From 35de9b83d8b0c39100fe7b850bbb630bdb302b38 Mon Sep 17 00:00:00 2001 From: Jeffrey Aven Date: Tue, 4 Aug 2026 14:39:39 +1000 Subject: [PATCH] okta updates --- providers/src/okta/v00.00.00000/provider.yaml | 78 +- .../src/okta/v00.00.00000/services/Org.yaml | 2284 ++- .../v00.00.00000/services/_well_known.yaml | 902 ++ .../v00.00.00000/services/agentpools.yaml | 311 +- .../v00.00.00000/services/api_tokens.yaml | 93 +- .../src/okta/v00.00.00000/services/apps.yaml | 5312 ++++--- .../services/attack_protection.yaml | 32 +- .../v00.00.00000/services/authenticators.yaml | 1002 +- .../services/authorizationservers.yaml | 2439 ++-- .../okta/v00.00.00000/services/behaviors.yaml | 102 +- .../v00.00.00000/services/bot_protection.yaml | 474 + .../okta/v00.00.00000/services/brands.yaml | 2032 +-- .../okta/v00.00.00000/services/captchas.yaml | 97 +- .../v00.00.00000/services/device_access.yaml | 326 - .../services/device_assurances.yaml | 420 +- .../services/device_integrations.yaml | 252 +- .../services/device_posture_checks.yaml | 120 +- .../okta/v00.00.00000/services/devices.yaml | 2342 ++- .../v00.00.00000/services/directories.yaml | 245 +- .../okta/v00.00.00000/services/domains.yaml | 253 +- .../src/okta/v00.00.00000/services/dr.yaml | 476 + .../v00.00.00000/services/email_domains.yaml | 128 +- .../v00.00.00000/services/email_servers.yaml | 529 +- .../v00.00.00000/services/eventhooks.yaml | 131 +- .../okta/v00.00.00000/services/features.yaml | 186 +- .../services/first_party_app_settings.yaml | 27 +- .../okta/v00.00.00000/services/groups.yaml | 3157 ++-- .../okta/v00.00.00000/services/hook_keys.yaml | 64 +- .../src/okta/v00.00.00000/services/iam.yaml | 1661 ++- .../services/identity_sources.yaml | 1523 +- .../src/okta/v00.00.00000/services/idps.yaml | 2361 +-- .../v00.00.00000/services/inlinehooks.yaml | 2398 +++- .../v00.00.00000/services/integrations.yaml | 376 +- .../src/okta/v00.00.00000/services/logs.yaml | 358 +- .../v00.00.00000/services/logstreams.yaml | 131 +- .../okta/v00.00.00000/services/mappings.yaml | 144 +- .../src/okta/v00.00.00000/services/meta.yaml | 11967 +++++++++++++++- .../okta/v00.00.00000/services/oauth2.yaml | 960 +- .../services/okta_personal_settings.yaml | 33 +- .../src/okta/v00.00.00000/services/orgs.yaml | 23 +- .../okta/v00.00.00000/services/policies.yaml | 5047 ++++--- .../services/principal_rate_limits.yaml | 56 +- .../services/privileged_access.yaml | 694 +- .../v00.00.00000/services/push_providers.yaml | 117 +- .../services/rate_limit_settings.yaml | 27 +- .../services/realm_assignments.yaml | 241 +- .../okta/v00.00.00000/services/realms.yaml | 124 +- .../src/okta/v00.00.00000/services/risk.yaml | 678 - .../src/okta/v00.00.00000/services/roles.yaml | 146 +- .../okta/v00.00.00000/services/security.yaml | 35 +- .../services/security_events_providers.yaml | 295 +- .../okta/v00.00.00000/services/sessions.yaml | 373 +- .../src/okta/v00.00.00000/services/ssf.yaml | 250 +- .../services/telephony_providers.yaml | 1044 ++ .../okta/v00.00.00000/services/templates.yaml | 71 +- .../okta/v00.00.00000/services/threats.yaml | 57 +- .../v00.00.00000/services/trustedorigins.yaml | 190 +- .../src/okta/v00.00.00000/services/users.yaml | 9095 +++++++----- .../services/webauthn_registration.yaml | 283 +- .../src/okta/v00.00.00000/services/zones.yaml | 197 +- 60 files changed, 45651 insertions(+), 19118 deletions(-) create mode 100644 providers/src/okta/v00.00.00000/services/_well_known.yaml create mode 100644 providers/src/okta/v00.00.00000/services/bot_protection.yaml delete mode 100644 providers/src/okta/v00.00.00000/services/device_access.yaml create mode 100644 providers/src/okta/v00.00.00000/services/dr.yaml delete mode 100644 providers/src/okta/v00.00.00000/services/risk.yaml create mode 100644 providers/src/okta/v00.00.00000/services/telephony_providers.yaml diff --git a/providers/src/okta/v00.00.00000/provider.yaml b/providers/src/okta/v00.00.00000/provider.yaml index efb63731..a340c94d 100644 --- a/providers/src/okta/v00.00.00000/provider.yaml +++ b/providers/src/okta/v00.00.00000/provider.yaml @@ -65,6 +65,15 @@ providerServices: title: behaviors API version: v00.00.00000 description: okta behaviors API + bot_protection: + id: bot_protection:v00.00.00000 + name: bot_protection + preferred: true + service: + $ref: okta/v00.00.00000/services/bot_protection.yaml + title: bot_protection API + version: v00.00.00000 + description: okta bot_protection API brands: id: brands:v00.00.00000 name: brands @@ -83,15 +92,15 @@ providerServices: title: captchas API version: v00.00.00000 description: okta captchas API - device_access: - id: device_access:v00.00.00000 - name: device_access + devices: + id: devices:v00.00.00000 + name: devices preferred: true service: - $ref: okta/v00.00.00000/services/device_access.yaml - title: device_access API + $ref: okta/v00.00.00000/services/devices.yaml + title: devices API version: v00.00.00000 - description: okta device_access API + description: okta devices API device_assurances: id: device_assurances:v00.00.00000 name: device_assurances @@ -119,15 +128,6 @@ providerServices: title: device_posture_checks API version: v00.00.00000 description: okta device_posture_checks API - devices: - id: devices:v00.00.00000 - name: devices - preferred: true - service: - $ref: okta/v00.00.00000/services/devices.yaml - title: devices API - version: v00.00.00000 - description: okta devices API directories: id: directories:v00.00.00000 name: directories @@ -146,6 +146,15 @@ providerServices: title: domains API version: v00.00.00000 description: okta domains API + dr: + id: dr:v00.00.00000 + name: dr + preferred: true + service: + $ref: okta/v00.00.00000/services/dr.yaml + title: dr API + version: v00.00.00000 + description: okta dr API email_domains: id: email_domains:v00.00.00000 name: email_domains @@ -371,15 +380,6 @@ providerServices: title: rate_limit_settings API version: v00.00.00000 description: okta rate_limit_settings API - realm_assignments: - id: realm_assignments:v00.00.00000 - name: realm_assignments - preferred: true - service: - $ref: okta/v00.00.00000/services/realm_assignments.yaml - title: realm_assignments API - version: v00.00.00000 - description: okta realm_assignments API realms: id: realms:v00.00.00000 name: realms @@ -389,15 +389,15 @@ providerServices: title: realms API version: v00.00.00000 description: okta realms API - risk: - id: risk:v00.00.00000 - name: risk + realm_assignments: + id: realm_assignments:v00.00.00000 + name: realm_assignments preferred: true service: - $ref: okta/v00.00.00000/services/risk.yaml - title: risk API + $ref: okta/v00.00.00000/services/realm_assignments.yaml + title: realm_assignments API version: v00.00.00000 - description: okta risk API + description: okta realm_assignments API roles: id: roles:v00.00.00000 name: roles @@ -443,6 +443,15 @@ providerServices: title: ssf API version: v00.00.00000 description: okta ssf API + telephony_providers: + id: telephony_providers:v00.00.00000 + name: telephony_providers + preferred: true + service: + $ref: okta/v00.00.00000/services/telephony_providers.yaml + title: telephony_providers API + version: v00.00.00000 + description: okta telephony_providers API templates: id: templates:v00.00.00000 name: templates @@ -497,6 +506,15 @@ providerServices: title: zones API version: v00.00.00000 description: okta zones API + _well_known: + id: _well_known:v00.00.00000 + name: _well_known + preferred: true + service: + $ref: okta/v00.00.00000/services/_well_known.yaml + title: _well_known API + version: v00.00.00000 + description: okta _well_known API config: auth: credentialsenvvar: OKTA_API_TOKEN diff --git a/providers/src/okta/v00.00.00000/services/Org.yaml b/providers/src/okta/v00.00.00000/services/Org.yaml index fd43cd5c..fa29bc7b 100644 --- a/providers/src/okta/v00.00.00000/services/Org.yaml +++ b/providers/src/okta/v00.00.00000/services/Org.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: org API description: okta org API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/org: get: @@ -112,11 +112,9 @@ paths: /api/v1/org/captcha: get: summary: Retrieve the org-wide CAPTCHA settings - description: >- + description: |- Retrieves the CAPTCHA settings object for your organization - - > **Note**: If the current organization hasn't configured CAPTCHA - Settings, the request returns an empty object. + > **Note**: If the current organization hasn't configured CAPTCHA Settings, the request returns an empty object. operationId: getOrgCaptchaSettings responses: '200': @@ -147,11 +145,9 @@ paths: - Okta Identity Engine put: summary: Replace the org-wide CAPTCHA settings - description: >- + description: |- Replaces the CAPTCHA settings object for your organization - - > **Note**: You can disable CAPTCHA for your organization by setting - `captchaId` and `enabledPages` to `null`. + > **Note**: You can disable CAPTCHA for your organization by setting `captchaId` and `enabledPages` to `null`. operationId: replacesOrgCaptchaSettings requestBody: content: @@ -237,9 +233,7 @@ paths: content: application/json: schema: - items: - $ref: '#/components/schemas/OrgContactTypeObj' - type: array + $ref: '#/components/schemas/ListOrgContactTypesResponse' examples: orgContactTypeEx: $ref: '#/components/examples/orgContactTypeResponse' @@ -259,9 +253,7 @@ paths: /api/v1/org/contacts/{contactType}: get: summary: Retrieve the contact type user - description: >- - Retrieves the ID and the user resource associated with the specified - contact type + description: Retrieves the ID and the user resource associated with the specified contact type operationId: getOrgContactUser responses: '200': @@ -288,6 +280,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathContactType' put: summary: Replace the contact type user description: Replaces the user associated with the specified contact type @@ -331,25 +325,18 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathContactType' + parameters: + - $ref: '#/components/parameters/pathContactType' /api/v1/org/email/bounces/remove-list: post: summary: Remove bounced emails - description: > + description: | Removes emails from an email service bounce list. + The emails submitted in this operation are removed from the bounce list by an asynchronous job. + Any email address that passes validation is accepted for the removal process, even if there are other email addresses in the request that failed validation. - The emails submitted in this operation are removed from the bounce list - by an asynchronous job. - - Any email address that passes validation is accepted for the removal - process, even if there are other email addresses in the request that - failed validation. - - - > **Note:** If there are validation errors for all email addresses, a - `200 OK` HTTP status is still returned. + > **Note:** If there are validation errors for all email addresses, a `200 OK` HTTP status is still returned. operationId: bulkRemoveEmailAddressBounces requestBody: content: @@ -367,23 +354,6 @@ paths: responses: '200': description: OK - content: - application/json: - schema: - $ref: '#/components/schemas/BouncesRemoveListResult' - examples: - example-1: - summary: Response example - value: - errors: - - emailAddress: unknown.email@okta.com - reason: >- - This email address does not belong to any user in your - organization. - - emailAddress: name@okta@com - reason: >- - Invalid email address. The provided email address - failed validation against RFC 3696. '400': $ref: '#/components/responses/ErrorApiValidationFailed400' '403': @@ -410,9 +380,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/UserFactorYubikeyOtpToken' + $ref: '#/components/schemas/ListYubikeyOtpTokensResponse' examples: ListYubikeyOptTokensResponse: $ref: '#/components/examples/ListYubikeyOptTokensResponse' @@ -431,6 +399,64 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - name: after + in: query + description: Specifies the pagination cursor for the next page of tokens + schema: + type: string + - name: expand + in: query + description: Embeds the [user](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/user) resource if the YubiKey token is assigned to a user and `expand` is set to `user` + schema: + type: string + - name: filter + in: query + description: The expression used to filter tokens + schema: + type: string + enum: + - profile.email + - profile.serial + - activated + - user.id + - created + - status + - lastVerified + - name: forDownload + in: query + description: Returns tokens in a CSV to download instead of in the response. When you use this query parameter, the `limit` default changes to 1000. + schema: + type: string + default: 'false' + - name: limit + in: query + description: Specifies the number of results per page + schema: + type: integer + default: 20 + maximum: 200 + - name: sortBy + in: query + description: The value of how the tokens are sorted + schema: + type: string + enum: + - profile.email + - profile.serial + - activated + - user.id + - created + - status + - lastVerified + - name: sortOrder + in: query + description: Specifies the sort order, either `ASC` or `DESC` + schema: + type: string + enum: + - ASC + - DESC post: summary: Upload a YubiKey OTP seed description: Uploads a seed for a user to enroll a YubiKey OTP @@ -452,9 +478,7 @@ paths: description: The YubiKey's private ID aesKey: type: string - description: >- - The cryptographic key used in the AES (Advanced Encryption - Standard) algorithm to encrypt and decrypt the YubiKey OTP + description: The cryptographic key used in the AES (Advanced Encryption Standard) algorithm to encrypt and decrypt the YubiKey OTP examples: uploadYubikeyOtpSeedRequest: $ref: '#/components/examples/UploadYubikeyTokenSeedRequest' @@ -486,69 +510,64 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - name: after - in: query - description: Specifies the pagination cursor for the next page of tokens - schema: - type: string - - name: expand - in: query - description: >- - Embeds the [user](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/) - resource if the YubiKey token is assigned to a user and `expand` is - set to `user` - schema: - type: string - - name: filter - in: query - description: The expression used to filter tokens - schema: - type: string - enum: - - profile.email - - profile.serial - - activated - - user.id - - created - - status - - lastVerified - - name: forDownload - in: query - description: >- - Returns tokens in a CSV to download instead of in the response. When - you use this query parameter, the `limit` default changes to 1000. - schema: - type: boolean - default: false - - name: limit - in: query - description: Specifies the number of results per page - schema: - type: integer - default: 20 - maximum: 200 - - name: sortBy - in: query - description: The value of how the tokens are sorted - schema: - type: string - enum: - - profile.email - - profile.serial - - activated - - user.id - - created - - status - - lastVerified - - name: sortOrder - in: query - description: Specifies the sort order, either `ASC` or `DESC` - schema: - type: string - enum: - - ASC - - DESC + parameters: + - name: after + in: query + description: Specifies the pagination cursor for the next page of tokens + schema: + type: string + - name: expand + in: query + description: Embeds the [user](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/user) resource if the YubiKey token is assigned to a user and `expand` is set to `user` + schema: + type: string + - name: filter + in: query + description: The expression used to filter tokens + schema: + type: string + enum: + - profile.email + - profile.serial + - activated + - user.id + - created + - status + - lastVerified + - name: forDownload + in: query + description: Returns tokens in a CSV to download instead of in the response. When you use this query parameter, the `limit` default changes to 1000. + schema: + type: string + default: 'false' + - name: limit + in: query + description: Specifies the number of results per page + schema: + type: integer + default: 20 + maximum: 200 + - name: sortBy + in: query + description: The value of how the tokens are sorted + schema: + type: string + enum: + - profile.email + - profile.serial + - activated + - user.id + - created + - status + - lastVerified + - name: sortOrder + in: query + description: Specifies the sort order, either `ASC` or `DESC` + schema: + type: string + enum: + - ASC + - DESC /api/v1/org/factors/yubikey_token/tokens/{tokenId}: get: summary: Retrieve a YubiKey OTP token @@ -586,55 +605,10 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/yubikeyTokenId' - /api/v1/org/logo: - post: - summary: Upload the org logo - description: Uploads and replaces the logo for your organization - operationId: uploadOrgLogo - requestBody: - content: - multipart/form-data: - schema: - type: object - properties: - file: - type: string - format: binary - description: >- - The file must be in PNG, JPG, or GIF format and less than 1 - MB in size. For best results use landscape orientation, a - transparent background, and a minimum size of 420px by 120px - to prevent upscaling. - required: - - file - description: logo file - responses: - '201': - description: Created - '400': - $ref: '#/components/responses/ErrorApiValidationFailed400' - '403': - $ref: '#/components/responses/ErrorAccessDenied403' - '429': - $ref: '#/components/responses/ErrorTooManyRequests429' - security: - - apiToken: [] - - oauth2: - - okta.apps.manage - tags: - - OrgSettingCustomization - x-okta-lifecycle: - lifecycle: GA - isGenerallyAvailable: true /api/v1/org/orgSettings/thirdPartyAdminSetting: get: summary: Retrieve the org third-party admin setting - description: >- - Retrieves the third-party admin setting. See [Configure third-party - administrators](https://help.okta.com/okta_help.htm?type=oie&id=csh_admin-third) - in the Okta product documentation. + description: Retrieves the third-party admin setting. See [Configure third-party administrators](https://help.okta.com/okta_help.htm?type=oie&id=csh_admin-third) in the Okta product documentation. operationId: getThirdPartyAdminSetting parameters: [] responses: @@ -659,18 +633,14 @@ paths: isGenerallyAvailable: true post: summary: Update the org third-party admin setting - description: > + description: | Updates the third-party admin setting. - - This setting allows third-party admins to perform administrative actions - in the Admin Console, but they can't do any of the following: + This setting allows third-party admins to perform administrative actions in the Admin Console, but they can't do any of the following: * Receive Okta admin email notifications * Contact Okta support * Sign in to the Okta Help Center - See [Configure third-party - administrators](https://help.okta.com/okta_help.htm?type=oie&id=csh_admin-third) - in the Okta product documentation. + See [Configure third-party administrators](https://help.okta.com/okta_help.htm?type=oie&id=csh_admin-third) in the Okta product documentation. operationId: updateThirdPartyAdminSetting parameters: [] requestBody: @@ -731,21 +701,12 @@ paths: /api/v1/org/preferences/hideEndUserFooter: post: summary: Set the hide dashboard footer preference - description: >- - Sets the preference to hide the Okta End-User Dashboard footer for all - end users of your org + description: Sets the preference to hide the Okta End-User Dashboard footer for all end users of your org operationId: setOrgHideOktaUIFooter parameters: [] responses: '200': description: Success - content: - application/json: - schema: - $ref: '#/components/schemas/OrgPreferences' - examples: - hideOrgPrefEx: - $ref: '#/components/examples/orgHideFooterPrefResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '429': @@ -762,21 +723,12 @@ paths: /api/v1/org/preferences/showEndUserFooter: post: summary: Set the show dashboard footer preference - description: >- - Sets the preference to show the Okta UI footer for all end users of your - org + description: Sets the preference to show the Okta UI footer for all end users of your org operationId: setOrgShowOktaUIFooter parameters: [] responses: '200': description: Success - content: - application/json: - schema: - $ref: '#/components/schemas/OrgPreferences' - examples: - showOrgPrefEx: - $ref: '#/components/examples/orgShowFooterPrefResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '429': @@ -795,9 +747,7 @@ paths: x-okta-iam-admin-roles: - SUPER_ADMIN summary: Retrieve Okta Aerial consent for your org - description: >- - Retrieves the Okta Aerial consent grant details for your Org. Returns a - 404 Not Found error if no consent has been granted. + description: Retrieves the Okta Aerial consent grant details for your Org. Returns a 404 Not Found error if no consent has been granted. operationId: getAerialConsent parameters: [] responses: @@ -822,9 +772,7 @@ paths: '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': - description: >- - Consent hasn't been given and there are no grants to any Aerial - Accounts + description: Consent hasn't been given and there are no grants to any Aerial Accounts content: application/json: schema: @@ -848,10 +796,7 @@ paths: x-okta-iam-admin-roles: - SUPER_ADMIN summary: Grant Okta Aerial access to your org - description: >- - Grants an Okta Aerial account consent to manage your org. If the org is - a child org, consent is taken from the parent org. Grant calls directly - to the child are not allowed. + description: Grants an Okta Aerial account consent to manage your org. If the org is a child org, consent is taken from the parent org. Grant calls directly to the child are not allowed. operationId: grantAerialConsent parameters: [] requestBody: @@ -861,9 +806,7 @@ paths: $ref: '#/components/schemas/OrgAerialConsent' examples: example-grant-call: - description: >- - Request body to grant an Okta Aerial account access to your - Org + description: Request body to grant an Okta Aerial account access to your Org value: accountId: 0200bs0617vvhv2v675mch1cukp responses: @@ -903,10 +846,7 @@ paths: x-okta-iam-admin-roles: - SUPER_ADMIN summary: Revoke Okta Aerial access to your org - description: >- - Revokes access of an Okta Aerial account to your Org. The revoke - operation will fail if the org has already been added to an Aerial - account. + description: Revokes access of an Okta Aerial account to your Org. The revoke operation will fail if the org has already been added to an Aerial account. operationId: revokeAerialConsent parameters: [] requestBody: @@ -986,13 +926,6 @@ paths: responses: '200': description: Success - content: - application/json: - schema: - $ref: '#/components/schemas/OrgOktaCommunicationSetting' - examples: - optInOktaCommSettingsEx: - $ref: '#/components/examples/orgCommunicationOptInResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '429': @@ -1015,13 +948,6 @@ paths: responses: '200': description: Success - content: - application/json: - schema: - $ref: '#/components/schemas/OrgOktaCommunicationSetting' - examples: - optOutOktaCommSettingsEx: - $ref: '#/components/examples/orgCommunicationOptOutResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '429': @@ -1052,8 +978,7 @@ paths: $ref: '#/components/schemas/OrgOktaSupportSettingsObj' examples: OktaSupportWithCaseNumberEx: - $ref: >- - #/components/examples/orgSupportSettingsWithCaseNumberResponse + $ref: '#/components/examples/orgSupportSettingsWithCaseNumberResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '429': @@ -1070,9 +995,7 @@ paths: /api/v1/org/privacy/oktaSupport/cases: get: summary: List all Okta Support cases - description: >- - Lists all Okta Support cases that the requesting principal has - permission to view + description: Lists all Okta Support cases that the requesting principal has permission to view operationId: listOktaSupportCases responses: '200': @@ -1104,17 +1027,12 @@ paths: x-okta-iam-admin-roles: - SUPER_ADMIN summary: Update an Okta Support case - description: >- + description: |- Updates access to the org for an Okta Support case: + * You can enable, disable, or extend access to your org for an Okta Support case. - * You can enable, disable, or extend access to your org for an Okta - Support case. - - - * You can approve Okta Support access to your org for self-assigned - cases. A self-assigned case is created and assigned by the same Okta - Support user. + * You can approve Okta Support access to your org for self-assigned cases. A self-assigned case is created and assigned by the same Okta Support user. operationId: updateOktaSupportCase requestBody: content: @@ -1159,26 +1077,19 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/caseNumber' + parameters: + - $ref: '#/components/parameters/caseNumber' /api/v1/org/privacy/oktaSupport/extend: post: deprecated: true x-okta-iam-admin-roles: - SUPER_ADMIN summary: Extend Okta Support access - description: >- - Extends the length of time that Okta Support can access your org by 24 - hours. This means that 24 hours are added to the remaining access time. - - - > **Note:** This resource is deprecated. Use the [Update an Okta Support - case](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/OrgSettingSupport/#tag/OrgSettingSupport/operation/updateOktaSupportCase) - resource to extend Okta Support access for a support case. + description: |- + Extends the length of time that Okta Support can access your org by 24 hours. This means that 24 hours are added to the remaining access time. - > For the corresponding Okta Admin Console feature, see [Give access to - Okta - Support](https://help.okta.com/okta_help.htm?type=oie&id=settings-support-access). + > **Note:** This resource is deprecated. Use the [Update an Okta Support case](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/orgsettingsupport/other/updateoktasupportcase) resource to extend Okta Support access for a support case. + > For the corresponding Okta Admin Console feature, see [Give access to Okta Support](https://help.okta.com/okta_help.htm?type=oie&id=settings-support-access). operationId: extendOktaSupport parameters: [] responses: @@ -1199,18 +1110,11 @@ paths: x-okta-iam-admin-roles: - SUPER_ADMIN summary: Grant Okta Support access - description: >- - Grants Okta Support temporary access to your org as an administrator for - eight hours + description: |- + Grants Okta Support temporary access to your org as an administrator for eight hours - - > **Note:** This resource is deprecated. Use the [Update an Okta Support - case](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/OrgSettingSupport/#tag/OrgSettingSupport/operation/updateOktaSupportCase) - resource to grant Okta Support access for a support case. - - > For the corresponding Okta Admin Console feature, see [Give access to - Okta - Support](https://help.okta.com/okta_help.htm?type=oie&id=settings-support-access). + > **Note:** This resource is deprecated. Use the [Update an Okta Support case](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/orgsettingsupport/other/updateoktasupportcase) resource to grant Okta Support access for a support case. + > For the corresponding Okta Admin Console feature, see [Give access to Okta Support](https://help.okta.com/okta_help.htm?type=oie&id=settings-support-access). operationId: grantOktaSupport parameters: [] responses: @@ -1231,17 +1135,11 @@ paths: x-okta-iam-admin-roles: - SUPER_ADMIN summary: Revoke Okta Support access - description: >- + description: |- Revokes Okta Support access to your org - - > **Note:** This resource is deprecated. Use the [Update an Okta Support - case](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/OrgSettingSupport/#tag/OrgSettingSupport/operation/updateOktaSupportCase) - resource to revoke Okta Support access for a support case. - - > For the corresponding Okta Admin Console feature, see [Give access to - Okta - Support](https://help.okta.com/okta_help.htm?type=oie&id=settings-support-access). + > **Note:** This resource is deprecated. Use the [Update an Okta Support case](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/orgsettingsupport/other/updateoktasupportcase) resource to revoke Okta Support access for a support case. + > For the corresponding Okta Admin Console feature, see [Give access to Okta Support](https://help.okta.com/okta_help.htm?type=oie&id=settings-support-access). operationId: revokeOktaSupport parameters: [] responses: @@ -1259,9 +1157,7 @@ paths: /api/v1/org/settings/autoAssignAdminAppSetting: get: summary: Retrieve the Okta Admin Console assignment setting - description: >- - Retrieves the org setting to automatically assign the Okta Admin Console - when an admin role is assigned + description: Retrieves the org setting to automatically assign the Okta Admin Console when an admin role is assigned operationId: getAutoAssignAdminAppSetting parameters: [] responses: @@ -1286,16 +1182,11 @@ paths: isGenerallyAvailable: true post: summary: Update the Okta Admin Console assignment setting - description: >- - Updates the org setting to automatically assign the Okta Admin Console - when an admin role is assigned - + description: |- + Updates the org setting to automatically assign the Okta Admin Console when an admin role is assigned > **Note:** This setting doesn't apply to the `SUPER_ADMIN` role. - - > When you assign the `SUPER_ADMIN` role to a user, the Admin Console is - always assigned to the user regardless of the - `autoAssignAdminAppSetting` setting. + > When you assign the `SUPER_ADMIN` role to a user, the Admin Console is always assigned to the user regardless of the `autoAssignAdminAppSetting` setting. operationId: updateAutoAssignAdminAppSetting requestBody: content: @@ -1325,10 +1216,7 @@ paths: /api/v1/org/settings/clientPrivilegesSetting: get: summary: Retrieve the default public client app role setting - description: >- - Retrieves the org setting to assign the [Super Admin - role](https://help.okta.com/okta_help.htm?type=oie&id=ext_superadmin) to - new public client apps + description: Retrieves the org setting to assign the [Super Admin role](https://help.okta.com/okta_help.htm?type=oie&id=ext_superadmin) to new public client apps operationId: getClientPrivilegesSetting parameters: [] responses: @@ -1353,10 +1241,7 @@ paths: isGenerallyAvailable: true put: summary: Assign the default public client app role setting - description: >- - Assigns the [Super Admin - role](https://help.okta.com/okta_help.htm?type=oie&id=ext_superadmin) as - the default role for new public client apps + description: Assigns the [Super Admin role](https://help.okta.com/okta_help.htm?type=oie&id=ext_superadmin) as the default role for new public client apps operationId: assignClientPrivilegesSetting requestBody: content: @@ -1486,31 +1371,57 @@ components: description: An Okta code for this type of error errorId: type: string - description: >- - A unique identifier for this error. This can be used by Okta Support - to help with troubleshooting. + description: A unique identifier for this error. This can be used by Okta Support to help with troubleshooting. errorLink: type: string description: An Okta code for this type of error errorSummary: type: string - description: >- - A short description of what caused this error. Sometimes this - contains dynamically-generated information about your specific - error. + description: A short description of what caused this error. Sometimes this contains dynamically-generated information about your specific error. OrgContactTypeObj: - anyOf: - - $ref: '#/components/schemas/orgBillingContactType' - - $ref: '#/components/schemas/orgTechnicalContactType' type: object properties: contactType: $ref: '#/components/schemas/OrgContactType' + _links: + type: object + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the org billing contact type object using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification + readOnly: true + properties: + billing: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the org billing [contact type user](https://developer.okta.com/docs/api/openapi/okta-management/management/orgsettingcontact/#tag/OrgSettingContact/operation/getOrgContactUser) resource discriminator: propertyName: contactType mapping: BILLING: '#/components/schemas/orgBillingContactType' TECHNICAL: '#/components/schemas/orgTechnicalContactType' + x-okta-ignore-redocly-rules-for-sdk: true + description: Org billing contact OrgContactUser: type: object properties: @@ -1519,12 +1430,7 @@ components: description: Contact user ID _links: type: object - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the - contact type user object using the [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the contact type user object using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification readOnly: true properties: user: @@ -1534,9 +1440,7 @@ components: properties: emailAddresses: type: array - description: >- - A list of email addresses to remove from the email-service bounce - list + description: A list of email addresses to remove from the email-service bounce list items: type: string description: Email address @@ -1545,12 +1449,11 @@ components: properties: errors: type: array - description: >- - A list of emails that wasn't added to the email-bounced remove list - and the error reason + description: A list of emails that wasn't added to the email-bounced remove list and the error reason items: $ref: '#/components/schemas/BouncesRemoveListError' UserFactorYubikeyOtpToken: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: created: @@ -1608,6 +1511,7 @@ components: description: Indicates if the third-party admin functionality is enabled example: false OrgPreferences: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: showEndUserFooter: @@ -1616,22 +1520,63 @@ components: readOnly: true _links: type: object - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for this - object using the [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for this object using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification readOnly: true properties: hideEndUserFooter: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to hide the footer in the End-User Dashboard + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to hide the footer in the End-User Dashboard showEndUserFooter: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to show the footer on the End-User Dashboard + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to show the footer on the End-User Dashboard OrgAerialConsentDetails: type: object properties: @@ -1664,6 +1609,7 @@ components: _links: $ref: '#/components/schemas/LinksAerialConsentRevoked' OrgOktaCommunicationSetting: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: optOutEmailUsers: @@ -1672,23 +1618,65 @@ components: readOnly: true _links: type: object - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for this - object using the [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for this object using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification readOnly: true properties: optIn: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to opt users in to communication emails + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to opt users in to communication emails optOut: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to opt users out of communication emails + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to opt users out of communication emails OrgOktaSupportSettingsObj: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: caseNumber: @@ -1706,44 +1694,144 @@ components: $ref: '#/components/schemas/OrgOktaSupportSetting' _links: type: object - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the - Okta Support Settings object using the [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the Okta Support Settings object using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification readOnly: true properties: extend: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: >- - Link to [extend Okta Support - Access](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/OrgSettingSupport/#tag/OrgSettingSupport/operation/extendOktaSupport) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to [extend Okta Support Access](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/orgsettingsupport/other/extendoktasupport) revoke: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: >- - Link to [revoke Okta Support - Access](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/OrgSettingSupport/#tag/OrgSettingSupport/operation/revokeOktaSupport) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to [revoke Okta Support Access](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/orgsettingsupport/other/revokeoktasupport) grant: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: >- - Link to [grant Okta Support - Access](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/OrgSettingSupport/#tag/OrgSettingSupport/operation/grantOktaSupport) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to [grant Okta Support Access](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/orgsettingsupport/other/grantoktasupport) case: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: >- - Link to [update an Okta Support - case](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/OrgSettingSupport/#tag/OrgSettingSupport/operation/updateOktaSupportCase) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to [update an Okta Support case](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/orgsettingsupport/other/updateoktasupportcase) cases: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: >- - Link to [List all Okta Support - cases](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/OrgSettingSupport/#tag/OrgSettingSupport/operation/listOktaSupportCases) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to [List all Okta Support cases](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/orgsettingsupport/other/listoktasupportcases) OktaSupportCases: type: object properties: @@ -1760,9 +1848,7 @@ components: readOnly: true impersonation: type: object - description: >- - Allows the Okta Support team to sign in to your org as an admin and - troubleshoot issues + description: Allows the Okta Support team to sign in to your org as an admin and troubleshoot issues properties: status: $ref: '#/components/schemas/OktaSupportAccessStatus' @@ -1773,10 +1859,7 @@ components: nullable: true selfAssigned: type: object - description: >- - Customer allows Okta Support access to self-assigned cases. Support - cases are self-assigned when an Okta Support team member creates and - assigns the case to themselves. + description: Customer allows Okta Support access to self-assigned cases. Support cases are self-assigned when an Okta Support team member creates and assigns the case to themselves. properties: status: $ref: '#/components/schemas/SelfAssignedStatus' @@ -1785,76 +1868,187 @@ components: description: Subject of the support case readOnly: true AutoAssignAdminAppSetting: - description: >- - The org setting that automatically assigns the Okta Admin Console when - an admin role is assigned + description: The org setting that automatically assigns the Okta Admin Console when an admin role is assigned type: object properties: autoAssignAdminAppSetting: type: boolean - description: >- - Automatically assigns the Okta Admin Console to the user when an - admin role is assigned + description: Automatically assigns the Okta Admin Console to the user when an admin role is assigned ClientPrivilegesSetting: - description: >- - The org setting that assigns the super admin role by default to a public - client app + description: The org setting that assigns the super admin role by default to a public client app type: object properties: clientPrivilegesSetting: type: boolean - description: >- - If true, assigns the super admin role by default to new public - client apps + description: If true, assigns the super admin role by default to new public client apps example: true orgGeneralSettingLinks: - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the org - using the [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification + x-okta-ignore-redocly-rules-for-sdk: true + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the org using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification type: object properties: contacts: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: >- - Link to the [Org - Contacts](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/OrgSettingContact/) - resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the [Org Contacts](https://developer.okta.com/docs/api/openapi/okta-management/management/orgsettingcontact/) resource logo: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the org logo + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the org logo oktaCommunication: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: >- - Link to the [Org Communication - Settings](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/OrgSettingCommunication/) - resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the [Org Communication Settings](https://developer.okta.com/docs/api/openapi/okta-management/management/orgsettingcommunication/) resource oktaSupport: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: >- - Link to the [Org Support - Settings](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/OrgSettingSupport/) - resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the [Org Support Settings](https://developer.okta.com/docs/api/openapi/okta-management/management/orgsettingsupport/) resource preferences: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: >- - Link to the [Org - Preferences](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/OrgSettingCustomization/#tag/OrgSettingCustomization/operation/getOrgPreferences) - resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the [Org Preferences](https://developer.okta.com/docs/api/openapi/okta-management/management/orgsettingcustomization/getorgpreferences) resource uploadLogo: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: >- - Link to the [Upload Org - Logo](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/OrgSettingCustomization/#tag/OrgSettingCustomization/operation/uploadOrgLogo) - resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the [Upload Org Logo](https://developer.okta.com/docs/api/openapi/okta-management/management/orgsettingcustomization) resource readOnly: true enabledPagesType: title: enabledPages @@ -1868,6 +2062,7 @@ components: SSPR: Self-service Password Recovery page SSR: Self-service Registration page HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object additionalProperties: true type: object @@ -1884,15 +2079,11 @@ components: readOnly: true templated: type: boolean - description: >- - Indicates whether the link object's `href` property is a URI - template. + description: Indicates whether the link object's `href` property is a URI template. readOnly: true type: type: string - description: >- - The media type of the link. If omitted, it is implicitly - `application/json`. + description: The media type of the link. If omitted, it is implicitly `application/json`. readOnly: true required: - href @@ -1902,6 +2093,7 @@ components: errorSummary: type: string orgBillingContactType: + x-okta-ignore-redocly-rules-for-sdk: true description: Org billing contact type: object properties: @@ -1909,23 +2101,38 @@ components: $ref: '#/components/schemas/OrgContactType' _links: type: object - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the - org billing contact type object using the [JSON Hypertext - Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the org billing contact type object using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification readOnly: true properties: billing: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: >- - Link to the org billing [contact type - user](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/OrgSettingContact/#tag/OrgSettingContact/operation/getOrgContactUser) - resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the org billing [contact type user](https://developer.okta.com/docs/api/openapi/okta-management/management/orgsettingcontact/#tag/OrgSettingContact/operation/getOrgContactUser) resource orgTechnicalContactType: + x-okta-ignore-redocly-rules-for-sdk: true description: Org technical contact type: object properties: @@ -1933,22 +2140,36 @@ components: $ref: '#/components/schemas/OrgContactType' _links: type: object - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the - org technical Contact Type object using the [JSON Hypertext - Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the org technical Contact Type object using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification readOnly: true properties: technical: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: >- - Link to the org technical [Contact Type - User](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/OrgSettingContact/#tag/OrgSettingContact/operation/getOrgContactUser) - resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the org technical [Contact Type User](https://developer.okta.com/docs/api/openapi/okta-management/management/orgsettingcontact/#tag/OrgSettingContact/operation/getOrgContactUser) resource OrgContactType: description: Type of contact type: string @@ -1956,9 +2177,32 @@ components: - BILLING - TECHNICAL HrefObjectUserLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the user resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the user resource BouncesRemoveListError: type: object properties: @@ -1969,34 +2213,352 @@ components: type: string description: Validation error reason UserFactorLinks: - allOf: - - $ref: '#/components/schemas/LinksActivate' - - $ref: '#/components/schemas/LinksCancel' - - $ref: '#/components/schemas/LinksDeactivate' - - $ref: '#/components/schemas/LinksEnroll' - - $ref: '#/components/schemas/LinksFactor' - - $ref: '#/components/schemas/LinksPoll' - - $ref: '#/components/schemas/LinksQrcode' - - $ref: '#/components/schemas/LinksQuestions' - - $ref: '#/components/schemas/LinksResend' - - $ref: '#/components/schemas/LinksSend' - - $ref: '#/components/schemas/LinksSelf' - - $ref: '#/components/schemas/LinksUser' - - $ref: '#/components/schemas/LinksVerify' readOnly: true - LinksAerialConsentGranted: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - type: object + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + activate: + description: Activates an enrolled factor. See [Activate a factor](https://developer.okta.com/docs/api/openapi/okta-management/management/userfactor/activatefactor). + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object properties: - revoke: - $ref: '#/components/schemas/HrefObjectRevokeAerialConsent' - LinksAerialConsentRevoked: - allOf: - - type: object + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + cancel: + description: Cancels a `push` factor challenge with a `WAITING` status + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object properties: - grant: - $ref: '#/components/schemas/HrefObjectGrantAerialConsent' + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + deactivate: + description: Deactivates the factor. See [Unenroll a factor](https://developer.okta.com/docs/api/openapi/okta-management/management/userfactor/unenrollfactor). + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + enroll: + description: Enrolls a supported factor. See [Enroll a factor](https://developer.okta.com/docs/api/openapi/okta-management/management/userfactor/enrollfactor). + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + factor: + description: Link to the factor resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + poll: + description: Polls the factor resource for status information. Always use the `poll` link instead of manually constructing your own URL. + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + qrcode: + description: QR code that encodes the push activation code needed for enrollment on the device + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + question: + description: Lists all supported security questions. See [List all supported security questions](https://developer.okta.com/docs/api/openapi/okta-management/management/userfactor/listsupportedsecurityquestions). + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + resend: + description: Resends the factor enrollment challenge. See [Resend a factor enrollment](https://developer.okta.com/docs/api/openapi/okta-management/management/userfactor/resendenrollfactor). + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + send: + description: Sends an activation link through email or sms for users who can't scan the QR code + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + user: + description: Returns information on the specified user + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + verify: + description: Verifies the factor resource. See [Verify a factor](https://developer.okta.com/docs/api/openapi/okta-management/management/userfactor/verifyfactor). + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + LinksAerialConsentGranted: + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + revoke: + $ref: '#/components/schemas/HrefObjectRevokeAerialConsent' + readOnly: true + LinksAerialConsentRevoked: + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + grant: + $ref: '#/components/schemas/HrefObjectGrantAerialConsent' OrgOktaSupportSetting: description: Status of Okta Support Settings type: string @@ -2024,13 +2586,9 @@ components: - NOT_REQUIRED - REQUESTED x-enumDescriptions: - NOT_REQUIRED: >- - Approval isn't required because the case wasn't self-created and - self-assigned by an Okta Support user + NOT_REQUIRED: Approval isn't required because the case wasn't self-created and self-assigned by an Okta Support user REQUESTED: Customer approval for self-assigned case requested - APPROVED: >- - Okta Support access is approved by the customer for the self-assigned - case + APPROVED: Okta Support access is approved by the customer for the self-assigned case HrefHints: description: Describes allowed HTTP verbs for the `href` type: object @@ -2040,141 +2598,450 @@ components: items: $ref: '#/components/schemas/HttpMethod' LinksActivate: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: activate: - allOf: - - description: >- - Activates an enrolled factor. See [Activate a - factor](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/activateFactor). - - $ref: '#/components/schemas/HrefObject' + description: Activates an enrolled factor. See [Activate a factor](https://developer.okta.com/docs/api/openapi/okta-management/management/userfactor/activatefactor). + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href readOnly: true LinksCancel: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: cancel: - allOf: - - description: Cancels a `push` factor challenge with a `WAITING` status - - $ref: '#/components/schemas/HrefObject' + description: Cancels a `push` factor challenge with a `WAITING` status + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href readOnly: true LinksDeactivate: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: deactivate: - allOf: - - description: >- - Deactivates the factor. See [Unenroll a - factor](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/unenrollFactor). - - $ref: '#/components/schemas/HrefObject' + description: Deactivates the factor. See [Unenroll a factor](https://developer.okta.com/docs/api/openapi/okta-management/management/userfactor/unenrollfactor). + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href readOnly: true LinksEnroll: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: enroll: - allOf: - - description: >- - Enrolls a supported factor. See [Enroll a - factor](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/enrollFactor). - - $ref: '#/components/schemas/HrefObject' + description: Enrolls a supported factor. See [Enroll a factor](https://developer.okta.com/docs/api/openapi/okta-management/management/userfactor/enrollfactor). + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href readOnly: true LinksFactor: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: factor: - allOf: - - description: Link to the factor resource - - $ref: '#/components/schemas/HrefObject' + description: Link to the factor resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href readOnly: true LinksPoll: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: poll: - allOf: - - description: >- - Polls the factor resource for status information. Always use the - `poll` link instead of manually constructing your own URL. - - $ref: '#/components/schemas/HrefObject' + description: Polls the factor resource for status information. Always use the `poll` link instead of manually constructing your own URL. + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href readOnly: true LinksQrcode: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: qrcode: - allOf: - - description: >- - QR code that encodes the push activation code needed for - enrollment on the device - - $ref: '#/components/schemas/HrefObject' + description: QR code that encodes the push activation code needed for enrollment on the device + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href readOnly: true LinksQuestions: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: question: - allOf: - - description: >- - Lists all supported security questions. See [List all supported - security - questions](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/listSupportedSecurityQuestions). - - $ref: '#/components/schemas/HrefObject' + description: Lists all supported security questions. See [List all supported security questions](https://developer.okta.com/docs/api/openapi/okta-management/management/userfactor/listsupportedsecurityquestions). + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href readOnly: true LinksResend: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: resend: - allOf: - - description: >- - Resends the factor enrollment challenge. See [Resend a factor - enrollment](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/resendEnrollFactor). - - $ref: '#/components/schemas/HrefObject' + description: Resends the factor enrollment challenge. See [Resend a factor enrollment](https://developer.okta.com/docs/api/openapi/okta-management/management/userfactor/resendenrollfactor). + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href readOnly: true LinksSend: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: send: - allOf: - - description: >- - Sends an activation link through email or sms for users who - can't scan the QR code - - $ref: '#/components/schemas/HrefObject' + description: Sends an activation link through email or sms for users who can't scan the QR code + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href readOnly: true LinksSelf: - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the - [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. This object is used for dynamic discovery of related - resources and lifecycle operations. + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. type: object properties: self: $ref: '#/components/schemas/HrefObjectSelfLink' readOnly: true - LinksUser: + LinksUserFactors: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: user: - allOf: - - description: Returns information on the specified user - - $ref: '#/components/schemas/HrefObject' + description: Returns information on the specified user + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href readOnly: true LinksVerify: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: verify: - allOf: - - description: >- - Verifies the factor resource. See [Verify a - factor](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/verifyFactor). - - $ref: '#/components/schemas/HrefObject' + description: Verifies the factor resource. See [Verify a factor](https://developer.okta.com/docs/api/openapi/okta-management/management/userfactor/verifyfactor). + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href readOnly: true HrefObjectRevokeAerialConsent: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to revoke Okta Aerial consent for your Org + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to revoke Okta Aerial consent for your Org HrefObjectGrantAerialConsent: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to grant Okta Aerial access to your Org + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to grant Okta Aerial access to your Org HttpMethod: type: string enum: @@ -2183,9 +3050,46 @@ components: - POST - PUT HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) + ListOrgContactTypesResponse: + type: object + properties: + org_contact_types: + type: array + items: + $ref: '#/components/schemas/OrgContactTypeObj' + ListYubikeyOtpTokensResponse: + type: object + properties: + yubikey_otp_tokens: + type: array + items: + $ref: '#/components/schemas/UserFactorYubikeyOtpToken' responses: ErrorAccessDenied403: description: Forbidden @@ -2379,11 +3283,7 @@ components: errorLink: E0000001 errorId: oae-hk3rssXQmOWDRsaFfxe8A errorCauses: - errorSummary: >- - captchaId: Invalid CAPTCHA ID. The value of captchaId cannot be - blank when enabledPages is not empty. Please resubmit with an - existing CAPTCHA ID or disable CAPTCHA support on all supported - pages. + errorSummary: 'captchaId: Invalid CAPTCHA ID. The value of captchaId cannot be blank when enabledPages is not empty. Please resubmit with an existing CAPTCHA ID or disable CAPTCHA support on all supported pages.' orgContactTypeResponse: summary: Org contact types value: @@ -2414,8 +3314,7 @@ components: serial: '000003632071' _links: self: - href: >- - https://{yourOktaDomain}/api/v1/org/factors/yubikey_token/tokens/ykkwcx13nrDq8g4oy0g3 + href: https://{yourOktaDomain}/api/v1/org/factors/yubikey_token/tokens/ykkwcx13nrDq8g4oy0g3 hints: allow: - GET @@ -2430,8 +3329,7 @@ components: serial: '000009508427' _links: self: - href: >- - https://{yourOktaDomain}/api/v1/org/factors/yubikey_token/tokens/ykkxdtCA1fKVxyu6R0g3 + href: https://{yourOktaDomain}/api/v1/org/factors/yubikey_token/tokens/ykkxdtCA1fKVxyu6R0g3 hints: allow: - GET @@ -2441,8 +3339,7 @@ components: allow: - GET deactivate: - href: >- - https://{yourOktaDomain}/api/v1/users/00uu0x8sxTr9HcHOo0g3/factors/ykfxduQAhl89YyPrV0g3 + href: https://{yourOktaDomain}/api/v1/users/00uu0x8sxTr9HcHOo0g3/factors/ykfxduQAhl89YyPrV0g3 hints: allow: - DELETE @@ -2464,8 +3361,7 @@ components: serial: '000007886622' _links: self: - href: >- - https://{yourOktaDomain}/api/v1/org/factors/yubikey_token/tokens/ykkut4G6ti62DD8Dy0g3 + href: https://{yourOktaDomain}/api/v1/org/factors/yubikey_token/tokens/ykkut4G6ti62DD8Dy0g3 hints: allow: - GET @@ -2483,8 +3379,7 @@ components: serial: '000009508427' _links: self: - href: >- - https://{yourOktaDomain}/api/v1/org/factors/yubikey_token/tokens/ykkxdtCA1fKVxyu6R0g3 + href: https://{yourOktaDomain}/api/v1/org/factors/yubikey_token/tokens/ykkxdtCA1fKVxyu6R0g3 hints: allow: - GET @@ -2494,8 +3389,7 @@ components: allow: - GET deactivate: - href: >- - https://{yourOktaDomain}/api/v1/users/00uu0x8sxTr9HcHOo0g3/factors/ykfxduQAhl89YyPrV0g3 + href: https://{yourOktaDomain}/api/v1/users/00uu0x8sxTr9HcHOo0g3/factors/ykfxduQAhl89YyPrV0g3 hints: allow: - DELETE @@ -2566,8 +3460,7 @@ components: optOutEmailUsers: true _links: optIn: - href: >- - https://{yourOktaDomain}/api/v1/org/privacy/oktaCommunication/optIn + href: https://{yourOktaDomain}/api/v1/org/privacy/oktaCommunication/optIn hints: allow: - POST @@ -2577,8 +3470,7 @@ components: optOutEmailUsers: false _links: optOut: - href: >- - https://{yourOktaDomain}/api/v1/org/privacy/oktaCommunication/optOut + href: https://{yourOktaDomain}/api/v1/org/privacy/oktaCommunication/optOut hints: allow: - POST @@ -2590,8 +3482,7 @@ components: caseNumber: '20000144' _links: case: - href: >- - https://{yourOktaDomain}/api/v1/org/privacy/oktaSupport/case/{caseNumber} + href: https://{yourOktaDomain}/api/v1/org/privacy/oktaSupport/case/{caseNumber} hints: allow: - PATCH @@ -2709,12 +3600,18 @@ components: mediaType: application/json openAPIDocKey: '200' update_org_settings: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1org/post' response: mediaType: application/json openAPIDocKey: '200' replace_org_settings: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1org/put' response: @@ -2725,12 +3622,10 @@ components: - $ref: '#/components/x-stackQL-resources/settings/methods/get_org_settings' insert: [] update: - - $ref: >- - #/components/x-stackQL-resources/settings/methods/update_org_settings + - $ref: '#/components/x-stackQL-resources/settings/methods/update_org_settings' delete: [] replace: - - $ref: >- - #/components/x-stackQL-resources/settings/methods/replace_org_settings + - $ref: '#/components/x-stackQL-resources/settings/methods/replace_org_settings' captcha_settings: id: okta.org.captcha_settings name: captcha_settings @@ -2743,6 +3638,9 @@ components: mediaType: application/json openAPIDocKey: '200' replaces_org_captcha_settings: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1org~1captcha/put' response: @@ -2752,20 +3650,17 @@ components: operation: $ref: '#/paths/~1api~1v1~1org~1captcha/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/captcha_settings/methods/get_org_captcha_settings + - $ref: '#/components/x-stackQL-resources/captcha_settings/methods/get_org_captcha_settings' insert: [] update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/captcha_settings/methods/delete_org_captcha_settings + - $ref: '#/components/x-stackQL-resources/captcha_settings/methods/delete_org_captcha_settings' replace: - - $ref: >- - #/components/x-stackQL-resources/captcha_settings/methods/replaces_org_captcha_settings + - $ref: '#/components/x-stackQL-resources/captcha_settings/methods/replaces_org_captcha_settings' contact_types: id: okta.org.contact_types name: contact_types @@ -2777,10 +3672,18 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.org_contact_types + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListOrgContactTypesResponse' + transform: + body: |- + {{- $wrapped := printf "{\"org_contact_types\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/contact_types/methods/list_org_contact_types + - $ref: '#/components/x-stackQL-resources/contact_types/methods/list_org_contact_types' insert: [] update: [] delete: [] @@ -2797,6 +3700,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_org_contact_user: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1org~1contacts~1{contactType}/put' response: @@ -2804,20 +3710,21 @@ components: openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/contacts/methods/get_org_contact_user + - $ref: '#/components/x-stackQL-resources/contacts/methods/get_org_contact_user' insert: [] update: [] delete: [] replace: - - $ref: >- - #/components/x-stackQL-resources/contacts/methods/replace_org_contact_user + - $ref: '#/components/x-stackQL-resources/contacts/methods/replace_org_contact_user' email_customizations: id: okta.org.email_customizations name: email_customizations title: Email Customizations methods: bulk_remove_email_address_bounces: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1org~1email~1bounces~1remove-list/post' response: @@ -2840,7 +3747,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.yubikey_otp_tokens + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListYubikeyOtpTokensResponse' + transform: + body: |- + {{- $wrapped := printf "{\"yubikey_otp_tokens\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 upload_yubikey_otp_token_seed: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1org~1factors~1yubikey_token~1tokens/post' response: @@ -2848,32 +3767,51 @@ components: openAPIDocKey: '200' get_yubikey_otp_token_by_id: operation: - $ref: >- - #/paths/~1api~1v1~1org~1factors~1yubikey_token~1tokens~1{tokenId}/get + $ref: '#/paths/~1api~1v1~1org~1factors~1yubikey_token~1tokens~1{tokenId}/get' response: mediaType: application/json openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/yubikey_otp_tokens/methods/list_yubikey_otp_tokens - - $ref: >- - #/components/x-stackQL-resources/yubikey_otp_tokens/methods/get_yubikey_otp_token_by_id + - $ref: '#/components/x-stackQL-resources/yubikey_otp_tokens/methods/get_yubikey_otp_token_by_id' + - $ref: '#/components/x-stackQL-resources/yubikey_otp_tokens/methods/list_yubikey_otp_tokens' insert: [] update: [] delete: [] replace: [] + third_party_admin_setting: + id: okta.org.third_party_admin_setting + name: third_party_admin_setting + title: Third Party Admin Setting + methods: + get_third_party_admin_setting: + operation: + $ref: '#/paths/~1api~1v1~1org~1orgSettings~1thirdPartyAdminSetting/get' + response: + mediaType: application/json + openAPIDocKey: '200' + update_third_party_admin_setting: + config: + requestBodyTranslate: + algorithm: naive + operation: + $ref: '#/paths/~1api~1v1~1org~1orgSettings~1thirdPartyAdminSetting/post' + response: + mediaType: application/json + openAPIDocKey: '200' + sqlVerbs: + select: + - $ref: '#/components/x-stackQL-resources/third_party_admin_setting/methods/get_third_party_admin_setting' + insert: [] + update: + - $ref: '#/components/x-stackQL-resources/third_party_admin_setting/methods/update_third_party_admin_setting' + delete: [] + replace: [] preferences: id: okta.org.preferences name: preferences title: Preferences methods: - upload_org_logo: - operation: - $ref: '#/paths/~1api~1v1~1org~1logo/post' - response: - mediaType: '' - openAPIDocKey: '201' get_org_preferences: operation: $ref: '#/paths/~1api~1v1~1org~1preferences/get' @@ -2894,39 +3832,11 @@ components: openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/preferences/methods/get_org_preferences + - $ref: '#/components/x-stackQL-resources/preferences/methods/get_org_preferences' insert: [] update: [] delete: [] replace: [] - third_party_admin_setting: - id: okta.org.third_party_admin_setting - name: third_party_admin_setting - title: Third Party Admin Setting - methods: - get_third_party_admin_setting: - operation: - $ref: '#/paths/~1api~1v1~1org~1orgSettings~1thirdPartyAdminSetting/get' - response: - mediaType: application/json - openAPIDocKey: '200' - update_third_party_admin_setting: - operation: - $ref: '#/paths/~1api~1v1~1org~1orgSettings~1thirdPartyAdminSetting/post' - response: - mediaType: application/json - openAPIDocKey: '200' - sqlVerbs: - select: - - $ref: >- - #/components/x-stackQL-resources/third_party_admin_setting/methods/get_third_party_admin_setting - insert: [] - update: - - $ref: >- - #/components/x-stackQL-resources/third_party_admin_setting/methods/update_third_party_admin_setting - delete: [] - replace: [] support_aerial_consent: id: okta.org.support_aerial_consent name: support_aerial_consent @@ -2939,12 +3849,18 @@ components: mediaType: application/json openAPIDocKey: '200' grant_aerial_consent: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1org~1privacy~1aerial~1grant/post' response: mediaType: application/json openAPIDocKey: '200' revoke_aerial_consent: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1org~1privacy~1aerial~1revoke/post' response: @@ -2952,15 +3868,12 @@ components: openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/support_aerial_consent/methods/get_aerial_consent + - $ref: '#/components/x-stackQL-resources/support_aerial_consent/methods/get_aerial_consent' insert: - - $ref: >- - #/components/x-stackQL-resources/support_aerial_consent/methods/grant_aerial_consent + - $ref: '#/components/x-stackQL-resources/support_aerial_consent/methods/grant_aerial_consent' update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/support_aerial_consent/methods/revoke_aerial_consent + - $ref: '#/components/x-stackQL-resources/support_aerial_consent/methods/revoke_aerial_consent' replace: [] communication_settings: id: okta.org.communication_settings @@ -2987,8 +3900,7 @@ components: openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/communication_settings/methods/get_okta_communication_settings + - $ref: '#/components/x-stackQL-resources/communication_settings/methods/get_okta_communication_settings' insert: [] update: [] delete: [] @@ -3006,8 +3918,7 @@ components: openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/support_settings/methods/get_org_okta_support_settings + - $ref: '#/components/x-stackQL-resources/support_settings/methods/get_org_okta_support_settings' insert: [] update: [] delete: [] @@ -3024,55 +3935,22 @@ components: mediaType: application/json openAPIDocKey: '200' update_okta_support_case: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1org~1privacy~1oktaSupport~1cases~1{caseNumber}/patch + $ref: '#/paths/~1api~1v1~1org~1privacy~1oktaSupport~1cases~1{caseNumber}/patch' response: mediaType: application/json openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/support_cases/methods/list_okta_support_cases + - $ref: '#/components/x-stackQL-resources/support_cases/methods/list_okta_support_cases' insert: [] update: - - $ref: >- - #/components/x-stackQL-resources/support_cases/methods/update_okta_support_case + - $ref: '#/components/x-stackQL-resources/support_cases/methods/update_okta_support_case' delete: [] replace: [] - okta_support: - id: okta.org.okta_support - name: okta_support - title: Okta Support - methods: - extend_okta_support: - operation: - $ref: '#/paths/~1api~1v1~1org~1privacy~1oktaSupport~1extend/post' - response: - mediaType: '' - openAPIDocKey: '' - grant_okta_support: - operation: - $ref: '#/paths/~1api~1v1~1org~1privacy~1oktaSupport~1grant/post' - response: - mediaType: '' - openAPIDocKey: '' - revoke_okta_support: - operation: - $ref: '#/paths/~1api~1v1~1org~1privacy~1oktaSupport~1revoke/post' - response: - mediaType: '' - openAPIDocKey: '' - sqlVerbs: - select: [] - insert: - - $ref: >- - #/components/x-stackQL-resources/okta_support/methods/grant_okta_support - update: [] - delete: - - $ref: >- - #/components/x-stackQL-resources/okta_support/methods/revoke_okta_support - replace: [] auto_assign_admin_app_setting: id: okta.org.auto_assign_admin_app_setting name: auto_assign_admin_app_setting @@ -3085,6 +3963,9 @@ components: mediaType: application/json openAPIDocKey: '200' update_auto_assign_admin_app_setting: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1org~1settings~1autoAssignAdminAppSetting/post' response: @@ -3092,12 +3973,10 @@ components: openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/auto_assign_admin_app_setting/methods/get_auto_assign_admin_app_setting + - $ref: '#/components/x-stackQL-resources/auto_assign_admin_app_setting/methods/get_auto_assign_admin_app_setting' insert: [] update: - - $ref: >- - #/components/x-stackQL-resources/auto_assign_admin_app_setting/methods/update_auto_assign_admin_app_setting + - $ref: '#/components/x-stackQL-resources/auto_assign_admin_app_setting/methods/update_auto_assign_admin_app_setting' delete: [] replace: [] client_privileges_setting: @@ -3112,6 +3991,9 @@ components: mediaType: application/json openAPIDocKey: '200' assign_client_privileges_setting: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1org~1settings~1clientPrivilegesSetting/put' response: @@ -3119,20 +4001,26 @@ components: openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/client_privileges_setting/methods/get_client_privileges_setting + - $ref: '#/components/x-stackQL-resources/client_privileges_setting/methods/get_client_privileges_setting' insert: [] update: [] delete: [] replace: - - $ref: >- - #/components/x-stackQL-resources/client_privileges_setting/methods/assign_client_privileges_setting + - $ref: '#/components/x-stackQL-resources/client_privileges_setting/methods/assign_client_privileges_setting' servers: - url: https://{subdomain}.okta.com/ variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/_well_known.yaml b/providers/src/okta/v00.00.00000/services/_well_known.yaml new file mode 100644 index 00000000..701645e1 --- /dev/null +++ b/providers/src/okta/v00.00.00000/services/_well_known.yaml @@ -0,0 +1,902 @@ +openapi: 3.0.3 +info: + title: _well_known API + description: okta _well_known API + version: 2026.07.2 +paths: + /.well-known/app-authenticator-configuration: + get: + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: [] + summary: Retrieve the well-known app authenticator configuration + description: >- + Retrieves the well-known app authenticator configuration. Includes an + app authenticator's settings, supported methods, and other details. + operationId: getWellKnownAppAuthenticatorConfiguration + parameters: + - name: oauthClientId + in: query + description: Filters app authenticator configurations by `oauthClientId` + required: true + schema: + type: string + responses: + '200': + description: Success + content: + application/json: + schema: + $ref: >- + #/components/schemas/GetWellKnownAppAuthenticatorConfigurationResponse + examples: + AuthenticatorConfiguration: + $ref: >- + #/components/examples/WellKnownAppAuthenticatorConfigurationCustomApp + '400': + $ref: '#/components/responses/ErrorMissingRequiredParameter400' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: [] + tags: + - Authenticator + /.well-known/apple-app-site-association: + get: + summary: Retrieve the customized apple-app-site-association URI content + description: >- + Retrieves the content of the `apple-app-site-assocation` well-known URI + + + > **Note:** When serving this URI, Okta adds `authsrv` content to + provide a seamless experience for Okta Verify. You can't modify the + content in the `authsrv` object. + operationId: getAppleAppSiteAssociationWellKnownURI + responses: + '200': + description: Success + content: + application/json: + schema: + $ref: '#/components/schemas/PublicAppleAppSiteWellKnownURI' + examples: + Response: + $ref: '#/components/examples/PublicAppleAppSiteWellKnownURIResponse' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: [] + tags: + - AssociatedDomainCustomizations + x-okta-lifecycle: + lifecycle: LIMITED_GA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + /.well-known/assetlinks.json: + get: + summary: Retrieve the customized assetlinks.json URI content + description: Retrieves the content of the `assetlinks.json` well-known URI + operationId: getAssetLinksWellKnownURI + responses: + '200': + description: Success + content: + application/json: + schema: + $ref: '#/components/schemas/GetAssetLinksWellKnownURIResponse' + examples: + Response: + $ref: '#/components/examples/PublicAssetLinksWellKnownURIResponse' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: [] + tags: + - AssociatedDomainCustomizations + x-okta-lifecycle: + lifecycle: LIMITED_GA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + /.well-known/okta-organization: + get: + summary: Retrieve the Org metadata + description: >- + Retrieves the org metadata, which includes the org ID, configured custom + domains, and authentication pipeline + operationId: getWellknownOrgMetadata + responses: + '200': + description: Success + content: + application/json: + schema: + $ref: '#/components/schemas/WellKnownOrgMetadata' + examples: + Identity Engine org with a custom domain: + $ref: >- + #/components/examples/WellKnownOrgMetadataResponseCustomUrlOie + Classic Engine org: + $ref: '#/components/examples/WellKnownOrgMetadataResponseClassic' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: [] + tags: + - OrgSettingMetadata + x-okta-lifecycle: + isCorsEnabled: true + lifecycle: GA + isGenerallyAvailable: true + /.well-known/ssf-configuration: + get: + summary: Retrieve the SSF transmitter metadata + description: >- + Retrieves SSF transmitter configuration metadata. This includes all + supported endpoints and key information about certain properties of the + Okta org as the transmitter, such as `delivery_methods_supported`, + `issuer`, and `jwks_uri`. + operationId: getWellknownSsfMetadata + responses: + '200': + description: OK + content: + application/json: + schema: + $ref: '#/components/schemas/WellKnownSSFMetadata' + examples: + wellKnownSSFMetadataExample: + $ref: '#/components/examples/wellKnownSSFMetadataExample' + '401': + $ref: '#/components/responses/ErrorInvalidToken401' + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: [] + tags: + - SSFTransmitter + x-okta-lifecycle: + lifecycle: LIMITED_GA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + /.well-known/webauthn: + get: + summary: Retrieve the customized webauthn URI content + description: Retrieves the content of the `webauthn` well-known URI + operationId: getWebAuthnWellKnownURI + responses: + '200': + description: Success + content: + application/json: + schema: + $ref: '#/components/schemas/PublicWebauthnSiteWellKnownURI' + examples: + Response: + $ref: '#/components/examples/PublicWebauthnWellKnownURIResponse' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: [] + tags: + - AssociatedDomainCustomizations + x-okta-lifecycle: + lifecycle: LIMITED_GA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine +components: + schemas: + WellKnownAppAuthenticatorConfiguration: + type: object + properties: + appAuthenticatorEnrollEndpoint: + type: string + description: The authenticator enrollment endpoint + authenticatorId: + type: string + description: The unique identifier of the app authenticator + createdDate: + type: string + description: Timestamp when the authenticator was created + format: date-time + key: + $ref: '#/components/schemas/AuthenticatorKeyEnum' + lastUpdated: + type: string + description: Timestamp when the authenticator was last modified + format: date-time + name: + type: string + description: The authenticator display name + orgId: + type: string + description: The `id` of the Okta Org + settings: + type: object + properties: + userVerification: + $ref: '#/components/schemas/CustomAppUserVerificationEnum' + supportedMethods: + type: array + items: + $ref: '#/components/schemas/SupportedMethods' + type: + type: string + description: The type of authenticator + enum: + - app + PublicAppleAppSiteWellKnownURI: + x-okta-ignore-redocly-rules-for-sdk: true + description: The well-known URI content in JSON object format (opaque JSON object) + type: string + PublicAssetLinksWellKnownURI: + x-okta-ignore-redocly-rules-for-sdk: true + description: The well-known URI content in a JSON array of objects format + items: + type: string + description: (opaque JSON object) + type: array + WellKnownOrgMetadata: + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + id: + type: string + description: Org unique identifier + pipeline: + $ref: '#/components/schemas/PipelineType' + _links: + type: object + description: >- + Specifies link relations (see [Web + Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for this + object using the [JSON Hypertext Application + Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) + specification + readOnly: true + properties: + alternate: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to the custom domain org URL + organization: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to the org URL + WellKnownSSFMetadata: + title: Shared signals framework metadata + description: >- + Metadata about Okta as a transmitter and relevant information for + configuration. + type: object + properties: + authorization_schemes: + type: array + description: >- + An array of JSON objects that specify the authorization scheme + properties supported by the transmitter + items: + $ref: '#/components/schemas/WellKnownSSFMetadataSpecUrn' + configuration_endpoint: + type: string + format: uri + description: The URL of the SSF stream configuration endpoint + example: https://{yourOktaDomain}/api/v1/ssf/stream + default_subjects: + type: string + description: >- + A string that indicates the default behavior of newly created + streams + enum: + - ALL + - NONE + x-enumDescriptions: + ALL: >- + Indicates that any subjects that are appropriate for the stream + are added to the stream by default. + NONE: Indicates that no subjects are added by default + delivery_methods_supported: + type: array + items: + type: string + format: uri + description: An array of supported SET delivery methods + example: + - https://schemas.openid.net/secevent/risc/delivery-method/push + - urn:ietf:rfc:8935 + issuer: + type: string + description: >- + The issuer used in security event tokens. This value is set as `iss` + in the claim. + example: https://{yourOktaDomain} + jwks_uri: + type: string + description: >- + The URL of the JSON Web Key Set (JWKS) that contains the signing + keys for validating the signatures of security event tokens (SETs) + format: uri + example: https://{yourOktaDomain}/oauth2/v1/keys + spec_version: + type: string + description: >- + The version identifying the implementer's draft or final + specification implemented by the transmitter + example: 1_0-ID3 + verification_endpoint: + type: string + format: uri + description: The URL of the SSF stream verification endpoint + example: https://{yourOktaDomain}/api/v1/ssf/stream/verification + PublicWebauthnSiteWellKnownURI: + x-okta-ignore-redocly-rules-for-sdk: true + description: The well-known URI content in JSON object format (opaque JSON object) + type: string + AuthenticatorKeyEnum: + description: A human-readable string that identifies the authenticator + type: string + enum: + - custom_app + - duo + - external_idp + - google_otp + - okta_email + - okta_password + - okta_verify + - onprem_mfa + - phone_number + - security_key + - security_question + - smart_card_idp + - symantec_vip + - webauthn + - yubikey_token + - tac + CustomAppUserVerificationEnum: + description: User verification setting + type: string + enum: + - PREFERRED + - REQUIRED + SupportedMethods: + x-okta-ignore-redocly-rules-for-sdk: true + description: The supported methods of an authenticator + type: object + properties: + settings: + type: object + properties: + keyProtection: + $ref: '#/components/schemas/PushMethodKeyProtection' + algorithms: + description: The encryption algorithm for this authenticator method + type: array + items: + $ref: '#/components/schemas/AuthenticatorMethodAlgorithm' + transactionTypes: + type: array + description: The transaction type for this authenticator method + items: + $ref: '#/components/schemas/AuthenticatorMethodTransactionType' + status: + type: string + enum: + - ACTIVE + - INACTIVE + description: The status of the authenticator method + type: + type: string + description: The type of authenticator method + enum: + - push + Error: + title: Error + type: object + properties: + errorCauses: + type: array + items: + $ref: '#/components/schemas/ErrorCause' + errorCode: + type: string + description: An Okta code for this type of error + errorId: + type: string + description: >- + A unique identifier for this error. This can be used by Okta Support + to help with troubleshooting. + errorLink: + type: string + description: An Okta code for this type of error + errorSummary: + type: string + description: >- + A short description of what caused this error. Sometimes this + contains dynamically-generated information about your specific + error. + PipelineType: + description: The Okta authentication pipeline of the org + type: string + enum: + - idx + - v1 + x-enumDescriptions: + idx: >- + [Identity + Engine](https://help.okta.com/okta_help.htm?type=oie&id=ext-get-started-oie) + v1: '[Classic Engine](https://help.okta.com/en-us/content/index-admin.htm)' + HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + WellKnownSSFMetadataSpecUrn: + type: object + properties: + spec_urn: + type: string + format: uri + description: The URN that describes the specification of the protocol being used + example: urn:ietf:rfc:6749 + PushMethodKeyProtection: + description: Indicates whether you must use a hardware key store + type: string + enum: + - ANY + - HARDWARE + AuthenticatorMethodAlgorithm: + type: string + enum: + - ES256 + - RS256 + AuthenticatorMethodTransactionType: + type: string + enum: + - CIBA + - LOGIN + LifecycleStatus: + type: string + enum: + - ACTIVE + - INACTIVE + ErrorCause: + type: object + properties: + errorSummary: + type: string + HrefHints: + description: Describes allowed HTTP verbs for the `href` + type: object + properties: + allow: + type: array + items: + $ref: '#/components/schemas/HttpMethod' + HttpMethod: + type: string + enum: + - DELETE + - GET + - POST + - PUT + GetWellKnownAppAuthenticatorConfigurationResponse: + type: object + properties: + well_known_app_authenticator_configuration: + type: array + items: + $ref: '#/components/schemas/WellKnownAppAuthenticatorConfiguration' + GetAssetLinksWellKnownURIResponse: + type: object + properties: + asset_links_well_known_uri: + type: array + items: + type: object + properties: + asset_links_well_known_uri: + type: string + responses: + ErrorMissingRequiredParameter400: + description: Bad Request + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + examples: + MissingRequiredParameter: + $ref: '#/components/examples/ErrorMissingRequiredParameter' + ErrorTooManyRequests429: + description: Too Many Requests + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + examples: + TooManyRequests: + $ref: '#/components/examples/ErrorTooManyRequests' + ErrorResourceNotFound404: + description: Not Found + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + examples: + ResourceNotFound: + $ref: '#/components/examples/ErrorResourceNotFound' + ErrorInvalidToken401: + description: Unauthorized + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + examples: + InvalidTokenProvided: + $ref: '#/components/examples/ErrorInvalidTokenProvided' + ErrorAccessDenied403: + description: Forbidden + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + examples: + AccessDenied: + $ref: '#/components/examples/ErrorAccessDenied' + examples: + WellKnownAppAuthenticatorConfigurationCustomApp: + summary: Retrieve app authenticator configuration + value: + - authenticatorId: aut22f6xzargnJZYE3l7 + orgId: 00o1vhf34q20MfCFC3l7 + type: app + key: custom_app + name: Custom authenticator + createdDate: '2022-10-11T08:56:45.000Z' + lastUpdated: '2023-09-07T11:31:35.000Z' + settings: + userVerification: PREFERRED + supportedMethods: + - type: push + status: ACTIVE + settings: + algorithms: + - RS256 + - ES256 + keyProtection: ANY + appAuthenticatorEnrollEndpoint: https://{yourOktaDomain}/idp/myaccount/app-authenticators + PublicAppleAppSiteWellKnownURIResponse: + value: + authsrv: + apps: + - B7F62B65BN.com.okta.mobile + - B7F62B65BN.com.okta.mobile.auth-service-extension + - B7F62B65BN.com.okta.authenticator.beta + - B7F62B65BN.com.okta.authenticator.beta.auth-service-extension + - 7WXXBW6Z2Y.com.okta.mobile.internalrelease + - 7WXXBW6Z2Y.com.okta.mobile.internalrelease.auth-service-extension + key1: value1 + key2: value2 + key3: + key3.1: value3.1 + PublicAssetLinksWellKnownURIResponse: + value: + - key1: value1 + WellKnownOrgMetadataResponseCustomUrlOie: + value: + id: 00o47wwoytgsDqEtz0g7 + _links: + organization: + href: https://{yourSubdomain}.okta.com + alternate: + href: https://{yourCustomDomain} + pipeline: idx + WellKnownOrgMetadataResponseClassic: + value: + id: 00o5rb5mt2H3d1TJd0h7 + _links: + organization: + href: https://{{yourOktaDomain}} + pipeline: v1 + wellKnownSSFMetadataExample: + summary: Well-Known SSF metadata example + value: + configuration_endpoint: https://{yourOktaDomain}/api/v1/ssf/stream + delivery_methods_supported: + - https://schemas.openid.net/secevent/risc/delivery-method/push + - urn:ietf:rfc:8935 + issuer: https://{yourOktaDomain} + jwks_uri: https://{yourOktaDomain}/oauth2/v1/keys + verification_endpoint: https://{yourOktaDomain}/api/v1/ssf/stream/verification + spec_version: 1_0-ID3 + authorization_schemes: + - spec_urn: urn:ietf:rfc:6749 + default_subjects: ALL + PublicWebauthnWellKnownURIResponse: + value: + origins: + - https://example1.com + ErrorMissingRequiredParameter: + summary: Missing Required Parameter + value: + errorCode: E0000028 + errorSummary: The request is missing a required parameter. + errorLink: E0000028 + errorId: sampleiCF-l7mr9XqM1NQ + errorCauses: [] + ErrorTooManyRequests: + summary: Too Many Requests + value: + errorCode: E0000047 + errorSummary: API call exceeded rate limit due to too many requests. + errorLink: E0000047 + errorId: sampleQPivGUj_ND5v78vbYWW + errorCauses: [] + ErrorResourceNotFound: + summary: Resource Not Found + value: + errorCode: E0000007 + errorSummary: 'Not found: {0}' + errorLink: E0000007 + errorId: sampleMlLvGUj_YD5v16vkYWY + errorCauses: [] + ErrorInvalidTokenProvided: + summary: Invalid Token Provided + value: + errorCode: E0000011 + errorSummary: Invalid token provided + errorLink: E0000011 + errorId: sampleQPivGUj_ND5v78vbYWW + errorCauses: [] + ErrorAccessDenied: + summary: Access Denied + value: + errorCode: E0000006 + errorSummary: You do not have permission to perform the requested action + errorLink: E0000006 + errorId: sampleNUSD_8fdkFd8fs8SDBK + errorCauses: [] + x-stackQL-resources: + app_authenticator_configuration: + id: okta._well_known.app_authenticator_configuration + name: app_authenticator_configuration + title: App Authenticator Configuration + methods: + get_well_known_app_authenticator_configuration: + operation: + $ref: '#/paths/~1.well-known~1app-authenticator-configuration/get' + response: + mediaType: application/json + openAPIDocKey: '200' + objectKey: $.well_known_app_authenticator_configuration + overrideMediaType: application/json + schema_override: + $ref: >- + #/components/schemas/GetWellKnownAppAuthenticatorConfigurationResponse + transform: + body: >- + {{- $wrapped := printf + "{\"well_known_app_authenticator_configuration\":%s}" . -}} + + {{- $wrapped -}} + type: golang_template_text_v0.3.0 + sqlVerbs: + select: + - $ref: >- + #/components/x-stackQL-resources/app_authenticator_configuration/methods/get_well_known_app_authenticator_configuration + insert: [] + update: [] + delete: [] + replace: [] + apple_app_site_association: + id: okta._well_known.apple_app_site_association + name: apple_app_site_association + title: Apple App Site Association + methods: + get_apple_app_site_association_well_known_uri: + operation: + $ref: '#/paths/~1.well-known~1apple-app-site-association/get' + response: + mediaType: application/json + openAPIDocKey: '200' + sqlVerbs: + select: + - $ref: >- + #/components/x-stackQL-resources/apple_app_site_association/methods/get_apple_app_site_association_well_known_uri + insert: [] + update: [] + delete: [] + replace: [] + asset_links: + id: okta._well_known.asset_links + name: asset_links + title: Asset Links + methods: + get_asset_links_well_known_uri: + operation: + $ref: '#/paths/~1.well-known~1assetlinks.json/get' + response: + mediaType: application/json + openAPIDocKey: '200' + objectKey: $.asset_links_well_known_uri + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/GetAssetLinksWellKnownURIResponse' + transform: + body: >- + {{- $wrapped := printf "{\"items\":%s}" . -}} + + {{- $parsed := jsonMapFromString $wrapped -}} + + {{- $items := index $parsed "items" -}} + + {"asset_links_well_known_uri":[{{- range $i, $v := $items -}}{{- + if $i -}},{{- end -}}{"asset_links_well_known_uri":"{{- $v + -}}"}{{- end -}}]} + type: golang_template_text_v0.3.0 + sqlVerbs: + select: + - $ref: >- + #/components/x-stackQL-resources/asset_links/methods/get_asset_links_well_known_uri + insert: [] + update: [] + delete: [] + replace: [] + org_metadata: + id: okta._well_known.org_metadata + name: org_metadata + title: Org Metadata + methods: + get_wellknown_org_metadata: + operation: + $ref: '#/paths/~1.well-known~1okta-organization/get' + response: + mediaType: application/json + openAPIDocKey: '200' + sqlVerbs: + select: + - $ref: >- + #/components/x-stackQL-resources/org_metadata/methods/get_wellknown_org_metadata + insert: [] + update: [] + delete: [] + replace: [] + ssf_metadata: + id: okta._well_known.ssf_metadata + name: ssf_metadata + title: Ssf Metadata + methods: + get_wellknown_ssf_metadata: + operation: + $ref: '#/paths/~1.well-known~1ssf-configuration/get' + response: + mediaType: application/json + openAPIDocKey: '200' + sqlVerbs: + select: + - $ref: >- + #/components/x-stackQL-resources/ssf_metadata/methods/get_wellknown_ssf_metadata + insert: [] + update: [] + delete: [] + replace: [] + webauthn_well_known: + id: okta._well_known.webauthn_well_known + name: webauthn_well_known + title: Webauthn Well Known + methods: + get_web_authn_well_known_uri: + operation: + $ref: '#/paths/~1.well-known~1webauthn/get' + response: + mediaType: application/json + openAPIDocKey: '200' + sqlVerbs: + select: + - $ref: >- + #/components/x-stackQL-resources/webauthn_well_known/methods/get_web_authn_well_known_uri + insert: [] + update: [] + delete: [] + replace: [] +servers: + - url: https://{subdomain}.okta.com/ + variables: + subdomain: + default: my-org +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/agentpools.yaml b/providers/src/okta/v00.00.00000/services/agentpools.yaml index ceb6463c..87da2526 100644 --- a/providers/src/okta/v00.00.00000/services/agentpools.yaml +++ b/providers/src/okta/v00.00.00000/services/agentpools.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: agentpools API description: okta agentpools API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/agentPools: get: @@ -19,9 +19,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/AgentPool' + $ref: '#/components/schemas/ListAgentPoolsResponse' examples: ListAllAgentPoolsResponse: $ref: '#/components/examples/ListAllAgentPoolsResponse' @@ -45,15 +43,14 @@ paths: operationId: listAgentPoolsUpdates parameters: - $ref: '#/components/parameters/queryScheduled' + - $ref: '#/components/parameters/pathPoolId' responses: '200': description: OK content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/AgentPoolUpdate' + $ref: '#/components/schemas/ListAgentPoolsUpdatesResponse' examples: ListAllAgentPoolUpdatesResponse: $ref: '#/components/examples/ListAllAgentPoolUpdatesResponse' @@ -106,8 +103,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathPoolId' + parameters: + - $ref: '#/components/parameters/pathPoolId' /api/v1/agentPools/{poolId}/updates/settings: get: summary: Retrieve an agent pool update's settings @@ -119,7 +116,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/AgentPoolUpdateSetting' + $ref: '#/components/schemas/AgentPoolUpdateSettingResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -135,6 +132,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathPoolId' post: summary: Update an agent pool update settings description: Updates an agent pool update instance settings @@ -143,7 +142,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/AgentPoolUpdateSetting' + $ref: '#/components/schemas/AgentPoolUpdateSettingRequest' required: true responses: '201': @@ -151,7 +150,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/AgentPoolUpdateSetting' + $ref: '#/components/schemas/AgentPoolUpdateSettingResponse' '400': $ref: '#/components/responses/ErrorApiValidationFailed400' '403': @@ -169,8 +168,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathPoolId' + parameters: + - $ref: '#/components/parameters/pathPoolId' /api/v1/agentPools/{poolId}/updates/{updateId}: get: summary: Retrieve an agent pool update by ID @@ -198,11 +197,12 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathPoolId' + - $ref: '#/components/parameters/pathUpdateId' post: summary: Update an agent pool update by ID - description: >- - Updates an agent pool update instance and returns the latest agent pool - update + description: Updates an agent pool update instance and returns the latest agent pool update operationId: updateAgentPoolsUpdate requestBody: content: @@ -234,6 +234,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathPoolId' + - $ref: '#/components/parameters/pathUpdateId' delete: summary: Delete an agent pool update description: Deletes agent pool update @@ -256,9 +259,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathPoolId' - - $ref: '#/components/parameters/pathUpdateId' + parameters: + - $ref: '#/components/parameters/pathPoolId' + - $ref: '#/components/parameters/pathUpdateId' /api/v1/agentPools/{poolId}/updates/{updateId}/activate: post: summary: Activate an agent pool update @@ -286,9 +289,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathPoolId' - - $ref: '#/components/parameters/pathUpdateId' + parameters: + - $ref: '#/components/parameters/pathPoolId' + - $ref: '#/components/parameters/pathUpdateId' /api/v1/agentPools/{poolId}/updates/{updateId}/deactivate: post: summary: Deactivate an agent pool update @@ -316,9 +319,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathPoolId' - - $ref: '#/components/parameters/pathUpdateId' + parameters: + - $ref: '#/components/parameters/pathPoolId' + - $ref: '#/components/parameters/pathUpdateId' /api/v1/agentPools/{poolId}/updates/{updateId}/pause: post: summary: Pause an agent pool update @@ -346,9 +349,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathPoolId' - - $ref: '#/components/parameters/pathUpdateId' + parameters: + - $ref: '#/components/parameters/pathPoolId' + - $ref: '#/components/parameters/pathUpdateId' /api/v1/agentPools/{poolId}/updates/{updateId}/resume: post: summary: Resume an agent pool update @@ -376,15 +379,13 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathPoolId' - - $ref: '#/components/parameters/pathUpdateId' + parameters: + - $ref: '#/components/parameters/pathPoolId' + - $ref: '#/components/parameters/pathUpdateId' /api/v1/agentPools/{poolId}/updates/{updateId}/retry: post: summary: Retry an agent pool update - description: >- - Retries an agent pool update if the update is unsuccessful or - communication with Okta was interrupted during an agent auto-update + description: Retries an agent pool update if the update is unsuccessful or communication with Okta was interrupted during an agent auto-update operationId: retryAgentPoolsUpdate responses: '201': @@ -408,9 +409,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathPoolId' - - $ref: '#/components/parameters/pathUpdateId' + parameters: + - $ref: '#/components/parameters/pathPoolId' + - $ref: '#/components/parameters/pathUpdateId' /api/v1/agentPools/{poolId}/updates/{updateId}/stop: post: summary: Stop an agent pool update @@ -438,17 +439,13 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathPoolId' - - $ref: '#/components/parameters/pathUpdateId' + parameters: + - $ref: '#/components/parameters/pathPoolId' + - $ref: '#/components/parameters/pathUpdateId' components: schemas: AgentPool: - description: >- - An agent pool is a collection of agents that serve a common purpose. An - agent pool has a unique ID within an org, and contains a collection of - agents disjoint to every other agent pool, meaning that no two agent - pools share an agent. + description: An agent pool is a collection of agents that serve a common purpose. An agent pool has a unique ID within an org, and contains a collection of agents disjoint to every other agent pool, meaning that no two agent pools share an agent. type: object properties: agents: @@ -515,8 +512,36 @@ components: example: 3.20.0 _links: $ref: '#/components/schemas/LinksSelf' - AgentPoolUpdateSetting: - description: Setting for auto-update + AgentPoolUpdateSettingResponse: + description: Settings for auto-update + type: object + properties: + agentType: + $ref: '#/components/schemas/AgentType' + continueOnError: + type: boolean + description: Continues the update even if some agents fail to update + latestVersion: + type: string + description: Latest version of the agent + example: 3.20.0 + minimalSupportedVersion: + type: string + description: Minimal version of the agent + example: 3.19.0 + poolId: + type: string + readOnly: true + description: ID of the agent pool that the settings apply to + example: 0oa3eu7ekG8tjbD9J5s6 + poolName: + type: string + description: Pool name + example: iwa.dc + releaseChannel: + $ref: '#/components/schemas/ReleaseChannel' + AgentPoolUpdateSettingRequest: + description: Settings for auto-update type: object properties: agentType: @@ -543,6 +568,8 @@ components: example: iwa.dc releaseChannel: $ref: '#/components/schemas/ReleaseChannel' + required: + - agentType AgentType: description: Agent types that are being monitored type: string @@ -570,9 +597,9 @@ components: type: boolean description: Determines if the agent is on the latest generally available version lastConnection: - type: string - format: date-time - description: Timestamp when the agent last connected to Okta + type: integer + format: int64 + description: Unix timestamp in milliseconds when the agent last connected to Okta name: type: string description: Agent name @@ -606,13 +633,7 @@ components: - INACTIVE - OPERATIONAL LinksSelf: - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the - [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. This object is used for dynamic discovery of related - resources and lifecycle operations. + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. type: object properties: self: @@ -631,29 +652,20 @@ components: description: An Okta code for this type of error errorId: type: string - description: >- - A unique identifier for this error. This can be used by Okta Support - to help with troubleshooting. + description: A unique identifier for this error. This can be used by Okta Support to help with troubleshooting. errorLink: type: string description: An Okta code for this type of error errorSummary: type: string - description: >- - A short description of what caused this error. Sometimes this - contains dynamically-generated information about your specific - error. + description: A short description of what caused this error. Sometimes this contains dynamically-generated information about your specific error. AutoUpdateSchedule: description: The schedule of auto-update configured by the admin type: object properties: cron: type: string - description: >- - The schedule of the update in cron format. The cron settings are - limited to only the day of the month or the nth-day-of-the-week - configurations. For example, `0 8 ? * 6#3` indicates every third - Saturday at 8:00 AM. + description: The schedule of the update in cron format. The cron settings are limited to only the day of the month or the nth-day-of-the-week configurations. For example, `0 8 ? * 6#3` indicates every third Saturday at 8:00 AM. example: 0 8 ? * 6#3 delay: description: Delay in days @@ -663,10 +675,7 @@ components: type: integer example: 120 lastUpdated: - description: >- - Timestamp when the update finished (only for a successful or failed - update, not for a cancelled update). Null is returned if the job - hasn't finished once yet. + description: Timestamp when the update finished (only for a successful or failed update, not for a cancelled update). Null is returned if the job hasn't finished once yet. type: string format: date-time timezone: @@ -702,15 +711,39 @@ components: - Scheduled - Success HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) ErrorCause: type: object properties: errorSummary: type: string HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object additionalProperties: true type: object @@ -727,15 +760,11 @@ components: readOnly: true templated: type: boolean - description: >- - Indicates whether the link object's `href` property is a URI - template. + description: Indicates whether the link object's `href` property is a URI template. readOnly: true type: type: string - description: >- - The media type of the link. If omitted, it is implicitly - `application/json`. + description: The media type of the link. If omitted, it is implicitly `application/json`. readOnly: true required: - href @@ -754,6 +783,20 @@ components: - GET - POST - PUT + ListAgentPoolsResponse: + type: object + properties: + agent_pools: + type: array + items: + $ref: '#/components/schemas/AgentPool' + ListAgentPoolsUpdatesResponse: + type: object + properties: + agent_pools_updates: + type: array + items: + $ref: '#/components/schemas/AgentPoolUpdate' responses: ErrorAccessDenied403: description: Forbidden @@ -812,11 +855,7 @@ components: in: query schema: type: string - description: >- - The cursor to use for pagination. It is an opaque string that specifies - your current location in the list and is obtained from the `Link` - response header. See - [Pagination](https://developer.okta.com/docs/api/#pagination). + description: The cursor to use for pagination. It is an opaque string that specifies your current location in the list and is obtained from the `Link` response header. See [Pagination](https://developer.okta.com/docs/api/#pagination) and [Link header](https://developer.okta.com/docs/api/#link-header). pathPoolId: name: poolId in: path @@ -827,11 +866,9 @@ components: queryScheduled: name: scheduled in: query - description: >- - Return only scheduled or ad-hoc updates. If this parameter isn't - provided, Okta returns the entire list of updates. + description: Return only scheduled or ad-hoc updates. If this parameter isn't provided, Okta returns the entire list of updates. schema: - type: boolean + type: string required: false pathUpdateId: name: updateId @@ -944,10 +981,18 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.agent_pools + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListAgentPoolsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"agent_pools\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/agent_pools/methods/list_agent_pools + - $ref: '#/components/x-stackQL-resources/agent_pools/methods/list_agent_pools' insert: [] update: [] delete: [] @@ -963,7 +1008,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.agent_pools_updates + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListAgentPoolsUpdatesResponse' + transform: + body: |- + {{- $wrapped := printf "{\"agent_pools_updates\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_agent_pools_update: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1agentPools~1{poolId}~1updates/post' response: @@ -976,6 +1033,9 @@ components: mediaType: application/json openAPIDocKey: '200' update_agent_pools_update: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1agentPools~1{poolId}~1updates~1{updateId}/post' response: @@ -983,68 +1043,56 @@ components: openAPIDocKey: '201' delete_agent_pools_update: operation: - $ref: >- - #/paths/~1api~1v1~1agentPools~1{poolId}~1updates~1{updateId}/delete + $ref: '#/paths/~1api~1v1~1agentPools~1{poolId}~1updates~1{updateId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' activate_agent_pools_update: operation: - $ref: >- - #/paths/~1api~1v1~1agentPools~1{poolId}~1updates~1{updateId}~1activate/post + $ref: '#/paths/~1api~1v1~1agentPools~1{poolId}~1updates~1{updateId}~1activate/post' response: mediaType: application/json openAPIDocKey: '201' deactivate_agent_pools_update: operation: - $ref: >- - #/paths/~1api~1v1~1agentPools~1{poolId}~1updates~1{updateId}~1deactivate/post + $ref: '#/paths/~1api~1v1~1agentPools~1{poolId}~1updates~1{updateId}~1deactivate/post' response: mediaType: application/json openAPIDocKey: '201' pause_agent_pools_update: operation: - $ref: >- - #/paths/~1api~1v1~1agentPools~1{poolId}~1updates~1{updateId}~1pause/post + $ref: '#/paths/~1api~1v1~1agentPools~1{poolId}~1updates~1{updateId}~1pause/post' response: mediaType: application/json openAPIDocKey: '201' resume_agent_pools_update: operation: - $ref: >- - #/paths/~1api~1v1~1agentPools~1{poolId}~1updates~1{updateId}~1resume/post + $ref: '#/paths/~1api~1v1~1agentPools~1{poolId}~1updates~1{updateId}~1resume/post' response: mediaType: application/json openAPIDocKey: '201' retry_agent_pools_update: operation: - $ref: >- - #/paths/~1api~1v1~1agentPools~1{poolId}~1updates~1{updateId}~1retry/post + $ref: '#/paths/~1api~1v1~1agentPools~1{poolId}~1updates~1{updateId}~1retry/post' response: mediaType: application/json openAPIDocKey: '201' stop_agent_pools_update: operation: - $ref: >- - #/paths/~1api~1v1~1agentPools~1{poolId}~1updates~1{updateId}~1stop/post + $ref: '#/paths/~1api~1v1~1agentPools~1{poolId}~1updates~1{updateId}~1stop/post' response: mediaType: application/json openAPIDocKey: '201' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/agent_pool_updates/methods/list_agent_pools_updates - - $ref: >- - #/components/x-stackQL-resources/agent_pool_updates/methods/get_agent_pools_update_instance + - $ref: '#/components/x-stackQL-resources/agent_pool_updates/methods/get_agent_pools_update_instance' + - $ref: '#/components/x-stackQL-resources/agent_pool_updates/methods/list_agent_pools_updates' insert: - - $ref: >- - #/components/x-stackQL-resources/agent_pool_updates/methods/create_agent_pools_update + - $ref: '#/components/x-stackQL-resources/agent_pool_updates/methods/create_agent_pools_update' update: - - $ref: >- - #/components/x-stackQL-resources/agent_pool_updates/methods/update_agent_pools_update + - $ref: '#/components/x-stackQL-resources/agent_pool_updates/methods/update_agent_pools_update' delete: - - $ref: >- - #/components/x-stackQL-resources/agent_pool_updates/methods/delete_agent_pools_update + - $ref: '#/components/x-stackQL-resources/agent_pool_updates/methods/delete_agent_pools_update' replace: [] agent_pool_update_settings: id: okta.agentpools.agent_pool_update_settings @@ -1058,6 +1106,9 @@ components: mediaType: application/json openAPIDocKey: '200' update_agent_pools_update_settings: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1agentPools~1{poolId}~1updates~1settings/post' response: @@ -1065,12 +1116,10 @@ components: openAPIDocKey: '201' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/agent_pool_update_settings/methods/get_agent_pools_update_settings + - $ref: '#/components/x-stackQL-resources/agent_pool_update_settings/methods/get_agent_pools_update_settings' insert: [] update: - - $ref: >- - #/components/x-stackQL-resources/agent_pool_update_settings/methods/update_agent_pools_update_settings + - $ref: '#/components/x-stackQL-resources/agent_pool_update_settings/methods/update_agent_pools_update_settings' delete: [] replace: [] servers: @@ -1078,7 +1127,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/api_tokens.yaml b/providers/src/okta/v00.00.00000/services/api_tokens.yaml index c4dc03c0..46403c69 100644 --- a/providers/src/okta/v00.00.00000/services/api_tokens.yaml +++ b/providers/src/okta/v00.00.00000/services/api_tokens.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: api_tokens API description: okta api_tokens API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/api-tokens: get: @@ -15,9 +15,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/ApiToken' + $ref: '#/components/schemas/ListApiTokensResponse' examples: List Tokens: $ref: '#/components/examples/ApiTokenListMetadataResponse' @@ -83,6 +81,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathApiTokenId' put: summary: Upsert an API token network condition description: Upserts an API Token Network Condition by `apiTokenId` @@ -127,6 +127,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathApiTokenId' delete: summary: Revoke an API token description: Revokes an API token by `apiTokenId` @@ -149,8 +151,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathApiTokenId' + parameters: + - $ref: '#/components/parameters/pathApiTokenId' components: schemas: ApiToken: @@ -290,15 +292,43 @@ components: contains dynamically-generated information about your specific error. HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) ErrorCause: type: object properties: errorSummary: type: string HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object additionalProperties: true type: object @@ -342,6 +372,13 @@ components: - GET - POST - PUT + ListApiTokensResponse: + type: object + properties: + api_tokens: + type: array + items: + $ref: '#/components/schemas/ApiToken' responses: ErrorAccessDenied403: description: Forbidden @@ -501,11 +538,20 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.api_tokens + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListApiTokensResponse' + transform: + body: |- + {{- $wrapped := printf "{\"api_tokens\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 revoke_current_api_token: operation: $ref: '#/paths/~1api~1v1~1api-tokens~1current/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' get_api_token: operation: @@ -514,6 +560,9 @@ components: mediaType: application/json openAPIDocKey: '200' upsert_api_token: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1api-tokens~1{apiTokenId}/put' response: @@ -523,20 +572,20 @@ components: operation: $ref: '#/paths/~1api~1v1~1api-tokens~1{apiTokenId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: + - $ref: '#/components/x-stackQL-resources/api_tokens/methods/get_api_token' - $ref: >- #/components/x-stackQL-resources/api_tokens/methods/list_api_tokens - - $ref: '#/components/x-stackQL-resources/api_tokens/methods/get_api_token' insert: [] update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/api_tokens/methods/revoke_current_api_token - $ref: >- #/components/x-stackQL-resources/api_tokens/methods/revoke_api_token + - $ref: >- + #/components/x-stackQL-resources/api_tokens/methods/revoke_current_api_token replace: - $ref: >- #/components/x-stackQL-resources/api_tokens/methods/upsert_api_token @@ -545,7 +594,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/apps.yaml b/providers/src/okta/v00.00.00000/services/apps.yaml index 04682164..7373c524 100644 --- a/providers/src/okta/v00.00.00000/services/apps.yaml +++ b/providers/src/okta/v00.00.00000/services/apps.yaml @@ -2,50 +2,41 @@ openapi: 3.0.3 info: title: apps API description: okta apps API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/apps: get: summary: List all applications - description: >- - Lists all apps in the org with pagination. A subset of apps can be - returned that match a supported filter expression or query. The results - are [paginated]https://developer.okta.com/docs/api#pagination according to the `limit` parameter. If - there are multiple pages of results, the header contains a `next` link. - Treat the link as an opaque value (follow it, don't parse it). - + description: |- + Lists all apps in the org with pagination. A subset of apps can be returned that match a supported filter expression or query. The results are [paginated]https://developer.okta.com/docs/api#pagination according to the `limit` parameter. If there are multiple pages of results, the header contains a `next` link. Treat the link as an opaque value (follow it, don't parse it). - > **Note:** To list all of a member's assigned app links, use the [List - all assigned app links endpoint in the User Resources - API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserResources/#tag/UserResources/operation/listAppLinks). + > **Note:** To list all of a member's assigned app links, use the [List all assigned app links endpoint in the User Resources API](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/userresources/other/listapplinks). operationId: listApplications parameters: - name: q in: query - description: >- - Searches for apps with `name` or `label` properties that starts with - the `q` value using the `startsWith` operation + description: Searches for apps with `name` or `label` properties that starts with the `q` value using the `startsWith` operation schema: type: string example: Okta - name: after in: query - description: >- - Specifies the [pagination]https://developer.okta.com/docs/api#pagination cursor for the next page of - results. Treat this as an opaque value obtained through the `next` - link relationship. + description: Specifies the [pagination]https://developer.okta.com/docs/api#pagination cursor for the next page of results. Treat this as an opaque value obtained through the `next` link relationship. schema: type: string example: 16278919418571 - name: useOptimization in: query - description: >- - Specifies whether to use query optimization. If you specify - `useOptimization=true` in the request query, the response contains a - subset of app instance properties. + description: Specifies whether to use query optimization. If you specify `useOptimization=true` in the request query, the response contains a subset of app instance properties. schema: - type: boolean - default: false + type: string + default: 'false' + - name: alwaysIncludeVpnSettings + in: query + description: Specifies whether to include the VPN configuration for existing notifications in the result, regardless of whether VPN notifications are configured + schema: + type: string + default: 'false' - name: limit in: query description: Specifies the number of results per page @@ -56,41 +47,33 @@ paths: maximum: 200 - name: filter in: query - description: >- - Filters apps by `status`, `user.id`, `group.id`, - `credentials.signing.kid` or `name` expression that supports the - `eq` operator + description: 'Filters apps with a supported expression for a subset of properties. Filtering supports the following limited number of properties: `id`, `status`, `credentials.signing.kid`, `settings.slo.enabled`, or `name`. See [Filter](https://developer.okta.com/docs/api/#filter).' schema: type: string examples: ActiveStatusEx: - value: status%20eq%20%22ACTIVE%22 + value: status eq "ACTIVE" summary: Filter for active apps NameFilterEx: - value: name%20eq%20%22okta_org2org%22 + value: name eq "okta_org2org" summary: Filter for apps with `okta_org2org` name CredKidEx: - value: >- - credentials.signing.kid%20eq%20%22SIMcCQNY3uwXoW3y0vf6VxiBb5n9pf8L2fK8d-F1bm4%22 + value: credentials.signing.kid eq "SIMcCQNY3uwXoW3y0vf6VxiBb5n9pf8L2fK8d-F1bm4" summary: Filter for apps using a specific key - $ref: '#/components/parameters/queryAppsExpand' - name: includeNonDeleted - description: >- - Specifies whether to include non-active, but not deleted apps in the - results + description: Specifies whether to include non-active, but not deleted apps in the results in: query schema: - type: boolean - default: false + type: string + default: 'false' responses: '200': description: Success content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/Application' + $ref: '#/components/schemas/ListApplicationsResponse' examples: ResponseExample1: $ref: '#/components/examples/GetApplicationsByUserResponseEx' @@ -115,29 +98,20 @@ paths: isGenerallyAvailable: true post: summary: Create an application - description: > + description: | Creates an app instance in your Okta org. - You can either create an OIN app instance or a custom app instance: - - * OIN app instances have prescribed `name` (key app definition) and - `signOnMode` options. See the [OIN - schemas](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Application/#tag/Application/schema/GoogleApplication) - for the request body. - - * For custom app instances, select the - [signOnMode](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Application/#tag/Application/operation/createApplication!path=0/signOnMode&t=request) - that pertains to your app and specify the required parameters in the - request body. + * OIN app instances have prescribed `name` (key app definition) and `signOnMode` options. See the [OIN schemas](https://developer.okta.com/docs/api/openapi/okta-management/management/application/googleapplication) for the request body. + * For custom app instances, select the [signOnMode](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/application/other/createapplication#application/createapplication/t=request&path=&d=0/signonmode) that pertains to your app and specify the required parameters in the request body. operationId: createApplication parameters: - name: activate in: query description: Executes activation lifecycle operation when creating the app schema: - type: boolean - default: true + type: string + default: 'true' - name: OktaAccessGateway-Agent in: header schema: @@ -217,15 +191,13 @@ paths: parameters: - name: expand in: query - description: >- - An optional query parameter to return the specified [Application - User](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/ApplicationUsers/) in - the `_embedded` property. - + description: |- + An optional query parameter to return the specified [Application User](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/applicationusers) in the `_embedded` property. Valid value: `expand=user/{userId}` schema: type: string example: user/0oa1gjh63g214q0Hq0g4 + - $ref: '#/components/parameters/pathAppId' responses: '200': description: Success @@ -253,16 +225,11 @@ paths: isGenerallyAvailable: true put: summary: Replace an application - description: > + description: | Replaces properties for an application - > **Notes:** - > * All required properties must be specified in the request body - - > * You can't modify system-assigned properties, such as `id`, `name`, - `status`, `created`, and `lastUpdated`. The values for these properties - in the PUT request body are ignored. + > * You can't modify system-assigned properties, such as `id`, `name`, `status`, `created`, and `lastUpdated`. The values for these properties in the PUT request body are ignored. operationId: replaceApplication x-codegen-request-body-name: application requestBody: @@ -333,6 +300,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathAppId' delete: summary: Delete an application description: Deletes an inactive application @@ -356,8 +325,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' + parameters: + - $ref: '#/components/parameters/pathAppId' /api/v1/apps/{appId}/connections/default: get: summary: Retrieve the default provisioning connection @@ -372,11 +341,9 @@ paths: $ref: '#/components/schemas/ProvisioningConnectionResponse' examples: ProvisioningConnectionTokenZscalerEx: - $ref: >- - #/components/examples/ProvisioningConnectionTokenResponseWithProfileZscalerEx + $ref: '#/components/examples/ProvisioningConnectionTokenResponseWithProfileZscalerEx' ProvisioningConnectionTokenOrg2OrgEx: - $ref: >- - #/components/examples/ProvisioningConnectionTokenResponseWithProfileOrg2OrgEx + $ref: '#/components/examples/ProvisioningConnectionTokenResponseWithProfileOrg2OrgEx' ProvisioningConnectionOauthO365Ex: $ref: '#/components/examples/ProvisioningConnectionOauthResponseEx' '403': @@ -394,6 +361,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathAppId' post: summary: Update the default provisioning connection description: Updates the default provisioning connection for an app @@ -402,24 +371,35 @@ paths: - in: query name: activate schema: - type: boolean + type: string description: Activates the provisioning connection + - $ref: '#/components/parameters/pathAppId' requestBody: content: application/json: schema: - oneOf: - - $ref: '#/components/schemas/ProvisioningConnectionTokenRequest' - - $ref: '#/components/schemas/ProvisioningConnectionOauthRequest' + x-okta-ignore-redocly-rules-for-sdk: true + title: Token-based connection + type: string + description: (opaque JSON object) + properties: + baseUrl: + type: string + description: Only used for the Zscaler 2.0 (`zscalerbyz`) app. The base URL for the Zscaler 2.0 target app, which also contains the Zscaler ID. + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: true + profile: + $ref: '#/components/schemas/ProvisioningConnectionTokenRequestProfile' + required: + - profile examples: ProvisioningConnectionTokenZscalerEx: $ref: '#/components/examples/ProvisioningConnectionTokenRequestEx' ProvisioningConnectionTokenOrg2OrgEx: - $ref: >- - #/components/examples/ProvisioningConnectionTokenOrg2OrgRequestEx + $ref: '#/components/examples/ProvisioningConnectionTokenOrg2OrgRequestEx' ProvisioningConnectionOAuthOrg2OrgEx: - $ref: >- - #/components/examples/ProvisioningConnectionOAuthOrg2OrgWithRotationRequestEx + $ref: '#/components/examples/ProvisioningConnectionOAuthOrg2OrgWithRotationRequestEx' ProvisioningConnectionOauthO365Ex: $ref: '#/components/examples/ProvisioningConnectionOauthO365RequestEx' required: true @@ -432,14 +412,11 @@ paths: $ref: '#/components/schemas/ProvisioningConnectionResponse' examples: ProvisioningConnectionTokenZscalerEx: - $ref: >- - #/components/examples/ProvisioningConnectionTokenResponseWithProfileZscalerEx + $ref: '#/components/examples/ProvisioningConnectionTokenResponseWithProfileZscalerEx' ProvisioningConnectionTokenOrg2OrgEx: - $ref: >- - #/components/examples/ProvisioningConnectionTokenResponseWithProfileOrg2OrgEx + $ref: '#/components/examples/ProvisioningConnectionTokenResponseWithProfileOrg2OrgEx' ProvisioningConnectionOAuthOrg2OrgEx: - $ref: >- - #/components/examples/ProvisioningConnectionOAuthOrg2OrgWithRotationResponseEx + $ref: '#/components/examples/ProvisioningConnectionOAuthOrg2OrgWithRotationResponseEx' ProvisioningConnectionOauthO365Ex: $ref: '#/components/examples/ProvisioningConnectionOauthResponseEx' '400': @@ -459,16 +436,10 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' /api/v1/apps/{appId}/connections/default/jwks: get: - summary: >- - Retrieve a JSON Web Key Set (JWKS) for the default provisioning - connection - description: >- - Retrieves a JWKS for the default provisioning connection. This can be - used by the OAuth 2.0 app's `jwk_uri` property in the target org. + summary: Retrieve a JSON Web Key Set (JWKS) for the default provisioning connection + description: Retrieves a JWKS for the default provisioning connection. This can be used by the OAuth 2.0 app's `jwk_uri` property in the target org. operationId: getUserProvisioningConnectionJWKS responses: '200': @@ -497,8 +468,8 @@ paths: lifecycle: GA isGenerallyAvailable: false SKUs: [] - parameters: - - $ref: '#/components/parameters/pathAppId' + parameters: + - $ref: '#/components/parameters/pathAppId' /api/v1/apps/{appId}/connections/default/lifecycle/activate: post: summary: Activate the default provisioning connection @@ -522,8 +493,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' + parameters: + - $ref: '#/components/parameters/pathAppId' /api/v1/apps/{appId}/connections/default/lifecycle/deactivate: post: summary: Deactivate the default provisioning connection @@ -547,12 +518,12 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' + parameters: + - $ref: '#/components/parameters/pathAppId' /api/v1/apps/{appId}/credentials/csrs: get: summary: List all certificate signing requests - description: Lists all Certificate Signing Requests for an application + description: Lists all certificate signing requests for an app operationId: listCsrsForApplication responses: '200': @@ -560,9 +531,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/Csr' + $ref: '#/components/schemas/ListCsrsForApplicationResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -578,21 +547,15 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathAppId' post: summary: Generate a certificate signing request - description: >- - Generates a new key pair and returns the Certificate Signing - Request(CSR) for it. The information in a CSR is used by the Certificate - Authority (CA) to verify and create your certificate. It also contains - the public key that is included in your certificate. - - - Returns CSR in `pkcs#10` format if the `Accept` media type is - `application/pkcs10` or a CSR object if the `Accept` media type is - `application/json`. + description: |- + Generates a new key pair and returns the certificate signing request (CSR) for it. The information in a CSR is used by the Certificate Authority (CA) to verify and create your certificate. It also contains the public key that's included in your certificate. - > **Note:** The key pair isn't listed in the Key Credentials for the app - until it's published. + Returns CSR in `pkcs#10` format if the `Accept` media type is `application/pkcs10` or a CSR object if the `Accept` media type is `application/json`. + > **Note:** The key pair isn't listed in the key credentials for the app until it's published. operationId: generateCsrForApplication x-codegen-request-body-name: metadata requestBody: @@ -651,18 +614,15 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' + parameters: + - $ref: '#/components/parameters/pathAppId' /api/v1/apps/{appId}/credentials/csrs/{csrId}: get: summary: Retrieve a certificate signing request - description: >- - Retrieves a Certificate Signing Request (CSR) for the app by `csrId`. - + description: |- + Retrieves a certificate signing request (CSR) for the app by `csrId`. - Returns a Base64-encoded CSR in DER format if the `Accept` media type is - `application/pkcs10` or a CSR object if the `Accept` media type is - `application/json`. + Returns a Base64-encoded CSR in DER format if the `Accept` media type is `application/pkcs10` or a CSR object if the `Accept` media type is `application/json`. operationId: getCsrForApplication responses: '200': @@ -712,11 +672,12 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/pathCsrId' delete: summary: Revoke a certificate signing request - description: >- - Revokes a Certificate Signing Request and deletes the key pair from the - app + description: Revokes a certificate signing request and deletes the key pair from the app operationId: revokeCsrFromApplication responses: '204': @@ -737,18 +698,15 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' - - $ref: '#/components/parameters/pathCsrId' + parameters: + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/pathCsrId' /api/v1/apps/{appId}/credentials/csrs/{csrId}/lifecycle/publish: post: summary: Publish a certificate signing request - description: >- - Publishes a Certificate Signing Request (CSR) for the app with a signed - X.509 certificate and adds it into the Application Key Credentials. - - > **Note:** Publishing a certificate completes the lifecycle of the CSR - and it's no longer accessible. + description: |- + Publishes a certificate signing request (CSR) for the app with a signed X.509 certificate and adds it into the application key credentials. + > **Note:** Publishing a certificate completes the lifecycle of the CSR and it's no longer accessible. operationId: publishCsrFromApplication requestBody: required: true @@ -757,26 +715,19 @@ paths: schema: type: string format: binary - description: >- + description: |- X.509 certificate in `CER` format. - - The client can either post in binary or Base64URL-encoded. If - the post is Base64URL-encoded, set the - `Content-Transfer-Encoding` header to `base64`. + The client can either post in binary or Base64URL-encoded. If the post is Base64URL-encoded, set the `Content-Transfer-Encoding` header to `base64`. example: '@certificate.pem' x-okta-operationId: publishBinaryCerCert application/pkix-cert: schema: type: string format: binary - description: >- - X.509 certificate in `DER` format. - - The client can either post in binary or Base64URL-encoded. If - the post is Base64URL-encoded, set the - `Content-Transfer-Encoding` header to `base64`. - example: >- - MIIFgjCCA2qgAwIBAgICEAcwDQYJKoZIhvcNAQELBQAwXjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMQ0wCwYDVQQKDARPa3RhMQwwCgYDVQQLDANFbmcxDTALBgNVBAMMBFJvb3QwHhcNMTcwMzI3MjEyMDQ3WhcNMTgwNDA2MjEyMDQ3WjB4MQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzETMBEGA1UECgwKT2t0YSwgSW5jLjEQMA4GA1UECwwHSmFua3lDbzEVMBMGA1UEAwwMSWRQIElzc3VlciA3MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmkC6yAJVvFwUlmM9gKjb2d+YK5qHFt+mXSsbjWKKs4EfNm+BoQeeovBZtSACyaqLc8IYFTPEURFcbDQ9DkAL04uUIRD2gaHYY7uK0jsluEaXGq2RAIsmzAwNTzkiDw4q9pDL/q7n0f/SDt1TsMaMQayB6bU5jWsmqcWJ8MCRJ1aJMjZ16un5UVx51IIeCbe4QRDxEXGAvYNczsBoZxspDt28esSpq5W0dBFxcyGVudyl54Er3FzAguhgfMVjH+bUec9j2Tl40qDTktrYgYfxz9pfjm01Hl4WYP1YQxeETpSL7cQ5Ihz4jGDtHUEOcZ4GfJrPzrGpUrak8Qp5xcwCqQIDAQABo4IBLjCCASowCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBkAwMwYJYIZIAYb4QgENBCYWJE9wZW5TU0wgR2VuZXJhdGVkIFNlcnZlciBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUVqJukDmyENw/2pTApbxc/HRKbngwgZAGA1UdIwSBiDCBhYAUFx245ZZXqWTTbARfMlFWN77L9EahYqRgMF4xCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEMMAoGA1UECwwDRW5nMQ0wCwYDVQQDDARSb290ggkAlIfpwZjO5o8wDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA0GCSqGSIb3DQEBCwUAA4ICAQCcoBSRtY+9cJY00hLvq6AloYZcdn/kUQupfmyz4n3lKE3wV2FB0swKnK0QDi8iNuQJFdag/19vDHC4/LhoSuv1Q+KXM61pPZVRXXPyC1+e7Y6hj93tEI5HcqLPcDRH1AIG2l8tE7LBn+MQB5Vh6oxjG2IdoWxg6abMfISU+MauPWql4vMDUWo9iNShAo44Z5fd+nuz+hlAinU9Xn9Jf2QsfKvcbMRq7iuqgkabgdmObmWb9KK0Vm7TDkxCH0pB0onPr6epVUP8Obg/pT1Oj/1hOLbfR8CHHWdAWzUBGGvp2TIy2A8LUaEoFnwkxZfdL7Bnd0RH/ClBtAjzLOxmUo7NbZmEnYCcD5pZz7BdZI0db/eBXFqfOlA88rEe+9Sv+NndIq0/WNIIsJi2RgjJnxsxvB5MjhhzmItpFIUl5yqoO3C9jcCp6HDBJxtCGbvAr5ALPn5RCJeBIr67WpAiTd7L3Ebu9SQZlXnoHX8kP04EA6ylR3W0EFbh7KUtq8M2H2vo0wjMj7ysl/3tT7cEZ97s1ygO5iJx3GfMDyrDhtLXSBJ20uSxTJeptRw8SDiwTqunIh1WyKlcQz1WGauSbW4eXdj/r9KYMJ3qMMkdP/9THQUtTcOYx51r8RV9pdzqF2HPnZZNziBa+wXJZHEWp70NyoakNthgYwtypqiDHs2f3Q== + description: |- + X.509 certificate in `DER` format. + The client can either post in binary or Base64URL-encoded. If the post is Base64URL-encoded, set the `Content-Transfer-Encoding` header to `base64`. + example: MIIFgjCCA2qgAwIBAgICEAcwDQYJKoZIhvcNAQELBQAwXjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMQ0wCwYDVQQKDARPa3RhMQwwCgYDVQQLDANFbmcxDTALBgNVBAMMBFJvb3QwHhcNMTcwMzI3MjEyMDQ3WhcNMTgwNDA2MjEyMDQ3WjB4MQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzETMBEGA1UECgwKT2t0YSwgSW5jLjEQMA4GA1UECwwHSmFua3lDbzEVMBMGA1UEAwwMSWRQIElzc3VlciA3MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmkC6yAJVvFwUlmM9gKjb2d+YK5qHFt+mXSsbjWKKs4EfNm+BoQeeovBZtSACyaqLc8IYFTPEURFcbDQ9DkAL04uUIRD2gaHYY7uK0jsluEaXGq2RAIsmzAwNTzkiDw4q9pDL/q7n0f/SDt1TsMaMQayB6bU5jWsmqcWJ8MCRJ1aJMjZ16un5UVx51IIeCbe4QRDxEXGAvYNczsBoZxspDt28esSpq5W0dBFxcyGVudyl54Er3FzAguhgfMVjH+bUec9j2Tl40qDTktrYgYfxz9pfjm01Hl4WYP1YQxeETpSL7cQ5Ihz4jGDtHUEOcZ4GfJrPzrGpUrak8Qp5xcwCqQIDAQABo4IBLjCCASowCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBkAwMwYJYIZIAYb4QgENBCYWJE9wZW5TU0wgR2VuZXJhdGVkIFNlcnZlciBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUVqJukDmyENw/2pTApbxc/HRKbngwgZAGA1UdIwSBiDCBhYAUFx245ZZXqWTTbARfMlFWN77L9EahYqRgMF4xCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEMMAoGA1UECwwDRW5nMQ0wCwYDVQQDDARSb290ggkAlIfpwZjO5o8wDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA0GCSqGSIb3DQEBCwUAA4ICAQCcoBSRtY+9cJY00hLvq6AloYZcdn/kUQupfmyz4n3lKE3wV2FB0swKnK0QDi8iNuQJFdag/19vDHC4/LhoSuv1Q+KXM61pPZVRXXPyC1+e7Y6hj93tEI5HcqLPcDRH1AIG2l8tE7LBn+MQB5Vh6oxjG2IdoWxg6abMfISU+MauPWql4vMDUWo9iNShAo44Z5fd+nuz+hlAinU9Xn9Jf2QsfKvcbMRq7iuqgkabgdmObmWb9KK0Vm7TDkxCH0pB0onPr6epVUP8Obg/pT1Oj/1hOLbfR8CHHWdAWzUBGGvp2TIy2A8LUaEoFnwkxZfdL7Bnd0RH/ClBtAjzLOxmUo7NbZmEnYCcD5pZz7BdZI0db/eBXFqfOlA88rEe+9Sv+NndIq0/WNIIsJi2RgjJnxsxvB5MjhhzmItpFIUl5yqoO3C9jcCp6HDBJxtCGbvAr5ALPn5RCJeBIr67WpAiTd7L3Ebu9SQZlXnoHX8kP04EA6ylR3W0EFbh7KUtq8M2H2vo0wjMj7ysl/3tT7cEZ97s1ygO5iJx3GfMDyrDhtLXSBJ20uSxTJeptRw8SDiwTqunIh1WyKlcQz1WGauSbW4eXdj/r9KYMJ3qMMkdP/9THQUtTcOYx51r8RV9pdzqF2HPnZZNziBa+wXJZHEWp70NyoakNthgYwtypqiDHs2f3Q== x-okta-operationId: publishBinaryDerCert application/x-pem-file: schema: @@ -788,13 +739,6 @@ paths: responses: '201': description: Created - content: - application/json: - schema: - $ref: '#/components/schemas/JsonWebKey' - examples: - PublishCSR: - $ref: '#/components/examples/KeyCredentialExample' '400': description: Bad Request content: @@ -805,8 +749,7 @@ paths: ErrorPublishCSRCertDoesNotMatchCSR: $ref: '#/components/examples/ErrorPublishCSRCertDoesNotMatchCSR' ErrorPublishCSRCertValidityLessThan90Days: - $ref: >- - #/components/examples/ErrorPublishCSRCertValidityLessThan90Days + $ref: '#/components/examples/ErrorPublishCSRCertValidityLessThan90Days' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -822,9 +765,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' - - $ref: '#/components/parameters/pathCsrId' + parameters: + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/pathCsrId' /api/v1/apps/{appId}/credentials/jwks: get: summary: List all the OAuth 2.0 client JSON Web Keys @@ -836,12 +779,7 @@ paths: content: application/json: schema: - type: array - items: - oneOf: - - $ref: '#/components/schemas/OAuth2ClientJsonSigningKeyResponse' - - $ref: >- - #/components/schemas/OAuth2ClientJsonEncryptionKeyResponse + $ref: '#/components/schemas/ListJwkResponse' examples: OAuthClientJsonWebKeyListResponseExample: $ref: '#/components/examples/oAuthClientJsonWebKeyListResponse' @@ -862,50 +800,173 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathAppId' post: summary: Add a JSON Web Key - description: >- + description: |- Adds a new JSON Web Key to the client`s JSON Web Keys. - - > **Note:** This API doesn't allow you to add a key if the existing key - doesn't have a `kid`. This is also consistent with how the [Dynamic - Client Registration](/openapi/okta-oauth/oauth/tag/Client/) or - [Applications](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Application/) - APIs behave, as they don't allow the creation of multiple keys without - `kids`. Use the [Replace an - Application](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Application/#tag/Application/operation/replaceApplication) - or the [Replace a Client - Application](/openapi/okta-oauth/oauth/tag/Client/#tag/Client/operation/replaceClient) - operation to update the JWKS or [Delete an OAuth 2.0 Client JSON Web - Key](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/ApplicationSSOPublicKeys/#tag/ApplicationSSOPublicKeys/operation/deletejwk) - and re-add the key with a `kid`. + > **Note:** This API doesn't allow you to add a key if the existing key doesn't have a `kid`. This is also consistent with how the [Dynamic Client Registration](https://developer.okta.com/docs/api/openapi/okta-oauth/oauth/client) or [Applications](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/application) APIs behave, as they don't allow the creation of multiple keys without `kids`. Use the [Replace an Application](https://developer.okta.com/docs/api/openapi/okta-management/management/application/replaceapplication) or the [Replace a Client Application](https://developer.okta.com/docs/api/openapi/okta-oauth/oauth/client/replaceclient) operation to update the JWKS or [Delete an OAuth 2.0 Client JSON Web Key](https://developer.okta.com/docs/api/openapi/okta-management/management/applicationssopublickeys/deletejwk) and re-add the key with a `kid`. operationId: addJwk requestBody: required: true content: application/json: schema: - oneOf: - - $ref: '#/components/schemas/OAuth2ClientJsonSigningKeyRequest' - - $ref: '#/components/schemas/OAuth2ClientJsonEncryptionKeyRequest' + x-okta-ignore-redocly-rules-for-sdk: true + title: Signing Key + description: A [JSON Web Key (JWK)](https://tools.ietf.org/html/rfc7517) is a JSON representation of a cryptographic key. Okta uses signing keys to verify the signature of a JWT when provided for the `private_key_jwt` client authentication method or for a signed authorize request object. Okta supports both RSA and Elliptic Curve (EC) keys for signing tokens. + type: object + properties: + alg: + type: string + description: Algorithm used in the key + example: RS256 + nullable: false + use: + type: string + description: Acceptable use of the JSON Web Key + example: sig + nullable: false + enum: + - sig + e: + type: string + description: RSA key value (exponent) for key binding + example: AQAB + nullable: false + kty: + type: string + description: Cryptographic algorithm family for the certificate's key pair + example: RSA + nullable: false + enum: + - RSA + 'n': + type: string + description: RSA key value (modulus) for key binding + example: mkC6yAJVvFwUlmM9gKjb2d-YK5qHFt-mXSsbjWKKs4EfNm-BoQeeovBZtSACyaqLc8IYFTPEURFcbDQ9DkAL04uUIRD2gaHYY7uK0jsluEaXGq2RAIsmzAwNTzkiDw4q9pDL_q7n0f_SDt1TsMaMQayB6bU5jWsmqcWJ8MCRJ1aJMjZ16un5UVx51IIeCbe4QRDxEXGAvYNczsBoZxspDt28esSpq5W0dBFxcyGVudyl54Er3FzAguhgfMVjH-bUec9j2Tl40qDTktrYgYfxz9pfjm01Hl4WYP1YQxeETpSL7cQ5Ihz4jGDtHUEOcZ4GfJrPzrGpUrak8Qp5xcwCqQ + nullable: false + kid: + type: string + description: Unique identifier of the JSON Web Key in the OAUth 2.0 client's JWKS + example: SIMcCQNY3uwXoW3y0vf6VxiBb5n9pf8L2fK8d-FIbm4 + nullable: true + status: + type: string + enum: + - ACTIVE + - INACTIVE + description: Status of the OAuth 2.0 client JSON Web Key + example: ACTIVE + nullable: false + default: ACTIVE + x: + type: string + description: The public x coordinate for the elliptic curve point + 'y': + type: string + description: The public y coordinate for the elliptic curve point + discriminator: + propertyName: kty + mapping: + RSA: '#/components/schemas/OAuth2ClientJsonWebKeyRsaRequest' + EC: '#/components/schemas/OAuth2ClientJsonWebKeyECRequest' + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: true examples: createOAuth2ClientJsonWebKeyRequestBody: $ref: '#/components/examples/oAuthClientJsonWebKeyRequest' createOAuth2ClientJsonInactiveEncryptionKeyRequestBody: - $ref: >- - #/components/examples/oAuthClientJsonInactiveEncryptionKeyRequest + $ref: '#/components/examples/oAuthClientJsonInactiveEncryptionKeyRequest' createOAuth2ClientJsonActiveEncryptionKeyRequestBody: - $ref: >- - #/components/examples/oAuthClientJsonActiveEncryptionKeyRequest + $ref: '#/components/examples/oAuthClientJsonActiveEncryptionKeyRequest' responses: '201': description: Created content: application/json: schema: - oneOf: - - $ref: '#/components/schemas/OAuth2ClientJsonSigningKeyResponse' - - $ref: '#/components/schemas/OAuth2ClientJsonEncryptionKeyResponse' + x-okta-ignore-redocly-rules-for-sdk: true + title: Signing Key + description: A [JSON Web Key (JWK)](https://tools.ietf.org/html/rfc7517) is a JSON representation of a cryptographic key. Okta uses signing keys to verify the signature of a JWT when provided for the `private_key_jwt` client authentication method or for a signed authorize request object. Okta supports both RSA and Elliptic Curve (EC) keys for signing tokens. + discriminator: + propertyName: kty + mapping: + RSA: '#/components/schemas/OAuth2ClientJsonWebKeyRsaResponse' + EC: '#/components/schemas/OAuth2ClientJsonWebKeyECResponse' + type: object + properties: + e: + type: string + description: RSA key value (exponent) for key binding + example: AQAB + nullable: false + kty: + type: string + description: Cryptographic algorithm family for the certificate's key pair + example: RSA + nullable: false + enum: + - RSA + 'n': + type: string + description: RSA key value (modulus) for key binding + example: mkC6yAJVvFwUlmM9gKjb2d-YK5qHFt-mXSsbjWKKs4EfNm-BoQeeovBZtSACyaqLc8IYFTPEURFcbDQ9DkAL04uUIRD2gaHYY7uK0jsluEaXGq2RAIsmzAwNTzkiDw4q9pDL_q7n0f_SDt1TsMaMQayB6bU5jWsmqcWJ8MCRJ1aJMjZ16un5UVx51IIeCbe4QRDxEXGAvYNczsBoZxspDt28esSpq5W0dBFxcyGVudyl54Er3FzAguhgfMVjH-bUec9j2Tl40qDTktrYgYfxz9pfjm01Hl4WYP1YQxeETpSL7cQ5Ihz4jGDtHUEOcZ4GfJrPzrGpUrak8Qp5xcwCqQ + nullable: false + kid: + type: string + description: Unique identifier of the JSON Web Key in the OAUth 2.0 client's JWKS + example: SIMcCQNY3uwXoW3y0vf6VxiBb5n9pf8L2fK8d-FIbm4 + nullable: true + status: + type: string + enum: + - ACTIVE + - INACTIVE + description: Status of the OAuth 2.0 client JSON Web Key + example: ACTIVE + nullable: false + default: ACTIVE + created: + type: string + description: Timestamp when the OAuth 2.0 client JSON Web Key was created + example: '2023-02-21T20:08:24.000Z' + readOnly: true + nullable: false + id: + type: string + description: The unique ID of the OAuth client JSON Web Key + example: pks2f4zrZbs8nUa7p0g4 + readOnly: true + nullable: false + lastUpdated: + type: string + description: Timestamp when the OAuth 2.0 client JSON Web Key was updated + example: '2023-02-21T20:08:24.000Z' + readOnly: true + nullable: false + _links: + $ref: '#/components/schemas/OAuthClientSecretLinks' + readOnly: true + nullable: false + x: + type: string + description: The public x coordinate for the elliptic curve point + 'y': + type: string + description: The public y coordinate for the elliptic curve point + use: + type: string + description: Acceptable use of the JSON Web Key + example: enc + nullable: false + enum: + - enc + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: true examples: newOAuth2ClientJsonWebKeyResponse: $ref: '#/components/examples/oAuthClientJsonWebKey' @@ -945,12 +1006,12 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' + parameters: + - $ref: '#/components/parameters/pathAppId' /api/v1/apps/{appId}/credentials/jwks/{keyId}: get: summary: Retrieve an OAuth 2.0 client JSON Web Key - description: Retrieves an OAuth 2.0 Client JSON Web Key by `keyId`. + description: Retrieves an OAuth 2.0 client JSON Web Key by `keyId` operationId: getJwk responses: '200': @@ -959,9 +1020,84 @@ paths: application/json: schema: type: object - oneOf: - - $ref: '#/components/schemas/OAuth2ClientJsonSigningKeyResponse' - - $ref: '#/components/schemas/OAuth2ClientJsonEncryptionKeyResponse' + x-okta-ignore-redocly-rules-for-sdk: true + title: Signing Key + description: A [JSON Web Key (JWK)](https://tools.ietf.org/html/rfc7517) is a JSON representation of a cryptographic key. Okta uses signing keys to verify the signature of a JWT when provided for the `private_key_jwt` client authentication method or for a signed authorize request object. Okta supports both RSA and Elliptic Curve (EC) keys for signing tokens. + discriminator: + propertyName: kty + mapping: + RSA: '#/components/schemas/OAuth2ClientJsonWebKeyRsaResponse' + EC: '#/components/schemas/OAuth2ClientJsonWebKeyECResponse' + properties: + e: + type: string + description: RSA key value (exponent) for key binding + example: AQAB + nullable: false + kty: + type: string + description: Cryptographic algorithm family for the certificate's key pair + example: RSA + nullable: false + enum: + - RSA + 'n': + type: string + description: RSA key value (modulus) for key binding + example: mkC6yAJVvFwUlmM9gKjb2d-YK5qHFt-mXSsbjWKKs4EfNm-BoQeeovBZtSACyaqLc8IYFTPEURFcbDQ9DkAL04uUIRD2gaHYY7uK0jsluEaXGq2RAIsmzAwNTzkiDw4q9pDL_q7n0f_SDt1TsMaMQayB6bU5jWsmqcWJ8MCRJ1aJMjZ16un5UVx51IIeCbe4QRDxEXGAvYNczsBoZxspDt28esSpq5W0dBFxcyGVudyl54Er3FzAguhgfMVjH-bUec9j2Tl40qDTktrYgYfxz9pfjm01Hl4WYP1YQxeETpSL7cQ5Ihz4jGDtHUEOcZ4GfJrPzrGpUrak8Qp5xcwCqQ + nullable: false + kid: + type: string + description: Unique identifier of the JSON Web Key in the OAUth 2.0 client's JWKS + example: SIMcCQNY3uwXoW3y0vf6VxiBb5n9pf8L2fK8d-FIbm4 + nullable: true + status: + type: string + enum: + - ACTIVE + - INACTIVE + description: Status of the OAuth 2.0 client JSON Web Key + example: ACTIVE + nullable: false + default: ACTIVE + created: + type: string + description: Timestamp when the OAuth 2.0 client JSON Web Key was created + example: '2023-02-21T20:08:24.000Z' + readOnly: true + nullable: false + id: + type: string + description: The unique ID of the OAuth client JSON Web Key + example: pks2f4zrZbs8nUa7p0g4 + readOnly: true + nullable: false + lastUpdated: + type: string + description: Timestamp when the OAuth 2.0 client JSON Web Key was updated + example: '2023-02-21T20:08:24.000Z' + readOnly: true + nullable: false + _links: + $ref: '#/components/schemas/OAuthClientSecretLinks' + readOnly: true + nullable: false + x: + type: string + description: The public x coordinate for the elliptic curve point + 'y': + type: string + description: The public y coordinate for the elliptic curve point + use: + type: string + description: Acceptable use of the JSON Web Key + example: enc + nullable: false + enum: + - enc + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: true examples: OAuthClientJsonWebKeyResponseExample: $ref: '#/components/examples/oAuthClientJsonWebKey' @@ -982,11 +1118,12 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/pathJsonWebKeyId' delete: summary: Delete an OAuth 2.0 client JSON Web Key - description: >- - Deletes an OAuth 2.0 Client JSON Web Key by `keyId`. You can only delete - an inactive key. + description: Deletes an OAuth 2.0 Client JSON Web Key by `keyId`. You can only delete an inactive key. operationId: deletejwk responses: '204': @@ -1017,18 +1154,15 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' - - $ref: '#/components/parameters/pathJsonWebKeyId' + parameters: + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/pathJsonWebKeyId' /api/v1/apps/{appId}/credentials/jwks/{keyId}/lifecycle/activate: post: summary: Activate an OAuth 2.0 client JSON Web Key - description: >- - Activates an OAuth 2.0 Client JSON Web Key by `keyId` - - > **Note:** You can have only one active encryption key at any given - time for app. When you activate an inactive key, the current active key - is automatically deactivated. + description: |- + Activates an OAuth 2.0 client JSON Web Key by `keyId` + > **Note:** You can have only one active encryption key at any given time for an app. When you activate an inactive key, the current active key is automatically deactivated. operationId: activateOAuth2ClientJsonWebKey responses: '200': @@ -1036,9 +1170,85 @@ paths: content: application/json: schema: - oneOf: - - $ref: '#/components/schemas/OAuth2ClientJsonSigningKeyResponse' - - $ref: '#/components/schemas/OAuth2ClientJsonEncryptionKeyResponse' + x-okta-ignore-redocly-rules-for-sdk: true + title: Signing Key + description: A [JSON Web Key (JWK)](https://tools.ietf.org/html/rfc7517) is a JSON representation of a cryptographic key. Okta uses signing keys to verify the signature of a JWT when provided for the `private_key_jwt` client authentication method or for a signed authorize request object. Okta supports both RSA and Elliptic Curve (EC) keys for signing tokens. + discriminator: + propertyName: kty + mapping: + RSA: '#/components/schemas/OAuth2ClientJsonWebKeyRsaResponse' + EC: '#/components/schemas/OAuth2ClientJsonWebKeyECResponse' + type: object + properties: + e: + type: string + description: RSA key value (exponent) for key binding + example: AQAB + nullable: false + kty: + type: string + description: Cryptographic algorithm family for the certificate's key pair + example: RSA + nullable: false + enum: + - RSA + 'n': + type: string + description: RSA key value (modulus) for key binding + example: mkC6yAJVvFwUlmM9gKjb2d-YK5qHFt-mXSsbjWKKs4EfNm-BoQeeovBZtSACyaqLc8IYFTPEURFcbDQ9DkAL04uUIRD2gaHYY7uK0jsluEaXGq2RAIsmzAwNTzkiDw4q9pDL_q7n0f_SDt1TsMaMQayB6bU5jWsmqcWJ8MCRJ1aJMjZ16un5UVx51IIeCbe4QRDxEXGAvYNczsBoZxspDt28esSpq5W0dBFxcyGVudyl54Er3FzAguhgfMVjH-bUec9j2Tl40qDTktrYgYfxz9pfjm01Hl4WYP1YQxeETpSL7cQ5Ihz4jGDtHUEOcZ4GfJrPzrGpUrak8Qp5xcwCqQ + nullable: false + kid: + type: string + description: Unique identifier of the JSON Web Key in the OAUth 2.0 client's JWKS + example: SIMcCQNY3uwXoW3y0vf6VxiBb5n9pf8L2fK8d-FIbm4 + nullable: true + status: + type: string + enum: + - ACTIVE + - INACTIVE + description: Status of the OAuth 2.0 client JSON Web Key + example: ACTIVE + nullable: false + default: ACTIVE + created: + type: string + description: Timestamp when the OAuth 2.0 client JSON Web Key was created + example: '2023-02-21T20:08:24.000Z' + readOnly: true + nullable: false + id: + type: string + description: The unique ID of the OAuth client JSON Web Key + example: pks2f4zrZbs8nUa7p0g4 + readOnly: true + nullable: false + lastUpdated: + type: string + description: Timestamp when the OAuth 2.0 client JSON Web Key was updated + example: '2023-02-21T20:08:24.000Z' + readOnly: true + nullable: false + _links: + $ref: '#/components/schemas/OAuthClientSecretLinks' + readOnly: true + nullable: false + x: + type: string + description: The public x coordinate for the elliptic curve point + 'y': + type: string + description: The public y coordinate for the elliptic curve point + use: + type: string + description: Acceptable use of the JSON Web Key + example: enc + nullable: false + enum: + - enc + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: true examples: activateOAuth2ClientJsonWebKeyResponse: $ref: '#/components/examples/oAuthClientJsonWebKey' @@ -1059,19 +1269,15 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' - - $ref: '#/components/parameters/pathJsonWebKeyId' + parameters: + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/pathJsonWebKeyId' /api/v1/apps/{appId}/credentials/jwks/{keyId}/lifecycle/deactivate: post: summary: Deactivate an OAuth 2.0 client JSON Web Key - description: >- - Deactivates an OAuth 2.0 Client JSON Web Key by `keyId`. - - > **Note:** You can only deactivate signing keys. Deactivating the - active encryption key isn't allowed if the client has ID token - encryption enabled. You can activate another encryption key, which makes - the current key inactive. + description: |- + Deactivates an OAuth 2.0 client JSON Web Key by `keyId` + > **Note:** You can only deactivate signing keys. Deactivating the active encryption key isn't allowed if the client has ID token encryption enabled. You can activate another encryption key, which makes the current key inactive. operationId: deactivateOAuth2ClientJsonWebKey responses: '200': @@ -1082,8 +1288,7 @@ paths: $ref: '#/components/schemas/OAuth2ClientJsonSigningKeyResponse' examples: deactivateOAuth2ClientJsonWebKeyResponse: - $ref: >- - #/components/examples/deactivateOAuth2ClientJsonWebKeyResponse + $ref: '#/components/examples/deactivateOAuth2ClientJsonWebKeyResponse' '400': description: Bad Request content: @@ -1092,11 +1297,9 @@ paths: $ref: '#/components/schemas/Error' examples: ErrorDeactivateTheOnlyKeyWithPrivateKeyJwtAuthMethod: - $ref: >- - #/components/examples/ErrorDeactivateTheOnlyKeyWithPrivateKeyJwtAuthMethod + $ref: '#/components/examples/ErrorDeactivateTheOnlyKeyWithPrivateKeyJwtAuthMethod' ErrorDeactivateTheOnlyKeyWithRequestObjectSignAlgorithm: - $ref: >- - #/components/examples/ErrorDeactivateTheOnlyKeyWithRequestObjectSignAlgorithm + $ref: '#/components/examples/ErrorDeactivateTheOnlyKeyWithRequestObjectSignAlgorithm' ErrorDeactivateEncryptionKey: $ref: '#/components/examples/ErrorDeactivateEncryptionKey' '401': @@ -1116,9 +1319,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' - - $ref: '#/components/parameters/pathJsonWebKeyId' + parameters: + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/pathJsonWebKeyId' /api/v1/apps/{appId}/credentials/keys: get: summary: List all key credentials @@ -1130,9 +1333,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/JsonWebKey' + $ref: '#/components/schemas/ListApplicationKeysResponse' examples: ListAllKeyCredentialsExample: $ref: '#/components/examples/ListAllKeyCredentialsExample' @@ -1151,32 +1352,24 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' + parameters: + - $ref: '#/components/parameters/pathAppId' /api/v1/apps/{appId}/credentials/keys/generate: post: summary: Generate a key credential - description: >- + description: |- Generates a new X.509 certificate for an app key credential - - > **Note:** To update an Application with the newly generated key - credential, use the [Replace an - Application](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Application/#tag/Application/operation/replaceApplication) - request with the new - [credentials.signing.kid](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Application/#tag/Application/operation/replaceApplication!path=4/credentials/signing/kid&t=request) - value in the request body. You can provide just the [Signing Credential - object](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Application/#tag/Application/operation/replaceApplication!path=4/credentials/signing&t=request) - instead of the entire [Application Credential - object](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Application/#tag/Application/operation/replaceApplication!path=4/credentials&t=request). + > **Note:** To update an app with the newly generated key credential, use the [Replace an Application](https://developer.okta.com/docs/api/openapi/okta-management/management/application/replaceapplication) request with the new [credentials.signing.kid](https://developer.okta.com/docs/api/openapi/okta-management/management/application/replaceapplication#application/replaceapplication/t=request&path=&d=0/credentials/signing/kid) value in the request body. You can provide just the [signing credential object](https://developer.okta.com/docs/api/openapi/okta-management/management/application/replaceapplication#application/replaceapplication/t=request&path=&d=0/credentials/signing) instead of the entire [application credential object](https://developer.okta.com/docs/api/openapi/okta-management/management/application/replaceapplication#application/replaceapplication/t=response&c=200&path=&d=0/credentials). operationId: generateApplicationKey parameters: - name: validityYears - description: Expiry years of the Application Key Credential + description: Expiry years of the application key credential in: query required: true schema: type: integer example: 5 + - $ref: '#/components/parameters/pathAppId' responses: '201': description: Created @@ -1211,12 +1404,10 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' /api/v1/apps/{appId}/credentials/keys/{keyId}: get: summary: Retrieve a key credential - description: Retrieves a specific Application Key Credential by `kid` + description: Retrieves a specific application key credential by `kid` operationId: getApplicationKey responses: '200': @@ -1243,41 +1434,31 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' - - $ref: '#/components/parameters/pathKeyId' + parameters: + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/pathKeyId' /api/v1/apps/{appId}/credentials/keys/{keyId}/clone: post: summary: Clone a key credential - description: >- - Clones an X.509 certificate for an Application Key Credential from a - source app to a target app. - - - For step-by-step instructions to clone a credential, see [Share - application key credentials for IdPs across - apps](https://developer.okta.com/docs/guides/sharing-cert/main/). + description: |- + Clones an X.509 certificate for an application key credential from a source app to a target app. + For step-by-step instructions to clone a credential, see [Share application key credentials for IdPs across apps](https://developer.okta.com/docs/guides/sharing-cert/main/). > **Note:** Sharing certificates isn't a recommended security practice. operationId: cloneApplicationKey parameters: - name: targetAid in: query - description: Unique key of the target Application + description: Unique key of the target app required: true schema: type: string example: 0ouuytCAJSSDELFTUIDS + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/pathKeyId' responses: '201': description: Created - content: - application/json: - schema: - $ref: '#/components/schemas/JsonWebKey' - examples: - KeyCredentialExample: - $ref: '#/components/examples/KeyCredentialExample' '400': description: Bad Request content: @@ -1302,9 +1483,6 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' - - $ref: '#/components/parameters/pathKeyId' /api/v1/apps/{appId}/credentials/secrets: get: summary: List all OAuth 2.0 client secrets @@ -1316,9 +1494,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/OAuth2ClientSecret' + $ref: '#/components/schemas/ListOAuth2ClientSecretsResponse' examples: OAuthClientSecretListResponseExample: $ref: '#/components/examples/oAuthClientSecretListResponse' @@ -1339,18 +1515,13 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathAppId' post: summary: Create an OAuth 2.0 client secret - description: >- - Creates an OAuth 2.0 Client Secret object with a new active client - secret. You can create up to two Secret objects. An error is returned if - you attempt to create more than two Secret objects. - - > **Note:** This API lets you bring your own secret. If - [token_endpoint_auth_method](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Application/#tag/Application/operation/createApplication!path=4/credentials/oauthClient/token_endpoint_auth_method&t=request) - of the app is `client_secret_jwt`, then the minimum length of - `client_secret` is 32 characters. If no secret is specified in the - request, Okta adds a new system-generated secret. + description: |- + Creates an OAuth 2.0 client secret object with a new active client secret. You can create up to two secret objects. An error is returned if you attempt to create more than two secret objects. + > **Note:** This API lets you bring your own secret. If [token_endpoint_auth_method](https://developer.okta.com/docs/api/openapi/okta-oauth/oauth/client/createclient#client/createclient/t=request&path=token_endpoint_auth_method) of the app is `client_secret_jwt`, then the minimum length of `client_secret` is 32 characters. If no secret is specified in the request, Okta adds a new system-generated secret. operationId: createOAuth2ClientSecret requestBody: content: @@ -1359,11 +1530,9 @@ paths: $ref: '#/components/schemas/OAuth2ClientSecretRequestBody' examples: createOAuth2ClientSecretSystemGeneratedRequestBody: - $ref: >- - #/components/examples/createOAuth2ClientSecretSystemGeneratedRequestBody + $ref: '#/components/examples/createOAuth2ClientSecretSystemGeneratedRequestBody' createOAuth2ClientSecretCustomRequestBody: - $ref: >- - #/components/examples/createOAuth2ClientSecretCustomRequestBody + $ref: '#/components/examples/createOAuth2ClientSecretCustomRequestBody' responses: '201': description: Created @@ -1386,8 +1555,7 @@ paths: ErrorClientSecretTooShort: $ref: '#/components/examples/ErrorClientSecretTooShort' ErrorClientSecretTooShortJWT: - $ref: >- - #/components/examples/ErrorClientSecretTooShortWithClientSecretJWT + $ref: '#/components/examples/ErrorClientSecretTooShortWithClientSecretJWT' ErrorClientSecretPrivateKeyJWT: $ref: '#/components/examples/ErrorClientSecretWithPrivateKeyJWT' ErrorClientSecretNonAscii: @@ -1409,12 +1577,12 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' + parameters: + - $ref: '#/components/parameters/pathAppId' /api/v1/apps/{appId}/credentials/secrets/{secretId}: get: summary: Retrieve an OAuth 2.0 client secret - description: Retrieves an OAuth 2.0 Client Secret by `secretId` + description: Retrieves an OAuth 2.0 client secrets by `secretId` operationId: getOAuth2ClientSecret responses: '200': @@ -1444,11 +1612,12 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/pathClientSecretId' delete: summary: Delete an OAuth 2.0 client secret - description: >- - Deletes an OAuth 2.0 Client Secret by `secretId`. You can only delete an - inactive Secret. + description: Deletes an OAuth 2.0 client secret by `secretId`. You can only delete an inactive secret. operationId: deleteOAuth2ClientSecret responses: '204': @@ -1479,13 +1648,13 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' - - $ref: '#/components/parameters/pathClientSecretId' + parameters: + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/pathClientSecretId' /api/v1/apps/{appId}/credentials/secrets/{secretId}/lifecycle/activate: post: summary: Activate an OAuth 2.0 client secret - description: Activates an OAuth 2.0 Client Secret by `secretId` + description: Activates an OAuth 2.0 client secret by `secretId` operationId: activateOAuth2ClientSecret responses: '200': @@ -1514,15 +1683,13 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' - - $ref: '#/components/parameters/pathClientSecretId' + parameters: + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/pathClientSecretId' /api/v1/apps/{appId}/credentials/secrets/{secretId}/lifecycle/deactivate: post: summary: Deactivate an OAuth 2.0 client secret - description: >- - Deactivates an OAuth 2.0 Client Secret by `secretId`. You can't - deactivate a secret if it's the only secret of the client. + description: Deactivates an OAuth 2.0 client secret by `secretId`. You can't deactivate a secret if it's the only secret of the client. operationId: deactivateOAuth2ClientSecret responses: '200': @@ -1560,23 +1727,20 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' - - $ref: '#/components/parameters/pathClientSecretId' + parameters: + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/pathClientSecretId' /api/v1/apps/{appId}/cwo/connections: get: summary: Retrieve all Cross App Access connections - description: > - Retrieves inbound and outbound Cross App Access connections associated - with an app + description: | + Retrieves inbound and outbound Cross App Access connections associated with an app operationId: getAllCrossAppAccessConnections parameters: - name: after in: query required: false - description: >- - Specifies the pagination cursor for the next page of connection - results + description: Specifies the pagination cursor for the next page of connection results schema: type: string - name: limit @@ -1592,15 +1756,60 @@ paths: format: int32 default: -1 maximum: 200 + - name: status + in: query + required: false + description: | + Filters connections by their lifecycle status. When specified, only connections that match the specified status are returned. + schema: + type: string + enum: + - ACTIVE + - INACTIVE + example: ACTIVE + - name: requestingAppId + in: query + required: false + description: Filters only connections where the app with the specified ID is the requesting app + schema: + type: string + example: 0oa8mm6ktyXqkcs5t0g7 + - name: resourceAppId + in: query + required: false + description: Filters only connections where the app with the specified ID is the requesting app + schema: + type: string + example: 0oa8mmm7ruidxWhlf0g7 + - name: activeAppsOnly + in: query + required: false + description: When set to true, filters the result to include only connections where both the requesting and resource app have a status of ACTIVE + schema: + type: string + example: true + - name: requestingAppName + in: query + required: false + description: Filters connections where the requesting app's name matches the provided search string + schema: + type: string + example: zoom + - name: resourceAppName + in: query + required: false + description: Filters connections where the resource app's name matches the provided search string + schema: + type: string + example: box + - $ref: '#/components/parameters/pathAppId' responses: '200': description: Success content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/OrgCrossAppAccessConnection' + $ref: '#/components/schemas/GetAllCrossAppAccessConnectionsResponse' '401': $ref: '#/components/responses/ErrorInvalidToken401' '403': @@ -1659,8 +1868,8 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathAppId' + parameters: + - $ref: '#/components/parameters/pathAppId' /api/v1/apps/{appId}/cwo/connections/{connectionId}: get: summary: Retrieve a Cross App Access connection @@ -1693,6 +1902,9 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine + parameters: + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/connectionId' patch: summary: Update a Cross App Access connection description: | @@ -1732,6 +1944,9 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine + parameters: + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/connectionId' delete: summary: Delete a Cross App Access connection description: | @@ -1759,20 +1974,16 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathAppId' - - $ref: '#/components/parameters/connectionId' + parameters: + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/connectionId' /api/v1/apps/{appId}/features: get: summary: List all features - description: > + description: | Lists all features for an app - - > **Note:** This request returns an error if provisioning isn't enabled - for the app. - - > To set up provisioning, see [Update the default provisioning - connection](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/ApplicationConnections/#tag/ApplicationConnections/operation/updateDefaultProvisioningConnectionForApplication). + > **Note:** This request returns an error if provisioning isn't enabled for the app. + > To set up provisioning, see [Update the default provisioning connection](https://developer.okta.com/docs/api/openapi/okta-management/management/applicationconnections/updatedefaultprovisioningconnectionforapplication). operationId: listFeaturesForApplication responses: '200': @@ -1780,9 +1991,7 @@ paths: content: application/json: schema: - items: - $ref: '#/components/schemas/ApplicationFeature' - type: array + $ref: '#/components/schemas/ListFeaturesForApplicationResponse' examples: ListAppFeatureResponse: $ref: '#/components/examples/AppFeatureListResponseEx' @@ -1810,8 +2019,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' + parameters: + - $ref: '#/components/parameters/pathAppId' /api/v1/apps/{appId}/features/{featureName}: get: summary: Retrieve a feature @@ -1842,6 +2051,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/pathFeatureName' put: summary: Update a feature description: | @@ -1852,15 +2064,30 @@ paths: content: application/json: schema: - oneOf: - - $ref: '#/components/schemas/CapabilitiesObject' - - $ref: '#/components/schemas/CapabilitiesInboundProvisioningObject' + x-okta-ignore-redocly-rules-for-sdk: true + title: USER_PROVISIONING + description: Defines the configurations for the USER_PROVISIONING feature + type: object + properties: + create: + $ref: '#/components/schemas/CapabilitiesCreateObject' + update: + $ref: '#/components/schemas/CapabilitiesUpdateObject' + importRules: + $ref: '#/components/schemas/CapabilitiesImportRulesObject' + importSettings: + $ref: '#/components/schemas/CapabilitiesImportSettingsObject' + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: true + required: + - importSettings + - importRules examples: UpdateAppFeatureEx: $ref: '#/components/examples/UpdateAppFeatureRequestEx' UpdateInboundProvisioningFeatureEx: - $ref: >- - #/components/examples/UpdateInboundProvisioningFeatureRequestEx + $ref: '#/components/examples/UpdateInboundProvisioningFeatureRequestEx' required: true responses: '200': @@ -1873,8 +2100,7 @@ paths: UpdateAppFeatureEx: $ref: '#/components/examples/UpdateAppFeatureResponseEx' UpdateInboundProvisioningFeatureEx: - $ref: >- - #/components/examples/UpdateInboundProvisioningFeatureResponseEx + $ref: '#/components/examples/UpdateInboundProvisioningFeatureResponseEx' '400': $ref: '#/components/responses/ErrorApiValidationFailed400' '403': @@ -1892,9 +2118,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' - - $ref: '#/components/parameters/pathFeatureName' + parameters: + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/pathFeatureName' /api/v1/apps/{appId}/federated-claims: get: summary: List all configured federated claims @@ -1906,9 +2132,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/FederatedClaim' + $ref: '#/components/schemas/ListFederatedClaimsResponse' examples: listFederatedClaimResponse: $ref: '#/components/examples/listFederatedClaimResponse' @@ -1929,11 +2153,11 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathAppId' post: summary: Create a federated claim - description: >- - Creates a claim that will be included in tokens produced by federation - protocols (for example: OIDC `id_tokens` or SAML Assertions) + description: 'Creates a claim that will be included in tokens produced by federation protocols (for example: OIDC `id_tokens` or SAML Assertions)' operationId: createFederatedClaim requestBody: required: true @@ -1975,8 +2199,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' + parameters: + - $ref: '#/components/parameters/pathAppId' /api/v1/apps/{appId}/federated-claims/{claimId}: get: summary: Retrieve a federated claim @@ -2010,11 +2234,12 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/claimId' put: summary: Replace a federated claim - description: >- - Replaces a claim that will be included in tokens produced by federation - protocols (for example: OIDC `id_tokens` or SAML Assertions) + description: 'Replaces a claim that will be included in tokens produced by federation protocols (for example: OIDC `id_tokens` or SAML Assertions)' operationId: replaceFederatedClaim requestBody: content: @@ -2055,6 +2280,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/claimId' delete: summary: Delete a federated claim description: Deletes a federated claim by `claimId` @@ -2079,9 +2307,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' - - $ref: '#/components/parameters/claimId' + parameters: + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/claimId' /api/v1/apps/{appId}/grants: get: summary: List all app grants @@ -2089,15 +2317,14 @@ paths: operationId: listScopeConsentGrants parameters: - $ref: '#/components/parameters/queryAppGrantsExpand' + - $ref: '#/components/parameters/pathAppId' responses: '200': description: Success content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/OAuth2ScopeConsentGrant' + $ref: '#/components/schemas/ListScopeConsentGrantsResponse' examples: ListAppGrantsExample: $ref: '#/components/examples/ListAppGrantsEx' @@ -2157,8 +2384,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' + parameters: + - $ref: '#/components/parameters/pathAppId' /api/v1/apps/{appId}/grants/{grantId}: get: summary: Retrieve an app grant @@ -2166,6 +2393,8 @@ paths: operationId: getScopeConsentGrant parameters: - $ref: '#/components/parameters/queryAppGrantsExpand' + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/pathGrantId' responses: '200': description: Success @@ -2214,9 +2443,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' - - $ref: '#/components/parameters/pathGrantId' + parameters: + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/pathGrantId' /api/v1/apps/{appId}/group-push/mappings: get: x-okta-lifecycle: @@ -2241,12 +2470,8 @@ paths: maximum: 1000 minimum: 1 - name: lastUpdated - description: >- - Filters group push mappings by last updated date. The `lastUpdated` - parameter supports the following format: `YYYY-MM-DDTHH:mm:ssZ`. - This filters mappings updated on or after the specified date and - time in UTC. - + description: |- + Filters group push mappings by last updated date. The `lastUpdated` parameter supports the following format: `YYYY-MM-DDTHH:mm:ssZ`. This filters mappings updated on or after the specified date and time in UTC. If you don't specify a value, all group push mappings are returned. in: query @@ -2254,35 +2479,29 @@ paths: type: string example: '2025-01-01T00:00:00Z' - name: sourceGroupId - description: >- - Filters group push mappings by source group ID. If you don't specify - a value, all group push mappings are returned. + description: Filters group push mappings by source group ID. If you don't specify a value, all group push mappings are returned. in: query schema: type: string example: 00g00000000000000000 - name: status - description: >- - Filters group push mappings by status. If you don't specify a value, - all group push mappings are returned. + description: Filters group push mappings by status. If you don't specify a value, all group push mappings are returned. in: query schema: $ref: '#/components/schemas/GroupPushMappingStatus' + - $ref: '#/components/parameters/pathAppId' responses: '200': description: OK content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/GroupPushMapping' + $ref: '#/components/schemas/ListGroupPushMappingsResponse' examples: List group push mappings: $ref: '#/components/examples/ListGroupPushMappingsResponse_Example' List group push mappings with active filter: - $ref: >- - #/components/examples/ListGroupPushMappingsResponse_ExampleWithActiveFilter + $ref: '#/components/examples/ListGroupPushMappingsResponse_ExampleWithActiveFilter' '401': $ref: '#/components/responses/ErrorInvalidToken401' '403': @@ -2301,13 +2520,10 @@ paths: lifecycle: GA isGenerallyAvailable: true summary: Create a group push mapping - description: >- + description: |- Creates or links a group push mapping. - - **Note:** Either `targetGroupId` or `targetGroupName` must be provided, - but not both. If `targetGroupId` is provided, it links to an existing - group. If `targetGroupName` is provided, it creates a new group. + **Note:** Either `targetGroupId` or `targetGroupName` must be provided, but not both. If `targetGroupId` is provided, it links to an existing group. If `targetGroupName` is provided, it creates a new group. operationId: createGroupPushMapping x-codegen-request-body-name: body requestBody: @@ -2317,14 +2533,11 @@ paths: $ref: '#/components/schemas/CreateGroupPushMappingRequest' examples: Create group push mapping (create new group): - $ref: >- - #/components/examples/CreateGroupPushMappingRequest_ExampleCreate + $ref: '#/components/examples/CreateGroupPushMappingRequest_ExampleCreate' Create group push mapping (Active Directory): - $ref: >- - #/components/examples/CreateGroupPushMappingRequest_ExampleCreate_ActiveDirectory + $ref: '#/components/examples/CreateGroupPushMappingRequest_ExampleCreate_ActiveDirectory' Create group push mapping (link existing group): - $ref: >- - #/components/examples/CreateGroupPushMappingRequest_ExampleLink + $ref: '#/components/examples/CreateGroupPushMappingRequest_ExampleLink' required: true responses: '201': @@ -2335,14 +2548,11 @@ paths: $ref: '#/components/schemas/GroupPushMapping' examples: Create group push mapping: - $ref: >- - #/components/examples/CreateGroupPushMappingResponse_ExampleCreate + $ref: '#/components/examples/CreateGroupPushMappingResponse_ExampleCreate' Create group push mapping (Active Directory): - $ref: >- - #/components/examples/CreateGroupPushMappingResponse_ExampleCreate_ActiveDirectory + $ref: '#/components/examples/CreateGroupPushMappingResponse_ExampleCreate_ActiveDirectory' Create group push mapping (link existing group): - $ref: >- - #/components/examples/CreateGroupPushMappingResponse_ExampleLink + $ref: '#/components/examples/CreateGroupPushMappingResponse_ExampleLink' '400': $ref: '#/components/responses/ErrorApiValidationFailed400' '401': @@ -2365,8 +2575,8 @@ paths: - okta.groups.manage tags: - GroupPushMapping - parameters: - - $ref: '#/components/parameters/pathAppId' + parameters: + - $ref: '#/components/parameters/pathAppId' /api/v1/apps/{appId}/group-push/mappings/{mappingId}: get: x-okta-lifecycle: @@ -2384,11 +2594,9 @@ paths: $ref: '#/components/schemas/GroupPushMapping' examples: Retrieve group push mapping: - $ref: >- - #/components/examples/RetrieveGroupPushMappingResponse_Example + $ref: '#/components/examples/RetrieveGroupPushMappingResponse_Example' Retrieve group push mapping (Active Directory): - $ref: >- - #/components/examples/RetrieveGroupPushMappingResponse_Example_ActiveDirectory + $ref: '#/components/examples/RetrieveGroupPushMappingResponse_Example_ActiveDirectory' '401': $ref: '#/components/responses/ErrorInvalidToken401' '403': @@ -2404,6 +2612,9 @@ paths: - okta.groups.read tags: - GroupPushMapping + parameters: + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/pathGroupPushMappingId' patch: x-okta-lifecycle: lifecycle: GA @@ -2455,25 +2666,26 @@ paths: - okta.groups.manage tags: - GroupPushMapping + parameters: + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/pathGroupPushMappingId' delete: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true summary: Delete a group push mapping - description: >- - Deletes a specific group push mapping. The group push mapping must be in - an `INACTIVE` state. + description: Deletes a specific group push mapping. The group push mapping must be in an `INACTIVE` state. operationId: deleteGroupPushMapping parameters: - in: query name: deleteTargetGroup - description: >- - If set to `true`, the target group is also deleted. If set to - `false`, the target group isn't deleted. + description: If set to `true`, the target group is also deleted. If set to `false`, the target group isn't deleted. required: true schema: - type: boolean - default: false + type: string + default: 'false' + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/pathGroupPushMappingId' responses: '204': description: No Content @@ -2500,9 +2712,6 @@ paths: - okta.groups.manage tags: - GroupPushMapping - parameters: - - $ref: '#/components/parameters/pathAppId' - - $ref: '#/components/parameters/pathGroupPushMappingId' /api/v1/apps/{appId}/groups: get: summary: List all application groups @@ -2511,37 +2720,28 @@ paths: parameters: - name: q in: query - description: >- - Specifies a filter for a list of assigned groups returned based on - their names. The value of `q` is matched against the group `name`. - - This filter only supports the `startsWith` operation that matches - the `q` string against the beginning of the [group - name](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/Group/#tag/Group/operation/listGroups!c=200&path=profile/name&t=response). + description: |- + Specifies a filter for a list of assigned groups returned based on their names. The value of `q` is matched against the group `name`. + This filter only supports the `startsWith` operation that matches the `q` string against the beginning of the [group name](openapi/okta-management/management/group#tag/Group/operation/listGroups!c=200&path=profile/name&t=response). schema: type: string example: test - name: after in: query - description: >- - Specifies the pagination cursor for the `next` page of results. - Treat this as an opaque value obtained through the next link - relationship. See - [Pagination](https://developer.okta.com/docs/api/#pagination). + description: Specifies the pagination cursor for the `next` page of results. Treat this as an opaque value obtained through the next link relationship. See [Pagination](https://developer.okta.com/docs/api/#pagination). schema: type: string example: 16275000448691 - $ref: '#/components/parameters/queryGroupAssignmentLimit' - $ref: '#/components/parameters/queryGroupAssignmentWithMetadataExpand' + - $ref: '#/components/parameters/pathAppId' responses: '200': description: Success content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/ApplicationGroupAssignment' + $ref: '#/components/schemas/ListApplicationGroupAssignmentsResponse' examples: listGroupAssignmentsResponseExample: $ref: '#/components/examples/GroupAssignmentExListResponse' @@ -2560,8 +2760,6 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' /api/v1/apps/{appId}/groups/{groupId}: get: summary: Retrieve an application group @@ -2569,6 +2767,8 @@ paths: operationId: getApplicationGroupAssignment parameters: - $ref: '#/components/parameters/queryGroupAssignmentWithGroupExpand' + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/pathGroupId' responses: '200': description: Success @@ -2596,16 +2796,9 @@ paths: isGenerallyAvailable: true put: summary: Assign an application group - description: >- - Assigns a - [Group](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/Group/) - to an app, which in turn assigns the app to each - [User](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/) - that belongs to the group. - - The resulting application user - [scope](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/ApplicationUsers/#tag/ApplicationUsers/operation/listApplicationUsers!c=200&path=scope&t=response) - is `GROUP` since the assignment was from the group membership. + description: |- + Assigns a [Group](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/group) to an app, which in turn assigns the app to each [User](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/user) that belongs to the group. + The resulting application user [scope](https://developer.okta.com/docs/api/openapi/okta-management/management/applicationusers/listapplicationusers#applicationusers/listapplicationusers/t=response&c=200&path=scope) is `GROUP` since the assignment was from the group membership. operationId: assignGroupToApplication x-codegen-request-body-name: applicationGroupAssignment requestBody: @@ -2644,6 +2837,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/pathGroupId' patch: summary: Update an application group description: Updates a group assignment to an app @@ -2686,6 +2882,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/pathGroupId' delete: summary: Unassign an application group description: Unassigns a Group from an app @@ -2709,18 +2908,26 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' - - $ref: '#/components/parameters/pathGroupId' - /api/v1/apps/{appId}/lifecycle/activate: - post: - summary: Activate an application - description: Activates an inactive application - operationId: activateApplication + parameters: + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/pathGroupId' + /api/v1/apps/{appId}/interclient-allowed-apps: + get: + summary: List all allowed apps for a target app + description: Lists all apps allowed by this app to request interclient SSO using the interclient token + operationId: listInterclientAllowedApplications responses: '200': description: Success - content: {} + content: + application/json: + schema: + $ref: '#/components/schemas/ListInterclientAllowedApplicationsResponse' + examples: + ListInterclientAllowedAppsResponse: + $ref: '#/components/examples/ListInterclientAllowedAppsResponse' + '401': + $ref: '#/components/responses/ErrorInvalidToken401' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -2730,30 +2937,79 @@ paths: security: - apiToken: [] - oauth2: - - okta.apps.manage + - okta.apps.interclientTrust.read tags: - - Application + - ApplicationInterclientTrustMappings x-okta-lifecycle: - lifecycle: GA - isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' - /api/v1/apps/{appId}/lifecycle/deactivate: + lifecycle: LIMITED_GA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + parameters: + - $ref: '#/components/parameters/pathAppId' post: - summary: Deactivate an application - description: >- - Deactivates an active application - - - > **Note:** Deactivating an app triggers a full reconciliation of all - users assigned to the app by groups. This reconcile process removes the - app assignment for the deactivated app, and might also correct - assignments that were supposed to be removed but failed previously. - operationId: deactivateApplication + summary: Create an allowed app mapping for a target app + description: Creates a mapping between the target app and an allowed app for interclient SSO using the interclient token + operationId: createInterclientTrustMapping + requestBody: + required: true + content: + application/json: + schema: + $ref: '#/components/schemas/InterclientTrustMappingRequestBody' + examples: + createInterclientTrustMappingRequest: + $ref: '#/components/examples/createInterclientTrustMappingRequestBody' responses: - '200': - description: Success - content: {} + '201': + description: Created + content: + application/json: + schema: + $ref: '#/components/schemas/InterclientTrustMapping' + examples: + createInterclientTrustMappingResponse: + $ref: '#/components/examples/InterclientTrustMappingResponse' + '400': + description: Bad Request + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + examples: + ErrorTargetAppType: + $ref: '#/components/examples/ErrorTargetAppType' + ErrorTooManyAllowedApps: + $ref: '#/components/examples/ErrorTooManyAllowedApps' + '401': + $ref: '#/components/responses/ErrorInvalidToken401' + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: + - apiToken: [] + - oauth2: + - okta.apps.interclientTrust.manage + tags: + - ApplicationInterclientTrustMappings + x-okta-lifecycle: + lifecycle: LIMITED_GA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + parameters: + - $ref: '#/components/parameters/pathAppId' + /api/v1/apps/{appId}/interclient-allowed-apps/{allowedAppId}: + delete: + summary: Delete an interclient trust mapping + description: Deletes the mapping between the target app and an allowed app + operationId: deleteInterclientTrustMapping + responses: + '204': + description: No Content + '401': + $ref: '#/components/responses/ErrorInvalidToken401' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -2763,33 +3019,118 @@ paths: security: - apiToken: [] - oauth2: - - okta.apps.manage + - okta.apps.interclientTrust.manage tags: - - Application + - ApplicationInterclientTrustMappings x-okta-lifecycle: - lifecycle: GA - isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' - /api/v1/apps/{appId}/logo: - post: - summary: Upload an application logo - description: > - Uploads a logo for the app instance. - - If the app already has a logo, this operation replaces the previous - logo. - - - The logo is visible in the Admin Console as an icon for your app - instance. - - If you have one `appLink` object configured, this logo also appears in - the End-User Dashboard as an icon for your app. + lifecycle: LIMITED_GA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + parameters: + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/appIdToDelete' + /api/v1/apps/{appId}/interclient-target-apps: + get: + summary: List all target apps for an allowed app + description: Lists all the target apps that allow this app to request interclient SSO using an interclient token + operationId: listInterclientTargetApplications + responses: + '200': + description: Success + content: + application/json: + schema: + $ref: '#/components/schemas/ListInterclientTargetApplicationsResponse' + examples: + ListInterclientTargetAppsResponse: + $ref: '#/components/examples/ListInterclientTargetAppsResponse' + '401': + $ref: '#/components/responses/ErrorInvalidToken401' + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: + - apiToken: [] + - oauth2: + - okta.apps.interclientTrust.read + tags: + - ApplicationInterclientTrustMappings + x-okta-lifecycle: + lifecycle: LIMITED_GA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + parameters: + - $ref: '#/components/parameters/pathAppId' + /api/v1/apps/{appId}/lifecycle/activate: + post: + summary: Activate an application + description: Activates an inactive application + operationId: activateApplication + responses: + '200': + description: Success + content: {} + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: + - apiToken: [] + - oauth2: + - okta.apps.manage + tags: + - Application + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathAppId' + /api/v1/apps/{appId}/lifecycle/deactivate: + post: + summary: Deactivate an application + description: |- + Deactivates an active application - > **Note:** If you have multiple `appLink` objects, use the Admin - Console to add logos for each app link. + > **Note:** Deactivating an app triggers a full reconciliation of all users assigned to the app by groups. This reconcile process removes the app assignment for the deactivated app, and might also correct assignments that were supposed to be removed but failed previously. + operationId: deactivateApplication + responses: + '200': + description: Success + content: {} + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: + - apiToken: [] + - oauth2: + - okta.apps.manage + tags: + - Application + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathAppId' + /api/v1/apps/{appId}/logo: + post: + summary: Upload an application logo + description: | + Uploads a logo for the app instance. + If the app already has a logo, this operation replaces the previous logo. + The logo is visible in the Admin Console as an icon for your app instance. + If you have one `appLink` object configured, this logo also appears in the End-User Dashboard as an icon for your app. + > **Note:** If you have multiple `appLink` objects, use the Admin Console to add logos for each app link. > You can't use the API to add logos for multiple app links. operationId: uploadApplicationLogo requestBody: @@ -2801,27 +3142,15 @@ paths: file: type: string format: binary - description: > + description: | The image file containing the logo. - - The file must be in PNG, JPG, SVG, or GIF format, and less - than one MB in size. - - For best results, use an image with a transparent background - and a square dimension of 200 x 200 pixels to prevent - upscaling. - + The file must be in PNG, JPG, SVG, or GIF format, and less than one MB in size. + For best results, use an image with a transparent background and a square dimension of 200 x 200 pixels to prevent upscaling. > **Notes:** - - > * Only SVG files encoded in UTF-8 are supported. For - example, `` is a valid - SVG file declaration. - - > * `multipart/form-data` isn't supported for Python. Remove - the `"Content-Type": "multipart/form-data"` line if you use - the Python request sample code. + > * Only SVG files encoded in UTF-8 are supported. For example, `` is a valid SVG file declaration. + > * `multipart/form-data` isn't supported for Python. Remove the `"Content-Type": "multipart/form-data"` line if you use the Python request sample code. required: - file responses: @@ -2844,27 +3173,17 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' + parameters: + - $ref: '#/components/parameters/pathAppId' /api/v1/apps/{appId}/policies/{policyId}: put: - summary: Assign an authentication policy - description: >- - Assigns an app to an [authentication - policy](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Policy/), identified by - `policyId`. - - If the app was previously assigned to another policy, this operation - replaces that assignment with the updated policy identified by - `policyId`. - - - > **Note:** When you [merge duplicate authentication - policies](https://help.okta.com/okta_help.htm?type=oie&id=ext-merge-auth-policies), + summary: Assign an app sign-in policy + description: |- + Assigns an app to an [app sign-in policy](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/policy/), identified by `policyId`. + If the app was previously assigned to another policy, this operation replaces that assignment with the updated policy identified by `policyId`. - the policy and mapping CRUD operations may be unavailable during the - consolidation. When the consolidation is complete, you receive an email - with merged results. + > **Note:** When you [merge duplicate app sign-in policies](https://help.okta.com/okta_help.htm?type=oie&id=ext-merge-auth-policies), + the policy and mapping CRUD operations may be unavailable during the consolidation. When the consolidation is complete, you receive an email with merged results. operationId: assignApplicationPolicy responses: '204': @@ -2886,9 +3205,9 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathAppId' - - $ref: '#/components/parameters/pathPolicyId' + parameters: + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/pathPolicyId' /api/v1/apps/{appId}/sso/saml/metadata: get: summary: Preview the application SAML metadata @@ -2901,6 +3220,7 @@ paths: schema: type: string example: mXtzOtml09Dg1ZCeKxTRBo3KrQuBWFkJ5oxhVagjTzo + - $ref: '#/components/parameters/pathAppId' responses: '200': description: OK @@ -2912,7 +3232,7 @@ paths: examples: previewSAML: summary: SAML metadata example - value: > + value: | @@ -2921,35 +3241,20 @@ paths: MIIDqDCCApCgAwIBAgIGAVGNO4qeMA0GCSqGSIb3DQEBBQUAMIGUMQswCQYDVQQGEwJVUzETMBEG A1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEU - MBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGJhbGFjb21wdGVzdDEcMBoGCSqGSIb3DQEJ - ARYNaW5mb0Bva3RhLmNvbTAeFw0xNTEyMTAxODUwMDhaFw0xNzEyMTAxODUxMDdaMIGUMQswCQYD - VQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsG - A1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGJhbGFjb21wdGVzdDEc - MBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC - ggEBALAakG48bgcTWHdwmVLHig0mkiRejxIVm3wbzrNSJcBruTq2zCYZ1rGfVxTYON8kJqvkXPmv - kzWKhpEkvhubL+mx29XpXY0AsNIfgcm5xIV56yhXSvlMdqzGo3ciRwoACaF+ClNLxmXK9UTZD89B - bVVGCG5AEvja0eCQ0GYsO5i9aSI5aTroab8Aew31PuWl/RGQWmjVy8+7P4wwkKKJNKCpxMYDlhfa - WRp0zwUSbUCO0qEyeAYdZx6CLES4FGrDi/7D6G+ewWC+kbz1tL1XpF2Dcg3+IOlHrV6VWzz3rG39 - v9zFIncjvoQJFDGWhpqGqcmXvgH0Ze3SVcVF01T+bK0CAwEAATANBgkqhkiG9w0BAQUFAAOCAQEA - AHmnSZ4imjNrIf9wxfQIcqHXEBoJ+oJtd59cw1Ur/YQY9pKXxoglqCQ54ZmlIf4GghlcZhslLO+m - NdkQVwSmWMh6KLxVM18/xAkq8zyKbMbvQnTjFB7x45bgokwbjhivWqrB5LYHHCVN7k/8mKlS4eCK - Ci6RGEmErjojr4QN2xV0qAqP6CcGANgpepsQJCzlWucMFKAh0x9Kl8fmiQodfyLXyrebYsVnLrMf - jxE1b6dg4jKvv975tf5wreQSYZ7m//g3/+NnuDKkN/03HqhV7hTNi1fyctXk8I5Nwgyr+pT5LT2k - YoEdncuy+GQGzE9yLOhC4HNfHQXpqp2tMPdRlw== @@ -2975,35 +3280,27 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' /api/v1/apps/{appId}/tokens: get: summary: List all application refresh tokens - description: > + description: | Lists all refresh tokens for an app - - > **Note:** The results are [paginated]https://developer.okta.com/docs/api#pagination according to the - `limit` parameter. - - > If there are multiple pages of results, the Link header contains a - `next` link that you need to use as an opaque value (follow it, don't - parse it). + > **Note:** The results are [paginated]https://developer.okta.com/docs/api#pagination according to the `limit` parameter. + > If there are multiple pages of results, the Link header contains a `next` link that you need to use as an opaque value (follow it, don't parse it). operationId: listOAuth2TokensForApplication parameters: - $ref: '#/components/parameters/queryAppGrantsExpand' - $ref: '#/components/parameters/queryAppAfter' - $ref: '#/components/parameters/queryLimit' + - $ref: '#/components/parameters/pathAppId' responses: '200': description: Success content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/OAuth2RefreshToken' + $ref: '#/components/schemas/ListOAuth2TokensForApplicationResponse' examples: getOAuth2TokenForApplicationListExample: $ref: '#/components/examples/OAuth2RefreshTokenResponseListEx' @@ -3024,10 +3321,7 @@ paths: isGenerallyAvailable: true delete: summary: Revoke all application tokens - description: >- - Revokes all OAuth 2.0 refresh tokens for the specified app. Any access - tokens issued with these refresh tokens are also revoked, but access - tokens issued without a refresh token aren't affected. + description: Revokes all OAuth 2.0 refresh tokens for the specified app. Any access tokens issued with these refresh tokens are also revoked, but access tokens issued without a refresh token aren't affected. operationId: revokeOAuth2TokensForApplication responses: '204': @@ -3048,8 +3342,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' + parameters: + - $ref: '#/components/parameters/pathAppId' /api/v1/apps/{appId}/tokens/{tokenId}: get: summary: Retrieve an application token @@ -3057,6 +3351,8 @@ paths: operationId: getOAuth2TokenForApplication parameters: - $ref: '#/components/parameters/queryAppGrantsExpand' + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/pathTokenId' responses: '200': description: Success @@ -3105,9 +3401,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' - - $ref: '#/components/parameters/pathTokenId' + parameters: + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/pathTokenId' /api/v1/apps/{appId}/users: get: summary: List all application users @@ -3118,15 +3414,14 @@ paths: - $ref: '#/components/parameters/queryAppLimit' - $ref: '#/components/parameters/queryAppUserQ' - $ref: '#/components/parameters/queryAppUserExpand' + - $ref: '#/components/parameters/pathAppId' responses: '200': description: Success content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/AppUser' + $ref: '#/components/schemas/ListApplicationUsersResponse' examples: ListAppUsersExample: $ref: '#/components/examples/AppUserListEx' @@ -3199,11 +3494,8 @@ paths: - okta.apps.manage tags: - ApplicationUsers - x-okta-lifecycle: - lifecycle: GA - isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' + parameters: + - $ref: '#/components/parameters/pathAppId' /api/v1/apps/{appId}/users/{userId}: get: summary: Retrieve an application user @@ -3211,6 +3503,8 @@ paths: operationId: getApplicationUser parameters: - $ref: '#/components/parameters/queryAppUserExpand' + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/pathAppUserId' responses: '200': description: Success @@ -3281,34 +3575,29 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/pathAppUserId' delete: summary: Unassign an application user - description: >- + description: |- Unassigns a user from an app + For directories like Active Directory and LDAP, they act as the owner of the user's credential with Okta delegating authentication (DelAuth) to that directory. + If this request is successful for a user when DelAuth is enabled, then the user is in a state with no password. You can then reset the user's password. - For directories like Active Directory and LDAP, they act as the owner of - the user's credential with Okta delegating authentication (DelAuth) to - that directory. - - If this request is successful for a user when DelAuth is enabled, then - the user is in a state with no password. You can then reset the user's - password. - - - > **Important:** This is a destructive operation. You can't recover the - user's app profile. If the app is enabled for provisioning and - configured to deactivate users, the user is also deactivated in the - target app. + > **Important:** This is a destructive operation. You can't recover the user's app profile. If the app is enabled for provisioning and configured to deactivate users, the user is also deactivated in the target app. operationId: unassignUserFromApplication parameters: - name: sendEmail in: query description: Sends a deactivation email to the administrator if `true` schema: - type: boolean - default: false + type: string + default: 'false' x-okta-added-version: 1.5.0 + - $ref: '#/components/parameters/pathAppId' + - $ref: '#/components/parameters/pathAppUserId' responses: '204': description: No Content @@ -3328,19 +3617,12 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' - - $ref: '#/components/parameters/pathAppUserId' /api/v1/apps/{appName}/{appId}/oauth2/callback: post: summary: Verify the provisioning connection - description: > - Verifies the OAuth 2.0-based connection as part of the OAuth 2.0 consent - flow. The validation of the consent flow is the last step of the - provisioning setup for an OAuth 2.0-based connection. - - Currently, this operation only supports `office365`,`google`, `zoomus`, - and `slack` apps. + description: | + Verifies the OAuth 2.0-based connection as part of the OAuth 2.0 consent flow. The validation of the consent flow is the last step of the provisioning setup for an OAuth 2.0-based connection. + Currently, this operation only supports `office365`,`google`, `zoomus`, and `slack` apps. operationId: verifyProvisioningConnectionForApplication parameters: - name: code @@ -3352,9 +3634,9 @@ paths: in: query schema: type: string - description: >- - A temporary code string that the client exchanges for an access - token + description: A temporary code string that the client exchanges for an access token + - $ref: '#/components/parameters/pathOAuthProvisioningAppName' + - $ref: '#/components/parameters/pathAppId' responses: '204': description: No content @@ -3373,12 +3655,10 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathOAuthProvisioningAppName' - - $ref: '#/components/parameters/pathAppId' components: schemas: Application: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: accessibility: @@ -3388,14 +3668,13 @@ components: format: date-time readOnly: true description: Timestamp when the application object was created + expressConfiguration: + $ref: '#/components/schemas/ApplicationExpressConfiguration' features: type: array - description: > + description: | Enabled app features - - > **Note:** See [Application - Features](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/ApplicationFeatures/) - for app provisioning features. + > **Note:** See [Application Features](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/applicationfeatures/) for app provisioning features. readOnly: true items: type: string @@ -3443,52 +3722,21 @@ components: - ENTITLEMENT_MANAGEMENT - PUSH_NEW_USERS_WITH_HASHED_PASSWORD x-enumDescriptions: - GROUP_PUSH: >- - Creates or links a group in the app when a mapping is defined - for a group in Okta. Okta is the source for group memberships - and all group members in Okta who are also assigned to the app - are synced as group members to the app. + GROUP_PUSH: Creates or links a group in the app when a mapping is defined for a group in Okta. Okta is the source for group memberships and all group members in Okta who are also assigned to the app are synced as group members to the app. IMPORT_NEW_USERS: Creates or links a user in Okta to a user from the app - IMPORT_PROFILE_UPDATES: >- - Updates a linked user's app profile during manual or scheduled - imports - IMPORT_USER_SCHEMA: >- - Discovers the profile schema for a user from the app - automatically - PROFILE_MASTERING: >- - Designates the app as the identity lifecycle and profile - attribute authority for linked users. The user's profile in Okta - is read-only. - PUSH_NEW_USERS: >- - Creates or links a user account in the app when assigning the - app to a user in Okta - PUSH_PASSWORD_UPDATES: >- - Updates the user's app password when their password changes in - Okta - PUSH_PROFILE_UPDATES: >- - Updates a user's profile in the app when the user's profile - changes in Okta (the profile source) - PUSH_USER_DEACTIVATION: >- - Deactivates a user's account in the app when unassigned from the - app in Okta or deactivated - REACTIVATE_USERS: >- - Reactivates an existing inactive user when provisioning a user - to the app - OUTBOUND_DEL_AUTH: >- - Okta user authentication requests are delegated to a third-party - app - DESKTOP_SSO: >- - Okta user authentication requests are handled by desktop SSO - negotiation (if possible) - FEDERATED_PROFILE: >- - App user profiles are synchronized at sign-in and profile-view - instances instead of during bulk imports - SUPPRESS_ACTIVATION_EMAIL: >- - Activation emails aren't sent to users sourced by AD and orgs - with DelAuth enabled - PUSH_PENDING_USERS: >- - Users are in PENDING state in Okta and are created but not - active in the sourced app user + IMPORT_PROFILE_UPDATES: Updates a linked user's app profile during manual or scheduled imports + IMPORT_USER_SCHEMA: Discovers the profile schema for a user from the app automatically + PROFILE_MASTERING: Designates the app as the identity lifecycle and profile attribute authority for linked users. The user's profile in Okta is read-only. + PUSH_NEW_USERS: Creates or links a user account in the app when assigning the app to a user in Okta + PUSH_PASSWORD_UPDATES: Updates the user's app password when their password changes in Okta + PUSH_PROFILE_UPDATES: Updates a user's profile in the app when the user's profile changes in Okta (the profile source) + PUSH_USER_DEACTIVATION: Deactivates a user's account in the app when unassigned from the app in Okta or deactivated + REACTIVATE_USERS: Reactivates an existing inactive user when provisioning a user to the app + OUTBOUND_DEL_AUTH: Okta user authentication requests are delegated to a third-party app + DESKTOP_SSO: Okta user authentication requests are handled by desktop SSO negotiation (if possible) + FEDERATED_PROFILE: App user profiles are synchronized at sign-in and profile-view instances instead of during bulk imports + SUPPRESS_ACTIVATION_EMAIL: Activation emails aren't sent to users sourced by AD and orgs with DelAuth enabled + PUSH_PENDING_USERS: Users are in PENDING state in Okta and are created but not active in the sourced app user MFA: App can verify credentials as a second factor UPDATE_EXISTING_USERNAME: App can update the user name for existing users EXCLUDE_USERNAME_UPDATE_ON_PROFILE_PUSH: Exclude username update during profile push @@ -3497,47 +3745,25 @@ components: IMPORT_SYNC_CONTACTS: Synchronize contacts DEVICE_COMPLIANCE: Apps support device compliance rules VPN_CONFIG: App supports pushing VPN configuration to OMM enrolled devices - IMPORT_SCHEMA_ENUM_VALUES: >- - App supports downloading schema enum values. You can download - custom objects and integrating them with UD without being tied - to the type metadata system. - SCIM_PROVISIONING: >- - App supports generic SCIM client provisioning and can leverage - SCIM standard for provisioning and push custom attributes to a - third-party app + IMPORT_SCHEMA_ENUM_VALUES: App supports downloading schema enum values. You can download custom objects and integrating them with UD without being tied to the type metadata system. + SCIM_PROVISIONING: App supports generic SCIM client provisioning and can leverage SCIM standard for provisioning and push custom attributes to a third-party app DEVICE_FILTER_IN_SIGN_ON_RULES: App supports filtering by client type in app sign-on rules - PROFILE_TEMPLATE_UPGRADE: >- - App supports profile template upgrades. This is primarily to - help roll out the profile template upgrade feature for - individual apps - DEFAULT_PUSH_STATUS_TO_PUSH: >- - App defaults Push status to `PUSH`. This feature is for apps, - such as SharePoint, that want to receive App User profile - updates even though they didn't implement traditional - PUSH_PROFILE_UPDATES in the client API. + PROFILE_TEMPLATE_UPGRADE: App supports profile template upgrades. This is primarily to help roll out the profile template upgrade feature for individual apps + DEFAULT_PUSH_STATUS_TO_PUSH: App defaults Push status to `PUSH`. This feature is for apps, such as SharePoint, that want to receive App User profile updates even though they didn't implement traditional PUSH_PROFILE_UPDATES in the client API. REAL_TIME_SYNC: Apps support real-time synchronization SSO: Apps support establishing a subject based on claims from an IdP - AUTHN_CONTEXT: >- - Apps support establishing an authentication context based on - claims from an IdP + AUTHN_CONTEXT: Apps support establishing an authentication context based on claims from an IdP JIT_PROVISIONING: Apps support provisioning a user based on claims from an IdP - GROUP_SYNC: >- - Apps support syncing group information based on claims from an - IdP + GROUP_SYNC: Apps support syncing group information based on claims from an IdP OPP_SCIM_INCREMENTAL_IMPORTS: Apps support incremental imports. Used for SCIM app instances - IN_MEMORY_APP_USER: >- - Apps support in-memory app users. This feature is used as an - alternative to Implicit App Assignment for a non-persisted app - user. + IN_MEMORY_APP_USER: Apps support in-memory app users. This feature is used as an alternative to Implicit App Assignment for a non-persisted app user. LOG_STREAMING: Apps support log streaming OAUTH_INTEGRATION: App is an OAuth 2.0 integration IDP: Apps support IdP functionalities PUSH_NEW_USERS_WITHOUT_PASSWORD: Don't send generated password for new users SKYHOOK_SERVICE: Use the Skyhook microservice for LCM operations ENTITLEMENT_MANAGEMENT: Marker to showcase which OIN apps are entitlement enabled - PUSH_NEW_USERS_WITH_HASHED_PASSWORD: >- - Send hashed password for new users. This feature is only used - for CIS to CIC migration. + PUSH_NEW_USERS_WITH_HASHED_PASSWORD: Send hashed password for new users. This feature is only used for CIS to CIC migration. id: type: string readOnly: true @@ -3557,22 +3783,13 @@ components: description: The Okta resource name (ORN) for the current app instance profile: type: object - description: >- - Contains any valid JSON schema for specifying properties that can be - referenced from a request (only available to OAuth 2.0 client apps). - - For example, add an app manager contact email address or define an - allowlist of groups that you can then reference using the Okta - Expression Language `getFilteredGroups` function. - + description: |- + Contains any valid JSON schema for specifying properties that can be referenced from a request (only available to OAuth 2.0 client apps). + For example, add an app manager contact email address or define an allowlist of groups that you can then reference using the Okta Expression Language `getFilteredGroups` function. > **Notes:** - > * `profile` isn't encrypted, so don't store sensitive data in it. - - > * `profile` doesn't limit the level of nesting in the JSON schema - you created, but there is a practical size limit. Okta recommends a - JSON schema size of 1 MB or less for best performance. + > * `profile` doesn't limit the level of nesting in the JSON schema you created, but there is a practical size limit. Okta recommends a JSON schema size of 1 MB or less for best performance. additionalProperties: true signOnMode: $ref: '#/components/schemas/ApplicationSignOnMode' @@ -3584,21 +3801,11 @@ components: $ref: '#/components/schemas/ApplicationVisibility' _embedded: type: object - description: >- - Embedded resources related to the app using the [JSON Hypertext - Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. If the `expand=user/{userId}` query parameter is - specified, then the assigned [Application - User](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/ApplicationUsers/) is - embedded. + description: Embedded resources related to the app using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. If the `expand=user/{userId}` query parameter is specified, then the assigned [Application User](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/applicationusers) is embedded. properties: user: type: object - description: >- - The specified [Application - User](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/ApplicationUsers/) - assigned to the app + description: The specified [Application User](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/applicationusers) assigned to the app additionalProperties: type: object properties: {} @@ -3638,36 +3845,31 @@ components: - profile - status ProvisioningConnectionTokenRequest: + x-okta-ignore-redocly-rules-for-sdk: true title: Token-based connection - allOf: - - $ref: '#/components/schemas/ProvisioningConnectionRequest' - - description: Token-based provisioning connection request - properties: - baseUrl: - type: string - description: >- - Only used for the Zscaler 2.0 (`zscalerbyz`) app. The base URL - for the Zscaler 2.0 target app, which also contains the Zscaler - ID. - x-okta-lifecycle: - lifecycle: GA - isGenerallyAvailable: true - profile: - $ref: '#/components/schemas/ProvisioningConnectionTokenRequestProfile' - required: - - profile - type: object + type: string + description: (opaque JSON object) + properties: + baseUrl: + type: string + description: Only used for the Zscaler 2.0 (`zscalerbyz`) app. The base URL for the Zscaler 2.0 target app, which also contains the Zscaler ID. + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: true + profile: + $ref: '#/components/schemas/ProvisioningConnectionTokenRequestProfile' + required: + - profile ProvisioningConnectionOauthRequest: + x-okta-ignore-redocly-rules-for-sdk: true title: OAuth 2.0-based connection - allOf: - - $ref: '#/components/schemas/ProvisioningConnectionRequest' - - description: OAuth 2.0-based provisioning connection request - properties: - profile: - $ref: '#/components/schemas/ProvisioningConnectionOauthRequestProfile' - required: - - profile - type: object + type: string + description: (opaque JSON object) + properties: + profile: + $ref: '#/components/schemas/ProvisioningConnectionOauthRequestProfile' + required: + - profile AppConnectionUserProvisionJWKResponse: properties: jwks: @@ -3683,8 +3885,7 @@ components: csr: type: string readOnly: true - example: >- - MIIC4DCCAcgCAQAwcTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk9rdGEsIEluYy4xDDAKBgNVBAsMA0RldjESMBAGA1UEAwwJU1AgSXNzdWVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6m8jHVCr9/tKvvbFN59T4raoCs/78KRm4fSefHQOv1TKLXo4wTLbsqYWRWc5u0sd5orUMQgPQOyj3i6qh13mALY4BzrT057EG1BUNjGg29QgYlnOk2iX890e5BIDMQQEIKFrvOi2V8cLUkLvE2ydRn0VO1Q1frbUkYeStJYC5Api2JQsYRwa+1ZeDH1ITnIzUaugWhW2WB2lSnwZkenne5KtffxMPYVu+IhNRHoKaRA6Z51YNhMJIx17JM2hs/H4Ka3drk6kzDf7ofk/yBpb9yBWyU7CTSQhdoHidxqFprMDaT66W928t3AeOENHBuwn8c2K9WeGG+bELNyQRJVmawIDAQABoCowKAYJKoZIhvcNAQkOMRswGTAXBgNVHREEEDAOggxkZXYub2t0YS5jb20wDQYJKoZIhvcNAQELBQADggEBAA2hsVJRVM+A83X9MekjTnIbt19UNT8wX7wlE9jUKirWsxceLiZBpVGn9qfKhhVIpvdaIRSeoFYS2Kg/m1G6bCvjmZLcrQ5FcEBjZH2NKfNppGVnfC2ugtUkBtCB+UUzOhKhRKJtGugenKbP33zRWWIqnd2waF6Cy8TIuqQVPbwEDN9bCbAs7ND6CFYNguY7KYjWzQOeAR716eqpEEXuPYAS4nx/ty4ylonR8cv+gpq51rvq80A4k/36aoeM0Y6I4w64vhTfuvWW2UYFUD+/+y2FA2CSP4JfctySrf1s525v6fzTFZ3qZbB5OZQtP2b8xYWktMzywsxGKDoVDB4wkH4= + example: MIIC4DCCAcgCAQAwcTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk9rdGEsIEluYy4xDDAKBgNVBAsMA0RldjESMBAGA1UEAwwJU1AgSXNzdWVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6m8jHVCr9/tKvvbFN59T4raoCs/78KRm4fSefHQOv1TKLXo4wTLbsqYWRWc5u0sd5orUMQgPQOyj3i6qh13mALY4BzrT057EG1BUNjGg29QgYlnOk2iX890e5BIDMQQEIKFrvOi2V8cLUkLvE2ydRn0VO1Q1frbUkYeStJYC5Api2JQsYRwa+1ZeDH1ITnIzUaugWhW2WB2lSnwZkenne5KtffxMPYVu+IhNRHoKaRA6Z51YNhMJIx17JM2hs/H4Ka3drk6kzDf7ofk/yBpb9yBWyU7CTSQhdoHidxqFprMDaT66W928t3AeOENHBuwn8c2K9WeGG+bELNyQRJVmawIDAQABoCowKAYJKoZIhvcNAQkOMRswGTAXBgNVHREEEDAOggxkZXYub2t0YS5jb20wDQYJKoZIhvcNAQELBQADggEBAA2hsVJRVM+A83X9MekjTnIbt19UNT8wX7wlE9jUKirWsxceLiZBpVGn9qfKhhVIpvdaIRSeoFYS2Kg/m1G6bCvjmZLcrQ5FcEBjZH2NKfNppGVnfC2ugtUkBtCB+UUzOhKhRKJtGugenKbP33zRWWIqnd2waF6Cy8TIuqQVPbwEDN9bCbAs7ND6CFYNguY7KYjWzQOeAR716eqpEEXuPYAS4nx/ty4ylonR8cv+gpq51rvq80A4k/36aoeM0Y6I4w64vhTfuvWW2UYFUD+/+y2FA2CSP4JfctySrf1s525v6fzTFZ3qZbB5OZQtP2b8xYWktMzywsxGKDoVDB4wkH4= id: type: string readOnly: true @@ -3727,9 +3928,7 @@ components: type: string readOnly: true kty: - description: >- - Cryptographic algorithm family for the certificate's keypair. Valid - value: `RSA` + description: 'Cryptographic algorithm family for the certificate''s keypair. Valid value: `RSA`' type: string readOnly: true lastUpdated: @@ -3737,27 +3936,20 @@ components: format: date-time $ref: '#/components/schemas/lastUpdatedProperty' 'n': - description: >- - RSA modulus value that is used by both the public and private keys - and provides a link between them + description: RSA modulus value that is used by both the public and private keys and provides a link between them type: string use: description: 'Acceptable use of the certificate. Valid value: `sig`' type: string readOnly: true x5c: - description: >- - X.509 certificate chain that contains a chain of one or more - certificates + description: X.509 certificate chain that contains a chain of one or more certificates type: array items: type: string readOnly: true x5t#S256: - description: >- - X.509 certificate SHA-256 thumbprint, which is the base64url-encoded - SHA-256 thumbprint (digest) of the DER encoding of an X.509 - certificate + description: X.509 certificate SHA-256 thumbprint, which is the base64url-encoded SHA-256 thumbprint (digest) of the DER encoding of an X.509 certificate type: string readOnly: true Error: @@ -3773,46 +3965,22 @@ components: description: An Okta code for this type of error errorId: type: string - description: >- - A unique identifier for this error. This can be used by Okta Support - to help with troubleshooting. + description: A unique identifier for this error. This can be used by Okta Support to help with troubleshooting. errorLink: type: string description: An Okta code for this type of error errorSummary: type: string - description: >- - A short description of what caused this error. Sometimes this - contains dynamically-generated information about your specific - error. + description: A short description of what caused this error. Sometimes this contains dynamically-generated information about your specific error. OAuth2ClientJsonSigningKeyResponse: + x-okta-ignore-redocly-rules-for-sdk: true title: Signing Key - description: >- - A [JSON Web Key (JWK)](https://tools.ietf.org/html/rfc7517) is a JSON - representation of a cryptographic key. Okta uses signing keys to verify - the signature of a JWT when provided for the `private_key_jwt` client - authentication method or for a signed authorize request object. Okta - supports both RSA and Elliptic Curve (EC) keys for signing tokens. - allOf: - - $ref: '#/components/schemas/OAuth2ClientJsonWebKeyResponseBase' - oneOf: - - $ref: '#/components/schemas/OAuth2ClientJsonWebKeyRsaResponse' - - $ref: '#/components/schemas/OAuth2ClientJsonWebKeyECResponse' - OAuth2ClientJsonEncryptionKeyResponse: - title: Encryption Key - allOf: - - $ref: '#/components/schemas/OAuth2ClientJsonWebKeyRequestBase' - - $ref: '#/components/schemas/OAuth2ClientJsonWebKeyResponseBase' - description: >- - A [JSON Web Key - (JWK)](https://tools.ietf.org/html/rfc7517) is a JSON representation of - a cryptographic key. Okta uses an encryption key to encrypt an ID token - JWT minted by the org authorization server or custom authorization - server. Okta supports only RSA keys for encrypting tokens. - x-okta-lifecycle: - lifecycle: EA - isGenerallyAvailable: true + description: A [JSON Web Key (JWK)](https://tools.ietf.org/html/rfc7517) is a JSON representation of a cryptographic key. Okta uses signing keys to verify the signature of a JWT when provided for the `private_key_jwt` client authentication method or for a signed authorize request object. Okta supports both RSA and Elliptic Curve (EC) keys for signing tokens. + discriminator: + propertyName: kty + mapping: + RSA: '#/components/schemas/OAuth2ClientJsonWebKeyRsaResponse' + EC: '#/components/schemas/OAuth2ClientJsonWebKeyECResponse' type: object properties: e: @@ -3830,56 +3998,55 @@ components: 'n': type: string description: RSA key value (modulus) for key binding - example: >- - mkC6yAJVvFwUlmM9gKjb2d-YK5qHFt-mXSsbjWKKs4EfNm-BoQeeovBZtSACyaqLc8IYFTPEURFcbDQ9DkAL04uUIRD2gaHYY7uK0jsluEaXGq2RAIsmzAwNTzkiDw4q9pDL_q7n0f_SDt1TsMaMQayB6bU5jWsmqcWJ8MCRJ1aJMjZ16un5UVx51IIeCbe4QRDxEXGAvYNczsBoZxspDt28esSpq5W0dBFxcyGVudyl54Er3FzAguhgfMVjH-bUec9j2Tl40qDTktrYgYfxz9pfjm01Hl4WYP1YQxeETpSL7cQ5Ihz4jGDtHUEOcZ4GfJrPzrGpUrak8Qp5xcwCqQ + example: mkC6yAJVvFwUlmM9gKjb2d-YK5qHFt-mXSsbjWKKs4EfNm-BoQeeovBZtSACyaqLc8IYFTPEURFcbDQ9DkAL04uUIRD2gaHYY7uK0jsluEaXGq2RAIsmzAwNTzkiDw4q9pDL_q7n0f_SDt1TsMaMQayB6bU5jWsmqcWJ8MCRJ1aJMjZ16un5UVx51IIeCbe4QRDxEXGAvYNczsBoZxspDt28esSpq5W0dBFxcyGVudyl54Er3FzAguhgfMVjH-bUec9j2Tl40qDTktrYgYfxz9pfjm01Hl4WYP1YQxeETpSL7cQ5Ihz4jGDtHUEOcZ4GfJrPzrGpUrak8Qp5xcwCqQ nullable: false - use: + kid: + type: string + description: Unique identifier of the JSON Web Key in the OAUth 2.0 client's JWKS + example: SIMcCQNY3uwXoW3y0vf6VxiBb5n9pf8L2fK8d-FIbm4 + nullable: true + status: type: string - description: Acceptable use of the JSON Web Key - example: enc - nullable: false enum: - - enc - OAuth2ClientJsonSigningKeyRequest: - title: Signing Key - allOf: - - $ref: '#/components/schemas/OAuth2ClientJsonWebKeyRequestBase' - oneOf: - - $ref: '#/components/schemas/OAuth2ClientJsonWebKeyRsaRequest' - - $ref: '#/components/schemas/OAuth2ClientJsonWebKeyECRequest' - description: >- - A [JSON Web Key (JWK)](https://tools.ietf.org/html/rfc7517) is a JSON - representation of a cryptographic key. Okta uses signing keys to verify - the signature of a JWT when provided for the `private_key_jwt` client - authentication method or for a signed authorize request object. Okta - supports both RSA and Elliptic Curve (EC) keys for signing tokens. - type: object - properties: - alg: + - ACTIVE + - INACTIVE + description: Status of the OAuth 2.0 client JSON Web Key + example: ACTIVE + nullable: false + default: ACTIVE + created: type: string - description: Algorithm used in the key - example: RS256 + description: Timestamp when the OAuth 2.0 client JSON Web Key was created + example: '2023-02-21T20:08:24.000Z' + readOnly: true nullable: false - use: + id: type: string - description: Acceptable use of the JSON Web Key - example: sig + description: The unique ID of the OAuth client JSON Web Key + example: pks2f4zrZbs8nUa7p0g4 + readOnly: true nullable: false - enum: - - sig - OAuth2ClientJsonEncryptionKeyRequest: + lastUpdated: + type: string + description: Timestamp when the OAuth 2.0 client JSON Web Key was updated + example: '2023-02-21T20:08:24.000Z' + readOnly: true + nullable: false + _links: + $ref: '#/components/schemas/OAuthClientSecretLinks' + readOnly: true + nullable: false + x: + type: string + description: The public x coordinate for the elliptic curve point + 'y': + type: string + description: The public y coordinate for the elliptic curve point + OAuth2ClientJsonEncryptionKeyResponse: title: Encryption Key - allOf: - - $ref: '#/components/schemas/OAuth2ClientJsonWebKeyRequestBase' - description: >- - A [JSON Web Key - (JWK)](https://tools.ietf.org/html/rfc7517) is a JSON representation of - a cryptographic key. Okta uses an encryption key to encrypt an ID token - JWT minted by the org authorization server or custom authorization - server. Okta supports only RSA keys for encrypting tokens. + description: A [JSON Web Key (JWK)](https://tools.ietf.org/html/rfc7517) is a JSON representation of a cryptographic key. Okta uses an encryption key to encrypt an ID token JWT minted by the org authorization server or custom authorization server. Okta supports only RSA keys for encrypting tokens. x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: true type: object properties: @@ -3898,8 +4065,7 @@ components: 'n': type: string description: RSA key value (modulus) for key binding - example: >- - mkC6yAJVvFwUlmM9gKjb2d-YK5qHFt-mXSsbjWKKs4EfNm-BoQeeovBZtSACyaqLc8IYFTPEURFcbDQ9DkAL04uUIRD2gaHYY7uK0jsluEaXGq2RAIsmzAwNTzkiDw4q9pDL_q7n0f_SDt1TsMaMQayB6bU5jWsmqcWJ8MCRJ1aJMjZ16un5UVx51IIeCbe4QRDxEXGAvYNczsBoZxspDt28esSpq5W0dBFxcyGVudyl54Er3FzAguhgfMVjH-bUec9j2Tl40qDTktrYgYfxz9pfjm01Hl4WYP1YQxeETpSL7cQ5Ihz4jGDtHUEOcZ4GfJrPzrGpUrak8Qp5xcwCqQ + example: mkC6yAJVvFwUlmM9gKjb2d-YK5qHFt-mXSsbjWKKs4EfNm-BoQeeovBZtSACyaqLc8IYFTPEURFcbDQ9DkAL04uUIRD2gaHYY7uK0jsluEaXGq2RAIsmzAwNTzkiDw4q9pDL_q7n0f_SDt1TsMaMQayB6bU5jWsmqcWJ8MCRJ1aJMjZ16un5UVx51IIeCbe4QRDxEXGAvYNczsBoZxspDt28esSpq5W0dBFxcyGVudyl54Er3FzAguhgfMVjH-bUec9j2Tl40qDTktrYgYfxz9pfjm01Hl4WYP1YQxeETpSL7cQ5Ihz4jGDtHUEOcZ4GfJrPzrGpUrak8Qp5xcwCqQ nullable: false use: type: string @@ -3908,45 +4074,193 @@ components: nullable: false enum: - enc - OAuth2ClientSecret: - type: object - properties: - client_secret: + kid: type: string - description: The OAuth 2.0 client secret string - example: DRUFXGF9XbLn......a3x3POBiIxDreBCdZuFs5B - readOnly: true + description: Unique identifier of the JSON Web Key in the OAUth 2.0 client's JWKS + example: SIMcCQNY3uwXoW3y0vf6VxiBb5n9pf8L2fK8d-FIbm4 + nullable: true + status: + type: string + enum: + - ACTIVE + - INACTIVE + description: Status of the OAuth 2.0 client JSON Web Key + example: ACTIVE nullable: false + default: ACTIVE created: type: string - description: Timestamp when the OAuth Client 2.0 Secret was created + description: Timestamp when the OAuth 2.0 client JSON Web Key was created example: '2023-02-21T20:08:24.000Z' readOnly: true nullable: false id: type: string - description: The unique ID of the OAuth Client Secret - example: ocs2f4zrZbs8nUa7p0g4 + description: The unique ID of the OAuth client JSON Web Key + example: pks2f4zrZbs8nUa7p0g4 readOnly: true nullable: false lastUpdated: type: string - description: Timestamp when the OAuth Client 2.0 Secret was updated + description: Timestamp when the OAuth 2.0 client JSON Web Key was updated example: '2023-02-21T20:08:24.000Z' readOnly: true nullable: false - secret_hash: - type: string - description: OAuth 2.0 client secret string hash - example: yk4SVx4sUWVJVbHt6M-UPA + _links: + $ref: '#/components/schemas/OAuthClientSecretLinks' readOnly: true nullable: false - status: - type: string - enum: + OAuth2ClientJsonSigningKeyRequest: + x-okta-ignore-redocly-rules-for-sdk: true + title: Signing Key + description: A [JSON Web Key (JWK)](https://tools.ietf.org/html/rfc7517) is a JSON representation of a cryptographic key. Okta uses signing keys to verify the signature of a JWT when provided for the `private_key_jwt` client authentication method or for a signed authorize request object. Okta supports both RSA and Elliptic Curve (EC) keys for signing tokens. + type: object + properties: + alg: + type: string + description: Algorithm used in the key + example: RS256 + nullable: false + use: + type: string + description: Acceptable use of the JSON Web Key + example: sig + nullable: false + enum: + - sig + e: + type: string + description: RSA key value (exponent) for key binding + example: AQAB + nullable: false + kty: + type: string + description: Cryptographic algorithm family for the certificate's key pair + example: RSA + nullable: false + enum: + - RSA + 'n': + type: string + description: RSA key value (modulus) for key binding + example: mkC6yAJVvFwUlmM9gKjb2d-YK5qHFt-mXSsbjWKKs4EfNm-BoQeeovBZtSACyaqLc8IYFTPEURFcbDQ9DkAL04uUIRD2gaHYY7uK0jsluEaXGq2RAIsmzAwNTzkiDw4q9pDL_q7n0f_SDt1TsMaMQayB6bU5jWsmqcWJ8MCRJ1aJMjZ16un5UVx51IIeCbe4QRDxEXGAvYNczsBoZxspDt28esSpq5W0dBFxcyGVudyl54Er3FzAguhgfMVjH-bUec9j2Tl40qDTktrYgYfxz9pfjm01Hl4WYP1YQxeETpSL7cQ5Ihz4jGDtHUEOcZ4GfJrPzrGpUrak8Qp5xcwCqQ + nullable: false + kid: + type: string + description: Unique identifier of the JSON Web Key in the OAUth 2.0 client's JWKS + example: SIMcCQNY3uwXoW3y0vf6VxiBb5n9pf8L2fK8d-FIbm4 + nullable: true + status: + type: string + enum: + - ACTIVE + - INACTIVE + description: Status of the OAuth 2.0 client JSON Web Key + example: ACTIVE + nullable: false + default: ACTIVE + x: + type: string + description: The public x coordinate for the elliptic curve point + 'y': + type: string + description: The public y coordinate for the elliptic curve point + discriminator: + propertyName: kty + mapping: + RSA: '#/components/schemas/OAuth2ClientJsonWebKeyRsaRequest' + EC: '#/components/schemas/OAuth2ClientJsonWebKeyECRequest' + OAuth2ClientJsonEncryptionKeyRequest: + x-okta-ignore-redocly-rules-for-sdk: true + title: Encryption key + description: A [JSON Web Key (JWK)](https://tools.ietf.org/html/rfc7517) is a JSON representation of a cryptographic key. Okta uses an encryption key to encrypt an ID token JWT minted by the org authorization server or custom authorization server. Okta supports only RSA keys for encrypting tokens. + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: true + type: object + properties: + alg: + type: string + description: Algorithm used in the key + example: RSA-OAEP + nullable: false + e: + type: string + description: RSA key value (exponent) for key binding + example: AQAB + nullable: false + kty: + type: string + description: Cryptographic algorithm family for the certificate's key pair + example: RSA + nullable: false + enum: + - RSA + 'n': + type: string + description: RSA key value (modulus) for key binding + example: mkC6yAJVvFwUlmM9gKjb2d-YK5qHFt-mXSsbjWKKs4EfNm-BoQeeovBZtSACyaqLc8IYFTPEURFcbDQ9DkAL04uUIRD2gaHYY7uK0jsluEaXGq2RAIsmzAwNTzkiDw4q9pDL_q7n0f_SDt1TsMaMQayB6bU5jWsmqcWJ8MCRJ1aJMjZ16un5UVx51IIeCbe4QRDxEXGAvYNczsBoZxspDt28esSpq5W0dBFxcyGVudyl54Er3FzAguhgfMVjH-bUec9j2Tl40qDTktrYgYfxz9pfjm01Hl4WYP1YQxeETpSL7cQ5Ihz4jGDtHUEOcZ4GfJrPzrGpUrak8Qp5xcwCqQ + nullable: false + use: + type: string + description: Acceptable use of the JSON Web Key + example: enc + nullable: false + enum: + - enc + kid: + type: string + description: Unique identifier of the JSON Web Key in the OAUth 2.0 client's JWKS + example: SIMcCQNY3uwXoW3y0vf6VxiBb5n9pf8L2fK8d-FIbm4 + nullable: true + status: + type: string + enum: + - ACTIVE + - INACTIVE + description: Status of the OAuth 2.0 client JSON Web Key + example: ACTIVE + nullable: false + default: ACTIVE + OAuth2ClientSecret: + type: object + properties: + client_secret: + type: string + description: The OAuth 2.0 client secret string + example: DRUFXGF9XbLn......a3x3POBiIxDreBCdZuFs5B + readOnly: true + nullable: false + created: + type: string + description: Timestamp when the OAuth 2.0 client secret was created + example: '2023-02-21T20:08:24.000Z' + readOnly: true + nullable: false + id: + type: string + description: The unique ID of the OAuth 2.0 client secret + example: ocs2f4zrZbs8nUa7p0g4 + readOnly: true + nullable: false + lastUpdated: + type: string + description: Timestamp when the OAuth 2.0 client secret was updated + example: '2023-02-21T20:08:24.000Z' + readOnly: true + nullable: false + secret_hash: + type: string + description: OAuth 2.0 client secret string hash + example: yk4SVx4sUWVJVbHt6M-UPA + readOnly: true + nullable: false + status: + type: string + enum: - ACTIVE - INACTIVE - description: Status of the OAuth 2.0 Client Secret + description: Status of the OAuth 2.0 client secret example: ACTIVE nullable: false default: ACTIVE @@ -3966,7 +4280,7 @@ components: enum: - ACTIVE - INACTIVE - description: Status of the OAuth 2.0 Client Secret + description: Status of the OAuth 2.0 client secret example: ACTIVE OrgCrossAppAccessConnection: description: Connection object for Cross App Access connections @@ -3985,9 +4299,7 @@ components: example: cwofxqCAJWWGELFTYASJ lastUpdated: type: string - description: >- - The ISO 8601 formatted date and time when the connection was last - updated + description: The ISO 8601 formatted date and time when the connection was last updated format: date-time readOnly: true example: '2024-10-15T14:20:00.000Z' @@ -4020,6 +4332,7 @@ components: required: - status ApplicationFeature: + x-okta-ignore-redocly-rules-for-sdk: true description: | The Feature object is used to configure app feature settings. type: object @@ -4033,15 +4346,21 @@ components: $ref: '#/components/schemas/ApplicationFeatureType' readOnly: true status: - allOf: - - $ref: '#/components/schemas/EnabledStatus' - - default: DISABLED - - example: ENABLED - - readOnly: true + description: Setting status + type: string + enum: + - DISABLED + - ENABLED + default: DISABLED + example: ENABLED + readOnly: true _links: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - readOnly: true + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + readOnly: true discriminator: propertyName: name mapping: @@ -4116,6 +4435,7 @@ components: description: The name of the claim to be used in the produced token example: role OAuth2ScopeConsentGrant: + x-okta-ignore-redocly-rules-for-sdk: true description: Grant object that represents an app consent scope grant type: object properties: @@ -4135,18 +4455,13 @@ components: example: oag3ih1zrm1cBFOiq0h6 issuer: type: string - description: >- - The issuer of your org authorization server. This is typically your - Okta domain. + description: The issuer of your org authorization server. This is typically your Okta domain. example: https://my_test_okta_org.oktapreview.com lastUpdated: $ref: '#/components/schemas/lastUpdatedProperty' scopeId: type: string - description: >- - The name of the [Okta - scope](https://developer.okta.com/docs/api/oauth2/#oauth-20-scopes) - for which consent is granted + description: The name of the [Okta scope](https://developer.okta.com/docs/api/oauth2/#oauth-20-scopes) for which consent is granted example: okta.users.read source: $ref: '#/components/schemas/OAuth2ScopeConsentGrantSource' @@ -4170,32 +4485,72 @@ components: example: okta.users.read readOnly: true _links: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - type: object + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + app: + description: Link to the app resource + type: object properties: - app: - description: Link to the app resource - allOf: - - $ref: '#/components/schemas/AppResourceHrefObject' - client: - description: Link to the client resource - allOf: - - $ref: '#/components/schemas/AppResourceHrefObject' - scope: - description: Link to the scope resource - allOf: - - $ref: '#/components/schemas/ScopeResourceHrefObject' - user: - description: Link to the user resource - allOf: - - $ref: '#/components/schemas/UserResourceHrefObject' - authorizationServer: - description: Link to the authorization server resource - allOf: - - $ref: >- - #/components/schemas/AuthorizationServerResourceHrefObject - - readOnly: true + href: + type: string + description: Link URI + example: https://{yourOktaDomain}/api/v1/apps/0oabskvc6442nkvQO0h7 + title: + type: string + description: Link name + example: My App + client: + description: Link to the client resource + type: object + properties: + href: + type: string + description: Link URI + example: https://{yourOktaDomain}/api/v1/apps/0oabskvc6442nkvQO0h7 + title: + type: string + description: Link name + example: My App + scope: + description: Link to the scope resource + type: object + properties: + href: + type: string + description: Link URI + example: https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7/scopes/scpCmCCV1DpxVkCaye2X + title: + type: string + description: Link name + example: My phone + user: + description: Link to the user resource + type: object + properties: + href: + type: string + description: Link URI + example: https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7 + title: + type: string + description: Link name + example: SAML Jackson + authorizationServer: + description: Link to the authorization server resource + type: object + properties: + href: + type: string + description: Link URI + example: https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7 + title: + type: string + description: Link name + example: Example Authorization Server + readOnly: true required: - issuer - scopeId @@ -4207,15 +4562,9 @@ components: - ERROR - INACTIVE x-enumDescriptions: - ACTIVE: >- - The group push mapping is active and Okta pushes membership changes to - the target group - INACTIVE: >- - The group push mapping is inactive and Okta doesn't push membership - changes to the target group - ERROR: >- - The group push mapping is in an error state and Okta doesn't push - membership changes to the target group + ACTIVE: The group push mapping is active and Okta pushes membership changes to the target group + INACTIVE: The group push mapping is inactive and Okta doesn't push membership changes to the target group + ERROR: The group push mapping is in an error state and Okta doesn't push membership changes to the target group GroupPushMapping: type: object properties: @@ -4265,7 +4614,6 @@ components: type: object properties: appConfig: - type: object $ref: '#/components/schemas/AppConfig' sourceGroupId: description: The ID of the source group for the group push mapping @@ -4274,17 +4622,10 @@ components: type: string $ref: '#/components/schemas/GroupPushMappingStatusUpsert' targetGroupId: - description: >- - The ID of the existing target group for the group push mapping. This - is used to link to an existing group. Required if `targetGroupName` - is not provided. + description: The ID of the existing target group for the group push mapping. This is used to link to an existing group. Required if `targetGroupName` is not provided. type: string targetGroupName: - description: >- - The name of the target group for the group push mapping. This is - used when creating a new downstream group. If the group already - exists, it links to the existing group. Required if `targetGroupId` - is not provided. + description: The name of the target group for the group push mapping. This is used when creating a new downstream group. If the group already exists, it links to the existing group. Required if `targetGroupId` is not provided. type: string required: - sourceGroupId @@ -4292,85 +4633,65 @@ components: type: object properties: status: - description: >- + description: |- The status of the group push mapping. + If changing the group push mapping status to `ACTIVE`, Okta performs an initial push to the target group, and then begins pushing membership changes. - If changing the group push mapping status to `ACTIVE`, Okta performs - an initial push to the target group, and then begins pushing - membership changes. - - - If changing the group push mapping status to `INACTIVE`, Okta stops - pushing membership changes to the target group. + If changing the group push mapping status to `INACTIVE`, Okta stops pushing membership changes to the target group. type: string $ref: '#/components/schemas/GroupPushMappingStatusUpsert' required: - status ApplicationGroupAssignment: + x-okta-ignore-redocly-rules-for-sdk: true title: Application Group Assignment - description: >- - The Application Group object that defines a group of users' app-specific - profile and credentials for an app + description: The Application Group object that defines a group of users' app-specific profile and credentials for an app type: object properties: id: type: string - description: >- - ID of the - [group](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/Group/) + description: ID of the [group](openapi/okta-management/management/group) readOnly: true example: 00g4hb1HChfUriNgW0g4 lastUpdated: - allOf: - - $ref: '#/components/schemas/lastUpdatedProperty' - - example: '2014-06-24T15:28:14.000Z' + format: date-time + description: Timestamp when the object was last updated + type: string + readOnly: true + example: '2014-06-24T15:28:14.000Z' priority: type: integer - description: >- - Priority assigned to the group. If an app has more than one group - assigned to the same user, then the group with the higher priority - has its profile applied to the [application - user](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/ApplicationUsers/). - - If a priority value isn't specified, then the next highest priority - is assigned by default. - - See [Assign attribute group - priority](https://help.okta.com/okta_help.htm?type=oie&id=ext-usgp-app-group-priority) - and the [sample priority use - case](https://help.okta.com/okta_help.htm?type=oie&id=ext-usgp-combine-values-use). + description: |- + Priority assigned to the group. If an app has more than one group assigned to the same user, then the group with the higher priority has its profile applied to the [application user](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/applicationusers). + If a priority value isn't specified, then the next highest priority is assigned by default. + See [Assign attribute group priority](https://help.okta.com/okta_help.htm?type=oie&id=ext-usgp-app-group-priority) and the [sample priority use case](https://help.okta.com/okta_help.htm?type=oie&id=ext-usgp-combine-values-use). example: 99 profile: $ref: '#/components/schemas/GroupAssignmentProfile' _embedded: type: object - description: >- - Embedded resource related to the Application Group using the [JSON - Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. - - If the `expand=group` query parameter is specified, then the - [group](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/Group/) - object is embedded. - - If the `expand=metadata` query parameter is specified, then the - group assignment metadata is embedded. + description: |- + Embedded resource related to the Application Group using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. + If the `expand=group` query parameter is specified, then the [group](openapi/okta-management/management/group) object is embedded. + If the `expand=metadata` query parameter is specified, then the group assignment metadata is embedded. additionalProperties: type: object properties: {} readOnly: true _links: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - type: object - properties: - app: - $ref: '#/components/schemas/HrefObjectAppLink' - group: - $ref: '#/components/schemas/HrefObjectGroupLink' + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + app: + $ref: '#/components/schemas/HrefObjectAppLink' + group: + $ref: '#/components/schemas/HrefObjectGroupLink' + readOnly: true JsonPatchOperation: + x-okta-ignore-redocly-rules-for-sdk: true description: The update action type: object properties: @@ -4380,9 +4701,63 @@ components: type: string description: The resource path of the attribute to update value: - type: object - description: The update operation value + type: string + description: The update operation value (opaque JSON object) + InterclientTrustMappingRequestBody: + type: object + properties: + id: + type: string + description: App ID of the allowed app + example: 0oa1elyw9EAkUNUrW0g5 + nullable: false + InterclientTrustMapping: + type: object + properties: + appInstanceId: + type: string + description: The app ID of the target app + example: 0oa8ghelqWXs70qD80g5 + readOnly: true + nullable: false + created: + type: string + description: Timestamp when the interclient trust mapping was created + example: '2025-11-25T22:44:06.000Z' + readOnly: true + nullable: false + id: + type: string + description: The unique ID of the interclient trust mapping + example: itmahqusSr3v8Kk3B0g5 + readOnly: true + nullable: false + lastUpdated: + type: string + description: Timestamp when the interclient trust mapping was updated + example: '2025-11-25T22:44:06.000Z' + readOnly: true + nullable: false + lastUpdatedBy: + type: string + description: ID of the user who created the interclient trust mapping + example: 00u102rhXmxEGFKiB0g5 + readOnly: true + nullable: false + orgId: + type: string + description: ID of the org + example: 00o102n9p4vX126Gp0g5 + readOnly: true + nullable: false + trustedAppInstanceId: + type: string + description: The app ID of the allowed app + example: 0oa5kw6q51dFckBE70g5 + readOnly: true + nullable: false OAuth2RefreshToken: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: clientId: @@ -4420,9 +4795,7 @@ components: example: 00u5t60iloOHN9pBi0h7 _embedded: type: object - description: >- - The embedded resources related to the object if the `expand` query - parameter is specified + description: The embedded resources related to the object if the `expand` query parameter is specified properties: scopes: type: array @@ -4431,70 +4804,98 @@ components: $ref: '#/components/schemas/OAuth2RefreshTokenScope' readOnly: true _links: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - type: object + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + app: + description: Link to the app resource + type: object + properties: + href: + type: string + description: Link URI + example: https://{yourOktaDomain}/api/v1/apps/0oabskvc6442nkvQO0h7 + title: + type: string + description: Link name + example: My App + revoke: + description: Link to revoke the refresh Token + type: object + properties: + href: + type: string + description: Link URI + example: https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7/clients/0oabskvc6442nkvQO0h7/tokens/oar579Mcp7OUsNTlo0g3 + hints: + properties: + allow: + items: + enum: + - DELETE + default: DELETE + type: object + client: + description: Link to the client resource + type: object + properties: + href: + type: string + description: Link URI + example: https://{yourOktaDomain}/api/v1/apps/0oabskvc6442nkvQO0h7 + title: + type: string + description: Link name + example: My App + user: + description: Link to the user resource + type: object + properties: + href: + type: string + description: Link URI + example: https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7 + title: + type: string + description: Link name + example: SAML Jackson + authorizationServer: + description: Link to the Token authorization server resource + type: object properties: - app: - description: Link to the app resource - allOf: - - $ref: '#/components/schemas/AppResourceHrefObject' - revoke: - description: Link to revoke the refresh Token - allOf: - - $ref: '#/components/schemas/RevokeRefreshTokenHrefObject' - - properties: - hints: - properties: - allow: - items: - enum: - - DELETE - default: DELETE - type: object - type: object - client: - description: Link to the client resource - allOf: - - $ref: '#/components/schemas/AppResourceHrefObject' - user: - description: Link to the user resource - allOf: - - $ref: '#/components/schemas/UserResourceHrefObject' - authorizationServer: - description: Link to the Token authorization server resource - allOf: - - $ref: >- - #/components/schemas/AuthorizationServerResourceHrefObject + href: + type: string + description: Link URI + example: https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7 + title: + type: string + description: Link name + example: Example Authorization Server + readOnly: true AppUser: + x-okta-ignore-redocly-rules-for-sdk: true title: Application User - description: >- - The application user object defines a user's app-specific profile and - credentials for an app + description: The app user object defines a user's app-specific profile and credentials for an app type: object properties: created: - allOf: - - $ref: '#/components/schemas/createdProperty' - - example: '2014-06-24T15:27:59.000Z' - credentials: - $ref: '#/components/schemas/AppUserCredentials' + description: Timestamp when the object was created + format: date-time + example: '2017-03-28T01:11:10.000Z' + type: string + readOnly: true + credentials: + $ref: '#/components/schemas/AppUserCredentials' externalId: type: string - description: >- - The ID of the user in the target app that's linked to the Okta - application user object. - - This value is the native app-specific identifier or primary key for - the user in the target app. - - - The `externalId` is set during import when the user is confirmed - (reconciled) or during provisioning when the user is created in the - target app. + description: |- + The ID of the user in the target app that's linked to the Okta application user object. + This value is the native app-specific identifier or primary key for the user in the target app. - This value isn't populated for SSO app assignments (for example, - SAML or SWA) because it isn't synchronized with a target app. + The `externalId` is set during import when the user is confirmed (reconciled) or during provisioning when the user is created in the target app. + This value isn't populated for SSO app assignments (for example, SAML or SWA) because it isn't synchronized with a target app. readOnly: true example: 70c14cc17d3745e8a9f98d599a68329c id: @@ -4503,17 +4904,16 @@ components: example: 00u11z6WHMYCGPCHCRFK lastSync: type: string - description: >- - Timestamp of the last synchronization operation. This value is only - updated for apps with the `IMPORT_PROFILE_UPDATES` or `PUSH - PROFILE_UPDATES` feature. + description: Timestamp of the last synchronization operation. This value is only updated for apps with the `IMPORT_PROFILE_UPDATES` or `PUSH PROFILE_UPDATES` feature. format: date-time readOnly: true example: '2014-06-24T15:27:59.000Z' lastUpdated: - allOf: - - $ref: '#/components/schemas/lastUpdatedProperty' - - example: '2014-06-24T15:28:14.000Z' + format: date-time + description: Timestamp when the object was last updated + type: string + readOnly: true + example: '2014-06-24T15:28:14.000Z' passwordChanged: type: string description: Timestamp when the application user password was last changed @@ -4525,9 +4925,7 @@ components: $ref: '#/components/schemas/AppUserProfile' scope: type: string - description: >- - Indicates if the assignment is direct (`USER`) or by group - membership (`GROUP`). + description: Indicates if the assignment is direct (`USER`) or by group membership (`GROUP`). If not specified, Okta tries to determine the scope based on the assignment type. enum: - USER - GROUP @@ -4544,11 +4942,7 @@ components: $ref: '#/components/schemas/AppUserSyncState' _embedded: type: object - description: >- - Embedded resources related to the application user using the [JSON - Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification + description: Embedded resources related to the application user using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification additionalProperties: type: object properties: {} @@ -4556,14 +4950,92 @@ components: _links: $ref: '#/components/schemas/LinksAppAndUser' AppUserAssignRequest: - allOf: - - $ref: '#/components/schemas/AppUser' - - required: - - id + x-okta-ignore-redocly-rules-for-sdk: true + title: Application User + description: The app user object defines a user's app-specific profile and credentials for an app + type: object + properties: + created: + description: Timestamp when the object was created + format: date-time + example: '2017-03-28T01:11:10.000Z' + type: string + readOnly: true + credentials: + $ref: '#/components/schemas/AppUserCredentials' + externalId: + type: string + description: |- + The ID of the user in the target app that's linked to the Okta application user object. + This value is the native app-specific identifier or primary key for the user in the target app. + + The `externalId` is set during import when the user is confirmed (reconciled) or during provisioning when the user is created in the target app. + This value isn't populated for SSO app assignments (for example, SAML or SWA) because it isn't synchronized with a target app. + readOnly: true + example: 70c14cc17d3745e8a9f98d599a68329c + id: + type: string + description: Unique identifier for the Okta user + example: 00u11z6WHMYCGPCHCRFK + lastSync: + type: string + description: Timestamp of the last synchronization operation. This value is only updated for apps with the `IMPORT_PROFILE_UPDATES` or `PUSH PROFILE_UPDATES` feature. + format: date-time + readOnly: true + example: '2014-06-24T15:27:59.000Z' + lastUpdated: + format: date-time + description: Timestamp when the object was last updated + type: string + readOnly: true + example: '2014-06-24T15:28:14.000Z' + passwordChanged: + type: string + description: Timestamp when the application user password was last changed + format: date-time + readOnly: true + nullable: true + example: '2014-06-24T15:27:59.000Z' + profile: + $ref: '#/components/schemas/AppUserProfile' + scope: + type: string + description: Indicates if the assignment is direct (`USER`) or by group membership (`GROUP`). If not specified, Okta tries to determine the scope based on the assignment type. + enum: + - USER + - GROUP + example: USER + status: + $ref: '#/components/schemas/AppUserStatus' + statusChanged: + type: string + description: Timestamp when the application user status was last changed + format: date-time + readOnly: true + example: '2014-06-24T15:28:14.000Z' + syncState: + $ref: '#/components/schemas/AppUserSyncState' + _embedded: + type: object + description: Embedded resources related to the application user using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification + additionalProperties: + type: object + properties: {} + readOnly: true + _links: + $ref: '#/components/schemas/LinksAppAndUser' + required: + - id AppUserUpdateRequest: - oneOf: - - $ref: '#/components/schemas/AppUserCredentialsRequestPayload' - - $ref: '#/components/schemas/AppUserProfileRequestPayload' + x-okta-ignore-redocly-rules-for-sdk: true + title: Credentials + description: Updates the assigned user credentials + type: object + properties: + credentials: + $ref: '#/components/schemas/AppUserCredentials' + profile: + $ref: '#/components/schemas/AppUserProfile' ApplicationAccessibility: description: Specifies access settings for the app type: object @@ -4573,21 +5045,35 @@ components: description: Custom error page URL for the app loginRedirectUrl: type: string - description: >- + description: |- Custom login page URL for the app - - > **Note:** The `loginRedirectUrl` property is deprecated in - Identity Engine. This property is used with the custom app login - feature. Orgs that actively use this feature can continue to do so. - See [Okta-hosted sign-in (redirect - authentication)](https://developer.okta.com/docs/guides/redirect-authentication/) - or [configure IdP routing - rules](https://help.okta.com/okta_help.htm?type=oie&id=ext-cfg-routing-rules) - to redirect users to the appropriate sign-in app for orgs that don't - use the custom app login feature. + > **Note:** The `loginRedirectUrl` property is deprecated in Identity Engine. This property is used with the custom app login feature. Orgs that actively use this feature can continue to do so. See [Okta-hosted sign-in (redirect authentication)](https://developer.okta.com/docs/guides/redirect-authentication/) or [configure IdP routing rules](https://help.okta.com/okta_help.htm?type=oie&id=ext-cfg-routing-rules) to redirect users to the appropriate sign-in app for orgs that don't use the custom app login feature. selfService: type: boolean description: Represents whether the app can be self-assignable by users + ApplicationExpressConfiguration: + description: |- +
+ Indicates which Express Configuration capabilities the app supports and has enabled + type: object + properties: + enabledCapabilities: + type: array + description: Capabilities currently enabled for the app + items: + $ref: '#/components/schemas/ApplicationCapability' + example: + - SSO + supportedCapabilities: + type: array + description: Capabilities supported by the app + items: + $ref: '#/components/schemas/ApplicationCapability' + example: + - SSO + - PROVISIONING + - UNIVERSAL_LOGOUT + readOnly: true ApplicationLabel: description: User-defined display name for app type: string @@ -4599,36 +5085,20 @@ components: type: integer description: Number of licenses purchased for the app ApplicationSignOnMode: - description: > + description: | Authentication mode for the app - | signOnMode | Description | - | ---------- | ----------- | - | AUTO_LOGIN | Secure Web Authentication (SWA) | - | BASIC_AUTH | HTTP Basic Authentication with Okta Browser Plugin | - | BOOKMARK | Just a bookmark (no-authentication) | - - | BROWSER_PLUGIN | Secure Web Authentication (SWA) with Okta Browser - Plugin | - + | BROWSER_PLUGIN | Secure Web Authentication (SWA) with Okta Browser Plugin | | OPENID_CONNECT | Federated Authentication with OpenID Connect (OIDC) | - - | SAML_1_1 | Federated Authentication with SAML 1.1 WebSSO (not - supported for custom apps) | - + | SAML_1_1 | Federated Authentication with SAML 1.1 WebSSO (not supported for custom apps) | | SAML_2_0 | Federated Authentication with SAML 2.0 WebSSO | - - | SECURE_PASSWORD_STORE | Secure Web Authentication (SWA) with POST - (plugin not required) | - - | WS_FEDERATION | Federated Authentication with WS-Federation Passive - Requestor Profile | - + | SECURE_PASSWORD_STORE | Secure Web Authentication (SWA) with POST (plugin not required) | + | WS_FEDERATION | Federated Authentication with WS-Federation Passive Requestor Profile | Select the `signOnMode` for your custom app: type: string @@ -4651,12 +5121,9 @@ components: - INACTIVE readOnly: true ApplicationUniversalLogout: - description: >- -
- - Universal Logout properties for the app. These properties are only - returned and can't be updated. + description: |- +
+ Universal Logout properties for the app. These properties are only returned and can't be updated. x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false @@ -4666,9 +5133,7 @@ components: properties: identityStack: type: string - description: >- - Indicates whether the app uses a shared identity stack that may - cause the user to sign out of other apps by the same company + description: Indicates whether the app uses a shared identity stack that may cause the user to sign out of other apps by the same company enum: - SHARED - NOT_SHARED @@ -4681,11 +5146,7 @@ components: - GLOBAL_TOKEN_REVOCATION x-enumDescriptions: PROPRIETARY: Universal Logout is implemented with a proprietary method. - GLOBAL_TOKEN_REVOCATION: >- - Universal Logout is implemented with the [Global Token - Revocation](https://datatracker.ietf.org/doc/draft-parecki-oauth-global-token-revocation/) - protocol. See the [Global Token Revocation - API](https://developer.okta.com/docs/api/openapi/okta-oauth/oauth/tag/GlobalTokenRevocation/). + GLOBAL_TOKEN_REVOCATION: Universal Logout is implemented with the [Global Token Revocation](https://datatracker.ietf.org/doc/draft-parecki-oauth-global-token-revocation/) protocol. See the [Global Token Revocation API](https://developer.okta.com/docs/api/openapi/okta-oauth/oauth/tag/GlobalTokenRevocation/). example: PROPRIETARY status: type: string @@ -4696,26 +5157,18 @@ components: - UNSUPPORTED example: ENABLED x-enumDescriptions: - ENABLED: >- - Universal Logout is enabled. Users are signed out of the app - instance when the Okta system or an admin initiates logout. + ENABLED: Universal Logout is enabled. Users are signed out of the app instance when the Okta system or an admin initiates logout. DISABLED: Universal Logout is disabled UNSUPPORTED: The app doesn't support Universal Logout supportType: type: string - description: >- - Indicates whether the app supports full or partial Universal Logout - (UL). + description: Indicates whether the app supports full or partial Universal Logout (UL). enum: - FULL - PARTIAL x-enumDescriptions: - FULL: >- - Full UL support (users are signed out of an app when the Okta - system or an admin initiates logout) - PARTIAL: >- - This app's sign-out behavior can be different from other supported - UL apps. + FULL: Full UL support (users are signed out of an app when the Okta system or an admin initiates logout) + PARTIAL: This app's sign-out behavior can be different from other supported UL apps. example: FULL readOnly: true ApplicationVisibility: @@ -4724,9 +5177,7 @@ components: properties: appLinks: type: object - description: >- - Links or icons that appear on the End-User Dashboard if they're set - to `true`. + description: Links or icons that appear on the End-User Dashboard if they're set to `true`. additionalProperties: type: boolean autoLaunch: @@ -4769,9 +5220,7 @@ components: readOnly: true type: object ProvisioningConnectionTokenAuthScheme: - description: >- - A token is used to authenticate with the app. This property is only - returned for the `TOKEN` authentication scheme. + description: A token is used to authenticate with the app. This property is only returned for the `TOKEN` authentication scheme. type: string enum: - TOKEN @@ -4795,18 +5244,24 @@ components: x-enumDescriptions: DISABLED: The provisioning connection is disabled. ENABLED: The provisioning connection is enabled. - UNKNOWN: >- - Provisioning isn't supported by the app, or the authentication method - is unknown. + UNKNOWN: Provisioning isn't supported by the app, or the authentication method is unknown. LinksSelfLifecycleAndAuthorize: - allOf: - - $ref: '#/components/schemas/LinksSelfAndLifecycle' - - type: object - properties: - authorize: - $ref: '#/components/schemas/HrefObjectAuthorizeLink' - ProvisioningConnectionRequest: + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + activate: + $ref: '#/components/schemas/HrefObjectActivateLink' + deactivate: + $ref: '#/components/schemas/HrefObjectDeactivateLink' + authorize: + $ref: '#/components/schemas/HrefObjectAuthorizeLink' + readOnly: true + ProvisioningConnectionRequest: + x-okta-ignore-redocly-rules-for-sdk: true + type: string + description: (opaque JSON object) ProvisioningConnectionTokenRequestProfile: properties: authScheme: @@ -4823,9 +5278,7 @@ components: $ref: '#/components/schemas/ProvisioningConnectionOauthAuthScheme' clientId: type: string - description: >- - Only used for the Okta Org2Org (`okta_org2org`) app. The unique - client identifier for the OAuth 2.0 service app from the target org. + description: Only used for the Okta Org2Org (`okta_org2org`) app. The unique client identifier for the OAuth 2.0 service app from the target org. settings: $ref: '#/components/schemas/Office365ProvisioningSettings' signing: @@ -4849,13 +5302,7 @@ components: type: string readOnly: true CSRLinks: - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the - current status of a CSR object using the [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. This object is used for dynamic discovery of related - resources and lifecycle operations. + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status of a CSR object using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. properties: publish: $ref: '#/components/schemas/HrefCsrPublishLink' @@ -4880,9 +5327,7 @@ components: example: San Francisco organizationalUnitName: type: string - description: >- - Name of the smaller organization, for example, the department or the - division + description: Name of the smaller organization, for example, the department or the division example: Dev organizationName: type: string @@ -4911,9 +5356,42 @@ components: properties: errorSummary: type: string - OAuth2ClientJsonWebKeyResponseBase: + OAuth2ClientJsonWebKeyRsaResponse: + title: RSA signing key + description: An RSA signing key type: object properties: + e: + type: string + description: RSA key value (exponent) for key binding + example: AQAB + nullable: false + kty: + type: string + description: Cryptographic algorithm family for the certificate's key pair + example: RSA + nullable: false + enum: + - RSA + 'n': + type: string + description: RSA key value (modulus) for key binding + example: mkC6yAJVvFwUlmM9gKjb2d-YK5qHFt-mXSsbjWKKs4EfNm-BoQeeovBZtSACyaqLc8IYFTPEURFcbDQ9DkAL04uUIRD2gaHYY7uK0jsluEaXGq2RAIsmzAwNTzkiDw4q9pDL_q7n0f_SDt1TsMaMQayB6bU5jWsmqcWJ8MCRJ1aJMjZ16un5UVx51IIeCbe4QRDxEXGAvYNczsBoZxspDt28esSpq5W0dBFxcyGVudyl54Er3FzAguhgfMVjH-bUec9j2Tl40qDTktrYgYfxz9pfjm01Hl4WYP1YQxeETpSL7cQ5Ihz4jGDtHUEOcZ4GfJrPzrGpUrak8Qp5xcwCqQ + nullable: false + kid: + type: string + description: Unique identifier of the JSON Web Key in the OAUth 2.0 client's JWKS + example: SIMcCQNY3uwXoW3y0vf6VxiBb5n9pf8L2fK8d-FIbm4 + nullable: true + status: + type: string + enum: + - ACTIVE + - INACTIVE + description: Status of the OAuth 2.0 client JSON Web Key + example: ACTIVE + nullable: false + default: ACTIVE created: type: string description: Timestamp when the OAuth 2.0 client JSON Web Key was created @@ -4922,7 +5400,7 @@ components: nullable: false id: type: string - description: The unique ID of the OAuth Client JSON Web Key + description: The unique ID of the OAuth client JSON Web Key example: pks2f4zrZbs8nUa7p0g4 readOnly: true nullable: false @@ -4936,44 +5414,15 @@ components: $ref: '#/components/schemas/OAuthClientSecretLinks' readOnly: true nullable: false - OAuth2ClientJsonWebKeyRsaResponse: - title: RSA Signing Key - description: An RSA signing key - allOf: - - $ref: '#/components/schemas/OAuth2ClientJsonWebKeyRequestBase' - - $ref: '#/components/schemas/OAuth2ClientJsonWebKeyResponseBase' - type: object - properties: - e: - type: string - description: RSA key value (exponent) for key binding - example: AQAB - nullable: false - kty: - type: string - description: Cryptographic algorithm family for the certificate's key pair - example: RSA - nullable: false - enum: - - RSA - 'n': - type: string - description: RSA key value (modulus) for key binding - example: >- - mkC6yAJVvFwUlmM9gKjb2d-YK5qHFt-mXSsbjWKKs4EfNm-BoQeeovBZtSACyaqLc8IYFTPEURFcbDQ9DkAL04uUIRD2gaHYY7uK0jsluEaXGq2RAIsmzAwNTzkiDw4q9pDL_q7n0f_SDt1TsMaMQayB6bU5jWsmqcWJ8MCRJ1aJMjZ16un5UVx51IIeCbe4QRDxEXGAvYNczsBoZxspDt28esSpq5W0dBFxcyGVudyl54Er3FzAguhgfMVjH-bUec9j2Tl40qDTktrYgYfxz9pfjm01Hl4WYP1YQxeETpSL7cQ5Ihz4jGDtHUEOcZ4GfJrPzrGpUrak8Qp5xcwCqQ - nullable: false OAuth2ClientJsonWebKeyECResponse: - title: EC Signing Key + title: EC signing key description: An EC signing key - allOf: - - $ref: '#/components/schemas/OAuth2ClientJsonWebKeyRequestBase' - - $ref: '#/components/schemas/OAuth2ClientJsonWebKeyResponseBase' type: object properties: kty: type: string description: Cryptographic algorithm family for the certificate's key pair - example: RSA + example: EC nullable: false enum: - EC @@ -4983,6 +5432,42 @@ components: 'y': type: string description: The public y coordinate for the elliptic curve point + kid: + type: string + description: Unique identifier of the JSON Web Key in the OAUth 2.0 client's JWKS + example: SIMcCQNY3uwXoW3y0vf6VxiBb5n9pf8L2fK8d-FIbm4 + nullable: true + status: + type: string + enum: + - ACTIVE + - INACTIVE + description: Status of the OAuth 2.0 client JSON Web Key + example: ACTIVE + nullable: false + default: ACTIVE + created: + type: string + description: Timestamp when the OAuth 2.0 client JSON Web Key was created + example: '2023-02-21T20:08:24.000Z' + readOnly: true + nullable: false + id: + type: string + description: The unique ID of the OAuth client JSON Web Key + example: pks2f4zrZbs8nUa7p0g4 + readOnly: true + nullable: false + lastUpdated: + type: string + description: Timestamp when the OAuth 2.0 client JSON Web Key was updated + example: '2023-02-21T20:08:24.000Z' + readOnly: true + nullable: false + _links: + $ref: '#/components/schemas/OAuthClientSecretLinks' + readOnly: true + nullable: false OAuth2ClientJsonWebKeyRequestBase: type: object properties: @@ -5000,11 +5485,35 @@ components: example: ACTIVE nullable: false default: ACTIVE + OAuth2ClientJsonWebKeyResponseBase: + type: object + properties: + created: + type: string + description: Timestamp when the OAuth 2.0 client JSON Web Key was created + example: '2023-02-21T20:08:24.000Z' + readOnly: true + nullable: false + id: + type: string + description: The unique ID of the OAuth client JSON Web Key + example: pks2f4zrZbs8nUa7p0g4 + readOnly: true + nullable: false + lastUpdated: + type: string + description: Timestamp when the OAuth 2.0 client JSON Web Key was updated + example: '2023-02-21T20:08:24.000Z' + readOnly: true + nullable: false + _links: + $ref: '#/components/schemas/OAuthClientSecretLinks' + readOnly: true + nullable: false OAuth2ClientJsonWebKeyRsaRequest: - title: RSA Signing Key + x-okta-ignore-redocly-rules-for-sdk: true + title: RSA signing key description: An RSA signing key - allOf: - - $ref: '#/components/schemas/OAuth2ClientJsonWebKeyRequestBase' type: object properties: e: @@ -5022,14 +5531,26 @@ components: 'n': type: string description: RSA key value (modulus) for key binding - example: >- - mkC6yAJVvFwUlmM9gKjb2d-YK5qHFt-mXSsbjWKKs4EfNm-BoQeeovBZtSACyaqLc8IYFTPEURFcbDQ9DkAL04uUIRD2gaHYY7uK0jsluEaXGq2RAIsmzAwNTzkiDw4q9pDL_q7n0f_SDt1TsMaMQayB6bU5jWsmqcWJ8MCRJ1aJMjZ16un5UVx51IIeCbe4QRDxEXGAvYNczsBoZxspDt28esSpq5W0dBFxcyGVudyl54Er3FzAguhgfMVjH-bUec9j2Tl40qDTktrYgYfxz9pfjm01Hl4WYP1YQxeETpSL7cQ5Ihz4jGDtHUEOcZ4GfJrPzrGpUrak8Qp5xcwCqQ + example: mkC6yAJVvFwUlmM9gKjb2d-YK5qHFt-mXSsbjWKKs4EfNm-BoQeeovBZtSACyaqLc8IYFTPEURFcbDQ9DkAL04uUIRD2gaHYY7uK0jsluEaXGq2RAIsmzAwNTzkiDw4q9pDL_q7n0f_SDt1TsMaMQayB6bU5jWsmqcWJ8MCRJ1aJMjZ16un5UVx51IIeCbe4QRDxEXGAvYNczsBoZxspDt28esSpq5W0dBFxcyGVudyl54Er3FzAguhgfMVjH-bUec9j2Tl40qDTktrYgYfxz9pfjm01Hl4WYP1YQxeETpSL7cQ5Ihz4jGDtHUEOcZ4GfJrPzrGpUrak8Qp5xcwCqQ + nullable: false + kid: + type: string + description: Unique identifier of the JSON Web Key in the OAUth 2.0 client's JWKS + example: SIMcCQNY3uwXoW3y0vf6VxiBb5n9pf8L2fK8d-FIbm4 + nullable: true + status: + type: string + enum: + - ACTIVE + - INACTIVE + description: Status of the OAuth 2.0 client JSON Web Key + example: ACTIVE nullable: false + default: ACTIVE OAuth2ClientJsonWebKeyECRequest: - title: EC Signing Key + x-okta-ignore-redocly-rules-for-sdk: true + title: EC signing Key description: An EC signing key - allOf: - - $ref: '#/components/schemas/OAuth2ClientJsonWebKeyRequestBase' type: object properties: kty: @@ -5045,40 +5566,39 @@ components: 'y': type: string description: The public y coordinate for the elliptic curve point - OAuthClientSecretLinks: - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the - current status of an application using the [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. This object is used for dynamic discovery of related - resources and lifecycle operations. - properties: - activate: - $ref: '#/components/schemas/HrefObjectActivateLink' - deactivate: - $ref: '#/components/schemas/HrefObjectDeactivateLink' - delete: - $ref: '#/components/schemas/HrefObjectDeleteLink' - readOnly: true - type: object - ApplicationFeatureType: - description: > + kid: + type: string + description: Unique identifier of the JSON Web Key in the OAUth 2.0 client's JWKS + example: SIMcCQNY3uwXoW3y0vf6VxiBb5n9pf8L2fK8d-FIbm4 + nullable: true + status: + type: string + enum: + - ACTIVE + - INACTIVE + description: Status of the OAuth 2.0 client JSON Web Key + example: ACTIVE + nullable: false + default: ACTIVE + OAuthClientSecretLinks: + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status of an app using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + properties: + activate: + $ref: '#/components/schemas/HrefObjectActivateLink' + deactivate: + $ref: '#/components/schemas/HrefObjectDeactivateLink' + delete: + $ref: '#/components/schemas/HrefObjectDeleteLink' + readOnly: true + type: object + ApplicationFeatureType: + description: | Key name of the feature - | Feature name | Description | - | --------- | ------------- | - - | USER_PROVISIONING | User profiles are pushed from Okta to the - third-party app. Represents the **To App** provisioning feature setting - in the Admin Console. | - - | INBOUND_PROVISIONING | User profiles are imported from the third-party - app into Okta. This feature represents the **To Okta** provisioning - feature setting in the Admin Console. | - + | USER_PROVISIONING | User profiles are pushed from Okta to the third-party app. Represents the **To App** provisioning feature setting in the Admin Console. | + | INBOUND_PROVISIONING | User profiles are imported from the third-party app into Okta. This feature represents the **To Okta** provisioning feature setting in the Admin Console. | Select the feature: example: USER_PROVISIONING @@ -5093,27 +5613,17 @@ components: - DISABLED - ENABLED LinksSelf: - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the - [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. This object is used for dynamic discovery of related - resources and lifecycle operations. + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. type: object properties: self: $ref: '#/components/schemas/HrefObjectSelfLink' readOnly: true CapabilitiesCreateObject: - description: > - Determines whether Okta assigns a new app account to each user managed - by Okta. - - - Okta doesn't create a new account if it detects that the username - specified in Okta already exists in the app. + description: | + Determines whether Okta assigns a new app account to each user managed by Okta. + Okta doesn't create a new account if it detects that the username specified in Okta already exists in the app. The user's Okta username is assigned by default. type: object properties: @@ -5190,8 +5700,7 @@ components: href: type: string description: Link URI - example: >- - https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7/scopes/scpCmCCV1DpxVkCaye2X + example: https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7/scopes/scpCmCCV1DpxVkCaye2X title: type: string description: Link name @@ -5213,16 +5722,13 @@ components: href: type: string description: Link URI - example: >- - https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7 + example: https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7 title: type: string description: Link name example: Example Authorization Server AppConfig: - description: >- - Additional app configuration for group push mappings. Currently only - required for Active Directory. + description: Additional app configuration for group push mappings. Currently only required for Active Directory. type: object properties: type: @@ -5234,16 +5740,14 @@ components: ACTIVE_DIRECTORY: '#/components/schemas/AppConfigActiveDirectory' GroupPushMappingLinks: description: Discoverable resources related to the group push mapping - allOf: - - properties: - app: - $ref: '#/components/schemas/HrefObjectAppLink' - sourceGroup: - $ref: '#/components/schemas/HrefObjectGroupLink' - targetGroup: - $ref: '#/components/schemas/HrefObjectGroupLink' - type: object type: object + properties: + app: + $ref: '#/components/schemas/HrefObjectAppLink' + sourceGroup: + $ref: '#/components/schemas/HrefObjectGroupLink' + targetGroup: + $ref: '#/components/schemas/HrefObjectGroupLink' GroupPushMappingStatusUpsert: description: The status of the group push mapping title: GroupPushMappingStatus @@ -5253,24 +5757,65 @@ components: - ACTIVE - INACTIVE GroupAssignmentProfile: - description: >- - Specifies the profile properties applied to [application - users](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/ApplicationUsers/) - that are assigned to the app through group membership. - - Some reference properties are imported from the target app and can't be - configured. See - [profile](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#tag/User/operation/getUser!c=200&path=profile&t=response). + description: |- + Specifies the profile properties applied to [application users](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/applicationusers) that are assigned to the app through group membership. + Some reference properties are imported from the target app and can't be configured. See [profile](https://developer.okta.com/docs/api/openapi/okta-management/management/user/getuser#user/getuser/t=response&c=200&path=profile). additionalProperties: true type: object HrefObjectAppLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the app resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the app resource HrefObjectGroupLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the group resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the group resource PatchAction: description: The operation (PATCH action) type: string @@ -5278,17 +5823,16 @@ components: - remove - replace x-enumDescriptions: - remove: Removes the attribute in `path` + remove: Removes the attribute in `path` if allowed replace: Replaces the attribute in content `path` with the content in `value` OAuth2RefreshTokenScope: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: description: type: string description: Description of the Scope - example: >- - Requests a refresh token by default, used to obtain more access - tokens without re-prompting the user for authentication + example: Requests a refresh token by default, used to obtain more access tokens without re-prompting the user for authentication displayName: type: string description: Name of the end user displayed in a consent dialog @@ -5302,74 +5846,53 @@ components: description: Scope name example: offline_access _links: - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the - current status of an application using the [JSON Hypertext - Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. This object is used for dynamic discovery of related - resources and lifecycle operations. + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status of an application using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. type: object properties: scope: description: Link to Scope resource - allOf: - - $ref: '#/components/schemas/OfflineAccessScopeResourceHrefObject' + type: object + properties: + href: + type: string + description: Link URI + example: https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7/scopes/scppb56cIl4GvGxy70g3 + title: + type: string + description: Link name + example: offline_access RevokeRefreshTokenHrefObject: type: object properties: href: type: string description: Link URI - example: >- - https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7/clients/0oabskvc6442nkvQO0h7/tokens/oar579Mcp7OUsNTlo0g3 + example: https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7/clients/0oabskvc6442nkvQO0h7/tokens/oar579Mcp7OUsNTlo0g3 AppUserCredentials: - description: > + description: | Specifies a user's credentials for the app. - - This parameter can be omitted for apps with [sign-on - mode](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Application/#tag/Application/operation/getApplication!c=200&path=0/signOnMode&t=response) - (`signOnMode`) or [authentication - schemes](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Application/#tag/Application/operation/getApplication!c=200&path=0/credentials/scheme&t=response) - (`credentials.scheme`) that don't require credentials. + This parameter can be omitted for apps with [sign-on mode](https://developer.okta.com/docs/api/openapi/okta-management/management/application/getapplication#application/getapplication/t=response&c=200&path=&d=0/signonmode) (`signOnMode`) or [authentication schemes](https://developer.okta.com/docs/api/openapi/okta-management/management/application/getapplication#application/getapplication/t=response&c=200&path=&d=0/credentials/scheme) (`credentials.scheme`) that don't require credentials. type: object properties: password: $ref: '#/components/schemas/AppUserPasswordCredential' userName: type: string - description: >- + description: |- The user's username in the app - - > **Note:** The - [userNameTemplate](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Application/#tag/Application/operation/createApplication!path=0/credentials/userNameTemplate&t=request) - in the application object defines the default username generated - when a user is assigned to that app. - - > If you attempt to assign a username or password to an app with an - incompatible [authentication - scheme](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Application/#tag/Application/operation/createApplication!path=0/credentials/scheme&t=request), - the following error is returned: - - > "Credentials should not be set on this resource based on the - scheme." + > **Note:** The [userNameTemplate](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/application/other/createapplication#application/createapplication/t=response&c=200&path=&d=0/credentials/usernametemplate) in the application object defines the default username generated when a user is assigned to that app. + > If you attempt to assign a username or password to an app with an incompatible [authentication scheme](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/application/other/createapplication#application/createapplication/t=response&c=200&path=&d=0/credentials/scheme), the following error is returned: + > "Credentials should not be set on this resource based on the scheme." minLength: 1 maxLength: 100 example: testuser@example.com AppUserProfile: - description: > + description: | Specifies the default and custom profile properties for a user. - - Properties that are visible in the Admin Console for an app assignment - can also be assigned through the API. - - Some properties are reference properties that are imported from the - target app and can't be configured. - - See - [profile](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#tag/User/operation/getUser!c=200&path=profile&t=response). + Properties that are visible in the Admin Console for an app assignment can also be assigned through the API. + Some properties are reference properties that are imported from the target app and can't be configured. + See [profile](https://developer.okta.com/docs/api/openapi/okta-management/management/user/getuser#user/getuser/t=response&c=200&path=profile). additionalProperties: true type: object AppUserStatus: @@ -5391,57 +5914,26 @@ components: - SUSPENDED - UNASSIGNED x-enumDescriptions: - ACTIVE: >- - The application user is provisioned and is enabled to use the app. - This status also occurs if the app has the `IMPORT_PROFILE_UPDATES` - feature enabled and user import is confirmed, or if the app doesn't - have provisioning enabled. - INACTIVE: >- - The application user is provisioned, but isn't enabled to use the app. - Application users in this status can be reactivated with a password - reset or permanently deleted. + ACTIVE: The application user is provisioned and is enabled to use the app. This status also occurs if the app has the `IMPORT_PROFILE_UPDATES` feature enabled and user import is confirmed, or if the app doesn't have provisioning enabled. + INACTIVE: The application user is provisioned, but isn't enabled to use the app. Application users in this status can be reactivated with a password reset or permanently deleted. IMPORTED: The application user is created based on imported data. MATCHED: The imported user is matched with an existing Application User. - UNASSIGNED: >- - The application user was imported, but the user-matching operation was - skipped. - SUSPENDED: >- - The application user is provisioned, but isn't enabled to use the app. - Application users in this status can be reactivated without a password - reset. - PENDING: >- - The application user is provisioned, but in a pending state and can't - use the app. The status moves to `ACTIVE` when the application user is - activated. - APPROVED: >- - The application user was created but not provisioned. This status can - occur when manual provisioning acknowledgment is required. - REVOKED: >- - The application user is disabled and waiting for deprovisioning - acknowledgment. The application user can be deleted after - deprovisioning acknowledgment. + UNASSIGNED: The application user was imported, but the user-matching operation was skipped. + SUSPENDED: The application user is provisioned, but isn't enabled to use the app. Application users in this status can be reactivated without a password reset. + PENDING: The application user is provisioned, but in a pending state and can't use the app. The status moves to `ACTIVE` when the application user is activated. + APPROVED: The application user was created but not provisioned. This status can occur when manual provisioning acknowledgment is required. + REVOKED: The application user is disabled and waiting for deprovisioning acknowledgment. The application user can be deleted after deprovisioning acknowledgment. IMPLICIT: The application user is now migrated to use implicit app assignment. - STAGED: >- - The application user doesn't have `externalId` set and the background - provisioning operation is queued. This applies to apps with the - `PUSH_NEW_USERS` feature enabled. - PROVISIONED: >- - The background provisioning operation completed and the application - user was assigned an `externalId` successfully. - DEPROVISIONED: >- - The user was removed by the provisioning operation and the - `externalId` property is unassigned. + STAGED: The application user doesn't have `externalId` set and the background provisioning operation is queued. This applies to apps with the `PUSH_NEW_USERS` feature enabled. + PROVISIONED: The background provisioning operation completed and the application user was assigned an `externalId` successfully. + DEPROVISIONED: The user was removed by the provisioning operation and the `externalId` property is unassigned. readOnly: true AppUserSyncState: - description: >- + description: |- The synchronization state for the application user. + The application user's `syncState` depends on whether the `PROFILE_MASTERING` feature is enabled for the app. - The application user's `syncState` depends on whether the - `PROFILE_MASTERING` feature is enabled for the app. - - - > **Note:** User provisioning currently must be configured through the - Admin Console. + > **Note:** User provisioning currently must be configured through the Admin Console. example: SYNCHRONIZED type: string enum: @@ -5451,31 +5943,14 @@ components: - SYNCHRONIZED - SYNCING x-enumDescriptions: - DISABLED: >- - The provisioning feature is disabled for the app (`PROFILE_MASTERING` - feature is disabled). - OUT_OF_SYNC: >- - The Application User has changes that haven't been pushed to the - target app. - SYNCING: >- - A background provisioning operation is running to update the user's - profile in the target app. - SYNCHRONIZED: >- - All changes to the application user profile have successfully been - synchronized with the target app. - ERROR: >- - A background provisioning operation failed to update the user's - profile in the target app. You must resolve the provisioning task in - the Admin Console before you retry the operation. + DISABLED: The provisioning feature is disabled for the app (`PROFILE_MASTERING` feature is disabled). + OUT_OF_SYNC: The Application User has changes that haven't been pushed to the target app. + SYNCING: A background provisioning operation is running to update the user's profile in the target app. + SYNCHRONIZED: All changes to the application user profile have successfully been synchronized with the target app. + ERROR: A background provisioning operation failed to update the user's profile in the target app. You must resolve the provisioning task in the Admin Console before you retry the operation. readOnly: true LinksAppAndUser: - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the - [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. This object is used for dynamic discovery of resources - related to the application user. + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of resources related to the application user. type: object properties: app: @@ -5494,15 +5969,9 @@ components: $ref: '#/components/schemas/AppUserCredentials' AppUserProfileRequestPayload: title: Profile - description: >- + description: |- Updates the assigned user profile - - > **Note:** The Okta API currently doesn't support entity tags for - conditional updates. As long as you're the only user updating the the - user profile, Okta recommends you fetch the most recent profile with - [Retrieve an Application - User](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/ApplicationUsers/#tag/ApplicationUsers/operation/getApplicationUser), - apply your profile update, and then `POST` back the updated profile. + > **Note:** The Okta API currently doesn't support entity tags for conditional updates. As long as you're the only user updating the the user profile, Okta recommends you fetch the most recent profile with [Retrieve an Application User](https://developer.okta.com/docs/api/openapi/okta-management/management/applicationusers#tag/ApplicationUsers/operation/getApplicationUser), apply your profile update, and then `POST` back the updated profile. type: object properties: profile: @@ -5515,6 +5984,13 @@ components: - office365 - slack - zoomus + ApplicationCapability: + description: Capabilities supported by the app + type: string + enum: + - PROVISIONING + - SSO + - UNIVERSAL_LOGOUT ApplicationVisibilityHide: description: Hides the app for specific end-user apps type: object @@ -5530,14 +6006,61 @@ components: default: false example: true AccessPolicyLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the app access policy resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the app access policy resource HrefObjectActivateLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to activate the resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to activate the resource HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object additionalProperties: true type: object @@ -5554,51 +6077,176 @@ components: readOnly: true templated: type: boolean - description: >- - Indicates whether the link object's `href` property is a URI - template. + description: Indicates whether the link object's `href` property is a URI template. readOnly: true type: type: string - description: >- - The media type of the link. If omitted, it is implicitly - `application/json`. + description: The media type of the link. If omitted, it is implicitly `application/json`. readOnly: true required: - href HrefObjectDeactivateLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to deactivate the resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to deactivate the resource GroupsLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: >- - Link to the [Application - Groups](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/ApplicationGroups/#tag/ApplicationGroups/operation/listApplicationGroupAssignments) - resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the [Application Groups](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/applicationgroups/other/listapplicationgroupassignments) resource HelpLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the app help resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the app help resource MetadataLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: >- - Link to the [SAML - metadata](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/ApplicationSSO/#tag/ApplicationSSO/operation/previewSAMLmetadataForApplication) - for SSO + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the [SAML metadata](https://developer.okta.com/docs/api/openapi/okta-management/management/applicationsso/previewsamlmetadataforapplication) for SSO HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) UsersLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: >- - Link to the [Application - Users](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/ApplicationUsers/#tag/ApplicationUsers/operation/listApplicationUsers) - resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the [Application Users](https://developer.okta.com/docs/api/openapi/okta-management/management/applicationusers#tag/ApplicationUsers/operation/listApplicationUsers) resource ProvisioningConnectionAuthScheme: description: Defines the method of authentication type: string @@ -5609,9 +6257,7 @@ components: x-enumDescriptions: TOKEN: A token is used to authenticate with the app. OAUTH2: OAuth 2.0 is used to authenticate with the app. - UNKNOWN: >- - The authentication scheme used by the app isn't supported, or the app - doesn't support provisioning. + UNKNOWN: The authentication scheme used by the app isn't supported, or the app doesn't support provisioning. Org2OrgProvisioningOAuthSigningSettings: x-okta-lifecycle: lifecycle: GA @@ -5629,14 +6275,16 @@ components: required: - rotationMode LinksSelfAndLifecycle: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - type: object - properties: - activate: - $ref: '#/components/schemas/HrefObjectActivateLink' - deactivate: - $ref: '#/components/schemas/HrefObjectDeactivateLink' + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + activate: + $ref: '#/components/schemas/HrefObjectActivateLink' + deactivate: + $ref: '#/components/schemas/HrefObjectDeactivateLink' + readOnly: true HrefObjectAuthorizeLink: x-okta-lifecycle: lifecycle: GA @@ -5684,52 +6332,78 @@ components: href: type: string description: Link URI - example: >- - https://{yourOktaDomain}/api/v1/apps/0oad5lTSBOMUBOBVVQSC/credentials/csrs/h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50/lifecycle/publish + example: https://{yourOktaDomain}/api/v1/apps/0oad5lTSBOMUBOBVVQSC/credentials/csrs/h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50/lifecycle/publish + required: + - href + readOnly: true + HrefCsrSelfLink: + title: Link Object + description: Link to the resource (self) + type: object + properties: + hints: + $ref: '#/components/schemas/CsrSelfHrefHints' + href: + type: string + description: Link URI + example: https://{yourOktaDomain}/api/v1/apps/0oad5lTSBOMUBOBVVQSC/credentials/csrs/h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50 required: - href readOnly: true - HrefCsrSelfLink: + HrefObjectDeleteLink: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object - description: Link to the resource (self) + additionalProperties: true type: object properties: hints: - $ref: '#/components/schemas/CsrSelfHrefHints' + $ref: '#/components/schemas/HrefHints' + readOnly: true href: type: string description: Link URI - example: >- - https://{yourOktaDomain}/api/v1/apps/0oad5lTSBOMUBOBVVQSC/credentials/csrs/h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50 + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true required: - href - readOnly: true - HrefObjectDeleteLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to delete the resource + description: Link to delete the resource LifecycleCreateSettingObject: - description: >- - Determines whether to update a user in the app when a user in Okta is - updated + x-okta-ignore-redocly-rules-for-sdk: true + description: Determines whether to update a user in the app when a user in Okta is updated type: object properties: status: - allOf: - - $ref: '#/components/schemas/EnabledStatus' - - default: DISABLED + description: Setting status + type: string + enum: + - DISABLED + - ENABLED + default: DISABLED LifecycleDeactivateSettingObject: + x-okta-ignore-redocly-rules-for-sdk: true description: Determines whether deprovisioning occurs when the app is unassigned type: object properties: status: - allOf: - - $ref: '#/components/schemas/EnabledStatus' - - default: DISABLED + description: Setting status + type: string + enum: + - DISABLED + - ENABLED + default: DISABLED PasswordSettingObject: - description: >- - Determines whether Okta creates and pushes a password in the app for - each assigned user + x-okta-ignore-redocly-rules-for-sdk: true + description: Determines whether Okta creates and pushes a password in the app for each assigned user type: object properties: change: @@ -5737,60 +6411,49 @@ components: seed: $ref: '#/components/schemas/SeedEnum' status: - allOf: - - $ref: '#/components/schemas/EnabledStatus' - - default: DISABLED - - example: ENABLED + description: Setting status + type: string + enum: + - DISABLED + - ENABLED + default: DISABLED + example: ENABLED ProfileSettingObject: - description: > - This setting determines whether a user in the app gets updated when - they're updated in Okta. - - - If enabled, Okta updates a user's attributes in the app when the app is - assigned. + x-okta-ignore-redocly-rules-for-sdk: true + description: | + This setting determines whether a user in the app gets updated when they're updated in Okta. - Future changes made to the Okta user's profile automatically overwrite - the corresponding attribute value in the app. + If enabled, Okta updates a user's attributes in the app when the app is assigned. + Future changes made to the Okta user's profile automatically overwrite the corresponding attribute value in the app. type: object properties: status: - allOf: - - $ref: '#/components/schemas/EnabledStatus' - - example: DISABLED - - default: DISABLED + description: Setting status + type: string + enum: + - DISABLED + - ENABLED + example: DISABLED + default: DISABLED CapabilitiesImportRulesUserCreateAndMatchObject: description: Rules for matching and creating users type: object properties: allowPartialMatch: type: boolean - description: >- - Allows user import upon partial matching. Partial matching occurs - when the first and last names of an imported user match those of an - existing Okta user, even if the username or email attributes don't - match. + description: Allows user import upon partial matching. Partial matching occurs when the first and last names of an imported user match those of an existing Okta user, even if the username or email attributes don't match. autoActivateNewUsers: type: boolean description: If set to `true`, imported new users are automatically activated. autoConfirmExactMatch: type: boolean - description: >- - If set to `true`, exact-matched users are automatically confirmed on - activation. If set to `false`, exact-matched users need to be - confirmed manually. + description: If set to `true`, exact-matched users are automatically confirmed on activation. If set to `false`, exact-matched users need to be confirmed manually. autoConfirmNewUsers: type: boolean - description: >- - If set to `true`, imported new users are automatically confirmed on - activation. This doesn't apply to imported users that already exist - in Okta. + description: If set to `true`, imported new users are automatically confirmed on activation. This doesn't apply to imported users that already exist in Okta. autoConfirmPartialMatch: type: boolean - description: >- - If set to `true`, partially matched users are automatically - confirmed on activation. If set to `false`, partially matched users - need to be confirmed manually. + description: If set to `true`, partially matched users are automatically confirmed on activation. If set to `false`, partially matched users need to be confirmed manually. exactMatchCriteria: type: string description: Determines the attribute to match users @@ -5798,17 +6461,42 @@ components: - EMAIL - USERNAME ImportScheduleObject: + x-okta-ignore-redocly-rules-for-sdk: true description: Import schedule configuration type: object properties: fullImport: - allOf: - - $ref: '#/components/schemas/ImportScheduleSettings' - - description: Determines the full import schedule + type: object + properties: + expression: + type: string + description: The import schedule in UNIX cron format + example: 00 21 * * Mon,Thu,Fri,Sat + timezone: + type: string + description: The import schedule time zone in Internet Assigned Numbers Authority (IANA) time zone name format + minLength: 1 + maxLength: 64 + example: America/Los_Angeles + required: + - expression + description: Determines the full import schedule incrementalImport: - allOf: - - $ref: '#/components/schemas/ImportScheduleSettings' - - description: Determines the incremental import schedule + type: object + properties: + expression: + type: string + description: The import schedule in UNIX cron format + example: 00 21 * * Mon,Thu,Fri,Sat + timezone: + type: string + description: The import schedule time zone in Internet Assigned Numbers Authority (IANA) time zone name format + minLength: 1 + maxLength: 64 + example: America/Los_Angeles + required: + - expression + description: Determines the incremental import schedule status: $ref: '#/components/schemas/EnabledStatus' ImportUsernameObject: @@ -5817,10 +6505,7 @@ components: properties: userNameExpression: type: string - description: >- - For `usernameFormat=CUSTOM`, specifies the Okta Expression Language - statement for a username format that imported users use to sign in - to Okta + description: For `usernameFormat=CUSTOM`, specifies the Okta Expression Language statement for a username format that imported users use to sign in to Okta usernameFormat: type: string description: Determines the username format when users sign in to Okta @@ -5841,16 +6526,13 @@ components: href: type: string description: Link URI - example: >- - https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7/scopes/scppb56cIl4GvGxy70g3 + example: https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7/scopes/scppb56cIl4GvGxy70g3 title: type: string description: Link name example: offline_access AppUserPasswordCredential: - description: >- - The user's password. This is a write-only property. An empty `password` - object is returned to indicate that a password value exists. + description: The user's password. This is a write-only property. An empty `password` object is returned to indicate that a password value exists. type: object properties: value: @@ -5859,9 +6541,32 @@ components: format: password writeOnly: true HrefObjectUserLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the user resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the user resource HrefHints: description: Describes allowed HTTP verbs for the `href` type: object @@ -5877,28 +6582,23 @@ components: - AUTO - MANUAL x-enumDescriptions: - AUTO: >- - Okta manages key rotation for the provisioning connection. Use the - [Retrieve a JWKS for the default provisioning - connection](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/ApplicationConnections/#tag/ApplicationConnections/operation/getUserProvisioningConnectionJWKS) - endpoint for the latest key credentials. - MANUAL: >- - You need to rotate the keys for your provisioning connection manually - based on your own schedule. See [Key - rotation](https://developer.okta.com/docs/concepts/key-rotation/). + AUTO: Okta manages key rotation for the provisioning connection. Use the [Retrieve a JWKS for the default provisioning connection](https://developer.okta.com/docs/api/openapi/okta-management/management/applicationconnections/getuserprovisioningconnectionjwks) endpoint for the latest key credentials. + MANUAL: You need to rotate the keys for your provisioning connection manually based on your own schedule. See [Key rotation](https://developer.okta.com/docs/concepts/key-rotation/). HrefHintsGuidanceObject: - allOf: - - $ref: '#/components/schemas/HrefHints' - - description: Describes allowed HTTP verbs and guidance for the `href` - - type: object - properties: - guidance: - type: array - description: > - Specifies the URI to invoke for granting scope consent required - to complete the OAuth 2.0 connection - items: - type: string + x-okta-ignore-redocly-rules-for-sdk: true + description: Describes allowed HTTP verbs for the `href` + type: object + properties: + allow: + type: array + items: + $ref: '#/components/schemas/HttpMethod' + guidance: + type: array + description: | + Specifies the URI to invoke for granting scope consent required to complete the OAuth 2.0 connection + items: + type: string CsrPublishHrefHints: description: Describes allowed HTTP verbs for the `href` type: object @@ -5921,9 +6621,7 @@ components: - GET - DELETE ChangeEnum: - description: >- - Determines whether a change in a user's password also updates the user's - password in the app + description: Determines whether a change in a user's password also updates the user's password in the app default: KEEP_EXISTING example: CHANGE type: string @@ -5931,9 +6629,7 @@ components: - CHANGE - KEEP_EXISTING SeedEnum: - description: >- - Determines whether the generated password is the user's Okta password or - a randomly generated password + description: Determines whether the generated password is the user's Okta password or a randomly generated password default: RANDOM example: OKTA type: string @@ -5949,9 +6645,7 @@ components: example: 00 21 * * Mon,Thu,Fri,Sat timezone: type: string - description: >- - The import schedule time zone in Internet Assigned Numbers Authority - (IANA) time zone name format + description: The import schedule time zone in Internet Assigned Numbers Authority (IANA) time zone name format minLength: 1 maxLength: 64 example: America/Los_Angeles @@ -5964,6 +6658,119 @@ components: - GET - POST - PUT + ListApplicationsResponse: + type: object + properties: + applications: + type: array + items: + $ref: '#/components/schemas/Application' + ListCsrsForApplicationResponse: + type: object + properties: + csrs_for_application: + type: array + items: + $ref: '#/components/schemas/Csr' + ListJwkResponse: + type: object + properties: + jwk: + type: array + items: + oneOf: + - $ref: '#/components/schemas/OAuth2ClientJsonSigningKeyResponse' + - $ref: '#/components/schemas/OAuth2ClientJsonEncryptionKeyResponse' + ListApplicationKeysResponse: + type: object + properties: + application_keys: + type: array + items: + $ref: '#/components/schemas/JsonWebKey' + ListOAuth2ClientSecretsResponse: + type: object + properties: + oauth2_client_secrets: + type: array + items: + $ref: '#/components/schemas/OAuth2ClientSecret' + GetAllCrossAppAccessConnectionsResponse: + type: object + properties: + cross_app_access_connections: + type: array + items: + $ref: '#/components/schemas/OrgCrossAppAccessConnection' + ListFeaturesForApplicationResponse: + type: object + properties: + features_for_application: + type: array + items: + $ref: '#/components/schemas/ApplicationFeature' + ListFederatedClaimsResponse: + type: object + properties: + federated_claims: + type: array + items: + $ref: '#/components/schemas/FederatedClaim' + ListScopeConsentGrantsResponse: + type: object + properties: + scope_consent_grants: + type: array + items: + $ref: '#/components/schemas/OAuth2ScopeConsentGrant' + ListGroupPushMappingsResponse: + type: object + properties: + group_push_mappings: + type: array + items: + $ref: '#/components/schemas/GroupPushMapping' + ListApplicationGroupAssignmentsResponse: + type: object + properties: + application_group_assignments: + type: array + items: + $ref: '#/components/schemas/ApplicationGroupAssignment' + ListInterclientAllowedApplicationsResponse: + type: object + properties: + interclient_allowed_applications: + type: array + items: + type: object + properties: + interclient_allowed_application: + type: string + ListInterclientTargetApplicationsResponse: + type: object + properties: + interclient_target_applications: + type: array + items: + type: object + properties: + interclient_target_application: + type: string + ListOAuth2TokensForApplicationResponse: + type: object + properties: + oauth2_tokens_for_application: + type: array + items: + $ref: '#/components/schemas/OAuth2RefreshToken' + ListApplicationUsersResponse: + type: object + properties: + application_users: + type: array + items: + $ref: '#/components/schemas/AppUser' responses: ErrorAccessDenied403: description: Forbidden @@ -6036,16 +6843,10 @@ components: queryAppsExpand: name: expand in: query - description: >- - An optional parameter used for link expansion to embed more resources in - the response. - - Only supports `expand=user/{userId}` and must be used with the `user.id - eq "{userId}"` filter query for the same user. - - Returns the assigned [application - user](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/ApplicationUsers/) in the - `_embedded` property. + description: |- + An optional parameter used for link expansion to embed more resources in the response. + Only supports `expand=user/{userId}` and must be used with the `user.id eq "{userId}"` filter query for the same user. + Returns the assigned [application user](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/applicationusers) in the `_embedded` property. schema: type: string example: user/0oa1gjh63g214q0Hq0g4 @@ -6071,8 +6872,8 @@ components: schema: type: string required: true - description: Unique `id` of the Custom Authorization Server JSON Web Key - example: apk2f4zrZbs8nUa7p0g4 + description: Unique `id` of the OAuth 2.0 client JSON Web Key + example: pks2f4zrZbs8nUa7p0g4 pathKeyId: name: keyId description: ID of the Key Credential for the application @@ -6087,7 +6888,7 @@ components: schema: type: string required: true - description: Unique `id` of the OAuth 2.0 Client Secret + description: Unique `id` of the OAuth 2.0 client secret example: ocs2f4zrZbs8nUa7p0g4 connectionId: name: connectionId @@ -6115,9 +6916,7 @@ components: queryAppGrantsExpand: name: expand in: query - description: >- - An optional parameter to return scope details in the `_embedded` - property. Valid value: `scope` + description: 'An optional parameter to return scope details in the `_embedded` property. Valid value: `scope`' schema: type: string example: scope @@ -6140,13 +6939,9 @@ components: queryGroupAssignmentLimit: name: limit in: query - description: >- + description: |- Specifies the number of objects to return per page. - - If there are multiple pages of results, the Link header contains a - `next` link that you need to use as an opaque value (follow it, don't - parse it). - + If there are multiple pages of results, the Link header contains a `next` link that you need to use as an opaque value (follow it, don't parse it). See [Pagination]https://developer.okta.com/docs/api#pagination. examples: min: @@ -6167,12 +6962,7 @@ components: queryGroupAssignmentWithMetadataExpand: name: expand in: query - description: >- - An optional query parameter to return the corresponding assigned - [group](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/Group/) - or - - the group assignment metadata details in the `_embedded` property. + description: An optional query parameter to return the corresponding assigned [group](openapi/okta-management/management/group) or the group assignment metadata details in the `_embedded` property. schema: type: string example: metadata @@ -6194,12 +6984,7 @@ components: queryGroupAssignmentWithGroupExpand: name: expand in: query - description: >- - An optional query parameter to return the corresponding assigned - [group](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/Group/) - or - - the group assignment metadata details in the `_embedded` property. + description: An optional query parameter to return the corresponding assigned [group](openapi/okta-management/management/group) or the group assignment metadata details in the `_embedded` property. schema: type: string example: group @@ -6210,9 +6995,17 @@ components: metadata: value: metadata summary: Embedded group assignment metadata + appIdToDelete: + name: allowedAppId + in: path + schema: + type: string + required: true + description: App ID of the allowed app instance to delete mapping from the target app. + example: 0oa1elyw9EAkUNUrW0g5 pathPolicyId: name: policyId - description: '`id` of the Policy' + description: '`id` of the policy' in: path required: true schema: @@ -6221,10 +7014,7 @@ components: queryAppAfter: name: after in: query - description: >- - Specifies the pagination cursor for the next page of results. Treat this - as an opaque value obtained through the next link relationship. See - [Pagination]https://developer.okta.com/docs/api#pagination. + description: Specifies the pagination cursor for the next page of results. Treat this as an opaque value obtained through the next link relationship. See [Pagination]https://developer.okta.com/docs/api#pagination. schema: type: string example: 16275000448691 @@ -6254,13 +7044,9 @@ components: minimum: 1 maximum: 500 default: 50 - description: > + description: | Specifies the number of objects to return per page. - - If there are multiple pages of results, the Link header contains a - `next` link that you need to use as an opaque value (follow it, don't - parse it). - + If there are multiple pages of results, the Link header contains a `next` link that you need to use as an opaque value (follow it, don't parse it). See [Pagination]https://developer.okta.com/docs/api#pagination. queryAppUserQ: name: q @@ -6268,27 +7054,16 @@ components: schema: type: string example: sam - description: > - Specifies a filter for the list of application users returned based on - their profile attributes. - - The value of `q` is matched against the beginning of the following - profile attributes: `userName`, `firstName`, `lastName`, and `email`. - - This filter only supports the `startsWith` operation that matches the - `q` string against the beginning of the attribute values. - - > **Note:** For OIDC apps, user profiles don't contain the `firstName` - or `lastName` attributes. Therefore, the query only matches against the - `userName` or `email` attributes. + description: | + Specifies a filter for the list of application users returned based on their profile attributes. + The value of `q` is matched against the beginning of the following profile attributes: `userName`, `firstName`, `lastName`, and `email`. + This filter only supports the `startsWith` operation that matches the `q` string against the beginning of the attribute values. + > **Note:** For OIDC apps, user profiles don't contain the `firstName` or `lastName` attributes. Therefore, the query only matches against the `userName` or `email` attributes. queryAppUserExpand: name: expand in: query - description: >- - An optional query parameter to return the corresponding - [User](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/) object in the - `_embedded` property. - + description: |- + An optional query parameter to return the corresponding [User](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/user) object in the `_embedded` property. Valid value: `user` schema: type: string @@ -6312,8 +7087,7 @@ components: summary: Retrieve apps assigned to a user value: - id: 0oa1gjh63g214q0Hq0g4 - orn: >- - orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:testorgone_customsaml20app_1:0oa1gjh63g214q0Hq0g4 + orn: orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:testorgone_customsaml20app_1:0oa1gjh63g214q0Hq0g4 name: testorgone_customsaml20app_1 label: Custom Saml 2.0 App status: ACTIVE @@ -6359,8 +7133,7 @@ components: signatureAlgorithm: RSA_SHA256 digestAlgorithm: SHA256 honorForceAuthn: true - authnContextClassRef: >- - urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport + authnContextClassRef: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport slo: enabled: true spIssuer: https://testorgone.okta.com @@ -6382,30 +7155,23 @@ components: _links: logo: - name: medium - href: >- - https://testorgone.okta.com/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png + href: https://testorgone.okta.com/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png type: image/png appLinks: - name: testorgone_customsaml20app_1_link - href: >- - https://testorgone.okta.com/home/testorgone_customsaml20app_1/0oa1gjh63g214q0Hq0g4/aln1gofChJaerOVfY0g4 + href: https://testorgone.okta.com/home/testorgone_customsaml20app_1/0oa1gjh63g214q0Hq0g4/aln1gofChJaerOVfY0g4 type: text/html help: - href: >- - https://testorgone-admin.okta.com/app/testorgone_customsaml20app_1/0oa1gjh63g214q0Hq0g4/setup/help/SAML_2_0/instructions + href: https://testorgone-admin.okta.com/app/testorgone_customsaml20app_1/0oa1gjh63g214q0Hq0g4/setup/help/SAML_2_0/instructions type: text/html users: - href: >- - https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/users + href: https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/users deactivate: - href: >- - https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/lifecycle/deactivate + href: https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/lifecycle/deactivate groups: - href: >- - https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/groups + href: https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/groups metadata: - href: >- - https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/sso/saml/metadata + href: https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/sso/saml/metadata type: application/xml _embedded: user: @@ -6423,11 +7189,9 @@ components: userName: user@example.com _links: app: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oabizCHPNYALCHDUIOD + href: https://{yourOktaDomain}/api/v1/apps/0oabizCHPNYALCHDUIOD user: - href: >- - https://{yourOktaDomain}/api/v1/users/00ucw2RPGIUNTDQOYPOF + href: https://{yourOktaDomain}/api/v1/users/00ucw2RPGIUNTDQOYPOF id: 0oabkvBLDEKCNXBGYUAS name: template_swa label: Sample Plugin App @@ -6463,17 +7227,13 @@ components: name: medium type: image/png users: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS/users + href: https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS/users groups: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS/groups + href: https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS/groups self: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS + href: https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS deactivate: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS/lifecycle/deactivate _embedded: user: id: 00ucw2RPGIUNTDQOYPOF @@ -6491,11 +7251,9 @@ components: password: {} _links: app: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS + href: https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS user: - href: >- - https://{yourOktaDomain}/api/v1/users/00ucw2RPGIUNTDQOYPOF + href: https://{yourOktaDomain}/api/v1/users/00ucw2RPGIUNTDQOYPOF GetApplicationsByGroupResponseEx: summary: Retrieve apps assigned to a group value: @@ -6543,31 +7301,25 @@ components: attributeStatements: [] _links: help: - href: >- - https://testorgone-admin.okta.com/app/workday/0oa7vicdkRNrz59R80w6/setup/help/SAML_2_0/external-doc + href: https://testorgone-admin.okta.com/app/workday/0oa7vicdkRNrz59R80w6/setup/help/SAML_2_0/external-doc type: text/html metadata: - href: >- - https://testorgone.okta.com/api/v1/apps/0oa7vicdkRNrz59R80w6/sso/saml/metadata + href: https://testorgone.okta.com/api/v1/apps/0oa7vicdkRNrz59R80w6/sso/saml/metadata type: application/xml appLinks: - name: login - href: >- - https://testorgone.okta.com/home/workday/0oa7vicdkRNrz59R80w6/30 + href: https://testorgone.okta.com/home/workday/0oa7vicdkRNrz59R80w6/30 type: text/html groups: - href: >- - https://testorgone.okta.com/api/v1/apps/0oa7vicdkRNrz59R80w6/groups + href: https://testorgone.okta.com/api/v1/apps/0oa7vicdkRNrz59R80w6/groups logo: - name: medium href: https://tc2static.oktacdn.com/fs/bcg/4/gfs1wwhrwJR4LpB5X0w6 type: image/png users: - href: >- - https://testorgone.okta.com/api/v1/apps/0oa7vicdkRNrz59R80w6/users + href: https://testorgone.okta.com/api/v1/apps/0oa7vicdkRNrz59R80w6/users deactivate: - href: >- - https://testorgone.okta.com/api/v1/apps/0oa7vicdkRNrz59R80w6/lifecycle/deactivate + href: https://testorgone.okta.com/api/v1/apps/0oa7vicdkRNrz59R80w6/lifecycle/deactivate - id: 0oa7vicvor8YSr9Hc0w6 orn: orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:workday:0oa7vicvor8YSr9Hc0w6 name: workday @@ -6612,35 +7364,28 @@ components: attributeStatements: [] _links: help: - href: >- - https://testorgone-admin.okta.com/app/workday/0oa7vicvor8YSr9Hc0w6/setup/help/SAML_2_0/external-doc + href: https://testorgone-admin.okta.com/app/workday/0oa7vicvor8YSr9Hc0w6/setup/help/SAML_2_0/external-doc type: text/html metadata: - href: >- - https://testorgone.okta.com/api/v1/apps/0oa7vicvor8YSr9Hc0w6/sso/saml/metadata + href: https://testorgone.okta.com/api/v1/apps/0oa7vicvor8YSr9Hc0w6/sso/saml/metadata type: application/xml appLinks: - name: login - href: >- - https://testorgone.okta.com/home/workday/0oa7vicvor8YSr9Hc0w6/30 + href: https://testorgone.okta.com/home/workday/0oa7vicvor8YSr9Hc0w6/30 type: text/html groups: - href: >- - https://testorgone.okta.com/api/v1/apps/0oa7vicvor8YSr9Hc0w6/groups + href: https://testorgone.okta.com/api/v1/apps/0oa7vicvor8YSr9Hc0w6/groups logo: - name: medium href: https://tc2static.oktacdn.com/fs/bcg/4/gfs1wwhrwJR4LpB5X0w6 type: image/png users: - href: >- - https://testorgone.okta.com/api/v1/apps/0oa7vicvor8YSr9Hc0w6/users + href: https://testorgone.okta.com/api/v1/apps/0oa7vicvor8YSr9Hc0w6/users deactivate: - href: >- - https://testorgone.okta.com/api/v1/apps/0oa7vicvor8YSr9Hc0w6/lifecycle/deactivate + href: https://testorgone.okta.com/api/v1/apps/0oa7vicvor8YSr9Hc0w6/lifecycle/deactivate - id: 0oabkvBLDEKCNXBGYUAS name: template_swa - orn: >- - orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:template_swa:0oabkvBLDEKCNXBGYUAS + orn: orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:template_swa:0oabkvBLDEKCNXBGYUAS label: Sample Plugin App status: ACTIVE lastUpdated: '2013-09-11T17:58:54.000Z' @@ -6680,15 +7425,13 @@ components: self: href: https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS deactivate: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS/lifecycle/deactivate GetApplicationsByKeyResponseEx: summary: Retrieve apps using a key value: - id: 0oa1gjh63g214q0Hq0g4 name: testorgone_customsaml20app_1 - orn: >- - orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:testorgone_customsaml20app_1:0oa1gjh63g214q0Hq0g4 + orn: orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:testorgone_customsaml20app_1:0oa1gjh63g214q0Hq0g4 label: Custom Saml 2.0 App status: ACTIVE lastUpdated: '2016-08-09T20:12:19.000Z' @@ -6733,8 +7476,7 @@ components: signatureAlgorithm: RSA_SHA256 digestAlgorithm: SHA256 honorForceAuthn: true - authnContextClassRef: >- - urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport + authnContextClassRef: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport slo: enabled: true spIssuer: https://testorgone.okta.com @@ -6760,30 +7502,23 @@ components: _links: logo: - name: medium - href: >- - https://testorgone.okta.com/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png + href: https://testorgone.okta.com/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png type: image/png appLinks: - name: testorgone_customsaml20app_1_link - href: >- - https://testorgone.okta.com/home/testorgone_customsaml20app_1/0oa1gjh63g214q0Hq0g4/aln1gofChJaerOVfY0g4 + href: https://testorgone.okta.com/home/testorgone_customsaml20app_1/0oa1gjh63g214q0Hq0g4/aln1gofChJaerOVfY0g4 type: text/html help: - href: >- - https://testorgone-admin.okta.com/app/testorgone_customsaml20app_1/0oa1gjh63g214q0Hq0g4/setup/help/SAML_2_0/instructions + href: https://testorgone-admin.okta.com/app/testorgone_customsaml20app_1/0oa1gjh63g214q0Hq0g4/setup/help/SAML_2_0/instructions type: text/html users: - href: >- - https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/users + href: https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/users deactivate: - href: >- - https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/lifecycle/deactivate + href: https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/lifecycle/deactivate groups: - href: >- - https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/groups + href: https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/groups metadata: - href: >- - https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/sso/saml/metadata + href: https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/sso/saml/metadata type: application/xml _embedded: user: @@ -6801,11 +7536,9 @@ components: userName: user@example.com _links: app: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oabizCHPNYALCHDUIOD + href: https://{yourOktaDomain}/api/v1/apps/0oabizCHPNYALCHDUIOD user: - href: >- - https://{yourOktaDomain}/api/v1/users/00ucw2RPGIUNTDQOYPOF + href: https://{yourOktaDomain}/api/v1/users/00ucw2RPGIUNTDQOYPOF id: 0oabkvBLDEKCNXBGYUAS name: template_swa label: Sample Plugin App @@ -6841,17 +7574,13 @@ components: name: medium type: image/png users: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS/users + href: https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS/users groups: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS/groups + href: https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS/groups self: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS + href: https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS deactivate: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS/lifecycle/deactivate _embedded: user: id: 00ucw2RPGIUNTDQOYPOF @@ -6869,11 +7598,9 @@ components: password: {} _links: app: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS + href: https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS user: - href: >- - https://{yourOktaDomain}/api/v1/users/00ucw2RPGIUNTDQOYPOF + href: https://{yourOktaDomain}/api/v1/users/00ucw2RPGIUNTDQOYPOF GetApplicationsByNameResponseEx: summary: Retrieve apps by name value: @@ -6921,31 +7648,25 @@ components: attributeStatements: [] _links: help: - href: >- - https://testorgone-admin.okta.com/app/workday/0oa7vicdkRNrz59R80w6/setup/help/SAML_2_0/external-doc + href: https://testorgone-admin.okta.com/app/workday/0oa7vicdkRNrz59R80w6/setup/help/SAML_2_0/external-doc type: text/html metadata: - href: >- - https://testorgone.okta.com/api/v1/apps/0oa7vicdkRNrz59R80w6/sso/saml/metadata + href: https://testorgone.okta.com/api/v1/apps/0oa7vicdkRNrz59R80w6/sso/saml/metadata type: application/xml appLinks: - name: login - href: >- - https://testorgone.okta.com/home/workday/0oa7vicdkRNrz59R80w6/30 + href: https://testorgone.okta.com/home/workday/0oa7vicdkRNrz59R80w6/30 type: text/html groups: - href: >- - https://testorgone.okta.com/api/v1/apps/0oa7vicdkRNrz59R80w6/groups + href: https://testorgone.okta.com/api/v1/apps/0oa7vicdkRNrz59R80w6/groups logo: - name: medium href: https://tc2static.oktacdn.com/fs/bcg/4/gfs1wwhrwJR4LpB5X0w6 type: image/png users: - href: >- - https://testorgone.okta.com/api/v1/apps/0oa7vicdkRNrz59R80w6/users + href: https://testorgone.okta.com/api/v1/apps/0oa7vicdkRNrz59R80w6/users deactivate: - href: >- - https://testorgone.okta.com/api/v1/apps/0oa7vicdkRNrz59R80w6/lifecycle/deactivate + href: https://testorgone.okta.com/api/v1/apps/0oa7vicdkRNrz59R80w6/lifecycle/deactivate - id: 0oa7vicvor8YSr9Hc0w6 name: workday orn: orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:workday:0oa7vicdkRNrz59R80w6 @@ -6990,31 +7711,25 @@ components: attributeStatements: [] _links: help: - href: >- - https://testorgone-admin.okta.com/app/workday/0oa7vicvor8YSr9Hc0w6/setup/help/SAML_2_0/external-doc + href: https://testorgone-admin.okta.com/app/workday/0oa7vicvor8YSr9Hc0w6/setup/help/SAML_2_0/external-doc type: text/html metadata: - href: >- - https://testorgone.okta.com/api/v1/apps/0oa7vicvor8YSr9Hc0w6/sso/saml/metadata + href: https://testorgone.okta.com/api/v1/apps/0oa7vicvor8YSr9Hc0w6/sso/saml/metadata type: application/xml appLinks: - name: login - href: >- - https://testorgone.okta.com/home/workday/0oa7vicvor8YSr9Hc0w6/30 + href: https://testorgone.okta.com/home/workday/0oa7vicvor8YSr9Hc0w6/30 type: text/html groups: - href: >- - https://testorgone.okta.com/api/v1/apps/0oa7vicvor8YSr9Hc0w6/groups + href: https://testorgone.okta.com/api/v1/apps/0oa7vicvor8YSr9Hc0w6/groups logo: - name: medium href: https://tc2static.oktacdn.com/fs/bcg/4/gfs1wwhrwJR4LpB5X0w6 type: image/png users: - href: >- - https://testorgone.okta.com/api/v1/apps/0oa7vicvor8YSr9Hc0w6/users + href: https://testorgone.okta.com/api/v1/apps/0oa7vicvor8YSr9Hc0w6/users deactivate: - href: >- - https://testorgone.okta.com/api/v1/apps/0oa7vicvor8YSr9Hc0w6/lifecycle/deactivate + href: https://testorgone.okta.com/api/v1/apps/0oa7vicvor8YSr9Hc0w6/lifecycle/deactivate BookmarkEx: summary: BOOKMARK value: @@ -7209,21 +7924,18 @@ components: - POST appLinks: - name: customswaapp_link - href: >- - http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 + href: http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 type: text/html groups: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/groups logo: - name: medium - href: >- - http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png + href: http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png type: image/png users: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/users deactivate: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate visibility: autoLaunch: false autoSubmitToolbar: false @@ -7277,21 +7989,18 @@ components: - POST appLinks: - name: customswaapp_link - href: >- - http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 + href: http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 type: text/html groups: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/groups logo: - name: medium - href: >- - http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png + href: http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png type: image/png users: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/users deactivate: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate visibility: autoLaunch: false autoSubmitToolbar: false @@ -7301,8 +8010,7 @@ components: appLinks: customswaapp_link: true name: customswaapp - orn: >- - orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:customswaapp:0oafxqCAJWWGELFTYASJ + orn: orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:customswaapp:0oafxqCAJWWGELFTYASJ label: Custom SWA App features: [] signOnMode: AUTO_LOGIN @@ -7349,21 +8057,18 @@ components: - POST appLinks: - name: customswaapp_link - href: >- - http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 + href: http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 type: text/html groups: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/groups logo: - name: medium - href: >- - http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png + href: http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png type: image/png users: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/users deactivate: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate visibility: autoLaunch: false autoSubmitToolbar: false @@ -7373,8 +8078,7 @@ components: appLinks: login: true name: template_basic_auth - orn: >- - orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:template_basic_auth:0oafxqCAJWWGELFTYASJ + orn: orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:template_basic_auth:0oafxqCAJWWGELFTYASJ label: Sample Basic Auth App features: [] signOnMode: BASIC_AUTH @@ -7421,21 +8125,18 @@ components: - POST appLinks: - name: customswaapp_link - href: >- - http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 + href: http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 type: text/html groups: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/groups logo: - name: medium - href: >- - http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png + href: http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png type: image/png users: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/users deactivate: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate visibility: autoLaunch: false autoSubmitToolbar: false @@ -7445,8 +8146,7 @@ components: appLinks: login: true name: template_sps - orn: >- - orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:template_sps:0oafxqCAJWWGELFTYASJ + orn: orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:template_sps:0oafxqCAJWWGELFTYASJ label: Example SWA App features: [] signOnMode: SECURE_PASSWORD_STORE @@ -7499,21 +8199,18 @@ components: - POST appLinks: - name: customswaapp_link - href: >- - http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 + href: http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 type: text/html groups: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/groups logo: - name: medium - href: >- - http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png + href: http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png type: image/png users: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/users deactivate: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate visibility: autoLaunch: false autoSubmitToolbar: false @@ -7523,8 +8220,7 @@ components: appLinks: login: true name: template_wsfed - orn: >- - orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:template_wsfed:0oafxqCAJWWGELFTYASJ + orn: orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:template_wsfed:0oafxqCAJWWGELFTYASJ label: Sample WS-Fed App features: [] signOnMode: WS_FEDERATION @@ -7581,21 +8277,18 @@ components: - POST appLinks: - name: customswaapp_link - href: >- - http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 + href: http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 type: text/html groups: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/groups logo: - name: medium - href: >- - http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png + href: http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png type: image/png users: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/users deactivate: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate visibility: autoLaunch: false autoSubmitToolbar: false @@ -7605,8 +8298,7 @@ components: appLinks: login: true name: template_swa - orn: >- - orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:template_swa:0oafxqCAJWWGELFTYASJ + orn: orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:template_swa:0oafxqCAJWWGELFTYASJ label: Sample Plugin App features: [] signOnMode: BROWSER_PLUGIN @@ -7655,21 +8347,18 @@ components: - POST appLinks: - name: customswaapp_link - href: >- - http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 + href: http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 type: text/html groups: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/groups logo: - name: medium - href: >- - http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png + href: http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png type: image/png users: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/users deactivate: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate visibility: autoLaunch: false autoSubmitToolbar: false @@ -7679,8 +8368,7 @@ components: appLinks: login: true name: template_swa3field - orn: >- - orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:template_swa3field:0oafxqCAJWWGELFTYASJ + orn: orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:template_swa3field:0oafxqCAJWWGELFTYASJ label: Sample Plugin App features: [] signOnMode: BROWSER_PLUGIN @@ -7731,21 +8419,18 @@ components: - POST appLinks: - name: customswaapp_link - href: >- - http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 + href: http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 type: text/html groups: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/groups logo: - name: medium - href: >- - http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png + href: http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png type: image/png users: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/users deactivate: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate visibility: autoLaunch: false autoSubmitToolbar: false @@ -7755,8 +8440,7 @@ components: appLinks: testorgone_examplecustomsaml20app_1_link: true name: testorgone_examplecustomsaml20app_1 - orn: >- - orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:testorgone_examplecustomsaml20app_1:0oafxqCAJWWGELFTYASJ + orn: orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:testorgone_examplecustomsaml20app_1:0oafxqCAJWWGELFTYASJ label: Example Custom SAML 2.0 App features: [] signOnMode: SAML_2_0 @@ -7831,21 +8515,18 @@ components: - POST appLinks: - name: customswaapp_link - href: >- - http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 + href: http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 type: text/html groups: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/groups logo: - name: medium - href: >- - http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png + href: http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png type: image/png users: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/users deactivate: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate visibility: autoLaunch: false autoSubmitToolbar: false @@ -7855,8 +8536,7 @@ components: appLinks: oidc_client_link: true name: oidc_client - orn: >- - orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:oidc_client:0oafxqCAJWWGELFTYASJ + orn: orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:oidc_client:0oafxqCAJWWGELFTYASJ label: Sample Client profile features: [] signOnMode: OPENID_CONNECT @@ -7912,8 +8592,7 @@ components: value: id: 0oa1gjh63g214q0Hq0g4 name: testorgone_customsaml20app_1 - orn: >- - orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:testorgone_customsaml20app_1:0oa1gjh63g214q0Hq0g4 + orn: orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:testorgone_customsaml20app_1:0oa1gjh63g214q0Hq0g4 label: Custom Saml 2.0 App status: ACTIVE lastUpdated: '2016-08-09T20:12:19.000Z' @@ -7985,8 +8664,7 @@ components: - id: cal3ughy17pylLxQB357 _links: self: - href: >- - https://{yourOktaDomain}/api/v1/inlineHooks/cal3ughy17pylLxQB357 + href: https://{yourOktaDomain}/api/v1/inlineHooks/cal3ughy17pylLxQB357 hints: allow: - GET @@ -7997,32 +8675,33 @@ components: supportType: FULL identityStack: NOT_SHARED protocol: GLOBAL_TOKEN_REVOCATION + expressConfiguration: + supportedCapabilities: + - SSO + - PROVISIONING + - UNIVERSAL_LOGOUT + enabledCapabilities: + - SSO _links: logo: - name: medium - href: >- - https://testorgone.okta.com/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png + href: https://testorgone.okta.com/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png type: image/png appLinks: - name: testorgone_customsaml20app_1_link - href: >- - https://testorgone.okta.com/home/testorgone_customsaml20app_1/0oa1gjh63g214q0Hq0g4/aln1gofChJaerOVfY0g4 + href: https://testorgone.okta.com/home/testorgone_customsaml20app_1/0oa1gjh63g214q0Hq0g4/aln1gofChJaerOVfY0g4 type: text/html help: - href: >- - https://testorgone-admin.okta.com/app/testorgone_customsaml20app_1/0oa1gjh63g214q0Hq0g4/setup/help/SAML_2_0/instructions + href: https://testorgone-admin.okta.com/app/testorgone_customsaml20app_1/0oa1gjh63g214q0Hq0g4/setup/help/SAML_2_0/instructions type: text/html users: href: https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/users deactivate: - href: >- - https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/lifecycle/deactivate + href: https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/lifecycle/deactivate groups: - href: >- - https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/groups + href: https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/groups metadata: - href: >- - https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/sso/saml/metadata + href: https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/sso/saml/metadata type: application/xml BookmarkPutEx: summary: BOOKMARK @@ -8210,21 +8889,18 @@ components: - POST appLinks: - name: customswaapp_link - href: >- - http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 + href: http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 type: text/html groups: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/groups logo: - name: medium - href: >- - http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png + href: http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png type: image/png users: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/users deactivate: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate visibility: autoLaunch: false autoSubmitToolbar: false @@ -8278,21 +8954,18 @@ components: - POST appLinks: - name: customswaapp_link - href: >- - http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 + href: http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 type: text/html groups: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/groups logo: - name: medium - href: >- - http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png + href: http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png type: image/png users: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/users deactivate: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate visibility: autoLaunch: false autoSubmitToolbar: false @@ -8302,8 +8975,7 @@ components: appLinks: customswaapp_link: true name: customswaapp - orn: >- - orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:customswaapp:0oafxqCAJWWGELFTYASJ + orn: orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:customswaapp:0oafxqCAJWWGELFTYASJ label: Custom SWA App updated features: [] signOnMode: AUTO_LOGIN @@ -8350,21 +9022,18 @@ components: - POST appLinks: - name: customswaapp_link - href: >- - http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 + href: http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 type: text/html groups: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/groups logo: - name: medium - href: >- - http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png + href: http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png type: image/png users: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/users deactivate: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate visibility: autoLaunch: false autoSubmitToolbar: false @@ -8374,8 +9043,7 @@ components: appLinks: login: true name: template_basic_auth - orn: >- - orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:template_basic_auth:0oafxqCAJWWGELFTYASJ + orn: orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:template_basic_auth:0oafxqCAJWWGELFTYASJ label: Sample Basic Auth App updated features: [] signOnMode: BASIC_AUTH @@ -8422,21 +9090,18 @@ components: - POST appLinks: - name: customswaapp_link - href: >- - http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 + href: http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 type: text/html groups: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/groups logo: - name: medium - href: >- - http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png + href: http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png type: image/png users: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/users deactivate: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate visibility: autoLaunch: false autoSubmitToolbar: false @@ -8446,8 +9111,7 @@ components: appLinks: login: true name: template_sps - orn: >- - orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:template_sps:0oafxqCAJWWGELFTYASJ + orn: orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:template_sps:0oafxqCAJWWGELFTYASJ label: Example SWA App updated features: [] signOnMode: SECURE_PASSWORD_STORE @@ -8500,21 +9164,18 @@ components: - POST appLinks: - name: customswaapp_link - href: >- - http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 + href: http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 type: text/html groups: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/groups logo: - name: medium - href: >- - http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png + href: http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png type: image/png users: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/users deactivate: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate visibility: autoLaunch: false autoSubmitToolbar: false @@ -8524,8 +9185,7 @@ components: appLinks: login: true name: template_wsfed - orn: >- - orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:template_wsfed:0oafxqCAJWWGELFTYASJ + orn: orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:template_wsfed:0oafxqCAJWWGELFTYASJ label: Sample WS-Fed App updated features: [] signOnMode: WS_FEDERATION @@ -8582,21 +9242,18 @@ components: - POST appLinks: - name: customswaapp_link - href: >- - http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 + href: http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 type: text/html groups: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/groups logo: - name: medium - href: >- - http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png + href: http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png type: image/png users: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/users deactivate: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate visibility: autoLaunch: false autoSubmitToolbar: false @@ -8606,8 +9263,7 @@ components: appLinks: login: true name: template_swa - orn: >- - orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:template_swa:0oafxqCAJWWGELFTYASJ + orn: orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:template_swa:0oafxqCAJWWGELFTYASJ label: Sample Plugin App updated features: [] signOnMode: BROWSER_PLUGIN @@ -8656,21 +9312,18 @@ components: - POST appLinks: - name: customswaapp_link - href: >- - http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 + href: http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 type: text/html groups: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/groups logo: - name: medium - href: >- - http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png + href: http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png type: image/png users: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/users deactivate: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate visibility: autoLaunch: false autoSubmitToolbar: false @@ -8680,8 +9333,7 @@ components: appLinks: login: true name: template_swa3field - orn: >- - orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:template_swa3field:0oafxqCAJWWGELFTYASJ + orn: orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:template_swa3field:0oafxqCAJWWGELFTYASJ label: Sample Plugin App updated features: [] signOnMode: BROWSER_PLUGIN @@ -8732,21 +9384,18 @@ components: - POST appLinks: - name: customswaapp_link - href: >- - http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 + href: http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 type: text/html groups: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/groups logo: - name: medium - href: >- - http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png + href: http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png type: image/png users: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/users deactivate: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate visibility: autoLaunch: false autoSubmitToolbar: false @@ -8756,8 +9405,7 @@ components: appLinks: testorgone_examplecustomsaml20app_1_link: true name: testorgone_examplecustomsaml20app_1 - orn: >- - orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:testorgone_examplecustomsaml20app_1:0oafxqCAJWWGELFTYASJ + orn: orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:testorgone_examplecustomsaml20app_1:0oafxqCAJWWGELFTYASJ label: Example Custom SAML 2.0 App updated features: [] signOnMode: SAML_2_0 @@ -8832,21 +9480,18 @@ components: - POST appLinks: - name: customswaapp_link - href: >- - http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 + href: http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4 type: text/html groups: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/groups logo: - name: medium - href: >- - http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png + href: http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png type: image/png users: href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/users deactivate: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate visibility: autoLaunch: false autoSubmitToolbar: false @@ -8856,8 +9501,7 @@ components: appLinks: oidc_client_link: true name: oidc_client - orn: >- - orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:oidc_client:0oafxqCAJWWGELFTYASJ + orn: orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:oidc_client:0oafxqCAJWWGELFTYASJ label: Sample Client profile updated features: [] signOnMode: OPENID_CONNECT @@ -8922,8 +9566,7 @@ components: - GET - POST deactivate: - href: >- - https://{yourOktaDomain}/api/v1/apps/${appId}/connections/default/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/apps/${appId}/connections/default/lifecycle/deactivate hints: allow: - POST @@ -8943,8 +9586,7 @@ components: - GET - POST deactivate: - href: >- - https://{yourOktaDomain}/api/v1/apps/${appId}/connections/default/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/apps/${appId}/connections/default/lifecycle/deactivate hints: allow: - POST @@ -8962,21 +9604,17 @@ components: - GET - POST deactivate: - href: >- - https://{yourOktaDomain}/api/v1/apps/${appId}/connections/default/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/apps/${appId}/connections/default/lifecycle/deactivate hints: allow: - POST authorize: - href: >- - https://login.microsoftonline.com/myofficetenant.onmicrosoft.com/oauth2/authorize?response_type=code&state=>&client_id=&redirect_uri=&scope= + href: https://login.microsoftonline.com/myofficetenant.onmicrosoft.com/oauth2/authorize?response_type=code&state=>&client_id=&redirect_uri=&scope= hints: allow: - GET guidance: - - >- - Specifies the URI to invoke in a browser for granting scope - consent required to complete the OAuth 2.0 connection. + - Specifies the URI to invoke in a browser for granting scope consent required to complete the OAuth 2.0 connection. ProvisioningConnectionTokenRequestEx: summary: Provisioning connection with token for Zscaler 2.0 (zscalerbyz) app value: @@ -8995,9 +9633,7 @@ components: lifecycle: GA isGenerallyAvailable: false SKUs: [] - summary: >- - Provisioning connection with OAuth 2.0 for Okta Org2Org app with key - rotation + summary: Provisioning connection with OAuth 2.0 for Okta Org2Org app with key rotation value: profile: authScheme: OAUTH @@ -9017,9 +9653,7 @@ components: lifecycle: GA isGenerallyAvailable: false SKUs: [] - summary: >- - Provisioning connection with OAuth 2.0 for Okta Org2Org (okta_org2org) - app + summary: Provisioning connection with OAuth 2.0 for Okta Org2Org (okta_org2org) app value: authScheme: OAUTH2 status: ENABLED @@ -9036,8 +9670,7 @@ components: - GET - POST deactivate: - href: >- - https://{yourOktaDomain}/api/v1/apps/${appId}/connections/default/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/apps/${appId}/connections/default/lifecycle/deactivate hints: allow: - POST @@ -9054,27 +9687,23 @@ components: 'n': AJncrKuine49_CEVR4GPn.....zOrouIUCSMlRL0HU= AppCsrPkcs10Response: summary: CSR in DER format - value: >- - MIIC4DCCAcgCAQAwcTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk9rdGEsIEluYy4xDDAKBgNVBAsMA0RldjESMBAGA1UEAwwJU1AgSXNzdWVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6m8jHVCr9 + value: MIIC4DCCAcgCAQAwcTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk9rdGEsIEluYy4xDDAKBgNVBAsMA0RldjESMBAGA1UEAwwJU1AgSXNzdWVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6m8jHVCr9 AppCsrJsonResponse: summary: CSR object in JSON format value: id: h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50 created: '2017-03-28T01:11:10.000Z' - csr: >- - MIIC4DCCAcgCAQAwcTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk9rdGEsIEluYy4xDDAKBgNVBAsMA0RldjESMBAGA1UEAwwJU1AgSXNzdWVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6m8jHVCr9/tKvvbFN59T4raoCs/78KRm4fSefHQOv1TKLXo4wTLbsqYWRWc5u0sd5orUMQgPQOyj3i6qh13mALY4BzrT057EG1BUNjGg29QgYlnOk2iX890e5BIDMQQEIKFrvOi2V8cLUkLvE2ydRn0VO1Q1frbUkYeStJYC5Api2JQsYRwa+1ZeDH1ITnIzUaugWhW2WB2lSnwZkenne5KtffxMPYVu+IhNRHoKaRA6Z51YNhMJIx17JM2hs/H4Ka3drk6kzDf7ofk/yBpb9yBWyU7CTSQhdoHidxqFprMDaT66W928t3AeOENHBuwn8c2K9WeGG+bELNyQRJVmawIDAQABoCowKAYJKoZIhvcNAQkOMRswGTAXBgNVHREEEDAOggxkZXYub2t0YS5jb20wDQYJKoZIhvcNAQELBQADggEBAA2hsVJRVM+A83X9MekjTnIbt19UNT8wX7wlE9jUKirWsxceLiZBpVGn9qfKhhVIpvdaIRSeoFYS2Kg/m1G6bCvjmZLcrQ5FcEBjZH2NKfNppGVnfC2ugtUkBtCB+UUzOhKhRKJtGugenKbP33zRWWIqnd2waF6Cy8TIuqQVPbwEDN9bCbAs7ND6CFYNguY7KYjWzQOeAR716eqpEEXuPYAS4nx/ty4ylonR8cv+gpq51rvq80A4k/36aoeM0Y6I4w64vhTfuvWW2UYFUD+/+y2FA2CSP4JfctySrf1s525v6fzTFZ3qZbB5OZQtP2b8xYWktMzywsxGKDoVDB4wkH4= + csr: MIIC4DCCAcgCAQAwcTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk9rdGEsIEluYy4xDDAKBgNVBAsMA0RldjESMBAGA1UEAwwJU1AgSXNzdWVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6m8jHVCr9/tKvvbFN59T4raoCs/78KRm4fSefHQOv1TKLXo4wTLbsqYWRWc5u0sd5orUMQgPQOyj3i6qh13mALY4BzrT057EG1BUNjGg29QgYlnOk2iX890e5BIDMQQEIKFrvOi2V8cLUkLvE2ydRn0VO1Q1frbUkYeStJYC5Api2JQsYRwa+1ZeDH1ITnIzUaugWhW2WB2lSnwZkenne5KtffxMPYVu+IhNRHoKaRA6Z51YNhMJIx17JM2hs/H4Ka3drk6kzDf7ofk/yBpb9yBWyU7CTSQhdoHidxqFprMDaT66W928t3AeOENHBuwn8c2K9WeGG+bELNyQRJVmawIDAQABoCowKAYJKoZIhvcNAQkOMRswGTAXBgNVHREEEDAOggxkZXYub2t0YS5jb20wDQYJKoZIhvcNAQELBQADggEBAA2hsVJRVM+A83X9MekjTnIbt19UNT8wX7wlE9jUKirWsxceLiZBpVGn9qfKhhVIpvdaIRSeoFYS2Kg/m1G6bCvjmZLcrQ5FcEBjZH2NKfNppGVnfC2ugtUkBtCB+UUzOhKhRKJtGugenKbP33zRWWIqnd2waF6Cy8TIuqQVPbwEDN9bCbAs7ND6CFYNguY7KYjWzQOeAR716eqpEEXuPYAS4nx/ty4ylonR8cv+gpq51rvq80A4k/36aoeM0Y6I4w64vhTfuvWW2UYFUD+/+y2FA2CSP4JfctySrf1s525v6fzTFZ3qZbB5OZQtP2b8xYWktMzywsxGKDoVDB4wkH4= kty: RSA _links: self: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oad5lTSBOMUBOBVVQSC/credentials/csrs/h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50 + href: https://{yourOktaDomain}/api/v1/apps/0oad5lTSBOMUBOBVVQSC/credentials/csrs/h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50 hints: allow: - GET - DELETE publish: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oad5lTSBOMUBOBVVQSC/credentials/csrs/h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50/lifecycle/publish + href: https://{yourOktaDomain}/api/v1/apps/0oad5lTSBOMUBOBVVQSC/credentials/csrs/h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50/lifecycle/publish hints: allow: - POST @@ -9085,11 +9714,9 @@ components: lastUpdated: '2024-08-13T18:26:57.000Z' expiresAt: '2017-12-10T18:56:22.000Z' x5c: - - >- - MIIDqDCCApCgAwIBAgIGAVGNQFX5MA0GCSqGSIb3DQEBBQUAMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGJhbGFjb21wdGVzdDEcMBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTAeFw0xNTEyMTAxODU1MjJaFw0xNzEyMTAxODU2MjJaMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGJhbGFjb21wdGVzdDEcMBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJJjrcnI6cXBiXNq9YDgfYrQe2O5qEHG4MXP8Ue0sMeefFkFEHYHnHUeZCq6WTAGqR+1LFgOl+Eq9We5V+qNlGIfkFkQ3iHGBrIALKqLCd0Et76HicDiegz7j9DtN+lo0hG/gfcw5783L5g5xeQ7zVmCQMkFwoUA0uA3bsfUSrmfORHJL+EMNQT8XIXD8NkG4g6u7ylHVRTLgXbe+W/p04m3EP6l41xl+MhIpBaPxDsyUvcKCNwkZN3aZIin1O9Y4YJuDHxrM64/VtLLp0sC05iawAmfsLunF7rdJAkWUpPn+xkviyNQ3UpvwAYuDr+jKLUdh2reRnm1PezxMIXzBVMCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEARnFIjyitrCGbleFr3KeAwdOyeHiRmgeKupX5ZopgXtcseJoToUIinX5DVw2fVZPahqs0Q7/a0wcVnTRpw6946qZCwKd/PvZ1feVuVEA5Ui3+XvHuSH5xLp7NvYG1snNEvlbN3+NDUMlWj2NEbihowUBt9+UxTpQO3+N08q3aZk3hOZ+tHt+1Te7KEEL/4CM28GZ9MY7fSrS7MAgp1+ZXtn+kRlMrXnQ49qBda37brwDRqmSY9PwNMbev3r+9ZHwxr9W5wXW4Ev4C4xngA7RkVoyDbItSUho0I0M0u/LHuppclnXrw97xyO5Z883eIBvPVjfRcxsJxXJ8jx70ATDskw== + - MIIDqDCCApCgAwIBAgIGAVGNQFX5MA0GCSqGSIb3DQEBBQUAMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGJhbGFjb21wdGVzdDEcMBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTAeFw0xNTEyMTAxODU1MjJaFw0xNzEyMTAxODU2MjJaMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGJhbGFjb21wdGVzdDEcMBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJJjrcnI6cXBiXNq9YDgfYrQe2O5qEHG4MXP8Ue0sMeefFkFEHYHnHUeZCq6WTAGqR+1LFgOl+Eq9We5V+qNlGIfkFkQ3iHGBrIALKqLCd0Et76HicDiegz7j9DtN+lo0hG/gfcw5783L5g5xeQ7zVmCQMkFwoUA0uA3bsfUSrmfORHJL+EMNQT8XIXD8NkG4g6u7ylHVRTLgXbe+W/p04m3EP6l41xl+MhIpBaPxDsyUvcKCNwkZN3aZIin1O9Y4YJuDHxrM64/VtLLp0sC05iawAmfsLunF7rdJAkWUpPn+xkviyNQ3UpvwAYuDr+jKLUdh2reRnm1PezxMIXzBVMCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEARnFIjyitrCGbleFr3KeAwdOyeHiRmgeKupX5ZopgXtcseJoToUIinX5DVw2fVZPahqs0Q7/a0wcVnTRpw6946qZCwKd/PvZ1feVuVEA5Ui3+XvHuSH5xLp7NvYG1snNEvlbN3+NDUMlWj2NEbihowUBt9+UxTpQO3+N08q3aZk3hOZ+tHt+1Te7KEEL/4CM28GZ9MY7fSrS7MAgp1+ZXtn+kRlMrXnQ49qBda37brwDRqmSY9PwNMbev3r+9ZHwxr9W5wXW4Ev4C4xngA7RkVoyDbItSUho0I0M0u/LHuppclnXrw97xyO5Z883eIBvPVjfRcxsJxXJ8jx70ATDskw== e: AQAB - 'n': >- - mkC6yAJVvFwUlmM9gKjb2d-YK5qHFt-mXSsbjWKKs4EfNm-BoQeeovBZtSACyaqLc8IYFTPEURFcbDQ9DkAL04uUIRD2gaHYY7uK0jsluEaXGq2RAIsmzAwNTzkiDw4q9pDL_q7n0f_SDt1TsMaMQayB6bU5jWsmqcWJ8MCRJ1aJMjZ16un5UVx51IIeCbe4QRDxEXGAvYNczsBoZxspDt28esSpq5W0dBFxcyGVudyl54Er3FzAguhgfMVjH-bUec9j2Tl40qDTktrYgYfxz9pfjm01Hl4WYP1YQxeETpSL7cQ5Ihz4jGDtHUEOcZ4GfJrPzrGpUrak8Qp5xcwCqQ + 'n': mkC6yAJVvFwUlmM9gKjb2d-YK5qHFt-mXSsbjWKKs4EfNm-BoQeeovBZtSACyaqLc8IYFTPEURFcbDQ9DkAL04uUIRD2gaHYY7uK0jsluEaXGq2RAIsmzAwNTzkiDw4q9pDL_q7n0f_SDt1TsMaMQayB6bU5jWsmqcWJ8MCRJ1aJMjZ16un5UVx51IIeCbe4QRDxEXGAvYNczsBoZxspDt28esSpq5W0dBFxcyGVudyl54Er3FzAguhgfMVjH-bUec9j2Tl40qDTktrYgYfxz9pfjm01Hl4WYP1YQxeETpSL7cQ5Ihz4jGDtHUEOcZ4GfJrPzrGpUrak8Qp5xcwCqQ kid: SIMcCQNY3uwXoW3y0vf6VxiBb5n9pf8L2fK8d-FIbm4 kty: RSA use: sig @@ -9129,14 +9756,12 @@ components: lastUpdated: '2023-02-21T20:08:24.000Z' _links: activate: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/jwks/pks2f4zrZbs8nUa7p0g4/lifecycle/activate + href: https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/jwks/pks2f4zrZbs8nUa7p0g4/lifecycle/activate hints: allow: - POST delete: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/jwks/pks2f4zrZbs8nUa7p0g4 + href: https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/jwks/pks2f4zrZbs8nUa7p0g4 hints: allow: - DELETE @@ -9152,8 +9777,7 @@ components: lastUpdated: '2023-04-06T21:32:33.000Z' _links: deactivate: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/jwks/pks2f50kZB0cITmYU0g4/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/jwks/pks2f50kZB0cITmYU0g4/lifecycle/deactivate hints: allow: - POST @@ -9203,8 +9827,7 @@ components: lastUpdated: '2023-04-06T21:32:33.000Z' _links: deactivate: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/jwks/pks2f50kZB0cITmYU0g4/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/jwks/pks2f50kZB0cITmYU0g4/lifecycle/deactivate hints: allow: - POST @@ -9222,14 +9845,12 @@ components: lastUpdated: '2023-04-06T21:32:33.000Z' _links: activate: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/jwks/pks2f50kZB0cITmYU0g4/lifecycle/activate + href: https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/jwks/pks2f50kZB0cITmYU0g4/lifecycle/activate hints: allow: - POST delete: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/jwks/pks2f50kZB0cITmYU0g4 + href: https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/jwks/pks2f50kZB0cITmYU0g4 hints: allow: - DELETE @@ -9252,11 +9873,7 @@ components: errorLink: E0000001 errorId: sampleQPivGUj_ND5v78vbYWW errorCauses: - - errorSummary: >- - Each key should have a unique kid when adding multiple keys. Use - the Apps API to update the JWKS to add a kid for the existing key, - or delete the existing key and re-add the key with a kid using the - JWKS APIs. + - errorSummary: Each key should have a unique kid when adding multiple keys. Use the Apps API to update the JWKS to add a kid for the existing key, or delete the existing key and re-add the key with a kid using the JWKS APIs. ErrorClientJsonWebKeyDuplicateKid: value: errorCode: E0000001 @@ -9272,9 +9889,7 @@ components: errorLink: E0000001 errorId: sampleQPivGUj_ND5v78vbYWW errorCauses: - - errorSummary: >- - RSA key length in the 'jwks' is less than '2,048' bits for the - given key. + - errorSummary: RSA key length in the 'jwks' is less than '2,048' bits for the given key. ErrorClientJsonWebKeyTooManyKids: value: errorCode: E0000001 @@ -9282,10 +9897,7 @@ components: errorLink: E0000001 errorId: sampleQPivGUj_ND5v78vbYWW errorCauses: - - errorSummary: >- - You can't create a new key. You have reached the maximum number of - keys allowed (50). To add another key, you must first delete an - existing one. + - errorSummary: You can't create a new key. You have reached the maximum number of keys allowed (50). To add another key, you must first delete an existing one. ErrorOnlyOneActiveEncryptionKeyAllowed: value: errorCode: E0000001 @@ -9301,11 +9913,9 @@ components: errorLink: E0000001 errorId: sampleQPivGUj_ND5v78vbYWW errorCauses: - - errorSummary: >- - ''ACTIVE'' keys cannot be deleted. Activate another key before - deleting this one. + - errorSummary: You can't delete an active JSON Web Key. Deactivate the key before deleting it. deactivateOAuth2ClientJsonWebKeyResponse: - summary: Deactivate JSON Signing Key example + summary: Deactivate JSON signing key example value: id: pks2f50kZB0cITmYU0g4 kid: ASHJHGasa782333-Sla3x3POBiIxDreBCdZuFs5B @@ -9319,8 +9929,7 @@ components: lastUpdated: '2023-04-06T21:32:33.000Z' _links: activate: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/jwks/pks2f50kZB0cITmYU0g4/lifecycle/activate + href: https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/jwks/pks2f50kZB0cITmYU0g4/lifecycle/activate hints: allow: - POST @@ -9331,9 +9940,7 @@ components: errorLink: E0000001 errorId: sampleQPivGUj_ND5v78vbYWW errorCauses: - - errorSummary: >- - Can't deactivate the only active JSON Web Key when the value for - `token_endpoint_auth_method` is `private_key_jwt`. + - errorSummary: Can't deactivate the only active JSON Web Key when the value for `token_endpoint_auth_method` is `private_key_jwt`. ErrorDeactivateTheOnlyKeyWithRequestObjectSignAlgorithm: value: errorCode: E0000001 @@ -9341,9 +9948,7 @@ components: errorLink: E0000001 errorId: sampleQPivGUj_ND5v78vbYWW errorCauses: - - errorSummary: >- - The `jwks` must contain at least one key with an algorithm - matching the `request_object_signature_algorithm`. + - errorSummary: The `jwks` must contain at least one key with an algorithm matching the `request_object_signature_algorithm`. ErrorDeactivateEncryptionKey: value: errorCode: E0000001 @@ -9359,11 +9964,9 @@ components: lastUpdated: '2024-08-13T18:26:57.000Z' expiresAt: '2017-12-10T18:56:22.000Z' x5c: - - >- - MIIDqDCCApCgAwIBAgIGAVGNQFX5MA0GCSqGSIb3DQEBBQUAMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGJhbGFjb21wdGVzdDEcMBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTAeFw0xNTEyMTAxODU1MjJaFw0xNzEyMTAxODU2MjJaMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGJhbGFjb21wdGVzdDEcMBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJJjrcnI6cXBiXNq9YDgfYrQe2O5qEHG4MXP8Ue0sMeefFkFEHYHnHUeZCq6WTAGqR+1LFgOl+Eq9We5V+qNlGIfkFkQ3iHGBrIALKqLCd0Et76HicDiegz7j9DtN+lo0hG/gfcw5783L5g5xeQ7zVmCQMkFwoUA0uA3bsfUSrmfORHJL+EMNQT8XIXD8NkG4g6u7ylHVRTLgXbe+W/p04m3EP6l41xl+MhIpBaPxDsyUvcKCNwkZN3aZIin1O9Y4YJuDHxrM64/VtLLp0sC05iawAmfsLunF7rdJAkWUpPn+xkviyNQ3UpvwAYuDr+jKLUdh2reRnm1PezxMIXzBVMCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEARnFIjyitrCGbleFr3KeAwdOyeHiRmgeKupX5ZopgXtcseJoToUIinX5DVw2fVZPahqs0Q7/a0wcVnTRpw6946qZCwKd/PvZ1feVuVEA5Ui3+XvHuSH5xLp7NvYG1snNEvlbN3+NDUMlWj2NEbihowUBt9+UxTpQO3+N08q3aZk3hOZ+tHt+1Te7KEEL/4CM28GZ9MY7fSrS7MAgp1+ZXtn+kRlMrXnQ49qBda37brwDRqmSY9PwNMbev3r+9ZHwxr9W5wXW4Ev4C4xngA7RkVoyDbItSUho0I0M0u/LHuppclnXrw97xyO5Z883eIBvPVjfRcxsJxXJ8jx70ATDskw== + - MIIDqDCCApCgAwIBAgIGAVGNQFX5MA0GCSqGSIb3DQEBBQUAMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGJhbGFjb21wdGVzdDEcMBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTAeFw0xNTEyMTAxODU1MjJaFw0xNzEyMTAxODU2MjJaMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGJhbGFjb21wdGVzdDEcMBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJJjrcnI6cXBiXNq9YDgfYrQe2O5qEHG4MXP8Ue0sMeefFkFEHYHnHUeZCq6WTAGqR+1LFgOl+Eq9We5V+qNlGIfkFkQ3iHGBrIALKqLCd0Et76HicDiegz7j9DtN+lo0hG/gfcw5783L5g5xeQ7zVmCQMkFwoUA0uA3bsfUSrmfORHJL+EMNQT8XIXD8NkG4g6u7ylHVRTLgXbe+W/p04m3EP6l41xl+MhIpBaPxDsyUvcKCNwkZN3aZIin1O9Y4YJuDHxrM64/VtLLp0sC05iawAmfsLunF7rdJAkWUpPn+xkviyNQ3UpvwAYuDr+jKLUdh2reRnm1PezxMIXzBVMCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEARnFIjyitrCGbleFr3KeAwdOyeHiRmgeKupX5ZopgXtcseJoToUIinX5DVw2fVZPahqs0Q7/a0wcVnTRpw6946qZCwKd/PvZ1feVuVEA5Ui3+XvHuSH5xLp7NvYG1snNEvlbN3+NDUMlWj2NEbihowUBt9+UxTpQO3+N08q3aZk3hOZ+tHt+1Te7KEEL/4CM28GZ9MY7fSrS7MAgp1+ZXtn+kRlMrXnQ49qBda37brwDRqmSY9PwNMbev3r+9ZHwxr9W5wXW4Ev4C4xngA7RkVoyDbItSUho0I0M0u/LHuppclnXrw97xyO5Z883eIBvPVjfRcxsJxXJ8jx70ATDskw== e: AQAB - 'n': >- - mkC6yAJVvFwUlmM9gKjb2d-YK5qHFt-mXSsbjWKKs4EfNm-BoQeeovBZtSACyaqLc8IYFTPEURFcbDQ9DkAL04uUIRD2gaHYY7uK0jsluEaXGq2RAIsmzAwNTzkiDw4q9pDL_q7n0f_SDt1TsMaMQayB6bU5jWsmqcWJ8MCRJ1aJMjZ16un5UVx51IIeCbe4QRDxEXGAvYNczsBoZxspDt28esSpq5W0dBFxcyGVudyl54Er3FzAguhgfMVjH-bUec9j2Tl40qDTktrYgYfxz9pfjm01Hl4WYP1YQxeETpSL7cQ5Ihz4jGDtHUEOcZ4GfJrPzrGpUrak8Qp5xcwCqQ + 'n': mkC6yAJVvFwUlmM9gKjb2d-YK5qHFt-mXSsbjWKKs4EfNm-BoQeeovBZtSACyaqLc8IYFTPEURFcbDQ9DkAL04uUIRD2gaHYY7uK0jsluEaXGq2RAIsmzAwNTzkiDw4q9pDL_q7n0f_SDt1TsMaMQayB6bU5jWsmqcWJ8MCRJ1aJMjZ16un5UVx51IIeCbe4QRDxEXGAvYNczsBoZxspDt28esSpq5W0dBFxcyGVudyl54Er3FzAguhgfMVjH-bUec9j2Tl40qDTktrYgYfxz9pfjm01Hl4WYP1YQxeETpSL7cQ5Ihz4jGDtHUEOcZ4GfJrPzrGpUrak8Qp5xcwCqQ kid: SIMcCQNY3uwXoW3y0vf6VxiBb5n9pf8L2fK8d-FIbm4 kty: RSA use: sig @@ -9372,11 +9975,9 @@ components: lastUpdated: '2024-08-13T18:26:57.000Z' expiresAt: '2045-01-23T02:15:23.000Z' x5c: - - >- - MIIDqDCCApCgAwIBAgIGAUsUkouzMA0GCSqGSIb3DQEBBQUAMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGJhbGFjb21wdGVzdDEcMBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTAeFw0xNTAxMjMwMjE0MjNaFw00NTAxMjMwMjE1MjNaMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGJhbGFjb21wdGVzdDEcMBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKhmkmKsu3FYeBiJg44aN6Ah3g9gof1cytXJVMnblDUWpLfe/FMUQCssh8Y8NCYRri5jni4efBgk6B3SkC7ymqsOXILIEHSwUYWnAaqDOTxO101mHzryowu1+0PldRNoyTthahpprvAPYlTin9zrDTqFT+WY/zwoaN8H+CfixlW1nM85qF18zYYekkW50MSoHPcfJKe2ywIhPXTYTSBEPcHh8dQEjBrZn7A4qOoDnfOXll8OL7j2O6EVyTtHA0tLJHVLpwI4gSPsXFwEnHltjN57odwYe9yds0BbM/YG9i+am1+3cmZ6Uyd16mLGclrr05o9BHcEZ4ZctV2hr6whbRsCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEAnNlF27gRmhGTQ+GRAvbvYToFRgsIbBAPvRqB2LmEIiQ6UJd602w6uP1sv/zEzBYg4SnMLuVyWgOJ6d71dCvXdIO9mgAq6BaEPjlo0WhGyt+zGrpkMnIX5EwRa64kHydcPRHNA607wVYA96sJdyNJEMzBvjY9fJnfevzzDCN3NWpMS2T6rk6HP5IziI1VuFWY2OUC1kbCqLj1dUgp8koe3ftLL55ZpkAocnVMnrzBveNjgAOAiKTMcyS0bhESph9aVWvuHVZSfTnUjnTPb/4jA2YlB3ED+qaU3aqHwft1KXwZskNXBKXy7lyC+CMoeB3/ncFhSg/UllBooPPS3wYlNA== + - MIIDqDCCApCgAwIBAgIGAUsUkouzMA0GCSqGSIb3DQEBBQUAMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGJhbGFjb21wdGVzdDEcMBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTAeFw0xNTAxMjMwMjE0MjNaFw00NTAxMjMwMjE1MjNaMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGJhbGFjb21wdGVzdDEcMBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKhmkmKsu3FYeBiJg44aN6Ah3g9gof1cytXJVMnblDUWpLfe/FMUQCssh8Y8NCYRri5jni4efBgk6B3SkC7ymqsOXILIEHSwUYWnAaqDOTxO101mHzryowu1+0PldRNoyTthahpprvAPYlTin9zrDTqFT+WY/zwoaN8H+CfixlW1nM85qF18zYYekkW50MSoHPcfJKe2ywIhPXTYTSBEPcHh8dQEjBrZn7A4qOoDnfOXll8OL7j2O6EVyTtHA0tLJHVLpwI4gSPsXFwEnHltjN57odwYe9yds0BbM/YG9i+am1+3cmZ6Uyd16mLGclrr05o9BHcEZ4ZctV2hr6whbRsCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEAnNlF27gRmhGTQ+GRAvbvYToFRgsIbBAPvRqB2LmEIiQ6UJd602w6uP1sv/zEzBYg4SnMLuVyWgOJ6d71dCvXdIO9mgAq6BaEPjlo0WhGyt+zGrpkMnIX5EwRa64kHydcPRHNA607wVYA96sJdyNJEMzBvjY9fJnfevzzDCN3NWpMS2T6rk6HP5IziI1VuFWY2OUC1kbCqLj1dUgp8koe3ftLL55ZpkAocnVMnrzBveNjgAOAiKTMcyS0bhESph9aVWvuHVZSfTnUjnTPb/4jA2YlB3ED+qaU3aqHwft1KXwZskNXBKXy7lyC+CMoeB3/ncFhSg/UllBooPPS3wYlNA== e: AQAB - 'n': >- - htbi5H5MN_oYaKcZ8vlWRZn2oTrPY0v8_2Br_VZPJgJ57dCgguq5dDk1Me_ax-B3kjBPdXcW8wEoUFaU30spyVeQjZrdqsSvF0nMW4OzrMOIqrGLwCrAoDBS8tutfk5Y7qc-5xABzxgu4BjgSK5nWXbCt_UR0DzVTknotmMGeT8tAej8F6GAphLa0YhIxWT7Jy-y_pdANsiUPRiZBoLueGI0rrCqgYHIQVjNoj4-si105KCXbQuyYM9_Cd-dyyu5KJ4Ic0cOW61gpx4pnecMgSy8OX57FEd06W2hExBd49ah6jra2KFMeOGe3rkIXirdkofl1mBgeQ77ruKO1wW9Qw + 'n': htbi5H5MN_oYaKcZ8vlWRZn2oTrPY0v8_2Br_VZPJgJ57dCgguq5dDk1Me_ax-B3kjBPdXcW8wEoUFaU30spyVeQjZrdqsSvF0nMW4OzrMOIqrGLwCrAoDBS8tutfk5Y7qc-5xABzxgu4BjgSK5nWXbCt_UR0DzVTknotmMGeT8tAej8F6GAphLa0YhIxWT7Jy-y_pdANsiUPRiZBoLueGI0rrCqgYHIQVjNoj4-si105KCXbQuyYM9_Cd-dyyu5KJ4Ic0cOW61gpx4pnecMgSy8OX57FEd06W2hExBd49ah6jra2KFMeOGe3rkIXirdkofl1mBgeQ77ruKO1wW9Qw kid: mXtzOtml09Dg1ZCeKxTRBo3KrQuBWFkJ5oxhVagjTzo kty: RSA use: sig @@ -9398,9 +9999,7 @@ components: errorLink: E0000001 errorId: sampleQPivGUj_ND5v78vbYWW errorCauses: - - errorSummary: >- - Key already exists in the list of key credentials for the target - app. + - errorSummary: Key already exists in the list of key credentials for the target app. oAuthClientSecretListResponse: summary: Secrets list response example value: @@ -9412,14 +10011,12 @@ components: lastUpdated: '2023-02-21T20:08:24.000Z' _links: activate: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/secrets/ocs2f4zrZbs8nUa7p0g4/lifecycle/activate + href: https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/secrets/ocs2f4zrZbs8nUa7p0g4/lifecycle/activate hints: allow: - POST delete: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/secrets/ocs2f4zrZbs8nUa7p0g4 + href: https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/secrets/ocs2f4zrZbs8nUa7p0g4 hints: allow: - DELETE @@ -9431,8 +10028,7 @@ components: lastUpdated: '2023-04-06T21:32:33.000Z' _links: deactivate: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/secrets/ocs2f50kZB0cITmYU0g4/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/secrets/ocs2f50kZB0cITmYU0g4/lifecycle/deactivate hints: allow: - POST @@ -9455,8 +10051,7 @@ components: lastUpdated: '2023-04-06T21:32:33.000Z' _links: deactivate: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/secrets/ocs2f50kZB0cITmYU0g4/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/secrets/ocs2f50kZB0cITmYU0g4/lifecycle/deactivate hints: allow: - POST @@ -9468,9 +10063,7 @@ components: errorLink: E0000001 errorId: sampleQPivGUj_ND5v78vbYWW errorCauses: - - errorSummary: >- - client_secret: 'client_secret' can't be more than '100' characters - long. + - errorSummary: 'client_secret: ''client_secret'' can''t be more than ''100'' characters long.' ErrorClientSecretTooShort: summary: Client secret too short error value: @@ -9479,9 +10072,7 @@ components: errorLink: E0000001 errorId: sampleQPivGUj_ND5v78vbYWW errorCauses: - - errorSummary: >- - client_secret: 'client_secret' must be at least '14' characters - long. + - errorSummary: 'client_secret: ''client_secret'' must be at least ''14'' characters long.' ErrorClientSecretTooShortWithClientSecretJWT: summary: Client secret is too short for JWT error value: @@ -9490,9 +10081,7 @@ components: errorLink: E0000001 errorId: sampleQPivGUj_ND5v78vbYWW errorCauses: - - errorSummary: >- - client_secret: 'client_secret' must be at least '32' characters - long when 'token_endpoint_auth_method' is 'client_secret_jwt'. + - errorSummary: 'client_secret: ''client_secret'' must be at least ''32'' characters long when ''token_endpoint_auth_method'' is ''client_secret_jwt''.' ErrorClientSecretWithPrivateKeyJWT: summary: Client secret can't be used for private key JWT error value: @@ -9501,9 +10090,7 @@ components: errorLink: E0000001 errorId: sampleQPivGUj_ND5v78vbYWW errorCauses: - - errorSummary: >- - 'client_secret' can't be used when 'token_endpoint_auth_method' is - 'private_key_jwt'. + - errorSummary: '''client_secret'' can''t be used when ''token_endpoint_auth_method'' is ''private_key_jwt''.' ErrorClientSecretNonAscii: summary: Client secret allows only ASCII error value: @@ -9512,9 +10099,7 @@ components: errorLink: E0000001 errorId: sampleQPivGUj_ND5v78vbYWW errorCauses: - - errorSummary: >- - client_secret: ''client_secret'' must only contain printable - ASCII: [x20-x7E]+ + - errorSummary: 'client_secret: ''''client_secret'''' must only contain printable ASCII: [x20-x7E]+' ErrorMaxNumberOfSecrets: summary: Maximum client secrets reached error value: @@ -9531,9 +10116,7 @@ components: errorLink: E0000001 errorId: sampleQPivGUj_ND5v78vbYWW errorCauses: - - errorSummary: >- - You can't delete an active client secret. Deactivate the secret - before deleting it. + - errorSummary: You can't delete an active client secret. Deactivate the secret before deleting it. activateOAuth2ClientSecretResponse: summary: Activate secret response example value: @@ -9545,8 +10128,7 @@ components: lastUpdated: '2023-04-06T21:32:33.000Z' _links: deactivate: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/secrets/ocs2f50kZB0cITmYU0g4/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/secrets/ocs2f50kZB0cITmYU0g4/lifecycle/deactivate hints: allow: - POST @@ -9561,14 +10143,12 @@ components: lastUpdated: '2023-02-21T20:08:24.000Z' _links: activate: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/secrets/ocs2f4zrZbs8nUa7p0g4/lifecycle/activate + href: https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/secrets/ocs2f4zrZbs8nUa7p0g4/lifecycle/activate hints: allow: - POST delete: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/secrets/ocs2f4zrZbs8nUa7p0g4 + href: https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/secrets/ocs2f4zrZbs8nUa7p0g4 hints: allow: - DELETE @@ -9601,8 +10181,7 @@ components: change: KEEP_EXISTING _links: self: - href: >- - https://{yourOktaDomain}/api/v1/apps/${appId}/features/USER_PROVISIONING + href: https://{yourOktaDomain}/api/v1/apps/${appId}/features/USER_PROVISIONING hints: allow: - GET @@ -9637,8 +10216,7 @@ components: change: KEEP_EXISTING _links: self: - href: >- - https://{yourOktaDomain}/api/v1/apps/${appId}/features/USER_PROVISIONING + href: https://{yourOktaDomain}/api/v1/apps/${appId}/features/USER_PROVISIONING hints: allow: - GET @@ -9664,26 +10242,21 @@ components: isGenerallyAvailable: true summary: Update INBOUND_PROVISIONING request value: - capabilities: - importSettings: - username: - userNameFormat: EMAIL - schedule: - status: ENABLED - fullImport: - expression: 0 0 * * 0 - timezone: America/New_York - incrementalImport: - expression: 0 */3 * * * - timezone: America/New_York - importRules: - userCreateAndMatch: - exactMatchCriteria: EMAIL - allowPartialMatch: false - autoConfirmPartialMatch: false - autoConfirmExactMatch: false - autoConfirmNewUsers: false - autoActivateNewUsers: false + importSettings: + username: + userNameFormat: EMAIL + schedule: + status: DISABLED + fullImport: null + incrementalImport: null + importRules: + userCreateAndMatch: + exactMatchCriteria: EMAIL + allowPartialMatch: false + autoConfirmPartialMatch: false + autoConfirmExactMatch: false + autoConfirmNewUsers: false + autoActivateNewUsers: false UpdateAppFeatureResponseEx: summary: Update USER_PROVISIONING response value: @@ -9705,8 +10278,7 @@ components: change: CHANGE _links: self: - href: >- - https://{yourOktaDomain}/api/v1/apps/${appId}/features/USER_PROVISIONING + href: https://{yourOktaDomain}/api/v1/apps/${appId}/features/USER_PROVISIONING hints: allow: - GET @@ -9742,8 +10314,7 @@ components: autoActivateNewUsers: false _links: self: - href: >- - https://{yourOktaDomain}/api/v1/apps/${appId}/features/INBOUND_PROVISIONING + href: https://{yourOktaDomain}/api/v1/apps/${appId}/features/INBOUND_PROVISIONING hints: allow: - GET @@ -9809,8 +10380,7 @@ components: href: https://{yourOktaDomain}/api/v1/apps/{appId} title: Application name self: - href: >- - https://{yourOktaDomain}/api/v1/apps/{appId}/grants/oag91n9ruw3dsaXzP0h6 + href: https://{yourOktaDomain}/api/v1/apps/{appId}/grants/oag91n9ruw3dsaXzP0h6 hints: allow: - GET @@ -9837,8 +10407,7 @@ components: href: https://{yourOktaDomain}/api/v1/apps/{appId} title: Application name self: - href: >- - https://{yourOktaDomain}/api/v1/apps/{appId}/grants/oaghm3sh9ukdkvDmO0h6 + href: https://{yourOktaDomain}/api/v1/apps/{appId}/grants/oaghm3sh9ukdkvDmO0h6 hints: allow: - GET @@ -9873,8 +10442,7 @@ components: href: https://{yourOktaDomain}/api/v1/apps/{appId} title: Application name self: - href: >- - https://{yourOktaDomain}/api/v1/apps/{appId}/grants/oag91n9ruw3dsaXzP0h6 + href: https://{yourOktaDomain}/api/v1/apps/{appId}/grants/oag91n9ruw3dsaXzP0h6 hints: allow: - GET @@ -10100,8 +10668,7 @@ components: app: href: http://{yourOktaDomain}/api/v1/apps/0oa15anjcUHSI6hTB0g4 self: - href: >- - http://{yourOktaDomain}/api/v1/apps/0oa15anjcUHSI6hTB0g4/groups/00g15acRUy0SYb9GT0g4 + href: http://{yourOktaDomain}/api/v1/apps/0oa15anjcUHSI6hTB0g4/groups/00g15acRUy0SYb9GT0g4 group: href: http://{yourOktaDomain}/api/v1/groups/00g15acRUy0SYb9GT0g4 _embedded: @@ -10114,8 +10681,7 @@ components: value: - id: 00uzojLwDGgUynjJS0g3 self: - href: >- - http://{yourOktaDomain}/api/v1/users/00uzojLwDGgUynjJS0g3 + href: http://{yourOktaDomain}/api/v1/users/00uzojLwDGgUynjJS0g3 lastUpdated: null preferredLanguage: source: @@ -10123,8 +10689,7 @@ components: value: - id: 00uzojLwDGgUynjJS0g3 self: - href: >- - http://{yourOktaDomain}/api/v1/users/00uzojLwDGgUynjJS0g3 + href: http://{yourOktaDomain}/api/v1/users/00uzojLwDGgUynjJS0g3 lastUpdated: null manager: source: @@ -10138,8 +10703,7 @@ components: value: - id: 00uzojLwDGgUynjJS0g3 self: - href: >- - http://{yourOktaDomain}/api/v1/users/00uzojLwDGgUynjJS0g3 + href: http://{yourOktaDomain}/api/v1/users/00uzojLwDGgUynjJS0g3 lastUpdated: null securityAnswer: source: @@ -10147,8 +10711,7 @@ components: value: - id: 00uzojLwDGgUynjJS0g3 self: - href: >- - http://{yourOktaDomain}/api/v1/users/00uzojLwDGgUynjJS0g3 + href: http://{yourOktaDomain}/api/v1/users/00uzojLwDGgUynjJS0g3 lastUpdated: null timezone: source: @@ -10156,8 +10719,7 @@ components: value: - id: 00uzojLwDGgUynjJS0g3 self: - href: >- - http://{yourOktaDomain}/api/v1/users/00uzojLwDGgUynjJS0g3 + href: http://{yourOktaDomain}/api/v1/users/00uzojLwDGgUynjJS0g3 lastUpdated: null organization: source: @@ -10165,8 +10727,7 @@ components: value: - id: 00uzojLwDGgUynjJS0g3 self: - href: >- - http://{yourOktaDomain}/api/v1/users/00uzojLwDGgUynjJS0g3 + href: http://{yourOktaDomain}/api/v1/users/00uzojLwDGgUynjJS0g3 lastUpdated: null initialStatus: source: @@ -10174,8 +10735,7 @@ components: value: - id: 00uzojLwDGgUynjJS0g3 self: - href: >- - http://{yourOktaDomain}/api/v1/users/00uzojLwDGgUynjJS0g3 + href: http://{yourOktaDomain}/api/v1/users/00uzojLwDGgUynjJS0g3 lastUpdated: null managerId: source: @@ -10195,8 +10755,7 @@ components: value: - id: 00uzojLwDGgUynjJS0g3 self: - href: >- - http://{yourOktaDomain}/api/v1/users/00uzojLwDGgUynjJS0g3 + href: http://{yourOktaDomain}/api/v1/users/00uzojLwDGgUynjJS0g3 lastUpdated: null department: source: @@ -10227,8 +10786,7 @@ components: app: href: http://{yourOktaDomain}/api/v1/apps/0oa15anjcUHSI6hTB0g4 self: - href: >- - http://{yourOktaDomain}/api/v1/apps/0oa15anjcUHSI6hTB0g4/groups/00g15acRUy0SYb9GT0g4 + href: http://{yourOktaDomain}/api/v1/apps/0oa15anjcUHSI6hTB0g4/groups/00g15acRUy0SYb9GT0g4 group: href: http://{yourOktaDomain}/api/v1/groups/00g15acRUy0SYb9GT0g4 _embedded: @@ -10246,19 +10804,15 @@ components: _links: logo: - name: medium - href: >- - http://{yourOktaDomain}/assets/img/logos/groups/odyssey/okta-medium.30ce6d4085dff29412984e4c191bc874.png + href: http://{yourOktaDomain}/assets/img/logos/groups/odyssey/okta-medium.30ce6d4085dff29412984e4c191bc874.png type: image/png - name: large - href: >- - http://{yourOktaDomain}/assets/img/logos/groups/odyssey/okta-large.c3cb8cda8ae0add1b4fe928f5844dbe3.png + href: http://{yourOktaDomain}/assets/img/logos/groups/odyssey/okta-large.c3cb8cda8ae0add1b4fe928f5844dbe3.png type: image/png users: - href: >- - http://{yourOktaDomain}/api/v1/groups/00g15acRUy0SYb9GT0g4/users + href: http://{yourOktaDomain}/api/v1/groups/00g15acRUy0SYb9GT0g4/users apps: - href: >- - http://{yourOktaDomain}/api/v1/groups/00g15acRUy0SYb9GT0g4/apps + href: http://{yourOktaDomain}/api/v1/groups/00g15acRUy0SYb9GT0g4/apps GroupAssignmentPutRequestExample: summary: Assign application group request value: @@ -10299,8 +10853,7 @@ components: app: href: http://{yourOktaDomain}/api/v1/apps/0oa15anjcUHSI6hTB0g4 self: - href: >- - http://{yourOktaDomain}/api/v1/apps/0oa15anjcUHSI6hTB0g4/groups/00g15acRUy0SYb9GT0g4 + href: http://{yourOktaDomain}/api/v1/apps/0oa15anjcUHSI6hTB0g4/groups/00g15acRUy0SYb9GT0g4 group: href: http://{yourOktaDomain}/api/v1/groups/00g15acRUy0SYb9GT0g4 GroupAssignmentPatchRequestExample: @@ -10332,10 +10885,51 @@ components: app: href: http://{yourOktaDomain}/api/v1/apps/0oa15anjcUHSI6hTB0g4 self: - href: >- - http://{yourOktaDomain}/api/v1/apps/0oa15anjcUHSI6hTB0g4/groups/00g15acRUy0SYb9GT0g4 + href: http://{yourOktaDomain}/api/v1/apps/0oa15anjcUHSI6hTB0g4/groups/00g15acRUy0SYb9GT0g4 group: href: http://{yourOktaDomain}/api/v1/groups/00g15acRUy0SYb9GT0g4 + ListInterclientAllowedAppsResponse: + summary: List interclient allowed apps example + value: + - 0oa1elyw9EAkUNUrW0g5 + - 0oa5mihmA6vMpXcm50g5 + - 0oa89ks1irGAcYwXw0g5 + createInterclientTrustMappingRequestBody: + summary: Create an interclient target and allowed app mapping + value: + id: 0oa89ks1irGAcYwXw0g5 + InterclientTrustMappingResponse: + summary: Create an interclient target and allowed app mapping response + value: + - id: itmahqusSr3v8Kk3B0g5 + orgId: 00o102n9p4vX126Gp0g5 + appInstanceId: 0oa8ghelqWXs70qD80g5 + trustedAppInstanceId: 0oa5kw6q51dFckBE70g5 + created: '2025-11-25T22:44:06.000Z' + lastUpdated: '2025-11-25T22:44:06.000Z' + lastUpdatedBy: 00u102rhXmxEGFKiB0g5 + ErrorTargetAppType: + value: + errorCode: E0000001 + errorSummary: 'Api validation failed: Interclient Trust Mappings' + errorLink: E0000001 + errorId: oae7oXKyr41R7yW8Q-gMZsTrA + errorCauses: + - errorSummary: The target application must be an OIDC or SAML app. + ErrorTooManyAllowedApps: + value: + errorCode: E0000001 + errorSummary: 'Api validation failed: Interclient Trust Mappings' + errorLink: E0000001 + errorId: oae7oXKyr41R7yW8Q-gMZsTrA + errorCauses: + - errorSummary: The target application cannot have more than 5 trusted apps. + ListInterclientTargetAppsResponse: + summary: List interclient target apps + value: + - 0oa1elyw9EAkUNUrW0g5 + - 0oa5mihmA6vMpXcm50g5 + - 0oa89ks1irGAcYwXw0g5 OAuth2RefreshTokenResponseListEx: summary: App refresh token list example value: @@ -10354,13 +10948,10 @@ components: scopes: - id: scppb56cIl4GvGxy70g3 name: offline_access - description: >- - Requests a refresh token by default and is used to obtain more - access tokens without re-prompting the user for authentication + description: Requests a refresh token by default and is used to obtain more access tokens without re-prompting the user for authentication _links: scope: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7/scopes/scppb56cIl4GvGxy70g3 + href: https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7/scopes/scppb56cIl4GvGxy70g3 title: offline_access - id: scp142iq2J8IGRUCS0g4 name: car:drive @@ -10368,19 +10959,16 @@ components: description: Allows the user to drive a car _links: scope: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7/scopes/scp142iq2J8IGRUCS0g4 + href: https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7/scopes/scp142iq2J8IGRUCS0g4 title: Drive car _links: app: href: https://{yourOktaDomain}/api/v1/apps/0oabskvc6442nkvQO0h7 title: Native self: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oabskvc6442nkvQO0h7/tokens/oar579Mcp7OUsNTlo0g3 + href: https://{yourOktaDomain}/api/v1/apps/0oabskvc6442nkvQO0h7/tokens/oar579Mcp7OUsNTlo0g3 revoke: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oabskvc6442nkvQO0h7/tokens/oar579Mcp7OUsNTlo0g3 + href: https://{yourOktaDomain}/api/v1/apps/0oabskvc6442nkvQO0h7/tokens/oar579Mcp7OUsNTlo0g3 hints: allow: - DELETE @@ -10391,8 +10979,7 @@ components: href: https://{yourOktaDomain}/api/v1/users/00upcgi9dyWEOeCwM0g3 title: Saml Jackson authorizationServer: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7 + href: https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7 title: Example Authorization Server OAuth2RefreshTokenResponseEx: summary: OAuth 2.0 refresh token example @@ -10412,13 +10999,10 @@ components: scopes: - id: scppb56cIl4GvGxy70g3 name: offline_access - description: >- - Requests a refresh token by default and is used to obtain more - access tokens without re-prompting the user for authentication + description: Requests a refresh token by default and is used to obtain more access tokens without re-prompting the user for authentication _links: scope: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7/scopes/scppb56cIl4GvGxy70g3 + href: https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7/scopes/scppb56cIl4GvGxy70g3 title: offline_access - id: scp142iq2J8IGRUCS0g4 name: car:drive @@ -10426,19 +11010,16 @@ components: description: Allows the user to drive a car _links: scope: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7/scopes/scp142iq2J8IGRUCS0g4 + href: https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7/scopes/scp142iq2J8IGRUCS0g4 title: Drive car _links: app: href: https://{yourOktaDomain}/api/v1/apps/0oabskvc6442nkvQO0h7 title: Native self: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oabskvc6442nkvQO0h7/tokens/oar579Mcp7OUsNTlo0g3 + href: https://{yourOktaDomain}/api/v1/apps/0oabskvc6442nkvQO0h7/tokens/oar579Mcp7OUsNTlo0g3 revoke: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oabskvc6442nkvQO0h7/tokens/oar579Mcp7OUsNTlo0g3 + href: https://{yourOktaDomain}/api/v1/apps/0oabskvc6442nkvQO0h7/tokens/oar579Mcp7OUsNTlo0g3 hints: allow: - DELETE @@ -10449,8 +11030,7 @@ components: href: https://{yourOktaDomain}/api/v1/users/00upcgi9dyWEOeCwM0g3 title: Saml Jackson authorizationServer: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7 + href: https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7 title: Example Authorization Server AppUserListEx: summary: List application user example @@ -10509,36 +11089,28 @@ components: name: OKTA _links: suspend: - href: >- - https://{yourOktaDomain}/api/v1/users/00u1dnq5S0CfjlkpABCD/lifecycle/suspend + href: https://{yourOktaDomain}/api/v1/users/00u1dnq5S0CfjlkpABCD/lifecycle/suspend method: POST schema: - href: >- - https://{yourOktaDomain}/api/v1/meta/schemas/user/oscarho9g7PythoN23z9 + href: https://{yourOktaDomain}/api/v1/meta/schemas/user/oscarho9g7PythoN23z9 resetPassword: - href: >- - https://{yourOktaDomain}/api/v1/users/00u1dnq5S0CfjlkpABCD/lifecycle/reset_password + href: https://{yourOktaDomain}/api/v1/users/00u1dnq5S0CfjlkpABCD/lifecycle/reset_password method: POST expirePassword: - href: >- - https://{yourOktaDomain}/api/v1/users/00u1dnq5S0CfjlkpABCD/lifecycle/expire_password + href: https://{yourOktaDomain}/api/v1/users/00u1dnq5S0CfjlkpABCD/lifecycle/expire_password method: POST changeRecoveryQuestion: - href: >- - https://{yourOktaDomain}/api/v1/users/00u1dnq5S0CfjlkpABCD/credentials/change_recovery_question + href: https://{yourOktaDomain}/api/v1/users/00u1dnq5S0CfjlkpABCD/credentials/change_recovery_question method: POST self: href: https://{yourOktaDomain}/api/v1/users/00u1dnq5S0CfjlkpABCD type: - href: >- - https://{yourOktaDomain}/api/v1/meta/types/user/otyzhh29g7Python90g3 + href: https://{yourOktaDomain}/api/v1/meta/types/user/otyzhh29g7Python90g3 changePassword: - href: >- - https://rain.okta1.com/api/v1/users/00u1dnq5S0CfjlkpABCD/credentials/change_password + href: https://rain.okta1.com/api/v1/users/00u1dnq5S0CfjlkpABCD/credentials/change_password method: POST deactivate: - href: >- - https://{yourOktaDomain}/api/v1/users/00u1dnq5S0CfjlkpABCD/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/users/00u1dnq5S0CfjlkpABCD/lifecycle/deactivate method: POST AppUserAssignSSORequest: summary: SSO application user request example @@ -10686,36 +11258,28 @@ components: name: OKTA _links: suspend: - href: >- - https://{yourOktaDomain}/api/v1/users/00u1dnq5S0CfjlkpABCD/lifecycle/suspend + href: https://{yourOktaDomain}/api/v1/users/00u1dnq5S0CfjlkpABCD/lifecycle/suspend method: POST schema: - href: >- - https://{yourOktaDomain}/api/v1/meta/schemas/user/oscarho9g7PythoN23z9 + href: https://{yourOktaDomain}/api/v1/meta/schemas/user/oscarho9g7PythoN23z9 resetPassword: - href: >- - https://{yourOktaDomain}/api/v1/users/00u1dnq5S0CfjlkpABCD/lifecycle/reset_password + href: https://{yourOktaDomain}/api/v1/users/00u1dnq5S0CfjlkpABCD/lifecycle/reset_password method: POST expirePassword: - href: >- - https://{yourOktaDomain}/api/v1/users/00u1dnq5S0CfjlkpABCD/lifecycle/expire_password + href: https://{yourOktaDomain}/api/v1/users/00u1dnq5S0CfjlkpABCD/lifecycle/expire_password method: POST changeRecoveryQuestion: - href: >- - https://{yourOktaDomain}/api/v1/users/00u1dnq5S0CfjlkpABCD/credentials/change_recovery_question + href: https://{yourOktaDomain}/api/v1/users/00u1dnq5S0CfjlkpABCD/credentials/change_recovery_question method: POST self: href: https://{yourOktaDomain}/api/v1/users/00u1dnq5S0CfjlkpABCD type: - href: >- - https://{yourOktaDomain}/api/v1/meta/types/user/otyzhh29g7Python90g3 + href: https://{yourOktaDomain}/api/v1/meta/types/user/otyzhh29g7Python90g3 changePassword: - href: >- - https://rain.okta1.com/api/v1/users/00u1dnq5S0CfjlkpABCD/credentials/change_password + href: https://rain.okta1.com/api/v1/users/00u1dnq5S0CfjlkpABCD/credentials/change_password method: POST deactivate: - href: >- - https://{yourOktaDomain}/api/v1/users/00u1dnq5S0CfjlkpABCD/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/users/00u1dnq5S0CfjlkpABCD/lifecycle/deactivate method: POST AppUserUpdateCredRequest: summary: Application User credentials update @@ -10845,24 +11409,16 @@ components: errorCauses: [] ErrorAppUserForbiddenAction: summary: Forbidden action - description: >- - If the `PUSH_NEW_USERS` or `PUSH_PROFILE_UPDATES` feature is enabled and - the request specifies a value for a profile-mapped (Universal Directory) - attribute that doesn't match the mapped value, then a 403 error is - returned. + description: If the `PUSH_NEW_USERS` or `PUSH_PROFILE_UPDATES` feature is enabled and the request specifies a value for a profile-mapped (Universal Directory) attribute that doesn't match the mapped value, then a 403 error is returned. value: errorCode: E0000075 - errorSummary: >- - Cannot modify the firstName attribute because it has a field mapping - and profile push is enabled. + errorSummary: Cannot modify the firstName attribute because it has a field mapping and profile push is enabled. errorLink: E0000075 errorId: sampleWXiR_K-WwaTKhlgBQ errorCauses: [] ErrorAppUserUpdateBadRequest: summary: Bad request - description: >- - If you attempt to assign a username or password to an app with an - incompatible authentication scheme, then a 400 error is returned. + description: If you attempt to assign a username or password to an app with an incompatible authentication scheme, then a 400 error is returned. value: errorCode: E0000041 errorSummary: Credentials should not be set on this resource based on the scheme. @@ -10882,7 +11438,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.applications + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListApplicationsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"applications\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_application: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1apps/post' response: @@ -10895,6 +11463,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_application: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1apps~1{appId}/put' response: @@ -10904,31 +11475,34 @@ components: operation: $ref: '#/paths/~1api~1v1~1apps~1{appId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' activate_application: operation: $ref: '#/paths/~1api~1v1~1apps~1{appId}~1lifecycle~1activate/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '200' deactivate_application: operation: $ref: '#/paths/~1api~1v1~1apps~1{appId}~1lifecycle~1deactivate/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '200' upload_application_logo: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1apps~1{appId}~1logo/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '201' assign_application_policy: operation: $ref: '#/paths/~1api~1v1~1apps~1{appId}~1policies~1{policyId}/put' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' preview_samlmetadata_for_application: operation: @@ -10938,20 +11512,15 @@ components: openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/applications/methods/list_applications - - $ref: >- - #/components/x-stackQL-resources/applications/methods/get_application + - $ref: '#/components/x-stackQL-resources/applications/methods/get_application' + - $ref: '#/components/x-stackQL-resources/applications/methods/list_applications' insert: - - $ref: >- - #/components/x-stackQL-resources/applications/methods/create_application + - $ref: '#/components/x-stackQL-resources/applications/methods/create_application' update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/applications/methods/delete_application + - $ref: '#/components/x-stackQL-resources/applications/methods/delete_application' replace: - - $ref: >- - #/components/x-stackQL-resources/applications/methods/replace_application + - $ref: '#/components/x-stackQL-resources/applications/methods/replace_application' connections: id: okta.apps.connections name: connections @@ -10964,6 +11533,9 @@ components: mediaType: application/json openAPIDocKey: '200' update_default_provisioning_connection_for_application: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1apps~1{appId}~1connections~1default/post' response: @@ -10971,32 +11543,28 @@ components: openAPIDocKey: '200' activate_default_provisioning_connection_for_application: operation: - $ref: >- - #/paths/~1api~1v1~1apps~1{appId}~1connections~1default~1lifecycle~1activate/post + $ref: '#/paths/~1api~1v1~1apps~1{appId}~1connections~1default~1lifecycle~1activate/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' deactivate_default_provisioning_connection_for_application: operation: - $ref: >- - #/paths/~1api~1v1~1apps~1{appId}~1connections~1default~1lifecycle~1deactivate/post + $ref: '#/paths/~1api~1v1~1apps~1{appId}~1connections~1default~1lifecycle~1deactivate/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' verify_provisioning_connection_for_application: operation: $ref: '#/paths/~1api~1v1~1apps~1{appName}~1{appId}~1oauth2~1callback/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/connections/methods/get_default_provisioning_connection_for_application + - $ref: '#/components/x-stackQL-resources/connections/methods/get_default_provisioning_connection_for_application' insert: [] update: - - $ref: >- - #/components/x-stackQL-resources/connections/methods/update_default_provisioning_connection_for_application + - $ref: '#/components/x-stackQL-resources/connections/methods/update_default_provisioning_connection_for_application' delete: [] replace: [] connection_jwks: @@ -11012,8 +11580,7 @@ components: openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/connection_jwks/methods/get_user_provisioning_connection_jwks + - $ref: '#/components/x-stackQL-resources/connection_jwks/methods/get_user_provisioning_connection_jwks' insert: [] update: [] delete: [] @@ -11029,7 +11596,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.csrs_for_application + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListCsrsForApplicationResponse' + transform: + body: |- + {{- $wrapped := printf "{\"csrs_for_application\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 generate_csr_for_application: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1apps~1{appId}~1credentials~1csrs/post' response: @@ -11043,29 +11622,27 @@ components: openAPIDocKey: '200' revoke_csr_from_application: operation: - $ref: >- - #/paths/~1api~1v1~1apps~1{appId}~1credentials~1csrs~1{csrId}/delete + $ref: '#/paths/~1api~1v1~1apps~1{appId}~1credentials~1csrs~1{csrId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' publish_csr_from_application: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1apps~1{appId}~1credentials~1csrs~1{csrId}~1lifecycle~1publish/post + $ref: '#/paths/~1api~1v1~1apps~1{appId}~1credentials~1csrs~1{csrId}~1lifecycle~1publish/post' response: mediaType: application/json openAPIDocKey: '201' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/csrs/methods/list_csrs_for_application - - $ref: >- - #/components/x-stackQL-resources/csrs/methods/get_csr_for_application + - $ref: '#/components/x-stackQL-resources/csrs/methods/get_csr_for_application' + - $ref: '#/components/x-stackQL-resources/csrs/methods/list_csrs_for_application' insert: [] update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/csrs/methods/revoke_csr_from_application + - $ref: '#/components/x-stackQL-resources/csrs/methods/revoke_csr_from_application' replace: [] jwks: id: okta.apps.jwks @@ -11078,7 +11655,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.jwk + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListJwkResponse' + transform: + body: |- + {{- $wrapped := printf "{\"jwk\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 add_jwk: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1apps~1{appId}~1credentials~1jwks/post' response: @@ -11092,29 +11681,26 @@ components: openAPIDocKey: '200' deletejwk: operation: - $ref: >- - #/paths/~1api~1v1~1apps~1{appId}~1credentials~1jwks~1{keyId}/delete + $ref: '#/paths/~1api~1v1~1apps~1{appId}~1credentials~1jwks~1{keyId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' activate_oauth2_client_json_web_key: operation: - $ref: >- - #/paths/~1api~1v1~1apps~1{appId}~1credentials~1jwks~1{keyId}~1lifecycle~1activate/post + $ref: '#/paths/~1api~1v1~1apps~1{appId}~1credentials~1jwks~1{keyId}~1lifecycle~1activate/post' response: mediaType: application/json openAPIDocKey: '200' deactivate_oauth2_client_json_web_key: operation: - $ref: >- - #/paths/~1api~1v1~1apps~1{appId}~1credentials~1jwks~1{keyId}~1lifecycle~1deactivate/post + $ref: '#/paths/~1api~1v1~1apps~1{appId}~1credentials~1jwks~1{keyId}~1lifecycle~1deactivate/post' response: mediaType: application/json openAPIDocKey: '200' sqlVerbs: select: - - $ref: '#/components/x-stackQL-resources/jwks/methods/list_jwk' - $ref: '#/components/x-stackQL-resources/jwks/methods/get_jwk' + - $ref: '#/components/x-stackQL-resources/jwks/methods/list_jwk' insert: - $ref: '#/components/x-stackQL-resources/jwks/methods/add_jwk' update: [] @@ -11132,6 +11718,15 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.application_keys + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListApplicationKeysResponse' + transform: + body: |- + {{- $wrapped := printf "{\"application_keys\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 generate_application_key: operation: $ref: '#/paths/~1api~1v1~1apps~1{appId}~1credentials~1keys~1generate/post' @@ -11146,19 +11741,16 @@ components: openAPIDocKey: '200' clone_application_key: operation: - $ref: >- - #/paths/~1api~1v1~1apps~1{appId}~1credentials~1keys~1{keyId}~1clone/post + $ref: '#/paths/~1api~1v1~1apps~1{appId}~1credentials~1keys~1{keyId}~1clone/post' response: mediaType: application/json openAPIDocKey: '201' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/keys/methods/list_application_keys - $ref: '#/components/x-stackQL-resources/keys/methods/get_application_key' + - $ref: '#/components/x-stackQL-resources/keys/methods/list_application_keys' insert: - - $ref: >- - #/components/x-stackQL-resources/keys/methods/generate_application_key + - $ref: '#/components/x-stackQL-resources/keys/methods/generate_application_key' update: [] delete: [] replace: [] @@ -11173,7 +11765,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.oauth2_client_secrets + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListOAuth2ClientSecretsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"oauth2_client_secrets\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_oauth2_client_secret: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1apps~1{appId}~1credentials~1secrets/post' response: @@ -11181,45 +11785,37 @@ components: openAPIDocKey: '201' get_oauth2_client_secret: operation: - $ref: >- - #/paths/~1api~1v1~1apps~1{appId}~1credentials~1secrets~1{secretId}/get + $ref: '#/paths/~1api~1v1~1apps~1{appId}~1credentials~1secrets~1{secretId}/get' response: mediaType: application/json openAPIDocKey: '200' delete_oauth2_client_secret: operation: - $ref: >- - #/paths/~1api~1v1~1apps~1{appId}~1credentials~1secrets~1{secretId}/delete + $ref: '#/paths/~1api~1v1~1apps~1{appId}~1credentials~1secrets~1{secretId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' activate_oauth2_client_secret: operation: - $ref: >- - #/paths/~1api~1v1~1apps~1{appId}~1credentials~1secrets~1{secretId}~1lifecycle~1activate/post + $ref: '#/paths/~1api~1v1~1apps~1{appId}~1credentials~1secrets~1{secretId}~1lifecycle~1activate/post' response: mediaType: application/json openAPIDocKey: '200' deactivate_oauth2_client_secret: operation: - $ref: >- - #/paths/~1api~1v1~1apps~1{appId}~1credentials~1secrets~1{secretId}~1lifecycle~1deactivate/post + $ref: '#/paths/~1api~1v1~1apps~1{appId}~1credentials~1secrets~1{secretId}~1lifecycle~1deactivate/post' response: mediaType: application/json openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/secrets/methods/list_oauth2_client_secrets - - $ref: >- - #/components/x-stackQL-resources/secrets/methods/get_oauth2_client_secret + - $ref: '#/components/x-stackQL-resources/secrets/methods/get_oauth2_client_secret' + - $ref: '#/components/x-stackQL-resources/secrets/methods/list_oauth2_client_secrets' insert: - - $ref: >- - #/components/x-stackQL-resources/secrets/methods/create_oauth2_client_secret + - $ref: '#/components/x-stackQL-resources/secrets/methods/create_oauth2_client_secret' update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/secrets/methods/delete_oauth2_client_secret + - $ref: '#/components/x-stackQL-resources/secrets/methods/delete_oauth2_client_secret' replace: [] cross_app_access_connections: id: okta.apps.cross_app_access_connections @@ -11232,7 +11828,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.cross_app_access_connections + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/GetAllCrossAppAccessConnectionsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"cross_app_access_connections\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_cross_app_access_connection: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1apps~1{appId}~1cwo~1connections/post' response: @@ -11240,40 +11848,35 @@ components: openAPIDocKey: '201' get_cross_app_access_connection: operation: - $ref: >- - #/paths/~1api~1v1~1apps~1{appId}~1cwo~1connections~1{connectionId}/get + $ref: '#/paths/~1api~1v1~1apps~1{appId}~1cwo~1connections~1{connectionId}/get' response: mediaType: application/json openAPIDocKey: '200' update_cross_app_access_connection: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1apps~1{appId}~1cwo~1connections~1{connectionId}/patch + $ref: '#/paths/~1api~1v1~1apps~1{appId}~1cwo~1connections~1{connectionId}/patch' response: mediaType: application/json openAPIDocKey: '200' delete_cross_app_access_connection: operation: - $ref: >- - #/paths/~1api~1v1~1apps~1{appId}~1cwo~1connections~1{connectionId}/delete + $ref: '#/paths/~1api~1v1~1apps~1{appId}~1cwo~1connections~1{connectionId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/cross_app_access_connections/methods/get_all_cross_app_access_connections - - $ref: >- - #/components/x-stackQL-resources/cross_app_access_connections/methods/get_cross_app_access_connection + - $ref: '#/components/x-stackQL-resources/cross_app_access_connections/methods/get_cross_app_access_connection' + - $ref: '#/components/x-stackQL-resources/cross_app_access_connections/methods/get_all_cross_app_access_connections' insert: - - $ref: >- - #/components/x-stackQL-resources/cross_app_access_connections/methods/create_cross_app_access_connection + - $ref: '#/components/x-stackQL-resources/cross_app_access_connections/methods/create_cross_app_access_connection' update: - - $ref: >- - #/components/x-stackQL-resources/cross_app_access_connections/methods/update_cross_app_access_connection + - $ref: '#/components/x-stackQL-resources/cross_app_access_connections/methods/update_cross_app_access_connection' delete: - - $ref: >- - #/components/x-stackQL-resources/cross_app_access_connections/methods/delete_cross_app_access_connection + - $ref: '#/components/x-stackQL-resources/cross_app_access_connections/methods/delete_cross_app_access_connection' replace: [] features: id: okta.apps.features @@ -11286,6 +11889,15 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.features_for_application + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListFeaturesForApplicationResponse' + transform: + body: |- + {{- $wrapped := printf "{\"features_for_application\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 get_feature_for_application: operation: $ref: '#/paths/~1api~1v1~1apps~1{appId}~1features~1{featureName}/get' @@ -11293,6 +11905,9 @@ components: mediaType: application/json openAPIDocKey: '200' update_feature_for_application: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1apps~1{appId}~1features~1{featureName}/put' response: @@ -11300,16 +11915,13 @@ components: openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/features/methods/list_features_for_application - - $ref: >- - #/components/x-stackQL-resources/features/methods/get_feature_for_application + - $ref: '#/components/x-stackQL-resources/features/methods/get_feature_for_application' + - $ref: '#/components/x-stackQL-resources/features/methods/list_features_for_application' insert: [] update: [] delete: [] replace: - - $ref: >- - #/components/x-stackQL-resources/features/methods/update_feature_for_application + - $ref: '#/components/x-stackQL-resources/features/methods/update_feature_for_application' federated_claims: id: okta.apps.federated_claims name: federated_claims @@ -11321,7 +11933,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.federated_claims + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListFederatedClaimsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"federated_claims\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_federated_claim: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1apps~1{appId}~1federated-claims/post' response: @@ -11334,6 +11958,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_federated_claim: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1apps~1{appId}~1federated-claims~1{claimId}/put' response: @@ -11341,27 +11968,21 @@ components: openAPIDocKey: '201' delete_federated_claim: operation: - $ref: >- - #/paths/~1api~1v1~1apps~1{appId}~1federated-claims~1{claimId}/delete + $ref: '#/paths/~1api~1v1~1apps~1{appId}~1federated-claims~1{claimId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/federated_claims/methods/list_federated_claims - - $ref: >- - #/components/x-stackQL-resources/federated_claims/methods/get_federated_claim + - $ref: '#/components/x-stackQL-resources/federated_claims/methods/get_federated_claim' + - $ref: '#/components/x-stackQL-resources/federated_claims/methods/list_federated_claims' insert: - - $ref: >- - #/components/x-stackQL-resources/federated_claims/methods/create_federated_claim + - $ref: '#/components/x-stackQL-resources/federated_claims/methods/create_federated_claim' update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/federated_claims/methods/delete_federated_claim + - $ref: '#/components/x-stackQL-resources/federated_claims/methods/delete_federated_claim' replace: - - $ref: >- - #/components/x-stackQL-resources/federated_claims/methods/replace_federated_claim + - $ref: '#/components/x-stackQL-resources/federated_claims/methods/replace_federated_claim' grants: id: okta.apps.grants name: grants @@ -11373,7 +11994,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.scope_consent_grants + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListScopeConsentGrantsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"scope_consent_grants\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 grant_consent_to_scope: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1apps~1{appId}~1grants/post' response: @@ -11389,21 +12022,17 @@ components: operation: $ref: '#/paths/~1api~1v1~1apps~1{appId}~1grants~1{grantId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/grants/methods/list_scope_consent_grants - - $ref: >- - #/components/x-stackQL-resources/grants/methods/get_scope_consent_grant + - $ref: '#/components/x-stackQL-resources/grants/methods/get_scope_consent_grant' + - $ref: '#/components/x-stackQL-resources/grants/methods/list_scope_consent_grants' insert: - - $ref: >- - #/components/x-stackQL-resources/grants/methods/grant_consent_to_scope + - $ref: '#/components/x-stackQL-resources/grants/methods/grant_consent_to_scope' update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/grants/methods/revoke_scope_consent_grant + - $ref: '#/components/x-stackQL-resources/grants/methods/revoke_scope_consent_grant' replace: [] push_mappings: id: okta.apps.push_mappings @@ -11416,7 +12045,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.group_push_mappings + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListGroupPushMappingsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"group_push_mappings\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_group_push_mapping: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1apps~1{appId}~1group-push~1mappings/post' response: @@ -11424,40 +12065,35 @@ components: openAPIDocKey: '201' get_group_push_mapping: operation: - $ref: >- - #/paths/~1api~1v1~1apps~1{appId}~1group-push~1mappings~1{mappingId}/get + $ref: '#/paths/~1api~1v1~1apps~1{appId}~1group-push~1mappings~1{mappingId}/get' response: mediaType: application/json openAPIDocKey: '200' update_group_push_mapping: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1apps~1{appId}~1group-push~1mappings~1{mappingId}/patch + $ref: '#/paths/~1api~1v1~1apps~1{appId}~1group-push~1mappings~1{mappingId}/patch' response: mediaType: application/json openAPIDocKey: '200' delete_group_push_mapping: operation: - $ref: >- - #/paths/~1api~1v1~1apps~1{appId}~1group-push~1mappings~1{mappingId}/delete + $ref: '#/paths/~1api~1v1~1apps~1{appId}~1group-push~1mappings~1{mappingId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/push_mappings/methods/list_group_push_mappings - - $ref: >- - #/components/x-stackQL-resources/push_mappings/methods/get_group_push_mapping + - $ref: '#/components/x-stackQL-resources/push_mappings/methods/get_group_push_mapping' + - $ref: '#/components/x-stackQL-resources/push_mappings/methods/list_group_push_mappings' insert: - - $ref: >- - #/components/x-stackQL-resources/push_mappings/methods/create_group_push_mapping + - $ref: '#/components/x-stackQL-resources/push_mappings/methods/create_group_push_mapping' update: - - $ref: >- - #/components/x-stackQL-resources/push_mappings/methods/update_group_push_mapping + - $ref: '#/components/x-stackQL-resources/push_mappings/methods/update_group_push_mapping' delete: - - $ref: >- - #/components/x-stackQL-resources/push_mappings/methods/delete_group_push_mapping + - $ref: '#/components/x-stackQL-resources/push_mappings/methods/delete_group_push_mapping' replace: [] group_assignments: id: okta.apps.group_assignments @@ -11470,6 +12106,15 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.application_group_assignments + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListApplicationGroupAssignmentsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"application_group_assignments\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 get_application_group_assignment: operation: $ref: '#/paths/~1api~1v1~1apps~1{appId}~1groups~1{groupId}/get' @@ -11477,12 +12122,18 @@ components: mediaType: application/json openAPIDocKey: '200' assign_group_to_application: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1apps~1{appId}~1groups~1{groupId}/put' response: mediaType: application/json openAPIDocKey: '200' update_group_assignment_to_application: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1apps~1{appId}~1groups~1{groupId}/patch' response: @@ -11492,24 +12143,94 @@ components: operation: $ref: '#/paths/~1api~1v1~1apps~1{appId}~1groups~1{groupId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/group_assignments/methods/list_application_group_assignments - - $ref: >- - #/components/x-stackQL-resources/group_assignments/methods/get_application_group_assignment + - $ref: '#/components/x-stackQL-resources/group_assignments/methods/get_application_group_assignment' + - $ref: '#/components/x-stackQL-resources/group_assignments/methods/list_application_group_assignments' insert: [] update: - - $ref: >- - #/components/x-stackQL-resources/group_assignments/methods/update_group_assignment_to_application + - $ref: '#/components/x-stackQL-resources/group_assignments/methods/update_group_assignment_to_application' delete: - - $ref: >- - #/components/x-stackQL-resources/group_assignments/methods/unassign_application_from_group + - $ref: '#/components/x-stackQL-resources/group_assignments/methods/unassign_application_from_group' replace: - - $ref: >- - #/components/x-stackQL-resources/group_assignments/methods/assign_group_to_application + - $ref: '#/components/x-stackQL-resources/group_assignments/methods/assign_group_to_application' + interclient_allowed_apps: + id: okta.apps.interclient_allowed_apps + name: interclient_allowed_apps + title: Interclient Allowed Apps + methods: + list_interclient_allowed_applications: + operation: + $ref: '#/paths/~1api~1v1~1apps~1{appId}~1interclient-allowed-apps/get' + response: + mediaType: application/json + openAPIDocKey: '200' + objectKey: $.interclient_allowed_applications + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListInterclientAllowedApplicationsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"items\":%s}" . -}} + {{- $parsed := jsonMapFromString $wrapped -}} + {{- $items := index $parsed "items" -}} + {"interclient_allowed_applications":[{{- range $i, $v := $items -}}{{- if $i -}},{{- end -}}{"interclient_allowed_application":"{{- $v -}}"}{{- end -}}]} + type: golang_template_text_v0.3.0 + create_interclient_trust_mapping: + config: + requestBodyTranslate: + algorithm: naive + operation: + $ref: '#/paths/~1api~1v1~1apps~1{appId}~1interclient-allowed-apps/post' + response: + mediaType: application/json + openAPIDocKey: '201' + delete_interclient_trust_mapping: + operation: + $ref: '#/paths/~1api~1v1~1apps~1{appId}~1interclient-allowed-apps~1{allowedAppId}/delete' + response: + mediaType: application/json + openAPIDocKey: '204' + sqlVerbs: + select: + - $ref: '#/components/x-stackQL-resources/interclient_allowed_apps/methods/list_interclient_allowed_applications' + insert: + - $ref: '#/components/x-stackQL-resources/interclient_allowed_apps/methods/create_interclient_trust_mapping' + update: [] + delete: + - $ref: '#/components/x-stackQL-resources/interclient_allowed_apps/methods/delete_interclient_trust_mapping' + replace: [] + interclient_target_apps: + id: okta.apps.interclient_target_apps + name: interclient_target_apps + title: Interclient Target Apps + methods: + list_interclient_target_applications: + operation: + $ref: '#/paths/~1api~1v1~1apps~1{appId}~1interclient-target-apps/get' + response: + mediaType: application/json + openAPIDocKey: '200' + objectKey: $.interclient_target_applications + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListInterclientTargetApplicationsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"items\":%s}" . -}} + {{- $parsed := jsonMapFromString $wrapped -}} + {{- $items := index $parsed "items" -}} + {"interclient_target_applications":[{{- range $i, $v := $items -}}{{- if $i -}},{{- end -}}{"interclient_target_application":"{{- $v -}}"}{{- end -}}]} + type: golang_template_text_v0.3.0 + sqlVerbs: + select: + - $ref: '#/components/x-stackQL-resources/interclient_target_apps/methods/list_interclient_target_applications' + insert: [] + update: [] + delete: [] + replace: [] tokens: id: okta.apps.tokens name: tokens @@ -11521,11 +12242,20 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.oauth2_tokens_for_application + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListOAuth2TokensForApplicationResponse' + transform: + body: |- + {{- $wrapped := printf "{\"oauth2_tokens_for_application\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 revoke_oauth2_tokens_for_application: operation: $ref: '#/paths/~1api~1v1~1apps~1{appId}~1tokens/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' get_oauth2_token_for_application: operation: @@ -11537,21 +12267,17 @@ components: operation: $ref: '#/paths/~1api~1v1~1apps~1{appId}~1tokens~1{tokenId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/tokens/methods/list_oauth2_tokens_for_application - - $ref: >- - #/components/x-stackQL-resources/tokens/methods/get_oauth2_token_for_application + - $ref: '#/components/x-stackQL-resources/tokens/methods/get_oauth2_token_for_application' + - $ref: '#/components/x-stackQL-resources/tokens/methods/list_oauth2_tokens_for_application' insert: [] update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/tokens/methods/revoke_oauth2_tokens_for_application - - $ref: >- - #/components/x-stackQL-resources/tokens/methods/revoke_oauth2_token_for_application + - $ref: '#/components/x-stackQL-resources/tokens/methods/revoke_oauth2_token_for_application' + - $ref: '#/components/x-stackQL-resources/tokens/methods/revoke_oauth2_tokens_for_application' replace: [] application_users: id: okta.apps.application_users @@ -11564,7 +12290,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.application_users + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListApplicationUsersResponse' + transform: + body: |- + {{- $wrapped := printf "{\"application_users\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 assign_user_to_application: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1apps~1{appId}~1users/post' response: @@ -11577,6 +12315,9 @@ components: mediaType: application/json openAPIDocKey: '200' update_application_user: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1apps~1{appId}~1users~1{userId}/post' response: @@ -11586,30 +12327,33 @@ components: operation: $ref: '#/paths/~1api~1v1~1apps~1{appId}~1users~1{userId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/application_users/methods/list_application_users - - $ref: >- - #/components/x-stackQL-resources/application_users/methods/get_application_user + - $ref: '#/components/x-stackQL-resources/application_users/methods/get_application_user' + - $ref: '#/components/x-stackQL-resources/application_users/methods/list_application_users' insert: - - $ref: >- - #/components/x-stackQL-resources/application_users/methods/assign_user_to_application + - $ref: '#/components/x-stackQL-resources/application_users/methods/assign_user_to_application' update: - - $ref: >- - #/components/x-stackQL-resources/application_users/methods/update_application_user + - $ref: '#/components/x-stackQL-resources/application_users/methods/update_application_user' delete: - - $ref: >- - #/components/x-stackQL-resources/application_users/methods/unassign_user_from_application + - $ref: '#/components/x-stackQL-resources/application_users/methods/unassign_user_from_application' replace: [] servers: - url: https://{subdomain}.okta.com/ variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/attack_protection.yaml b/providers/src/okta/v00.00.00000/services/attack_protection.yaml index 8c2d359b..9d992d38 100644 --- a/providers/src/okta/v00.00.00000/services/attack_protection.yaml +++ b/providers/src/okta/v00.00.00000/services/attack_protection.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: attack_protection API description: okta attack_protection API - version: 5.1.0 + version: 2026.07.2 paths: /attack-protection/api/v1/authenticator-settings: get: @@ -15,9 +15,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/AttackProtectionAuthenticatorSettings' + $ref: '#/components/schemas/AttackProtectionAuthenticatorSettings' '403': $ref: '#/components/responses/ErrorAccessDenied403' '429': @@ -86,9 +84,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/UserLockoutSettings' + $ref: '#/components/schemas/UserLockoutSettings' '403': $ref: '#/components/responses/ErrorAccessDenied403' '429': @@ -259,6 +255,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_authenticator_settings: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1attack-protection~1api~1v1~1authenticator-settings/put' response: @@ -286,6 +285,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_user_lockout_settings: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1attack-protection~1api~1v1~1user-lockout-settings/put' response: @@ -306,7 +308,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/authenticators.yaml b/providers/src/okta/v00.00.00000/services/authenticators.yaml index 825e9f3e..32a6ea0d 100644 --- a/providers/src/okta/v00.00.00000/services/authenticators.yaml +++ b/providers/src/okta/v00.00.00000/services/authenticators.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: authenticators API description: okta authenticators API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/authenticators: get: @@ -15,12 +15,12 @@ paths: content: application/json: schema: - items: - $ref: '#/components/schemas/AuthenticatorBase' - type: array + $ref: '#/components/schemas/ListAuthenticatorsResponse' examples: OrgAuthenticatorsEx: $ref: '#/components/examples/AuthenticatorsResponse' + OrgAuthenticatorsExWithWebAuthnNameAndDescription: + $ref: '#/components/examples/AuthenticatorsResponseWithWebAuthnNameAndDescription' '403': $ref: '#/components/responses/ErrorAccessDenied403' '429': @@ -43,12 +43,10 @@ paths: parameters: - in: query name: activate - description: >- - Whether to execute the activation lifecycle operation when Okta - creates the authenticator + description: Whether to execute the activation lifecycle operation when Okta creates the authenticator schema: - type: boolean - default: true + type: string + default: 'true' x-codegen-request-body-name: authenticator requestBody: $ref: '#/components/requestBodies/AuthenticatorRequestBody' @@ -75,9 +73,7 @@ paths: /api/v1/authenticators/{authenticatorId}: get: summary: Retrieve an authenticator - description: >- - Retrieves an authenticator from your Okta organization by - `authenticatorId` + description: Retrieves an authenticator from your Okta organization by `authenticatorId` operationId: getAuthenticator responses: '200': @@ -99,11 +95,11 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine + parameters: + - $ref: '#/components/parameters/pathAuthenticatorId' put: summary: Replace an authenticator - description: >- - Replaces the properties for an authenticator identified by - `authenticatorId` + description: Replaces the properties for an authenticator identified by `authenticatorId` operationId: replaceAuthenticator x-codegen-request-body-name: authenticator requestBody: @@ -130,19 +126,17 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathAuthenticatorId' + parameters: + - $ref: '#/components/parameters/pathAuthenticatorId' /api/v1/authenticators/{authenticatorId}/aaguids: get: x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] summary: List all custom AAGUIDs - description: >- - Lists all custom Authenticator Attestation Global Unique Identifiers - (AAGUIDs) in the org - + description: |- + Lists all custom Authenticator Attestation Global Unique Identifiers (AAGUIDs) in the org Only custom AAGUIDs that an admin has created are returned. operationId: listAllCustomAAGUIDs @@ -152,7 +146,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/AllCustomAAGUIDResponseObject' + $ref: '#/components/schemas/ListAllCustomAAGUIDsResponse' examples: default: $ref: '#/components/examples/AllCustomAAGUIDResponse' @@ -168,13 +162,15 @@ paths: - okta.authenticators.read tags: - Authenticator + parameters: + - $ref: '#/components/parameters/pathAuthenticatorId' post: x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] summary: Create a custom AAGUID - description: Creates a custom AAGUID for the WebAuthn authenticator + description: Creates a custom AAGUID for the Passkey (FIDO2 WebAuthn) authenticator operationId: createCustomAAGUID requestBody: content: @@ -206,12 +202,12 @@ paths: - okta.authenticators.manage tags: - Authenticator - parameters: - - $ref: '#/components/parameters/pathAuthenticatorId' + parameters: + - $ref: '#/components/parameters/pathAuthenticatorId' /api/v1/authenticators/{authenticatorId}/aaguids/{aaguid}: get: x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] summary: Retrieve a custom AAGUID @@ -239,13 +235,16 @@ paths: - okta.authenticators.read tags: - Authenticator + parameters: + - $ref: '#/components/parameters/pathAuthenticatorId' + - $ref: '#/components/parameters/pathAAGUID' put: x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] summary: Replace a custom AAGUID - description: Replaces a custom AAGUID for the specified WebAuthn authenticator + description: Replaces a custom AAGUID for the specified Passkey (FIDO2 WebAuthn) authenticator operationId: replaceCustomAAGUID requestBody: content: @@ -277,15 +276,16 @@ paths: - okta.authenticators.manage tags: - Authenticator + parameters: + - $ref: '#/components/parameters/pathAuthenticatorId' + - $ref: '#/components/parameters/pathAAGUID' patch: x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] summary: Update a custom AAGUID - description: >- - Updates the properties of a custom AAGUID by the `authenticatorId` and - `aaguid` ID + description: Updates the properties of a custom AAGUID by the `authenticatorId` and `aaguid` ID operationId: updateCustomAAGUID requestBody: content: @@ -317,9 +317,12 @@ paths: - okta.authenticators.manage tags: - Authenticator + parameters: + - $ref: '#/components/parameters/pathAuthenticatorId' + - $ref: '#/components/parameters/pathAAGUID' delete: x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] summary: Delete a custom AAGUID @@ -343,9 +346,9 @@ paths: - okta.authenticators.manage tags: - Authenticator - parameters: - - $ref: '#/components/parameters/pathAuthenticatorId' - - $ref: '#/components/parameters/pathAAGUID' + parameters: + - $ref: '#/components/parameters/pathAuthenticatorId' + - $ref: '#/components/parameters/pathAAGUID' /api/v1/authenticators/{authenticatorId}/lifecycle/activate: post: summary: Activate an authenticator @@ -371,8 +374,8 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathAuthenticatorId' + parameters: + - $ref: '#/components/parameters/pathAuthenticatorId' /api/v1/authenticators/{authenticatorId}/lifecycle/deactivate: post: summary: Deactivate an authenticator @@ -398,8 +401,8 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathAuthenticatorId' + parameters: + - $ref: '#/components/parameters/pathAuthenticatorId' /api/v1/authenticators/{authenticatorId}/methods: get: summary: List all methods of an authenticator @@ -411,9 +414,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/AuthenticatorMethodBase' + $ref: '#/components/schemas/ListAuthenticatorMethodsResponse' examples: Phone: $ref: '#/components/examples/AuthenticatorMethodPhone' @@ -421,6 +422,10 @@ paths: $ref: '#/components/examples/AuthenticatorMethodTac' WebAuthn: $ref: '#/components/examples/AuthenticatorMethodWebAuthn' + WebAuthnWithRpId: + $ref: '#/components/examples/AuthenticatorMethodWebAuthnWithRpId' + WebAuthnWithRebrandSettings: + $ref: '#/components/examples/AuthenticatorMethodWebAuthnWithRebrandSettings' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -438,14 +443,12 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathAuthenticatorId' + parameters: + - $ref: '#/components/parameters/pathAuthenticatorId' /api/v1/authenticators/{authenticatorId}/methods/{methodType}: get: summary: Retrieve an authenticator method - description: >- - Retrieves a method identified by `methodType` of an authenticator - identified by `authenticatorId` + description: Retrieves a method identified by `methodType` of an authenticator identified by `authenticatorId` operationId: getAuthenticatorMethod responses: '200': @@ -457,12 +460,16 @@ paths: examples: sms: $ref: '#/components/examples/AuthenticatorMethodSms' - tac: - $ref: '#/components/examples/AuthenticatorMethodTac' voice: $ref: '#/components/examples/AuthenticatorMethodInactiveVoice' + tac: + $ref: '#/components/examples/AuthenticatorMethodTac' webauthn: $ref: '#/components/examples/AuthenticatorMethodWebAuthn' + webauthnWithRpId: + $ref: '#/components/examples/AuthenticatorMethodWebAuthnWithRpId' + WebAuthnWithRebrandSettings: + $ref: '#/components/examples/AuthenticatorMethodWebAuthnWithRebrandSettings' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -480,11 +487,12 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine + parameters: + - $ref: '#/components/parameters/pathAuthenticatorId' + - $ref: '#/components/parameters/pathMethodType' put: summary: Replace an authenticator method - description: >- - Replaces a method of `methodType` for an authenticator identified by - `authenticatorId` + description: Replaces a method of `methodType` for an authenticator identified by `authenticatorId` operationId: replaceAuthenticatorMethod requestBody: content: @@ -501,12 +509,16 @@ paths: examples: sms: $ref: '#/components/examples/AuthenticatorMethodSms' - tac: - $ref: '#/components/examples/AuthenticatorMethodTac' voice: $ref: '#/components/examples/AuthenticatorMethodInactiveVoice' + tac: + $ref: '#/components/examples/AuthenticatorMethodTac' webauthn: $ref: '#/components/examples/AuthenticatorMethodWebAuthn' + webauthnWithRpId: + $ref: '#/components/examples/AuthenticatorMethodWebAuthnWithRpId' + webauthnWithRebrandSettings: + $ref: '#/components/examples/AuthenticatorMethodWebAuthnWithRebrandSettings' '400': $ref: '#/components/responses/ErrorApiValidationFailed400' '403': @@ -526,30 +538,17 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathAuthenticatorId' - - $ref: '#/components/parameters/pathMethodType' + parameters: + - $ref: '#/components/parameters/pathAuthenticatorId' + - $ref: '#/components/parameters/pathMethodType' /api/v1/authenticators/{authenticatorId}/methods/{methodType}/lifecycle/activate: post: summary: Activate an authenticator method - description: >- - Activates a method for an authenticator identified by `authenticatorId` - and `methodType` + description: Activates a method for an authenticator identified by `authenticatorId` and `methodType` operationId: activateAuthenticatorMethod responses: '200': description: Success - content: - application/json: - schema: - $ref: '#/components/schemas/AuthenticatorMethodBase' - examples: - sms: - $ref: '#/components/examples/AuthenticatorMethodSms' - webauthn: - $ref: '#/components/examples/AuthenticatorMethodWebAuthn' - tac: - $ref: '#/components/examples/AuthenticatorMethodTac' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -567,26 +566,17 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathAuthenticatorId' - - $ref: '#/components/parameters/pathMethodType' + parameters: + - $ref: '#/components/parameters/pathAuthenticatorId' + - $ref: '#/components/parameters/pathMethodType' /api/v1/authenticators/{authenticatorId}/methods/{methodType}/lifecycle/deactivate: post: summary: Deactivate an authenticator method - description: >- - Deactivates a method for an authenticator identified by - `authenticatorId` and `methodType` + description: Deactivates a method for an authenticator identified by `authenticatorId` and `methodType` operationId: deactivateAuthenticatorMethod responses: '200': description: Success - content: - application/json: - schema: - $ref: '#/components/schemas/AuthenticatorMethodBase' - examples: - voice: - $ref: '#/components/examples/AuthenticatorMethodInactiveVoice' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -604,12 +594,43 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathAuthenticatorId' - - $ref: '#/components/parameters/pathMethodType' + parameters: + - $ref: '#/components/parameters/pathAuthenticatorId' + - $ref: '#/components/parameters/pathMethodType' + /api/v1/authenticators/{authenticatorId}/methods/{webAuthnMethodType}/verify-rp-id-domain: + post: + summary: Verify a Relying Party ID domain + description: Verifies the [Relying Party identifier (RP ID)](https://www.w3.org/TR/webauthn/#relying-party-identifier) domain for the specified Passkey (FIDO2 WebAuthn) authenticator and the specific `webauthn` authenticator method + operationId: verifyRpIdDomain + responses: + '204': + description: No Content + '400': + $ref: '#/components/responses/ErrorApiValidationFailed400' + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: + - apiToken: [] + - oauth2: + - okta.authenticators.manage + tags: + - Authenticator + x-okta-lifecycle: + lifecycle: LIMITED_GA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + parameters: + - $ref: '#/components/parameters/pathAuthenticatorId' + - $ref: '#/components/parameters/pathWebAuthnMethodType' components: schemas: AuthenticatorBase: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: created: @@ -617,6 +638,13 @@ components: format: date-time readOnly: true type: string + description: + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: [] + description: The description of the authenticator. This setting is only available for the `webauthn` authenticator type (Passkeys). + type: string id: description: A unique identifier for the authenticator readOnly: true @@ -632,8 +660,11 @@ components: description: Display name of the authenticator type: string status: + type: string + enum: + - ACTIVE + - INACTIVE description: Status of the authenticator - $ref: '#/components/schemas/LifecycleStatus' type: $ref: '#/components/schemas/AuthenticatorType' _links: @@ -643,6 +674,7 @@ components: propertyName: key mapping: custom_app: '#/components/schemas/AuthenticatorKeyCustomApp' + custom_otp: '#/components/schemas/AuthenticatorKeyCustomOtp' duo: '#/components/schemas/AuthenticatorKeyDuo' okta_email: '#/components/schemas/AuthenticatorKeyEmail' google_otp: '#/components/schemas/AuthenticatorKeyGoogleOtp' @@ -666,9 +698,7 @@ components: type: object properties: aaguid: - description: >- - An Authenticator Attestation Global Unique Identifier (AAGUID) is a - 128-bit identifier indicating the model. + description: An Authenticator Attestation Global Unique Identifier (AAGUID) is a 128-bit identifier indicating the model. type: string attestationRootCertificates: $ref: '#/components/schemas/AttestationRootCertificatesRequest' @@ -678,9 +708,7 @@ components: type: object properties: aaguid: - description: >- - A unique 128-bit identifier that's assigned to a specific model of - security key or authenticator + description: A unique 128-bit identifier that's assigned to a specific model of security key or authenticator type: string attestationRootCertificates: $ref: '#/components/schemas/AttestationRootCertificatesResponse' @@ -702,11 +730,15 @@ components: description: The product name associated with this AAGUID. type: string AuthenticatorMethodBase: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: status: description: The status of the authenticator method - $ref: '#/components/schemas/LifecycleStatus' + type: string + enum: + - ACTIVE + - INACTIVE type: $ref: '#/components/schemas/AuthenticatorMethodType' _links: @@ -766,14 +798,44 @@ components: - security_question - tac AuthenticatorLinks: - allOf: - - $ref: '#/components/schemas/LinksSelfAndLifecycle' - - type: object + x-okta-ignore-redocly-rules-for-sdk: true + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + activate: + $ref: '#/components/schemas/HrefObjectActivateLink' + deactivate: + $ref: '#/components/schemas/HrefObjectDeactivateLink' + methods: + description: Link to authenticator methods + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object properties: - methods: - description: Link to authenticator methods - allOf: - - $ref: '#/components/schemas/HrefObject' + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + readOnly: true Error: title: Error type: object @@ -787,18 +849,13 @@ components: description: An Okta code for this type of error errorId: type: string - description: >- - A unique identifier for this error. This can be used by Okta Support - to help with troubleshooting. + description: A unique identifier for this error. This can be used by Okta Support to help with troubleshooting. errorLink: type: string description: An Okta code for this type of error errorSummary: type: string - description: >- - A short description of what caused this error. Sometimes this - contains dynamically-generated information about your specific - error. + description: A short description of what caused this error. Sometimes this contains dynamically-generated information about your specific error. AttestationRootCertificatesRequest: description: Contains the certificate and information about it items: @@ -813,19 +870,13 @@ components: type: object properties: fipsCompliant: - description: >- - Indicates whether the authenticator meets Federal Information - Processing Standards (FIPS) compliance requirements + description: Indicates whether the authenticator meets Federal Information Processing Standards (FIPS) compliance requirements type: boolean hardwareProtected: - description: >- - Indicates whether the authenticator stores the private key on a - hardware component + description: Indicates whether the authenticator stores the private key on a hardware component type: boolean platformAttached: - description: >- - Indicates whether the custom AAGUID is built into the authenticator - (`true`) or if it's a separate, external authenticator + description: Indicates whether the custom AAGUID is built into the authenticator (`true`) or if it's a separate, external authenticator type: boolean AttestationRootCertificatesResponse: items: @@ -845,13 +896,7 @@ components: type: string type: array LinksSelf: - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the - [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. This object is used for dynamic discovery of related - resources and lifecycle operations. + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. type: object properties: self: @@ -876,15 +921,23 @@ components: - webauthn - tac LinksSelfAndLifecycle: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - type: object - properties: - activate: - $ref: '#/components/schemas/HrefObjectActivateLink' - deactivate: - $ref: '#/components/schemas/HrefObjectDeactivateLink' + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + activate: + $ref: '#/components/schemas/HrefObjectActivateLink' + deactivate: + $ref: '#/components/schemas/HrefObjectDeactivateLink' + readOnly: true + AuthenticatorMethodTypeWebAuthn: + description: The type of authenticator method + type: string + enum: + - webauthn HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object additionalProperties: true type: object @@ -901,15 +954,11 @@ components: readOnly: true templated: type: boolean - description: >- - Indicates whether the link object's `href` property is a URI - template. + description: Indicates whether the link object's `href` property is a URI template. readOnly: true type: type: string - description: >- - The media type of the link. If omitted, it is implicitly - `application/json`. + description: The media type of the link. If omitted, it is implicitly `application/json`. readOnly: true required: - href @@ -919,17 +968,86 @@ components: errorSummary: type: string HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) HrefObjectActivateLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to activate the resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to activate the resource HrefObjectDeactivateLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to deactivate the resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to deactivate the resource HrefHints: description: Describes allowed HTTP verbs for the `href` type: object @@ -945,6 +1063,27 @@ components: - GET - POST - PUT + ListAuthenticatorsResponse: + type: object + properties: + authenticators: + type: array + items: + $ref: '#/components/schemas/AuthenticatorBase' + ListAllCustomAAGUIDsResponse: + type: object + properties: + custom_aaguids: + type: array + items: + $ref: '#/components/schemas/CustomAAGUIDResponseObject' + ListAuthenticatorMethodsResponse: + type: object + properties: + authenticator_methods: + type: array + items: + $ref: '#/components/schemas/AuthenticatorMethodBase' responses: ErrorAccessDenied403: description: Forbidden @@ -981,6 +1120,8 @@ components: $ref: '#/components/examples/AuthenticatorResponsePhone' WebAuthn: $ref: '#/components/examples/AuthenticatorResponseWebAuthn' + Passkeys with custom name and description: + $ref: '#/components/examples/AuthenticatorResponseWebAuthnWithNameAndDescription' SecurityQuestion: $ref: '#/components/examples/AuthenticatorResponseSecurityQuestion' TAC: @@ -1036,9 +1177,16 @@ components: required: true schema: $ref: '#/components/schemas/AuthenticatorMethodType' + pathWebAuthnMethodType: + name: webAuthnMethodType + description: Type of authenticator method + in: path + required: true + schema: + $ref: '#/components/schemas/AuthenticatorMethodTypeWebAuthn' examples: AuthenticatorsResponse: - summary: Org authenticators + summary: List of org's authenticators value: - type: email id: aut1nbsPHh7jNjjyP0g4 @@ -1052,21 +1200,18 @@ components: tokenLifetimeInMinutes: 5 _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nbsPHh7jNjjyP0g4 + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nbsPHh7jNjjyP0g4 hints: allow: - GET - PUT methods: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nbsPHh7jNjjyP0g4/methods + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nbsPHh7jNjjyP0g4/methods hints: allow: - GET deactivate: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nbsPHh7jNjjyP0g4/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nbsPHh7jNjjyP0g4/lifecycle/deactivate hints: allow: - POST @@ -1079,15 +1224,13 @@ components: lastUpdated: '2020-07-26T21:05:23.000Z' _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nbtrJKKA9m45a0g4 + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nbtrJKKA9m45a0g4 hints: allow: - GET - PUT methods: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nbtrJKKA9m45a0g4/methods + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nbtrJKKA9m45a0g4/methods hints: allow: - GET @@ -1102,21 +1245,18 @@ components: allowedFor: none _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nbuyD8m1ckAYc0g4 + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nbuyD8m1ckAYc0g4 hints: allow: - GET - PUT methods: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nbuyD8m1ckAYc0g4/methods + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nbuyD8m1ckAYc0g4/methods hints: allow: - GET activate: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nbuyD8m1ckAYc0g4/lifecycle/activate + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nbuyD8m1ckAYc0g4/lifecycle/activate hints: allow: - POST @@ -1129,32 +1269,139 @@ components: lastUpdated: '2020-07-27T18:59:30.000Z' _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4 + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4 hints: allow: - GET - PUT methods: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/methods + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/methods hints: allow: - GET deactivate: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/lifecycle/deactivate hints: allow: - POST aaguids: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/aaguids + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/aaguids + hints: + allow: + - GET + - POST + AuthenticatorsResponseWithWebAuthnNameAndDescription: + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: [] + summary: Org authenticators with Passkey (FIDO2 WebAuthn) authenticator name and description + value: + - type: email + id: aut1nbsPHh7jNjjyP0g4 + key: okta_email + status: ACTIVE + name: Email + created: '2020-07-26T21:05:23.000Z' + lastUpdated: '2020-07-28T21:45:52.000Z' + settings: + allowedFor: any + tokenLifetimeInMinutes: 5 + _links: + self: + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nbsPHh7jNjjyP0g4 + hints: + allow: + - GET + - PUT + methods: + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nbsPHh7jNjjyP0g4/methods + hints: + allow: + - GET + deactivate: + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nbsPHh7jNjjyP0g4/lifecycle/deactivate + hints: + allow: + - POST + - type: password + id: aut1nbtrJKKA9m45a0g4 + key: okta_password + status: ACTIVE + name: Password + created: '2020-07-26T21:05:23.000Z' + lastUpdated: '2020-07-26T21:05:23.000Z' + _links: + self: + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nbtrJKKA9m45a0g4 + hints: + allow: + - GET + - PUT + methods: + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nbtrJKKA9m45a0g4/methods + hints: + allow: + - GET + - type: phone + id: aut1nbuyD8m1ckAYc0g4 + key: phone_number + status: INACTIVE + name: Phone + created: '2020-07-26T21:05:23.000Z' + lastUpdated: '2020-07-29T00:21:29.000Z' + settings: + allowedFor: none + _links: + self: + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nbuyD8m1ckAYc0g4 + hints: + allow: + - GET + - PUT + methods: + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nbuyD8m1ckAYc0g4/methods + hints: + allow: + - GET + activate: + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nbuyD8m1ckAYc0g4/lifecycle/activate + hints: + allow: + - POST + - type: security_key + id: aut1nd8PQhGcQtSxB0g4 + key: webauthn + status: ACTIVE + name: Custom Passkey (FIDO2 WebAuthn) authenticator name + description: Custom description for Passkey (FIDO2 WebAuthn) authenticator + created: '2020-07-26T21:16:37.000Z' + lastUpdated: '2020-07-27T18:59:30.000Z' + _links: + self: + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4 + hints: + allow: + - GET + - PUT + methods: + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/methods + hints: + allow: + - GET + deactivate: + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/lifecycle/deactivate + hints: + allow: + - POST + aaguids: + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/aaguids hints: allow: - GET - POST AllCustomAAGUIDResponse: + summary: List of custom AAGUIDs value: - aaguid: cb69481e-8ff7-4039-93ec-0a272911111 name: My Security Key @@ -1169,8 +1416,7 @@ components: exp: '2035-05-26T16:04:58.000Z' _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/aaguids/cb69481e-8ff7-4039-93ec-0a272911111 + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/aaguids/cb69481e-8ff7-4039-93ec-0a272911111 hints: allow: - GET @@ -1178,6 +1424,7 @@ components: - PATCH - DELETE CustomAAGUIDRequest: + summary: Create a custom AAGUID value: aaguid: cb69481e-8ff7-4039-93ec-0a272911111 name: My Security Key @@ -1188,6 +1435,7 @@ components: attestationRootCertificates: - x5c: X5C... CustomAAGUIDResponse: + summary: Custom AAGUID value: aaguid: cb69481e-8ff7-4039-93ec-0a272911111 name: My Security Key @@ -1202,8 +1450,7 @@ components: exp: '2035-05-26T16:04:58.000Z' _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/aaguids/cb69481e-8ff7-4039-93ec-0a272911111 + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/aaguids/cb69481e-8ff7-4039-93ec-0a272911111 hints: allow: - GET @@ -1211,6 +1458,7 @@ components: - PATCH - DELETE CustomAAGUIDUpdateRequest: + summary: Update a custom AAGUID value: name: My Security Key authenticatorCharacteristics: @@ -1220,20 +1468,19 @@ components: attestationRootCertificates: - x5c: X5C... AuthenticatorMethodPhone: + summary: List of phone authenticator methods value: - type: sms status: ACTIVE _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/methods/sms + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/methods/sms hints: allow: - GET - PUT deactivate: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/methods/sms/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/methods/sms/lifecycle/deactivate hints: allow: - POST @@ -1241,88 +1488,156 @@ components: status: INACTIVE _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/methods/voice + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/methods/voice hints: allow: - GET - PUT activate: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/methods/voice/lifecycle/activate + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/methods/voice/lifecycle/activate hints: allow: - POST AuthenticatorMethodTac: x-okta-lifecycle: - lifecycle: EA + lifecycle: LIMITED_GA isGenerallyAvailable: false SKUs: [] + summary: Temporary Access Code authenticator method value: type: tac status: ACTIVE _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut3l0cm6voCtVWK20g7/methods/tac + href: https://{yourOktaDomain}/api/v1/authenticators/aut3l0cm6voCtVWK20g7/methods/tac hints: allow: - GET - PUT deactivate: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut3l0cm6voCtVWK20g7/methods/tac/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/authenticators/aut3l0cm6voCtVWK20g7/methods/tac/lifecycle/deactivate hints: allow: - POST AuthenticatorMethodWebAuthn: + summary: Passkey (FIDO2 WebAuthn) authenticator method + value: + type: webauthn + status: ACTIVE + settings: + userVerification: DISCOURAGED + attachment: ANY + _links: + self: + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/methods/webauthn + hints: + allow: + - GET + - PUT + AuthenticatorMethodWebAuthnWithRpId: + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: [] + summary: Passkey (FIDO2 WebAuthn) authenticator method with a custom RP ID value: type: webauthn status: ACTIVE settings: userVerification: DISCOURAGED attachment: ANY + rpId: + enabled: false + domain: + name: mycustomdomain.com + validationStatus: NOT_STARTED + dnsRecord: + recordType: TXT + fqdn: _oktaverification.mycustomdomain.com, + verificationValue: 5e2dc662c8ce4f4aa4cd1cd292490d35 + _links: + self: + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/methods/webauthn + hints: + allow: + - GET + - PUT + verify-rp-id-domain: + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/methods/webauthn/verify-rp-id-domain + hints: + allow: + - POST + AuthenticatorMethodWebAuthnWithRebrandSettings: + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: [] + summary: Passkeys method with rebranded and new settings + value: + type: webauthn + status: ACTIVE + settings: + userVerification: PREFERRED + userVerificationForVerify: PREFERRED + residentKeyRequirement: REQUIRED + showSignInWithAPasskeyButton: false + certBasedAttestationValidation: false + allowSyncablePasskeys: true + hardwareProtected: false + fipsCompliant: false + attachment: ANY + rpId: + enabled: false + domain: + name: mycustomdomain.com + validationStatus: NOT_STARTED + dnsRecord: + recordType: TXT + fqdn: _oktaverification.mycustomdomain.com, + verificationValue: 5e2dc662c8ce4f4aa4cd1cd292490d35 _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/methods/webauthn + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/methods/webauthn hints: allow: - GET - PUT + verify-rp-id-domain: + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/methods/webauthn/verify-rp-id-domain + hints: + allow: + - POST AuthenticatorMethodSms: + summary: Phone authenticator - SMS method value: type: sms status: ACTIVE _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/methods/sms + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/methods/sms hints: allow: - GET - PUT deactivate: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/methods/sms/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/methods/sms/lifecycle/deactivate hints: allow": - POST AuthenticatorMethodInactiveVoice: + summary: Phone authenticator - Voice method value: type: voice status: INACTIVE _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/methods/voice + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/methods/voice hints: allow: - GET - PUT activate: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/methods/voice/lifecycle/activate + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/methods/voice/lifecycle/activate hints: allow: - POST @@ -1343,6 +1658,7 @@ components: errorId: sampleQPivGUj_ND5v78vbYWW errorCauses: [] AuthenticatorRequestDuo: + summary: Duo value: key: duo name: Duo Security @@ -1356,9 +1672,10 @@ components: host: https://api-xxxxxxxx.duosecurity.com AuthenticatorRequestTac: x-okta-lifecycle: - lifecycle: EA + lifecycle: LIMITED_GA isGenerallyAvailable: false SKUs: [] + summary: Temporary Access Code value: key: tac name: Temporary Access Code @@ -1374,7 +1691,17 @@ components: letters: true specialCharacters: true multiUseAllowed: true + AuthenticatorRequestWebAuthnWithNameAndDescription: + value: + key: webauthn + name: Custom Passkey (FIDO2 WebAuthn) authenticator name + description: Custom description for Passkey (FIDO2 WebAuthn) authenticator + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: [] AuthenticatorResponseDuo: + summary: Duo value: type: app id: aut9gnvcjUHIWb37J0g4 @@ -1392,25 +1719,23 @@ components: template: oktaId _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut5gnvcjUHIWb25J0g4 + href: https://{yourOktaDomain}/api/v1/authenticators/aut5gnvcjUHIWb25J0g4 hints: allow: - GET - PUT deactivate: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut5gnvcjUHIWb25J0g4/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/authenticators/aut5gnvcjUHIWb25J0g4/lifecycle/deactivate hints: allow: - POST methods: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut5gnvcjUHIWb25J0g4/methods + href: https://{yourOktaDomain}/api/v1/authenticators/aut5gnvcjUHIWb25J0g4/methods hints: allow: - GET AuthenticatorResponseEmail: + summary: Email value: type: email id: aut1nbsPHh7jNjjyP0g4 @@ -1424,25 +1749,23 @@ components: tokenLifetimeInMinutes: 5 _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nbsPHh7jNjjyP0g4 + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nbsPHh7jNjjyP0g4 hints: allow: - GET - PUT methods: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nbsPHh7jNjjyP0g4/methods + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nbsPHh7jNjjyP0g4/methods hints: allow: - GET deactivate: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nbsPHh7jNjjyP0g4/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nbsPHh7jNjjyP0g4/lifecycle/deactivate hints: allow: - POST AuthenticatorResponsePassword: + summary: Password value: type: password id: aut1nbtrJKKA9m45a0g4 @@ -1453,19 +1776,18 @@ components: lastUpdated: '2020-07-26T21:05:23.000Z' _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nbtrJKKA9m45a0g4 + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nbtrJKKA9m45a0g4 hints: allow: - GET - PUT methods: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nbtrJKKA9m45a0g4/methods + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nbtrJKKA9m45a0g4/methods hints: allow: - GET AuthenticatorResponsePhone: + summary: Phone value: type: phone id: aut1nbuyD8m1ckAYc0g4 @@ -1478,25 +1800,23 @@ components: allowedFor: none _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nbuyD8m1ckAYc0g4 + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nbuyD8m1ckAYc0g4 hints: allow: - GET - PUT methods: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nbuyD8m1ckAYc0g4/methods + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nbuyD8m1ckAYc0g4/methods hints: allow: - GET activate: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nbuyD8m1ckAYc0g4/lifecycle/activate + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nbuyD8m1ckAYc0g4/lifecycle/activate hints: allow: - POST AuthenticatorResponseWebAuthn: + summary: Passkey (FIDO2 WebAuthn) value: type: security_key id: aut1nd8PQhGcQtSxB0g4 @@ -1507,31 +1827,64 @@ components: lastUpdated: '2020-07-27T18:59:30.000Z' _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4 + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4 hints: allow: - GET - PUT methods: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/methods + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/methods hints: allow: - GET deactivate: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/lifecycle/deactivate hints: allow: - POST aaguids: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/aaguids + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/aaguids hints: allow: - GET - POST + AuthenticatorResponseWebAuthnWithNameAndDescription: + value: + key: webauthn + name: Custom Passkey (FIDO2 WebAuthn) authenticator name + description: Custom description for Passkey (FIDO2 WebAuthn) authenticator + type: security_key + id: aut1nd8PQhGcQtSxB0g4 + status: ACTIVE + created: '2020-07-26T21:16:37.000Z' + lastUpdated: '2020-07-27T18:59:30.000Z' + _links: + self: + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4 + hints: + allow: + - GET + - PUT + methods: + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/methods + hints: + allow: + - GET + deactivate: + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/lifecycle/deactivate + hints: + allow: + - POST + aaguids: + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/aaguids + hints: + allow: + - GET + - POST + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: [] AuthenticatorResponseSecurityQuestion: summary: Security question value: @@ -1544,28 +1897,26 @@ components: lastUpdated: '2020-07-26T21:05:23.000Z' _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nbvIgEenhwE6c0g4 + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nbvIgEenhwE6c0g4 hints: allow: - GET methods: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nbvIgEenhwE6c0g4/methods + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nbvIgEenhwE6c0g4/methods hints: allow: - GET deactivate: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nbvIgEenhwE6c0g4/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nbvIgEenhwE6c0g4/lifecycle/deactivate hints: allow: - POST AuthenticatorResponseTac: x-okta-lifecycle: - lifecycle: EA + lifecycle: LIMITED_GA isGenerallyAvailable: false SKUs: [] + summary: Temporary Access Code value: type: tac id: aut3l0cm6voCtVWK20g7 @@ -1588,21 +1939,18 @@ components: multiUseAllowed: true _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut3l0cm6voCtVWK20g7 + href: https://{yourOktaDomain}/api/v1/authenticators/aut3l0cm6voCtVWK20g7 hints: allow: - GET - PUT deactivate: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut3l0cm6voCtVWK20g7/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/authenticators/aut3l0cm6voCtVWK20g7/lifecycle/deactivate hints: allow: - POST methods: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut3l0cm6voCtVWK20g7/methods + href: https://{yourOktaDomain}/api/v1/authenticators/aut3l0cm6voCtVWK20g7/methods hints: allow: - GET @@ -1623,6 +1971,7 @@ components: errorId: sampleMlLvGUj_YD5v16vkYWY errorCauses: [] AuthenticatorResponseInactiveWebAuthn: + summary: Inactive Passkey (FIDO2 WebAuthn) authenticator value: type: security_key id: aut1nd8PQhGcQtSxB0g4 @@ -1633,21 +1982,18 @@ components: lastUpdated: '2020-07-27T18:59:30.000Z' _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4 + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4 hints: allow: - GET - PUT methods: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/methods + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/methods hints: allow: - GET deactivate: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/authenticators/aut1nd8PQhGcQtSxB0g4/lifecycle/deactivate hints: allow: - POST @@ -1662,6 +2008,8 @@ components: $ref: '#/components/examples/AuthenticatorRequestDuo' TAC: $ref: '#/components/examples/AuthenticatorRequestTac' + Passkeys with custom name and description: + $ref: '#/components/examples/AuthenticatorRequestWebAuthnWithNameAndDescription' required: true x-stackQL-resources: authenticators: @@ -1675,52 +2023,61 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.authenticators + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListAuthenticatorsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"authenticators\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_authenticator: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1authenticators/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '200' get_authenticator: operation: $ref: '#/paths/~1api~1v1~1authenticators~1{authenticatorId}/get' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '200' replace_authenticator: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1authenticators~1{authenticatorId}/put' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '200' activate_authenticator: operation: - $ref: >- - #/paths/~1api~1v1~1authenticators~1{authenticatorId}~1lifecycle~1activate/post + $ref: '#/paths/~1api~1v1~1authenticators~1{authenticatorId}~1lifecycle~1activate/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '200' deactivate_authenticator: operation: - $ref: >- - #/paths/~1api~1v1~1authenticators~1{authenticatorId}~1lifecycle~1deactivate/post + $ref: '#/paths/~1api~1v1~1authenticators~1{authenticatorId}~1lifecycle~1deactivate/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/authenticators/methods/list_authenticators - - $ref: >- - #/components/x-stackQL-resources/authenticators/methods/get_authenticator + - $ref: '#/components/x-stackQL-resources/authenticators/methods/get_authenticator' + - $ref: '#/components/x-stackQL-resources/authenticators/methods/list_authenticators' insert: - - $ref: >- - #/components/x-stackQL-resources/authenticators/methods/create_authenticator + - $ref: '#/components/x-stackQL-resources/authenticators/methods/create_authenticator' update: [] delete: [] replace: - - $ref: >- - #/components/x-stackQL-resources/authenticators/methods/replace_authenticator + - $ref: '#/components/x-stackQL-resources/authenticators/methods/replace_authenticator' custom_aaguids: id: okta.authenticators.custom_aaguids name: custom_aaguids @@ -1732,7 +2089,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.custom_aaguids + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListAllCustomAAGUIDsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"custom_aaguids\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_custom_aaguid: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1authenticators~1{authenticatorId}~1aaguids/post' response: @@ -1740,50 +2109,46 @@ components: openAPIDocKey: '200' get_custom_aaguid: operation: - $ref: >- - #/paths/~1api~1v1~1authenticators~1{authenticatorId}~1aaguids~1{aaguid}/get + $ref: '#/paths/~1api~1v1~1authenticators~1{authenticatorId}~1aaguids~1{aaguid}/get' response: mediaType: application/json openAPIDocKey: '200' replace_custom_aaguid: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1authenticators~1{authenticatorId}~1aaguids~1{aaguid}/put + $ref: '#/paths/~1api~1v1~1authenticators~1{authenticatorId}~1aaguids~1{aaguid}/put' response: mediaType: application/json openAPIDocKey: '200' update_custom_aaguid: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1authenticators~1{authenticatorId}~1aaguids~1{aaguid}/patch + $ref: '#/paths/~1api~1v1~1authenticators~1{authenticatorId}~1aaguids~1{aaguid}/patch' response: mediaType: application/json openAPIDocKey: '200' delete_custom_aaguid: operation: - $ref: >- - #/paths/~1api~1v1~1authenticators~1{authenticatorId}~1aaguids~1{aaguid}/delete + $ref: '#/paths/~1api~1v1~1authenticators~1{authenticatorId}~1aaguids~1{aaguid}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/custom_aaguids/methods/list_all_custom_aaguids - - $ref: >- - #/components/x-stackQL-resources/custom_aaguids/methods/get_custom_aaguid + - $ref: '#/components/x-stackQL-resources/custom_aaguids/methods/get_custom_aaguid' + - $ref: '#/components/x-stackQL-resources/custom_aaguids/methods/list_all_custom_aaguids' insert: - - $ref: >- - #/components/x-stackQL-resources/custom_aaguids/methods/create_custom_aaguid + - $ref: '#/components/x-stackQL-resources/custom_aaguids/methods/create_custom_aaguid' update: - - $ref: >- - #/components/x-stackQL-resources/custom_aaguids/methods/update_custom_aaguid + - $ref: '#/components/x-stackQL-resources/custom_aaguids/methods/update_custom_aaguid' delete: - - $ref: >- - #/components/x-stackQL-resources/custom_aaguids/methods/delete_custom_aaguid + - $ref: '#/components/x-stackQL-resources/custom_aaguids/methods/delete_custom_aaguid' replace: - - $ref: >- - #/components/x-stackQL-resources/custom_aaguids/methods/replace_custom_aaguid + - $ref: '#/components/x-stackQL-resources/custom_aaguids/methods/replace_custom_aaguid' authenticator_methods: id: okta.authenticators.authenticator_methods name: authenticator_methods @@ -1795,52 +2160,71 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.authenticator_methods + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListAuthenticatorMethodsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"authenticator_methods\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 get_authenticator_method: operation: - $ref: >- - #/paths/~1api~1v1~1authenticators~1{authenticatorId}~1methods~1{methodType}/get + $ref: '#/paths/~1api~1v1~1authenticators~1{authenticatorId}~1methods~1{methodType}/get' response: mediaType: application/json openAPIDocKey: '200' replace_authenticator_method: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1authenticators~1{authenticatorId}~1methods~1{methodType}/put + $ref: '#/paths/~1api~1v1~1authenticators~1{authenticatorId}~1methods~1{methodType}/put' response: mediaType: application/json openAPIDocKey: '200' activate_authenticator_method: operation: - $ref: >- - #/paths/~1api~1v1~1authenticators~1{authenticatorId}~1methods~1{methodType}~1lifecycle~1activate/post + $ref: '#/paths/~1api~1v1~1authenticators~1{authenticatorId}~1methods~1{methodType}~1lifecycle~1activate/post' response: mediaType: application/json openAPIDocKey: '200' deactivate_authenticator_method: operation: - $ref: >- - #/paths/~1api~1v1~1authenticators~1{authenticatorId}~1methods~1{methodType}~1lifecycle~1deactivate/post + $ref: '#/paths/~1api~1v1~1authenticators~1{authenticatorId}~1methods~1{methodType}~1lifecycle~1deactivate/post' response: mediaType: application/json openAPIDocKey: '200' + verify_rp_id_domain: + operation: + $ref: '#/paths/~1api~1v1~1authenticators~1{authenticatorId}~1methods~1{webAuthnMethodType}~1verify-rp-id-domain/post' + response: + mediaType: application/json + openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/authenticator_methods/methods/list_authenticator_methods - - $ref: >- - #/components/x-stackQL-resources/authenticator_methods/methods/get_authenticator_method + - $ref: '#/components/x-stackQL-resources/authenticator_methods/methods/get_authenticator_method' + - $ref: '#/components/x-stackQL-resources/authenticator_methods/methods/list_authenticator_methods' insert: [] update: [] delete: [] replace: - - $ref: >- - #/components/x-stackQL-resources/authenticator_methods/methods/replace_authenticator_method + - $ref: '#/components/x-stackQL-resources/authenticator_methods/methods/replace_authenticator_method' servers: - url: https://{subdomain}.okta.com/ variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/authorizationservers.yaml b/providers/src/okta/v00.00.00000/services/authorizationservers.yaml index c70a9844..cb511de5 100644 --- a/providers/src/okta/v00.00.00000/services/authorizationservers.yaml +++ b/providers/src/okta/v00.00.00000/services/authorizationservers.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: authorizationservers API description: okta authorizationservers API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/authorizationServers: get: @@ -12,27 +12,20 @@ paths: parameters: - name: q in: query - description: >- - Searches the `name` and `audiences` of authorization servers for - matching values + description: Searches the `name` and `audiences` of authorization servers for matching values example: customasone schema: type: string - name: limit in: query - description: >- - Specifies the number of authorization server results on a page. - Maximum value: 200 + description: 'Specifies the number of authorization server results on a page. Maximum value: 200' schema: type: integer format: int32 default: 200 - name: after in: query - description: >- - Specifies the pagination cursor for the next page of authorization - servers. Treat as an opaque value and obtain through the next link - relationship. + description: Specifies the pagination cursor for the next page of authorization servers. Treat as an opaque value and obtain through the next link relationship. schema: type: string responses: @@ -41,9 +34,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/AuthorizationServer' + $ref: '#/components/schemas/ListAuthorizationServersResponse' examples: ListAuthServers: $ref: '#/components/examples/ListAuthServersResponse' @@ -60,8 +51,7 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management + SKUs: [] post: summary: Create an authorization server description: Creates an authorization server @@ -76,8 +66,7 @@ paths: CreateAuthServer: $ref: '#/components/examples/CreateAuthServerBody' CreateAuthServerWithAccessTokenEncryption: - $ref: >- - #/components/examples/CreateAuthServerWithAccessTokenEncryptionBody + $ref: '#/components/examples/CreateAuthServerWithAccessTokenEncryptionBody' required: true responses: '201': @@ -90,8 +79,7 @@ paths: CreateAuthServer: $ref: '#/components/examples/CreateAuthServerResponse' CreateAuthServerWithAccessTokenEncryption: - $ref: >- - #/components/examples/CreateAuthServerWithAccessTokenEncryptionResponse + $ref: '#/components/examples/CreateAuthServerWithAccessTokenEncryptionResponse' '400': $ref: '#/components/responses/ErrorApiValidationFailed400' '403': @@ -107,8 +95,7 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management + SKUs: [] /api/v1/authorizationServers/{authServerId}: get: summary: Retrieve an authorization server @@ -139,8 +126,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' put: summary: Replace an authorization server description: Replaces an authorization server @@ -155,8 +143,7 @@ paths: ReplaceAuthServer: $ref: '#/components/examples/ReplaceAuthServerBody' ReplaceAuthServerEnableTokenEncryption: - $ref: >- - #/components/examples/ReplaceAuthServerEnableTokenEncryptionBody + $ref: '#/components/examples/ReplaceAuthServerEnableTokenEncryptionBody' required: true responses: '200': @@ -169,8 +156,7 @@ paths: ReplaceAuthServer: $ref: '#/components/examples/ReplaceAuthServerResponse' ReplaceAuthServerEnableTokenEncryption: - $ref: >- - #/components/examples/ReplaceAuthServerEnableTokenEncryptionResponse + $ref: '#/components/examples/ReplaceAuthServerEnableTokenEncryptionResponse' '400': $ref: '#/components/responses/ErrorApiValidationFailed400' '403': @@ -188,8 +174,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' delete: summary: Delete an authorization server description: Deletes an authorization server @@ -213,30 +200,23 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management - parameters: - - $ref: '#/components/parameters/pathAuthServerId' + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' /api/v1/authorizationServers/{authServerId}/associatedServers: get: summary: List all associated authorization servers - description: >- - Lists all associated Authorization Servers by trusted type for the given - `authServerId` + description: Lists all associated Authorization Servers by trusted type for the given `authServerId` operationId: listAssociatedServersByTrustedType parameters: - name: trusted in: query - description: >- - Searches trusted authorization servers when `true` or searches - untrusted authorization servers when `false` + description: Searches trusted authorization servers when `true` or searches untrusted authorization servers when `false` schema: - type: boolean + type: string - name: q in: query - description: >- - Searches for the name or audience of the associated authorization - servers + description: Searches for the name or audience of the associated authorization servers example: customasone schema: type: string @@ -249,20 +229,17 @@ paths: default: 200 - name: after in: query - description: >- - Specifies the pagination cursor for the next page of the associated - authorization servers + description: Specifies the pagination cursor for the next page of the associated authorization servers schema: type: string + - $ref: '#/components/parameters/pathAuthServerId' responses: '200': description: Success content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/AuthorizationServer' + $ref: '#/components/schemas/ListAssociatedServersByTrustedTypeResponse' examples: ListAssocAuthServer: $ref: '#/components/examples/ListAssocAuthServerResponse' @@ -281,13 +258,10 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management + SKUs: [] post: summary: Create an associated authorization server - description: >- - Creates trusted relationships between the given authorization server and - other authorization servers + description: Creates trusted relationships between the given authorization server and other authorization servers operationId: createAssociatedServers x-codegen-request-body-name: associatedServerMediated requestBody: @@ -305,9 +279,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/AuthorizationServer' + $ref: '#/components/schemas/CreateAssociatedServersResponse' examples: CreateAssocAuthServer: $ref: '#/components/examples/CreateAssocAuthServerResponse' @@ -328,10 +300,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management - parameters: - - $ref: '#/components/parameters/pathAuthServerId' + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' /api/v1/authorizationServers/{authServerId}/associatedServers/{associatedServerId}: delete: summary: Delete an associated authorization server @@ -356,17 +327,14 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management - parameters: - - $ref: '#/components/parameters/pathAuthServerId' - - $ref: '#/components/parameters/pathAssociatedServerId' + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' + - $ref: '#/components/parameters/pathAssociatedServerId' /api/v1/authorizationServers/{authServerId}/claims: get: summary: List all custom token claims - description: >- - Lists all custom token Claims defined for a specified custom - authorization server + description: Lists all custom token Claims defined for a specified custom authorization server operationId: listOAuth2Claims responses: '200': @@ -374,9 +342,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/OAuth2Claim' + $ref: '#/components/schemas/ListOAuth2ClaimsResponse' examples: ListCustomTokenClaims: $ref: '#/components/examples/ListCustomTokenClaimsResponse' @@ -395,8 +361,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' post: summary: Create a custom token claim description: Creates a custom token Claim for a custom authorization server @@ -438,10 +405,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management - parameters: - - $ref: '#/components/parameters/pathAuthServerId' + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' /api/v1/authorizationServers/{authServerId}/claims/{claimId}: get: summary: Retrieve a custom token claim @@ -472,8 +438,10 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' + - $ref: '#/components/parameters/pathClaimId' put: summary: Replace a custom token claim description: Replaces a custom token Claim specified by the `claimId` @@ -515,8 +483,10 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' + - $ref: '#/components/parameters/pathClaimId' delete: summary: Delete a custom token claim description: Deletes a custom token Claim specified by the `claimId` @@ -540,23 +510,17 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management - parameters: - - $ref: '#/components/parameters/pathAuthServerId' - - $ref: '#/components/parameters/pathClaimId' + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' + - $ref: '#/components/parameters/pathClaimId' /api/v1/authorizationServers/{authServerId}/clients: get: summary: List all client resources for an authorization server - description: >- - Lists all client resources for which the specified authorization server - has tokens. - + description: |- + Lists all client resources for which the specified authorization server has tokens. - > **Note:** To list a specific user's client resources for which they - have tokens or grants, use the [List all clients endpoint in the User - Resources - API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserResources/#tag/UserResources/operation/listUserClients). + > **Note:** To list a specific user's client resources for which they have tokens or grants, use the [List all clients endpoint in the User Resources API](https://developer.okta.com/docs/api/openapi/okta-management/management/userresources/listuserclients). operationId: listOAuth2ClientsForAuthorizationServer responses: '200': @@ -564,9 +528,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/OAuth2Client' + $ref: '#/components/schemas/ListOAuth2ClientsForAuthorizationServerResponse' examples: ListClients: $ref: '#/components/examples/ListClientsResponse' @@ -585,23 +547,18 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management - parameters: - - $ref: '#/components/parameters/pathAuthServerId' + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' /api/v1/authorizationServers/{authServerId}/clients/{clientId}/tokens: get: summary: List all refresh tokens for a client - description: >- - Lists all refresh tokens issued by an authorization server for a - specific Client + description: Lists all refresh tokens issued by an authorization server for a specific Client operationId: listRefreshTokensForAuthorizationServerAndClient parameters: - name: expand in: query - description: >- - Valid value: `scope`. If specified, scope details are included in - the `_embedded` attribute. + description: 'Valid value: `scope`. If specified, scope details are included in the `_embedded` attribute.' schema: type: string - name: after @@ -616,15 +573,15 @@ paths: type: integer format: int32 default: -1 + - $ref: '#/components/parameters/pathAuthServerId' + - $ref: '#/components/parameters/pathClientId' responses: '200': description: Success content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/OAuth2RefreshToken' + $ref: '#/components/schemas/ListRefreshTokensForAuthorizationServerAndClientResponse' examples: ListRefreshTokenClients: $ref: '#/components/examples/ListRefreshTokensClientsResponse' @@ -643,8 +600,7 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management + SKUs: [] delete: summary: Revoke all refresh tokens for a client description: Revokes all refresh tokens for a Client @@ -668,11 +624,10 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management - parameters: - - $ref: '#/components/parameters/pathAuthServerId' - - $ref: '#/components/parameters/pathClientId' + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' + - $ref: '#/components/parameters/pathClientId' /api/v1/authorizationServers/{authServerId}/clients/{clientId}/tokens/{tokenId}: get: summary: Retrieve a refresh token for a client @@ -681,11 +636,12 @@ paths: parameters: - name: expand in: query - description: >- - Valid value: `scope`. If specified, scope details are included in - the `_embedded` attribute. + description: 'Valid value: `scope`. If specified, scope details are included in the `_embedded` attribute.' schema: type: string + - $ref: '#/components/parameters/pathAuthServerId' + - $ref: '#/components/parameters/pathClientId' + - $ref: '#/components/parameters/pathTokenId' responses: '200': description: Success @@ -711,8 +667,7 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management + SKUs: [] delete: summary: Revoke a refresh token for a client description: Revokes a refresh token for a Client @@ -736,18 +691,15 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management - parameters: - - $ref: '#/components/parameters/pathAuthServerId' - - $ref: '#/components/parameters/pathClientId' - - $ref: '#/components/parameters/pathTokenId' + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' + - $ref: '#/components/parameters/pathClientId' + - $ref: '#/components/parameters/pathTokenId' /api/v1/authorizationServers/{authServerId}/credentials/keys: get: summary: List all credential keys - description: >- - Lists all of the current, future, and expired Keys used by the Custom - Authorization Server + description: Lists all of the current, future, and expired Keys used by the Custom Authorization Server operationId: listAuthorizationServerKeys responses: '200': @@ -755,9 +707,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/AuthorizationServerJsonWebKey' + $ref: '#/components/schemas/ListAuthorizationServerKeysResponse' examples: ListAuthorizationServerKeys: $ref: '#/components/examples/ListAuthorizationServerKeys' @@ -776,10 +726,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management - parameters: - - $ref: '#/components/parameters/pathAuthServerId' + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' /api/v1/authorizationServers/{authServerId}/credentials/keys/{keyId}: get: summary: Retrieve an authorization server key @@ -814,33 +763,21 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management - parameters: - - $ref: '#/components/parameters/pathAuthServerId' - - $ref: '#/components/parameters/pathCredentialKeyId' + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' + - $ref: '#/components/parameters/pathCredentialKeyId' /api/v1/authorizationServers/{authServerId}/credentials/lifecycle/keyRotate: post: summary: Rotate all credential keys - description: >- - Rotates the current Keys for a Custom Authorization Server. If you - rotate Keys, - - the `ACTIVE` Key becomes the `EXPIRED` Key, the `NEXT` Key becomes the - `ACTIVE` Key, - - and the Custom Authorization Server immediately begins using the new - active - + description: |- + Rotates the current Keys for a Custom Authorization Server. If you rotate Keys, + the `ACTIVE` Key becomes the `EXPIRED` Key, the `NEXT` Key becomes the `ACTIVE` Key, + and the Custom Authorization Server immediately begins using the new active Key to sign tokens. - - > **Note:** Okta rotates your Keys automatically in `AUTO` mode. You can - rotate Keys - - yourself in either mode. If Keys are rotated manually, you should - invalidate any intermediate cache. - + > **Note:** Okta rotates your Keys automatically in `AUTO` mode. You can rotate Keys + yourself in either mode. If Keys are rotated manually, you should invalidate any intermediate cache. and fetch the Keys again using the Keys endpoint. operationId: rotateAuthorizationServerKeys x-codegen-request-body-name: use @@ -853,15 +790,6 @@ paths: responses: '200': description: Success - content: - application/json: - schema: - type: array - items: - $ref: '#/components/schemas/AuthorizationServerJsonWebKey' - examples: - RotateAuthorizationServerKeys: - $ref: '#/components/examples/ListAuthorizationServerKeys' '400': description: Bad Request content: @@ -886,10 +814,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management - parameters: - - $ref: '#/components/parameters/pathAuthServerId' + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' /api/v1/authorizationServers/{authServerId}/lifecycle/activate: post: summary: Activate an authorization server @@ -914,10 +841,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management - parameters: - - $ref: '#/components/parameters/pathAuthServerId' + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' /api/v1/authorizationServers/{authServerId}/lifecycle/deactivate: post: summary: Deactivate an authorization server @@ -942,10 +868,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management - parameters: - - $ref: '#/components/parameters/pathAuthServerId' + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' /api/v1/authorizationServers/{authServerId}/policies: get: summary: List all policies @@ -957,9 +882,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/AuthorizationServerPolicy' + $ref: '#/components/schemas/ListAuthorizationServerPoliciesResponse' examples: ListAuthorizationServerPolicies: $ref: '#/components/examples/ListAuthorizationServerPolicies' @@ -978,8 +901,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' post: summary: Create a policy description: Creates a policy @@ -1021,10 +945,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management - parameters: - - $ref: '#/components/parameters/pathAuthServerId' + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' /api/v1/authorizationServers/{authServerId}/policies/{policyId}: get: summary: Retrieve a policy @@ -1055,8 +978,10 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' + - $ref: '#/components/parameters/pathPolicyId' put: summary: Replace a policy description: Replaces a policy @@ -1098,8 +1023,10 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' + - $ref: '#/components/parameters/pathPolicyId' delete: summary: Delete a policy description: Deletes a policy @@ -1123,11 +1050,10 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management - parameters: - - $ref: '#/components/parameters/pathAuthServerId' - - $ref: '#/components/parameters/pathPolicyId' + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' + - $ref: '#/components/parameters/pathPolicyId' /api/v1/authorizationServers/{authServerId}/policies/{policyId}/lifecycle/activate: post: summary: Activate a policy @@ -1152,11 +1078,10 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management - parameters: - - $ref: '#/components/parameters/pathAuthServerId' - - $ref: '#/components/parameters/pathPolicyId' + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' + - $ref: '#/components/parameters/pathPolicyId' /api/v1/authorizationServers/{authServerId}/policies/{policyId}/lifecycle/deactivate: post: summary: Deactivate a policy @@ -1181,17 +1106,14 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management - parameters: - - $ref: '#/components/parameters/pathAuthServerId' - - $ref: '#/components/parameters/pathPolicyId' + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' + - $ref: '#/components/parameters/pathPolicyId' /api/v1/authorizationServers/{authServerId}/policies/{policyId}/rules: get: summary: List all policy rules - description: >- - Lists all policy rules for the specified Custom Authorization Server and - Policy + description: Lists all policy rules for the specified Custom Authorization Server and Policy operationId: listAuthorizationServerPolicyRules responses: '200': @@ -1199,9 +1121,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/AuthorizationServerPolicyRule' + $ref: '#/components/schemas/ListAuthorizationServerPolicyRulesResponse' examples: ListAuthorizationServerPolicyRules: $ref: '#/components/examples/ListAuthorizationServerPolicyRules' @@ -1220,13 +1140,13 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' + - $ref: '#/components/parameters/pathPolicyId' post: summary: Create a policy rule - description: >- - Creates a policy rule for the specified Custom Authorization Server and - Policy + description: Creates a policy rule for the specified Custom Authorization Server and Policy operationId: createAuthorizationServerPolicyRule x-codegen-request-body-name: policyRule requestBody: @@ -1236,8 +1156,7 @@ paths: $ref: '#/components/schemas/AuthorizationServerPolicyRuleRequest' examples: CreateAuthorizationServerPolicyRule: - $ref: >- - #/components/examples/CreateAuthorizationServerPolicyRuleRequest + $ref: '#/components/examples/CreateAuthorizationServerPolicyRuleRequest' required: true responses: '201': @@ -1266,11 +1185,10 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management - parameters: - - $ref: '#/components/parameters/pathAuthServerId' - - $ref: '#/components/parameters/pathPolicyId' + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' + - $ref: '#/components/parameters/pathPolicyId' /api/v1/authorizationServers/{authServerId}/policies/{policyId}/rules/{ruleId}: get: summary: Retrieve a policy rule @@ -1301,13 +1219,14 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' + - $ref: '#/components/parameters/pathPolicyId' + - $ref: '#/components/parameters/pathRuleId' put: summary: Replace a policy rule - description: >- - Replaces the configuration of the Policy Rule defined in the specified - Custom Authorization Server and Policy + description: Replaces the configuration of the Policy Rule defined in the specified Custom Authorization Server and Policy operationId: replaceAuthorizationServerPolicyRule x-codegen-request-body-name: policyRule requestBody: @@ -1317,8 +1236,7 @@ paths: $ref: '#/components/schemas/AuthorizationServerPolicyRuleRequest' examples: UpdateAuthorizationServerPolicyRule: - $ref: >- - #/components/examples/UpdateAuthorizationServerPolicyRuleRequest + $ref: '#/components/examples/UpdateAuthorizationServerPolicyRuleRequest' required: true responses: '200': @@ -1347,13 +1265,14 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' + - $ref: '#/components/parameters/pathPolicyId' + - $ref: '#/components/parameters/pathRuleId' delete: summary: Delete a policy rule - description: >- - Deletes a Policy Rule defined in the specified Custom Authorization - Server and Policy + description: Deletes a Policy Rule defined in the specified Custom Authorization Server and Policy operationId: deleteAuthorizationServerPolicyRule responses: '204': @@ -1374,12 +1293,11 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management - parameters: - - $ref: '#/components/parameters/pathAuthServerId' - - $ref: '#/components/parameters/pathPolicyId' - - $ref: '#/components/parameters/pathRuleId' + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' + - $ref: '#/components/parameters/pathPolicyId' + - $ref: '#/components/parameters/pathRuleId' /api/v1/authorizationServers/{authServerId}/policies/{policyId}/rules/{ruleId}/lifecycle/activate: post: summary: Activate a policy rule @@ -1404,12 +1322,11 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management - parameters: - - $ref: '#/components/parameters/pathAuthServerId' - - $ref: '#/components/parameters/pathPolicyId' - - $ref: '#/components/parameters/pathRuleId' + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' + - $ref: '#/components/parameters/pathPolicyId' + - $ref: '#/components/parameters/pathRuleId' /api/v1/authorizationServers/{authServerId}/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate: post: summary: Deactivate a policy rule @@ -1434,12 +1351,11 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management - parameters: - - $ref: '#/components/parameters/pathAuthServerId' - - $ref: '#/components/parameters/pathPolicyId' - - $ref: '#/components/parameters/pathRuleId' + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' + - $ref: '#/components/parameters/pathPolicyId' + - $ref: '#/components/parameters/pathRuleId' /api/v1/authorizationServers/{authServerId}/resourceservercredentials/keys: get: summary: List all Custom Authorization Server Public JSON Web Keys @@ -1451,9 +1367,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/OAuth2ResourceServerJsonWebKey' + $ref: '#/components/schemas/ListOAuth2ResourceServerJsonWebKeysResponse' examples: ListOAuth2ResourceServerJsonWebKeys: $ref: '#/components/examples/ListOAuth2ResourceServerJsonWebKeys' @@ -1472,25 +1386,16 @@ paths: tags: - OAuth2ResourceServerCredentialsKeys x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathAuthServerId' post: summary: Add a JSON Web Key - description: >- - Adds a new JSON Web Key to the custom authorization server`s JSON web - keys. - - > **Note:** This API doesn't allow you to add a key if the existing key - doesn't have a `kid`. Use the [Replace an Authorization - Server](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/AuthorizationServer/#tag/AuthorizationServer/operation/replaceAuthorizationServer) - operation to update the JWKS or [Delete a Custom Authorization Server - Public JSON Web - Key](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/OAuth2ResourceServerCredentialsKeys/#tag/OAuth2ResourceServerCredentialsKeys/operation/deleteOAuth2ResourceServerJsonWebKey) - and re-add the key with a `kid`. - - > **Note:** This API doesn't allow you to add a key with an ACTIVE - status. You need to add an INACTIVE key first, and then ACTIVATE the - key. + description: |- + Adds a new JSON Web Key to the custom authorization server`s JSON web keys. + > **Note:** This API doesn't allow you to add a key if the existing key doesn't have a `kid`. Use the [Replace an Authorization Server](https://developer.okta.com/docs/api/openapi/okta-management/management/authorizationserver/replaceauthorizationserver) operation to update the JWKS or [Delete a Custom Authorization Server Public JSON Web Key](https://developer.okta.com/docs/api/openapi/okta-management/management/oauth2resourceservercredentialskeys/deleteoauth2resourceserverjsonwebkey) and re-add the key with a `kid`. + > **Note:** This API doesn't allow you to add a key with an ACTIVE status. You need to add an INACTIVE key first, and then ACTIVATE the key. operationId: addOAuth2ResourceServerJsonWebKey requestBody: required: true @@ -1539,10 +1444,10 @@ paths: tags: - OAuth2ResourceServerCredentialsKeys x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAuthServerId' + parameters: + - $ref: '#/components/parameters/pathAuthServerId' /api/v1/authorizationServers/{authServerId}/resourceservercredentials/keys/{keyId}: get: summary: Retrieve a Custom Authorization Server Public JSON Web Key @@ -1574,13 +1479,14 @@ paths: tags: - OAuth2ResourceServerCredentialsKeys x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathAuthServerId' + - $ref: '#/components/parameters/CustomAsPathJsonWebKeyId' delete: summary: Delete a Custom Authorization Server Public JSON Web Key - description: >- - Deletes a custom authorization server public JSON web key by key `id`. - You can only delete an inactive key. + description: Deletes a custom authorization server public JSON web key by key `id`. You can only delete an inactive key. operationId: deleteOAuth2ResourceServerJsonWebKey responses: '204': @@ -1592,8 +1498,8 @@ paths: schema: $ref: '#/components/schemas/Error' examples: - ErrorDeleteActiveJsonWebKey: - $ref: '#/components/examples/ErrorDeleteActiveJsonWebKey' + ErrorDeleteCustomAsActiveJsonWebKey: + $ref: '#/components/examples/ErrorDeleteCustomAsActiveJsonWebKey' '401': $ref: '#/components/responses/ErrorInvalidToken401' '403': @@ -1609,20 +1515,17 @@ paths: tags: - OAuth2ResourceServerCredentialsKeys x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAuthServerId' - - $ref: '#/components/parameters/pathJsonWebKeyId' + parameters: + - $ref: '#/components/parameters/pathAuthServerId' + - $ref: '#/components/parameters/CustomAsPathJsonWebKeyId' /api/v1/authorizationServers/{authServerId}/resourceservercredentials/keys/{keyId}/lifecycle/activate: post: summary: Activate a Custom Authorization Server Public JSON Web Key - description: >- + description: |- Activates a custom authorization server public JSON web key by key `id`. - - > **Note:** You can have only one active key at any given time for the - authorization server. When you activate an inactive key, Okta - automatically deactivates the current active key. + > **Note:** You can have only one active key at any given time for the authorization server. When you activate an inactive key, Okta automatically deactivates the current active key. operationId: activateOAuth2ResourceServerJsonWebKey responses: '200': @@ -1649,21 +1552,17 @@ paths: tags: - OAuth2ResourceServerCredentialsKeys x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAuthServerId' - - $ref: '#/components/parameters/pathJsonWebKeyId' + parameters: + - $ref: '#/components/parameters/pathAuthServerId' + - $ref: '#/components/parameters/CustomAsPathJsonWebKeyId' /api/v1/authorizationServers/{authServerId}/resourceservercredentials/keys/{keyId}/lifecycle/deactivate: post: summary: Deactivate a Custom Authorization Server Public JSON Web Key - description: >- - Deactivates a custom authorization server public JSON web key by key - `id`. - - > **Note:** Deactivating the active key isn't allowed if the - authorization server has access token encryption enabled. You can - activate another key, which makes the current key inactive. + description: |- + Deactivates a custom authorization server public JSON web key by key `id`. + > **Note:** Deactivating the active key isn't allowed if the authorization server has access token encryption enabled. You can activate another key, which makes the current key inactive. operationId: deactivateOAuth2ResourceServerJsonWebKey responses: '200': @@ -1699,11 +1598,11 @@ paths: tags: - OAuth2ResourceServerCredentialsKeys x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAuthServerId' - - $ref: '#/components/parameters/pathJsonWebKeyId' + parameters: + - $ref: '#/components/parameters/pathAuthServerId' + - $ref: '#/components/parameters/CustomAsPathJsonWebKeyId' /api/v1/authorizationServers/{authServerId}/scopes: get: summary: List all custom token scopes @@ -1722,35 +1621,27 @@ paths: type: string - name: after in: query - description: >- + description: |- Specifies the pagination cursor for the next page of scopes. - - Treat the after cursor as an opaque value and obtain it through the - next link relationship. See - [Pagination](https://developer.okta.com/docs/api/#pagination). + Treat the after cursor as an opaque value and obtain it through the next link relationship. See [Pagination](https://developer.okta.com/docs/api/#pagination). schema: type: string - name: limit in: query - description: >- + description: |- Specifies the number of objects to return per page. - - If there are multiple pages of results, the Link header contains a - `next` link that you need to use as an opaque value (follow it, - don't parse it). See - [Pagination](https://developer.okta.com/docs/api/#pagination). + If there are multiple pages of results, the Link header contains a `next` link that you need to use as an opaque value (follow it, don't parse it). See [Pagination](https://developer.okta.com/docs/api/#pagination). schema: type: integer maximum: 200 + - $ref: '#/components/parameters/pathAuthServerId' responses: '200': description: Success content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/OAuth2Scope' + $ref: '#/components/schemas/ListOAuth2ScopesResponse' examples: ExampleScopes: $ref: '#/components/examples/ExampleOAuth2Scopes' @@ -1769,8 +1660,7 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management + SKUs: [] post: summary: Create a custom token scope description: Creates a custom token scope @@ -1812,10 +1702,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management - parameters: - - $ref: '#/components/parameters/pathAuthServerId' + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' /api/v1/authorizationServers/{authServerId}/scopes/{scopeId}: get: summary: Retrieve a custom token scope @@ -1846,8 +1735,10 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' + - $ref: '#/components/parameters/pathScopeId' put: summary: Replace a custom token scope description: Replaces a custom token scope @@ -1889,8 +1780,10 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' + - $ref: '#/components/parameters/pathScopeId' delete: summary: Delete a custom token scope description: Deletes a custom token scope @@ -1914,24 +1807,20 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false - SKUs: - - API Access Management - parameters: - - $ref: '#/components/parameters/pathAuthServerId' - - $ref: '#/components/parameters/pathScopeId' + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathAuthServerId' + - $ref: '#/components/parameters/pathScopeId' components: schemas: AuthorizationServer: type: object properties: accessTokenEncryptedResponseAlgorithm: - $ref: '#/components/schemas/KeyEncryptionAlgorithm' + $ref: '#/components/schemas/AccessTokenKeyEncryptionAlgorithm' audiences: type: array - description: >- - The recipients that the tokens are intended for. This becomes the - `aud` claim in an access token. Okta currently supports only one - audience. + description: The recipients that the tokens are intended for. This becomes the `aud` claim in an access token. Okta currently supports only one audience. items: type: string created: @@ -1949,57 +1838,28 @@ components: readOnly: true issuer: type: string - description: >- - The complete URL for the custom authorization server. This becomes - the `iss` claim in an access token. + description: The complete URL for the custom authorization server. This becomes the `iss` claim in an access token. issuerMode: type: string - description: >- - Indicates which value is specified in the issuer of the tokens that - a custom authorization server returns: the Okta org domain URL or a - custom domain URL. - + description: |- + Indicates which value is specified in the issuer of the tokens that a custom authorization server returns: the Okta org domain URL or a custom domain URL. - `issuerMode` is visible if you have a custom URL domain configured - or the Dynamic Issuer Mode feature enabled. If you have a custom URL - domain configured, you can set a custom domain URL in a custom - authorization server, and this property is returned in the - appropriate responses. + `issuerMode` is visible if you have a custom URL domain configured or the Dynamic Issuer Mode feature enabled. If you have a custom URL domain configured, you can set a custom domain URL in a custom authorization server, and this property is returned in the appropriate responses. + When set to `ORG_URL`, then in responses, `issuer` is the Okta org domain URL: `https://${yourOktaDomain}`. - When set to `ORG_URL`, then in responses, `issuer` is the Okta org - domain URL: `https://${yourOktaDomain}`. + When set to `CUSTOM_URL`, then in responses, `issuer` is the custom domain URL configured in the administration user interface. + When set to `DYNAMIC`, then in responses, `issuer` is the custom domain URL if the OAuth 2.0 request was sent to the custom domain, or is the Okta org's domain URL if the OAuth 2.0 request was sent to the original Okta org domain. - When set to `CUSTOM_URL`, then in responses, `issuer` is the custom - domain URL configured in the administration user interface. - - - When set to `DYNAMIC`, then in responses, `issuer` is the custom - domain URL if the OAuth 2.0 request was sent to the custom domain, - or is the Okta org's domain URL if the OAuth 2.0 request was sent to - the original Okta org domain. - - - After you configure a custom URL domain, all new custom - authorization servers use `CUSTOM_URL` by default. If the Dynamic - Issuer Mode feature is enabled, then all new custom authorization - servers use `DYNAMIC` by default. All existing custom authorization - servers continue to use the original value until they're changed - using the Admin Console or the API. This way, existing integrations - with the client and resource server continue to work after the - feature is enabled. + After you configure a custom URL domain, all new custom authorization servers use `CUSTOM_URL` by default. If the Dynamic Issuer Mode feature is enabled, then all new custom authorization servers use `DYNAMIC` by default. All existing custom authorization servers continue to use the original value until they're changed using the Admin Console or the API. This way, existing integrations with the client and resource server continue to work after the feature is enabled. jwks: $ref: '#/components/schemas/ResourceServerJsonWebKeys' jwks_uri: - description: >- - URL string that - references a JSON Web Key Set for encrypting JWTs minted by the - custom authorization server + description: URL string that references a JSON Web Key Set for encrypting JWTs minted by the custom authorization server type: string x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: true lastUpdated: type: string @@ -2025,13 +1885,7 @@ components: properties: alwaysIncludeInToken: type: boolean - description: >- - Specifies whether to include Claims in the token. The value is - always `TRUE` for access token Claims. If the value is set to - `FALSE` for an ID token claim, the Claim isn't included in the ID - token when the token is requested with the access token or with the - `authorization_code`. The client instead uses the access token to - get Claims from the `/userinfo` endpoint. + description: Specifies whether to include Claims in the token. The value is always `TRUE` for access token Claims. If the value is set to `FALSE` for an ID token claim, the Claim isn't included in the ID token when the token is requested with the access token or with the `authorization_code`. The client instead uses the access token to get Claims from the `/userinfo` endpoint. claimType: $ref: '#/components/schemas/OAuth2ClaimType' conditions: @@ -2051,17 +1905,14 @@ components: description: When `true`, indicates that Okta created the Claim type: boolean value: - description: >- - Specifies the value of the Claim. This value must be a string - literal if `valueType` is `GROUPS`, and the string literal is - matched with the selected `group_filter_type`. The value must be an - Okta EL expression if `valueType` is `EXPRESSION`. + description: Specifies the value of the Claim. This value must be a string literal if `valueType` is `GROUPS`, and the string literal is matched with the selected `group_filter_type`. The value must be an Okta EL expression if `valueType` is `EXPRESSION`. type: string valueType: $ref: '#/components/schemas/OAuth2ClaimValueType' _links: $ref: '#/components/schemas/LinksSelf' OAuth2Client: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: client_id: @@ -2079,26 +1930,35 @@ components: readOnly: true example: https://www.example.com logo_uri: - description: >- - URL string that references a logo for the client consent dialog (not - the sign-in dialog) + description: URL string that references a logo for the client consent dialog (not the sign-in dialog) type: string readOnly: true example: https://www.example.com/logo.png _links: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - type: object + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + grants: + description: Link to the grant resources + type: object properties: - grants: - description: Link to the grant resources - allOf: - - $ref: '#/components/schemas/GrantResourcesHrefObject' - tokens: - description: Link to the token resources - allOf: - - $ref: '#/components/schemas/TokenResourcesHrefObject' + href: + type: string + description: Link URI + example: https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7/clients/0oabskvc6442nkvQO0h7/grants + tokens: + description: Link to the token resources + type: object + properties: + href: + type: string + description: Link URI + example: https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7/clients/0oabskvc6442nkvQO0h7/tokens + readOnly: true OAuth2RefreshToken: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: clientId: @@ -2136,9 +1996,7 @@ components: example: 00u5t60iloOHN9pBi0h7 _embedded: type: object - description: >- - The embedded resources related to the object if the `expand` query - parameter is specified + description: The embedded resources related to the object if the `expand` query parameter is specified properties: scopes: type: array @@ -2147,41 +2005,76 @@ components: $ref: '#/components/schemas/OAuth2RefreshTokenScope' readOnly: true _links: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - type: object + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + app: + description: Link to the app resource + type: object + properties: + href: + type: string + description: Link URI + example: https://{yourOktaDomain}/api/v1/apps/0oabskvc6442nkvQO0h7 + title: + type: string + description: Link name + example: My App + revoke: + description: Link to revoke the refresh Token + type: object + properties: + href: + type: string + description: Link URI + example: https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7/clients/0oabskvc6442nkvQO0h7/tokens/oar579Mcp7OUsNTlo0g3 + hints: + properties: + allow: + items: + enum: + - DELETE + default: DELETE + type: object + client: + description: Link to the client resource + type: object + properties: + href: + type: string + description: Link URI + example: https://{yourOktaDomain}/api/v1/apps/0oabskvc6442nkvQO0h7 + title: + type: string + description: Link name + example: My App + user: + description: Link to the user resource + type: object properties: - app: - description: Link to the app resource - allOf: - - $ref: '#/components/schemas/AppResourceHrefObject' - revoke: - description: Link to revoke the refresh Token - allOf: - - $ref: '#/components/schemas/RevokeRefreshTokenHrefObject' - - properties: - hints: - properties: - allow: - items: - enum: - - DELETE - default: DELETE - type: object - type: object - client: - description: Link to the client resource - allOf: - - $ref: '#/components/schemas/AppResourceHrefObject' - user: - description: Link to the user resource - allOf: - - $ref: '#/components/schemas/UserResourceHrefObject' - authorizationServer: - description: Link to the Token authorization server resource - allOf: - - $ref: >- - #/components/schemas/AuthorizationServerResourceHrefObject + href: + type: string + description: Link URI + example: https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7 + title: + type: string + description: Link name + example: SAML Jackson + authorizationServer: + description: Link to the Token authorization server resource + type: object + properties: + href: + type: string + description: Link URI + example: https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7 + title: + type: string + description: Link name + example: Example Authorization Server + readOnly: true AuthorizationServerJsonWebKey: type: object properties: @@ -2197,28 +2090,17 @@ components: type: string readOnly: true kty: - description: >- - Cryptographic algorithm family for the certificate's keypair. Valid - value: `RSA` + description: 'Cryptographic algorithm family for the certificate''s keypair. Valid value: `RSA`' type: string readOnly: true 'n': - description: >- - RSA modulus value that is used by both the public and private keys - and provides a link between them + description: RSA modulus value that is used by both the public and private keys and provides a link between them type: string status: - description: >- - An `ACTIVE` Key is used to sign tokens issued by the authorization - server. Supported values: `ACTIVE`, `NEXT`, or `EXPIRED`
- - A `NEXT` Key is the next Key that the authorization server uses to - sign tokens when Keys are rotated. The `NEXT` Key might not be - listed if it hasn't been generated. - - An `EXPIRED` Key is the previous Key that the authorization server - used to sign tokens. The `EXPIRED` Key might not be listed if no Key - has expired or the expired Key was deleted. + description: |- + An `ACTIVE` Key is used to sign tokens issued by the authorization server. Supported values: `ACTIVE`, `NEXT`, or `EXPIRED`
+ A `NEXT` Key is the next Key that the authorization server uses to sign tokens when Keys are rotated. The `NEXT` Key might not be listed if it hasn't been generated. + An `EXPIRED` Key is the previous Key that the authorization server used to sign tokens. The `EXPIRED` Key might not be listed if no Key has expired or the expired Key was deleted. type: string use: description: 'Acceptable use of the key. Valid value: `sig`' @@ -2244,76 +2126,99 @@ components: description: An Okta code for this type of error errorId: type: string - description: >- - A unique identifier for this error. This can be used by Okta Support - to help with troubleshooting. + description: A unique identifier for this error. This can be used by Okta Support to help with troubleshooting. errorLink: type: string description: An Okta code for this type of error errorSummary: type: string - description: >- - A short description of what caused this error. Sometimes this - contains dynamically-generated information about your specific - error. + description: A short description of what caused this error. Sometimes this contains dynamically-generated information about your specific error. AuthorizationServerPolicy: - allOf: - - type: object + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + id: + type: string + description: ID of the Policy + type: + type: string + description: Indicates that the Policy is an authorization server Policy + enum: + - OAUTH_AUTHORIZATION_POLICY + name: + type: string + description: Name of the Policy + maxLength: 100 + minLength: 1 + conditions: + $ref: '#/components/schemas/AuthorizationServerPolicyConditions' + description: + type: string + description: Description of the Policy + maxLength: 255 + minLength: 1 + priority: + type: integer + description: Specifies the order in which this Policy is evaluated in relation to the other Policies in a custom authorization server + status: + type: string + description: Specifies whether requests have access to this Policy + enum: + - ACTIVE + - INACTIVE + system: + type: boolean + description: Specifies whether Okta created this Policy + created: + type: string + format: date-time + readOnly: true + description: Timestamp when the Policy was created + lastUpdated: + type: string + format: date-time + readOnly: true + description: Timestamp when the Policy was last updated + _links: + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object properties: - id: - type: string - description: ID of the Policy - type: - type: string - description: Indicates that the Policy is an authorization server Policy - enum: - - OAUTH_AUTHORIZATION_POLICY - name: - type: string - description: Name of the Policy - maxLength: 100 - minLength: 1 - conditions: - $ref: '#/components/schemas/AuthorizationServerPolicyConditions' - description: - type: string - description: Description of the Policy - maxLength: 255 - minLength: 1 - priority: - type: integer - description: >- - Specifies the order in which this Policy is evaluated in - relation to the other Policies in a custom authorization server - status: - type: string - description: Specifies whether requests have access to this Policy - enum: - - ACTIVE - - INACTIVE - system: - type: boolean - description: Specifies whether Okta created this Policy - created: - type: string - format: date-time - readOnly: true - description: Timestamp when the Policy was created - lastUpdated: - type: string - format: date-time - readOnly: true - description: Timestamp when the Policy was last updated - _links: - allOf: - - $ref: '#/components/schemas/LinksSelfAndLifecycle' - - type: object - properties: - rules: - allOf: - - description: Link to the authorization server policy's rules - - $ref: '#/components/schemas/HrefObject' + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + activate: + $ref: '#/components/schemas/HrefObjectActivateLink' + deactivate: + $ref: '#/components/schemas/HrefObjectDeactivateLink' + rules: + description: Link to the authorization server policy's rules + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + readOnly: true AuthorizationServerPolicyRule: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: actions: @@ -2355,16 +2260,74 @@ components: enum: - RESOURCE_ACCESS _links: - allOf: - - $ref: '#/components/schemas/LinksSelfAndLifecycle' + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + activate: + $ref: '#/components/schemas/HrefObjectActivateLink' + deactivate: + $ref: '#/components/schemas/HrefObjectDeactivateLink' + readOnly: true AuthorizationServerPolicyRuleRequest: - allOf: - - $ref: '#/components/schemas/AuthorizationServerPolicyRule' - - type: object - required: - - name - - conditions - - type + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + actions: + $ref: '#/components/schemas/AuthorizationServerPolicyRuleActions' + conditions: + $ref: '#/components/schemas/AuthorizationServerPolicyRuleConditions' + created: + type: string + format: date-time + readOnly: true + description: Timestamp when the rule was created + id: + type: string + description: Identifier of the rule + readOnly: true + lastUpdated: + type: string + format: date-time + readOnly: true + description: Timestamp when the rule was last modified + name: + type: string + description: Name of the rule + priority: + type: integer + description: Priority of the rule + status: + type: string + description: Status of the rule + enum: + - ACTIVE + - INACTIVE + system: + type: boolean + description: Set to `true` for system rules. You can't delete system rules. + type: + type: string + description: Rule type + enum: + - RESOURCE_ACCESS + _links: + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + activate: + $ref: '#/components/schemas/HrefObjectActivateLink' + deactivate: + $ref: '#/components/schemas/HrefObjectDeactivateLink' + readOnly: true + required: + - name + - conditions + - type + description: (opaque JSON object) OAuth2ResourceServerJsonWebKey: type: object properties: @@ -2387,9 +2350,7 @@ components: nullable: false kid: type: string - description: >- - Unique identifier of the JSON Web Key in the Custom Authorization - Server's Public JWKS + description: Unique identifier of the JSON Web Key in the Custom Authorization Server's Public JWKS example: SIMcCQNY3uwXoW3y0vf6VxiBb5n9pf8L2fK8d-FIbm4 nullable: true kty: @@ -2406,17 +2367,14 @@ components: 'n': type: string description: RSA key value (modulus) for key binding - example: >- - mkC6yAJVvFwUlmM9gKjb2d-YK5qHFt-mXSsbjWKKs4EfNm-BoQeeovBZtSACyaqLc8IYFTPEURFcbDQ9DkAL04uUIRD2gaHYY7uK0jsluEaXGq2RAIsmzAwNTzkiDw4q9pDL_q7n0f_SDt1TsMaMQayB6bU5jWsmqcWJ8MCRJ1aJMjZ16un5UVx51IIeCbe4QRDxEXGAvYNczsBoZxspDt28esSpq5W0dBFxcyGVudyl54Er3FzAguhgfMVjH-bUec9j2Tl40qDTktrYgYfxz9pfjm01Hl4WYP1YQxeETpSL7cQ5Ihz4jGDtHUEOcZ4GfJrPzrGpUrak8Qp5xcwCqQ + example: mkC6yAJVvFwUlmM9gKjb2d-YK5qHFt-mXSsbjWKKs4EfNm-BoQeeovBZtSACyaqLc8IYFTPEURFcbDQ9DkAL04uUIRD2gaHYY7uK0jsluEaXGq2RAIsmzAwNTzkiDw4q9pDL_q7n0f_SDt1TsMaMQayB6bU5jWsmqcWJ8MCRJ1aJMjZ16un5UVx51IIeCbe4QRDxEXGAvYNczsBoZxspDt28esSpq5W0dBFxcyGVudyl54Er3FzAguhgfMVjH-bUec9j2Tl40qDTktrYgYfxz9pfjm01Hl4WYP1YQxeETpSL7cQ5Ihz4jGDtHUEOcZ4GfJrPzrGpUrak8Qp5xcwCqQ nullable: false status: type: string enum: - ACTIVE - INACTIVE - description: >- - The status of the encryption key. You can use only an `ACTIVE` key - to encrypt tokens issued by the authorization server. + description: The status of the encryption key. You can use only an `ACTIVE` key to encrypt tokens issued by the authorization server. example: ACTIVE nullable: false default: ACTIVE @@ -2439,9 +2397,7 @@ components: nullable: false kid: type: string - description: >- - Unique identifier of the JSON web key in the custom authorization - server's public JWKS + description: Unique identifier of the JSON web key in the custom authorization server's public JWKS example: SIMcCQNY3uwXoW3y0vf6VxiBb5n9pf8L2fK8d-FIbm4 nullable: true kty: @@ -2452,8 +2408,7 @@ components: 'n': type: string description: RSA key value (modulus) for key binding - example: >- - mkC6yAJVvFwUlmM9gKjb2d-YK5qHFt-mXSsbjWKKs4EfNm-BoQeeovBZtSACyaqLc8IYFTPEURFcbDQ9DkAL04uUIRD2gaHYY7uK0jsluEaXGq2RAIsmzAwNTzkiDw4q9pDL_q7n0f_SDt1TsMaMQayB6bU5jWsmqcWJ8MCRJ1aJMjZ16un5UVx51IIeCbe4QRDxEXGAvYNczsBoZxspDt28esSpq5W0dBFxcyGVudyl54Er3FzAguhgfMVjH-bUec9j2Tl40qDTktrYgYfxz9pfjm01Hl4WYP1YQxeETpSL7cQ5Ihz4jGDtHUEOcZ4GfJrPzrGpUrak8Qp5xcwCqQ + example: mkC6yAJVvFwUlmM9gKjb2d-YK5qHFt-mXSsbjWKKs4EfNm-BoQeeovBZtSACyaqLc8IYFTPEURFcbDQ9DkAL04uUIRD2gaHYY7uK0jsluEaXGq2RAIsmzAwNTzkiDw4q9pDL_q7n0f_SDt1TsMaMQayB6bU5jWsmqcWJ8MCRJ1aJMjZ16un5UVx51IIeCbe4QRDxEXGAvYNczsBoZxspDt28esSpq5W0dBFxcyGVudyl54Er3FzAguhgfMVjH-bUec9j2Tl40qDTktrYgYfxz9pfjm01Hl4WYP1YQxeETpSL7cQ5Ihz4jGDtHUEOcZ4GfJrPzrGpUrak8Qp5xcwCqQ nullable: false status: type: string @@ -2468,6 +2423,7 @@ components: example: enc nullable: false OAuth2Scope: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: consent: @@ -2493,9 +2449,7 @@ components: description: Scope name optional: type: boolean - description: >- - Indicates whether the Scope is optional. When set to `true`, the - user can skip consent for the scope. + description: Indicates whether the Scope is optional. When set to `true`, the user can skip consent for the scope. default: false system: type: boolean @@ -2505,15 +2459,10 @@ components: $ref: '#/components/schemas/LinksSelf' required: - name - KeyEncryptionAlgorithm: - description: >- - The algorithm for - encrypting access tokens issued by this authorization server. If this is - requested, the response is signed, and then encrypted. The result is a - nested JWT. The default, if omitted, is that no encryption is performed. + AccessTokenKeyEncryptionAlgorithm: + description: The algorithm for encrypting access tokens issued by this authorization server. If this is requested, the response is signed, and then encrypted. The result is a nested JWT. The default, if omitted, is that no encryption is performed. x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: true type: string enum: @@ -2526,13 +2475,9 @@ components: signing: $ref: '#/components/schemas/AuthorizationServerCredentialsSigningConfig' ResourceServerJsonWebKeys: - description: >- - A [JSON Web Key - Set](https://tools.ietf.org/html/rfc7517#section-5) for encrypting JWTs - minted by the custom authorization server + description: A [JSON Web Key Set](https://tools.ietf.org/html/rfc7517#section-5) for encrypting JWTs minted by the custom authorization server x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: true type: object properties: @@ -2546,38 +2491,155 @@ components: - ACTIVE - INACTIVE AuthServerLinks: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - type: object + x-okta-ignore-redocly-rules-for-sdk: true + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + claims: + description: Link to the authorization server claims + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object properties: - claims: - allOf: - - description: Link to the authorization server claims - - $ref: '#/components/schemas/HrefObject' - deactivate: - allOf: - - $ref: '#/components/schemas/HrefObjectDeactivateLink' - metadata: - description: Link to the authorization server metadata - type: array - items: - $ref: '#/components/schemas/HrefObject' - policies: - allOf: - - description: Link to the authorization server policies - - $ref: '#/components/schemas/HrefObject' - rotateKey: - allOf: - - description: Link to the authorization server key rotation - - $ref: '#/components/schemas/HrefObject' - scopes: - allOf: - - description: Link to the authorization server scopes - - $ref: '#/components/schemas/HrefObject' + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + deactivate: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to deactivate the resource + metadata: + description: Link to the authorization server metadata + type: array + items: + $ref: '#/components/schemas/HrefObject' + policies: + description: Link to the authorization server policies + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + rotateKey: + description: Link to the authorization server key rotation + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + scopes: + description: Link to the authorization server scopes + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + readOnly: true OAuth2ClaimType: - description: >- - Specifies whether the Claim is for an access token (`RESOURCE`) or an ID - token (`IDENTITY`) + description: Specifies whether the Claim is for an access token (`RESOURCE`) or an ID token (`IDENTITY`) type: string enum: - IDENTITY @@ -2591,17 +2653,12 @@ components: items: type: string OAuth2ClaimGroupFilterType: - description: >- + description: |- Specifies the type of group filter if `valueType` is `GROUPS` + If `valueType` is `GROUPS`, then the groups returned are filtered according to the value of `group_filter_type`. - If `valueType` is `GROUPS`, then the groups returned are filtered - according to the value of `group_filter_type`. - - - If you have complex filters for Groups, you can [create a Groups - allowlist](https://developer.okta.com/docs/guides/customize-tokens-groups-claim/main/) - to put them all in a Claim. + If you have complex filters for Groups, you can [create a Groups allowlist](https://developer.okta.com/docs/guides/customize-tokens-groups-claim/main/) to put them all in a Claim. type: string enum: - CONTAINS @@ -2609,39 +2666,19 @@ components: - REGEX - STARTS_WITH x-enumDescriptions: - STARTS_WITH: >- - Group names start with `value` (not case-sensitive). For example, if - `value` is `group1`, then `group123` and `Group123` are included. - EQUALS: >- - Group name is the same as `value` (not case-sensitive). For example, - if `value` is `group1`, then `group1` and `Group1` are included, but - `group123` isn't. - CONTAINS: >- - Group names contain `value` (not case-sensitive). For example, if - `value` is `group1`, then `MyGroup123` and `group1` are included. - REGEX: >- - Group names match the regular expression in `value` (case-sensitive). - For example if `value` is `/^[a-z0-9_-]{3,16}$/`, then any Group name - that has at least three letters, no more than 16, and contains - lowercase letters, a hyphen, or numbers is a match. + STARTS_WITH: Group names start with `value` (not case-sensitive). For example, if `value` is `group1`, then `group123` and `Group123` are included. + EQUALS: Group name is the same as `value` (not case-sensitive). For example, if `value` is `group1`, then `group1` and `Group1` are included, but `group123` isn't. + CONTAINS: Group names contain `value` (not case-sensitive). For example, if `value` is `group1`, then `MyGroup123` and `group1` are included. + REGEX: Group names match the regular expression in `value` (case-sensitive). For example if `value` is `/^[a-z0-9_-]{3,16}$/`, then any Group name that has at least three letters, no more than 16, and contains lowercase letters, a hyphen, or numbers is a match. OAuth2ClaimValueType: - description: >- - Specifies whether the Claim is an Okta Expression Language (EL) - expression (`EXPRESSION`), a set of groups (`GROUPS`), or a system claim - (`SYSTEM`) + description: Specifies whether the Claim is an Okta Expression Language (EL) expression (`EXPRESSION`), a set of groups (`GROUPS`), or a system claim (`SYSTEM`) type: string enum: - EXPRESSION - GROUPS - SYSTEM LinksSelf: - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the - [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. This object is used for dynamic discovery of related - resources and lifecycle operations. + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. type: object properties: self: @@ -2653,16 +2690,14 @@ components: href: type: string description: Link URI - example: >- - https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7/clients/0oabskvc6442nkvQO0h7/grants + example: https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7/clients/0oabskvc6442nkvQO0h7/grants TokenResourcesHrefObject: type: object properties: href: type: string description: Link URI - example: >- - https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7/clients/0oabskvc6442nkvQO0h7/tokens + example: https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7/clients/0oabskvc6442nkvQO0h7/tokens createdProperty: description: Timestamp when the object was created format: date-time @@ -2683,14 +2718,13 @@ components: - REVOKED readOnly: true OAuth2RefreshTokenScope: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: description: type: string description: Description of the Scope - example: >- - Requests a refresh token by default, used to obtain more access - tokens without re-prompting the user for authentication + example: Requests a refresh token by default, used to obtain more access tokens without re-prompting the user for authentication displayName: type: string description: Name of the end user displayed in a consent dialog @@ -2704,20 +2738,21 @@ components: description: Scope name example: offline_access _links: - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the - current status of an application using the [JSON Hypertext - Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. This object is used for dynamic discovery of related - resources and lifecycle operations. + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status of an application using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. type: object properties: scope: description: Link to Scope resource - allOf: - - $ref: '#/components/schemas/OfflineAccessScopeResourceHrefObject' + type: object + properties: + href: + type: string + description: Link URI + example: https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7/scopes/scppb56cIl4GvGxy70g3 + title: + type: string + description: Link name + example: offline_access AppResourceHrefObject: type: object properties: @@ -2735,8 +2770,7 @@ components: href: type: string description: Link URI - example: >- - https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7/clients/0oabskvc6442nkvQO0h7/tokens/oar579Mcp7OUsNTlo0g3 + example: https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7/clients/0oabskvc6442nkvQO0h7/tokens/oar579Mcp7OUsNTlo0g3 UserResourceHrefObject: type: object properties: @@ -2754,8 +2788,7 @@ components: href: type: string description: Link URI - example: >- - https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7 + example: https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7 title: type: string description: Link name @@ -2776,15 +2809,18 @@ components: clients: $ref: '#/components/schemas/ClientPolicyCondition' LinksSelfAndLifecycle: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - type: object - properties: - activate: - $ref: '#/components/schemas/HrefObjectActivateLink' - deactivate: - $ref: '#/components/schemas/HrefObjectDeactivateLink' + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + activate: + $ref: '#/components/schemas/HrefObjectActivateLink' + deactivate: + $ref: '#/components/schemas/HrefObjectDeactivateLink' + readOnly: true HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object additionalProperties: true type: object @@ -2801,25 +2837,21 @@ components: readOnly: true templated: type: boolean - description: >- - Indicates whether the link object's `href` property is a URI - template. + description: Indicates whether the link object's `href` property is a URI template. readOnly: true type: type: string - description: >- - The media type of the link. If omitted, it is implicitly - `application/json`. + description: The media type of the link. If omitted, it is implicitly `application/json`. readOnly: true required: - href AuthorizationServerPolicyRuleActions: - allOf: - - $ref: '#/components/schemas/PolicyRuleActions' - - type: object - properties: - token: - $ref: '#/components/schemas/TokenAuthorizationServerPolicyRuleAction' + x-okta-ignore-redocly-rules-for-sdk: true + type: string + description: (opaque JSON object) + properties: + token: + $ref: '#/components/schemas/TokenAuthorizationServerPolicyRuleAction' AuthorizationServerPolicyRuleConditions: type: object properties: @@ -2830,13 +2862,7 @@ components: scopes: $ref: '#/components/schemas/OAuth2ScopesMediationPolicyRuleCondition' OAuthResourceServerKeyLinks: - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the - current status of a JSON Web Key using the [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. This object is used for dynamic discovery of related - resources and lifecycle operations. + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status of a JSON Web Key using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. properties: activate: $ref: '#/components/schemas/HrefObjectActivateLink' @@ -2864,23 +2890,16 @@ components: properties: kid: type: string - description: >- - The ID of the JSON Web Key used for signing tokens issued by the - authorization server + description: The ID of the JSON Web Key used for signing tokens issued by the authorization server readOnly: true lastRotated: type: string - description: >- - The timestamp when the authorization server started using the `kid` - for signing tokens + description: The timestamp when the authorization server started using the `kid` for signing tokens format: date-time readOnly: true nextRotation: type: string - description: >- - The timestamp when the authorization server changes the Key for - signing tokens. This is only returned when `rotationMode` is set to - `AUTO`. + description: The timestamp when the authorization server changes the Key for signing tokens. This is only returned when `rotationMode` is set to `AUTO`. format: date-time readOnly: true rotationMode: @@ -2888,11 +2907,7 @@ components: use: $ref: '#/components/schemas/AuthorizationServerCredentialsUse' ResourceServerJsonWebKey: - description: >- - A [JSON Web Key (JWK)](https://tools.ietf.org/html/rfc7517) is a JSON - representation of a cryptographic key. Okta can use the active key to - encrypt the access token minted by the authorization server. Okta - supports only RSA keys with 'use: enc'. + description: 'A [JSON Web Key (JWK)](https://tools.ietf.org/html/rfc7517) is a JSON representation of a cryptographic key. Okta can use the active key to encrypt the access token minted by the authorization server. Okta supports only RSA keys with ''use: enc''.' type: object properties: e: @@ -2911,38 +2926,106 @@ components: use: $ref: '#/components/schemas/JsonWebKeyUse' HrefObjectDeactivateLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to deactivate the resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to deactivate the resource HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) OfflineAccessScopeResourceHrefObject: type: object properties: href: type: string description: Link URI - example: >- - https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7/scopes/scppb56cIl4GvGxy70g3 + example: https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7/scopes/scppb56cIl4GvGxy70g3 title: type: string description: Link name example: offline_access ClientPolicyCondition: - description: Specifies which clients are included in the Policy + description: Specifies which clients are included in the policy type: object properties: include: type: array - description: Which clients are included in the Policy + description: Which clients are included in the policy items: type: string HrefObjectActivateLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to activate the resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to activate the resource HrefHints: description: Describes allowed HTTP verbs for the `href` type: object @@ -2952,30 +3035,25 @@ components: items: $ref: '#/components/schemas/HttpMethod' PolicyRuleActions: - type: object + x-okta-ignore-redocly-rules-for-sdk: true + type: string + description: (opaque JSON object) TokenAuthorizationServerPolicyRuleAction: type: object properties: accessTokenLifetimeMinutes: type: integer - description: >- - Lifetime of the access token in minutes. The minimum is five - minutes. The maximum is one day. + description: Lifetime of the access token in minutes. The minimum is five minutes. The maximum is one day. inlineHook: - $ref: >- - #/components/schemas/TokenAuthorizationServerPolicyRuleActionInlineHook + $ref: '#/components/schemas/TokenAuthorizationServerPolicyRuleActionInlineHook' refreshTokenLifetimeMinutes: type: integer description: Lifetime of the refresh token is the minimum access token lifetime. refreshTokenWindowMinutes: type: integer - description: >- - Timeframe when the refresh token is valid. The minimum is 10 - minutes. The maximum is five years (2,628,000 minutes). + description: Timeframe when the refresh token is valid. The minimum is 10 minutes. The maximum is five years (2,628,000 minutes). GrantTypePolicyRuleCondition: - description: >- - Array of grant types that this condition includes. Determines the - mechanism that Okta uses to authorize the creation of the tokens. + description: Array of grant types that this condition includes. Determines the mechanism that Okta uses to authorize the creation of the tokens. type: object properties: include: @@ -3000,9 +3078,32 @@ components: items: type: string HrefObjectDeleteLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to delete the resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to delete the resource AuthorizationServerCredentialsRotationMode: description: The Key rotation mode for the authorization server type: string @@ -3061,6 +3162,90 @@ components: type: array items: type: string + ListAuthorizationServersResponse: + type: object + properties: + authorization_servers: + type: array + items: + $ref: '#/components/schemas/AuthorizationServer' + ListAssociatedServersByTrustedTypeResponse: + type: object + properties: + associated_servers_by_trusted_type: + type: array + items: + $ref: '#/components/schemas/AuthorizationServer' + CreateAssociatedServersResponse: + type: object + properties: + create_associated_servers: + type: array + items: + $ref: '#/components/schemas/AuthorizationServer' + ListOAuth2ClaimsResponse: + type: object + properties: + oauth2_claims: + type: array + items: + $ref: '#/components/schemas/OAuth2Claim' + ListOAuth2ClientsForAuthorizationServerResponse: + type: object + properties: + oauth2_clients_for_authorization_server: + type: array + items: + $ref: '#/components/schemas/OAuth2Client' + ListRefreshTokensForAuthorizationServerAndClientResponse: + type: object + properties: + refresh_tokens_for_authorization_server_and_client: + type: array + items: + $ref: '#/components/schemas/OAuth2RefreshToken' + ListAuthorizationServerKeysResponse: + type: object + properties: + authorization_server_keys: + type: array + items: + $ref: '#/components/schemas/AuthorizationServerJsonWebKey' + RotateAuthorizationServerKeysResponse: + type: object + properties: + rotate_authorization_server_keys: + type: array + items: + $ref: '#/components/schemas/AuthorizationServerJsonWebKey' + ListAuthorizationServerPoliciesResponse: + type: object + properties: + authorization_server_policies: + type: array + items: + $ref: '#/components/schemas/AuthorizationServerPolicy' + ListAuthorizationServerPolicyRulesResponse: + type: object + properties: + authorization_server_policy_rules: + type: array + items: + $ref: '#/components/schemas/AuthorizationServerPolicyRule' + ListOAuth2ResourceServerJsonWebKeysResponse: + type: object + properties: + oauth2_resource_server_json_web_keys: + type: array + items: + $ref: '#/components/schemas/OAuth2ResourceServerJsonWebKey' + ListOAuth2ScopesResponse: + type: object + properties: + oauth2_scopes: + type: array + items: + $ref: '#/components/schemas/OAuth2Scope' responses: ErrorAccessDenied403: description: Forbidden @@ -3134,7 +3319,7 @@ components: example: hNJ3Uk76xLagWkGx5W3N pathClientId: name: clientId - description: Client app ID + description: '`client_id` of the app' in: path required: true schema: @@ -3158,7 +3343,7 @@ components: example: P7jXpG-LG2ObNgY9C0Mn2uf4InCQTmRZMDCZoVNxdrk pathPolicyId: name: policyId - description: '`id` of the Policy' + description: '`id` of the policy' in: path required: true schema: @@ -3172,7 +3357,7 @@ components: schema: type: string example: ruld3hJ7jZh4fn0st0g3 - pathJsonWebKeyId: + CustomAsPathJsonWebKeyId: name: keyId in: path schema: @@ -3210,26 +3395,22 @@ components: kid: WYQxoK4XAwGFn5Zw5AzLxFvqEKLP79BbsKmWeuc5TB4 _links: scopes: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes hints: allow: - GET claims: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/claims + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/claims hints: allow: - GET policies: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/policies + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/policies hints: allow: - GET self: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId} + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId} hints: allow: - GET @@ -3237,26 +3418,22 @@ components: - PUT metadata: - name: oauth-authorization-server - href: >- - https://{yourOktaDomain}/oauth2/{authorizationServerId}/.well-known/oauth-authorization-server + href: https://{yourOktaDomain}/oauth2/{authorizationServerId}/.well-known/oauth-authorization-server hints: allow: - GET - name: openid-configuration - href: >- - https://{yourOktaDomain}/oauth2/{authorizationServerId}/.well-known/openid-configuration + href: https://{yourOktaDomain}/oauth2/{authorizationServerId}/.well-known/openid-configuration hints: allow: - GET rotateKey: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/credentials/lifecycle/keyRotate + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/credentials/lifecycle/keyRotate hints: allow: - POST deactivate: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/lifecycle/deactivate hints: allow: - POST @@ -3268,9 +3445,7 @@ components: audiences: - api://default CreateAuthServerWithAccessTokenEncryptionBody: - summary: >- - Create a custom authorization server with access token encryption - enabled + summary: Create a custom authorization server with access token encryption enabled value: name: Sample Authorization Server description: Sample authorization server description @@ -3285,8 +3460,7 @@ components: kid: encKey use: enc e: AQAB - 'n': >- - iHYyA5KXL82veBfNP81D7Q1GMRWIixNTu5jY03Z19DN7qTg1xYPRyPEPuMJ5Xjdhrm3dJdW7p1woRa6CHfw8FS7aosXUZkplxPs0NICP32nCkwpX3U3CltgVWrpMEUrd-JljKm0AgrervZuLkgBEfwY3BXP_SCKjF0JtbQjcK9MOKFNUUUK3_xTrFcyZThlSOtiOmhjDHTfHzeG2Q0NG2Opom1kfKWLDUVy5qrzYJWgcCaPOyEE1xnk4u5syH_8APOi2tKwKBCgS_D-kXzZ_379VhVuEpo2CGBU20t9Ys_m8KLqMCOyJaoQ3R1r6cWHfnYSab31L1my3rLwuippXkQ + 'n': iHYyA5KXL82veBfNP81D7Q1GMRWIixNTu5jY03Z19DN7qTg1xYPRyPEPuMJ5Xjdhrm3dJdW7p1woRa6CHfw8FS7aosXUZkplxPs0NICP32nCkwpX3U3CltgVWrpMEUrd-JljKm0AgrervZuLkgBEfwY3BXP_SCKjF0JtbQjcK9MOKFNUUUK3_xTrFcyZThlSOtiOmhjDHTfHzeG2Q0NG2Opom1kfKWLDUVy5qrzYJWgcCaPOyEE1xnk4u5syH_8APOi2tKwKBCgS_D-kXzZ_379VhVuEpo2CGBU20t9Ys_m8KLqMCOyJaoQ3R1r6cWHfnYSab31L1my3rLwuippXkQ CreateAuthServerResponse: summary: Create a custom authorization server value: @@ -3308,26 +3482,22 @@ components: kid: WYQxoK4XAwGFn5Zw5AzLxFvqEKLP79BbsKmWeuc5TB4 _links: scopes: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes hints: allow: - GET claims: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/claims + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/claims hints: allow: - GET policies: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/policies + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/policies hints: allow: - GET self: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId} + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId} hints: allow: - GET @@ -3335,33 +3505,27 @@ components: - PUT metadata: - name: oauth-authorization-server - href: >- - https://{yourOktaDomain}/oauth2/{authorizationServerId}/.well-known/oauth-authorization-server + href: https://{yourOktaDomain}/oauth2/{authorizationServerId}/.well-known/oauth-authorization-server hints: allow: - GET - name: openid-configuration - href: >- - https://{yourOktaDomain}/oauth2/{authorizationServerId}/.well-known/openid-configuration + href: https://{yourOktaDomain}/oauth2/{authorizationServerId}/.well-known/openid-configuration hints: allow: - GET rotateKey: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/credentials/lifecycle/keyRotate + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/credentials/lifecycle/keyRotate hints: allow: - POST deactivate: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/lifecycle/deactivate hints: allow: - POST CreateAuthServerWithAccessTokenEncryptionResponse: - summary: >- - Create a custom authorization server with access token encryption - enabled + summary: Create a custom authorization server with access token encryption enabled value: id: '{authorizationServerId}' name: Sample Authorization Server @@ -3388,30 +3552,25 @@ components: kid: encKey use: enc e: AQAB - 'n': >- - iHYyA5KXL82veBfNP81D7Q1GMRWIixNTu5jY03Z19DN7qTg1xYPRyPEPuMJ5Xjdhrm3dJdW7p1woRa6CHfw8FS7aosXUZkplxPs0NICP32nCkwpX3U3CltgVWrpMEUrd-JljKm0AgrervZuLkgBEfwY3BXP_SCKjF0JtbQjcK9MOKFNUUUK3_xTrFcyZThlSOtiOmhjDHTfHzeG2Q0NG2Opom1kfKWLDUVy5qrzYJWgcCaPOyEE1xnk4u5syH_8APOi2tKwKBCgS_D-kXzZ_379VhVuEpo2CGBU20t9Ys_m8KLqMCOyJaoQ3R1r6cWHfnYSab31L1my3rLwuippXkQ + 'n': iHYyA5KXL82veBfNP81D7Q1GMRWIixNTu5jY03Z19DN7qTg1xYPRyPEPuMJ5Xjdhrm3dJdW7p1woRa6CHfw8FS7aosXUZkplxPs0NICP32nCkwpX3U3CltgVWrpMEUrd-JljKm0AgrervZuLkgBEfwY3BXP_SCKjF0JtbQjcK9MOKFNUUUK3_xTrFcyZThlSOtiOmhjDHTfHzeG2Q0NG2Opom1kfKWLDUVy5qrzYJWgcCaPOyEE1xnk4u5syH_8APOi2tKwKBCgS_D-kXzZ_379VhVuEpo2CGBU20t9Ys_m8KLqMCOyJaoQ3R1r6cWHfnYSab31L1my3rLwuippXkQ _links: scopes: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes hints: allow: - GET claims: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/claims + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/claims hints: allow: - GET policies: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/policies + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/policies hints: allow: - GET self: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId} + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId} hints: allow: - GET @@ -3419,26 +3578,22 @@ components: - PUT metadata: - name: oauth-authorization-server - href: >- - https://{yourOktaDomain}/oauth2/{authorizationServerId}/.well-known/oauth-authorization-server + href: https://{yourOktaDomain}/oauth2/{authorizationServerId}/.well-known/oauth-authorization-server hints: allow: - GET - name: openid-configuration - href: >- - https://{yourOktaDomain}/oauth2/{authorizationServerId}/.well-known/openid-configuration + href: https://{yourOktaDomain}/oauth2/{authorizationServerId}/.well-known/openid-configuration hints: allow: - GET rotateKey: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/credentials/lifecycle/keyRotate + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/credentials/lifecycle/keyRotate hints: allow: - POST deactivate: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/lifecycle/deactivate hints: allow: - POST @@ -3463,26 +3618,22 @@ components: kid: WYQxoK4XAwGFn5Zw5AzLxFvqEKLP79BbsKmWeuc5TB4 _links: scopes: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes hints: allow: - GET claims: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/claims + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/claims hints: allow: - GET policies: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/policies + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/policies hints: allow: - GET self: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId} + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId} hints: allow: - GET @@ -3490,26 +3641,22 @@ components: - PUT metadata: - name: oauth-authorization-server - href: >- - https://{yourOktaDomain}/oauth2/{authorizationServerId}/.well-known/oauth-authorization-server + href: https://{yourOktaDomain}/oauth2/{authorizationServerId}/.well-known/oauth-authorization-server hints: allow: - GET - name: openid-configuration - href: >- - https://{yourOktaDomain}/oauth2/{authorizationServerId}/.well-known/openid-configuration + href: https://{yourOktaDomain}/oauth2/{authorizationServerId}/.well-known/openid-configuration hints: allow: - GET rotateKey: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/credentials/lifecycle/keyRotate + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/credentials/lifecycle/keyRotate hints: allow: - POST deactivate: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/lifecycle/deactivate hints: allow: - POST @@ -3550,16 +3697,14 @@ components: kid: encKey1 use: enc e: AQAB - 'n': >- - iHYyA5KXL82veBfNP81D7Q1GMRWIixNTu5jY03Z19DN7qTg1xYPRyPEPuMJ5Xjdhrm3dJdW7p1woRa6CHfw8FS7aosXUZkplxPs0NICP32nCkwpX3U3CltgVWrpMEUrd-JljKm0AgrervZuLkgBEfwY3BXP_SCKjF0JtbQjcK9MOKFNUUUK3_xTrFcyZThlSOtiOmhjDHTfHzeG2Q0NG2Opom1kfKWLDUVy5qrzYJWgcCaPOyEE1xnk4u5syH_8APOi2tKwKBCgS_D-kXzZ_379VhVuEpo2CGBU20t9Ys_m8KLqMCOyJaoQ3R1r6cWHfnYSab31L1my3rLwuippXkQ + 'n': iHYyA5KXL82veBfNP81D7Q1GMRWIixNTu5jY03Z19DN7qTg1xYPRyPEPuMJ5Xjdhrm3dJdW7p1woRa6CHfw8FS7aosXUZkplxPs0NICP32nCkwpX3U3CltgVWrpMEUrd-JljKm0AgrervZuLkgBEfwY3BXP_SCKjF0JtbQjcK9MOKFNUUUK3_xTrFcyZThlSOtiOmhjDHTfHzeG2Q0NG2Opom1kfKWLDUVy5qrzYJWgcCaPOyEE1xnk4u5syH_8APOi2tKwKBCgS_D-kXzZ_379VhVuEpo2CGBU20t9Ys_m8KLqMCOyJaoQ3R1r6cWHfnYSab31L1my3rLwuippXkQ - kty: RSA id: apk5f3fg7kkG4TUzv0h8 status: INACTIVE kid: encKey2 use: enc e: AQAB - 'n': >- - iHYyA5KXL82veBfNP81D7Q1GMRWIixNTu5jY03Z19DN7qTg1xYPRyPEPuMJ5Xjdhrm3dJdW7p1woRa6CHfw8FS7aosXUZkplxPs0NICP32nCkwpX3U3CltgVWrpMEUrd-JljKm0AgrervZuLkgBEfwY3BXP_SCKjF0JtbQjcK9MOKFNUUUK3_xTrFcyZThlSOtiOmhjDHTfHzeG2Q0NG2Opom1kfKWLDUVy5qrzYJWgcCaPOyEE1xnk4u5syH_8APOi2tKwKBCgS_D-kXzZ_379VhVuEpo2CGBU20t9Ys_m8KLqMCOyJaoQ3R1r6cWHfnYSab31L1my3rLwuippXkQ + 'n': iHYyA5KXL82veBfNP81D7Q1GMRWIixNTu5jY03Z19DN7qTg1xYPRyPEPuMJ5Xjdhrm3dJdW7p1woRa6CHfw8FS7aosXUZkplxPs0NICP32nCkwpX3U3CltgVWrpMEUrd-JljKm0AgrervZuLkgBEfwY3BXP_SCKjF0JtbQjcK9MOKFNUUUK3_xTrFcyZThlSOtiOmhjDHTfHzeG2Q0NG2Opom1kfKWLDUVy5qrzYJWgcCaPOyEE1xnk4u5syH_8APOi2tKwKBCgS_D-kXzZ_379VhVuEpo2CGBU20t9Ys_m8KLqMCOyJaoQ3R1r6cWHfnYSab31L1my3rLwuippXkQ ReplaceAuthServerResponse: summary: Replace a custom authorization server value: @@ -3581,26 +3726,22 @@ components: kid: WYQxoK4XAwGFn5Zw5AzLxFvqEKLP79BbsKmWeuc5TB4 _links: scopes: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes hints: allow: - GET claims: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/claims + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/claims hints: allow: - GET policies: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/policies + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/policies hints: allow: - GET self: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId} + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId} hints: allow: - GET @@ -3608,26 +3749,22 @@ components: - PUT metadata: - name: oauth-authorization-server - href: >- - https://{yourOktaDomain}/oauth2/{authorizationServerId}/.well-known/oauth-authorization-server + href: https://{yourOktaDomain}/oauth2/{authorizationServerId}/.well-known/oauth-authorization-server hints: allow: - GET - name: openid-configuration - href: >- - https://{yourOktaDomain}/oauth2/{authorizationServerId}/.well-known/openid-configuration + href: https://{yourOktaDomain}/oauth2/{authorizationServerId}/.well-known/openid-configuration hints: allow: - GET rotateKey: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/credentials/lifecycle/keyRotate + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/credentials/lifecycle/keyRotate hints: allow: - POST deactivate: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/lifecycle/deactivate hints: allow: - POST @@ -3659,38 +3796,32 @@ components: kid: encKey1 use: enc e: AQAB - 'n': >- - iHYyA5KXL82veBfNP81D7Q1GMRWIixNTu5jY03Z19DN7qTg1xYPRyPEPuMJ5Xjdhrm3dJdW7p1woRa6CHfw8FS7aosXUZkplxPs0NICP32nCkwpX3U3CltgVWrpMEUrd-JljKm0AgrervZuLkgBEfwY3BXP_SCKjF0JtbQjcK9MOKFNUUUK3_xTrFcyZThlSOtiOmhjDHTfHzeG2Q0NG2Opom1kfKWLDUVy5qrzYJWgcCaPOyEE1xnk4u5syH_8APOi2tKwKBCgS_D-kXzZ_379VhVuEpo2CGBU20t9Ys_m8KLqMCOyJaoQ3R1r6cWHfnYSab31L1my3rLwuippXkQ + 'n': iHYyA5KXL82veBfNP81D7Q1GMRWIixNTu5jY03Z19DN7qTg1xYPRyPEPuMJ5Xjdhrm3dJdW7p1woRa6CHfw8FS7aosXUZkplxPs0NICP32nCkwpX3U3CltgVWrpMEUrd-JljKm0AgrervZuLkgBEfwY3BXP_SCKjF0JtbQjcK9MOKFNUUUK3_xTrFcyZThlSOtiOmhjDHTfHzeG2Q0NG2Opom1kfKWLDUVy5qrzYJWgcCaPOyEE1xnk4u5syH_8APOi2tKwKBCgS_D-kXzZ_379VhVuEpo2CGBU20t9Ys_m8KLqMCOyJaoQ3R1r6cWHfnYSab31L1my3rLwuippXkQ - kty: RSA id: apk5f3fg7kkG4TUzv0h8 status: INACTIVE kid: encKey2 use: enc e: AQAB - 'n': >- - iHYyA5KXL82veBfNP81D7Q1GMRWIixNTu5jY03Z19DN7qTg1xYPRyPEPuMJ5Xjdhrm3dJdW7p1woRa6CHfw8FS7aosXUZkplxPs0NICP32nCkwpX3U3CltgVWrpMEUrd-JljKm0AgrervZuLkgBEfwY3BXP_SCKjF0JtbQjcK9MOKFNUUUK3_xTrFcyZThlSOtiOmhjDHTfHzeG2Q0NG2Opom1kfKWLDUVy5qrzYJWgcCaPOyEE1xnk4u5syH_8APOi2tKwKBCgS_D-kXzZ_379VhVuEpo2CGBU20t9Ys_m8KLqMCOyJaoQ3R1r6cWHfnYSab31L1my3rLwuippXkQ + 'n': iHYyA5KXL82veBfNP81D7Q1GMRWIixNTu5jY03Z19DN7qTg1xYPRyPEPuMJ5Xjdhrm3dJdW7p1woRa6CHfw8FS7aosXUZkplxPs0NICP32nCkwpX3U3CltgVWrpMEUrd-JljKm0AgrervZuLkgBEfwY3BXP_SCKjF0JtbQjcK9MOKFNUUUK3_xTrFcyZThlSOtiOmhjDHTfHzeG2Q0NG2Opom1kfKWLDUVy5qrzYJWgcCaPOyEE1xnk4u5syH_8APOi2tKwKBCgS_D-kXzZ_379VhVuEpo2CGBU20t9Ys_m8KLqMCOyJaoQ3R1r6cWHfnYSab31L1my3rLwuippXkQ _links: scopes: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes hints: allow: - GET claims: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/claims + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/claims hints: allow: - GET policies: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/policies + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/policies hints: allow: - GET self: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId} + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId} hints: allow: - GET @@ -3698,26 +3829,22 @@ components: - PUT metadata: - name: oauth-authorization-server - href: >- - https://{yourOktaDomain}/oauth2/{authorizationServerId}/.well-known/oauth-authorization-server + href: https://{yourOktaDomain}/oauth2/{authorizationServerId}/.well-known/oauth-authorization-server hints: allow: - GET - name: openid-configuration - href: >- - https://{yourOktaDomain}/oauth2/{authorizationServerId}/.well-known/openid-configuration + href: https://{yourOktaDomain}/oauth2/{authorizationServerId}/.well-known/openid-configuration hints: allow: - GET rotateKey: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/credentials/lifecycle/keyRotate + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/credentials/lifecycle/keyRotate hints: allow: - POST deactivate: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/lifecycle/deactivate hints: allow: - POST @@ -3743,8 +3870,7 @@ components: use: sig _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId} + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId} hints: allow: - DELETE @@ -3774,8 +3900,7 @@ components: use: sig _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId} + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId} hints: allow: - DELETE @@ -3796,8 +3921,7 @@ components: apiResourceId: null _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/claims/{claimId} + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/claims/{claimId} hints: allow: - GET @@ -3835,8 +3959,7 @@ components: group_filter_type: CONTAINS _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/claims/{claimId} + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/claims/{claimId} hints: allow: - GET @@ -3860,8 +3983,7 @@ components: group_filter_type: CONTAINS _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/claims/{claimId} + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/claims/{claimId} hints: allow: - GET @@ -3899,8 +4021,7 @@ components: group_filter_type: CONTAINS _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/claims/{claimId} + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/claims/{claimId} hints: allow: - GET @@ -3918,8 +4039,7 @@ components: href: https://{yourOktaDomain}/oauth2/v1/clients/{clientId} title: My Web App tokens: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/clients/{clientId}/tokens + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/clients/{clientId}/tokens hints: allow: - GET @@ -3946,34 +4066,27 @@ components: description: Signals that a request is an OpenID request _links: scope: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes/{scopeId} + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes/{scopeId} title: openid - id: '{scopeID}' name: offline_access displayName: Keep you signed in to the app - description: >- - This keeps you signed in to the app, even when you aren't - using it. + description: This keeps you signed in to the app, even when you aren't using it. _links: scope: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes/{scopeId} + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes/{scopeId} itle: Keep you signed in to the app _links: app: href: https://{yourOktaDomain}/api/v1/apps/{appId} title: My Web App authorizationServer: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId} + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId} title: Authorization Server name self: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/clients/{clientId}/tokens/{tokenId} + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/clients/{clientId}/tokens/{tokenId} revoke: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/clients/{clientId}/tokens/{tokenId} + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/clients/{clientId}/tokens/{tokenId} hints: allow: - DELETE @@ -4002,13 +4115,10 @@ components: - id: '{scopeID}' name: offline_access displayName: Keep you signed in to the app - description: >- - This keeps you signed in to the app, even when you aren't - using it. + description: This keeps you signed in to the app, even when you aren't using it. _links: scope: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes/{scopeId} + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes/{scopeId} title: Keep you signed in to the app - id: '{scopeId}' name: openid @@ -4016,23 +4126,19 @@ components: description: Signals that a request is an OpenID request _links: scope: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes/{scopeId} + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes/{scopeId} title: openid _links: app: href: https://{yourOktaDomain}/api/v1/apps/{appId} title: My Web App authorizationServer: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId} + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId} title: Authorization Server name self: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/clients/{clientId}/tokens/{tokenId} + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/clients/{clientId}/tokens/{tokenId} revoke: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/clients/{clientId}/tokens/{tokenId} + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/clients/{clientId}/tokens/{tokenId} hints: allow: - DELETE @@ -4048,58 +4154,39 @@ components: - status: ACTIVE alg: RS256 e: AQAB - 'n': >- - g0MirhrysJMPm_wK45jvMbbyanfhl-jmTBv0o69GeifPaISaXGv8LKn3-CyJvUJcjjeHE17KtumJWVxUDRzFqtIMZ1ctCZyIAuWO0n - LKilg7_EIDXJrS8k14biqkPO1lXGFwtjo3zLHeFSLw6sWf-CEN9zv6Ff3IAXb-RMYpfh-bVrxIgWsWCxjLW-UKI3la-gs0nWHH2PJr5HLJuI - JIOL5HLJuIJIOLWahqTnm_r1LSCSYr6N4C-fh--w2_BW8DzTHalBYe76bNr0d7AqtR4tGazmrvrc79Wa2bjyxmhhN1u9jSaZQqq-3VZEod8q3, - WHH2PJ5v1LoXniJQ4a2W8nDVqb6h4E8MUKYOpljTfQ + 'n': g0MirhrysJMPm_wK45jvMbbyanfhl-jmTBv0o69GeifPaISaXGv8LKn3-CyJvUJcjjeHE17KtumJWVxUDRzFqtIMZ1ctCZyIAuWO0n LKilg7_EIDXJrS8k14biqkPO1lXGFwtjo3zLHeFSLw6sWf-CEN9zv6Ff3IAXb-RMYpfh-bVrxIgWsWCxjLW-UKI3la-gs0nWHH2PJr5HLJuI JIOL5HLJuIJIOLWahqTnm_r1LSCSYr6N4C-fh--w2_BW8DzTHalBYe76bNr0d7AqtR4tGazmrvrc79Wa2bjyxmhhN1u9jSaZQqq-3VZEod8q3, WHH2PJ5v1LoXniJQ4a2W8nDVqb6h4E8MUKYOpljTfQ kid: RQ8DuhdxCczyMvy7GNJb4Ka3lQ99vrSo3oFBUiZjzzc kty: RSA use: sig _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/credentials/keys/RQ8DuhdxCczyMvy7GNJb4Ka3lQ99vrSo3oFBUiZjzzc + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/credentials/keys/RQ8DuhdxCczyMvy7GNJb4Ka3lQ99vrSo3oFBUiZjzzc hints: allow: - GET - status: NEXT alg: RS256 e: AQAB - 'n': >- - l1hZ_g2sgBE3oHvu34T-5XP18FYJWgtul_nRNg-5xra5ySkaXEOJUDRERUG0HrR42uqf9jYrUTwg9fp-SqqNIdHRaN8EwRSDRsKAwK - 3 - HIJ2NJfgmrrO2ABkeyUq6rzHxAumiKv1iLFpSawSIiTEBJERtUCDcjbbqyHVFuivIFgH8L37 - - XDIDb0XG - R8DOoOHLJPTpsgH - rJe - M5w96VIRZInsGC5OGWkFdtgk6OkbvVd7_TXcxLCpWeg1vlbmX - 0 - TmG5yjSj7ek05txcpxIqYu - 7 FIGT0KKvXge_BOSEUlJpBhLKU28 - OtsOnmc3NLIGXB - GeDiUZiBYQdPR - myB4ZoQ + 'n': l1hZ_g2sgBE3oHvu34T-5XP18FYJWgtul_nRNg-5xra5ySkaXEOJUDRERUG0HrR42uqf9jYrUTwg9fp-SqqNIdHRaN8EwRSDRsKAwK 3 HIJ2NJfgmrrO2ABkeyUq6rzHxAumiKv1iLFpSawSIiTEBJERtUCDcjbbqyHVFuivIFgH8L37 - XDIDb0XG - R8DOoOHLJPTpsgH - rJe M5w96VIRZInsGC5OGWkFdtgk6OkbvVd7_TXcxLCpWeg1vlbmX - 0 TmG5yjSj7ek05txcpxIqYu - 7 FIGT0KKvXge_BOSEUlJpBhLKU28 OtsOnmc3NLIGXB - GeDiUZiBYQdPR - myB4ZoQ kid: Y3vBOdYT-l-I0j-gRQ26XjutSX00TeWiSguuDhW3ngo kty: RSA use: sig _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/credentials/keys/Y3vBOdYT-l-I0j-gRQ26XjutSX00TeWiSguuDhW3ngo + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/credentials/keys/Y3vBOdYT-l-I0j-gRQ26XjutSX00TeWiSguuDhW3ngo hints: allow: - GET - status: EXPIRED alg: RS256 e: AQAB - 'n': >- - lC4ehVB6W0OCtNPnz8udYH9Ao83B6EKnHA5eTcMOap_lQZ-nKtS1lZwBj4wXRVc1XmS0d2OQFA1VMQ-dHLDE3CiGfsGqWbaiZFdW7U - GLO1nAwfDdH6xp3xwpKOMewDXbAHJlXdYYAe2ap - - CE9c5WLTUBU6JROuWcorHCNJisj1aExyiY5t3JQQVGpBz2oUIHo7NRzQoKimvp - dMvMzcYnTlk1dhlG11b1GTkBclprm1BmOP7Ltjd7aEumOJWS67nKcAZzl48Zyg5KtV11V9F9dkGt25qHauqFKL7w3wu - - DYhT0hmyFc wn - tXS6e6HQbfHhR_MQxysLtDGOk2ViWv8AQ + 'n': lC4ehVB6W0OCtNPnz8udYH9Ao83B6EKnHA5eTcMOap_lQZ-nKtS1lZwBj4wXRVc1XmS0d2OQFA1VMQ-dHLDE3CiGfsGqWbaiZFdW7U GLO1nAwfDdH6xp3xwpKOMewDXbAHJlXdYYAe2ap - CE9c5WLTUBU6JROuWcorHCNJisj1aExyiY5t3JQQVGpBz2oUIHo7NRzQoKimvp dMvMzcYnTlk1dhlG11b1GTkBclprm1BmOP7Ltjd7aEumOJWS67nKcAZzl48Zyg5KtV11V9F9dkGt25qHauqFKL7w3wu - DYhT0hmyFc wn - tXS6e6HQbfHhR_MQxysLtDGOk2ViWv8AQ kid: h5Sr3LXcpQiQlAUVPdhrdLFoIvkhRTAVs_h39bQnxlU kty: RSA use: sig _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/credentials/keys/h5Sr3LXcpQiQlAUVPdhrdLFoIvkhRTAVs_h39bQnxlU + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/credentials/keys/h5Sr3LXcpQiQlAUVPdhrdLFoIvkhRTAVs_h39bQnxlU hints: allow: - GET @@ -4109,18 +4196,13 @@ components: status: ACTIVE alg: RS256 e: AQAB - 'n': >- - g0MirhrysJMPm_wK45jvMbbyanfhl-jmTBv0o69GeifPaISaXGv8LKn3-CyJvUJcjjeHE17KtumJWVxUDRzFqtIMZ1ctCZyIAuWO0n - LKilg7_EIDXJrS8k14biqkPO1lXGFwtjo3zLHeFSLw6sWf-CEN9zv6Ff3IAXb-RMYpfh-bVrxIgWsWCxjLW-UKI3la-gs0nWHH2PJr5HLJuI - JIOL5HLJuIJIOLWahqTnm_r1LSCSYr6N4C-fh--w2_BW8DzTHalBYe76bNr0d7AqtR4tGazmrvrc79Wa2bjyxmhhN1u9jSaZQqq-3VZEod8q3, - WHH2PJ5v1LoXniJQ4a2W8nDVqb6h4E8MUKYOpljTfQ + 'n': g0MirhrysJMPm_wK45jvMbbyanfhl-jmTBv0o69GeifPaISaXGv8LKn3-CyJvUJcjjeHE17KtumJWVxUDRzFqtIMZ1ctCZyIAuWO0n LKilg7_EIDXJrS8k14biqkPO1lXGFwtjo3zLHeFSLw6sWf-CEN9zv6Ff3IAXb-RMYpfh-bVrxIgWsWCxjLW-UKI3la-gs0nWHH2PJr5HLJuI JIOL5HLJuIJIOLWahqTnm_r1LSCSYr6N4C-fh--w2_BW8DzTHalBYe76bNr0d7AqtR4tGazmrvrc79Wa2bjyxmhhN1u9jSaZQqq-3VZEod8q3, WHH2PJ5v1LoXniJQ4a2W8nDVqb6h4E8MUKYOpljTfQ kid: RQ8DuhdxCczyMvy7GNJb4Ka3lQ99vrSo3oFBUiZjzzc kty: RSA use: sig _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/credentials/keys/RQ8DuhdxCczyMvy7GNJb4Ka3lQ99vrSo3oFBUiZjzzc + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/credentials/keys/RQ8DuhdxCczyMvy7GNJb4Ka3lQ99vrSo3oFBUiZjzzc hints: allow: - GET @@ -4130,21 +4212,13 @@ components: status: NEXT alg: RS256 e: AQAB - 'n': >- - l1hZ_g2sgBE3oHvu34T-5XP18FYJWgtul_nRNg-5xra5ySkaXEOJUDRERUG0HrR42uqf9jYrUTwg9fp-SqqNIdHRaN8EwRSDRsKAwK - 3 - HIJ2NJfgmrrO2ABkeyUq6rzHxAumiKv1iLFpSawSIiTEBJERtUCDcjbbqyHVFuivIFgH8L37 - - XDIDb0XG - R8DOoOHLJPTpsgH - rJe - M5w96VIRZInsGC5OGWkFdtgk6OkbvVd7_TXcxLCpWeg1vlbmX - 0 - TmG5yjSj7ek05txcpxIqYu - 7 FIGT0KKvXge_BOSEUlJpBhLKU28 OtsOnmc3NLIGXB - - GeDiUZiBYQdPR - myB4ZoQ + 'n': l1hZ_g2sgBE3oHvu34T-5XP18FYJWgtul_nRNg-5xra5ySkaXEOJUDRERUG0HrR42uqf9jYrUTwg9fp-SqqNIdHRaN8EwRSDRsKAwK 3 HIJ2NJfgmrrO2ABkeyUq6rzHxAumiKv1iLFpSawSIiTEBJERtUCDcjbbqyHVFuivIFgH8L37 - XDIDb0XG - R8DOoOHLJPTpsgH - rJe M5w96VIRZInsGC5OGWkFdtgk6OkbvVd7_TXcxLCpWeg1vlbmX - 0 TmG5yjSj7ek05txcpxIqYu - 7 FIGT0KKvXge_BOSEUlJpBhLKU28 OtsOnmc3NLIGXB - GeDiUZiBYQdPR - myB4ZoQ kid: Y3vBOdYT-l-I0j-gRQ26XjutSX00TeWiSguuDhW3ngo kty: RSA use: sig _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/credentials/keys/Y3vBOdYT-l-I0j-gRQ26XjutSX00TeWiSguuDhW3ngo + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/credentials/keys/Y3vBOdYT-l-I0j-gRQ26XjutSX00TeWiSguuDhW3ngo hints: allow: - GET @@ -4154,19 +4228,13 @@ components: status: EXPIRED alg: RS256 e: AQAB - 'n': >- - lC4ehVB6W0OCtNPnz8udYH9Ao83B6EKnHA5eTcMOap_lQZ-nKtS1lZwBj4wXRVc1XmS0d2OQFA1VMQ-dHLDE3CiGfsGqWbaiZFdW7U - GLO1nAwfDdH6xp3xwpKOMewDXbAHJlXdYYAe2ap - - CE9c5WLTUBU6JROuWcorHCNJisj1aExyiY5t3JQQVGpBz2oUIHo7NRzQoKimvp - dMvMzcYnTlk1dhlG11b1GTkBclprm1BmOP7Ltjd7aEumOJWS67nKcAZzl48Zyg5KtV11V9F9dkGt25qHauqFKL7w3wu - - DYhT0hmyFc wn - tXS6e6HQbfHhR_MQxysLtDGOk2ViWv8AQ + 'n': lC4ehVB6W0OCtNPnz8udYH9Ao83B6EKnHA5eTcMOap_lQZ-nKtS1lZwBj4wXRVc1XmS0d2OQFA1VMQ-dHLDE3CiGfsGqWbaiZFdW7U GLO1nAwfDdH6xp3xwpKOMewDXbAHJlXdYYAe2ap - CE9c5WLTUBU6JROuWcorHCNJisj1aExyiY5t3JQQVGpBz2oUIHo7NRzQoKimvp dMvMzcYnTlk1dhlG11b1GTkBclprm1BmOP7Ltjd7aEumOJWS67nKcAZzl48Zyg5KtV11V9F9dkGt25qHauqFKL7w3wu - DYhT0hmyFc wn - tXS6e6HQbfHhR_MQxysLtDGOk2ViWv8AQ kid: h5Sr3LXcpQiQlAUVPdhrdLFoIvkhRTAVs_h39bQnxlU kty: RSA use: sig _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/credentials/keys/h5Sr3LXcpQiQlAUVPdhrdLFoIvkhRTAVs_h39bQnxlU + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/credentials/keys/h5Sr3LXcpQiQlAUVPdhrdLFoIvkhRTAVs_h39bQnxlU hints: allow: - GET @@ -4197,22 +4265,19 @@ components: lastUpdated: '2017-06-07T15:28:17.000Z' _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/policies/00palyaappA22DPkj0h7 + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/policies/00palyaappA22DPkj0h7 hints: allow: - GET - PUT - DELETE deactivate: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/policies/00palyaappA22DPkj0h7/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/policies/00palyaappA22DPkj0h7/lifecycle/deactivate hints: allow: - POST rules: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/policies/00palyaappA22DPkj0h7/rules + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/policies/00palyaappA22DPkj0h7/rules hints: allow: - GET @@ -4247,22 +4312,19 @@ components: lastUpdated: '2017-06-07T15:28:17.000Z' _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/policies/00palyaappA22DPkj0h7 + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/policies/00palyaappA22DPkj0h7 hints: allow: - GET - PUT - DELETE deactivate: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/policies/00palyaappA22DPkj0h7/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/policies/00palyaappA22DPkj0h7/lifecycle/deactivate hints: allow: - POST rules: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/policies/00palyaappA22DPkj0h7/rules + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/policies/00palyaappA22DPkj0h7/rules hints: allow: - GET @@ -4318,16 +4380,14 @@ components: id: cal4egvp1mbMldrYN0g7 _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authServerId}/policies/{policyId}/rules/0prbsjfyl01zfSZ9K0h7 + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authServerId}/policies/{policyId}/rules/0prbsjfyl01zfSZ9K0h7 hints: allow: - GET - PUT - DELETE deactivate: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authServerId}/policies/{policyId}/rules/0prbsjfyl01zfSZ9K0h7/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authServerId}/policies/{policyId}/rules/0prbsjfyl01zfSZ9K0h7/lifecycle/deactivate hints: allow: - POST @@ -4396,16 +4456,14 @@ components: id: cal4egvp1mbMldrYN0g7 _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authServerId}/policies/{policyId}/rules/0prbsjfyl01zfSZ9K0h7 + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authServerId}/policies/{policyId}/rules/0prbsjfyl01zfSZ9K0h7 hints: allow: - GET - PUT - DELETE deactivate: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authServerId}/policies/{policyId}/rules/0prbsjfyl01zfSZ9K0h7/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authServerId}/policies/{policyId}/rules/0prbsjfyl01zfSZ9K0h7/lifecycle/deactivate hints: allow: - POST @@ -4443,11 +4501,7 @@ components: - status: ACTIVE id: apk40n33xfjbPaf6D0g5 e: AQAB - 'n': >- - g0MirhrysJMPm_wK45jvMbbyanfhl-jmTBv0o69GeifPaISaXGv8LKn3-CyJvUJcjjeHE17KtumJWVxUDRzFqtIMZ1ctCZyIAuWO0n - LKilg7_EIDXJrS8k14biqkPO1lXGFwtjo3zLHeFSLw6sWf-CEN9zv6Ff3IAXb-RMYpfh-bVrxIgWsWCxjLW-UKI3la-gs0nWHH2PJr5HLJuI - JIOL5HLJuIJIOLWahqTnm_r1LSCSYr6N4C-fh--w2_BW8DzTHalBYe76bNr0d7AqtR4tGazmrvrc79Wa2bjyxmhhN1u9jSaZQqq-3VZEod8q3, - WHH2PJ5v1LoXniJQ4a2W8nDVqb6h4E8MUKYOpljTfQ + 'n': g0MirhrysJMPm_wK45jvMbbyanfhl-jmTBv0o69GeifPaISaXGv8LKn3-CyJvUJcjjeHE17KtumJWVxUDRzFqtIMZ1ctCZyIAuWO0n LKilg7_EIDXJrS8k14biqkPO1lXGFwtjo3zLHeFSLw6sWf-CEN9zv6Ff3IAXb-RMYpfh-bVrxIgWsWCxjLW-UKI3la-gs0nWHH2PJr5HLJuI JIOL5HLJuIJIOLWahqTnm_r1LSCSYr6N4C-fh--w2_BW8DzTHalBYe76bNr0d7AqtR4tGazmrvrc79Wa2bjyxmhhN1u9jSaZQqq-3VZEod8q3, WHH2PJ5v1LoXniJQ4a2W8nDVqb6h4E8MUKYOpljTfQ kid: RQ8DuhdxCczyMvy7GNJb4Ka3lQ99vrSo3oFBUiZjzzc kty: RSA use: enc @@ -4455,22 +4509,14 @@ components: lastUpdated: '2023-04-06T21:32:33.000Z' _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/resourceservercredentials/keys/RQ8DuhdxCczyMvy7GNJb4Ka3lQ99vrSo3oFBUiZjzzc + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/resourceservercredentials/keys/RQ8DuhdxCczyMvy7GNJb4Ka3lQ99vrSo3oFBUiZjzzc hints: allow: - GET - status: INACTIVE id: apk33a45xfjbDfg6D0g5 e: AQAB - 'n': >- - l1hZ_g2sgBE3oHvu34T-5XP18FYJWgtul_nRNg-5xra5ySkaXEOJUDRERUG0HrR42uqf9jYrUTwg9fp-SqqNIdHRaN8EwRSDRsKAwK - 3 - HIJ2NJfgmrrO2ABkeyUq6rzHxAumiKv1iLFpSawSIiTEBJERtUCDcjbbqyHVFuivIFgH8L37 - - XDIDb0XG - R8DOoOHLJPTpsgH - rJe - M5w96VIRZInsGC5OGWkFdtgk6OkbvVd7_TXcxLCpWeg1vlbmX - 0 - TmG5yjSj7ek05txcpxIqYu - 7 FIGT0KKvXge_BOSEUlJpBhLKU28 - OtsOnmc3NLIGXB - GeDiUZiBYQdPR - myB4ZoQ + 'n': l1hZ_g2sgBE3oHvu34T-5XP18FYJWgtul_nRNg-5xra5ySkaXEOJUDRERUG0HrR42uqf9jYrUTwg9fp-SqqNIdHRaN8EwRSDRsKAwK 3 HIJ2NJfgmrrO2ABkeyUq6rzHxAumiKv1iLFpSawSIiTEBJERtUCDcjbbqyHVFuivIFgH8L37 - XDIDb0XG - R8DOoOHLJPTpsgH - rJe M5w96VIRZInsGC5OGWkFdtgk6OkbvVd7_TXcxLCpWeg1vlbmX - 0 TmG5yjSj7ek05txcpxIqYu - 7 FIGT0KKvXge_BOSEUlJpBhLKU28 OtsOnmc3NLIGXB - GeDiUZiBYQdPR - myB4ZoQ kid: Y3vBOdYT-l-I0j-gRQ26XjutSX00TeWiSguuDhW3ngo kty: RSA use: enc @@ -4478,8 +4524,7 @@ components: lastUpdated: '2023-04-06T21:32:33.000Z' _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/resourceservercredentials/keys/Y3vBOdYT-l-I0j-gRQ26XjutSX00TeWiSguuDhW3ngo + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/resourceservercredentials/keys/Y3vBOdYT-l-I0j-gRQ26XjutSX00TeWiSguuDhW3ngo hints: allow: - GET @@ -4507,8 +4552,7 @@ components: lastUpdated: '2023-04-06T21:32:33.000Z' _links: delete: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/resourceservercredentials/keys/RQ8DuhdxCczyMvy7GNJb4Ka3lQ99vrSo3oFBUiZjzzc/lifecycle/delete + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/resourceservercredentials/keys/RQ8DuhdxCczyMvy7GNJb4Ka3lQ99vrSo3oFBUiZjzzc/lifecycle/delete hints: allow: - DELETE @@ -4527,9 +4571,7 @@ components: errorLink: E0000001 errorId: sampleQPivGUj_ND5v78vbYWW errorCauses: - - errorSummary: >- - RSA key length in the 'jwks' is less than '2,048' bits for the - given key. + - errorSummary: RSA key length in the 'jwks' is less than '2,048' bits for the given key. ErrorJsonWebKeyTooManyKids: value: errorCode: E0000001 @@ -4537,10 +4579,7 @@ components: errorLink: E0000001 errorId: sampleQPivGUj_ND5v78vbYWW errorCauses: - - errorSummary: >- - You can't create a new key. You have reached the maximum number of - keys allowed (5). To add another key, you must first delete an - existing one. + - errorSummary: You can't create a new key. You have reached the maximum number of keys allowed (5). To add another key, you must first delete an existing one. ErrorJsonWebKeyCannotAddActiveKey: value: errorCode: E0000001, @@ -4548,19 +4587,15 @@ components: errorLink: E0000001, errorId: sampleQPivGUj_ND5v78vbYWW, errorCauses: - - errorSummary: >- - Keys cannot be created with an ''ACTIVE'' status. Create an - ''INACTIVE'' key and then activate it. - ErrorDeleteActiveJsonWebKey: + - errorSummary: Keys cannot be created with an ''ACTIVE'' status. Create an ''INACTIVE'' key and then activate it. + ErrorDeleteCustomAsActiveJsonWebKey: value: errorCode: E0000001 errorSummary: 'Api validation failed: JsonWebKey' errorLink: E0000001 errorId: sampleQPivGUj_ND5v78vbYWW errorCauses: - - errorSummary: >- - ''ACTIVE'' keys cannot be deleted. Activate another key before - deleting this one. + - errorSummary: '''''ACTIVE'''' keys cannot be deleted. Activate another key before deleting this one.' ErrorDeactivateActiveKey: value: errorCode: E0000001 @@ -4568,9 +4603,7 @@ components: errorLink: E0000001 errorId: sampleQPivGUj_ND5v78vbYWW errorCauses: - - errorSummary: >- - You cannot deactivate the active key when access token encryption - is enabled. + - errorSummary: You cannot deactivate the active key when access token encryption is enabled. ExampleOAuth2Scopes: summary: All scopes value: @@ -4585,8 +4618,7 @@ components: metadataPublish: NO_CLIENTS _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes/scp5yu8kLOnDzo7lh0g4 + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes/scp5yu8kLOnDzo7lh0g4 hints: allow: - GET @@ -4613,8 +4645,7 @@ components: metadataPublish: NO_CLIENTS _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes/scp5yu8kLOnDzo7lh0g4 + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes/scp5yu8kLOnDzo7lh0g4 hints: allow: - GET @@ -4640,8 +4671,7 @@ components: metadataPublish: ALL_CLIENTS _links: self: - href: >- - https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes/scp5yu8kLOnDzo7lh0g4 + href: https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes/scp5yu8kLOnDzo7lh0g4 hints: allow: - GET @@ -4699,7 +4729,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.authorization_servers + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListAuthorizationServersResponse' + transform: + body: |- + {{- $wrapped := printf "{\"authorization_servers\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_authorization_server: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1authorizationServers/post' response: @@ -4712,6 +4754,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_authorization_server: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}/put' response: @@ -4721,38 +4766,31 @@ components: operation: $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' activate_authorization_server: operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1lifecycle~1activate/post + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1lifecycle~1activate/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' deactivate_authorization_server: operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1lifecycle~1deactivate/post + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1lifecycle~1deactivate/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/authorization_servers/methods/list_authorization_servers - - $ref: >- - #/components/x-stackQL-resources/authorization_servers/methods/get_authorization_server + - $ref: '#/components/x-stackQL-resources/authorization_servers/methods/get_authorization_server' + - $ref: '#/components/x-stackQL-resources/authorization_servers/methods/list_authorization_servers' insert: - - $ref: >- - #/components/x-stackQL-resources/authorization_servers/methods/create_authorization_server + - $ref: '#/components/x-stackQL-resources/authorization_servers/methods/create_authorization_server' update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/authorization_servers/methods/delete_authorization_server + - $ref: '#/components/x-stackQL-resources/authorization_servers/methods/delete_authorization_server' replace: - - $ref: >- - #/components/x-stackQL-resources/authorization_servers/methods/replace_authorization_server + - $ref: '#/components/x-stackQL-resources/authorization_servers/methods/replace_authorization_server' associated_servers: id: okta.authorizationservers.associated_servers name: associated_servers @@ -4760,36 +4798,51 @@ components: methods: list_associated_servers_by_trusted_type: operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1associatedServers/get + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1associatedServers/get' response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.associated_servers_by_trusted_type + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListAssociatedServersByTrustedTypeResponse' + transform: + body: |- + {{- $wrapped := printf "{\"associated_servers_by_trusted_type\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_associated_servers: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1associatedServers/post + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1associatedServers/post' response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.create_associated_servers + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/CreateAssociatedServersResponse' + transform: + body: |- + {{- $wrapped := printf "{\"create_associated_servers\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 delete_associated_server: operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1associatedServers~1{associatedServerId}/delete + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1associatedServers~1{associatedServerId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/associated_servers/methods/list_associated_servers_by_trusted_type + - $ref: '#/components/x-stackQL-resources/associated_servers/methods/list_associated_servers_by_trusted_type' insert: - - $ref: >- - #/components/x-stackQL-resources/associated_servers/methods/create_associated_servers + - $ref: '#/components/x-stackQL-resources/associated_servers/methods/create_associated_servers' update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/associated_servers/methods/delete_associated_server + - $ref: '#/components/x-stackQL-resources/associated_servers/methods/delete_associated_server' replace: [] claims: id: okta.authorizationservers.claims @@ -4798,53 +4851,60 @@ components: methods: list_oauth2_claims: operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1claims/get + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1claims/get' response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.oauth2_claims + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListOAuth2ClaimsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"oauth2_claims\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_oauth2_claim: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1claims/post + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1claims/post' response: mediaType: application/json openAPIDocKey: '201' get_oauth2_claim: operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1claims~1{claimId}/get + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1claims~1{claimId}/get' response: mediaType: application/json openAPIDocKey: '200' replace_oauth2_claim: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1claims~1{claimId}/put + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1claims~1{claimId}/put' response: mediaType: application/json openAPIDocKey: '200' delete_oauth2_claim: operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1claims~1{claimId}/delete + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1claims~1{claimId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: '#/components/x-stackQL-resources/claims/methods/list_oauth2_claims' - $ref: '#/components/x-stackQL-resources/claims/methods/get_oauth2_claim' + - $ref: '#/components/x-stackQL-resources/claims/methods/list_oauth2_claims' insert: - - $ref: >- - #/components/x-stackQL-resources/claims/methods/create_oauth2_claim + - $ref: '#/components/x-stackQL-resources/claims/methods/create_oauth2_claim' update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/claims/methods/delete_oauth2_claim + - $ref: '#/components/x-stackQL-resources/claims/methods/delete_oauth2_claim' replace: - - $ref: >- - #/components/x-stackQL-resources/claims/methods/replace_oauth2_claim + - $ref: '#/components/x-stackQL-resources/claims/methods/replace_oauth2_claim' clients: id: okta.authorizationservers.clients name: clients @@ -4852,15 +4912,22 @@ components: methods: list_oauth2_clients_for_authorization_server: operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1clients/get + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1clients/get' response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.oauth2_clients_for_authorization_server + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListOAuth2ClientsForAuthorizationServerResponse' + transform: + body: |- + {{- $wrapped := printf "{\"oauth2_clients_for_authorization_server\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/clients/methods/list_oauth2_clients_for_authorization_server + - $ref: '#/components/x-stackQL-resources/clients/methods/list_oauth2_clients_for_authorization_server' insert: [] update: [] delete: [] @@ -4872,45 +4939,46 @@ components: methods: list_refresh_tokens_for_authorization_server_and_client: operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1clients~1{clientId}~1tokens/get + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1clients~1{clientId}~1tokens/get' response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.refresh_tokens_for_authorization_server_and_client + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListRefreshTokensForAuthorizationServerAndClientResponse' + transform: + body: |- + {{- $wrapped := printf "{\"refresh_tokens_for_authorization_server_and_client\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 revoke_refresh_tokens_for_authorization_server_and_client: operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1clients~1{clientId}~1tokens/delete + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1clients~1{clientId}~1tokens/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' get_refresh_token_for_authorization_server_and_client: operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1clients~1{clientId}~1tokens~1{tokenId}/get + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1clients~1{clientId}~1tokens~1{tokenId}/get' response: mediaType: application/json openAPIDocKey: '200' revoke_refresh_token_for_authorization_server_and_client: operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1clients~1{clientId}~1tokens~1{tokenId}/delete + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1clients~1{clientId}~1tokens~1{tokenId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/refresh_tokens/methods/list_refresh_tokens_for_authorization_server_and_client - - $ref: >- - #/components/x-stackQL-resources/refresh_tokens/methods/get_refresh_token_for_authorization_server_and_client + - $ref: '#/components/x-stackQL-resources/refresh_tokens/methods/get_refresh_token_for_authorization_server_and_client' + - $ref: '#/components/x-stackQL-resources/refresh_tokens/methods/list_refresh_tokens_for_authorization_server_and_client' insert: [] update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/refresh_tokens/methods/revoke_refresh_tokens_for_authorization_server_and_client - - $ref: >- - #/components/x-stackQL-resources/refresh_tokens/methods/revoke_refresh_token_for_authorization_server_and_client + - $ref: '#/components/x-stackQL-resources/refresh_tokens/methods/revoke_refresh_token_for_authorization_server_and_client' + - $ref: '#/components/x-stackQL-resources/refresh_tokens/methods/revoke_refresh_tokens_for_authorization_server_and_client' replace: [] keys: id: okta.authorizationservers.keys @@ -4919,31 +4987,47 @@ components: methods: list_authorization_server_keys: operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1credentials~1keys/get + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1credentials~1keys/get' response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.authorization_server_keys + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListAuthorizationServerKeysResponse' + transform: + body: |- + {{- $wrapped := printf "{\"authorization_server_keys\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 get_authorization_server_key: operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1credentials~1keys~1{keyId}/get + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1credentials~1keys~1{keyId}/get' response: mediaType: application/json openAPIDocKey: '200' rotate_authorization_server_keys: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1credentials~1lifecycle~1keyRotate/post + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1credentials~1lifecycle~1keyRotate/post' response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.rotate_authorization_server_keys + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/RotateAuthorizationServerKeysResponse' + transform: + body: |- + {{- $wrapped := printf "{\"rotate_authorization_server_keys\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/keys/methods/list_authorization_server_keys - - $ref: >- - #/components/x-stackQL-resources/keys/methods/get_authorization_server_key + - $ref: '#/components/x-stackQL-resources/keys/methods/get_authorization_server_key' + - $ref: '#/components/x-stackQL-resources/keys/methods/list_authorization_server_keys' insert: [] update: [] delete: [] @@ -4955,69 +5039,72 @@ components: methods: list_authorization_server_policies: operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1policies/get + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1policies/get' response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.authorization_server_policies + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListAuthorizationServerPoliciesResponse' + transform: + body: |- + {{- $wrapped := printf "{\"authorization_server_policies\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_authorization_server_policy: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1policies/post + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1policies/post' response: mediaType: application/json openAPIDocKey: '201' get_authorization_server_policy: operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1policies~1{policyId}/get + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1policies~1{policyId}/get' response: mediaType: application/json openAPIDocKey: '200' replace_authorization_server_policy: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1policies~1{policyId}/put + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1policies~1{policyId}/put' response: mediaType: application/json openAPIDocKey: '200' delete_authorization_server_policy: operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1policies~1{policyId}/delete + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1policies~1{policyId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' activate_authorization_server_policy: operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1policies~1{policyId}~1lifecycle~1activate/post + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1policies~1{policyId}~1lifecycle~1activate/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' deactivate_authorization_server_policy: operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1policies~1{policyId}~1lifecycle~1deactivate/post + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1policies~1{policyId}~1lifecycle~1deactivate/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/policies/methods/list_authorization_server_policies - - $ref: >- - #/components/x-stackQL-resources/policies/methods/get_authorization_server_policy + - $ref: '#/components/x-stackQL-resources/policies/methods/get_authorization_server_policy' + - $ref: '#/components/x-stackQL-resources/policies/methods/list_authorization_server_policies' insert: - - $ref: >- - #/components/x-stackQL-resources/policies/methods/create_authorization_server_policy + - $ref: '#/components/x-stackQL-resources/policies/methods/create_authorization_server_policy' update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/policies/methods/delete_authorization_server_policy + - $ref: '#/components/x-stackQL-resources/policies/methods/delete_authorization_server_policy' replace: - - $ref: >- - #/components/x-stackQL-resources/policies/methods/replace_authorization_server_policy + - $ref: '#/components/x-stackQL-resources/policies/methods/replace_authorization_server_policy' rules: id: okta.authorizationservers.rules name: rules @@ -5025,69 +5112,72 @@ components: methods: list_authorization_server_policy_rules: operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1policies~1{policyId}~1rules/get + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1policies~1{policyId}~1rules/get' response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.authorization_server_policy_rules + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListAuthorizationServerPolicyRulesResponse' + transform: + body: |- + {{- $wrapped := printf "{\"authorization_server_policy_rules\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_authorization_server_policy_rule: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1policies~1{policyId}~1rules/post + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1policies~1{policyId}~1rules/post' response: mediaType: application/json openAPIDocKey: '201' get_authorization_server_policy_rule: operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1policies~1{policyId}~1rules~1{ruleId}/get + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1policies~1{policyId}~1rules~1{ruleId}/get' response: mediaType: application/json openAPIDocKey: '200' replace_authorization_server_policy_rule: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1policies~1{policyId}~1rules~1{ruleId}/put + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1policies~1{policyId}~1rules~1{ruleId}/put' response: mediaType: application/json openAPIDocKey: '200' delete_authorization_server_policy_rule: operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1policies~1{policyId}~1rules~1{ruleId}/delete + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1policies~1{policyId}~1rules~1{ruleId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' activate_authorization_server_policy_rule: operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1policies~1{policyId}~1rules~1{ruleId}~1lifecycle~1activate/post + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1policies~1{policyId}~1rules~1{ruleId}~1lifecycle~1activate/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' deactivate_authorization_server_policy_rule: operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1policies~1{policyId}~1rules~1{ruleId}~1lifecycle~1deactivate/post + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1policies~1{policyId}~1rules~1{ruleId}~1lifecycle~1deactivate/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/rules/methods/list_authorization_server_policy_rules - - $ref: >- - #/components/x-stackQL-resources/rules/methods/get_authorization_server_policy_rule + - $ref: '#/components/x-stackQL-resources/rules/methods/get_authorization_server_policy_rule' + - $ref: '#/components/x-stackQL-resources/rules/methods/list_authorization_server_policy_rules' insert: - - $ref: >- - #/components/x-stackQL-resources/rules/methods/create_authorization_server_policy_rule + - $ref: '#/components/x-stackQL-resources/rules/methods/create_authorization_server_policy_rule' update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/rules/methods/delete_authorization_server_policy_rule + - $ref: '#/components/x-stackQL-resources/rules/methods/delete_authorization_server_policy_rule' replace: - - $ref: >- - #/components/x-stackQL-resources/rules/methods/replace_authorization_server_policy_rule + - $ref: '#/components/x-stackQL-resources/rules/methods/replace_authorization_server_policy_rule' oauth2_resource_server_jwks: id: okta.authorizationservers.oauth2_resource_server_jwks name: oauth2_resource_server_jwks @@ -5095,59 +5185,61 @@ components: methods: list_oauth2_resource_server_json_web_keys: operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1resourceservercredentials~1keys/get + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1resourceservercredentials~1keys/get' response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.oauth2_resource_server_json_web_keys + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListOAuth2ResourceServerJsonWebKeysResponse' + transform: + body: |- + {{- $wrapped := printf "{\"oauth2_resource_server_json_web_keys\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 add_oauth2_resource_server_json_web_key: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1resourceservercredentials~1keys/post + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1resourceservercredentials~1keys/post' response: mediaType: application/json openAPIDocKey: '201' get_oauth2_resource_server_json_web_key: operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1resourceservercredentials~1keys~1{keyId}/get + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1resourceservercredentials~1keys~1{keyId}/get' response: mediaType: application/json openAPIDocKey: '200' delete_oauth2_resource_server_json_web_key: operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1resourceservercredentials~1keys~1{keyId}/delete + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1resourceservercredentials~1keys~1{keyId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' activate_oauth2_resource_server_json_web_key: operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1resourceservercredentials~1keys~1{keyId}~1lifecycle~1activate/post + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1resourceservercredentials~1keys~1{keyId}~1lifecycle~1activate/post' response: mediaType: application/json openAPIDocKey: '200' deactivate_oauth2_resource_server_json_web_key: operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1resourceservercredentials~1keys~1{keyId}~1lifecycle~1deactivate/post + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1resourceservercredentials~1keys~1{keyId}~1lifecycle~1deactivate/post' response: mediaType: application/json openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/oauth2_resource_server_jwks/methods/list_oauth2_resource_server_json_web_keys - - $ref: >- - #/components/x-stackQL-resources/oauth2_resource_server_jwks/methods/get_oauth2_resource_server_json_web_key + - $ref: '#/components/x-stackQL-resources/oauth2_resource_server_jwks/methods/get_oauth2_resource_server_json_web_key' + - $ref: '#/components/x-stackQL-resources/oauth2_resource_server_jwks/methods/list_oauth2_resource_server_json_web_keys' insert: - - $ref: >- - #/components/x-stackQL-resources/oauth2_resource_server_jwks/methods/add_oauth2_resource_server_json_web_key + - $ref: '#/components/x-stackQL-resources/oauth2_resource_server_jwks/methods/add_oauth2_resource_server_json_web_key' update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/oauth2_resource_server_jwks/methods/delete_oauth2_resource_server_json_web_key + - $ref: '#/components/x-stackQL-resources/oauth2_resource_server_jwks/methods/delete_oauth2_resource_server_json_web_key' replace: [] scopes: id: okta.authorizationservers.scopes @@ -5156,59 +5248,74 @@ components: methods: list_oauth2_scopes: operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1scopes/get + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1scopes/get' response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.oauth2_scopes + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListOAuth2ScopesResponse' + transform: + body: |- + {{- $wrapped := printf "{\"oauth2_scopes\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_oauth2_scope: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1scopes/post + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1scopes/post' response: mediaType: application/json openAPIDocKey: '201' get_oauth2_scope: operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1scopes~1{scopeId}/get + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1scopes~1{scopeId}/get' response: mediaType: application/json openAPIDocKey: '200' replace_oauth2_scope: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1scopes~1{scopeId}/put + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1scopes~1{scopeId}/put' response: mediaType: application/json openAPIDocKey: '200' delete_oauth2_scope: operation: - $ref: >- - #/paths/~1api~1v1~1authorizationServers~1{authServerId}~1scopes~1{scopeId}/delete + $ref: '#/paths/~1api~1v1~1authorizationServers~1{authServerId}~1scopes~1{scopeId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: '#/components/x-stackQL-resources/scopes/methods/list_oauth2_scopes' - $ref: '#/components/x-stackQL-resources/scopes/methods/get_oauth2_scope' + - $ref: '#/components/x-stackQL-resources/scopes/methods/list_oauth2_scopes' insert: - - $ref: >- - #/components/x-stackQL-resources/scopes/methods/create_oauth2_scope + - $ref: '#/components/x-stackQL-resources/scopes/methods/create_oauth2_scope' update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/scopes/methods/delete_oauth2_scope + - $ref: '#/components/x-stackQL-resources/scopes/methods/delete_oauth2_scope' replace: - - $ref: >- - #/components/x-stackQL-resources/scopes/methods/replace_oauth2_scope + - $ref: '#/components/x-stackQL-resources/scopes/methods/replace_oauth2_scope' servers: - url: https://{subdomain}.okta.com/ variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/behaviors.yaml b/providers/src/okta/v00.00.00000/services/behaviors.yaml index 89c18096..53c42a9f 100644 --- a/providers/src/okta/v00.00.00000/services/behaviors.yaml +++ b/providers/src/okta/v00.00.00000/services/behaviors.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: behaviors API description: okta behaviors API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/behaviors: get: @@ -15,9 +15,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/BehaviorRule' + $ref: '#/components/schemas/ListBehaviorDetectionRulesResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '429': @@ -114,6 +112,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathBehaviorId' put: summary: Replace a behavior detection rule description: Replaces a Behavior Detection Rule by `behaviorId` @@ -169,6 +169,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathBehaviorId' delete: summary: Delete a behavior detection rule description: Deletes a Behavior Detection Rule by `behaviorId` @@ -198,8 +200,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathBehaviorId' + parameters: + - $ref: '#/components/parameters/pathBehaviorId' /api/v1/behaviors/{behaviorId}/lifecycle/activate: post: summary: Activate a behavior detection rule @@ -230,8 +232,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathBehaviorId' + parameters: + - $ref: '#/components/parameters/pathBehaviorId' /api/v1/behaviors/{behaviorId}/lifecycle/deactivate: post: summary: Deactivate a behavior detection rule @@ -262,8 +264,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathBehaviorId' + parameters: + - $ref: '#/components/parameters/pathBehaviorId' components: schemas: BehaviorRule: @@ -302,6 +304,7 @@ components: ANOMALOUS_IP: '#/components/schemas/BehaviorRuleAnomalousIP' ANOMALOUS_DEVICE: '#/components/schemas/BehaviorRuleAnomalousDevice' VELOCITY: '#/components/schemas/BehaviorRuleVelocity' + ANOMALOUS_ASN: '#/components/schemas/BehaviorRuleASN' Error: title: Error type: object @@ -339,6 +342,7 @@ components: - ANOMALOUS_IP - ANOMALOUS_LOCATION - VELOCITY + - ANOMALOUS_ASN LinksSelf: description: >- Specifies link relations (see [Web @@ -358,10 +362,38 @@ components: errorSummary: type: string HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object additionalProperties: true type: object @@ -405,6 +437,13 @@ components: - GET - POST - PUT + ListBehaviorDetectionRulesResponse: + type: object + properties: + behavior_detection_rules: + type: array + items: + $ref: '#/components/schemas/BehaviorRule' responses: ErrorAccessDenied403: description: Forbidden @@ -510,7 +549,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.behavior_detection_rules + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListBehaviorDetectionRulesResponse' + transform: + body: |- + {{- $wrapped := printf "{\"behavior_detection_rules\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_behavior_detection_rule: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1behaviors/post' response: @@ -523,6 +574,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_behavior_detection_rule: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1behaviors~1{behaviorId}/put' response: @@ -532,7 +586,7 @@ components: operation: $ref: '#/paths/~1api~1v1~1behaviors~1{behaviorId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' activate_behavior_detection_rule: operation: @@ -550,10 +604,10 @@ components: openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/behavior_detection_rules/methods/list_behavior_detection_rules - $ref: >- #/components/x-stackQL-resources/behavior_detection_rules/methods/get_behavior_detection_rule + - $ref: >- + #/components/x-stackQL-resources/behavior_detection_rules/methods/list_behavior_detection_rules insert: - $ref: >- #/components/x-stackQL-resources/behavior_detection_rules/methods/create_behavior_detection_rule @@ -569,7 +623,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/bot_protection.yaml b/providers/src/okta/v00.00.00000/services/bot_protection.yaml new file mode 100644 index 00000000..331e6661 --- /dev/null +++ b/providers/src/okta/v00.00.00000/services/bot_protection.yaml @@ -0,0 +1,474 @@ +openapi: 3.0.3 +info: + title: bot_protection API + description: okta bot_protection API + version: 2026.07.2 +paths: + /api/v1/bot-protection/configuration: + get: + summary: Retrieve the bot protection configuration + description: Retrieves the bot protection configuration for your org + operationId: getBotProtectionConfiguration + responses: + '200': + description: OK + content: + application/json: + schema: + $ref: '#/components/schemas/BotProtectionConfiguration' + examples: + Default: + $ref: '#/components/examples/BotProtectionConfigurationDefault' + Enforced: + $ref: '#/components/examples/BotProtectionConfigurationEnforced' + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: + - apiToken: [] + - oauth2: + - okta.botProtection.read + tags: + - BotProtection + x-okta-lifecycle: + lifecycle: LIMITED_GA + isGenerallyAvailable: false + SKUs: [] + post: + summary: Update the bot protection configuration + description: Updates the bot protection configuration for your org + operationId: updateBotProtectionConfiguration + x-codegen-request-body-name: botProtectionConfiguration + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/BotProtectionConfiguration' + examples: + LogOnly: + $ref: '#/components/examples/BotProtectionConfigurationRequestLogOnly' + Enforced: + $ref: >- + #/components/examples/BotProtectionConfigurationRequestEnforced + required: true + responses: + '200': + description: OK + content: + application/json: + schema: + $ref: '#/components/schemas/BotProtectionConfiguration' + examples: + LogOnly: + $ref: '#/components/examples/BotProtectionConfigurationDefault' + Enforced: + $ref: '#/components/examples/BotProtectionConfigurationEnforced' + '400': + description: Bad Request + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + examples: + ApiValidationFailed: + $ref: '#/components/examples/ErrorApiValidationFailed' + LevelRequired: + $ref: '#/components/examples/ErrorBotProtectionLevelRequired' + ModeRequired: + $ref: '#/components/examples/ErrorBotProtectionModeRequired' + EnforcementTypeRequired: + $ref: >- + #/components/examples/ErrorBotProtectionEnforcementTypeRequired + SupportedFlowsRequired: + $ref: >- + #/components/examples/ErrorBotProtectionSupportedFlowsRequired + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: + - apiToken: [] + - oauth2: + - okta.botProtection.manage + tags: + - BotProtection + x-okta-lifecycle: + lifecycle: LIMITED_GA + isGenerallyAvailable: false + SKUs: [] +components: + schemas: + BotProtectionConfiguration: + title: BotProtectionConfiguration + description: Bot protection configuration for the org + type: object + properties: + enforcementType: + $ref: '#/components/schemas/BotProtectionEnforcementType' + level: + $ref: '#/components/schemas/BotProtectionLevel' + mode: + $ref: '#/components/schemas/BotProtectionMode' + supportedFlows: + description: An array of authentication flows that have bot protection enabled + type: array + items: + $ref: '#/components/schemas/BotProtectionSupportedFlow' + _links: + $ref: '#/components/schemas/LinksSelf' + required: + - level + - mode + Error: + title: Error + type: object + properties: + errorCauses: + type: array + items: + $ref: '#/components/schemas/ErrorCause' + errorCode: + type: string + description: An Okta code for this type of error + errorId: + type: string + description: >- + A unique identifier for this error. This can be used by Okta Support + to help with troubleshooting. + errorLink: + type: string + description: An Okta code for this type of error + errorSummary: + type: string + description: >- + A short description of what caused this error. Sometimes this + contains dynamically-generated information about your specific + error. + BotProtectionEnforcementType: + description: The type of enforcement to trigger when a bot is detected + type: string + enum: + - OKTA_CHALLENGE + x-enumDescriptions: + OKTA_CHALLENGE: The Okta built-in challenge mechanism + BotProtectionLevel: + description: The sensitivity level of bot detection + type: string + enum: + - ANY + - HIGH + - LOW + - MEDIUM + x-enumDescriptions: + HIGH: >- + High - Flags only high-confidence bot requests. Prioritizes a + frictionless user experience. + MEDIUM: >- + Medium and above - Flags moderate and high-confidence bot requests. + Provides a balanced experience and security. + LOW: >- + Low and above - Flags low-confidence bot requests. Prioritizes a + rigorous security. + ANY: >- + Always flag all requests to trigger enforcement settings, regardless + of bot likeliness confidence level. + BotProtectionMode: + description: The enforcement mode for bot protection + type: string + enum: + - DISABLED + - ENFORCED + - LOG_ONLY + x-enumDescriptions: + DISABLED: Bot protection is disabled + LOG_ONLY: Bot detection events are logged but not enforced + ENFORCED: Enforcement is applied to events where bots are detected + BotProtectionSupportedFlow: + description: Authentication flows that support bot protection + type: string + enum: + - SIGN_IN + - SSPR + - SSR + x-enumDescriptions: + SIGN_IN: User sign-in page + SSPR: Self-Service Password Recovery page + SSR: Self-Service Registration page + LinksSelf: + description: >- + Specifies link relations (see [Web + Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the + [JSON Hypertext Application + Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) + specification. This object is used for dynamic discovery of related + resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + readOnly: true + ErrorCause: + type: object + properties: + errorSummary: + type: string + HrefObjectSelfLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) + HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + HrefHints: + description: Describes allowed HTTP verbs for the `href` + type: object + properties: + allow: + type: array + items: + $ref: '#/components/schemas/HttpMethod' + HttpMethod: + type: string + enum: + - DELETE + - GET + - POST + - PUT + responses: + ErrorAccessDenied403: + description: Forbidden + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + examples: + AccessDenied: + $ref: '#/components/examples/ErrorAccessDenied' + ErrorTooManyRequests429: + description: Too Many Requests + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + examples: + TooManyRequests: + $ref: '#/components/examples/ErrorTooManyRequests' + examples: + BotProtectionConfigurationDefault: + summary: Default bot protection configuration (`LOG_ONLY` mode) + value: + level: LOW + mode: LOG_ONLY + supportedFlows: + - SIGN_IN + - SSR + - SSPR + _links: + self: + href: https://{yourOktaDomain}/api/v1/bot-protection/configuration + hints: + allow: + - GET + - POST + BotProtectionConfigurationEnforced: + summary: Enforced bot protection configuration + value: + level: MEDIUM + mode: ENFORCED + enforcementType: OKTA_CHALLENGE + supportedFlows: + - SIGN_IN + - SSR + - SSPR + _links: + self: + href: https://{yourOktaDomain}/api/v1/bot-protection/configuration + hints: + allow: + - GET + - POST + BotProtectionConfigurationRequestLogOnly: + summary: Update to `LOG_ONLY` mode + value: + level: LOW + mode: LOG_ONLY + supportedFlows: + - SIGN_IN + - SSR + - SSPR + BotProtectionConfigurationRequestEnforced: + summary: Update to `ENFORCED` mode + value: + level: MEDIUM + mode: ENFORCED + enforcementType: OKTA_CHALLENGE + supportedFlows: + - SSR + - SSPR + ErrorApiValidationFailed: + summary: API Validation Failed + value: + errorCode: E0000001 + errorSummary: 'Api validation failed: {0}' + errorLink: E0000001 + errorId: sampleiCF-8D5rLW6myqiPItW + errorCauses: [] + ErrorBotProtectionLevelRequired: + summary: Level is required + value: + errorCode: E0000001 + errorSummary: 'Api validation failed: level' + errorLink: E0000001 + errorId: sampleiCF-8D5rLW6myqiPItW + errorCauses: + - errorSummary: 'level: The field cannot be left blank' + ErrorBotProtectionModeRequired: + summary: Mode is required + value: + errorCode: E0000001 + errorSummary: 'Api validation failed: mode' + errorLink: E0000001 + errorId: sampleiCF-8D5rLW6myqiPItW + errorCauses: + - errorSummary: 'mode: The field cannot be left blank' + ErrorBotProtectionEnforcementTypeRequired: + summary: Enforcement type is required when mode is ENFORCED + value: + errorCode: E0000001 + errorSummary: 'Api validation failed: enforcementType' + errorLink: E0000001 + errorId: sampleiCF-8D5rLW6myqiPItW + errorCauses: + - errorSummary: >- + enforcementType: Api validation failed: enforcementType must be + provided when mode is ENFORCED + ErrorBotProtectionSupportedFlowsRequired: + summary: Supported flows must have at least one flow + value: + errorCode: E0000001 + errorSummary: 'Api validation failed: supportedFlows' + errorLink: E0000001 + errorId: sampleiCF-8D5rLW6myqiPItW + errorCauses: + - errorSummary: >- + supportedFlows: Api validation failed: supportedFlows must have at + least one supported flow + ErrorAccessDenied: + summary: Access Denied + value: + errorCode: E0000006 + errorSummary: You do not have permission to perform the requested action + errorLink: E0000006 + errorId: sampleNUSD_8fdkFd8fs8SDBK + errorCauses: [] + ErrorTooManyRequests: + summary: Too Many Requests + value: + errorCode: E0000047 + errorSummary: API call exceeded rate limit due to too many requests. + errorLink: E0000047 + errorId: sampleQPivGUj_ND5v78vbYWW + errorCauses: [] + x-stackQL-resources: + bot_protection_configuration: + id: okta.bot_protection.bot_protection_configuration + name: bot_protection_configuration + title: Bot Protection Configuration + methods: + get_bot_protection_configuration: + operation: + $ref: '#/paths/~1api~1v1~1bot-protection~1configuration/get' + response: + mediaType: application/json + openAPIDocKey: '200' + update_bot_protection_configuration: + config: + requestBodyTranslate: + algorithm: naive + operation: + $ref: '#/paths/~1api~1v1~1bot-protection~1configuration/post' + response: + mediaType: application/json + openAPIDocKey: '200' + sqlVerbs: + select: + - $ref: >- + #/components/x-stackQL-resources/bot_protection_configuration/methods/get_bot_protection_configuration + insert: [] + update: + - $ref: >- + #/components/x-stackQL-resources/bot_protection_configuration/methods/update_bot_protection_configuration + delete: [] + replace: [] +servers: + - url: https://{subdomain}.okta.com/ + variables: + subdomain: + default: my-org +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/brands.yaml b/providers/src/okta/v00.00.00000/services/brands.yaml index fa1dbda1..681c8a09 100644 --- a/providers/src/okta/v00.00.00000/services/brands.yaml +++ b/providers/src/okta/v00.00.00000/services/brands.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: brands API description: okta brands API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/brands: get: @@ -20,9 +20,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/BrandWithEmbedded' + $ref: '#/components/schemas/ListBrandsResponse' examples: Get brands response: $ref: '#/components/examples/ListBrandsResponse' @@ -92,6 +90,7 @@ paths: operationId: getBrand parameters: - $ref: '#/components/parameters/queryExpandBrand' + - $ref: '#/components/parameters/pathBrandId' responses: '200': description: Successfully retrieved the brand @@ -119,16 +118,12 @@ paths: isGenerallyAvailable: true put: summary: Replace a brand - description: >+ + description: |+ Replaces a brand by `brandId` + Passing an invalid `brandId` returns a `404 Not Found` status code with the error code `E0000007`. - Passing an invalid `brandId` returns a `404 Not Found` status code with - the error code `E0000007`. - - - Not providing `agreeToCustomPrivacyPolicy` with `customPrivacyPolicyUrl` - returns a `400 Bad Request` status code with the error code `E0000001`. + Not providing `agreeToCustomPrivacyPolicy` with `customPrivacyPolicyUrl` returns a `400 Bad Request` status code with the error code `E0000001`. operationId: replaceBrand x-codegen-request-body-name: brand @@ -168,6 +163,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathBrandId' delete: summary: Delete a brand description: Deletes a brand by `brandId` @@ -201,8 +198,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathBrandId' + parameters: + - $ref: '#/components/parameters/pathBrandId' /api/v1/brands/{brandId}/domains: get: summary: List all domains associated with a brand @@ -230,14 +227,12 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathBrandId' + parameters: + - $ref: '#/components/parameters/pathBrandId' /api/v1/brands/{brandId}/pages/error: get: summary: Retrieve the error page sub-resources - description: >- - Retrieves the error page sub-resources. The `expand` query parameter - specifies which sub-resources to include in the response. + description: Retrieves the error page sub-resources. The `expand` query parameter specifies which sub-resources to include in the response. operationId: getErrorPage responses: '200': @@ -261,15 +256,13 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathBrandId' - - $ref: '#/components/parameters/queryExpandPageRoot' + parameters: + - $ref: '#/components/parameters/pathBrandId' + - $ref: '#/components/parameters/queryExpandPageRoot' /api/v1/brands/{brandId}/pages/error/customized: get: summary: Retrieve the customized error page - description: >- - Retrieves the customized error page. The customized error page appears - in your live environment. + description: Retrieves the customized error page. The customized error page appears in your live environment. operationId: getCustomizedErrorPage responses: '200': @@ -298,11 +291,11 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathBrandId' put: summary: Replace the customized error page - description: >- - Replaces the customized error page. The customized error page appears in - your live environment. + description: Replaces the customized error page. The customized error page appears in your live environment. operationId: replaceCustomizedErrorPage requestBody: content: @@ -339,11 +332,11 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathBrandId' delete: summary: Delete the customized error page - description: >- - Deletes the customized error page. As a result, the default error page - appears in your live environment. + description: Deletes the customized error page. As a result, the default error page appears in your live environment. operationId: deleteCustomizedErrorPage responses: '204': @@ -364,14 +357,12 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathBrandId' + parameters: + - $ref: '#/components/parameters/pathBrandId' /api/v1/brands/{brandId}/pages/error/default: get: summary: Retrieve the default error page - description: >- - Retrieves the default error page. The default error page appears when no - customized error page exists. + description: Retrieves the default error page. The default error page appears when no customized error page exists. operationId: getDefaultErrorPage responses: '200': @@ -395,15 +386,12 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathBrandId' + parameters: + - $ref: '#/components/parameters/pathBrandId' /api/v1/brands/{brandId}/pages/error/preview: get: summary: Retrieve the preview error page preview - description: >- - Retrieves the preview error page. The preview error page contains - unpublished changes and isn't shown in your live environment. Preview it - at `${yourOktaDomain}/error/preview`. + description: Retrieves the preview error page. The preview error page contains unpublished changes and isn't shown in your live environment. Preview it at `${yourOktaDomain}/error/preview`. operationId: getPreviewErrorPage responses: '200': @@ -432,12 +420,11 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathBrandId' put: summary: Replace the preview error page - description: >- - Replaces the preview error page. The preview error page contains - unpublished changes and isn't shown in your live environment. Preview it - at `${yourOktaDomain}/error/preview`. + description: Replaces the preview error page. The preview error page contains unpublished changes and isn't shown in your live environment. Preview it at `${yourOktaDomain}/error/preview`. operationId: replacePreviewErrorPage requestBody: content: @@ -474,12 +461,11 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathBrandId' delete: summary: Delete the preview error page - description: >- - Deletes the preview error page. The preview error page contains - unpublished changes and isn't shown in your live environment. Preview it - at `${yourOktaDomain}/error/preview`. + description: Deletes the preview error page. The preview error page contains unpublished changes and isn't shown in your live environment. Preview it at `${yourOktaDomain}/error/preview`. operationId: deletePreviewErrorPage responses: '204': @@ -500,14 +486,12 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathBrandId' + parameters: + - $ref: '#/components/parameters/pathBrandId' /api/v1/brands/{brandId}/pages/sign-in: get: summary: Retrieve the sign-in page sub-resources - description: >- - Retrieves the sign-in page sub-resources. The `expand` query parameter - specifies which sub-resources to include in the response. + description: Retrieves the sign-in page sub-resources. The `expand` query parameter specifies which sub-resources to include in the response. operationId: getSignInPage responses: '200': @@ -531,15 +515,13 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathBrandId' - - $ref: '#/components/parameters/queryExpandPageRoot' + parameters: + - $ref: '#/components/parameters/pathBrandId' + - $ref: '#/components/parameters/queryExpandPageRoot' /api/v1/brands/{brandId}/pages/sign-in/customized: get: summary: Retrieve the customized sign-in page - description: >- - Retrieves the customized sign-in page. The customized sign-in page - appears in your live environment. + description: Retrieves the customized sign-in page. The customized sign-in page appears in your live environment. operationId: getCustomizedSignInPage responses: '200': @@ -568,11 +550,11 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathBrandId' put: summary: Replace the customized sign-in page - description: >- - Replaces the customized sign-in page. The customized sign-in page - appears in your live environment. + description: Replaces the customized sign-in page. The customized sign-in page appears in your live environment. operationId: replaceCustomizedSignInPage requestBody: content: @@ -609,11 +591,11 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathBrandId' delete: summary: Delete the customized sign-in page - description: >- - Deletes the customized sign-in page. As a result, the default sign-in - page appears in your live environment. + description: Deletes the customized sign-in page. As a result, the default sign-in page appears in your live environment. operationId: deleteCustomizedSignInPage responses: '204': @@ -634,14 +616,12 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathBrandId' + parameters: + - $ref: '#/components/parameters/pathBrandId' /api/v1/brands/{brandId}/pages/sign-in/default: get: summary: Retrieve the default sign-in page - description: >- - Retrieves the default sign-in page. The default sign-in page appears - when no customized sign-in page exists. + description: Retrieves the default sign-in page. The default sign-in page appears when no customized sign-in page exists. operationId: getDefaultSignInPage responses: '200': @@ -665,15 +645,12 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathBrandId' + parameters: + - $ref: '#/components/parameters/pathBrandId' /api/v1/brands/{brandId}/pages/sign-in/preview: get: summary: Retrieve the preview sign-in page preview - description: >- - Retrieves the preview sign-in page. The preview sign-in page contains - unpublished changes and isn't shown in your live environment. Preview it - at `${yourOktaDomain}/login/preview`. + description: Retrieves the preview sign-in page. The preview sign-in page contains unpublished changes and isn't shown in your live environment. Preview it at `${yourOktaDomain}/login/preview`. operationId: getPreviewSignInPage responses: '200': @@ -702,12 +679,11 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathBrandId' put: summary: Replace the preview sign-in page - description: >- - Replaces the preview sign-in page. The preview sign-in page contains - unpublished changes and isn't shown in your live environment. Preview it - at `${yourOktaDomain}/login/preview`. + description: Replaces the preview sign-in page. The preview sign-in page contains unpublished changes and isn't shown in your live environment. Preview it at `${yourOktaDomain}/login/preview`. operationId: replacePreviewSignInPage requestBody: content: @@ -744,12 +720,11 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathBrandId' delete: summary: Delete the preview sign-in page - description: >- - Deletes the preview sign-in page. The preview sign-in page contains - unpublished changes and isn't shown in your live environment. Preview it - at `${yourOktaDomain}/login/preview`. + description: Deletes the preview sign-in page. The preview sign-in page contains unpublished changes and isn't shown in your live environment. Preview it at `${yourOktaDomain}/login/preview`. operationId: deletePreviewSignInPage responses: '204': @@ -770,8 +745,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathBrandId' + parameters: + - $ref: '#/components/parameters/pathBrandId' /api/v1/brands/{brandId}/pages/sign-in/widget-versions: get: summary: List all Sign-In Widget versions @@ -783,10 +758,7 @@ paths: content: application/json: schema: - type: array - items: - type: string - pattern: ^\d+\.\d+$ + $ref: '#/components/schemas/ListAllSignInWidgetVersionsResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -802,8 +774,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathBrandId' + parameters: + - $ref: '#/components/parameters/pathBrandId' /api/v1/brands/{brandId}/pages/sign-out/customized: get: summary: Retrieve the sign-out page settings @@ -831,6 +803,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathBrandId' put: summary: Replace the sign-out page settings description: Replaces the sign-out page settings @@ -865,8 +839,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathBrandId' + parameters: + - $ref: '#/components/parameters/pathBrandId' /api/v1/brands/{brandId}/templates/email: get: summary: List all email templates @@ -876,15 +850,14 @@ paths: - $ref: '#/components/parameters/queryAfter' - $ref: '#/components/parameters/queryLimit' - $ref: '#/components/parameters/queryExpandEmailTemplate' + - $ref: '#/components/parameters/pathBrandId' responses: '200': description: Successfully returned the list of email templates. content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/EmailTemplateResponse' + $ref: '#/components/schemas/ListEmailTemplatesResponse' examples: List email templates response: $ref: '#/components/examples/ListEmailTemplateResponse' @@ -892,10 +865,7 @@ paths: Link: schema: type: string - description: >- - The pagination header containing links to the current and next - page of results. See [Pagination]https://developer.okta.com/docs/api#pagination for more - information. + description: The pagination header containing links to the current and next page of results. See [Pagination]https://developer.okta.com/docs/api#pagination for more information. '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -911,8 +881,6 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathBrandId' /api/v1/brands/{brandId}/templates/email/{templateName}: get: summary: Retrieve an email template @@ -920,6 +888,8 @@ paths: operationId: getEmailTemplate parameters: - $ref: '#/components/parameters/queryExpandEmailTemplate' + - $ref: '#/components/parameters/pathBrandId' + - $ref: '#/components/parameters/pathTemplateName' responses: '200': description: Successfully retrieved the email template. @@ -945,35 +915,26 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathBrandId' - - $ref: '#/components/parameters/pathTemplateName' /api/v1/brands/{brandId}/templates/email/{templateName}/customizations: get: summary: List all email customizations - description: > + description: | Lists all customizations of an email template - - If Custom languages for Okta - Email Templates is enabled, all existing customizations are retrieved, - including customizations for additional languages. If disabled, only - customizations for Okta-supported languages are returned. + If Custom languages for Okta Email Templates is enabled, all existing customizations are retrieved, including customizations for additional languages. If disabled, only customizations for Okta-supported languages are returned. operationId: listEmailCustomizations parameters: - $ref: '#/components/parameters/queryAfter' - $ref: '#/components/parameters/queryLimit' + - $ref: '#/components/parameters/pathBrandId' + - $ref: '#/components/parameters/pathTemplateName' responses: '200': - description: >- - Successfully retrieved all email customizations for the specified - email template. + description: Successfully retrieved all email customizations for the specified email template. content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/EmailCustomization' + $ref: '#/components/schemas/ListEmailCustomizationsResponse' examples: List Email customizations response: $ref: '#/components/examples/ListEmailCustomizationResponse' @@ -994,13 +955,10 @@ paths: isGenerallyAvailable: true post: summary: Create an email customization - description: > + description: | Creates a new Email Customization - - If Custom languages for Okta - Email Templates is enabled, you can create a customization for any BCP47 - language in addition to the Okta-supported languages. + If Custom languages for Okta Email Templates is enabled, you can create a customization for any BCP47 language in addition to the Okta-supported languages. operationId: createEmailCustomization x-codegen-request-body-name: instance requestBody: @@ -1028,20 +986,16 @@ paths: '404': $ref: '#/components/responses/ErrorResourceNotFound404' '409': - description: >- - Could not create the email customization because it conflicts with - an existing email customization. + description: Could not create the email customization because it conflicts with an existing email customization. content: application/json: schema: $ref: '#/components/schemas/Error' examples: Default email customization already exists: - $ref: >- - #/components/examples/ErrorEmailCustomizationDefaultAlreadyExists + $ref: '#/components/examples/ErrorEmailCustomizationDefaultAlreadyExists' Email customization already exists for the specified language: - $ref: >- - #/components/examples/ErrorEmailCustomizationLanguageAlreadyExists + $ref: '#/components/examples/ErrorEmailCustomizationLanguageAlreadyExists' '429': $ref: '#/components/responses/ErrorTooManyRequests429' security: @@ -1053,16 +1007,15 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathBrandId' + - $ref: '#/components/parameters/pathTemplateName' delete: summary: Delete all email customizations - description: > + description: | Deletes all customizations for an email template - - If Custom languages for Okta - Email Templates is enabled, all customizations are deleted, including - customizations for additional languages. If disabled, only - customizations in Okta-supported languages are deleted. + If Custom languages for Okta Email Templates is enabled, all customizations are deleted, including customizations for additional languages. If disabled, only customizations in Okta-supported languages are deleted. operationId: deleteAllCustomizations responses: '204': @@ -1083,19 +1036,16 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathBrandId' - - $ref: '#/components/parameters/pathTemplateName' + parameters: + - $ref: '#/components/parameters/pathBrandId' + - $ref: '#/components/parameters/pathTemplateName' /api/v1/brands/{brandId}/templates/email/{templateName}/customizations/{customizationId}: get: summary: Retrieve an email customization - description: > + description: | Retrieves an email customization by its unique identifier - - If Custom languages for Okta - Email Templates is disabled, requests to retrieve an additional language - customization by ID result in a `404 Not Found` error response. + If Custom languages for Okta Email Templates is disabled, requests to retrieve an additional language customization by ID result in a `404 Not Found` error response. operationId: getEmailCustomization responses: '200': @@ -1122,15 +1072,16 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathBrandId' + - $ref: '#/components/parameters/pathTemplateName' + - $ref: '#/components/parameters/pathCustomizationId' put: summary: Replace an email customization - description: > + description: | Replaces an email customization using property values - - If Custom languages for Okta - Email Templates is disabled, requests to update a customization for an - additional language return a `404 Not Found` error response. + If Custom languages for Okta Email Templates is disabled, requests to update a customization for an additional language return a `404 Not Found` error response. operationId: replaceEmailCustomization x-codegen-request-body-name: instance requestBody: @@ -1159,23 +1110,18 @@ paths: '404': $ref: '#/components/responses/ErrorResourceNotFound404' '409': - description: >- - Could not update the email customization because the update would - cause a conflict with an existing email customization. + description: Could not update the email customization because the update would cause a conflict with an existing email customization. content: application/json: schema: $ref: '#/components/schemas/Error' examples: Default email customization already exists: - $ref: >- - #/components/examples/ErrorEmailCustomizationDefaultAlreadyExists + $ref: '#/components/examples/ErrorEmailCustomizationDefaultAlreadyExists' Email customization already exists for the specified language: - $ref: >- - #/components/examples/ErrorEmailCustomizationLanguageAlreadyExists + $ref: '#/components/examples/ErrorEmailCustomizationLanguageAlreadyExists' Cannot set the default email customization's isDefault to false: - $ref: >- - #/components/examples/ErrorEmailCustomizationCannotClearDefault + $ref: '#/components/examples/ErrorEmailCustomizationCannotClearDefault' '429': $ref: '#/components/responses/ErrorTooManyRequests429' security: @@ -1187,15 +1133,16 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathBrandId' + - $ref: '#/components/parameters/pathTemplateName' + - $ref: '#/components/parameters/pathCustomizationId' delete: summary: Delete an email customization - description: > + description: | Deletes an Email Customization by its unique identifier - - If Custom languages for Okta - Email Templates is disabled, deletion of an existing additional language - customization by ID doesn't register. + If Custom languages for Okta Email Templates is disabled, deletion of an existing additional language customization by ID doesn't register. operationId: deleteEmailCustomization responses: '204': @@ -1206,17 +1153,14 @@ paths: '404': $ref: '#/components/responses/ErrorResourceNotFound404' '409': - description: >- - Could not delete the email customization deleted because it is the - default email customization. + description: Could not delete the email customization deleted because it is the default email customization. content: application/json: schema: $ref: '#/components/schemas/Error' examples: Cannot delete default email customization: - $ref: >- - #/components/examples/ErrorEmailCustomizationCannotDeleteDefault + $ref: '#/components/examples/ErrorEmailCustomizationCannotDeleteDefault' '429': $ref: '#/components/responses/ErrorTooManyRequests429' security: @@ -1228,22 +1172,17 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathBrandId' - - $ref: '#/components/parameters/pathTemplateName' - - $ref: '#/components/parameters/pathCustomizationId' + parameters: + - $ref: '#/components/parameters/pathBrandId' + - $ref: '#/components/parameters/pathTemplateName' + - $ref: '#/components/parameters/pathCustomizationId' /api/v1/brands/{brandId}/templates/email/{templateName}/customizations/{customizationId}/preview: get: summary: Retrieve a preview of an email customization - description: > - Retrieves a Preview of an Email Customization. All variable references - are populated from the current user's context. For example, - `${user.profile.firstName}`. + description: | + Retrieves a Preview of an Email Customization. All variable references are populated from the current user's context. For example, `${user.profile.firstName}`. - - If Custom languages for Okta - Email Templates is disabled, requests for the preview of an additional - language customization by ID return a `404 Not Found` error response. + If Custom languages for Okta Email Templates is disabled, requests for the preview of an additional language customization by ID return a `404 Not Found` error response. operationId: getCustomizationPreview responses: '200': @@ -1270,26 +1209,24 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathBrandId' - - $ref: '#/components/parameters/pathTemplateName' - - $ref: '#/components/parameters/pathCustomizationId' + parameters: + - $ref: '#/components/parameters/pathBrandId' + - $ref: '#/components/parameters/pathTemplateName' + - $ref: '#/components/parameters/pathCustomizationId' /api/v1/brands/{brandId}/templates/email/{templateName}/default-content: get: summary: Retrieve an email template default content - description: > + description: | Retrieves an email template's default content - - Defaults to the current user's - language given the following: - + Defaults to the current user's language given the following: - Custom languages for Okta Email Templates is enabled - - An additional language is specified for the `language` parameter operationId: getEmailDefaultContent parameters: - $ref: '#/components/parameters/queryLanguage' + - $ref: '#/components/parameters/pathBrandId' + - $ref: '#/components/parameters/pathTemplateName' responses: '200': description: Successfully retrieved the email template's default content. @@ -1315,40 +1252,30 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathBrandId' - - $ref: '#/components/parameters/pathTemplateName' /api/v1/brands/{brandId}/templates/email/{templateName}/default-content/preview: get: summary: Retrieve a preview of the email template default content - description: > - Retrieves a preview of an Email Template's default content. All variable - references are populated using the current user's context. For example, - `${user.profile.firstName}`. - - - Defaults to the current user's - language given the following: + description: | + Retrieves a preview of an Email Template's default content. All variable references are populated using the current user's context. For example, `${user.profile.firstName}`. + Defaults to the current user's language given the following: - Custom languages for Okta Email Templates is enabled - - An additional language is specified for the `language` parameter operationId: getEmailDefaultPreview parameters: - $ref: '#/components/parameters/queryLanguage' + - $ref: '#/components/parameters/pathBrandId' + - $ref: '#/components/parameters/pathTemplateName' responses: '200': - description: >- - Successfully generated a preview of the email template's default - content. + description: Successfully generated a preview of the email template's default content. content: application/json: schema: $ref: '#/components/schemas/EmailPreview' examples: Preview email template default content response: - $ref: >- - #/components/examples/PreviewEmailTemplateDefaultContentResponse + $ref: '#/components/examples/PreviewEmailTemplateDefaultContentResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -1364,9 +1291,6 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathBrandId' - - $ref: '#/components/parameters/pathTemplateName' /api/v1/brands/{brandId}/templates/email/{templateName}/settings: get: summary: Retrieve the email template settings @@ -1397,6 +1321,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathBrandId' + - $ref: '#/components/parameters/pathTemplateName' put: summary: Replace the email template settings description: Replaces an email template's settings @@ -1432,9 +1359,7 @@ paths: Conflict: $ref: '#/components/examples/ErrorEmailSettingsRaceCondition' '422': - description: >- - Could not update the email template's settings due to an invalid - setting value. + description: Could not update the email template's settings due to an invalid setting value. content: application/json: schema: @@ -1453,39 +1378,27 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathBrandId' - - $ref: '#/components/parameters/pathTemplateName' + parameters: + - $ref: '#/components/parameters/pathBrandId' + - $ref: '#/components/parameters/pathTemplateName' /api/v1/brands/{brandId}/templates/email/{templateName}/test: post: summary: Send a test email - description: >- - Sends a test email to the current user's primary and secondary email - addresses. The email content is selected based on the following - priority: - - 1. The email customization for the language specified in the `language` - query parameter - - If Custom languages for Okta - Email Templates is enabled and the `language` parameter is an additional - language, the test email uses the customization corresponding to the - language. - + description: |- + Sends a test email to the current user's primary and secondary email addresses. The email content is selected based on the following priority: + 1. The email customization for the language specified in the `language` query parameter + If Custom languages for Okta Email Templates is enabled and the `language` parameter is an additional language, the test email uses the customization corresponding to the language. 2. The email template's default customization + 3. The email template's default content, translated to the current user's language - 3. The email template's default content, translated to the current - user's language - + You can only send customized test emails if you've configured a custom email domain. If you don't have a custom email domain, test emails use the Okta default template and are sent from the Okta email domain. - > **Note:** Super admins can view customized email templates with the - **Send a test email** request. However, when custom email templates are - sent to super admins as part of actual email notification flows, the - customizations aren't applied. Instead, the default email template is - used. This only applies to super admins. + > **Note:** Super admins can view customized email templates with the **Send a test email** request. However, when custom email templates are sent to super admins as part of actual email notification flows, the customizations aren't applied. Instead, the default email template is used. This only applies to super admins. operationId: sendTestEmail parameters: - $ref: '#/components/parameters/queryLanguage' + - $ref: '#/components/parameters/pathBrandId' + - $ref: '#/components/parameters/pathTemplateName' responses: '204': description: Successfully sent a test email. @@ -1505,18 +1418,13 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathBrandId' - - $ref: '#/components/parameters/pathTemplateName' /api/v1/brands/{brandId}/themes: get: summary: List all themes - description: >- + description: |- Lists all the themes in your brand. - - > **Important:** Currently each org supports only one theme, therefore - this contains a single object only. + > **Important:** Currently each org supports only one theme, therefore this contains a single object only. operationId: listBrandThemes responses: '200': @@ -1524,9 +1432,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/ThemeResponse' + $ref: '#/components/schemas/ListBrandThemesResponse' examples: Get themes response: $ref: '#/components/examples/ListThemesResponse' @@ -1545,8 +1451,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathBrandId' + parameters: + - $ref: '#/components/parameters/pathBrandId' /api/v1/brands/{brandId}/themes/{themeId}: get: summary: Retrieve a theme @@ -1577,6 +1483,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathBrandId' + - $ref: '#/components/parameters/pathThemeId' put: summary: Replace a theme description: Replaces a theme for a brand @@ -1618,24 +1527,20 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathBrandId' - - $ref: '#/components/parameters/pathThemeId' + parameters: + - $ref: '#/components/parameters/pathBrandId' + - $ref: '#/components/parameters/pathThemeId' /api/v1/brands/{brandId}/themes/{themeId}/background-image: post: summary: Upload the background image - description: >- - Uploads and replaces the background image for the theme. The file must - be in PNG, JPG, or GIF format and less than 2 MB in size. + description: Uploads and replaces the background image for the theme. The file must be in PNG, JPG, or GIF format and less than 2 MB in size. operationId: uploadBrandThemeBackgroundImage requestBody: content: multipart/form-data: schema: type: object - description: >- - The file must be in PNG, JPG, or GIF format and less than 2 MB - in size. + description: The file must be in PNG, JPG, or GIF format and less than 2 MB in size. properties: file: type: string @@ -1646,10 +1551,6 @@ paths: responses: '201': description: Content Created - content: - application/json: - schema: - $ref: '#/components/schemas/ImageUploadResponse' '400': $ref: '#/components/responses/ErrorApiValidationFailed400' '403': @@ -1667,6 +1568,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathBrandId' + - $ref: '#/components/parameters/pathThemeId' delete: summary: Delete the background image description: Deletes a theme background image @@ -1690,9 +1594,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathBrandId' - - $ref: '#/components/parameters/pathThemeId' + parameters: + - $ref: '#/components/parameters/pathBrandId' + - $ref: '#/components/parameters/pathThemeId' /api/v1/brands/{brandId}/themes/{themeId}/favicon: post: summary: Upload the favicon @@ -1703,9 +1607,7 @@ paths: multipart/form-data: schema: type: object - description: >- - The file must be in PNG or ICO format and have a 1:1 ratio with - a maximum dimension of 512 x 512 + description: The file must be in PNG or ICO format and have a 1:1 ratio with a maximum dimension of 512 x 512 properties: file: type: string @@ -1716,10 +1618,6 @@ paths: responses: '201': description: Created - content: - application/json: - schema: - $ref: '#/components/schemas/ImageUploadResponse' '400': $ref: '#/components/responses/ErrorApiValidationFailed400' '403': @@ -1737,6 +1635,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathBrandId' + - $ref: '#/components/parameters/pathThemeId' delete: summary: Delete the favicon description: Deletes a theme favicon. The theme will use the default Okta favicon. @@ -1760,27 +1661,19 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathBrandId' - - $ref: '#/components/parameters/pathThemeId' + parameters: + - $ref: '#/components/parameters/pathBrandId' + - $ref: '#/components/parameters/pathThemeId' /api/v1/brands/{brandId}/themes/{themeId}/logo: post: summary: Upload the logo - description: >- - Uploads and replaces the logo for the theme. The file must be in PNG, - JPG, or GIF format and less than 100kB in size. For best results use - landscape orientation, a transparent background, and a minimum size of - 300px by 50px to prevent upscaling. + description: Uploads and replaces the logo for the theme. The file must be in PNG, JPG, or GIF format and less than 100kB in size. For best results use landscape orientation, a transparent background, and a minimum size of 300px by 50px to prevent upscaling. operationId: uploadBrandThemeLogo requestBody: content: multipart/form-data: schema: - description: >- - The file must be in PNG, JPG, or GIF format and less than 100kB - in size. For best results use landscape orientation, a - transparent background, and a minimum size of 300px by 50px to - prevent upscaling. + description: The file must be in PNG, JPG, or GIF format and less than 100kB in size. For best results use landscape orientation, a transparent background, and a minimum size of 300px by 50px to prevent upscaling. type: object properties: file: @@ -1792,10 +1685,6 @@ paths: responses: '200': description: Success - content: - application/json: - schema: - $ref: '#/components/schemas/ImageUploadResponse' '400': $ref: '#/components/responses/ErrorApiValidationFailed400' '403': @@ -1813,6 +1702,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathBrandId' + - $ref: '#/components/parameters/pathThemeId' delete: summary: Delete the logo description: Deletes a Theme logo. The theme will use the default Okta logo. @@ -1836,15 +1728,13 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathBrandId' - - $ref: '#/components/parameters/pathThemeId' + parameters: + - $ref: '#/components/parameters/pathBrandId' + - $ref: '#/components/parameters/pathThemeId' /api/v1/brands/{brandId}/well-known-uris: get: summary: Retrieve all the well-known URIs - description: >- - Retrieves the content from each of the well-known URIs for a specified - brand + description: Retrieves the content from each of the well-known URIs for a specified brand operationId: getAllWellKnownURIs responses: '200': @@ -1869,13 +1759,13 @@ paths: tags: - AssociatedDomainCustomizations x-okta-lifecycle: - lifecycle: EA + lifecycle: LIMITED_GA isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathBrandId' - - $ref: '#/components/parameters/queryExpandWellKnownUris' + parameters: + - $ref: '#/components/parameters/pathBrandId' + - $ref: '#/components/parameters/queryExpandWellKnownUris' /api/v1/brands/{brandId}/well-known-uris/{path}: get: summary: Retrieve the well-known URI of a specific brand @@ -1913,20 +1803,18 @@ paths: tags: - AssociatedDomainCustomizations x-okta-lifecycle: - lifecycle: EA + lifecycle: LIMITED_GA isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathBrandId' - - $ref: '#/components/parameters/pathWellKnownUriPath' - - $ref: '#/components/parameters/queryExpandWellKnownUri' + parameters: + - $ref: '#/components/parameters/pathBrandId' + - $ref: '#/components/parameters/pathWellKnownUriPath' + - $ref: '#/components/parameters/queryExpandWellKnownUri' /api/v1/brands/{brandId}/well-known-uris/{path}/customized: get: summary: Retrieve the customized content of the specified well-known URI - description: >- - Retrieves the customized content of a well-known URI for a specific - brand and well-known URI path + description: Retrieves the customized content of a well-known URI for a specific brand and well-known URI path operationId: getBrandWellKnownURI responses: '200': @@ -1960,19 +1848,19 @@ paths: tags: - AssociatedDomainCustomizations x-okta-lifecycle: - lifecycle: EA + lifecycle: LIMITED_GA isGenerallyAvailable: false SKUs: - Okta Identity Engine + parameters: + - $ref: '#/components/parameters/pathBrandId' + - $ref: '#/components/parameters/pathWellKnownUriPath' put: summary: Replace the customized well-known URI of the specific path - description: >- + description: |- Replaces the content of a customized well-known URI that you specify. - - There are endpoint-specific format requirements when you update the - content of a customized well-known URI. See [Customize associated - domains](https://developer.okta.com/docs/guides/custom-well-known-uri/main/). + There are endpoint-specific format requirements when you update the content of a customized well-known URI. See [Customize associated domains](https://developer.okta.com/docs/guides/custom-well-known-uri/main/). operationId: replaceBrandWellKnownURI requestBody: content: @@ -2002,24 +1890,19 @@ paths: Invalid path: $ref: '#/components/examples/ErrorInvalidWellKnownPath' apple-app-site-association representation contains authsrv: - $ref: >- - #/components/examples/InvalidWellKnownAppleAppSiteRepresentationError + $ref: '#/components/examples/InvalidWellKnownAppleAppSiteRepresentationError' webauthn representation doesn't contain origins: - $ref: >- - #/components/examples/InvalidWellKnownWebauthnRepresentationError + $ref: '#/components/examples/InvalidWellKnownWebauthnRepresentationError' webauthn representation origins is not string array: - $ref: >- - #/components/examples/InvalidWellKnownWebauthnRepresentationOriginStringError + $ref: '#/components/examples/InvalidWellKnownWebauthnRepresentationOriginStringError' Invalid content type for apple-app-site-association and webauthn: $ref: '#/components/examples/InvalidWellKnownJsonTypeError' Invalid content type for assetlinks.json: $ref: '#/components/examples/InvalidWellKnownArrayTypeError' Cannot update well-known URI for default brand: - $ref: >- - #/components/examples/CannotUpdateWellKnownUriForDefaultBrandError + $ref: '#/components/examples/CannotUpdateWellKnownUriForDefaultBrandError' size limit exceeded: - $ref: >- - #/components/examples/WellKnownRepresentationSizeLimitExceededError + $ref: '#/components/examples/WellKnownRepresentationSizeLimitExceededError' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -2033,18 +1916,17 @@ paths: tags: - AssociatedDomainCustomizations x-okta-lifecycle: - lifecycle: EA + lifecycle: LIMITED_GA isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathBrandId' - - $ref: '#/components/parameters/pathWellKnownUriPath' + parameters: + - $ref: '#/components/parameters/pathBrandId' + - $ref: '#/components/parameters/pathWellKnownUriPath' components: schemas: BrandWithEmbedded: - allOf: - - $ref: '#/components/schemas/Brand' + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: _embedded: @@ -2062,19 +1944,53 @@ components: $ref: '#/components/schemas/EmailDomainResponse' readOnly: true _links: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - properties: - themes: - $ref: '#/components/schemas/HrefObject' - type: object + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + themes: + $ref: '#/components/schemas/HrefObject' + readOnly: true + agreeToCustomPrivacyPolicy: + type: boolean + description: Consent for updating the custom privacy URL. Not required when resetting the URL. + customPrivacyPolicyUrl: + type: string + description: Custom privacy policy URL + default: null + defaultApp: + $ref: '#/components/schemas/DefaultApp' + emailDomainId: + type: string + description: The ID of the email domain + id: + readOnly: true + type: string + description: The Brand ID + isDefault: + readOnly: true + type: boolean + description: If `true`, the Brand is used for the Okta subdomain + locale: + $ref: '#/components/schemas/Language' + name: + type: string + description: The name of the Brand + removePoweredByOkta: + type: boolean + default: false + description: Removes "Powered by Okta" from the sign-in page in redirect authentication deployments, and "© [current year] Okta, Inc." from the Okta End-User Dashboard CreateBrandRequest: title: CreateBrandRequest type: object properties: name: type: string - description: The name of the Brand + description: |- + The name of the brand + + > **Note:** You can't use the reserved `DRAPP_DOMAIN_BRAND` name. required: - name Brand: @@ -2082,9 +1998,7 @@ components: properties: agreeToCustomPrivacyPolicy: type: boolean - description: >- - Consent for updating the custom privacy URL. Not required when - resetting the URL. + description: Consent for updating the custom privacy URL. Not required when resetting the URL. customPrivacyPolicyUrl: type: string description: Custom privacy policy URL @@ -2110,10 +2024,7 @@ components: removePoweredByOkta: type: boolean default: false - description: >- - Removes "Powered by Okta" from the sign-in page in redirect - authentication deployments, and "© [current year] Okta, Inc." from - the Okta End-User Dashboard + description: Removes "Powered by Okta" from the sign-in page in redirect authentication deployments, and "© [current year] Okta, Inc." from the Okta End-User Dashboard Error: title: Error type: object @@ -2127,26 +2038,19 @@ components: description: An Okta code for this type of error errorId: type: string - description: >- - A unique identifier for this error. This can be used by Okta Support - to help with troubleshooting. + description: A unique identifier for this error. This can be used by Okta Support to help with troubleshooting. errorLink: type: string description: An Okta code for this type of error errorSummary: type: string - description: >- - A short description of what caused this error. Sometimes this - contains dynamically-generated information about your specific - error. + description: A short description of what caused this error. Sometimes this contains dynamically-generated information about your specific error. BrandRequest: type: object properties: agreeToCustomPrivacyPolicy: type: boolean - description: >- - Consent for updating the custom privacy URL. Not required when - resetting the URL. + description: Consent for updating the custom privacy URL. Not required when resetting the URL. customPrivacyPolicyUrl: type: string description: Custom privacy policy URL @@ -2159,22 +2063,27 @@ components: $ref: '#/components/schemas/Language' name: type: string - description: The name of the Brand + description: |- + The name of the brand + + > **Note:** You can't use the reserved `DRAPP_DOMAIN_BRAND` name. removePoweredByOkta: type: boolean default: false - description: >- - Removes "Powered by Okta" from the sign-in page in redirect - authentication deployments, and "© [current year] Okta, Inc." from - the Okta End-User Dashboard + description: Removes "Powered by Okta" from the sign-in page in redirect authentication deployments, and "© [current year] Okta, Inc." from the Okta End-User Dashboard required: - name BrandDomains: - title: BrandDomains - items: - $ref: '#/components/schemas/DomainResponse' - type: array + description: Defines a list of domains with a subset of the properties for each domain + type: object + properties: + domains: + description: Each element of the array defines an individual domain + type: array + items: + $ref: '#/components/schemas/DomainResponse' PageRoot: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: _embedded: @@ -2194,108 +2103,108 @@ components: format: uri readOnly: true _links: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - properties: - default: - $ref: '#/components/schemas/HrefObject' - customized: - $ref: '#/components/schemas/HrefObject' - preview: - $ref: '#/components/schemas/HrefObject' - type: object - ErrorPage: - allOf: - - $ref: '#/components/schemas/CustomizablePage' - - type: object + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object properties: - contentSecurityPolicySetting: - $ref: '#/components/schemas/ContentSecurityPolicySetting' + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + default: + $ref: '#/components/schemas/HrefObject' + customized: + $ref: '#/components/schemas/HrefObject' + preview: + $ref: '#/components/schemas/HrefObject' + readOnly: true + ErrorPage: + type: object + properties: + pageContent: + type: string + description: The HTML for the page + contentSecurityPolicySetting: + $ref: '#/components/schemas/ContentSecurityPolicySetting' SignInPage: - allOf: - - $ref: '#/components/schemas/CustomizablePage' - - type: object + type: object + properties: + pageContent: + type: string + description: The HTML for the page + contentSecurityPolicySetting: + $ref: '#/components/schemas/ContentSecurityPolicySetting' + widgetCustomizations: + type: object properties: - contentSecurityPolicySetting: - $ref: '#/components/schemas/ContentSecurityPolicySetting' - widgetCustomizations: - type: object - properties: - signInLabel: - type: string - description: The label for the sign in widget - usernameLabel: - type: string - description: The label for the username field - usernameInfoTip: - type: string - description: The label for the username information tip - passwordLabel: - type: string - description: The label for the password field - passwordInfoTip: - type: string - description: The label for the password information tip - showPasswordVisibilityToggle: - type: boolean - description: Allows users to see their passwords as they type - showUserIdentifier: - type: boolean - description: >- - Allows the user's identifier to appear on authentication and - enrollment pages - forgotPasswordLabel: - type: string - description: The label for the forgot password page - forgotPasswordUrl: - type: string - description: The forgot password URL - unlockAccountLabel: - type: string - description: The label for the unlock account link - unlockAccountUrl: - type: string - description: The unlock account URL - helpLabel: - type: string - description: The label for the help link - helpUrl: - type: string - description: The help link URL - customLink1Label: - type: string - description: The label for the first custom link - customLink1Url: - type: string - description: The URL for the first custom link - customLink2Label: - type: string - description: The label for the second custom link - customLink2Url: - type: string - description: The URL for the second custom link - authenticatorPageCustomLinkLabel: - type: string - description: The label for the authenticator page custom link - authenticatorPageCustomLinkUrl: - type: string - description: The URL for the authenticator page custom link - classicRecoveryFlowEmailOrUsernameLabel: - type: string - description: >- - The label for the username field in the classic recovery - flow - widgetGeneration: - $ref: '#/components/schemas/WidgetGeneration' - postAuthKeepMeSignedInPrompt: - $ref: '#/components/schemas/PostAuthKeepMeSignedInPrompt' - classicFooterHelpTitle: - type: string - description: >- - The title of the footer link on the sign-in page. Only - applicable for Classic Engine orgs. - widgetVersion: - $ref: '#/components/schemas/Version' + signInLabel: + type: string + description: The label for the sign in widget + usernameLabel: + type: string + description: The label for the username field + usernameInfoTip: + type: string + description: The label for the username information tip + passwordLabel: + type: string + description: The label for the password field + passwordInfoTip: + type: string + description: The label for the password information tip + showPasswordVisibilityToggle: + type: boolean + description: Allows users to see their passwords as they type + showUserIdentifier: + type: boolean + description: Allows the user's identifier to appear on authentication and enrollment pages + forgotPasswordLabel: + type: string + description: The label for the forgot password page + forgotPasswordUrl: + type: string + description: The forgot password URL + unlockAccountLabel: + type: string + description: The label for the unlock account link + unlockAccountUrl: + type: string + description: The unlock account URL + helpLabel: + type: string + description: The label for the help link + helpUrl: + type: string + description: The help link URL + customLink1Label: + type: string + description: The label for the first custom link + customLink1Url: + type: string + description: The URL for the first custom link + customLink2Label: + type: string + description: The label for the second custom link + customLink2Url: + type: string + description: The URL for the second custom link + authenticatorPageCustomLinkLabel: + type: string + description: The label for the authenticator page custom link + authenticatorPageCustomLinkUrl: + type: string + description: The URL for the authenticator page custom link + classicRecoveryFlowEmailOrUsernameLabel: + type: string + description: The label for the username field in the classic recovery flow + widgetGeneration: + $ref: '#/components/schemas/WidgetGeneration' + postAuthKeepMeSignedInPrompt: + $ref: '#/components/schemas/PostAuthKeepMeSignedInPrompt' + classicFooterHelpTitle: + type: string + description: The title of the footer link on the sign-in page. Only applicable for Classic Engine orgs. + gracePeriodRequiredSoon: + $ref: '#/components/schemas/GracePeriodRequiredSoon' + widgetVersion: + $ref: '#/components/schemas/Version' HostedPage: type: object properties: @@ -2306,6 +2215,7 @@ components: required: - type EmailTemplateResponse: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: name: @@ -2321,62 +2231,84 @@ components: type: integer readOnly: true _links: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - properties: - settings: - $ref: '#/components/schemas/HrefObject' - defaultContent: - $ref: '#/components/schemas/HrefObject' - customizations: - $ref: '#/components/schemas/HrefObject' - test: - $ref: '#/components/schemas/HrefObject' - type: object + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + settings: + $ref: '#/components/schemas/HrefObject' + defaultContent: + $ref: '#/components/schemas/HrefObject' + customizations: + $ref: '#/components/schemas/HrefObject' + test: + $ref: '#/components/schemas/HrefObject' + readOnly: true EmailCustomization: - allOf: - - $ref: '#/components/schemas/EmailContent' - - type: object + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + body: + type: string + description: | + The HTML body of the email. May contain [variable references](https://velocity.apache.org/engine/1.7/user-guide.html#references). + + Not required if Custom languages for Okta Email Templates is enabled. A `null` body is replaced with a default value from one of the following in priority order: + + 1. An existing default email customization, if one exists + 2. Okta-provided translated content for the specified language, if one exists + 3. Okta-provided translated content for the brand locale, if it's set + 4. Okta-provided content in English + subject: + type: string + description: | + The email subject. May contain [variable references](https://velocity.apache.org/engine/1.7/user-guide.html#references). + + Not required if Custom languages for Okta Email Templates is enabled. A `null` subject is replaced with a default value from one of the following in priority order: + + 1. An existing default email customization, if one exists + 2. Okta-provided translated content for the specified language, if one exists + 3. Okta-provided translated content for the brand locale, if it's set + 4. Okta-provided content in English + created: + type: string + format: date-time + readOnly: true + description: The UTC time at which this email customization was created. + id: + type: string + readOnly: true + description: A unique identifier for this email customization + isDefault: + type: boolean + description: Whether this is the default customization for the email template. Each customized email template must have exactly one default customization. Defaults to `true` for the first customization and `false` thereafter. + language: + $ref: '#/components/schemas/Language' + lastUpdated: + type: string + format: date-time + readOnly: true + description: The UTC time at which this email customization was last updated. + _links: + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object properties: - created: - type: string - format: date-time - readOnly: true - description: The UTC time at which this email customization was created. - id: - type: string - readOnly: true - description: A unique identifier for this email customization - isDefault: - type: boolean - description: >- - Whether this is the default customization for the email - template. Each customized email template must have exactly one - default customization. Defaults to `true` for the first - customization and `false` thereafter. - language: - $ref: '#/components/schemas/Language' - lastUpdated: - type: string - format: date-time - readOnly: true - description: The UTC time at which this email customization was last updated. - _links: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - properties: - self: - $ref: '#/components/schemas/HrefObject' - template: - $ref: '#/components/schemas/HrefObject' - preview: - $ref: '#/components/schemas/HrefObject' - test: - $ref: '#/components/schemas/HrefObject' - type: object - required: - - language + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + template: + $ref: '#/components/schemas/HrefObject' + preview: + $ref: '#/components/schemas/HrefObject' + test: + $ref: '#/components/schemas/HrefObject' + readOnly: true + required: + - subject + - body + - language EmailPreview: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: body: @@ -2388,36 +2320,64 @@ components: readOnly: true description: The email's subject _links: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - properties: - contentSource: - $ref: '#/components/schemas/HrefObject' - template: - $ref: '#/components/schemas/HrefObject' - test: - $ref: '#/components/schemas/HrefObject' - defaultContent: - $ref: '#/components/schemas/HrefObject' - type: object + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + contentSource: + $ref: '#/components/schemas/HrefObject' + template: + $ref: '#/components/schemas/HrefObject' + test: + $ref: '#/components/schemas/HrefObject' + defaultContent: + $ref: '#/components/schemas/HrefObject' + readOnly: true EmailDefaultContent: - allOf: - - $ref: '#/components/schemas/EmailContent' - - type: object + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + body: + type: string + description: | + The HTML body of the email. May contain [variable references](https://velocity.apache.org/engine/1.7/user-guide.html#references). + + Not required if Custom languages for Okta Email Templates is enabled. A `null` body is replaced with a default value from one of the following in priority order: + + 1. An existing default email customization, if one exists + 2. Okta-provided translated content for the specified language, if one exists + 3. Okta-provided translated content for the brand locale, if it's set + 4. Okta-provided content in English + subject: + type: string + description: | + The email subject. May contain [variable references](https://velocity.apache.org/engine/1.7/user-guide.html#references). + + Not required if Custom languages for Okta Email Templates is enabled. A `null` subject is replaced with a default value from one of the following in priority order: + + 1. An existing default email customization, if one exists + 2. Okta-provided translated content for the specified language, if one exists + 3. Okta-provided translated content for the brand locale, if it's set + 4. Okta-provided content in English + _links: + type: object + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. properties: - _links: - type: object - allOf: - - $ref: '#/components/schemas/LinksSelf' - - properties: - template: - $ref: '#/components/schemas/HrefObject' - preview: - $ref: '#/components/schemas/HrefObject' - test: - $ref: '#/components/schemas/HrefObject' - type: object + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + template: + $ref: '#/components/schemas/HrefObject' + preview: + $ref: '#/components/schemas/HrefObject' + test: + $ref: '#/components/schemas/HrefObject' + readOnly: true + required: + - subject + - body EmailSettingsResponse: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: recipients: @@ -2427,14 +2387,14 @@ components: - ADMINS_ONLY - NO_USERS _links: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - properties: - self: - $ref: '#/components/schemas/HrefObject' - template: - $ref: '#/components/schemas/HrefObject' - type: object + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + template: + $ref: '#/components/schemas/HrefObject' + readOnly: true EmailSettings: type: object properties: @@ -2447,14 +2407,15 @@ components: required: - recipients Error409: + x-okta-ignore-redocly-rules-for-sdk: true description: Conflict error object type: object properties: errorCauses: type: array - description: >- - Another request has already been received for the settings for this - email template + items: + type: string + description: Another request has already been received for the settings for this email template readOnly: true errorCode: type: string @@ -2470,9 +2431,7 @@ components: readOnly: true errorSummary: type: string - description: >- - Another request has already been received for the settings for this - email template + description: Another request has already been received for the settings for this email template readOnly: true ThemeResponse: type: object @@ -2558,6 +2517,7 @@ components: readOnly: true type: string WellKnownURIsRoot: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: _embedded: @@ -2583,35 +2543,39 @@ components: $ref: '#/components/schemas/WellKnownURIObjectResponse' readOnly: true _links: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - properties: - apple-app-site-association: - $ref: '#/components/schemas/HrefObject' - assetlinks.json: - $ref: '#/components/schemas/HrefObject' - webauthn: - $ref: '#/components/schemas/HrefObject' - type: object + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + apple-app-site-association: + $ref: '#/components/schemas/HrefObject' + assetlinks.json: + $ref: '#/components/schemas/HrefObject' + webauthn: + $ref: '#/components/schemas/HrefObject' + readOnly: true WellKnownURIObjectResponse: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: representation: - type: object - description: The well-known URI content in JSON format + type: string + description: The well-known URI content in JSON format (opaque JSON object) _links: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - properties: - self: - $ref: '#/components/schemas/HrefObject' - type: object + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + readOnly: true WellKnownURIRequest: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: representation: - type: object - description: The well-known URI content in JSON object format + type: string + description: The well-known URI content in JSON object format (opaque JSON object) required: - representation DomainResponse: @@ -2627,7 +2591,7 @@ components: dnsRecords: type: array items: - $ref: '#/components/schemas/DNSRecord' + $ref: '#/components/schemas/DNSRecordDomains' domain: description: Custom domain name type: string @@ -2643,8 +2607,7 @@ components: _links: $ref: '#/components/schemas/DomainLinks' EmailDomainResponse: - allOf: - - $ref: '#/components/schemas/BaseEmailDomain' + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: dnsValidationRecords: @@ -2661,20 +2624,22 @@ components: type: string description: The subdomain for the email sender's custom mail domain default: mail + displayName: + type: string + userName: + type: string + required: + - displayName + - userName LinksSelf: - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the - [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. This object is used for dynamic discovery of related - resources and lifecycle operations. + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. type: object properties: self: $ref: '#/components/schemas/HrefObjectSelfLink' readOnly: true HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object additionalProperties: true type: object @@ -2691,15 +2656,11 @@ components: readOnly: true templated: type: boolean - description: >- - Indicates whether the link object's `href` property is a URI - template. + description: Indicates whether the link object's `href` property is a URI template. readOnly: true type: type: string - description: >- - The media type of the link. If omitted, it is implicitly - `application/json`. + description: The media type of the link. If omitted, it is implicitly `application/json`. readOnly: true required: - href @@ -2716,9 +2677,7 @@ components: type: string description: Application URI for classic Orgs Language: - description: >- - The language specified as an [IETF BCP 47 language - tag](https://datatracker.ietf.org/doc/html/rfc5646) + description: The language specified as an [IETF BCP 47 language tag](https://datatracker.ietf.org/doc/html/rfc5646) type: string ErrorCause: type: object @@ -2771,11 +2730,31 @@ components: title: type: string description: The title on the Sign-In Widget when prompting for Stay signed in + GracePeriodRequiredSoon: + x-okta-lifecycle: + lifecycle: LIMITED_GA + isGenerallyAvailable: false + SKUs: [] + description: | + Customizable strings to use with [grace periods](https://developer.okta.com/docs/concepts/policies/#authenticator-enrollment-policies) that are shown on the Sign-In Widget + + You can use the `gracePeriodRequiredSoonDescription` string without using either of the custom link strings. + However, if you use one of the custom link strings (`gracePeriodRequiredSoonCustomLinkLabel` or `gracePeriodRequiredSoonCustomLinkUrl`), then both are required. + type: object + properties: + gracePeriodRequiredSoonCustomLinkLabel: + type: string + description: The label of the custom link that's shown on the Sign-In Widget when users are prompted to enroll required authenticators before their grace period ends. + gracePeriodRequiredSoonCustomLinkUrl: + type: string + description: The URL for the custom link that's shown on the Sign-In Widget when users are prompted to enroll required authenticators before their grace period ends. + gracePeriodRequiredSoonDescription: + type: string + description: The description that's shown on the Sign-In Widget for users who are within an authenticator grace period. This description prompts users to enroll required authenticators before their grace period ends. Version: - description: The version specified as a [Semantic Version](https://semver.org/). + description: The version specified as a [Semantic Version](https://semver.org/). This value can be a wildcard (`*`), a major version range (for example, `^2`), a major-only version (for example, `7`), or a specific `Major.Minor` version (for example, `5.15`). type: string - pattern: >- - ^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$ + pattern: ^(?:\*|\^?\d+(?:\.\d+){0,2})$ HostedPageType: type: string enum: @@ -2786,56 +2765,32 @@ components: properties: body: type: string - description: > - The HTML body of the email. May contain [variable - references](https://velocity.apache.org/engine/1.7/user-guide.html#references). - - - Not required if Custom - languages for Okta Email Templates is enabled. A `null` body is - replaced with a default value from one of the following in priority - order: + description: | + The HTML body of the email. May contain [variable references](https://velocity.apache.org/engine/1.7/user-guide.html#references). + Not required if Custom languages for Okta Email Templates is enabled. A `null` body is replaced with a default value from one of the following in priority order: 1. An existing default email customization, if one exists - - 2. Okta-provided translated content for the specified language, if - one exists - - 3. Okta-provided translated content for the brand locale, if it's - set - + 2. Okta-provided translated content for the specified language, if one exists + 3. Okta-provided translated content for the brand locale, if it's set 4. Okta-provided content in English subject: type: string - description: > - The email subject. May contain [variable - references](https://velocity.apache.org/engine/1.7/user-guide.html#references). - - - Not required if Custom - languages for Okta Email Templates is enabled. A `null` subject is - replaced with a default value from one of the following in priority - order: + description: | + The email subject. May contain [variable references](https://velocity.apache.org/engine/1.7/user-guide.html#references). + Not required if Custom languages for Okta Email Templates is enabled. A `null` subject is replaced with a default value from one of the following in priority order: 1. An existing default email customization, if one exists - - 2. Okta-provided translated content for the specified language, if - one exists - - 3. Okta-provided translated content for the brand locale, if it's - set - + 2. Okta-provided translated content for the specified language, if one exists + 3. Okta-provided translated content for the brand locale, if it's set 4. Okta-provided content in English required: - subject - body EmailTemplateTouchPointVariant: - description: > - Variant for email templates. You can publish a theme for email templates - with different combinations of assets. Variants are preset combinations - of those assets. + description: | + Variant for email templates. You can publish a theme for email templates with different combinations of assets. Variants are preset combinations of those assets. default: OKTA_DEFAULT type: string enum: @@ -2843,14 +2798,10 @@ components: - OKTA_DEFAULT x-enumDescriptions: FULL_THEME: Uses the Okta logo and Okta colors in email templates - OKTA_DEFAULT: >- - Uses the logo from the theme. Uses `primaryColorHex` as the background - color for buttons. + OKTA_DEFAULT: Uses the logo from the theme. Uses `primaryColorHex` as the background color for buttons. EndUserDashboardTouchPointVariant: - description: > - Variant for the Okta End-User Dashboard. You can publish a theme for - end-user dashboard with different combinations of assets. Variants are - preset combinations of those assets. + description: | + Variant for the Okta End-User Dashboard. You can publish a theme for end-user dashboard with different combinations of assets. Variants are preset combinations of those assets. default: OKTA_DEFAULT type: string enum: @@ -2859,24 +2810,13 @@ components: - OKTA_DEFAULT - WHITE_LOGO_BACKGROUND x-enumDescriptions: - FULL_THEME: >- - Uses the logo and favicon from the theme. Uses `primaryColorHex` for - the logo and the side navigation bar background color. - LOGO_ON_FULL_WHITE_BACKGROUND: >- - Uses the logo and favicon from the theme. Uses white background color - for the logo and the side navigation bar background color. - OKTA_DEFAULT: >- - Uses the Okta logo and favicon. Uses a white background color for the - logo and the side navigation bar background color. - WHITE_LOGO_BACKGROUND: >- - Uses the logo and favicon from the theme, with a white background - color for the logo. Uses `primaryColorHex` for the side navigation bar - background color. + FULL_THEME: Uses the logo and favicon from the theme. Uses `primaryColorHex` for the logo and the side navigation bar background color. + LOGO_ON_FULL_WHITE_BACKGROUND: Uses the logo and favicon from the theme. Uses white background color for the logo and the side navigation bar background color. + OKTA_DEFAULT: Uses the Okta logo and favicon. Uses a white background color for the logo and the side navigation bar background color. + WHITE_LOGO_BACKGROUND: Uses the logo and favicon from the theme, with a white background color for the logo. Uses `primaryColorHex` for the side navigation bar background color. ErrorPageTouchPointVariant: - description: > - Variant for the error page. You can publish a theme for error page with - different combinations of assets. Variants are preset combinations of - those assets. + description: | + Variant for the error page. You can publish a theme for error page with different combinations of assets. Variants are preset combinations of those assets. default: OKTA_DEFAULT type: string enum: @@ -2885,15 +2825,11 @@ components: - OKTA_DEFAULT x-enumDescriptions: BACKGROUND_IMAGE: Uses the logo, favicon, and background image from the theme - BACKGROUND_SECONDARY_COLOR: >- - Uses the logo and favicon from the theme. Uses `secondaryColorHex` as - the background color for the error page. + BACKGROUND_SECONDARY_COLOR: Uses the logo and favicon from the theme. Uses `secondaryColorHex` as the background color for the error page. OKTA_DEFAULT: Uses the Okta logo, favicon, and background color LoadingPageTouchPointVariant: - description: > - Variant for the Okta loading page. You can publish a theme for Okta - loading page with different combinations of assets. Variants are preset - combinations of those assets. + description: | + Variant for the Okta loading page. You can publish a theme for Okta loading page with different combinations of assets. Variants are preset combinations of those assets. default: OKTA_DEFAULT type: string enum: @@ -2903,14 +2839,9 @@ components: NONE: Uses no loading page animation during the redirect OKTA_DEFAULT: Uses the default Okta loading page animation during the redirect SignInPageTouchPointVariant: - description: > - Variant for the Okta sign-in page. You can publish a theme for sign-in - page with different combinations of assets. Variants are preset - combinations of those assets. - - > **Note:** For a non-`OKTA_DEFAULT` variant, `primaryColorHex` is used - for button background color and `primaryColorContrastHex` is used to - optimize the opacity for button text. + description: | + Variant for the Okta sign-in page. You can publish a theme for sign-in page with different combinations of assets. Variants are preset combinations of those assets. + > **Note:** For a non-`OKTA_DEFAULT` variant, `primaryColorHex` is used for button background color and `primaryColorContrastHex` is used to optimize the opacity for button text. type: string enum: - BACKGROUND_IMAGE @@ -2918,35 +2849,30 @@ components: - OKTA_DEFAULT x-enumDescriptions: BACKGROUND_IMAGE: Uses the logo, favicon, and background image from the theme - BACKGROUND_SECONDARY_COLOR: >- - Uses the logo and favicon from the theme. Uses `secondaryColorHex` as - the background color for the Okta sign-in page. - OKTA_DEFAULT: >- - Uses the Okta logo and favicon with no background image. Uses the Okta - colors on the Okta sign-in page. + BACKGROUND_SECONDARY_COLOR: Uses the logo and favicon from the theme. Uses `secondaryColorHex` as the background color for the Okta sign-in page. + OKTA_DEFAULT: Uses the Okta logo and favicon with no background image. Uses the Okta colors on the Okta sign-in page. WellKnownURIArrayResponse: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: representation: type: array description: The well-known URI content in a JSON array of objects format _links: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - properties: - self: - $ref: '#/components/schemas/HrefObject' - type: object + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + readOnly: true DomainCertificateSourceType: - description: >- - Certificate source type that indicates whether the certificate is - provided by the user or Okta. + description: Certificate source type that indicates whether the certificate is provided by the user or Okta. type: string enum: - MANUAL - OKTA_MANAGED - DNSRecord: - description: DNS TXT and CNAME records to be registered for the Domain + DNSRecordDomains: + description: DNS records to be registered for the domain type: object properties: expiration: @@ -2957,7 +2883,7 @@ components: type: string example: _oktaverification.login.example.com recordType: - $ref: '#/components/schemas/DNSRecordType' + $ref: '#/components/schemas/DNSRecordTypeDomains' values: description: DNS record value type: array @@ -2976,8 +2902,7 @@ components: fingerprint: description: Certificate fingerprint type: string - example: >- - 73:68:82:7B:83:2E:48:29:A5:5E:E8:40:41:80:B3:AA:03:C4:42:43:05:73:45:BC:AA:47:00:23:A3:70:E5:C4 + example: 73:68:82:7B:83:2E:48:29:A5:5E:E8:40:41:80:B3:AA:03:C4:42:43:05:73:45:BC:AA:47:00:23:A3:70:E5:C4 subject: description: Certificate subject type: string @@ -2992,24 +2917,94 @@ components: - NOT_STARTED - VERIFIED DomainLinks: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - type: object + x-okta-ignore-redocly-rules-for-sdk: true + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + brand: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: The associated brand + certificate: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: The certificate link references the domain certificate + verify: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object properties: - brand: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: The associated brand - certificate: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: The certificate link references the domain certificate - verify: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: >- - The verify link verifies the domain and transitions the - domain status to `VERIFIED` + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: The verify link verifies the domain and transitions the domain status to `VERIFIED` + readOnly: true BaseEmailDomain: type: object properties: @@ -3030,6 +3025,7 @@ components: verificationValue: type: string EmailDomainStatus: + x-okta-ignore-redocly-rules-for-sdk: true type: string enum: - DELETED @@ -3038,9 +3034,32 @@ components: - POLLING - VERIFIED HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) HrefHints: description: Describes allowed HTTP verbs for the `href` type: object @@ -3049,10 +3068,11 @@ components: type: array items: $ref: '#/components/schemas/HttpMethod' - DNSRecordType: + DNSRecordTypeDomains: example: TXT type: string enum: + - CAA - CNAME - TXT EmailDomainDNSRecordType: @@ -3067,6 +3087,44 @@ components: - GET - POST - PUT + ListBrandsResponse: + type: object + properties: + brands: + type: array + items: + $ref: '#/components/schemas/BrandWithEmbedded' + ListAllSignInWidgetVersionsResponse: + type: object + properties: + sign_in_widget_versions: + type: array + items: + type: object + properties: + sign_in_widget_version: + type: string + ListEmailTemplatesResponse: + type: object + properties: + email_templates: + type: array + items: + $ref: '#/components/schemas/EmailTemplateResponse' + ListEmailCustomizationsResponse: + type: object + properties: + email_customizations: + type: array + items: + $ref: '#/components/schemas/EmailCustomization' + ListBrandThemesResponse: + type: object + properties: + brand_themes: + type: array + items: + $ref: '#/components/schemas/ThemeResponse' responses: ErrorAccessDenied403: description: Forbidden @@ -3125,11 +3183,7 @@ components: in: query schema: type: string - description: >- - The cursor to use for pagination. It is an opaque string that specifies - your current location in the list and is obtained from the `Link` - response header. See - [Pagination](https://developer.okta.com/docs/api/#pagination). + description: The cursor to use for pagination. It is an opaque string that specifies your current location in the list and is obtained from the `Link` response header. See [Pagination](https://developer.okta.com/docs/api/#pagination) and [Link header](https://developer.okta.com/docs/api/#link-header). queryLimit: name: limit in: query @@ -3202,9 +3256,7 @@ components: schema: $ref: '#/components/schemas/Language' in: query - description: >- - The language to use for the email. Defaults to the current user's - language if unspecified. + description: The language to use for the email. Defaults to the current user's language if unspecified. pathThemeId: name: themeId in: path @@ -3276,14 +3328,12 @@ components: - PUT - DELETE themes: - href: >- - https://{yourOktaDomain}/api/v1/brands/bnd114iNkrcN6aR680g4/themes + href: https://{yourOktaDomain}/api/v1/brands/bnd114iNkrcN6aR680g4/themes hints: allow: - GET emailDomain: - href: >- - https://{yourOktaDomain}/api/v1/email-domains/OeD114iNkrcN6aR680g4 + href: https://{yourOktaDomain}/api/v1/email-domains/OeD114iNkrcN6aR680g4 hints: allow: - GET @@ -3425,49 +3475,42 @@ components: recipients: ALL_USERS _links: self: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/settings + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/settings hints: allow: - GET - PUT template: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation hints: allow: - GET _links: self: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation hints: allow: - GET settings: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/settings + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/settings hints: allow: - GET - PUT defaultContent: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/default-content + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/default-content hints: allow: - GET customizations: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/customizations + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/customizations hints: allow: - GET - POST - DELETE test: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/test + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/test hints: allow: - POST @@ -3480,49 +3523,42 @@ components: recipients: ALL_USERS _links: self: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/settings + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/settings hints: allow: - GET - PUT template: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation hints: allow: - GET _links: self: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation hints: allow: - GET settings: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/settings + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/settings hints: allow: - GET - PUT defaultContent: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/default-content + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/default-content hints: allow: - GET customizations: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/customizations + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/customizations hints: allow: - GET - POST - DELETE test: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/test + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/test hints: allow: - POST @@ -3531,37 +3567,30 @@ components: - language: en isDefault: true subject: Welcome to ${org.name}! - body: >- -

Hello, ${user.profile.firstName}. - Click here to activate your - account. + body:

Hello, ${user.profile.firstName}. Click here to activate your account. id: oel11u6DqUiMbQkpl0g4 created: '2021-11-09T20:38:10.000Z' lastUpdated: '2021-11-11T20:38:10.000Z' _links: self: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/customizations/oel11u6DqUiMbQkpl0g4 + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/customizations/oel11u6DqUiMbQkpl0g4 hints: allow: - GET - PUT - DELETE template: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation hints: allow: - GET preview: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/customizations/oel11u6DqUiMbQkpl0g4/preview + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/customizations/oel11u6DqUiMbQkpl0g4/preview hints: allow: - GET test: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/test + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/test hints: allow: - POST @@ -3569,45 +3598,37 @@ components: value: language: fr subject: Bienvenue dans ${org.name}! - body: >- -

Bonjour ${user.profile.firstName}. Activer le compte

+ body:

Bonjour ${user.profile.firstName}. Activer le compte

isDefault: false CreateUpdateEmailCustomizationResponse: value: language: fr subject: Bienvenue dans ${org.name}! - body: >- -

Bonjour ${user.profile.firstName}. Activer le compte

+ body:

Bonjour ${user.profile.firstName}. Activer le compte

isDefault: false id: oel11u6DqUiMbQkpl0g4 created: '2021-11-09T20:38:10.000Z' lastUpdated: '2021-11-11T20:38:10.000Z' _links: self: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/customizations/oel11u6DqUiMbQkpl0g4 + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/customizations/oel11u6DqUiMbQkpl0g4 hints: allow: - GET - PUT - DELETE template: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation hints: allow: - GET preview: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/customizations/oel11u6DqUiMbQkpl0g4/preview + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/customizations/oel11u6DqUiMbQkpl0g4/preview hints: allow: - GET test: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/test + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/test hints: allow: - POST @@ -3630,46 +3651,37 @@ components: language: en isDefault: true subject: Welcome to ${org.name}! - body: >- -

Hello, ${user.profile.firstName}. Click - here to activate your - account. + body:

Hello, ${user.profile.firstName}. Click here to activate your account. id: oel11u6DqUiMbQkpl0g4 created: '2021-11-09T20:38:10.000Z' lastUpdated: '2021-11-11T20:38:10.000Z' _links: self: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/customizations/oel11u6DqUiMbQkpl0g4 + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/customizations/oel11u6DqUiMbQkpl0g4 hints: allow: - GET - PUT - DELETE template: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation hints: allow: - GET preview: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/customizations/oel11u6DqUiMbQkpl0g4/preview + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/customizations/oel11u6DqUiMbQkpl0g4/preview hints: allow: - GET test: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/test + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/test hints: allow: - POST ErrorEmailCustomizationCannotClearDefault: value: errorCode: E0000185 - errorSummary: >- - The isDefault parameter of the default email template customization - can't be set to false. + errorSummary: The isDefault parameter of the default email template customization can't be set to false. errorLink: E0000185 errorId: oaejrB1fWL1S7mc-2KcG-SOtw errorCauses: [] @@ -3683,78 +3695,60 @@ components: PreviewEmailCustomizationResponse: value: subject: Welcome to Okta! - body: >- -

Hello, John. Click here to activate your - account. + body:

Hello, John. Click here to activate your account. _links: self: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/customizations/oel2kk1zYJBJbeaGo0g4/preview + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/customizations/oel2kk1zYJBJbeaGo0g4/preview hints: allow: - GET template: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation hints: allow: - GET test: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/test + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/test hints: allow: - POST EmailTemplateDefaultContentResponse: value: subject: Welcome to ${org.name}! - body: >- -

Hello, ${user.profile.firstName}. Click - here to activate your - account. + body:

Hello, ${user.profile.firstName}. Click here to activate your account. _links: self: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/default-content + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/default-content hints: allow: - GET template: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation hints: allow: - GET preview: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/default-content/preview + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/default-content/preview hints: allow: - GET PreviewEmailTemplateDefaultContentResponse: value: subject: Welcome to Okta! - body: >- -

Hello, John. Click here to activate your - account. + body:

Hello, John. Click here to activate your account. _links: self: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/default-content/preview + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/default-content/preview hints: allow: - GET template: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation hints: allow: - GET defaultContent: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/test/default-content + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/test/default-content hints: allow: - POST @@ -3763,24 +3757,20 @@ components: recipients: ALL_USERS _links: self: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/settings + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/settings hints: allow: - GET - PUT template: - href: >- - https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation + href: https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation hints: allow: - GET ErrorEmailSettingsRaceCondition: value: errorCode: E0000254 - errorSummary: >- - Another request has already been received for the settings for this - email template. Please try again later. + errorSummary: Another request has already been received for the settings for this email template. Please try again later. errorLink: E0000254 errorId: oaeUcGELffqRay0u1OPdnPypw errorCauses: [] @@ -3794,8 +3784,7 @@ components: ListThemesResponse: value: - id: thdul904tTZ6kWVhP0g3 - logo: >- - https://{yourOktaDomain}/assets/img/logos/okta-logo.47066819ac7db5c13f4c431b2687cef6.png + logo: https://{yourOktaDomain}/assets/img/logos/okta-logo.47066819ac7db5c13f4c431b2687cef6.png favicon: https://{yourOktaDomain}/favicon.ico backgroundImage: null primaryColorHex: '#1662dd' @@ -3810,8 +3799,7 @@ components: GetThemeResponse: value: id: thdul904tTZ6kWVhP0g3 - logo: >- - https://{yourOktaDomain}/assets/img/logos/okta-logo.47066819ac7db5c13f4c431b2687cef6.png + logo: https://{yourOktaDomain}/assets/img/logos/okta-logo.47066819ac7db5c13f4c431b2687cef6.png favicon: https://{yourOktaDomain}/favicon.ico backgroundImage: null primaryColorHex: '#1662dd' @@ -3837,8 +3825,7 @@ components: UpdateThemeResponse: value: id: thdul904tTZ6kWVhP0g3 - logo: >- - https://{yourOktaDomain}/assets/img/logos/okta-logo.47066819ac7db5c13f4c431b2687cef6.png + logo: https://{yourOktaDomain}/assets/img/logos/okta-logo.47066819ac7db5c13f4c431b2687cef6.png favicon: https://{yourOktaDomain}/favicon.ico backgroundImage: null primaryColorHex: '#1662dd' @@ -3854,28 +3841,24 @@ components: value: _links: self: - href: >- - https://{yourOktaDomain}/api/v1/brands/bnd114iNkrcN6aR680g4/well-known-uris + href: https://{yourOktaDomain}/api/v1/brands/bnd114iNkrcN6aR680g4/well-known-uris hints: allow: - GET apple-app-site-association: - href: >- - https://{yourOktaDomain}/api/v1/brands/bnd114iNkrcN6aR680g4/well-known-uris/apple-app-site-association + href: https://{yourOktaDomain}/api/v1/brands/bnd114iNkrcN6aR680g4/well-known-uris/apple-app-site-association hints: allow: - GET - PUT assetlinks.json: - href: >- - https://{yourOktaDomain}/api/v1/brands/bnd114iNkrcN6aR680g4/well-known-uris/assetlinks.json + href: https://{yourOktaDomain}/api/v1/brands/bnd114iNkrcN6aR680g4/well-known-uris/assetlinks.json hints: allow: - GET - PUT webauthn: - href: >- - https://{yourOktaDomain}/api/v1/brands/bnd114iNkrcN6aR680g4/well-known-uris/webauthn + href: https://{yourOktaDomain}/api/v1/brands/bnd114iNkrcN6aR680g4/well-known-uris/webauthn hints: allow: - GET @@ -3889,19 +3872,16 @@ components: - B7F62B65BN.com.okta.mobile - B7F62B65BN.com.okta.mobile.auth-service-extension - B7F62B65BN.com.okta.authenticator.beta - - >- - B7F62B65BN.com.okta.authenticator.beta.auth-service-extension + - B7F62B65BN.com.okta.authenticator.beta.auth-service-extension - 7WXXBW6Z2Y.com.okta.mobile.internalrelease - - >- - 7WXXBW6Z2Y.com.okta.mobile.internalrelease.auth-service-extension + - 7WXXBW6Z2Y.com.okta.mobile.internalrelease.auth-service-extension key1: value1 key2: value2 key3: key3.1: value3.1 _links: self: - href: >- - https://{yourOktaDomain}/api/v1/brands/bnd114iNkrcN6aR680g4/well-known-uris/apple-app-site-association/customized + href: https://{yourOktaDomain}/api/v1/brands/bnd114iNkrcN6aR680g4/well-known-uris/apple-app-site-association/customized hints: allow: - GET @@ -3915,8 +3895,7 @@ components: key3.1: value3.1 _links: self: - href: >- - https://{yourOktaDomain}/api/v1/brands/bnd114iNkrcN6aR680g4/well-known-uris/assetlinks.json/customized + href: https://{yourOktaDomain}/api/v1/brands/bnd114iNkrcN6aR680g4/well-known-uris/assetlinks.json/customized hints: allow: - GET @@ -3928,8 +3907,7 @@ components: - https://example1.com _links: self: - href: >- - https://{yourOktaDomain}/api/v1/brands/bnd114iNkrcN6aR680g4/well-known-uris/webauthn/customized + href: https://{yourOktaDomain}/api/v1/brands/bnd114iNkrcN6aR680g4/well-known-uris/webauthn/customized hints: allow: - GET @@ -3938,14 +3916,12 @@ components: value: _links: self: - href: >- - https://{yourOktaDomain}/api/v1/brands/bnd114iNkrcN6aR680g4/well-known-uris/apple-app-site-association + href: https://{yourOktaDomain}/api/v1/brands/bnd114iNkrcN6aR680g4/well-known-uris/apple-app-site-association hints: allow: - GET customized: - href: >- - https://{yourOktaDomain}/api/v1/brands/bnd114iNkrcN6aR680g4/well-known-uris/apple-app-site-association/customized + href: https://{yourOktaDomain}/api/v1/brands/bnd114iNkrcN6aR680g4/well-known-uris/apple-app-site-association/customized hints: allow: - GET @@ -3958,9 +3934,7 @@ components: errorLink: E0000001 errorId: sampleiCF-8D5rLW6myqiPItW errorCauses: - - errorSummary: >- - The specified path is not supported. Valid values: - [apple-app-site-association, assetlinks.json, webauthn]. + - errorSummary: 'The specified path is not supported. Valid values: [apple-app-site-association, assetlinks.json, webauthn].' WellKnownURIResponse: value: representation: @@ -3970,8 +3944,7 @@ components: key3.1: value3.1 _links: self: - href: >- - https://{yourOktaDomain}/api/v1/brands/bnd114iNkrcN6aR680g4/well-known-uris/apple-app-site-association/customized + href: https://{yourOktaDomain}/api/v1/brands/bnd114iNkrcN6aR680g4/well-known-uris/apple-app-site-association/customized hints: allow: - GET @@ -4090,7 +4063,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.brands + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListBrandsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"brands\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_brand: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1brands/post' response: @@ -4103,6 +4088,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_brand: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1brands~1{brandId}/put' response: @@ -4112,12 +4100,12 @@ components: operation: $ref: '#/paths/~1api~1v1~1brands~1{brandId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: '#/components/x-stackQL-resources/brands/methods/list_brands' - $ref: '#/components/x-stackQL-resources/brands/methods/get_brand' + - $ref: '#/components/x-stackQL-resources/brands/methods/list_brands' insert: - $ref: '#/components/x-stackQL-resources/brands/methods/create_brand' update: [] @@ -4138,8 +4126,7 @@ components: openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/domains/methods/list_brand_domains + - $ref: '#/components/x-stackQL-resources/domains/methods/list_brand_domains' insert: [] update: [] delete: [] @@ -4174,6 +4161,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_customized_error_page: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1pages~1error~1customized/put' response: @@ -4181,23 +4171,19 @@ components: openAPIDocKey: '200' delete_customized_error_page: operation: - $ref: >- - #/paths/~1api~1v1~1brands~1{brandId}~1pages~1error~1customized/delete + $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1pages~1error~1customized/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/customized_error_page/methods/get_customized_error_page + - $ref: '#/components/x-stackQL-resources/customized_error_page/methods/get_customized_error_page' insert: [] update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/customized_error_page/methods/delete_customized_error_page + - $ref: '#/components/x-stackQL-resources/customized_error_page/methods/delete_customized_error_page' replace: - - $ref: >- - #/components/x-stackQL-resources/customized_error_page/methods/replace_customized_error_page + - $ref: '#/components/x-stackQL-resources/customized_error_page/methods/replace_customized_error_page' default_error_page: id: okta.brands.default_error_page name: default_error_page @@ -4211,8 +4197,7 @@ components: openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/default_error_page/methods/get_default_error_page + - $ref: '#/components/x-stackQL-resources/default_error_page/methods/get_default_error_page' insert: [] update: [] delete: [] @@ -4229,6 +4214,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_preview_error_page: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1pages~1error~1preview/put' response: @@ -4238,20 +4226,17 @@ components: operation: $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1pages~1error~1preview/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/preview_error_page/methods/get_preview_error_page + - $ref: '#/components/x-stackQL-resources/preview_error_page/methods/get_preview_error_page' insert: [] update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/preview_error_page/methods/delete_preview_error_page + - $ref: '#/components/x-stackQL-resources/preview_error_page/methods/delete_preview_error_page' replace: - - $ref: >- - #/components/x-stackQL-resources/preview_error_page/methods/replace_preview_error_page + - $ref: '#/components/x-stackQL-resources/preview_error_page/methods/replace_preview_error_page' sign_in_page: id: okta.brands.sign_in_page name: sign_in_page @@ -4265,20 +4250,17 @@ components: openAPIDocKey: '200' delete_customized_sign_in_page: operation: - $ref: >- - #/paths/~1api~1v1~1brands~1{brandId}~1pages~1sign-in~1customized/delete + $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1pages~1sign-in~1customized/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/sign_in_page/methods/get_sign_in_page + - $ref: '#/components/x-stackQL-resources/sign_in_page/methods/get_sign_in_page' insert: [] update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/sign_in_page/methods/delete_customized_sign_in_page + - $ref: '#/components/x-stackQL-resources/sign_in_page/methods/delete_customized_sign_in_page' replace: [] customized_sign_in_page: id: okta.brands.customized_sign_in_page @@ -4287,28 +4269,27 @@ components: methods: get_customized_sign_in_page: operation: - $ref: >- - #/paths/~1api~1v1~1brands~1{brandId}~1pages~1sign-in~1customized/get + $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1pages~1sign-in~1customized/get' response: mediaType: application/json openAPIDocKey: '200' replace_customized_sign_in_page: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1brands~1{brandId}~1pages~1sign-in~1customized/put + $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1pages~1sign-in~1customized/put' response: mediaType: application/json openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/customized_sign_in_page/methods/get_customized_sign_in_page + - $ref: '#/components/x-stackQL-resources/customized_sign_in_page/methods/get_customized_sign_in_page' insert: [] update: [] delete: [] replace: - - $ref: >- - #/components/x-stackQL-resources/customized_sign_in_page/methods/replace_customized_sign_in_page + - $ref: '#/components/x-stackQL-resources/customized_sign_in_page/methods/replace_customized_sign_in_page' default_sign_in_page: id: okta.brands.default_sign_in_page name: default_sign_in_page @@ -4322,8 +4303,7 @@ components: openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/default_sign_in_page/methods/get_default_sign_in_page + - $ref: '#/components/x-stackQL-resources/default_sign_in_page/methods/get_default_sign_in_page' insert: [] update: [] delete: [] @@ -4340,6 +4320,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_preview_sign_in_page: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1pages~1sign-in~1preview/put' response: @@ -4347,23 +4330,19 @@ components: openAPIDocKey: '200' delete_preview_sign_in_page: operation: - $ref: >- - #/paths/~1api~1v1~1brands~1{brandId}~1pages~1sign-in~1preview/delete + $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1pages~1sign-in~1preview/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/preview_sign_in_page/methods/get_preview_sign_in_page + - $ref: '#/components/x-stackQL-resources/preview_sign_in_page/methods/get_preview_sign_in_page' insert: [] update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/preview_sign_in_page/methods/delete_preview_sign_in_page + - $ref: '#/components/x-stackQL-resources/preview_sign_in_page/methods/delete_preview_sign_in_page' replace: - - $ref: >- - #/components/x-stackQL-resources/preview_sign_in_page/methods/replace_preview_sign_in_page + - $ref: '#/components/x-stackQL-resources/preview_sign_in_page/methods/replace_preview_sign_in_page' sign_in_widget_versions: id: okta.brands.sign_in_widget_versions name: sign_in_widget_versions @@ -4371,15 +4350,24 @@ components: methods: list_all_sign_in_widget_versions: operation: - $ref: >- - #/paths/~1api~1v1~1brands~1{brandId}~1pages~1sign-in~1widget-versions/get + $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1pages~1sign-in~1widget-versions/get' response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.sign_in_widget_versions + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListAllSignInWidgetVersionsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"items\":%s}" . -}} + {{- $parsed := jsonMapFromString $wrapped -}} + {{- $items := index $parsed "items" -}} + {"sign_in_widget_versions":[{{- range $i, $v := $items -}}{{- if $i -}},{{- end -}}{"sign_in_widget_version":"{{- $v -}}"}{{- end -}}]} + type: golang_template_text_v0.3.0 sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/sign_in_widget_versions/methods/list_all_sign_in_widget_versions + - $ref: '#/components/x-stackQL-resources/sign_in_widget_versions/methods/list_all_sign_in_widget_versions' insert: [] update: [] delete: [] @@ -4391,28 +4379,27 @@ components: methods: get_sign_out_page_settings: operation: - $ref: >- - #/paths/~1api~1v1~1brands~1{brandId}~1pages~1sign-out~1customized/get + $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1pages~1sign-out~1customized/get' response: mediaType: application/json openAPIDocKey: '200' replace_sign_out_page_settings: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1brands~1{brandId}~1pages~1sign-out~1customized/put + $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1pages~1sign-out~1customized/put' response: mediaType: application/json openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/sign_out_page_settings/methods/get_sign_out_page_settings + - $ref: '#/components/x-stackQL-resources/sign_out_page_settings/methods/get_sign_out_page_settings' insert: [] update: [] delete: [] replace: - - $ref: >- - #/components/x-stackQL-resources/sign_out_page_settings/methods/replace_sign_out_page_settings + - $ref: '#/components/x-stackQL-resources/sign_out_page_settings/methods/replace_sign_out_page_settings' email_templates: id: okta.brands.email_templates name: email_templates @@ -4424,26 +4411,31 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.email_templates + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListEmailTemplatesResponse' + transform: + body: |- + {{- $wrapped := printf "{\"email_templates\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 get_email_template: operation: - $ref: >- - #/paths/~1api~1v1~1brands~1{brandId}~1templates~1email~1{templateName}/get + $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1templates~1email~1{templateName}/get' response: mediaType: application/json openAPIDocKey: '200' send_test_email: operation: - $ref: >- - #/paths/~1api~1v1~1brands~1{brandId}~1templates~1email~1{templateName}~1test/post + $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1templates~1email~1{templateName}~1test/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/email_templates/methods/list_email_templates - - $ref: >- - #/components/x-stackQL-resources/email_templates/methods/get_email_template + - $ref: '#/components/x-stackQL-resources/email_templates/methods/get_email_template' + - $ref: '#/components/x-stackQL-resources/email_templates/methods/list_email_templates' insert: [] update: [] delete: [] @@ -4455,64 +4447,67 @@ components: methods: list_email_customizations: operation: - $ref: >- - #/paths/~1api~1v1~1brands~1{brandId}~1templates~1email~1{templateName}~1customizations/get + $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1templates~1email~1{templateName}~1customizations/get' response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.email_customizations + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListEmailCustomizationsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"email_customizations\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_email_customization: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1brands~1{brandId}~1templates~1email~1{templateName}~1customizations/post + $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1templates~1email~1{templateName}~1customizations/post' response: mediaType: application/json openAPIDocKey: '201' delete_all_customizations: operation: - $ref: >- - #/paths/~1api~1v1~1brands~1{brandId}~1templates~1email~1{templateName}~1customizations/delete + $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1templates~1email~1{templateName}~1customizations/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' get_email_customization: operation: - $ref: >- - #/paths/~1api~1v1~1brands~1{brandId}~1templates~1email~1{templateName}~1customizations~1{customizationId}/get + $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1templates~1email~1{templateName}~1customizations~1{customizationId}/get' response: mediaType: application/json openAPIDocKey: '200' replace_email_customization: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1brands~1{brandId}~1templates~1email~1{templateName}~1customizations~1{customizationId}/put + $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1templates~1email~1{templateName}~1customizations~1{customizationId}/put' response: mediaType: application/json openAPIDocKey: '200' delete_email_customization: operation: - $ref: >- - #/paths/~1api~1v1~1brands~1{brandId}~1templates~1email~1{templateName}~1customizations~1{customizationId}/delete + $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1templates~1email~1{templateName}~1customizations~1{customizationId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/email_template_customizations/methods/list_email_customizations - - $ref: >- - #/components/x-stackQL-resources/email_template_customizations/methods/get_email_customization + - $ref: '#/components/x-stackQL-resources/email_template_customizations/methods/get_email_customization' + - $ref: '#/components/x-stackQL-resources/email_template_customizations/methods/list_email_customizations' insert: - - $ref: >- - #/components/x-stackQL-resources/email_template_customizations/methods/create_email_customization + - $ref: '#/components/x-stackQL-resources/email_template_customizations/methods/create_email_customization' update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/email_template_customizations/methods/delete_all_customizations - - $ref: >- - #/components/x-stackQL-resources/email_template_customizations/methods/delete_email_customization + - $ref: '#/components/x-stackQL-resources/email_template_customizations/methods/delete_email_customization' + - $ref: '#/components/x-stackQL-resources/email_template_customizations/methods/delete_all_customizations' replace: - - $ref: >- - #/components/x-stackQL-resources/email_template_customizations/methods/replace_email_customization + - $ref: '#/components/x-stackQL-resources/email_template_customizations/methods/replace_email_customization' customization_preview: id: okta.brands.customization_preview name: customization_preview @@ -4520,15 +4515,13 @@ components: methods: get_customization_preview: operation: - $ref: >- - #/paths/~1api~1v1~1brands~1{brandId}~1templates~1email~1{templateName}~1customizations~1{customizationId}~1preview/get + $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1templates~1email~1{templateName}~1customizations~1{customizationId}~1preview/get' response: mediaType: application/json openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/customization_preview/methods/get_customization_preview + - $ref: '#/components/x-stackQL-resources/customization_preview/methods/get_customization_preview' insert: [] update: [] delete: [] @@ -4540,15 +4533,13 @@ components: methods: get_email_default_content: operation: - $ref: >- - #/paths/~1api~1v1~1brands~1{brandId}~1templates~1email~1{templateName}~1default-content/get + $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1templates~1email~1{templateName}~1default-content/get' response: mediaType: application/json openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/email_default_content/methods/get_email_default_content + - $ref: '#/components/x-stackQL-resources/email_default_content/methods/get_email_default_content' insert: [] update: [] delete: [] @@ -4560,15 +4551,13 @@ components: methods: get_email_default_preview: operation: - $ref: >- - #/paths/~1api~1v1~1brands~1{brandId}~1templates~1email~1{templateName}~1default-content~1preview/get + $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1templates~1email~1{templateName}~1default-content~1preview/get' response: mediaType: application/json openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/email_default_preview/methods/get_email_default_preview + - $ref: '#/components/x-stackQL-resources/email_default_preview/methods/get_email_default_preview' insert: [] update: [] delete: [] @@ -4580,28 +4569,27 @@ components: methods: get_email_settings: operation: - $ref: >- - #/paths/~1api~1v1~1brands~1{brandId}~1templates~1email~1{templateName}~1settings/get + $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1templates~1email~1{templateName}~1settings/get' response: mediaType: application/json openAPIDocKey: '200' replace_email_settings: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1brands~1{brandId}~1templates~1email~1{templateName}~1settings/put + $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1templates~1email~1{templateName}~1settings/put' response: mediaType: application/json openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/email_settings/methods/get_email_settings + - $ref: '#/components/x-stackQL-resources/email_settings/methods/get_email_settings' insert: [] update: [] delete: [] replace: - - $ref: >- - #/components/x-stackQL-resources/email_settings/methods/replace_email_settings + - $ref: '#/components/x-stackQL-resources/email_settings/methods/replace_email_settings' themes: id: okta.brands.themes name: themes @@ -4613,6 +4601,15 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.brand_themes + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListBrandThemesResponse' + transform: + body: |- + {{- $wrapped := printf "{\"brand_themes\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 get_brand_theme: operation: $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1themes~1{themeId}/get' @@ -4620,40 +4617,48 @@ components: mediaType: application/json openAPIDocKey: '200' replace_brand_theme: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1themes~1{themeId}/put' response: mediaType: application/json openAPIDocKey: '200' upload_brand_theme_background_image: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1brands~1{brandId}~1themes~1{themeId}~1background-image/post + $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1themes~1{themeId}~1background-image/post' response: mediaType: application/json openAPIDocKey: '201' delete_brand_theme_background_image: operation: - $ref: >- - #/paths/~1api~1v1~1brands~1{brandId}~1themes~1{themeId}~1background-image/delete + $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1themes~1{themeId}~1background-image/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' upload_brand_theme_favicon: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1brands~1{brandId}~1themes~1{themeId}~1favicon/post + $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1themes~1{themeId}~1favicon/post' response: mediaType: application/json openAPIDocKey: '201' delete_brand_theme_favicon: operation: - $ref: >- - #/paths/~1api~1v1~1brands~1{brandId}~1themes~1{themeId}~1favicon/delete + $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1themes~1{themeId}~1favicon/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' upload_brand_theme_logo: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1themes~1{themeId}~1logo/post' response: @@ -4661,21 +4666,19 @@ components: openAPIDocKey: '200' delete_brand_theme_logo: operation: - $ref: >- - #/paths/~1api~1v1~1brands~1{brandId}~1themes~1{themeId}~1logo/delete + $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1themes~1{themeId}~1logo/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: '#/components/x-stackQL-resources/themes/methods/list_brand_themes' - $ref: '#/components/x-stackQL-resources/themes/methods/get_brand_theme' + - $ref: '#/components/x-stackQL-resources/themes/methods/list_brand_themes' insert: [] update: [] delete: [] replace: - - $ref: >- - #/components/x-stackQL-resources/themes/methods/replace_brand_theme + - $ref: '#/components/x-stackQL-resources/themes/methods/replace_brand_theme' well_known_uris: id: okta.brands.well_known_uris name: well_known_uris @@ -4695,10 +4698,8 @@ components: openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/well_known_uris/methods/get_all_well_known_uris - - $ref: >- - #/components/x-stackQL-resources/well_known_uris/methods/get_root_brand_well_known_uri + - $ref: '#/components/x-stackQL-resources/well_known_uris/methods/get_root_brand_well_known_uri' + - $ref: '#/components/x-stackQL-resources/well_known_uris/methods/get_all_well_known_uris' insert: [] update: [] delete: [] @@ -4710,34 +4711,41 @@ components: methods: get_brand_well_known_uri: operation: - $ref: >- - #/paths/~1api~1v1~1brands~1{brandId}~1well-known-uris~1{path}~1customized/get + $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1well-known-uris~1{path}~1customized/get' response: mediaType: application/json openAPIDocKey: '200' replace_brand_well_known_uri: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1brands~1{brandId}~1well-known-uris~1{path}~1customized/put + $ref: '#/paths/~1api~1v1~1brands~1{brandId}~1well-known-uris~1{path}~1customized/put' response: mediaType: application/json openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/brand_well_known_uris/methods/get_brand_well_known_uri + - $ref: '#/components/x-stackQL-resources/brand_well_known_uris/methods/get_brand_well_known_uri' insert: [] update: [] delete: [] replace: - - $ref: >- - #/components/x-stackQL-resources/brand_well_known_uris/methods/replace_brand_well_known_uri + - $ref: '#/components/x-stackQL-resources/brand_well_known_uris/methods/replace_brand_well_known_uri' servers: - url: https://{subdomain}.okta.com/ variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/captchas.yaml b/providers/src/okta/v00.00.00000/services/captchas.yaml index d796893a..a3187102 100644 --- a/providers/src/okta/v00.00.00000/services/captchas.yaml +++ b/providers/src/okta/v00.00.00000/services/captchas.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: captchas API description: okta captchas API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/captchas: get: @@ -18,9 +18,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/CAPTCHAInstance' + $ref: '#/components/schemas/ListCaptchaInstancesResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '429': @@ -126,6 +124,8 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine + parameters: + - $ref: '#/components/parameters/pathCaptchaId' post: summary: Update a CAPTCHA instance description: Partially updates the properties of a specified CAPTCHA instance @@ -173,6 +173,8 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine + parameters: + - $ref: '#/components/parameters/pathCaptchaId' put: summary: Replace a CAPTCHA instance description: Replaces the properties for a specified CAPTCHA instance @@ -220,6 +222,8 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine + parameters: + - $ref: '#/components/parameters/pathCaptchaId' delete: summary: Delete a CAPTCHA instance description: >- @@ -259,8 +263,8 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathCaptchaId' + parameters: + - $ref: '#/components/parameters/pathCaptchaId' components: schemas: CAPTCHAInstance: @@ -340,10 +344,38 @@ components: errorSummary: type: string HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object additionalProperties: true type: object @@ -387,6 +419,13 @@ components: - GET - POST - PUT + ListCaptchaInstancesResponse: + type: object + properties: + captcha_instances: + type: array + items: + $ref: '#/components/schemas/CAPTCHAInstance' responses: ErrorAccessDenied403: description: Forbidden @@ -537,7 +576,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.captcha_instances + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListCaptchaInstancesResponse' + transform: + body: |- + {{- $wrapped := printf "{\"captcha_instances\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_captcha_instance: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1captchas/post' response: @@ -550,12 +601,18 @@ components: mediaType: application/json openAPIDocKey: '200' update_captcha_instance: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1captchas~1{captchaId}/post' response: mediaType: application/json openAPIDocKey: '200' replace_captcha_instance: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1captchas~1{captchaId}/put' response: @@ -565,14 +622,14 @@ components: operation: $ref: '#/paths/~1api~1v1~1captchas~1{captchaId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/captcha_instances/methods/list_captcha_instances - $ref: >- #/components/x-stackQL-resources/captcha_instances/methods/get_captcha_instance + - $ref: >- + #/components/x-stackQL-resources/captcha_instances/methods/list_captcha_instances insert: - $ref: >- #/components/x-stackQL-resources/captcha_instances/methods/create_captcha_instance @@ -590,7 +647,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/device_access.yaml b/providers/src/okta/v00.00.00000/services/device_access.yaml deleted file mode 100644 index c041ca9c..00000000 --- a/providers/src/okta/v00.00.00000/services/device_access.yaml +++ /dev/null @@ -1,326 +0,0 @@ -openapi: 3.0.3 -info: - title: device_access API - description: okta device_access API - version: 5.1.0 -paths: - /device-access/api/v1/desktop-mfa/enforce-number-matching-challenge-settings: - get: - summary: Retrieve the Desktop MFA Enforce Number Matching Challenge org setting - description: >- - Retrieves the status of the Desktop MFA Enforce Number Matching - Challenge push notifications feature. That is, whether or not the - feature is enabled for your org. - operationId: getDesktopMFAEnforceNumberMatchingChallengeOrgSetting - responses: - '200': - description: OK - content: - application/json: - schema: - $ref: >- - #/components/schemas/DesktopMFAEnforceNumberMatchingChallengeOrgSetting - '403': - $ref: '#/components/responses/ErrorAccessDenied403' - '429': - $ref: '#/components/responses/ErrorTooManyRequests429' - security: - - apiToken: [] - - oauth2: - - okta.orgs.read - tags: - - DeviceAccess - x-okta-lifecycle: - lifecycle: LIMITED_GA - isGenerallyAvailable: false - SKUs: - - Okta Identity Engine - put: - summary: Replace the Desktop MFA Enforce Number Matching Challenge org setting - description: >- - Replaces the status of the Desktop MFA Enforce Number Matching Challenge - push notifications feature. That is, whether or not the feature is - enabled for your org. - operationId: replaceDesktopMFAEnforceNumberMatchingChallengeOrgSetting - x-codegen-request-body-name: DesktopMFAEnforceNumberMatchingChallengeOrgSetting - requestBody: - content: - application/json: - schema: - $ref: >- - #/components/schemas/DesktopMFAEnforceNumberMatchingChallengeOrgSetting - required: true - responses: - '200': - description: OK - content: - application/json: - schema: - $ref: >- - #/components/schemas/DesktopMFAEnforceNumberMatchingChallengeOrgSetting - '400': - $ref: '#/components/responses/ErrorApiValidationFailed400' - '403': - description: Forbidden - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - examples: - Access Denied: - $ref: '#/components/examples/ErrorAccessDenied' - '429': - $ref: '#/components/responses/ErrorTooManyRequests429' - security: - - apiToken: [] - - oauth2: - - okta.orgs.manage - tags: - - DeviceAccess - x-okta-lifecycle: - lifecycle: LIMITED_GA - isGenerallyAvailable: false - SKUs: - - Okta Identity Engine - /device-access/api/v1/desktop-mfa/recovery-pin-settings: - get: - summary: Retrieve the Desktop MFA Recovery PIN org setting - description: >- - Retrieves the status of the Desktop MFA Recovery PIN feature. That is, - whether or not the feature is enabled for your org. - operationId: getDesktopMFARecoveryPinOrgSetting - responses: - '200': - description: OK - content: - application/json: - schema: - $ref: '#/components/schemas/DesktopMFARecoveryPinOrgSetting' - '403': - $ref: '#/components/responses/ErrorAccessDenied403' - '429': - $ref: '#/components/responses/ErrorTooManyRequests429' - security: - - apiToken: [] - - oauth2: - - okta.orgs.read - tags: - - DeviceAccess - x-okta-lifecycle: - lifecycle: LIMITED_GA - isGenerallyAvailable: false - SKUs: - - Okta Identity Engine - put: - summary: Replace the Desktop MFA Recovery PIN org setting - description: Replaces the Desktop MFA Recovery PIN feature for your org - operationId: replaceDesktopMFARecoveryPinOrgSetting - x-codegen-request-body-name: DesktopMFARecoveryPinOrgSetting - requestBody: - content: - application/json: - schema: - $ref: '#/components/schemas/DesktopMFARecoveryPinOrgSetting' - required: true - responses: - '200': - description: OK - content: - application/json: - schema: - $ref: '#/components/schemas/DesktopMFARecoveryPinOrgSetting' - '400': - $ref: '#/components/responses/ErrorApiValidationFailed400' - '403': - description: Forbidden - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - examples: - Access Denied: - $ref: '#/components/examples/ErrorAccessDenied' - '429': - $ref: '#/components/responses/ErrorTooManyRequests429' - security: - - apiToken: [] - - oauth2: - - okta.orgs.manage - tags: - - DeviceAccess - x-okta-lifecycle: - lifecycle: LIMITED_GA - isGenerallyAvailable: false - SKUs: - - Okta Identity Engine -components: - schemas: - DesktopMFAEnforceNumberMatchingChallengeOrgSetting: - type: object - properties: - desktopMFAEnforceNumberMatchingChallengeEnabled: - type: boolean - description: >- - Indicates whether or not the Desktop MFA Enforce Number Matching - Challenge push notifications feature is enabled - default: false - Error: - title: Error - type: object - properties: - errorCauses: - type: array - items: - $ref: '#/components/schemas/ErrorCause' - errorCode: - type: string - description: An Okta code for this type of error - errorId: - type: string - description: >- - A unique identifier for this error. This can be used by Okta Support - to help with troubleshooting. - errorLink: - type: string - description: An Okta code for this type of error - errorSummary: - type: string - description: >- - A short description of what caused this error. Sometimes this - contains dynamically-generated information about your specific - error. - DesktopMFARecoveryPinOrgSetting: - type: object - properties: - desktopMFARecoveryPinEnabled: - type: boolean - description: >- - Indicates whether or not the Desktop MFA Recovery PIN feature is - enabled - default: false - ErrorCause: - type: object - properties: - errorSummary: - type: string - responses: - ErrorAccessDenied403: - description: Forbidden - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - examples: - AccessDenied: - $ref: '#/components/examples/ErrorAccessDenied' - ErrorTooManyRequests429: - description: Too Many Requests - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - examples: - TooManyRequests: - $ref: '#/components/examples/ErrorTooManyRequests' - ErrorApiValidationFailed400: - description: Bad Request - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - examples: - APIValidationFailed: - $ref: '#/components/examples/ErrorApiValidationFailed' - examples: - ErrorAccessDenied: - summary: Access Denied - value: - errorCode: E0000006 - errorSummary: You do not have permission to perform the requested action - errorLink: E0000006 - errorId: sampleNUSD_8fdkFd8fs8SDBK - errorCauses: [] - ErrorTooManyRequests: - summary: Too Many Requests - value: - errorCode: E0000047 - errorSummary: API call exceeded rate limit due to too many requests. - errorLink: E0000047 - errorId: sampleQPivGUj_ND5v78vbYWW - errorCauses: [] - ErrorApiValidationFailed: - summary: API Validation Failed - value: - errorCode: E0000001 - errorSummary: 'Api validation failed: {0}' - errorLink: E0000001 - errorId: sampleiCF-8D5rLW6myqiPItW - errorCauses: [] - x-stackQL-resources: - mfa_challenge_org_setting: - id: okta.device_access.mfa_challenge_org_setting - name: mfa_challenge_org_setting - title: Mfa Challenge Org Setting - methods: - get_desktop_mfaenforce_number_matching_challenge_org_setting: - operation: - $ref: >- - #/paths/~1device-access~1api~1v1~1desktop-mfa~1enforce-number-matching-challenge-settings/get - response: - mediaType: application/json - openAPIDocKey: '200' - replace_desktop_mfaenforce_number_matching_challenge_org_setting: - operation: - $ref: >- - #/paths/~1device-access~1api~1v1~1desktop-mfa~1enforce-number-matching-challenge-settings/put - response: - mediaType: application/json - openAPIDocKey: '200' - sqlVerbs: - select: - - $ref: >- - #/components/x-stackQL-resources/mfa_challenge_org_setting/methods/get_desktop_mfaenforce_number_matching_challenge_org_setting - insert: [] - update: [] - delete: [] - replace: - - $ref: >- - #/components/x-stackQL-resources/mfa_challenge_org_setting/methods/replace_desktop_mfaenforce_number_matching_challenge_org_setting - mfa_recovery_pin_setting: - id: okta.device_access.mfa_recovery_pin_setting - name: mfa_recovery_pin_setting - title: Mfa Recovery Pin Setting - methods: - get_desktop_mfarecovery_pin_org_setting: - operation: - $ref: >- - #/paths/~1device-access~1api~1v1~1desktop-mfa~1recovery-pin-settings/get - response: - mediaType: application/json - openAPIDocKey: '200' - replace_desktop_mfarecovery_pin_org_setting: - operation: - $ref: >- - #/paths/~1device-access~1api~1v1~1desktop-mfa~1recovery-pin-settings/put - response: - mediaType: application/json - openAPIDocKey: '200' - sqlVerbs: - select: - - $ref: >- - #/components/x-stackQL-resources/mfa_recovery_pin_setting/methods/get_desktop_mfarecovery_pin_org_setting - insert: [] - update: [] - delete: [] - replace: - - $ref: >- - #/components/x-stackQL-resources/mfa_recovery_pin_setting/methods/replace_desktop_mfarecovery_pin_org_setting -servers: - - url: https://{subdomain}.okta.com/ - variables: - subdomain: - default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. diff --git a/providers/src/okta/v00.00.00000/services/device_assurances.yaml b/providers/src/okta/v00.00.00000/services/device_assurances.yaml index aced4ba1..4c3736ac 100644 --- a/providers/src/okta/v00.00.00000/services/device_assurances.yaml +++ b/providers/src/okta/v00.00.00000/services/device_assurances.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: device_assurances API description: okta device_assurances API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/device-assurances: get: @@ -15,9 +15,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/DeviceAssurance' + $ref: '#/components/schemas/ListDeviceAssurancePoliciesResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '429': @@ -111,12 +109,9 @@ paths: ChromeOSWithGracePeriod: $ref: >- #/components/examples/DeviceAssuranceChromeOSWithGracePeriodRequest - MacOSWithDevicePostureChecks: + AndroidWithCallerContext: $ref: >- - #/components/examples/DeviceAssuranceMacOSWithDevicePostureChecksRequest - WindowsWithDevicePostureChecks: - $ref: >- - #/components/examples/DeviceAssuranceWindowsWithDevicePostureChecksRequest + #/components/examples/DeviceAssuranceAndroidWithCallerContextRequest required: true responses: '200': @@ -194,12 +189,9 @@ paths: ChromeOSWithGracePeriod: $ref: >- #/components/examples/DeviceAssuranceChromeOSWithGracePeriodResponse - MacOSWithDevicePostureChecks: - $ref: >- - #/components/examples/DeviceAssuranceMacOSWithDevicePostureChecksResponse - WindowsWithDevicePostureChecks: + AndroidWithCallerContext: $ref: >- - #/components/examples/DeviceAssuranceWindowsWithDevicePostureChecksResponse + #/components/examples/DeviceAssuranceAndroidWithCallerContextResponse '400': $ref: '#/components/responses/ErrorApiValidationFailed400' '403': @@ -298,12 +290,9 @@ paths: ChromeOSWithGracePeriod: $ref: >- #/components/examples/DeviceAssuranceChromeOSWithGracePeriodResponse - MacOSWithDevicePostureChecks: + AndroidWithCallerContext: $ref: >- - #/components/examples/DeviceAssuranceMacOSWithDevicePostureChecksResponse - WindowsWithDevicePostureChecks: - $ref: >- - #/components/examples/DeviceAssuranceWindowsWithDevicePostureChecksResponse + #/components/examples/DeviceAssuranceAndroidWithCallerContextResponse '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -321,6 +310,8 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine + parameters: + - $ref: '#/components/parameters/pathDeviceAssuranceId' put: summary: Replace a device assurance policy description: Replaces a device assurance policy by `deviceAssuranceId` @@ -399,12 +390,9 @@ paths: ChromeOSWithGracePeriod: $ref: >- #/components/examples/DeviceAssuranceChromeOSWithGracePeriodRequest - MacOSWithDevicePostureChecks: - $ref: >- - #/components/examples/DeviceAssuranceMacOSWithDevicePostureChecksRequest - WindowsWithDevicePostureChecks: + AndroidWithCallerContext: $ref: >- - #/components/examples/DeviceAssuranceWindowsWithDevicePostureChecksRequest + #/components/examples/DeviceAssuranceAndroidWithCallerContextRequest required: true responses: '200': @@ -482,12 +470,9 @@ paths: ChromeOSWithGracePeriod: $ref: >- #/components/examples/DeviceAssuranceChromeOSWithGracePeriodResponse - MacOSWithDevicePostureChecks: + AndroidWithCallerContext: $ref: >- - #/components/examples/DeviceAssuranceMacOSWithDevicePostureChecksResponse - WindowsWithDevicePostureChecks: - $ref: >- - #/components/examples/DeviceAssuranceWindowsWithDevicePostureChecksResponse + #/components/examples/DeviceAssuranceAndroidWithCallerContextResponse '400': $ref: '#/components/responses/ErrorApiValidationFailed400' '403': @@ -507,6 +492,8 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine + parameters: + - $ref: '#/components/parameters/pathDeviceAssuranceId' delete: summary: Delete a device assurance policy description: >- @@ -544,8 +531,8 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathDeviceAssuranceId' + parameters: + - $ref: '#/components/parameters/pathDeviceAssuranceId' components: schemas: DeviceAssurance: @@ -558,18 +545,14 @@ components: createdDate: type: string readOnly: true - devicePostureChecks: - $ref: '#/components/schemas/DevicePostureChecks' displayRemediationMode: x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] description: >- - Represents the - remediation mode of this device assurance policy when users are - denied access due to device noncompliance + Represents the remediation mode of this device assurance policy when + users are denied access due to device noncompliance type: string enum: - HIDE @@ -629,42 +612,26 @@ components: A short description of what caused this error. Sometimes this contains dynamically-generated information about your specific error. - DevicePostureChecks: - x-okta-lifecycle: - lifecycle: EA - isGenerallyAvailable: false - SKUs: [] - description: >- - Represents the Device - Posture Checks configuration for the device assurance policy - type: object - properties: - include: - type: array - description: >- - An array of key value pairs including Device Posture Check - `variableNames` - example: - - variableName: macOSFirewall - value: '1' - - variableName: windowsFirewall - value: '1' GracePeriod: + x-okta-ignore-redocly-rules-for-sdk: true x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] description: >- - Represents the Grace - Period configuration for the device assurance policy + Represents the Grace Period configuration for the device assurance + policy type: object properties: expiry: - oneOf: - - $ref: '#/components/schemas/ByDateTimeExpiry' - - $ref: '#/components/schemas/ByDurationExpiry' + description: >- + An [ISO + 8601](https://en.wikipedia.org/wiki/ISO_8601#Combined_date_and_time_representations) + formatted date and time. + format: date-time + example: '2024-12-01T00:00:00Z' + type: string + pattern: ^P(?:$)(\d+Y)?(\d+M)?(\d+W)?(\d+D)?(T(?:\d)(\d+H)?(\d+M)?(\d+S)?)?$ type: description: >- Represents the type of Grace Period configured for the device @@ -707,21 +674,6 @@ components: properties: errorSummary: type: string - ByDateTimeExpiry: - allOf: - - $ref: '#/components/schemas/DateTime' - ByDurationExpiry: - allOf: - - $ref: '#/components/schemas/TimeDuration' - description: >- - A time duration specified as an [ISO 8601 - duration](https://en.wikipedia.org/wiki/ISO_8601#Durations). - - Must be between 1 and 180 days inclusive. - HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) DateTime: description: >- An [ISO @@ -736,7 +688,39 @@ components: duration](https://en.wikipedia.org/wiki/ISO_8601#Durations). type: string pattern: ^P(?:$)(\d+Y)?(\d+M)?(\d+W)?(\d+D)?(T(?:\d)(\d+H)?(\d+M)?(\d+S)?)?$ + HrefObjectSelfLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object additionalProperties: true type: object @@ -780,6 +764,13 @@ components: - GET - POST - PUT + ListDeviceAssurancePoliciesResponse: + type: object + properties: + device_assurance_policies: + type: array + items: + $ref: '#/components/schemas/DeviceAssurance' responses: ErrorAccessDenied403: description: Forbidden @@ -831,7 +822,7 @@ components: value: name: Device assurance Android osVersion: - minimum: 12 + minimum: '12' diskEncryptionType: include: - USER @@ -914,7 +905,7 @@ components: keyTrustLevel: CHROME_OS_VERIFIED_MODE DeviceAssuranceChromeOSWithDevicePostureIdPThirdPartySignalProvidersRequest: x-okta-lifecycle: - lifecycle: EA + lifecycle: LIMITED_GA isGenerallyAvailable: false SKUs: [] summary: ChromeOS with Device Posture IdP as third-party signal provider request @@ -962,7 +953,7 @@ components: realtimeUrlCheckMode": true DeviceAssuranceMacOSWithDevicePostureIdPThirdPartySignalProvidersRequest: x-okta-lifecycle: - lifecycle: EA + lifecycle: LIMITED_GA isGenerallyAvailable: false SKUs: [] summary: macOS with Device Posture IdP as third-party signal provider request @@ -1020,15 +1011,16 @@ components: siteIsolationEnabled: true passwordProtectionWarningTrigger: PASSWORD_PROTECTION_OFF realtimeUrlCheckMode: true + antivirusEnabled: true secureBootEnabled: true windowsMachineDomain: testMachineDomain windowsUserDomain: testUserDomain crowdStrikeCustomerId: testCustomerId - crowdStrikeAgentId": testAgentId + crowdStrikeAgentId: testAgentId keyTrustLevel: CHROME_BROWSER_HW_KEY DeviceAssuranceWindowsWithDevicePostureIdPThirdPartySignalProvidersRequest: x-okta-lifecycle: - lifecycle: EA + lifecycle: LIMITED_GA isGenerallyAvailable: false SKUs: [] summary: Windows with Device Posture IdP as third-party signal provider request @@ -1051,7 +1043,7 @@ components: compliant: true DeviceAssuranceAndroidWithAndroidDeviceTrustThirdPartySignalProvidersRequest: x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] summary: Android with Android Device Trust as third-party signal provider request @@ -1083,7 +1075,7 @@ components: requireMajorVersionUpdate: true DeviceAssuranceAndroidWithDevicePostureIdPThirdPartySignalProvidersRequest: x-okta-lifecycle: - lifecycle: EA + lifecycle: LIMITED_GA isGenerallyAvailable: false SKUs: [] summary: Android with Device Posture IdP as third-party signal provider request @@ -1110,7 +1102,7 @@ components: compliant: true DeviceAssuranceIosWithDevicePostureIdPSignalProvidersRequest: x-okta-lifecycle: - lifecycle: EA + lifecycle: LIMITED_GA isGenerallyAvailable: false SKUs: [] summary: iOS with Device Posture IdP as third-party signal provider request @@ -1129,7 +1121,7 @@ components: compliant: true DeviceAssuranceAndroidWithDynamicVersionRequirementRequest: x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] summary: Android with dynamic version requirement request @@ -1151,7 +1143,7 @@ components: secureHardwarePresent: true DeviceAssuranceIosWithDynamicVersionRequirementRequest: x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] summary: iOS with dynamic version requirement request @@ -1168,7 +1160,7 @@ components: - BIOMETRIC DeviceAssuranceMacOSWithDynamicVersionRequirementRequest: x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] summary: macOS with dynamic version requirement request @@ -1190,7 +1182,7 @@ components: secureHardwarePresent: true DeviceAssuranceWindowsWithDynamicVersionRequirementsRequest: x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] summary: >- @@ -1218,7 +1210,7 @@ components: secureHardwarePresent: true DeviceAssuranceWindowsWithWin11DynamicVersionRequirementAndWin10MinimumVersionStringRequest: x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] summary: >- @@ -1244,7 +1236,7 @@ components: secureHardwarePresent: true DeviceAssuranceWindowsWithWin11MinimumVersionStringAndWin10DynamicVersionRequirementRequest: x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] summary: >- @@ -1269,7 +1261,7 @@ components: secureHardwarePresent: true DeviceAssuranceAndroidWithGracePeriodRequest: x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] summary: Android with due by date grace period request @@ -1295,7 +1287,7 @@ components: displayRemediationMode: SHOW DeviceAssuranceIosWithGracePeriodRequest: x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] summary: iOS with 30 day grace period request @@ -1314,7 +1306,7 @@ components: displayRemediationMode: SHOW DeviceAssuranceMacOSWithGracePeriodRequest: x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] summary: macOS request with due by date grace period request @@ -1337,7 +1329,7 @@ components: displayRemediationMode: SHOW DeviceAssuranceWindowsWithGracePeriodRequest: x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] summary: Windows with 7 day grace period request @@ -1360,7 +1352,7 @@ components: displayRemediationMode: SHOW DeviceAssuranceChromeOSWithGracePeriodRequest: x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] summary: ChromeOS with 7 day grace period request @@ -1389,59 +1381,35 @@ components: passwordProtectionWarningTrigger: PASSWORD_PROTECTION_OFF realtimeUrlCheckMode: true keyTrustLevel: CHROME_OS_VERIFIED_MODE - DeviceAssuranceMacOSWithDevicePostureChecksRequest: - x-okta-lifecycle: - lifecycle: EA - isGenerallyAvailable: false - SKUs: [] - summary: macOS request with OSQuery device posture check - value: - name: Device assurance macOS - osVersion: - minimum: 12.4.5 - diskEncryptionType: - include: - - ALL_INTERNAL_VOLUMES - platform: MACOS - screenLockType: - include: - - PASSCODE - - BIOMETRIC - secureHardwarePresent: true - devicePostureChecks: - include: - - variableName: macOSFirewall - value: '1' - DeviceAssuranceWindowsWithDevicePostureChecksRequest: + DeviceAssuranceAndroidWithCallerContextRequest: x-okta-lifecycle: lifecycle: EA isGenerallyAvailable: false SKUs: [] - summary: Windows request with OSQuery device posture check + summary: Android with caller context request value: - name: Device assurance Windows + name: Device assurance Android osVersion: - minimum: 12.4.5.9 + minimum: '12' diskEncryptionType: include: - - ALL_INTERNAL_VOLUMES - platform: WINDOWS + - USER + - FULL + jailbreak: false + platform: ANDROID screenLockType: include: - - PASSCODE - BIOMETRIC secureHardwarePresent: true - devicePostureChecks: - include: - - variableName: windowsFirewall - value: '1' + callerContext: + managedApp: true DeviceAssuranceAndroidResponse: summary: Android response value: id: dae3m8o4rWhwReDeM1c5 name: Device assurance Android lastUpdate: '2022-01-01T00:00:00.000Z' - createdUpdate: '2022-01-01T00:00:00.000Z' + createdDate: '2022-01-01T00:00:00.000Z' lastUpdatedBy: 00u217pyf72CdUrBt1c5 createdBy: 00u217pyf72CdUrBt1c5 osVersion: @@ -1471,7 +1439,7 @@ components: id: dae3m8o4rWhwReDeM1c5 name: Device assurance iOS lastUpdate: '2022-01-01T00:00:00.000Z' - createdUpdate: '2022-01-01T00:00:00.000Z' + createdDate: '2022-01-01T00:00:00.000Z' lastUpdatedBy: 00u217pyf72CdUrBt1c5 createdBy: 00u217pyf72CdUrBt1c5 osVersion: @@ -1496,7 +1464,7 @@ components: id: dae3m8o4rWhwReDeM1c5 name: Device assurance macOS lastUpdate: '2022-01-01T00:00:00.000Z' - createdUpdate: '2022-01-01T00:00:00.000Z' + createdDate: '2022-01-01T00:00:00.000Z' lastUpdatedBy: 00u217pyf72CdUrBt1c5 createdBy: 00u217pyf72CdUrBt1c5 osVersion: @@ -1525,7 +1493,7 @@ components: id: dae3m8o4rWhwReDeM1c5 name: Device assurance Windows lastUpdate: '2022-01-01T00:00:00.000Z' - createdUpdate: '2022-01-01T00:00:00.000Z' + createdDate: '2022-01-01T00:00:00.000Z' lastUpdatedBy: 00u217pyf72CdUrBt1c5 createdBy: 00u217pyf72CdUrBt1c5 osVersion: @@ -1560,7 +1528,7 @@ components: id: dae3m8o4rWhwReDeM1c5 name: Device assurance ChromeOS lastUpdate: '2022-01-01T00:00:00.000Z' - createdUpdate: '2022-01-01T00:00:00.000Z' + createdDate: '2022-01-01T00:00:00.000Z' lastUpdatedBy: 00u217pyf72CdUrBt1c5 createdBy: 00u217pyf72CdUrBt1c5 platform: CHROMEOS @@ -1593,7 +1561,7 @@ components: - PUT DeviceAssuranceChromeOSWithDevicePostureIdPThirdPartySignalProvidersResponse: x-okta-lifecycle: - lifecycle: EA + lifecycle: LIMITED_GA isGenerallyAvailable: false SKUs: [] summary: ChromeOS with Device Posture IdP as third-party signal provider response @@ -1601,7 +1569,7 @@ components: id: dae3m8o4rWhwReDeM1c5 name: Device assurance ChromeOS lastUpdate: '2022-01-01T00:00:00.000Z' - createdUpdate: '2022-01-01T00:00:00.000Z' + createdDate: '2022-01-01T00:00:00.000Z' lastUpdatedBy: 00u217pyf72CdUrBt1c5 createdBy: 00u217pyf72CdUrBt1c5 platform: CHROMEOS @@ -1630,7 +1598,7 @@ components: id: dae3m8o4rWhwReDeM1c5 name: Device assurance macOS lastUpdate: '2022-01-01T00:00:00.000Z' - createdUpdate: '2022-01-01T00:00:00.000Z' + createdDate: '2022-01-01T00:00:00.000Z' lastUpdatedBy: 00u217pyf72CdUrBt1c5 createdBy: 00u217pyf72CdUrBt1c5 osVersion: @@ -1672,7 +1640,7 @@ components: - PUT DeviceAssuranceMacOSWithDevicePostureIdPThirdPartySignalProvidersResponse: x-okta-lifecycle: - lifecycle: EA + lifecycle: LIMITED_GA isGenerallyAvailable: false SKUs: [] summary: macOS with Device Posture IdP as third-party signal provider response @@ -1680,7 +1648,7 @@ components: id: dae3m8o4rWhwReDeM1c5 name: Device assurance macOS lastUpdate: '2022-01-01T00:00:00.000Z' - createdUpdate: '2022-01-01T00:00:00.000Z' + createdDate: '2022-01-01T00:00:00.000Z' lastUpdatedBy: 00u217pyf72CdUrBt1c5 createdBy: 00u217pyf72CdUrBt1c5 osVersion: @@ -1719,7 +1687,7 @@ components: id: dae3m8o4rWhwReDeM1c5 name: Device assurance Windows lastUpdate: '2022-01-01T00:00:00.000Z' - createdUpdate: '2022-01-01T00:00:00.000Z' + createdDate: '2022-01-01T00:00:00.000Z' lastUpdatedBy: 00u217pyf72CdUrBt1c5 createdBy: 00u217pyf72CdUrBt1c5 osVersion: @@ -1749,11 +1717,12 @@ components: siteIsolationEnabled: true passwordProtectionWarningTrigger: PASSWORD_PROTECTION_OFF realtimeUrlCheckMode: true + antivirusEnabled: true secureBootEnabled: true windowsMachineDomain: testMachineDomain windowsUserDomain: testUserDomain crowdStrikeCustomerId: testCustomerId - crowdStrikeAgentId": testAgentId + crowdStrikeAgentId: testAgentId keyTrustLevel: CHROME_BROWSER_HW_KEY _links: self: @@ -1766,7 +1735,7 @@ components: - PUT DeviceAssuranceWindowsWithDevicePostureIdPThirdPartySignalProvidersResponse: x-okta-lifecycle: - lifecycle: EA + lifecycle: LIMITED_GA isGenerallyAvailable: false SKUs: [] summary: Windows with Device Posture IdP as third-party signal provider response @@ -1774,7 +1743,7 @@ components: id: dae3m8o4rWhwReDeM1c5 name: Device assurance Windows lastUpdate: '2022-01-01T00:00:00.000Z' - createdUpdate: '2022-01-01T00:00:00.000Z' + createdDate: '2022-01-01T00:00:00.000Z' lastUpdatedBy: 00u217pyf72CdUrBt1c5 createdBy: 00u217pyf72CdUrBt1c5 osVersion: @@ -1803,7 +1772,7 @@ components: - PUT DeviceAssuranceAndroidWithAndroidDeviceTrustThirdPartySignalProvidersResponse: x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] summary: >- @@ -1813,7 +1782,7 @@ components: id: dae3m8o4rWhwReDeM1c5 name: Device assurance Android with Android Device Trust third-party signals lastUpdate: '2022-01-01T00:00:00.000Z' - createdUpdate: '2022-01-01T00:00:00.000Z' + createdDate: '2022-01-01T00:00:00.000Z' lastUpdatedBy: 00u217pyf72CdUrBt1c5 createdBy: 00u217pyf72CdUrBt1c5 osVersion: @@ -1851,7 +1820,7 @@ components: - PUT DeviceAssuranceAndroidWithDevicePostureIdPThirdPartySignalProvidersResponse: x-okta-lifecycle: - lifecycle: EA + lifecycle: LIMITED_GA isGenerallyAvailable: false SKUs: [] summary: Android with Device Posture IdP as third-party signal provider response @@ -1859,7 +1828,7 @@ components: id: dae3m8o4rWhwReDeM1c5 name: Device assurance Android lastUpdate: '2022-01-01T00:00:00.000Z' - createdUpdate: '2022-01-01T00:00:00.000Z' + createdDate: '2022-01-01T00:00:00.000Z' lastUpdatedBy: 00u217pyf72CdUrBt1c5 createdBy: 00u217pyf72CdUrBt1c5 osVersion: @@ -1892,7 +1861,7 @@ components: - PUT DeviceAssuranceIosWithDevicePostureIdPSignalProvidersResponse: x-okta-lifecycle: - lifecycle: EA + lifecycle: LIMITED_GA isGenerallyAvailable: false SKUs: [] summary: iOS with Device Posture IdP as third-party signal provider response @@ -1900,7 +1869,7 @@ components: id: dae3m8o4rWhwReDeM1c5 name: Device assurance iOS lastUpdate: '2022-01-01T00:00:00.000Z' - createdUpdate: '2022-01-01T00:00:00.000Z' + createdDate: '2022-01-01T00:00:00.000Z' lastUpdatedBy: 00u217pyf72CdUrBt1c5 createdBy: 00u217pyf72CdUrBt1c5 osVersion: @@ -1925,7 +1894,7 @@ components: - PUT DeviceAssuranceAndroidWithDynamicVersionRequirementResponse: x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] summary: Android with dynamic version requirement response @@ -1933,7 +1902,7 @@ components: id: dae3m8o4rWhwReDeM1c5 name: Device assurance Android lastUpdate: '2022-01-01T00:00:00.000Z' - createdUpdate: '2022-01-01T00:00:00.000Z' + createdDate: '2022-01-01T00:00:00.000Z' lastUpdatedBy: 00u217pyf72CdUrBt1c5 createdBy: 00u217pyf72CdUrBt1c5 osVersion: @@ -1961,7 +1930,7 @@ components: - PUT DeviceAssuranceIosWithDynamicVersionRequirementResponse: x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] summary: iOS with dynamic version requirement response @@ -1969,7 +1938,7 @@ components: id: dae3m8o4rWhwReDeM1c5 name: Device assurance iOS lastUpdate: '2022-01-01T00:00:00.000Z' - createdUpdate: '2022-01-01T00:00:00.000Z' + createdDate: '2022-01-01T00:00:00.000Z' lastUpdatedBy: 00u217pyf72CdUrBt1c5 createdBy: 00u217pyf72CdUrBt1c5 osVersion: @@ -1992,7 +1961,7 @@ components: - PUT DeviceAssuranceMacOSWithDynamicVersionRequirementResponse: x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] summary: macOS with dynamic version requirement response @@ -2000,7 +1969,7 @@ components: id: dae3m8o4rWhwReDeM1c5 name: Device assurance macOS lastUpdate: '2022-01-01T00:00:00.000Z' - createdUpdate: '2022-01-01T00:00:00.000Z' + createdDate: '2022-01-01T00:00:00.000Z' lastUpdatedBy: 00u217pyf72CdUrBt1c5 createdBy: 00u217pyf72CdUrBt1c5 osVersion: @@ -2028,7 +1997,7 @@ components: - PUT DeviceAssuranceWindowsWithDynamicVersionRequirementsResponse: x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] summary: >- @@ -2038,7 +2007,7 @@ components: id: dae3m8o4rWhwReDeM1c5 name: Device assurance Windows lastUpdate: '2022-01-01T00:00:00.000Z' - createdUpdate: '2022-01-01T00:00:00.000Z' + createdDate: '2022-01-01T00:00:00.000Z' lastUpdatedBy: 00u217pyf72CdUrBt1c5 createdBy: 00u217pyf72CdUrBt1c5 osVersionConstraints: @@ -2070,7 +2039,7 @@ components: - PUT DeviceAssuranceWindowsWithWin11DynamicVersionRequirementAndWin10MinimumVersionStringResponse: x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] summary: >- @@ -2080,7 +2049,7 @@ components: id: dae3m8o4rWhwReDeM1c5 name: Device assurance Windows lastUpdate: '2022-01-01T00:00:00.000Z' - createdUpdate: '2022-01-01T00:00:00.000Z' + createdDate: '2022-01-01T00:00:00.000Z' lastUpdatedBy: 00u217pyf72CdUrBt1c5 createdBy: 00u217pyf72CdUrBt1c5 osVersionConstraints: @@ -2110,7 +2079,7 @@ components: - PUT DeviceAssuranceWindowsWithWin11MinimumVersionStringAndWin10DynamicVersionRequirementResponse: x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] summary: >- @@ -2120,7 +2089,7 @@ components: id: dae3m8o4rWhwReDeM1c5 name: Device assurance Windows lastUpdate: '2022-01-01T00:00:00.000Z' - createdUpdate: '2022-01-01T00:00:00.000Z' + createdDate: '2022-01-01T00:00:00.000Z' lastUpdatedBy: 00u217pyf72CdUrBt1c5 createdBy: 00u217pyf72CdUrBt1c5 osVersionConstraints: @@ -2149,7 +2118,7 @@ components: - PUT DeviceAssuranceAndroidWithGracePeriodResponse: x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] summary: Android with due by date grace period response @@ -2157,7 +2126,7 @@ components: id: dae3m8o4rWhwReDeM1c5 name: Device assurance Android lastUpdate: '2022-01-01T00:00:00.000Z' - createdUpdate: '2022-01-01T00:00:00.000Z' + createdDate: '2022-01-01T00:00:00.000Z' lastUpdatedBy: 00u217pyf72CdUrBt1c5 createdBy: 00u217pyf72CdUrBt1c5 osVersion: @@ -2187,7 +2156,7 @@ components: - PUT DeviceAssuranceIosWithGracePeriodResponse: x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] summary: iOS with due by days grace period response @@ -2195,7 +2164,7 @@ components: id: dae3m8o4rWhwReDeM1c5 name: Device assurance iOS lastUpdate: '2022-01-01T00:00:00.000Z' - createdUpdate: '2022-01-01T00:00:00.000Z' + createdDate: '2022-01-01T00:00:00.000Z' lastUpdatedBy: 00u217pyf72CdUrBt1c5 createdBy: 00u217pyf72CdUrBt1c5 osVersion: @@ -2220,7 +2189,7 @@ components: - PUT DeviceAssuranceMacOSWithGracePeriodResponse: x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] summary: macOS with due by date grace period response @@ -2228,7 +2197,7 @@ components: id: dae3m8o4rWhwReDeM1c5 name: Device assurance macOS lastUpdate: '2022-01-01T00:00:00.000Z' - createdUpdate: '2022-01-01T00:00:00.000Z' + createdDate: '2022-01-01T00:00:00.000Z' lastUpdatedBy: 00u217pyf72CdUrBt1c5 createdBy: 00u217pyf72CdUrBt1c5 osVersion: @@ -2257,7 +2226,7 @@ components: - PUT DeviceAssuranceWindowsWithGracePeriodResponse: x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] summary: Windows with due by days grace period response @@ -2265,7 +2234,7 @@ components: id: dae3m8o4rWhwReDeM1c5 name: Device assurance Windows lastUpdate: '2022-01-01T00:00:00.000Z' - createdUpdate: '2022-01-01T00:00:00.000Z' + createdDate: '2022-01-01T00:00:00.000Z' lastUpdatedBy: 00u217pyf72CdUrBt1c5 createdBy: 00u217pyf72CdUrBt1c5 osVersion: @@ -2294,7 +2263,7 @@ components: - PUT DeviceAssuranceChromeOSWithGracePeriodResponse: x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] summary: ChromeOS with due by days grace period response @@ -2302,7 +2271,7 @@ components: id: dae3m8o4rWhwReDeM1c5 name: Device assurance ChromeOS lastUpdate: '2022-01-01T00:00:00.000Z' - createdUpdate: '2022-01-01T00:00:00.000Z' + createdDate: '2022-01-01T00:00:00.000Z' lastUpdatedBy: 00u217pyf72CdUrBt1c5 createdBy: 00u217pyf72CdUrBt1c5 platform: CHROMEOS @@ -2328,71 +2297,33 @@ components: passwordProtectionWarningTrigger: PASSWORD_PROTECTION_OFF realtimeUrlCheckMode: true keyTrustLevel: CHROME_OS_VERIFIED_MODE - DeviceAssuranceMacOSWithDevicePostureChecksResponse: + DeviceAssuranceAndroidWithCallerContextResponse: x-okta-lifecycle: lifecycle: EA isGenerallyAvailable: false SKUs: [] - summary: macOS request with OSQuery device posture check + summary: Android with caller context response value: id: dae3m8o4rWhwReDeM1c5 - name: Device assurance macOS + name: Device assurance Android lastUpdate: '2022-01-01T00:00:00.000Z' - createdUpdate: '2022-01-01T00:00:00.000Z' + createdDate: '2022-01-01T00:00:00.000Z' lastUpdatedBy: 00u217pyf72CdUrBt1c5 createdBy: 00u217pyf72CdUrBt1c5 osVersion: minimum: 12.4.5 diskEncryptionType: include: - - ALL_INTERNAL_VOLUMES - platform: MACOS - screenLockType: - include: - - PASSCODE - - BIOMETRIC - secureHardwarePresent: true - devicePostureChecks: - include: - - variableName: macOSFirewall - value: '1' - _links: - self: - href: >- - https://your-subdomain.okta.com/api/v1/device-assurances/dae3m8o4rWhwReDeM1c5 - hints: - allow: - - DELETE - - GET - - PUT - DeviceAssuranceWindowsWithDevicePostureChecksResponse: - x-okta-lifecycle: - lifecycle: EA - isGenerallyAvailable: false - SKUs: [] - summary: Windows request with OSQuery device posture check - value: - id: dae3m8o4rWhwReDeM1c5 - name: Device assurance Windows - lastUpdate: '2022-01-01T00:00:00.000Z' - createdUpdate: '2022-01-01T00:00:00.000Z' - lastUpdatedBy: 00u217pyf72CdUrBt1c5 - createdBy: 00u217pyf72CdUrBt1c5 - osVersion: - minimum: 12.4.5.9 - diskEncryptionType: - include: - - ALL_INTERNAL_VOLUMES - platform: WINDOWS + - USER + - FULL + jailbreak: false + platform: ANDROID screenLockType: include: - - PASSCODE - BIOMETRIC secureHardwarePresent: true - devicePostureChecks: - include: - - variableName: windowsFirewall - value: '1' + callerContext: + managedApp: true _links: self: href: >- @@ -2403,7 +2334,7 @@ components: - GET - PUT ErrorDeviceAssuranceInUse: - summary: Can't delete device assurance policy in use by authentication policies + summary: Can't delete device assurance policy in use by app sign-in policies value: errorSummary: Device assurance is in use and cannot be deleted. errorId: oaenwA1ra80S9W-pvbh4m6haA @@ -2452,7 +2383,21 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.device_assurance_policies + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListDeviceAssurancePoliciesResponse' + transform: + body: >- + {{- $wrapped := printf "{\"device_assurance_policies\":%s}" . + -}} + + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_device_assurance_policy: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1device-assurances/post' response: @@ -2465,6 +2410,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_device_assurance_policy: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1device-assurances~1{deviceAssuranceId}/put' response: @@ -2474,14 +2422,14 @@ components: operation: $ref: '#/paths/~1api~1v1~1device-assurances~1{deviceAssuranceId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/device_assurance_policies/methods/list_device_assurance_policies - $ref: >- #/components/x-stackQL-resources/device_assurance_policies/methods/get_device_assurance_policy + - $ref: >- + #/components/x-stackQL-resources/device_assurance_policies/methods/list_device_assurance_policies insert: - $ref: >- #/components/x-stackQL-resources/device_assurance_policies/methods/create_device_assurance_policy @@ -2497,7 +2445,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/device_integrations.yaml b/providers/src/okta/v00.00.00000/services/device_integrations.yaml index e401402d..357e6aef 100644 --- a/providers/src/okta/v00.00.00000/services/device_integrations.yaml +++ b/providers/src/okta/v00.00.00000/services/device_integrations.yaml @@ -2,12 +2,12 @@ openapi: 3.0.3 info: title: device_integrations API description: okta device_integrations API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/device-integrations: get: x-okta-lifecycle: - lifecycle: EA + lifecycle: LIMITED_GA isGenerallyAvailable: false SKUs: [] summary: List all device integrations @@ -22,9 +22,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/DeviceIntegrations' + $ref: '#/components/schemas/ListDeviceIntegrationsResponse' '401': $ref: '#/components/responses/ErrorInvalidToken401' '403': @@ -40,7 +38,7 @@ paths: /api/v1/device-integrations/{deviceIntegrationId}: get: x-okta-lifecycle: - lifecycle: EA + lifecycle: LIMITED_GA isGenerallyAvailable: false SKUs: [] summary: Retrieve a device integration @@ -83,12 +81,12 @@ paths: - okta.deviceIntegrations.read tags: - DeviceIntegrations - parameters: - - $ref: '#/components/parameters/pathDeviceIntegrationId' + parameters: + - $ref: '#/components/parameters/pathDeviceIntegrationId' /api/v1/device-integrations/{deviceIntegrationId}/lifecycle/activate: post: x-okta-lifecycle: - lifecycle: EA + lifecycle: LIMITED_GA isGenerallyAvailable: false SKUs: [] summary: Activate a device integration @@ -130,12 +128,12 @@ paths: - okta.deviceIntegrations.manage tags: - DeviceIntegrations - parameters: - - $ref: '#/components/parameters/pathDeviceIntegrationId' + parameters: + - $ref: '#/components/parameters/pathDeviceIntegrationId' /api/v1/device-integrations/{deviceIntegrationId}/lifecycle/deactivate: post: x-okta-lifecycle: - lifecycle: EA + lifecycle: LIMITED_GA isGenerallyAvailable: false SKUs: [] summary: Deactivate a device integration @@ -168,8 +166,8 @@ paths: - okta.deviceIntegrations.manage tags: - DeviceIntegrations - parameters: - - $ref: '#/components/parameters/pathDeviceIntegrationId' + parameters: + - $ref: '#/components/parameters/pathDeviceIntegrationId' components: schemas: DeviceIntegrations: @@ -195,50 +193,30 @@ components: $ref: '#/components/schemas/LinksSelfAndLifecycle' DeviceIntegrationsMetadata: description: The metadata of the device integration - oneOf: - - type: object - properties: - type: - type: string - enum: - - CHROME - serviceAccountName: - type: string - serviceAccountEmail: - type: string - required: - - type - - serviceAccountName - - serviceAccountEmail - - type: object - properties: - type: - type: string - enum: - - WORKSPACE_ONE - provider: - type: string - enrollmentUrl: - type: string - idpId: - type: string - required: - - type - - provider - - enrollmentUrl - - idpId - - type: object - properties: - type: - type: string - enum: - - DEVICE_IDP - idpId: - type: string - required: - - type - - idpId + x-okta-ignore-redocly-rules-for-sdk: true type: object + properties: + type: + type: string + enum: + - CHROME + serviceAccountName: + type: string + serviceAccountEmail: + type: string + provider: + type: string + enrollmentUrl: + type: string + idpId: + type: string + required: + - type + - serviceAccountName + - serviceAccountEmail + - provider + - enrollmentUrl + - idpId DeviceIntegrationsName: description: The namespace of the device integration type: string @@ -265,14 +243,22 @@ components: - ACTIVE - DEACTIVATED LinksSelfAndLifecycle: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - type: object - properties: - activate: - $ref: '#/components/schemas/HrefObjectActivateLink' - deactivate: - $ref: '#/components/schemas/HrefObjectDeactivateLink' + description: >- + Specifies link relations (see [Web + Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the + [JSON Hypertext Application + Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) + specification. This object is used for dynamic discovery of related + resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + activate: + $ref: '#/components/schemas/HrefObjectActivateLink' + deactivate: + $ref: '#/components/schemas/HrefObjectDeactivateLink' + readOnly: true Error: title: Error type: object @@ -312,23 +298,105 @@ components: $ref: '#/components/schemas/HrefObjectSelfLink' readOnly: true HrefObjectActivateLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to activate the resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to activate the resource HrefObjectDeactivateLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to deactivate the resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to deactivate the resource ErrorCause: type: object properties: errorSummary: type: string HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object additionalProperties: true type: object @@ -372,6 +440,13 @@ components: - GET - POST - PUT + ListDeviceIntegrationsResponse: + type: object + properties: + device_integrations: + type: array + items: + $ref: '#/components/schemas/DeviceIntegrations' responses: ErrorInvalidToken401: description: Unauthorized @@ -599,6 +674,15 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.device_integrations + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListDeviceIntegrationsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"device_integrations\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 get_device_integration: operation: $ref: '#/paths/~1api~1v1~1device-integrations~1{deviceIntegrationId}/get' @@ -621,10 +705,10 @@ components: openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/device_integrations/methods/list_device_integrations - $ref: >- #/components/x-stackQL-resources/device_integrations/methods/get_device_integration + - $ref: >- + #/components/x-stackQL-resources/device_integrations/methods/list_device_integrations insert: [] update: [] delete: [] @@ -634,7 +718,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/device_posture_checks.yaml b/providers/src/okta/v00.00.00000/services/device_posture_checks.yaml index 0ca1cb86..c645ab70 100644 --- a/providers/src/okta/v00.00.00000/services/device_posture_checks.yaml +++ b/providers/src/okta/v00.00.00000/services/device_posture_checks.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: device_posture_checks API description: okta device_posture_checks API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/device-posture-checks: get: @@ -15,9 +15,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/DevicePostureCheck' + $ref: '#/components/schemas/ListDevicePostureChecksResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '429': @@ -29,7 +27,7 @@ paths: tags: - DevicePostureCheck x-okta-lifecycle: - lifecycle: EA + lifecycle: LIMITED_GA isGenerallyAvailable: false SKUs: - Okta Identity Engine @@ -94,9 +92,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/DevicePostureCheck' + $ref: '#/components/schemas/ListDefaultDevicePostureChecksResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '429': @@ -137,10 +133,12 @@ paths: tags: - DevicePostureCheck x-okta-lifecycle: - lifecycle: EA + lifecycle: LIMITED_GA isGenerallyAvailable: false SKUs: - Okta Identity Engine + parameters: + - $ref: '#/components/parameters/pathPostureCheckId' put: x-okta-lifecycle: lifecycle: GA @@ -187,6 +185,8 @@ paths: - okta.devicePostureChecks.manage tags: - DevicePostureCheck + parameters: + - $ref: '#/components/parameters/pathPostureCheckId' delete: summary: Delete a device posture check description: >- @@ -219,12 +219,12 @@ paths: tags: - DevicePostureCheck x-okta-lifecycle: - lifecycle: EA + lifecycle: LIMITED_GA isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathPostureCheckId' + parameters: + - $ref: '#/components/parameters/pathPostureCheckId' components: schemas: DevicePostureCheck: @@ -383,10 +383,38 @@ components: errorSummary: type: string HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object additionalProperties: true type: object @@ -430,6 +458,20 @@ components: - GET - POST - PUT + ListDevicePostureChecksResponse: + type: object + properties: + device_posture_checks: + type: array + items: + $ref: '#/components/schemas/DevicePostureCheck' + ListDefaultDevicePostureChecksResponse: + type: object + properties: + default_device_posture_checks: + type: array + items: + $ref: '#/components/schemas/DevicePostureCheck' responses: ErrorAccessDenied403: description: Forbidden @@ -638,7 +680,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.device_posture_checks + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListDevicePostureChecksResponse' + transform: + body: |- + {{- $wrapped := printf "{\"device_posture_checks\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_device_posture_check: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1device-posture-checks/post' response: @@ -651,6 +705,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_device_posture_check: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1device-posture-checks~1{postureCheckId}/put' response: @@ -660,14 +717,14 @@ components: operation: $ref: '#/paths/~1api~1v1~1device-posture-checks~1{postureCheckId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/device_posture_checks/methods/list_device_posture_checks - $ref: >- #/components/x-stackQL-resources/device_posture_checks/methods/get_device_posture_check + - $ref: >- + #/components/x-stackQL-resources/device_posture_checks/methods/list_device_posture_checks insert: - $ref: >- #/components/x-stackQL-resources/device_posture_checks/methods/create_device_posture_check @@ -689,6 +746,17 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.default_device_posture_checks + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListDefaultDevicePostureChecksResponse' + transform: + body: >- + {{- $wrapped := printf "{\"default_device_posture_checks\":%s}" + . -}} + + {{- $wrapped -}} + type: golang_template_text_v0.3.0 sqlVerbs: select: - $ref: >- @@ -702,7 +770,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/devices.yaml b/providers/src/okta/v00.00.00000/services/devices.yaml index d1f45a65..12c16f72 100644 --- a/providers/src/okta/v00.00.00000/services/devices.yaml +++ b/providers/src/okta/v00.00.00000/services/devices.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: devices API description: okta devices API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/devices: get: @@ -13,7 +13,7 @@ paths: >**Note:** To list all devices enrolled by a user, use the [List all devices endpoint in the User Resources - API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserResources/#tag/UserResources/operation/listUserDevices). + API](https://developer.okta.com/docs/api/openapi/okta-management/management/userresources/listuserdevices). You can return a subset of devices that match a supported search @@ -25,15 +25,14 @@ paths: depending on specified queries in the request. Empty list is returned if no objects match `search` request. - > **Note:** Listing devices with `search` should not be used as a part - of any critical flow, such as authentication or updates, to prevent - potential data loss. `search` results may not reflect the latest - information, as this endpoint uses a search index which may not be - up-to-date with recent updates to the object. + + > **Note:** The `search` parameter results are sourced from an + eventually consistent datasource and may not reflect the latest + information. Don't use search results directly for record updates, as the data might - be stale and therefore overwrite newer data, resulting in data loss. + be stale and therefore overwrite newer data, resulting in data loss. Use an `id` lookup for records that you update to ensure your results @@ -84,22 +83,22 @@ paths: examples: FilterByDeviceStatus: summary: Filter by device status - value: status%20eq%20%22ACTIVE%22 + value: status eq "ACTIVE" FilterByLastUpdatedTime: summary: Filter by last updated time - value: lastUpdated%20gt%20%222024-12-23'T'00%3A00%3A00.000Z%22 + value: lastUpdated gt "2024-12-23T00:00:00.000Z" FilterByDeviceId: summary: Filter by device ID - value: id%20eq%20%22guo4a5u7JHHhjXrMK0g4%22 + value: id eq "guo4a5u7JHHhjXrMK0g4" FilterByDeviceDisplayName: summary: Filter by device display name - value: profile.displayName%20eq%20%22Bob%22 + value: profile.displayName eq "Bob" FilterByDevicePlatform: summary: Filter by device platform - value: profile.platform%20eq%20%22WINDOWS%22 + value: profile.platform eq "WINDOWS" FilterBySID: summary: Filter by device security identifier (SID) - value: profile.sid%20sw%20%22S-1%22 + value: profile.sid sw "S-1" - name: expand in: query description: >- @@ -127,9 +126,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/DeviceList' + $ref: '#/components/schemas/ListDevicesResponse' examples: APIDevicesResponseUserSummaryExample: type: array @@ -163,10 +160,12 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/Device' + $ref: '#/components/schemas/DeviceWithProviders' examples: APIDevicesResponseExample: $ref: '#/components/examples/DeviceResponse' + APIDevicesWithProvidersResponseExample: + $ref: '#/components/examples/DeviceWithProvidersResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -184,13 +183,15 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine + parameters: + - $ref: '#/components/parameters/pathDeviceId' delete: summary: Delete a device description: >- Deletes (permanently) a device by `deviceId` if it has a status of `DEACTIVATED`. You can transition the device to `DEACTIVATED` status using the [Deactivate a - Device](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Device/#tag/Device/operation/deactivateDevice) + Device](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/device/other/deactivatedevice) endpoint. This request is destructive and deletes all of the profile data related @@ -228,8 +229,8 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathDeviceId' + parameters: + - $ref: '#/components/parameters/pathDeviceId' /api/v1/devices/{deviceId}/lifecycle/activate: post: summary: Activate a device @@ -257,8 +258,8 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathDeviceId' + parameters: + - $ref: '#/components/parameters/pathDeviceId' /api/v1/devices/{deviceId}/lifecycle/deactivate: post: summary: Deactivate a device @@ -293,8 +294,8 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathDeviceId' + parameters: + - $ref: '#/components/parameters/pathDeviceId' /api/v1/devices/{deviceId}/lifecycle/suspend: post: summary: Suspend a Device @@ -327,8 +328,8 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathDeviceId' + parameters: + - $ref: '#/components/parameters/pathDeviceId' /api/v1/devices/{deviceId}/lifecycle/unsuspend: post: summary: Unsuspend a Device @@ -356,8 +357,153 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathDeviceId' + parameters: + - $ref: '#/components/parameters/pathDeviceId' + /api/v1/devices/{deviceId}/os-accounts: + get: + summary: List all OS accounts for a device + description: Lists all OS accounts for a device by `deviceId` + operationId: listDeviceOSAccounts + parameters: + - $ref: '#/components/parameters/queryOsAccountExpand' + - $ref: '#/components/parameters/pathDeviceId' + responses: + '200': + description: Success + content: + application/json: + schema: + $ref: '#/components/schemas/ListDeviceOSAccountsResponse' + examples: + WindowsOSAccountListResponseExample: + summary: List all Windows OS accounts for a specific device + $ref: '#/components/examples/WindowsOSAccountListResponse' + MacOSOSAccountListResponseExample: + summary: List all macOS accounts for a specific device + $ref: '#/components/examples/MacOSOSAccountListResponse' + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: + - apiToken: [] + - oauth2: + - okta.devices.read + tags: + - Device + x-okta-lifecycle: + lifecycle: EA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + /api/v1/devices/{deviceId}/os-accounts/{osAccountId}: + get: + summary: Retrieve an OS account + description: Retrieves an OS account by `osAccountId` for a device + operationId: getDeviceOSAccount + parameters: + - $ref: '#/components/parameters/queryOsAccountExpand' + - $ref: '#/components/parameters/pathDeviceId' + - $ref: '#/components/parameters/pathOsAccountId' + responses: + '200': + description: OK + content: + application/json: + schema: + discriminator: + propertyName: platform + mapping: + WINDOWS: '#/components/schemas/OSAccountWindows' + MACOS: '#/components/schemas/OSAccountMacOS' + type: object + properties: + created: + type: string + format: date-time + description: Timestamp when the OS account was created + readOnly: true + deviceId: + type: string + description: Unique identifier of the device this OS account belongs to + readOnly: true + id: + type: string + description: Unique identifier for the OS account + readOnly: true + lastSeenAt: + type: string + format: date-time + nullable: true + description: Timestamp when the OS account was last seen + lastUpdated: + type: string + format: date-time + description: Timestamp when the OS account was last updated + readOnly: true + platform: + $ref: '#/components/schemas/OSAccountPlatform' + resourceAlternateId: + type: string + nullable: true + readOnly: true + resourceDisplayName: + $ref: '#/components/schemas/OSAccountDisplayName' + resourceId: + type: string + description: Alternate key for the `id` + readOnly: true + resourceType: + type: string + default: DOSAccount + readOnly: true + status: + type: string + description: Status of the OS account + enum: + - ACTIVE + - DELETED + _embedded: + $ref: '#/components/schemas/OSAccountEmbedded' + _links: + $ref: '#/components/schemas/OSAccountLinks' + profile: + $ref: '#/components/schemas/WindowsOSAccountProfile' + required: + - id + - deviceId + - created + - lastUpdated + - platform + - status + - _links + - profile + examples: + WindowsOSAccountResponseExample: + summary: Windows OS account + $ref: '#/components/examples/WindowsOSAccountResponse' + MacOSOSAccountResponseExample: + summary: macOS account + $ref: '#/components/examples/MacOSOSAccountResponse' + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: + - apiToken: [] + - oauth2: + - okta.devices.read + tags: + - Device + x-okta-lifecycle: + lifecycle: EA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine /api/v1/devices/{deviceId}/users: get: summary: List all users for a device @@ -369,9 +515,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/DeviceUser' + $ref: '#/components/schemas/ListDeviceUsersResponse' examples: APIDevicesListAllUsersResponseExample: summary: List all users for a specific device @@ -393,30 +537,65 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathDeviceId' + parameters: + - $ref: '#/components/parameters/pathDeviceId' components: schemas: DeviceList: - allOf: - - $ref: '#/components/schemas/Device' - - properties: - _embedded: - type: object - description: >- - List of associated users for the device if the `expand=user` - query parameter is specified in the request. Use - `expand=userSummary` to get only a summary of each associated - user for the device. - properties: - users: - description: Users for the device - type: array - items: - $ref: '#/components/schemas/DeviceUser' - readOnly: true + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + created: + type: string + format: date-time + description: Timestamp when the device was created + readOnly: true + id: + type: string + description: Unique key for the device + readOnly: true + lastUpdated: + type: string + format: date-time + description: >- + Timestamp when the device record was last updated. Updates occur + when Okta collects and saves device signals during authentication, + and when the lifecycle state of the device changes. + readOnly: true + profile: + $ref: '#/components/schemas/DeviceProfile' + resourceAlternateId: + type: string + readOnly: true + resourceDisplayName: + $ref: '#/components/schemas/DeviceDisplayName' + resourceId: + type: string + description: Alternate key for the `id` + readOnly: true + resourceType: + type: string + default: UDDevice + readOnly: true + status: + $ref: '#/components/schemas/DeviceStatus' + _links: + $ref: '#/components/schemas/LinksSelfAndFullUsersLifecycle' + _embedded: type: object - Device: + description: >- + List of associated users for the device if the `expand=user` query + parameter is specified in the request. Use `expand=userSummary` to + get only a summary of each associated user for the device. + properties: + users: + description: Users for the device + type: array + items: + $ref: '#/components/schemas/DeviceUser' + readOnly: true + DeviceWithProviders: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: created: @@ -455,6 +634,14 @@ components: $ref: '#/components/schemas/DeviceStatus' _links: $ref: '#/components/schemas/LinksSelfAndFullUsersLifecycle' + providers: + type: array + description: >- + List of providers for the device when the `expand=providers` query + parameter is specified + readOnly: true + items: + $ref: '#/components/schemas/DeviceProvider' Error: title: Error type: object @@ -480,6 +667,142 @@ components: A short description of what caused this error. Sometimes this contains dynamically-generated information about your specific error. + OSAccountWindows: + type: object + properties: + created: + type: string + format: date-time + description: Timestamp when the OS account was created + readOnly: true + deviceId: + type: string + description: Unique identifier of the device this OS account belongs to + readOnly: true + id: + type: string + description: Unique identifier for the OS account + readOnly: true + lastSeenAt: + type: string + format: date-time + nullable: true + description: Timestamp when the OS account was last seen + lastUpdated: + type: string + format: date-time + description: Timestamp when the OS account was last updated + readOnly: true + platform: + $ref: '#/components/schemas/OSAccountPlatform' + resourceAlternateId: + type: string + nullable: true + readOnly: true + resourceDisplayName: + $ref: '#/components/schemas/OSAccountDisplayName' + resourceId: + type: string + description: Alternate key for the `id` + readOnly: true + resourceType: + type: string + default: DOSAccount + readOnly: true + status: + type: string + description: Status of the OS account + enum: + - ACTIVE + - DELETED + _embedded: + $ref: '#/components/schemas/OSAccountEmbedded' + _links: + $ref: '#/components/schemas/OSAccountLinks' + profile: + $ref: '#/components/schemas/WindowsOSAccountProfile' + required: + - id + - deviceId + - created + - lastUpdated + - platform + - status + - _links + - profile + discriminator: + propertyName: platform + mapping: + WINDOWS: '#/components/schemas/OSAccountWindows' + MACOS: '#/components/schemas/OSAccountMacOS' + OSAccountMacOS: + type: object + properties: + created: + type: string + format: date-time + description: Timestamp when the OS account was created + readOnly: true + deviceId: + type: string + description: Unique identifier of the device this OS account belongs to + readOnly: true + id: + type: string + description: Unique identifier for the OS account + readOnly: true + lastSeenAt: + type: string + format: date-time + nullable: true + description: Timestamp when the OS account was last seen + lastUpdated: + type: string + format: date-time + description: Timestamp when the OS account was last updated + readOnly: true + platform: + $ref: '#/components/schemas/OSAccountPlatform' + resourceAlternateId: + type: string + nullable: true + readOnly: true + resourceDisplayName: + $ref: '#/components/schemas/OSAccountDisplayName' + resourceId: + type: string + description: Alternate key for the `id` + readOnly: true + resourceType: + type: string + default: DOSAccount + readOnly: true + status: + type: string + description: Status of the OS account + enum: + - ACTIVE + - DELETED + _embedded: + $ref: '#/components/schemas/OSAccountEmbedded' + _links: + $ref: '#/components/schemas/OSAccountLinks' + profile: + $ref: '#/components/schemas/MacOSAccountProfile' + required: + - id + - deviceId + - created + - lastUpdated + - platform + - status + - _links + - profile + discriminator: + propertyName: platform + mapping: + WINDOWS: '#/components/schemas/OSAccountWindows' + MACOS: '#/components/schemas/OSAccountMacOS' DeviceUser: type: object properties: @@ -504,123 +827,188 @@ components: - BIOMETRIC user: $ref: '#/components/schemas/User' - DeviceProfile: + Device: type: object properties: - diskEncryptionType: - $ref: '#/components/schemas/DiskEncryptionTypeDef' - displayName: + created: type: string - description: Display name of the device - minLength: 1 - maxLength: 255 - imei: + format: date-time + description: Timestamp when the device was created + readOnly: true + id: type: string - description: International Mobile Equipment Identity (IMEI) of the device - minLength: 14 - maxLength: 17 - integrityJailbreak: - type: boolean - description: >- - Indicates if the device is jailbroken or rooted. Only applicable to - `IOS` and `ANDROID` platforms - managed: - type: boolean + description: Unique key for the device + readOnly: true + lastUpdated: + type: string + format: date-time description: >- - Indicates if the device is managed by mobile device management (MDM) - software - manufacturer: + Timestamp when the device record was last updated. Updates occur + when Okta collects and saves device signals during authentication, + and when the lifecycle state of the device changes. + readOnly: true + profile: + $ref: '#/components/schemas/DeviceProfile' + resourceAlternateId: type: string - description: Name of the manufacturer of the device - maxLength: 127 - meid: + readOnly: true + resourceDisplayName: + $ref: '#/components/schemas/DeviceDisplayName' + resourceId: type: string - description: Mobile equipment identifier of the device - maxLength: 14 - model: + description: Alternate key for the `id` + readOnly: true + resourceType: type: string - description: Model of the device - maxLength: 127 - osVersion: + default: UDDevice + readOnly: true + status: + $ref: '#/components/schemas/DeviceStatus' + _links: + $ref: '#/components/schemas/LinksSelfAndFullUsersLifecycle' + DeviceProvider: + type: object + properties: + payload: + $ref: '#/components/schemas/OktaVerifyPayload' + payloadVersion: type: string - description: Version of the device OS - maxLength: 127 + description: The version of the payload schema + example: '1.0' + provider: + type: string + description: The name of the provider + example: oktaVerify + ErrorCause: + type: object + properties: + errorSummary: + type: string + OSAccount: + type: object + properties: + created: + type: string + format: date-time + description: Timestamp when the OS account was created + readOnly: true + deviceId: + type: string + description: Unique identifier of the device this OS account belongs to + readOnly: true + id: + type: string + description: Unique identifier for the OS account + readOnly: true + lastSeenAt: + type: string + format: date-time + nullable: true + description: Timestamp when the OS account was last seen + lastUpdated: + type: string + format: date-time + description: Timestamp when the OS account was last updated + readOnly: true platform: - $ref: '#/components/schemas/DevicePlatform' - registered: - type: boolean - description: Indicates if the device is registered at Okta - secureHardwarePresent: - type: boolean - description: Indicates if the device contains a secure hardware functionality - serialNumber: + $ref: '#/components/schemas/OSAccountPlatform' + resourceAlternateId: type: string - description: Serial number of the device - maxLength: 127 - sid: + nullable: true + readOnly: true + resourceDisplayName: + $ref: '#/components/schemas/OSAccountDisplayName' + resourceId: type: string - description: Windows Security identifier of the device - maxLength: 256 - tpmPublicKeyHash: + description: Alternate key for the `id` + readOnly: true + resourceType: type: string - description: Windows Trusted Platform Module hash value - udid: + default: DOSAccount + readOnly: true + status: type: string - description: macOS Unique device identifier of the device - maxLength: 47 + description: Status of the OS account + enum: + - ACTIVE + - DELETED + _embedded: + $ref: '#/components/schemas/OSAccountEmbedded' + _links: + $ref: '#/components/schemas/OSAccountLinks' required: - - displayName + - id + - deviceId + - created + - lastUpdated - platform - - registered - DeviceDisplayName: - description: Display name of the device + - status + - _links + discriminator: + propertyName: platform + mapping: + WINDOWS: '#/components/schemas/OSAccountWindows' + MACOS: '#/components/schemas/OSAccountMacOS' + WindowsOSAccountProfile: type: object properties: - sensitive: - type: boolean - description: >- - Indicates whether the associated value is Personal Identifiable - Information (PII) and requires masking - default: false - value: + directoryJoinStatus: type: string - description: Display name of the device - DeviceStatus: - description: The state object of the device - type: string - enum: - - ACTIVE - - DEACTIVATED - - SUSPENDED - - UNSUSPENDED - x-enumDescriptions: - ACTIVE: Use activated devices to create and delete device user links - DEACTIVATED: >- - Deactivation causes a device to lose all device user links. Set the - device status to `DEACTIVATED` before deleting it. - SUSPENDED: >- - Use suspended devices to create and delete device user links. You can - only unsuspend or deactivate suspended devices. - UNSUSPENDED: Returns a suspended device to `ACTIVE`. - LinksSelfAndFullUsersLifecycle: - allOf: - - $ref: '#/components/schemas/LinksSelfAndLifecycle' - - type: object - properties: - suspend: - $ref: '#/components/schemas/HrefObjectSuspendLink' - unsuspend: - $ref: '#/components/schemas/HrefObjectUnsuspendLink' - users: - description: Link to device users - allOf: - - $ref: '#/components/schemas/HrefObject' - ErrorCause: + description: Active Directory join status + example: AD + downLevelUsername: + type: string + description: Domain\username format (down-level logon name) + example: okta\carmel.sonne + fullName: + type: string + description: Full name of the account user + example: Carmel Sonne + GUID: + type: string + format: uuid + description: Globally Unique Identifier for the account + example: 4ac29c85-d847-4492-96cb-46e337170c33 + qualifiedUsername: + type: string + description: Fully qualified username + example: okta\carmel.sonne + securityId: + type: string + description: Windows Security Identifier (SID) + example: S-1-5-21-1004336348-1177238915-682003330-512 + type: + type: string + description: Profile type discriminator + enum: + - WINDOWS + upn: + type: string + description: User principal name + example: carmel.sonne@okta.com + MacOSAccountProfile: type: object properties: - errorSummary: + accountUuid: type: string + format: uuid + description: Unique identifier for the macOS account + example: 4ac29c85-d847-4492-96cb-46e337170c33 + fullName: + type: string + description: Full name of the account user + example: Carmel Sonne + type: + type: string + description: Profile type discriminator + enum: + - MACOS + username: + type: string + description: Username of the account + example: carmel.sonne User: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: activated: @@ -663,7 +1051,7 @@ components: type: string description: >- The ID of the realm in which the user is residing. See - [Realms](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Realm/). + [Realms](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/realm). example: guo1bfiNtSnZYILxO0g4 readOnly: true status: @@ -690,11 +1078,11 @@ components: description: >- The user type that determines the schema for the user's profile. The `type` property is a map that identifies the [User - Types](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/#tag/UserType). + Types](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/#tag/UserType). Currently it contains a single element, `id`. It can be specified - when creating a new user, and ca be updated by an admin on a full + when creating a new user, and can be updated by an admin on a full replace of an existing user (but not a partial update). properties: id: @@ -728,176 +1116,670 @@ components: For a collection of users, the links object contains only the `self` link. Operations that return a collection of users include [List all - users](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#tag/User/operation/listUsers) + users](https://developer.okta.com/docs/api/openapi/okta-management/management/user/listusers) and [List all group member - users](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/Group/#tag/Group/operation/listGroupUsers). - allOf: - - $ref: '#/components/schemas/LinksSelf' - - type: object - properties: - self: - description: URL to the individual user - allOf: - - $ref: '#/components/schemas/HrefObject' - activate: - description: URL to activate the user - allOf: - - $ref: '#/components/schemas/HrefObject' - resetPassword: - description: URL to reset the user's password - allOf: - - $ref: '#/components/schemas/HrefObject' - resetFactors: - description: URL to reset the user's factors - allOf: - - $ref: '#/components/schemas/HrefObject' - expirePassword: - description: URL to expire the user's password - allOf: - - $ref: '#/components/schemas/HrefObject' - forgotPassword: - description: URL to initiate a forgot password operation - allOf: - - $ref: '#/components/schemas/HrefObject' - changeRecoveryQuestion: - description: URL to change the user's recovery question - allOf: - - $ref: '#/components/schemas/HrefObject' - deactivate: - description: URL to deactivate a user - allOf: - - $ref: '#/components/schemas/HrefObject' - reactivate: - description: URL to reactivate the user - allOf: - - $ref: '#/components/schemas/HrefObject' - changePassword: - description: URL to change the user's password - allOf: - - $ref: '#/components/schemas/HrefObject' - schema: - description: URL to the user's profile schema - allOf: - - $ref: '#/components/schemas/HrefObject' - suspend: - description: URL to suspend the user - allOf: - - $ref: '#/components/schemas/HrefObject' - unsuspend: - description: URL to unsuspend the user - allOf: - - $ref: '#/components/schemas/HrefObject' - unlock: - description: URL to unlock the locked-out user - allOf: - - $ref: '#/components/schemas/HrefObject' - type: - description: URL to the user type - allOf: - - $ref: '#/components/schemas/HrefObject' - - readOnly: true - DiskEncryptionTypeDef: - description: >- - Type of encryption used on the device - - > **Note:** The following values map to Disk Encryption ON: `FULL`, - `USER`, `ALL_INTERNAL_VOLUMES`. All other values map to Disk Encryption - OFF. - type: string - enum: - - ALL_INTERNAL_VOLUMES - - FULL - - NONE - - SYSTEM_VOLUME - - USER - x-enumDescriptions: - NONE: No encryption has been set. - FULL: >- - Disk is fully encrypted. Only applicable to `IOS` and `ANDROID` - platforms. - USER: >- - Encryption key is tied to the user or profile. Only applicable to - `ANDROID` platform. - ALL_INTERNAL_VOLUMES: >- - All internal disks are encrypted. Only applicable to `WINDOWS` and - `MACOS` platforms. - SYSTEM_VOLUME: >- - Only the system volume is encrypted. Only applicable to `WINDOWS` and - `MACOS` platforms. - DevicePlatform: - description: OS platform of the device - type: string - enum: - - ANDROID - - IOS - - MACOS - - WINDOWS - LinksSelfAndLifecycle: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - type: object + users](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Group/#tag/Group/operation/listGroupUsers). + type: object properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' activate: - $ref: '#/components/schemas/HrefObjectActivateLink' + description: URL to activate the user + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + resetPassword: + description: URL to reset the user's password + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + resetFactors: + description: URL to reset the user's factors + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + expirePassword: + description: URL to expire the user's password + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + forgotPassword: + description: URL to initiate a forgot password operation + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + changeRecoveryQuestion: + description: URL to change the user's recovery question + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href deactivate: - $ref: '#/components/schemas/HrefObjectDeactivateLink' - HrefObjectSuspendLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to suspend the resource - HrefObjectUnsuspendLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to unsuspend the resource - HrefObject: - title: Link Object - additionalProperties: true + description: URL to deactivate a user + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + reactivate: + description: URL to reactivate the user + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + changePassword: + description: URL to change the user's password + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + schema: + description: URL to the user's profile schema + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + suspend: + description: URL to suspend the user + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + unsuspend: + description: URL to unsuspend the user + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + unlock: + description: URL to unlock the locked-out user + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + type: + description: URL to the user type + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + readOnly: true + DeviceProfile: type: object properties: - hints: - $ref: '#/components/schemas/HrefHints' - readOnly: true - href: + diskEncryptionType: + $ref: '#/components/schemas/DiskEncryptionTypeDef' + displayName: type: string - description: Link URI - name: + description: Display name of the device + minLength: 1 + maxLength: 255 + imei: type: string - description: Link name - readOnly: true - templated: + description: International Mobile Equipment Identity (IMEI) of the device + minLength: 14 + maxLength: 17 + integrityJailbreak: type: boolean description: >- - Indicates whether the link object's `href` property is a URI - template. - readOnly: true - type: - type: string + Indicates if the device is jailbroken or rooted. Only applicable to + `IOS` and `ANDROID` platforms + managed: + type: boolean description: >- - The media type of the link. If omitted, it is implicitly - `application/json`. - readOnly: true - required: - - href - UserCredentials: - description: >- - Specifies primary authentication and recovery credentials for a user. - Credential types and requirements vary depending on the provider and - security policy of the org. - type: object - properties: - password: - $ref: '#/components/schemas/PasswordCredential' - provider: - $ref: '#/components/schemas/AuthenticationProvider' - recovery_question: - $ref: '#/components/schemas/RecoveryQuestionCredential' - UserProfile: - additionalProperties: true - description: >- - Specifies the default and custom profile properties for a user. - - - The default user profile is based on the [System for Cross-domain + Indicates if the device is managed by mobile device management (MDM) + software + manufacturer: + type: string + description: Name of the manufacturer of the device + maxLength: 127 + meid: + type: string + description: Mobile equipment identifier of the device + maxLength: 14 + model: + type: string + description: Model of the device + maxLength: 127 + osVersion: + type: string + description: Version of the device OS + maxLength: 127 + platform: + $ref: '#/components/schemas/DevicePlatform' + registered: + type: boolean + description: Indicates if the device is registered at Okta + secureHardwarePresent: + type: boolean + description: Indicates if the device contains a secure hardware functionality + serialNumber: + type: string + description: Serial number of the device + maxLength: 127 + sid: + type: string + description: Windows Security identifier of the device + maxLength: 256 + tpmPublicKeyHash: + type: string + description: Windows Trusted Platform Module hash value + udid: + type: string + description: macOS Unique device identifier of the device + maxLength: 47 + required: + - displayName + - platform + - registered + DeviceDisplayName: + description: Display name of the device + type: object + properties: + sensitive: + type: boolean + description: >- + Indicates whether the associated value is Personal Identifiable + Information (PII) and requires masking + default: false + value: + type: string + description: Display name of the device + DeviceStatus: + description: The state object of the device + type: string + enum: + - ACTIVE + - DEACTIVATED + - SUSPENDED + - UNSUSPENDED + x-enumDescriptions: + ACTIVE: Use activated devices to create and delete device user links + DEACTIVATED: >- + Deactivation causes a device to lose all device user links. Set the + device status to `DEACTIVATED` before deleting it. + SUSPENDED: >- + Use suspended devices to create and delete device user links. You can + only unsuspend or deactivate suspended devices. + UNSUSPENDED: Returns a suspended device to `ACTIVE`. + LinksSelfAndFullUsersLifecycle: + x-okta-ignore-redocly-rules-for-sdk: true + description: >- + Specifies link relations (see [Web + Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the + [JSON Hypertext Application + Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) + specification. This object is used for dynamic discovery of related + resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + activate: + $ref: '#/components/schemas/HrefObjectActivateLink' + deactivate: + $ref: '#/components/schemas/HrefObjectDeactivateLink' + suspend: + $ref: '#/components/schemas/HrefObjectSuspendLink' + unsuspend: + $ref: '#/components/schemas/HrefObjectUnsuspendLink' + users: + description: Link to device users + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + readOnly: true + OktaVerifyPayload: + description: Payload data for the OktaVerify provider + type: object + properties: + clientVersion: + type: string + description: The version of the Okta Verify client + example: '7.0' + OSAccountPlatform: + description: OS platform for OS accounts (desktop platforms only) + type: string + enum: + - MACOS + - WINDOWS + x-enumDescriptions: + MACOS: macOS operating system + WINDOWS: Windows operating system + OSAccountDisplayName: + description: Display name of the OS account + type: object + properties: + sensitive: + type: boolean + description: >- + Indicates whether the associated value is Personal Identifiable + Information (PII) and requires masking + default: false + value: + type: string + description: Display name of the OS account + OSAccountEmbedded: + description: Embedded resources related to the OS account + type: object + properties: + accountLinkedEnrollments: + type: array + description: Enrollments linked to this OS account + items: + $ref: '#/components/schemas/AccountLinkedEnrollment' + users: + type: array + description: Users associated with this OS account + items: + $ref: '#/components/schemas/User' + OSAccountLinks: + type: object + properties: + device: + $ref: '#/components/schemas/HrefObject' + self: + $ref: '#/components/schemas/HrefObject' + UserCredentials: + description: >- + Specifies primary authentication and recovery credentials for a user. + Credential types and requirements vary depending on the provider and + security policy of the org. + type: object + properties: + password: + $ref: '#/components/schemas/PasswordCredential' + provider: + $ref: '#/components/schemas/AuthenticationProvider' + recovery_question: + $ref: '#/components/schemas/RecoveryQuestionCredential' + UserProfile: + additionalProperties: true + description: >- + Specifies the default and custom profile properties for a user. + + + The default user profile is based on the [System for Cross-domain Identity Management: Core Schema](https://datatracker.ietf.org/doc/html/rfc7643). @@ -908,7 +1790,7 @@ components: [pattern](https://developer.okta.com/docs/reference/api/schemas/#login-pattern-validation) for `login`. You can use the Profile Editor in the Admin Console or the [Schemas - API](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/UISchema/#tag/UISchema) + API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UISchema/#tag/UISchema) to make schema modifications. @@ -916,7 +1798,7 @@ components: the custom property to the user profile schema before you reference it. You can use the Profile Editor in the Admin Console or the [Schemas - API](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/UISchema/#tag/UISchema) + API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UISchema/#tag/UISchema) to manage schema extensions. @@ -1015,20 +1897,19 @@ components: Logins are not considered unique if they differ only in case and/or diacritical marks. If one of your users has a login of - Isaac.Brock@example.com, there cannot be another user whose login is - isaac.brock@example.com, nor isáàc.bröck@example.com. + `Isaac.Brock@example.com`, there cannot be another user whose login + is `isaac.brock@example.com`, nor `isáàc.bröck@example.com`. Okta has a default ambiguous name resolution policy for usernames - that include @-signs. (By default, usernames must be formatted as + that include @-signs. By default, usernames must be formatted as email addresses and thus always include @-signs. You can remove that restriction using either the Admin Console or the [Schemas - API](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/). + API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/). Users can sign in with their non-qualified short name (for example: - isaac.brock with username isaac.brock@example.com) as long as the - short name is still unique within the organization. - - maxLength: 100 + `isaac.brock` with username `isaac.brock@example.com`) as long as + the short name is still unique within the org. + maxLength: 100 minLength: 5 manager: type: string @@ -1087,7 +1968,6 @@ components: The secondary email address of the user typically used for account recovery. For validation, see [RFC 5322 Section 3.2.3](https://datatracker.ietf.org/doc/html/rfc5322#section-3.2.3). - minLength: 5 maxLength: 100 nullable: true state: @@ -1113,6 +1993,14 @@ components: description: >- The property used to describe the organization-to-user relationship, such as employee or contractor + + + > **Note:** The `userType` property is a standard string attribute + and should be treated as a descriptive label rather than a + functional setting. Unlike a user's assigned user + [`type`](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#tag/User/operation/createUser!path=type&t=request), + this property is purely informational and doesn't influence the + behavior of the Okta platform. nullable: true zipCode: type: string @@ -1133,6 +2021,12 @@ components: password policy at login time, notices the password has expired, and moves the user to the expired state. When running reports, remember that the data is valid as of the last login or lifecycle event for that user. + + + > **Note:** The `ACTIVATING` status is a transitional status that occurs + when a user is being activated but hasn't completed the activation + process. This status isn't directly settable through the API, nor should + you use it for any of your user management workflows. type: string enum: - ACTIVE @@ -1157,22 +2051,190 @@ components: self: $ref: '#/components/schemas/HrefObjectSelfLink' readOnly: true - HrefObjectActivateLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to activate the resource - HrefObjectDeactivateLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to deactivate the resource - HrefHints: - description: Describes allowed HTTP verbs for the `href` + HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true type: object properties: - allow: - type: array - items: - $ref: '#/components/schemas/HttpMethod' + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + DiskEncryptionTypeDef: + description: >- + Type of encryption used on the device + + > **Note:** The following values map to Disk Encryption ON: `FULL`, + `USER`, `ALL_INTERNAL_VOLUMES`. All other values map to Disk Encryption + OFF. + type: string + enum: + - ALL_INTERNAL_VOLUMES + - FULL + - NONE + - SYSTEM_VOLUME + - USER + x-enumDescriptions: + NONE: No encryption has been set. + FULL: >- + Disk is fully encrypted. Only applicable to `IOS` and `ANDROID` + platforms. + USER: >- + Encryption key is tied to the user or profile. Only applicable to + `ANDROID` platform. + ALL_INTERNAL_VOLUMES: >- + All internal disks are encrypted. Only applicable to `WINDOWS` and + `MACOS` platforms. + SYSTEM_VOLUME: >- + Only the system volume is encrypted. Only applicable to `WINDOWS` and + `MACOS` platforms. + DevicePlatform: + description: OS platform of the device + type: string + enum: + - ANDROID + - IOS + - MACOS + - WINDOWS + LinksSelfAndLifecycle: + description: >- + Specifies link relations (see [Web + Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the + [JSON Hypertext Application + Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) + specification. This object is used for dynamic discovery of related + resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + activate: + $ref: '#/components/schemas/HrefObjectActivateLink' + deactivate: + $ref: '#/components/schemas/HrefObjectDeactivateLink' + readOnly: true + HrefObjectSuspendLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to suspend the resource + HrefObjectUnsuspendLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to unsuspend the resource + AccountLinkedEnrollment: + description: An enrollment linked to an OS account + type: object + properties: + created: + type: string + format: date-time + description: Timestamp when the enrollment was created + readOnly: true + id: + type: string + description: Unique identifier of the enrollment + readOnly: true + lastUpdated: + type: string + format: date-time + description: Timestamp when the enrollment was last updated + readOnly: true + profile: + $ref: '#/components/schemas/AccountLinkedEnrollmentProfile' + status: + type: string + description: >- + Status of the enrollment. Possible values depend on `type`. For + `platform_sso` - `ACTIVE`, `SUSPENDED`, `REVOKED`. For `desktop_mfa` + - `ACTIVE`, `DELETED`. + enum: + - ACTIVE + - SUSPENDED + - REVOKED + - DELETED + type: + type: string + description: Type of the linked enrollment + enum: + - platform_sso + - desktop_mfa + _embedded: + $ref: '#/components/schemas/AccountLinkedEnrollmentEmbedded' PasswordCredential: description: >- Specifies a password for a user. @@ -1202,60 +2264,168 @@ components: $ref: '#/components/schemas/PasswordCredentialHook' value: type: string - writeOnly: true + writeOnly: true + description: >- + Specifies the password for a user. The password policy validates + this password. + format: password + example: pa$$word + AuthenticationProvider: + description: >- + Specifies the authentication provider that validates the user's password + credential. The user's current provider is managed by the **Delegated + Authentication** settings for your org. The provider object is + **read-only**. + type: object + properties: + name: + type: string + description: The name of the authentication provider + readOnly: true + example: OKTA + type: + $ref: '#/components/schemas/AuthenticationProviderType' + readOnly: true + RecoveryQuestionCredential: + description: >- + Specifies a secret question and answer that's validated (case + insensitive) when a user forgets their + + password or unlocks their account. The answer property is write-only. + type: object + properties: + answer: + type: string + description: The answer to the recovery question + minimum: 1 + maximum: 100 + writeOnly: true + example: se7en + question: + type: string + description: The recovery question + minimum: 1 + maximum: 100 + example: what is your favourite movie? + HrefObjectSelfLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) + HrefHints: + description: Describes allowed HTTP verbs for the `href` + type: object + properties: + allow: + type: array + items: + $ref: '#/components/schemas/HttpMethod' + HrefObjectActivateLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean description: >- - Specifies the password for a user. The password policy validates - this password. - format: password - example: pa$$word - AuthenticationProvider: - description: >- - Specifies the authentication provider that validates the user's password - credential. The user's current provider is managed by the **Delegated - Authentication** settings for your org. The provider object is - **read-only**. + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to activate the resource + HrefObjectDeactivateLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true type: object properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI name: type: string - description: The name of the authentication provider + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. readOnly: true - example: OKTA type: - $ref: '#/components/schemas/AuthenticationProviderType' - readOnly: true - RecoveryQuestionCredential: - description: >- - Specifies a secret question and answer that's validated (case - insensitive) when a user forgets their - - password or unlocks their account. The answer property is write-only. + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to deactivate the resource + AccountLinkedEnrollmentProfile: + description: Profile details for a linked enrollment type: object properties: - answer: + authenticationMethod: type: string - description: The answer to the recovery question - minimum: 1 - maximum: 100 - writeOnly: true - example: se7en - question: + description: Authentication method used for the enrollment + enum: + - PASSWORD + - SECURE_ENCLAVE + AccountLinkedEnrollmentEmbedded: + description: Embedded data for a linked enrollment + type: object + properties: + lastAuthenticatedOn: type: string - description: The recovery question - minimum: 1 - maximum: 100 - example: what is your favourite movie? - HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) - HttpMethod: - type: string - enum: - - DELETE - - GET - - POST - - PUT + format: date-time + description: Timestamp of the last successful authentication PasswordCredentialHash: description: >- Specifies a hashed password to import into Okta. This allows an existing @@ -1264,7 +2434,7 @@ components: from some other store. Okta supports the BCRYPT, SHA-512, SHA-256, SHA-1, MD5, and PBKDF2 hash functions for password import. A hashed password may be specified in a password object when creating or updating a user, but not for other operations. - See the [Create user with imported hashed password](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#create-user-with-imported-hashed-password) description. When you update a user with a hashed password, the user must be in the `STAGED` status. + See the [Create user with imported hashed password](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#create-user-with-imported-hashed-password) description. When you update a user with a hashed password, the user must be in the `STAGED` status. type: object properties: algorithm: @@ -1322,7 +2492,7 @@ components: PasswordCredentialHook: description: >- Specify a [password import inline - hook](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/InlineHook/#tag/InlineHook/operation/createPasswordImportInlineHook) + hook](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/inlinehook/createpasswordimportinlinehook) to trigger verification of the user's password the first time the user signs in. This allows an existing password to be imported into Okta directly from some other store. @@ -1358,6 +2528,13 @@ components: support a `password` or `recovery question` credential. The user must authenticate through a trusted identity provider. readOnly: true + HttpMethod: + type: string + enum: + - DELETE + - GET + - POST + - PUT PasswordCredentialHashAlgorithm: description: >- The algorithm used to generate the hash using the password (and salt, @@ -1378,6 +2555,34 @@ components: enum: - SHA256_HMAC - SHA512_HMAC + ListDevicesResponse: + type: object + properties: + devices: + type: array + items: + $ref: '#/components/schemas/DeviceList' + ListDeviceOSAccountsResponse: + type: object + properties: + device_osaccounts: + type: array + items: + oneOf: + - $ref: '#/components/schemas/OSAccountWindows' + - $ref: '#/components/schemas/OSAccountMacOS' + discriminator: + propertyName: platform + mapping: + WINDOWS: '#/components/schemas/OSAccountWindows' + MACOS: '#/components/schemas/OSAccountMacOS' + ListDeviceUsersResponse: + type: object + properties: + device_users: + type: array + items: + $ref: '#/components/schemas/DeviceUser' responses: ErrorAccessDenied403: description: Forbidden @@ -1415,6 +2620,34 @@ components: example: guo4a5u7JHHhjXrMK0g4 required: true description: '`id` of the device' + queryOsAccountExpand: + name: expand + in: query + description: >- + Comma-separated list of related resources to include in the `_embedded` + attribute. Supported values are `users` and + `account_linked_enrollments`. + required: false + style: form + explode: false + schema: + type: array + items: + type: string + enum: + - users + - account_linked_enrollments + example: + - users + - account_linked_enrollments + pathOsAccountId: + name: osAccountId + in: path + description: The unique identifier for the OS account + required: true + schema: + type: string + example: dao3qgkIEKjhNZudR0g4 examples: APIDevicesListAllUserSummaryResponse: summary: List all devices with embedded user summaries @@ -1712,6 +2945,60 @@ components: hints: allow: - POST + DeviceWithProvidersResponse: + value: + id: guo8jx5vVoxfvJeLb0w4 + status: ACTIVE + created: '2020-11-03T21:47:01.000Z' + lastUpdated: '2020-11-03T23:46:27.000Z' + profile: + displayName: DESKTOP-EHAD3IE + platform: WINDOWS + manufacturer: International Corp + model: VMware7,1 + osVersion: 10.0.18362 + serialNumber: 56 4d 4f 95 74 c5 d3 e7-fc 3a 57 9c c2 f8 5d ce + udid: 954F4D56-C574-E7D3-FC3A-579CC2F85DCE + sid: S-1-5-21-3992267483-1860856704-2413701314-500 + registered: true + secureHardwarePresent: false + diskEncryptionType: NONE + resourceId: guo8jx5vVoxfvJeLb0w4 + resourceDisplayName: + value: DESKTOP-EHAD3IE + sensitive: false + resourceType: UDDevice + resourceAlternateId: null + providers: + - provider: oktaVerify + payloadVersion: '1.0' + payload: + clientVersion: '7.0' + _links: + suspend: + href: >- + https://{yourOktaDomain}/api/v1/devices/guo8jx5vVoxfvJeLb0w4/lifecycle/suspend + hints: + allow: + - POST + self: + href: https://{yourOktaDomain}/api/v1/devices/guo8jx5vVoxfvJeLb0w4 + hints: + allow: + - GET + - PATCH + - PUT + users: + href: https://{yourOktaDomain}/api/v1/devices/guo8jx5vVoxfvJeLb0w4/users + hints: + allow: + - GET + deactivate: + href: >- + https://{yourOktaDomain}/api/v1/devices/guo8jx5vVoxfvJeLb0w4/lifecycle/deactivate + hints: + allow: + - POST ErrorAccessDenied: summary: Access Denied value: @@ -1720,6 +3007,222 @@ components: errorLink: E0000006 errorId: sampleNUSD_8fdkFd8fs8SDBK errorCauses: [] + WindowsOSAccountListResponse: + summary: List of Windows OS accounts + value: + - id: dao3qgkIEKjhNZudR0g4 + deviceId: guo4a5u7JHHhjXrMK0g4 + created: '2026-01-19T17:22:30.000Z' + lastUpdated: '2026-01-19T17:22:30.000Z' + platform: WINDOWS + profile: + type: WINDOWS + securityId: S-1-5-21-1004336348-1177238915-682003330-512 + GUID: 4ac29c85-d847-4492-96cb-46e337170c33 + directoryJoinStatus: AD + fullName: Carmel Sonne + downLevelUsername: okta\carmel.sonne + upn: carmel.sonne@okta.com + qualifiedUsername: okta\carmel.sonne + status: ACTIVE + lastSeenAt: '2026-04-09T17:22:56.000Z' + resourceAlternateId: null + resourceDisplayName: + value: Carmel Sonne + sensitive: false + resourceId: dao3qgkIEKjhNZudR0g4 + resourceType: DOSAccount + _embedded: + users: + - id: 00u1fxs5JcdX9jsfc0g5 + status: ACTIVE + profile: + firstName: Carmel + lastName: Sonne + login: carmel.sonne@okta.com + email: carmel.sonne@okta.com + accountLinkedEnrollments: + - id: ukp1fxtdiJkUQiX220g5 + type: platform_sso + status: ACTIVE + created: '2026-01-19T17:22:30.000Z' + lastUpdated: '2026-01-19T17:22:30.000Z' + profile: + authenticationMethod: PASSWORD + _embedded: + lastAuthenticatedOn: '2026-04-09T17:22:56.000Z' + _links: + self: + href: >- + https://{yourOktaDomain}/api/v1/devices/guo4a5u7JHHhjXrMK0g4/os-accounts/dao3qgkIEKjhNZudR0g4 + hints: + allow: + - GET + device: + href: https://{yourOktaDomain}/api/v1/devices/guo4a5u7JHHhjXrMK0g4 + hints: + allow: + - GET + MacOSOSAccountListResponse: + summary: List of macOS accounts + value: + - id: dao3qgkIEKjhNZudR0g4 + deviceId: guo4a5u7JHHhjXrMK0g4 + created: '2026-01-19T17:22:30.000Z' + lastUpdated: '2026-01-19T17:22:30.000Z' + platform: MACOS + profile: + type: MACOS + accountUuid: 4ac29c85-d847-4492-96cb-46e337170c33 + username: carmel.sonne + fullName: Carmel Sonne + status: ACTIVE + lastSeenAt: '2026-04-09T17:22:56.000Z' + resourceAlternateId: null + resourceDisplayName: + value: Carmel Sonne + sensitive: false + resourceId: dao3qgkIEKjhNZudR0g4 + resourceType: DOSAccount + _embedded: + users: + - id: 00u1fxs5JcdX9jsfc0g5 + status: ACTIVE + profile: + firstName: Carmel + lastName: Sonne + login: carmel.sonne@okta.com + email: carmel.sonne@okta.com + accountLinkedEnrollments: + - id: ukp1fxtdiJkUQiX220g5 + type: platform_sso + status: ACTIVE + created: '2026-01-19T17:22:30.000Z' + lastUpdated: '2026-01-19T17:22:30.000Z' + profile: + authenticationMethod: PASSWORD + _embedded: + lastAuthenticatedOn: '2026-04-09T17:22:56.000Z' + _links: + self: + href: >- + https://{yourOktaDomain}/api/v1/devices/guo4a5u7JHHhjXrMK0g4/os-accounts/dao3qgkIEKjhNZudR0g4 + hints: + allow: + - GET + device: + href: https://{yourOktaDomain}/api/v1/devices/guo4a5u7JHHhjXrMK0g4 + hints: + allow: + - GET + WindowsOSAccountResponse: + summary: Windows OS account + value: + id: dao3qgkIEKjhNZudR0g4 + deviceId: guo4a5u7JHHhjXrMK0g4 + created: '2026-01-19T17:22:30.000Z' + lastUpdated: '2026-01-19T17:22:30.000Z' + platform: WINDOWS + profile: + type: WINDOWS + securityId: S-1-5-21-1004336348-1177238915-682003330-512 + GUID: 4ac29c85-d847-4492-96cb-46e337170c33 + directoryJoinStatus: AD + fullName: Carmel Sonne + downLevelUsername: okta\carmel.sonne + upn: carmel.sonne@okta.com + qualifiedUsername: okta\carmel.sonne + status: ACTIVE + lastSeenAt: '2026-04-09T17:22:56.000Z' + resourceAlternateId: null + resourceDisplayName: + value: Carmel Sonne + sensitive: false + resourceId: dao3qgkIEKjhNZudR0g4 + resourceType: DOSAccount + _embedded: + users: + - id: 00u1fxs5JcdX9jsfc0g5 + status: ACTIVE + profile: + firstName: Carmel + lastName: Sonne + login: carmel.sonne@okta.com + email: carmel.sonne@okta.com + accountLinkedEnrollments: + - id: ukp1fxtdiJkUQiX220g5 + type: platform_sso + status: ACTIVE + created: '2026-01-19T17:22:30.000Z' + lastUpdated: '2026-01-19T17:22:30.000Z' + profile: + authenticationMethod: PASSWORD + _embedded: + lastAuthenticatedOn: '2026-04-09T17:22:56.000Z' + _links: + self: + href: >- + https://{yourOktaDomain}/api/v1/devices/guo4a5u7JHHhjXrMK0g4/os-accounts/dao3qgkIEKjhNZudR0g4 + hints: + allow: + - GET + device: + href: https://{yourOktaDomain}/api/v1/devices/guo4a5u7JHHhjXrMK0g4 + hints: + allow: + - GET + MacOSOSAccountResponse: + summary: macOS account + value: + id: dao3qgkIEKjhNZudR0g4 + deviceId: guo4a5u7JHHhjXrMK0g4 + created: '2026-01-19T17:22:30.000Z' + lastUpdated: '2026-01-19T17:22:30.000Z' + platform: MACOS + profile: + type: MACOS + accountUuid: 4ac29c85-d847-4492-96cb-46e337170c33 + username: carmel.sonne + fullName: Carmel Sonne + status: ACTIVE + lastSeenAt: '2026-04-09T17:22:56.000Z' + resourceAlternateId: null + resourceDisplayName: + value: Carmel Sonne + sensitive: false + resourceId: dao3qgkIEKjhNZudR0g4 + resourceType: DOSAccount + _embedded: + users: + - id: 00u1fxs5JcdX9jsfc0g5 + status: ACTIVE + profile: + firstName: Carmel + lastName: Sonne + login: carmel.sonne@okta.com + email: carmel.sonne@okta.com + accountLinkedEnrollments: + - id: ukp1fxtdiJkUQiX220g5 + type: platform_sso + status: ACTIVE + created: '2026-01-19T17:22:30.000Z' + lastUpdated: '2026-01-19T17:22:30.000Z' + profile: + authenticationMethod: PASSWORD + _embedded: + lastAuthenticatedOn: '2026-04-09T17:22:56.000Z' + _links: + self: + href: >- + https://{yourOktaDomain}/api/v1/devices/guo4a5u7JHHhjXrMK0g4/os-accounts/dao3qgkIEKjhNZudR0g4 + hints: + allow: + - GET + device: + href: https://{yourOktaDomain}/api/v1/devices/guo4a5u7JHHhjXrMK0g4 + hints: + allow: + - GET APIDevicesListAllUsersResponse: summary: Response example value: @@ -1818,6 +3321,15 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.devices + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListDevicesResponse' + transform: + body: |- + {{- $wrapped := printf "{\"devices\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 get_device: operation: $ref: '#/paths/~1api~1v1~1devices~1{deviceId}/get' @@ -1828,41 +3340,78 @@ components: operation: $ref: '#/paths/~1api~1v1~1devices~1{deviceId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' activate_device: operation: $ref: '#/paths/~1api~1v1~1devices~1{deviceId}~1lifecycle~1activate/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' deactivate_device: operation: $ref: '#/paths/~1api~1v1~1devices~1{deviceId}~1lifecycle~1deactivate/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' suspend_device: operation: $ref: '#/paths/~1api~1v1~1devices~1{deviceId}~1lifecycle~1suspend/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' unsuspend_device: operation: $ref: '#/paths/~1api~1v1~1devices~1{deviceId}~1lifecycle~1unsuspend/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: '#/components/x-stackQL-resources/devices/methods/list_devices' - $ref: '#/components/x-stackQL-resources/devices/methods/get_device' + - $ref: '#/components/x-stackQL-resources/devices/methods/list_devices' insert: [] update: [] delete: - $ref: '#/components/x-stackQL-resources/devices/methods/delete_device' replace: [] + device_os_accounts: + id: okta.devices.device_os_accounts + name: device_os_accounts + title: Device Os Accounts + methods: + list_device_osaccounts: + operation: + $ref: '#/paths/~1api~1v1~1devices~1{deviceId}~1os-accounts/get' + response: + mediaType: application/json + openAPIDocKey: '200' + objectKey: $.device_osaccounts + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListDeviceOSAccountsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"device_osaccounts\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 + get_device_osaccount: + operation: + $ref: >- + #/paths/~1api~1v1~1devices~1{deviceId}~1os-accounts~1{osAccountId}/get + response: + mediaType: application/json + openAPIDocKey: '200' + sqlVerbs: + select: + - $ref: >- + #/components/x-stackQL-resources/device_os_accounts/methods/get_device_osaccount + - $ref: >- + #/components/x-stackQL-resources/device_os_accounts/methods/list_device_osaccounts + insert: [] + update: [] + delete: [] + replace: [] device_users: id: okta.devices.device_users name: device_users @@ -1874,6 +3423,15 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.device_users + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListDeviceUsersResponse' + transform: + body: |- + {{- $wrapped := printf "{\"device_users\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 sqlVerbs: select: - $ref: >- @@ -1887,7 +3445,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/directories.yaml b/providers/src/okta/v00.00.00000/services/directories.yaml index 8f9828b1..94d71245 100644 --- a/providers/src/okta/v00.00.00000/services/directories.yaml +++ b/providers/src/okta/v00.00.00000/services/directories.yaml @@ -2,30 +2,28 @@ openapi: 3.0.3 info: title: directories API description: okta directories API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/directories/{appInstanceId}/groups/modify: post: - summary: Update an Active Directory group membership - description: >- - Updates an Active Directory group membership directly in Active - Directory + summary: Update an external directory group membership + description: |- + Updates an Active Directory or LDAP group membership directly in the Active Directory or LDAP server. + You can add or remove users from groups based on their identity and access requirements. This ensures that changes made to user access in Okta are reflected in AD or LDAP. When you use Okta Access Certifications to revoke a user's membership to an AD or LDAP group, the removal is reflected in AD or LDAP. - > **Note:** See **Before you begin: Active Directory integration with - the following setup** in the [Use Okta Access Certifications to manage - AD group - membership](https://help.okta.com/okta_help.htm?type=oie&id=ad-bidirectional-group-mgt-configure) - product documentation. - operationId: updateADGroupMembership + See [AD Bidirectional Group Management](https://help.okta.com/okta_help.htm?type=oie&id=ad-bidirectional-group-mgmt) and [LDAP Bidirectional Group Management](https://help.okta.com/okta_help.htm?type=oie&id=ldap-bidirectional-group-mgmt). + operationId: updateGroupMembership requestBody: content: application/json: schema: $ref: '#/components/schemas/AgentAction' examples: - addUserToGroup: + addADUserToGroup: $ref: '#/components/examples/add-user-request' + addLdapUserToGroup: + $ref: '#/components/examples/add-ldap-user-request' required: true responses: '200': @@ -55,19 +53,93 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/appInstanceId' + parameters: + - $ref: '#/components/parameters/appInstanceId' + /api/v1/directories/{appInstanceId}/groups/{groupId}/query: + post: + summary: Submit a query for AD Group + description: |- + Submits a query search on the on-premises agent to asynchronously fetch specific Active Directory (AD) attributes for a group. + Returns a `resultId` that is used to poll for the results. + operationId: submitGroupAttributeQuery + requestBody: + required: true + content: + application/json: + schema: + $ref: '#/components/schemas/GroupQueryRequest' + responses: + '202': + description: Accepted. Query initiated. + '400': + description: Bad Request + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + '502': + $ref: '#/components/responses/Error502NoConnectedAgents' + '504': + $ref: '#/components/responses/Error504AgentTimeOut' + security: + - oauth2: + - okta.directories.groups.read + tags: + - DirectoriesIntegration + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/adAppInstanceId' + - $ref: '#/components/parameters/groupId' + /api/v1/directories/{appInstanceId}/groups/{groupId}/query/{resultId}: + get: + summary: Retrieve the results of an AD group query + description: |- + Retrieves the results of the requested Active Directory (AD) group attributes using the `resultId` returned from the `POST /api/v1/directories/{appInstanceId}/groups/{groupId}/query` call. + If the operation has expired or if the `resultId` is invalid, returns a `404` status. + operationId: getGroupAttributeQueryResult + responses: + '200': + description: OK. Returns the group profile. + content: + application/json: + schema: + $ref: '#/components/schemas/GroupProfileResult' + '202': + description: Accepted. Query is still in progress. + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + security: + - oauth2: + - okta.directories.groups.read + tags: + - DirectoriesIntegration + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/adAppInstanceId' + - $ref: '#/components/parameters/groupId' + - $ref: '#/components/parameters/queryResultId' components: schemas: AgentAction: - description: Details about the Active Directory group membership update + description: Details about the Active Directory or LDAP group membership update type: object properties: id: type: string - description: ID of the Active Directory group to update + description: ID of the Active Directory or LDAP group to update parameters: $ref: '#/components/schemas/Parameters' + required: + - id + - parameters Error: title: Error type: object @@ -81,20 +153,53 @@ components: description: An Okta code for this type of error errorId: type: string - description: >- - A unique identifier for this error. This can be used by Okta Support - to help with troubleshooting. + description: A unique identifier for this error. This can be used by Okta Support to help with troubleshooting. errorLink: type: string description: An Okta code for this type of error errorSummary: type: string - description: >- - A short description of what caused this error. Sometimes this - contains dynamically-generated information about your specific - error. + description: A short description of what caused this error. Sometimes this contains dynamically-generated information about your specific error. + GroupQueryRequest: + type: object + properties: + attributes: + type: array + items: + type: string + description: 'An array of LDAP group attribute names to retrieve. Restricted attributes: member, memberOf, *' + example: + - distinguishedName + - description + - cn + - whenCreated + required: + - attributes + GroupQueryResponse: + type: object + properties: + resultId: + type: string + description: Identifier used to poll for the query result + example: rdj4edr7pSDGv8QF10g4 + GroupProfileResult: + type: object + properties: + id: + type: string + description: The ID of the group + example: 00g19oiNHkbKFvNTX0g4 + profile: + type: object + additionalProperties: true + description: Map of requested attributes and their values + example: + distinguishedName: CN=Finance,OU=Groups,DC=example,DC=com + description: Finance Department Group + cn: CN=Finance + whenCreated: 20230101000000.0Z Parameters: - description: Attributes used for processing Active Directory group membership update + description: Attributes used for processing Active Directory or LDAP group membership update type: object properties: action: @@ -108,9 +213,7 @@ components: REMOVE: Remove from the membership of the group attribute: type: string - description: >- - The attribute that tracks group memberships in Active Directory. For - Active Directory, use `member`. + description: The attribute that tracks group memberships in Active Directory or LDAP. For Active Directory, use `member`. For LDAP, use the appropriate attribute found in the LDAP server such as, but not limited to, `uniqueMember` or `member`. example: member values: type: array @@ -118,6 +221,10 @@ components: items: type: string description: ID of an existing user + required: + - action + - attribute + - values ErrorCause: type: object properties: @@ -164,13 +271,36 @@ components: appInstanceId: name: appInstanceId in: path - description: ID of the Active Directory app instance in Okta + description: ID of the Active Directory or LDAP app instance in Okta + schema: + type: string + required: true + adAppInstanceId: + name: appInstanceId + in: path + description: ID of the AD instance in Okta schema: type: string required: true + example: 00a1xucgTZFrziXg10g4 + groupId: + name: groupId + in: path + description: ID of the Okta group + required: true + schema: + type: string + example: 00g1xucgTZFrziXg10g4 + queryResultId: + name: resultId + in: path + description: The unique identifier returned by the initial POST request (`POST /api/v1/directories/{appInstanceId}/groups/{groupId}/query`) + required: true + schema: + type: string examples: add-user-request: - summary: Add user to group + summary: Add AD user to group value: id: 00g1xucgTZFrziXg10g4 parameters: @@ -178,6 +308,15 @@ components: attribute: member values: - 00u1bh5efGKMsSiLv0g4 + add-ldap-user-request: + summary: Add LDAP user to group + value: + id: 00g1xucgTZFrziXg10g4 + parameters: + action: ADD + attribute: uniqueMember + values: + - 00u1bh5efGKMsSiLv0g4 ErrorApiValidationFailed: summary: API Validation Failed value: @@ -222,19 +361,35 @@ components: name: directories_integration title: Directories Integration methods: - update_adgroup_membership: + update_group_membership: + config: + requestBodyTranslate: + algorithm: naive + operation: + $ref: '#/paths/~1api~1v1~1directories~1{appInstanceId}~1groups~1modify/post' + response: + mediaType: application/json + openAPIDocKey: '200' + submit_group_attribute_query: + config: + requestBodyTranslate: + algorithm: naive + operation: + $ref: '#/paths/~1api~1v1~1directories~1{appInstanceId}~1groups~1{groupId}~1query/post' + response: + mediaType: application/json + openAPIDocKey: '202' + get_group_attribute_query_result: operation: - $ref: >- - #/paths/~1api~1v1~1directories~1{appInstanceId}~1groups~1modify/post + $ref: '#/paths/~1api~1v1~1directories~1{appInstanceId}~1groups~1{groupId}~1query~1{resultId}/get' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '200' sqlVerbs: - select: [] + select: + - $ref: '#/components/x-stackQL-resources/directories_integration/methods/get_group_attribute_query_result' insert: [] - update: - - $ref: >- - #/components/x-stackQL-resources/directories_integration/methods/update_adgroup_membership + update: [] delete: [] replace: [] servers: @@ -242,7 +397,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/domains.yaml b/providers/src/okta/v00.00.00000/services/domains.yaml index 0842e93f..f3280313 100644 --- a/providers/src/okta/v00.00.00000/services/domains.yaml +++ b/providers/src/okta/v00.00.00000/services/domains.yaml @@ -2,11 +2,11 @@ openapi: 3.0.3 info: title: domains API description: okta domains API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/domains: get: - summary: List all Custom Domains + summary: List all custom domains description: Lists all verified custom domains for the org operationId: listCustomDomains responses: @@ -30,7 +30,7 @@ paths: lifecycle: GA isGenerallyAvailable: true post: - summary: Create a Custom Domain + summary: Create a custom domain description: Creates your custom domain operationId: createCustomDomain x-codegen-request-body-name: domain @@ -89,6 +89,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathDomainId' put: summary: Replace a custom domain's brand description: Replaces a custom domain's brand @@ -123,6 +125,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathDomainId' delete: summary: Delete a custom domain description: Deletes a custom domain by `domainId` @@ -146,8 +150,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathDomainId' + parameters: + - $ref: '#/components/parameters/pathDomainId' /api/v1/domains/{domainId}/certificate: put: summary: Upsert the custom domain's certificate @@ -196,17 +200,35 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathDomainId' + parameters: + - $ref: '#/components/parameters/pathDomainId' /api/v1/domains/{domainId}/verify: post: summary: Verify a custom domain description: >- Verifies the custom domain and validity of DNS records by `domainId`. + Verify your custom domain to confirm that you own or control the domain + and that you have properly configured the required DNS records. Furthermore, if the `certificateSourceType` in the domain is `OKTA_MANAGED`, then an attempt is made to obtain and install a certificate. After a certificate is obtained and installed by Okta, Okta manages the certificate including certificate renewal. + + + Verify your custom domain after you've [created + it](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/CustomDomain/#tag/CustomDomain/operation/createCustomDomain) + and after you've added your DNS records to your domain provider. Okta + doesn't verify your domain automatically. You must use the API to verify + your custom domain if you change your DNS records or if you encounter + issues with domain validation. + + + > **Note:** DNS record changes can take time to propagate. If you + recently updated your DNS records, you may need to wait before verifying + your custom domain. If you encounter issues with domain verification, + double-check your DNS records and ensure that they're correctly + configured. See [Update your DNS + records](https://developer.okta.com/docs/guides/custom-url-domain/main/#update-your-dns-txt). operationId: verifyDomain responses: '200': @@ -230,18 +252,18 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathDomainId' + parameters: + - $ref: '#/components/parameters/pathDomainId' components: schemas: DomainListResponse: description: >- Defines a list of domains with a subset of the properties for each - domain. + domain type: object properties: domains: - description: Each element of the array defines an individual domain. + description: Each element of the array defines an individual domain type: array items: $ref: '#/components/schemas/DomainResponse' @@ -251,7 +273,12 @@ components: certificateSourceType: $ref: '#/components/schemas/DomainCertificateSourceType' domain: - description: Custom domain name + description: >- + Custom domain name + + + > **Note:** You can't use the reserved + `drapp.{yourOrgSubDomain}.okta.com` domain. type: string example: login.example.com required: @@ -270,7 +297,7 @@ components: dnsRecords: type: array items: - $ref: '#/components/schemas/DNSRecord' + $ref: '#/components/schemas/DNSRecordDomains' domain: description: Custom domain name type: string @@ -363,8 +390,8 @@ components: enum: - MANUAL - OKTA_MANAGED - DNSRecord: - description: DNS TXT and CNAME records to be registered for the Domain + DNSRecordDomains: + description: DNS records to be registered for the domain type: object properties: expiration: @@ -375,7 +402,7 @@ components: type: string example: _oktaverification.login.example.com recordType: - $ref: '#/components/schemas/DNSRecordType' + $ref: '#/components/schemas/DNSRecordTypeDomains' values: description: DNS record value type: array @@ -410,24 +437,114 @@ components: - NOT_STARTED - VERIFIED DomainLinks: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - type: object + x-okta-ignore-redocly-rules-for-sdk: true + description: >- + Specifies link relations (see [Web + Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the + [JSON Hypertext Application + Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) + specification. This object is used for dynamic discovery of related + resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + brand: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: The associated brand + certificate: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: The certificate link references the domain certificate + verify: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object properties: - brand: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: The associated brand - certificate: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: The certificate link references the domain certificate - verify: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: >- - The verify link verifies the domain and transitions the - domain status to `VERIFIED` + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: >- + The verify link verifies the domain and transitions the domain + status to `VERIFIED` + readOnly: true DomainCertificateType: description: Certificate type type: string @@ -438,10 +555,11 @@ components: properties: errorSummary: type: string - DNSRecordType: + DNSRecordTypeDomains: example: TXT type: string enum: + - CAA - CNAME - TXT LinksSelf: @@ -458,6 +576,7 @@ components: $ref: '#/components/schemas/HrefObjectSelfLink' readOnly: true HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object additionalProperties: true type: object @@ -487,9 +606,36 @@ components: required: - href HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) HrefHints: description: Describes allowed HTTP verbs for the `href` type: object @@ -597,6 +743,9 @@ components: mediaType: application/json openAPIDocKey: '200' create_custom_domain: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1domains/post' response: @@ -609,6 +758,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_custom_domain: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1domains~1{domainId}/put' response: @@ -618,13 +770,16 @@ components: operation: $ref: '#/paths/~1api~1v1~1domains~1{domainId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' upsert_certificate: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1domains~1{domainId}~1certificate/put' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' verify_domain: operation: @@ -634,10 +789,10 @@ components: openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/custom_domains/methods/list_custom_domains - $ref: >- #/components/x-stackQL-resources/custom_domains/methods/get_custom_domain + - $ref: >- + #/components/x-stackQL-resources/custom_domains/methods/list_custom_domains insert: - $ref: >- #/components/x-stackQL-resources/custom_domains/methods/create_custom_domain @@ -653,7 +808,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/dr.yaml b/providers/src/okta/v00.00.00000/services/dr.yaml new file mode 100644 index 00000000..d1158d60 --- /dev/null +++ b/providers/src/okta/v00.00.00000/services/dr.yaml @@ -0,0 +1,476 @@ +openapi: 3.0.3 +info: + title: dr API + description: okta dr API + version: 2026.07.2 +paths: + /api/v1/dr/failback: + post: + x-okta-lifecycle: + lifecycle: EA + summary: Start the failback of your org + description: Starts the failback of your org + operationId: startOrgFailback + requestBody: + required: false + description: >- + The request body is optional. You can specify a domain to failback, an + empty object (`{}`), or no payload. + content: + application/json: + schema: + x-okta-ignore-redocly-rules-for-sdk: true + title: Domains + type: object + properties: + domains: + type: array + description: The Okta domain to failback + items: + type: string + description: Okta domain to failback + example: yourOktaDomain.okta.com + description: Empty object payload + additionalProperties: false + examples: + example1: + summary: A sample Okta domain to failback + value: + domains: + - yourOktaDomain.okta.com + example2: + summary: An empty object + value: {} + responses: + '200': + $ref: '#/components/responses/FailbackResponse' + '400': + $ref: '#/components/responses/ErrorApiValidationFailed400' + '401': + $ref: '#/components/responses/ErrorInvalidToken401' + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + '500': + $ref: '#/components/responses/ErrorInternalServer500' + security: + - oauth2: + - okta.dr.manage + tags: + - DisasterRecovery + /api/v1/dr/failover: + post: + x-okta-lifecycle: + lifecycle: EA + summary: Start the failover of your org + description: Starts the failover of your org + operationId: startOrgFailover + requestBody: + required: false + description: >- + The request body is optional. You can specify a domain to failover, an + empty object (`{}`), or no payload. + content: + application/json: + schema: + x-okta-ignore-redocly-rules-for-sdk: true + title: Domains + type: object + properties: + domains: + type: array + description: The Okta domain to failover + items: + type: string + description: Okta domain to failover + example: yourOktaDomain.okta.com + description: Empty object payload + additionalProperties: false + examples: + example1: + summary: A sample Okta domain to failover + value: + domains: + - yourOktaDomain.okta.com + example2: + summary: An empty object + value: {} + responses: + '200': + $ref: '#/components/responses/FailoverResponse' + '400': + $ref: '#/components/responses/ErrorApiValidationFailed400' + '401': + $ref: '#/components/responses/ErrorInvalidToken401' + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + '500': + $ref: '#/components/responses/ErrorInternalServer500' + security: + - oauth2: + - okta.dr.manage + tags: + - DisasterRecovery + /api/v1/dr/status: + get: + x-okta-lifecycle: + lifecycle: EA + summary: Retrieve the disaster recovery status for all domains + description: >- + Retrieves the failover or failback status for all the domains for your + org + operationId: getDRStatus + responses: + '200': + $ref: '#/components/responses/DRStatusResponse' + '400': + $ref: '#/components/responses/ErrorApiValidationFailed400' + '401': + $ref: '#/components/responses/ErrorInvalidToken401' + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + '500': + $ref: '#/components/responses/ErrorInternalServer500' + security: + - oauth2: + - okta.dr.read + tags: + - DisasterRecovery + /api/v1/dr/status/{domain}: + get: + x-okta-lifecycle: + lifecycle: EA + summary: Retrieve the disaster recovery status for a domain + description: >- + Retrieves the failover or failback status for the domain specified in + the request path + operationId: getDRStatusForDomain + responses: + '200': + $ref: '#/components/responses/DRStatusResponse' + '400': + $ref: '#/components/responses/ErrorApiValidationFailed400' + '401': + $ref: '#/components/responses/ErrorInvalidToken401' + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + '500': + $ref: '#/components/responses/ErrorInternalServer500' + security: + - oauth2: + - okta.dr.read + tags: + - DisasterRecovery + parameters: + - $ref: '#/components/parameters/domain' +components: + schemas: + FailbackRequestSchema: + title: Domains + type: object + properties: + domains: + type: array + description: The Okta domain to failback + items: + type: string + description: Okta domain to failback + example: yourOktaDomain.okta.com + EmptyRequestSchema: + x-okta-ignore-redocly-rules-for-sdk: true + title: Empty + description: Empty object payload + additionalProperties: false + type: object + FailoverRequestSchema: + title: Domains + type: object + properties: + domains: + type: array + description: The Okta domain to failover + items: + type: string + description: Okta domain to failover + example: yourOktaDomain.okta.com + Error: + title: Error + type: object + properties: + errorCauses: + type: array + items: + $ref: '#/components/schemas/ErrorCause' + errorCode: + type: string + description: An Okta code for this type of error + errorId: + type: string + description: >- + A unique identifier for this error. This can be used by Okta Support + to help with troubleshooting. + errorLink: + type: string + description: An Okta code for this type of error + errorSummary: + type: string + description: >- + A short description of what caused this error. Sometimes this + contains dynamically-generated information about your specific + error. + DRStatusItem: + description: Status whether a domain has been failed over or not + type: object + properties: + domain: + type: string + description: Domain for your org + isFailedOver: + type: boolean + description: Indicates if the domain has been failed over + nullable: false + ErrorCause: + type: object + properties: + errorSummary: + type: string + responses: + FailbackResponse: + description: OK + content: + application/json: + schema: + properties: + results: + type: array + description: Results of the failback operation + items: + properties: + domain: + type: string + description: Domain for your org + example: yourOktaDomain.okta.com + message: + type: string + description: Domain failback message + example: Failback was successful + type: object + type: object + ErrorApiValidationFailed400: + description: Bad Request + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + examples: + APIValidationFailed: + $ref: '#/components/examples/ErrorApiValidationFailed' + ErrorInvalidToken401: + description: Unauthorized + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + examples: + InvalidTokenProvided: + $ref: '#/components/examples/ErrorInvalidTokenProvided' + ErrorAccessDenied403: + description: Forbidden + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + examples: + AccessDenied: + $ref: '#/components/examples/ErrorAccessDenied' + ErrorTooManyRequests429: + description: Too Many Requests + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + examples: + TooManyRequests: + $ref: '#/components/examples/ErrorTooManyRequests' + ErrorInternalServer500: + description: Internal Server Error + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + examples: + InternalServerError: + $ref: '#/components/examples/ErrorInternalServer' + FailoverResponse: + description: OK + content: + application/json: + schema: + properties: + results: + type: array + description: Results of the failover operation + items: + properties: + domain: + type: string + description: Domain for your org + example: yourOktaDomain.okta.com + message: + type: string + description: Domain failover message + example: Failover was successful + type: object + type: object + DRStatusResponse: + description: OK + content: + application/json: + schema: + properties: + status: + type: array + description: List of domains and their disaster recovery status + items: + $ref: '#/components/schemas/DRStatusItem' + type: object + example: + status: + - domain: yourOktaDomain.okta.com + isFailedOver: true + headers: + Link: + description: A link to the next page of responses + schema: + type: string + parameters: + domain: + name: domain + in: path + description: The Okta domain name of your org or one of your custom domains + required: true + schema: + type: string + examples: + ErrorApiValidationFailed: + summary: API Validation Failed + value: + errorCode: E0000001 + errorSummary: 'Api validation failed: {0}' + errorLink: E0000001 + errorId: sampleiCF-8D5rLW6myqiPItW + errorCauses: [] + ErrorInvalidTokenProvided: + summary: Invalid Token Provided + value: + errorCode: E0000011 + errorSummary: Invalid token provided + errorLink: E0000011 + errorId: sampleQPivGUj_ND5v78vbYWW + errorCauses: [] + ErrorAccessDenied: + summary: Access Denied + value: + errorCode: E0000006 + errorSummary: You do not have permission to perform the requested action + errorLink: E0000006 + errorId: sampleNUSD_8fdkFd8fs8SDBK + errorCauses: [] + ErrorTooManyRequests: + summary: Too Many Requests + value: + errorCode: E0000047 + errorSummary: API call exceeded rate limit due to too many requests. + errorLink: E0000047 + errorId: sampleQPivGUj_ND5v78vbYWW + errorCauses: [] + ErrorInternalServer: + summary: Internal Server Error + value: + errorCode: E0000009 + errorSummary: Internal Server Error + errorLink: E0000000 + errorId: sampleAlJ82XS2SDB_vaNIWgcA + errorCauses: [] + x-stackQL-resources: + dr_operations: + id: okta.dr.dr_operations + name: dr_operations + title: Dr Operations + methods: + start_org_failback: + config: + requestBodyTranslate: + algorithm: naive + operation: + $ref: '#/paths/~1api~1v1~1dr~1failback/post' + response: + mediaType: application/json + openAPIDocKey: '200' + start_org_failover: + config: + requestBodyTranslate: + algorithm: naive + operation: + $ref: '#/paths/~1api~1v1~1dr~1failover/post' + response: + mediaType: application/json + openAPIDocKey: '200' + sqlVerbs: + select: [] + insert: [] + update: [] + delete: [] + replace: [] + dr_status: + id: okta.dr.dr_status + name: dr_status + title: Dr Status + methods: + get_drstatus: + operation: + $ref: '#/paths/~1api~1v1~1dr~1status/get' + response: + mediaType: application/json + openAPIDocKey: '200' + objectKey: $.status + get_drstatus_for_domain: + operation: + $ref: '#/paths/~1api~1v1~1dr~1status~1{domain}/get' + response: + mediaType: application/json + openAPIDocKey: '200' + objectKey: $.status + sqlVerbs: + select: + - $ref: >- + #/components/x-stackQL-resources/dr_status/methods/get_drstatus_for_domain + - $ref: '#/components/x-stackQL-resources/dr_status/methods/get_drstatus' + insert: [] + update: [] + delete: [] + replace: [] +servers: + - url: https://{subdomain}.okta.com/ + variables: + subdomain: + default: my-org +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/email_domains.yaml b/providers/src/okta/v00.00.00000/services/email_domains.yaml index e07034d7..d5d70c69 100644 --- a/providers/src/okta/v00.00.00000/services/email_domains.yaml +++ b/providers/src/okta/v00.00.00000/services/email_domains.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: email_domains API description: okta email_domains API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/email-domains: get: @@ -15,9 +15,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/EmailDomainResponseWithEmbedded' + $ref: '#/components/schemas/ListEmailDomainsResponse' examples: List email domain response: $ref: '#/components/examples/EmailDomainResponse' @@ -34,6 +32,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/queryExpandEmailDomain' post: summary: Create an email domain description: Creates an Email Domain in your org @@ -84,8 +84,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/queryExpandEmailDomain' + parameters: + - $ref: '#/components/parameters/queryExpandEmailDomain' /api/v1/email-domains/{emailDomainId}: get: summary: Retrieve an email domain @@ -116,6 +116,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathEmailDomainId' + - $ref: '#/components/parameters/queryExpandEmailDomain' put: summary: Replace an email domain description: Replaces associated username and sender display name by `emailDomainId` @@ -157,6 +160,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathEmailDomainId' + - $ref: '#/components/parameters/queryExpandEmailDomain' delete: summary: Delete an email domain description: Deletes an Email Domain by `emailDomainId` @@ -191,9 +197,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathEmailDomainId' - - $ref: '#/components/parameters/queryExpandEmailDomain' + parameters: + - $ref: '#/components/parameters/pathEmailDomainId' + - $ref: '#/components/parameters/queryExpandEmailDomain' /api/v1/email-domains/{emailDomainId}/verify: post: summary: Verify an email domain @@ -235,13 +241,12 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathEmailDomainId' + parameters: + - $ref: '#/components/parameters/pathEmailDomainId' components: schemas: EmailDomainResponseWithEmbedded: - allOf: - - $ref: '#/components/schemas/EmailDomainResponse' + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: _embedded: @@ -252,9 +257,29 @@ components: items: $ref: '#/components/schemas/Brand' readOnly: true + dnsValidationRecords: + type: array + items: + $ref: '#/components/schemas/EmailDomainDNSRecord' + domain: + type: string + id: + type: string + validationStatus: + $ref: '#/components/schemas/EmailDomainStatus' + validationSubdomain: + type: string + description: The subdomain for the email sender's custom mail domain + default: mail + displayName: + type: string + userName: + type: string + required: + - displayName + - userName EmailDomain: - allOf: - - $ref: '#/components/schemas/BaseEmailDomain' + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: brandId: @@ -267,12 +292,17 @@ components: Subdomain for the email sender's custom mail domain. Specify your subdomain when you configure a custom mail domain. default: mail + displayName: + type: string + userName: + type: string required: - domain - brandId + - displayName + - userName EmailDomainResponse: - allOf: - - $ref: '#/components/schemas/BaseEmailDomain' + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: dnsValidationRecords: @@ -289,6 +319,13 @@ components: type: string description: The subdomain for the email sender's custom mail domain default: mail + displayName: + type: string + userName: + type: string + required: + - displayName + - userName Error: title: Error type: object @@ -315,8 +352,16 @@ components: contains dynamically-generated information about your specific error. UpdateEmailDomain: - allOf: - - $ref: '#/components/schemas/BaseEmailDomain' + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + displayName: + type: string + userName: + type: string + required: + - displayName + - userName Brand: type: object properties: @@ -374,6 +419,7 @@ components: verificationValue: type: string EmailDomainStatus: + x-okta-ignore-redocly-rules-for-sdk: true type: string enum: - DELETED @@ -408,6 +454,13 @@ components: enum: - CNAME - TXT + ListEmailDomainsResponse: + type: object + properties: + email_domains: + type: array + items: + $ref: '#/components/schemas/EmailDomainResponseWithEmbedded' responses: ErrorAccessDenied403: description: Forbidden @@ -613,7 +666,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.email_domains + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListEmailDomainsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"email_domains\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_email_domain: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1email-domains/post' response: @@ -626,6 +691,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_email_domain: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1email-domains~1{emailDomainId}/put' response: @@ -635,7 +703,7 @@ components: operation: $ref: '#/paths/~1api~1v1~1email-domains~1{emailDomainId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' verify_email_domain: operation: @@ -645,10 +713,10 @@ components: openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/email_domains/methods/list_email_domains - $ref: >- #/components/x-stackQL-resources/email_domains/methods/get_email_domain + - $ref: >- + #/components/x-stackQL-resources/email_domains/methods/list_email_domains insert: - $ref: >- #/components/x-stackQL-resources/email_domains/methods/create_email_domain @@ -664,7 +732,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/email_servers.yaml b/providers/src/okta/v00.00.00000/services/email_servers.yaml index 9a8402ce..0cadd9f7 100644 --- a/providers/src/okta/v00.00.00000/services/email_servers.yaml +++ b/providers/src/okta/v00.00.00000/services/email_servers.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: email_servers API description: okta email_servers API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/email-servers: get: @@ -16,6 +16,13 @@ paths: application/json: schema: $ref: '#/components/schemas/EmailServerListResponse' + examples: + BasicSMTP: + $ref: '#/components/examples/ListBasicSMTPServer' + OAuthClientCredentials: + $ref: '#/components/examples/ListOAuthClientCredentialsServer' + OAuthJWT: + $ref: '#/components/examples/ListOAuthJWTServer' '403': $ref: '#/components/responses/ErrorAccessDenied403' '429': @@ -33,20 +40,40 @@ paths: - Okta Identity Engine post: summary: Create a custom SMTP server - description: Creates a custom email SMTP server configuration for your org + description: >- + Creates a custom email SMTP server configuration for your org. + + + For more information about configuring the OAuth 2.0 authentication + methods, see [Custom email providers with OAuth + 2.0](https://developer.okta.com/docs/guides/custom-smtp/main/). operationId: createEmailServer requestBody: content: application/json: schema: - $ref: '#/components/schemas/EmailServerPost' + $ref: '#/components/schemas/BaseEmailServerCreate' + examples: + BasicSMTP: + $ref: '#/components/examples/BasicSMTPRequest' + OAuthClientCredentials: + $ref: '#/components/examples/OAuthClientCredentialsRequest' + OAuthJWT: + $ref: '#/components/examples/OAuthJWTRequest' responses: '201': description: Successfully enrolled server credentials content: application/json: schema: - $ref: '#/components/schemas/EmailServerResponse' + $ref: '#/components/schemas/BaseEmailServer' + examples: + BasicSMTP: + $ref: '#/components/examples/BasicSMTPResponse' + OAuthClientCredentials: + $ref: '#/components/examples/OAuthClientCredentialsResponse' + OAuthJWT: + $ref: '#/components/examples/OAuthJWTResponse' '400': $ref: '#/components/responses/ErrorApiValidationFailed400' '403': @@ -75,7 +102,14 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/EmailServerListResponse' + $ref: '#/components/schemas/BaseEmailServer' + examples: + SMTPServerResponse: + $ref: '#/components/examples/BasicSMTPResponse' + OAuthClientCredentialsResponse: + $ref: '#/components/examples/OAuthClientCredentialsResponse' + OAuthJWTResponse: + $ref: '#/components/examples/OAuthJWTResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -93,22 +127,45 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine + parameters: + - $ref: '#/components/parameters/pathEmailServerId' patch: summary: Update an SMTP server configuration - description: Updates the specified custom SMTP server configuration + description: >- + Updates the specified custom SMTP server configuration + + + > **Note:** When you update an SMTP server configuration that uses OAuth + 2.0 authentication, the + [`authType`](#components/schemas/BaseEmailServer/properties/authType) + property is required in the request body. operationId: updateEmailServer requestBody: content: application/json: schema: - $ref: '#/components/schemas/EmailServerRequest' + $ref: '#/components/schemas/BaseEmailServer' + examples: + BasicSMTP: + $ref: '#/components/examples/BasicSMTPPatchRequest' + OAuthClientCredentials: + $ref: '#/components/examples/OAuthClientCredentialsPatchRequest' + OAuthJWT: + $ref: '#/components/examples/OAuthJWTPatchRequest' responses: '200': description: OK content: application/json: schema: - $ref: '#/components/schemas/EmailServerResponse' + $ref: '#/components/schemas/BaseEmailServer' + examples: + BasicSMTP: + $ref: '#/components/examples/BasicSMTPPatchResponse' + OAuthClientCredentials: + $ref: '#/components/examples/OAuthClientCredentialsPatchResponse' + OAuthJWT: + $ref: '#/components/examples/OAuthJWTPatchResponse' '400': $ref: '#/components/responses/ErrorApiValidationFailed400' '403': @@ -128,6 +185,8 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine + parameters: + - $ref: '#/components/parameters/pathEmailServerId' delete: summary: Delete an SMTP server configuration description: Deletes the specified custom SMTP server configuration @@ -152,12 +211,12 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathEmailServerId' + parameters: + - $ref: '#/components/parameters/pathEmailServerId' /api/v1/email-servers/{emailServerId}/test: post: summary: Test an SMTP server configuration - description: Tests the specified custom SMTP Server configuration + description: Tests the specified custom SMTP server configuration operationId: testEmailServer requestBody: content: @@ -186,8 +245,8 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathEmailServerId' + parameters: + - $ref: '#/components/parameters/pathEmailServerId' components: schemas: EmailServerListResponse: @@ -195,47 +254,100 @@ components: properties: email-servers: type: array + description: List of enrolled SMTP servers items: - $ref: '#/components/schemas/EmailServerResponse' - EmailServerPost: - allOf: - - $ref: '#/components/schemas/EmailServerRequest' - - required: - - host - - port - - username - - password - - alias - EmailServerResponse: - allOf: - - $ref: '#/components/schemas/BaseEmailServer' - - properties: - id: - type: string - description: ID of your SMTP server - type: object - EmailServerRequest: - allOf: - - $ref: '#/components/schemas/BaseEmailServer' - - properties: - password: - type: string - description: Password used to access your SMTP server - type: object + $ref: '#/components/schemas/BaseEmailServer' + BaseEmailServerCreate: + type: object + properties: + alias: + type: string + description: Human-readable name for your SMTP server + example: CustomServer1 + authType: + $ref: '#/components/schemas/SmtpAuthType' + enabled: + type: boolean + description: If `true`, all email traffic is routed through your SMTP server + host: + type: string + description: Hostname or IP address of your SMTP server + example: 192.168.160.1 + id: + type: string + description: ID of your SMTP server + readOnly: true + port: + type: integer + description: Port number of your SMTP server + example: 587 + username: + type: string + description: Username that's used to access your SMTP server + example: some_user@domain.com + required: + - alias + - enabled + - host + - port + - username + - authType + discriminator: + propertyName: authType + mapping: + BASIC_SMTP_AUTH: '#/components/schemas/BASIC_SMTP_AUTH_CREATE' + OAUTH2_CLIENT_CREDENTIALS: '#/components/schemas/OAUTH2_CLIENT_CREDENTIALS_CREATE' + OAUTH2_JWT_BEARER_GRANT: '#/components/schemas/OAUTH2_JWT_BEARER_GRANT_CREATE' + BaseEmailServer: + type: object + properties: + alias: + type: string + description: Human-readable name for your SMTP server + example: CustomServer1 + authType: + $ref: '#/components/schemas/SmtpAuthType' + enabled: + type: boolean + description: If `true`, all email traffic is routed through your SMTP server + host: + type: string + description: Hostname or IP address of your SMTP server + example: 192.168.160.1 + id: + type: string + description: ID of your SMTP server + readOnly: true + port: + type: integer + description: Port number of your SMTP server + example: 587 + username: + type: string + description: Username that's used to access your SMTP server + example: some_user@domain.com + required: + - authType + discriminator: + propertyName: authType + mapping: + BASIC_SMTP_AUTH: '#/components/schemas/BASIC_SMTP_AUTH' + OAUTH2_CLIENT_CREDENTIALS: '#/components/schemas/OAUTH2_CLIENT_CREDENTIALS' + OAUTH2_JWT_BEARER_GRANT: '#/components/schemas/OAUTH2_JWT_BEARER_GRANT' EmailTestAddresses: type: object properties: - from: + fromAddress: type: string description: Email address that sends test emails example: sender@host.com - to: + toAddress: type: string description: Email address that receives test emails example: receiver@host.com required: - - from - - to + - fromAddress + - toAddress Error: title: Error type: object @@ -261,28 +373,32 @@ components: A short description of what caused this error. Sometimes this contains dynamically-generated information about your specific error. - BaseEmailServer: - type: object - properties: - alias: - type: string - description: Human-readable name for your SMTP server - example: CustomServer1 - enabled: - type: boolean - description: If `true`, routes all email traffic through your SMTP server - host: - type: string - description: Hostname or IP address of your SMTP server - example: 192.168.160.1 - port: - type: integer - description: Port number of your SMTP server - example: 587 - username: - type: string - description: Username used to access your SMTP server - example: aUser + SmtpAuthType: + description: >- + + The + authentication type that's used by your SMTP server + x-okta-lifecycle: + lifecycle: EA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + type: string + enum: + - BASIC_SMTP_AUTH + - OAUTH2_CLIENT_CREDENTIALS + - OAUTH2_JWT_BEARER_GRANT + x-enumDescriptions: + BASIC_SMTP_AUTH: >- + Basic SMTP authentication uses a username and password to authenticate + with your SMTP server + OAUTH2_CLIENT_CREDENTIALS: >- + OAuth 2.0 client credentials requires you to create an OAuth 2.0 app + with your email provider to obtain a client ID and client secret + OAUTH2_JWT_BEARER_GRANT: >- + OAuth 2.0 JWT bearer token requires you to create an OAuth 2.0 app + with your email provider and use a signed JWT to obtain an access + token ErrorCause: type: object properties: @@ -332,8 +448,256 @@ components: required: true schema: type: string - description: ID of your SMTP Server configuration + description: ID of your SMTP server configuration examples: + ListBasicSMTPServer: + summary: List containing basic authentication SMTP server + value: + email-servers: + - id: ces7n3u7sSohfoaou0g1 + alias: CustomServer1 + enabled: true + authType: BASIC_SMTP_AUTH + host: smtp.example.com + port: 587 + username: user@example.com + ListOAuthClientCredentialsServer: + summary: List containing OAuth 2.0 client credentials SMTP server + x-okta-lifecycle: + lifecycle: EA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + value: + email-servers: + - id: ces7n3u7sSohfoaou0g2 + alias: OAuthServer1 + enabled: true + authType: OAUTH2_CLIENT_CREDENTIALS + host: smtp.oauth.com + port: 587 + username: user@oauth.com + clientId: oauth-client-id + tokenEndpoint: https://oauth.example.com/token + tokenEndpointAuthMethod: CLIENT_SECRET_BASIC + scopes: + - send_email + ListOAuthJWTServer: + summary: List containing OAuth 2.0 JWT bearer grant SMTP server + x-okta-lifecycle: + lifecycle: EA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + value: + email-servers: + - id: ces7n3u7sSohfoaou0g3 + alias: OAuthServer2 + enabled: true + authType: OAUTH2_JWT_BEARER_GRANT + host: smtp.oauth.com + port: 587 + username: user@oauth.com + clientId: oauth-client-id + tokenEndpoint: https://oauth.example.com/token + signingAlgorithm: RS256 + issuer: https://oauth.example.com + subject: user@oauth.com + audience: https://smtp.oauth.com + scopes: + - org.email.send + BasicSMTPRequest: + summary: Create basic authentication SMTP server + value: + alias: CustomServer1 + enabled: true + authType: BASIC_SMTP_AUTH + host: smtp.example.com + port: 587 + username: user@example.com + password: securepassword + OAuthClientCredentialsRequest: + summary: Create OAuth client credentials server + x-okta-lifecycle: + lifecycle: EA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + value: + alias: OAuthServer1 + enabled: false + authType: OAUTH2_CLIENT_CREDENTIALS + host: smtp.oauth.com + port: 587 + username: user@oauth.com + clientId: oauth-client-id + clientSecret: oauth-client-secret + tokenEndpoint: https://oauth.example.com/token + tokenEndpointAuthMethod: CLIENT_SECRET_BASIC + scopes: + - send_email + OAuthJWTRequest: + summary: Create OAuth 2.0 JWT bearer grant server + x-okta-lifecycle: + lifecycle: EA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + value: + alias: OAuthServer2 + enabled: false + authType: OAUTH2_JWT_BEARER_GRANT + host: smtp.oauth.com + port: 587 + username: user@oauth.com + clientId: oauth-client-id + tokenEndpoint: https://oauth.example.com/token + signingAlgorithm: RS256 + keyId: oauth-key-id + issuer: https://oauth.example.com + subject: user@oauth.com + audience: https://smtp.oauth.com + scopes: + - org.email.send + privateKey: | + -----BEGIN PRIVATE KEY----- + ... + -----END PRIVATE KEY----- + BasicSMTPResponse: + summary: Basic authentication SMTP server response + value: + id: ces7n3u7sSohfoaou0g1 + alias: CustomServer1 + enabled: true + authType: BASIC_SMTP_AUTH + host: smtp.example.com + port: 587 + username: user@example.com + OAuthClientCredentialsResponse: + summary: OAuth 2.0 client credentials server response + x-okta-lifecycle: + lifecycle: EA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + value: + id: ces7n3u7sSohfoaou0g2 + alias: OAuthServer1 + enabled: false + authType: OAUTH2_CLIENT_CREDENTIALS + host: smtp.oauth.com + port: 587 + username: user@oauth.com + clientId: oauth-client-id + tokenEndpoint: https://oauth.example.com/token + tokenEndpointAuthMethod: CLIENT_SECRET_BASIC + scopes: + - send_email + OAuthJWTResponse: + summary: OAuth 2.0 JWT bearer grant server response + x-okta-lifecycle: + lifecycle: EA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + value: + id: ces7n3u7sSohfoaou0g3 + alias: OAuthServer2 + enabled: false + authType: OAUTH2_JWT_BEARER_GRANT + host: smtp.oauth.com + port: 587 + username: user@oauth.com + clientId: oauth-client-id + signingAlgorithm: RS256 + issuer: https://oauth.example.com + subject: user@oauth.com + audience: https://smtp.oauth.com + scopes: + - org.email.send + BasicSMTPPatchRequest: + summary: Update basic SMTP server + value: + alias: CustomServer1 New Alias + password: New password + OAuthClientCredentialsPatchRequest: + summary: Update OAuth 2.0 client credentials server + x-okta-lifecycle: + lifecycle: EA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + value: + alias: OAuthServer1 New Alias + authType: OAUTH2_CLIENT_CREDENTIALS + clientSecret: New client secret + OAuthJWTPatchRequest: + summary: Update OAuth 2.0 JWT bearer grant server + x-okta-lifecycle: + lifecycle: EA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + value: + alias: OAuthServer2 New Alias + authType: OAUTH2_JWT_BEARER_GRANT + keyId: New keyId + privateKey: | + -----BEGIN PRIVATE KEY----- + ... New Private Key Contents ... + -----END PRIVATE KEY----- + BasicSMTPPatchResponse: + summary: Basic authentication SMTP server patch response + value: + id: ces7n3u7sSohfoaou0g1 + alias: CustomServer1 New Alias + enabled: true + authType: BASIC_SMTP_AUTH + host: smtp.example.com + port: 587 + username: user@example.com + OAuthClientCredentialsPatchResponse: + summary: OAuth 2.0 client credentials server patch response + x-okta-lifecycle: + lifecycle: EA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + value: + id: ces7n3u7sSohfoaou0g2 + alias: OAuthServer1 New Alias + enabled: false + authType: OAUTH2_CLIENT_CREDENTIALS + host: smtp.oauth.com + port: 587 + username: user@oauth.com + clientId: oauth-client-id + tokenEndpoint: https://oauth.example.com/token + tokenEndpointAuthMethod: CLIENT_SECRET_BASIC + scopes: + - send_email + OAuthJWTPatchResponse: + summary: OAuth 2.0 JWT bearer grant server patch response + x-okta-lifecycle: + lifecycle: EA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + value: + id: ces7n3u7sSohfoaou0g3 + alias: OAuthServer2 New Alias + enabled: false + authType: OAUTH2_JWT_BEARER_GRANT + host: smtp.oauth.com + port: 587 + username: user@oauth.com + clientId: oauth-client-id + signingAlgorithm: RS256 + issuer: https://oauth.example.com + subject: user@oauth.com + audience: https://smtp.oauth.com + scopes: + - org.email.send ErrorAccessDenied: summary: Access Denied value: @@ -379,6 +743,9 @@ components: mediaType: application/json openAPIDocKey: '200' create_email_server: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1email-servers/post' response: @@ -391,6 +758,9 @@ components: mediaType: application/json openAPIDocKey: '200' update_email_server: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1email-servers~1{emailServerId}/patch' response: @@ -400,20 +770,23 @@ components: operation: $ref: '#/paths/~1api~1v1~1email-servers~1{emailServerId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' test_email_server: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1email-servers~1{emailServerId}~1test/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/email_servers/methods/list_email_servers - $ref: >- #/components/x-stackQL-resources/email_servers/methods/get_email_server + - $ref: >- + #/components/x-stackQL-resources/email_servers/methods/list_email_servers insert: - $ref: >- #/components/x-stackQL-resources/email_servers/methods/create_email_server @@ -429,7 +802,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/eventhooks.yaml b/providers/src/okta/v00.00.00000/services/eventhooks.yaml index f459fdd5..344f146f 100644 --- a/providers/src/okta/v00.00.00000/services/eventhooks.yaml +++ b/providers/src/okta/v00.00.00000/services/eventhooks.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: eventhooks API description: okta eventhooks API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/eventHooks: get: @@ -15,9 +15,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/EventHook' + $ref: '#/components/schemas/ListEventHooksResponse' examples: RetrieveAllEventHooks: $ref: '#/components/examples/RetrieveAllEventHooks' @@ -124,6 +122,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathEventHookId' put: summary: Replace an event hook description: >- @@ -174,6 +174,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathEventHookId' delete: summary: Delete an event hook description: >- @@ -202,8 +204,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathEventHookId' + parameters: + - $ref: '#/components/parameters/pathEventHookId' /api/v1/eventHooks/{eventHookId}/lifecycle/activate: post: summary: Activate an event hook @@ -234,8 +236,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathEventHookId' + parameters: + - $ref: '#/components/parameters/pathEventHookId' /api/v1/eventHooks/{eventHookId}/lifecycle/deactivate: post: summary: Deactivate an event hook @@ -266,8 +268,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathEventHookId' + parameters: + - $ref: '#/components/parameters/pathEventHookId' /api/v1/eventHooks/{eventHookId}/lifecycle/verify: post: summary: Verify an event hook @@ -314,11 +316,12 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathEventHookId' + parameters: + - $ref: '#/components/parameters/pathEventHookId' components: schemas: EventHook: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: channel: @@ -360,14 +363,22 @@ components: verificationStatus: $ref: '#/components/schemas/EventHookVerificationStatus' _links: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - properties: - deactivate: - $ref: '#/components/schemas/HrefObject' - verify: - $ref: '#/components/schemas/HrefObject' - type: object + description: >- + Specifies link relations (see [Web + Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using + the [JSON Hypertext Application + Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) + specification. This object is used for dynamic discovery of related + resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + deactivate: + $ref: '#/components/schemas/HrefObject' + verify: + $ref: '#/components/schemas/HrefObject' + readOnly: true required: - name - events @@ -382,7 +393,7 @@ components: version: description: >- Version of the channel. Currently the only supported version is - `1.0.0``. + `1.0.0`. type: string required: - type @@ -423,6 +434,7 @@ components: $ref: '#/components/schemas/HrefObjectSelfLink' readOnly: true HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object additionalProperties: true type: object @@ -550,9 +562,36 @@ components: enum: - EVENT_TYPE HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) HrefHints: description: Describes allowed HTTP verbs for the `href` type: object @@ -639,6 +678,13 @@ components: nullable: true description: Internal field readOnly: true + ListEventHooksResponse: + type: object + properties: + event_hooks: + type: array + items: + $ref: '#/components/schemas/EventHook' responses: ErrorAccessDenied403: description: Forbidden @@ -1024,7 +1070,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.event_hooks + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListEventHooksResponse' + transform: + body: |- + {{- $wrapped := printf "{\"event_hooks\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_event_hook: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1eventHooks/post' response: @@ -1037,6 +1095,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_event_hook: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1eventHooks~1{eventHookId}/put' response: @@ -1046,7 +1107,7 @@ components: operation: $ref: '#/paths/~1api~1v1~1eventHooks~1{eventHookId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' activate_event_hook: operation: @@ -1071,10 +1132,10 @@ components: openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/event_hooks/methods/list_event_hooks - $ref: >- #/components/x-stackQL-resources/event_hooks/methods/get_event_hook + - $ref: >- + #/components/x-stackQL-resources/event_hooks/methods/list_event_hooks insert: - $ref: >- #/components/x-stackQL-resources/event_hooks/methods/create_event_hook @@ -1090,7 +1151,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/features.yaml b/providers/src/okta/v00.00.00000/services/features.yaml index bbc810f2..bc6dc5ff 100644 --- a/providers/src/okta/v00.00.00000/services/features.yaml +++ b/providers/src/okta/v00.00.00000/services/features.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: features API description: okta features API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/features: get: @@ -15,9 +15,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/Feature' + $ref: '#/components/schemas/ListFeaturesResponse' examples: FeaturesList: summary: List all self-service features for your org @@ -66,8 +64,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathFeatureId' + parameters: + - $ref: '#/components/parameters/pathFeatureId' /api/v1/features/{featureId}/dependencies: get: summary: List all dependencies @@ -84,9 +82,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/Feature' + $ref: '#/components/schemas/ListFeatureDependenciesResponse' examples: FeaturesDependenciesList: summary: List all dependencies @@ -106,8 +102,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathFeatureId' + parameters: + - $ref: '#/components/parameters/pathFeatureId' /api/v1/features/{featureId}/dependents: get: summary: List all dependents @@ -124,9 +120,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/Feature' + $ref: '#/components/schemas/ListFeatureDependentsResponse' examples: FeaturesDependentsList: summary: List all feature dependents for the specified feature @@ -146,8 +140,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathFeatureId' + parameters: + - $ref: '#/components/parameters/pathFeatureId' /api/v1/features/{featureId}/{lifecycle}: post: summary: Update a feature lifecycle @@ -178,9 +172,9 @@ paths: The following chart shows the different state transitions for a feature. - ![State transitions of a - feature](/img/update-ssfeat-flowchart.png - '#width=500px;') + Example operationId: updateFeatureLifecycle parameters: - name: mode @@ -190,6 +184,8 @@ paths: Supported value is `force`. schema: type: string + - $ref: '#/components/parameters/pathFeatureId' + - $ref: '#/components/parameters/pathLifecycle' responses: '200': description: Success @@ -216,12 +212,10 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathFeatureId' - - $ref: '#/components/parameters/pathLifecycle' components: schemas: Feature: + x-okta-ignore-redocly-rules-for-sdk: true description: Specifies feature release cycle information type: object properties: @@ -242,28 +236,36 @@ components: type: $ref: '#/components/schemas/FeatureType' _links: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - properties: - dependents: - description: Link to feature dependents - type: object - readOnly: true - properties: - href: - description: Link URI - type: string - readOnly: true - dependencies: - description: Link to feature dependencies - type: object + description: >- + Specifies link relations (see [Web + Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using + the [JSON Hypertext Application + Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) + specification. This object is used for dynamic discovery of related + resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + dependents: + description: Link to feature dependents + type: object + readOnly: true + properties: + href: + description: Link URI + type: string readOnly: true - properties: - href: - description: Link URI - type: string - readOnly: true + dependencies: + description: Link to feature dependencies type: object + readOnly: true + properties: + href: + description: Link URI + type: string + readOnly: true + readOnly: true FeatureStage: description: >- Current release cycle stage of a feature @@ -351,15 +353,43 @@ components: - BETA - EA HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) ErrorCause: type: object properties: errorSummary: type: string HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object additionalProperties: true type: object @@ -403,6 +433,27 @@ components: - GET - POST - PUT + ListFeaturesResponse: + type: object + properties: + features: + type: array + items: + $ref: '#/components/schemas/Feature' + ListFeatureDependenciesResponse: + type: object + properties: + feature_dependencies: + type: array + items: + $ref: '#/components/schemas/Feature' + ListFeatureDependentsResponse: + type: object + properties: + feature_dependents: + type: array + items: + $ref: '#/components/schemas/Feature' responses: ErrorAccessDenied403: description: Forbidden @@ -599,6 +650,15 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.features + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListFeaturesResponse' + transform: + body: |- + {{- $wrapped := printf "{\"features\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 get_feature: operation: $ref: '#/paths/~1api~1v1~1features~1{featureId}/get' @@ -613,8 +673,8 @@ components: openAPIDocKey: '200' sqlVerbs: select: - - $ref: '#/components/x-stackQL-resources/features/methods/list_features' - $ref: '#/components/x-stackQL-resources/features/methods/get_feature' + - $ref: '#/components/x-stackQL-resources/features/methods/list_features' insert: [] update: [] delete: [] @@ -630,6 +690,15 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.feature_dependencies + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListFeatureDependenciesResponse' + transform: + body: |- + {{- $wrapped := printf "{\"feature_dependencies\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 sqlVerbs: select: - $ref: >- @@ -649,6 +718,15 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.feature_dependents + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListFeatureDependentsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"feature_dependents\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 sqlVerbs: select: - $ref: >- @@ -662,7 +740,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/first_party_app_settings.yaml b/providers/src/okta/v00.00.00000/services/first_party_app_settings.yaml index fdd530e9..495f1873 100644 --- a/providers/src/okta/v00.00.00000/services/first_party_app_settings.yaml +++ b/providers/src/okta/v00.00.00000/services/first_party_app_settings.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: first_party_app_settings API description: okta first_party_app_settings API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/first-party-app-settings/{appName}: get: @@ -34,6 +34,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathFirstPartyAppName' put: summary: Replace the Okta application settings description: >- @@ -81,8 +83,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathFirstPartyAppName' + parameters: + - $ref: '#/components/parameters/pathFirstPartyAppName' components: schemas: AdminConsoleSettings: @@ -219,6 +221,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_first_party_app_settings: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1first-party-app-settings~1{appName}/put' response: @@ -239,7 +244,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/groups.yaml b/providers/src/okta/v00.00.00000/services/groups.yaml index a66eb4c3..24ecc0d9 100644 --- a/providers/src/okta/v00.00.00000/services/groups.yaml +++ b/providers/src/okta/v00.00.00000/services/groups.yaml @@ -2,238 +2,153 @@ openapi: 3.0.3 info: title: groups API description: okta groups API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/groups: get: summary: List all groups - description: >- + description: |- Lists all groups with pagination support. + > **Note:** To list all groups belonging to a member, use the [List all groups endpoint in the User Resources API](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/userresources/other/listusergroups). - > **Note:** To list all groups belonging to a member, use the [List all - groups endpoint in the User Resources - API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserResources/#tag/UserResources/operation/listUserGroups). - - - The number of groups returned depends on the specified - [`limit`](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Group/#tag/Group/operation/listGroups!in=query&path=limit&t=request), - if you have a search, filter, and/or query parameter set, and if that - parameter is not null. We recommend using a limit less than or equal to - 200. - + The number of groups returned depends on the specified [`limit`](https://developer.okta.com/docs/api/openapi/okta-management/management/group/listgroups#group/listgroups/t=request&in=query&path=limit), if you have a search, filter, and/or query parameter set, and if that parameter is not null. We recommend using a limit less than or equal to 200. - A subset of groups can be returned that match a supported filter - expression, query, or search criteria. + A subset of groups can be returned that match a supported filter expression, query, or search criteria. - - > **Note:** Results from the filter or query parameter are driven from - an eventually consistent datasource. The synchronization lag is - typically less than one second. + > **Note:** The `search` parameter results are sourced from an eventually consistent datasource and may not reflect the latest information. operationId: listGroups parameters: - name: search in: query - description: >- - Searches for groups with a supported - [filtering](https://developer.okta.com/docs/api/#filter) expression - for all properties except for `_embedded`, `_links`, and - `objectClass`. This operation supports - [pagination](https://developer.okta.com/docs/api/#pagination). - + description: |- + Searches for groups with a supported [filtering](https://developer.okta.com/docs/api/#filter) expression for all properties except for `_embedded`, `_links`, and `objectClass`. Okta recommends this query parameter because it provides the largest range of search options and optimal performance. - Using search requires [URL - encoding](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding), - for example, `search=type eq "OKTA_GROUP"` is encoded as - `search=type+eq+%22OKTA_GROUP%22`. + This operation supports [pagination](https://developer.okta.com/docs/api/#pagination). + The `search` string requires [URL encoding](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding). For example, `search=type eq "OKTA_GROUP"` is encoded as `search=type+eq+%22OKTA_GROUP%22`. This operation searches many properties: - - * Any group profile attribute, including imported app group profile - attributes. - - * The top-level properties: `id`, `created`, - `lastMembershipUpdated`, `lastUpdated`, and `type`. - - * The - [source](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Group/#tag/Group/operation/listGroups!c=200&path=_links/source&t=response) - of groups with type of `APP_GROUP`, accessed as `source.id`. - + * Any group profile attribute, including imported app group profile attributes. + * The top-level properties: `id`, `created`, `lastMembershipUpdated`, `lastUpdated`, and `type`. + * The [source](https://developer.okta.com/docs/api/openapi/okta-management/management/group/listgroups#group/listgroups/t=response&c=200&path=_links/source) of groups with type of `APP_GROUP`, accessed as `source.id`. You can also use the `sortBy` and `sortOrder` parameters. - - Searches for groups can be filtered by the following operators: - `sw`, `eq`, and `co`. You can only use `co` with these select - profile attributes: `profile.name` and `profile.description`. See - [Operators](https://developer.okta.com/docs/api/#operators). + Searches for groups can be filtered by the following operators: `sw`, `eq`, and `co`. You can only use `co` with these select profile attributes: `profile.name` and `profile.description`. See [Operators](https://developer.okta.com/docs/api/#operators). schema: type: string examples: searchByType: - value: type%20eq%20%22APP_GROUP%22 + value: type eq "APP_GROUP" summary: Search by type description: Search for groups that have a type of APP_GROUP searchByLastMembershipUpdatedAfterDate: - value: lastMembershipUpdated%20gt%20%222014-01-01T00%3A00%3A00.000Z%22 + value: lastMembershipUpdated gt "2024-01-01T00:00:00.000Z" summary: Search by last updated membership timestamp - description: >- - Search for groups whose memberships were last updated after - 01/01/2024 + description: Search for groups whose memberships were last updated after 01/01/2024 searchById: - value: id%20eq%20%2200gak46y5hydV6NdM0g4%22 + value: id eq "00gak46y5hydV6NdM0g4" summary: Search by ID description: Search for groups with the specified ID (00gak46y5hydV6NdM0g4) searchByProfileName: - value: profile.name%20eq%20%22West%20Coast%20users%22 + value: profile.name eq "West Coast users" summary: Search by name - description: >- - Search for groups that have a group profile name of West Coast - users + description: Search for groups that have a group profile name of West Coast users searchBySamAccountName: - value: profile.samAccountName%20sw%20%22West%20Coast%22 + value: profile.samAccountName sw "West Coast" summary: Search using an operator - description: >- - Search for groups whose samAccountName profile attribute starts - with "West Coast" + description: Search for groups whose samAccountName profile attribute starts with "West Coast" searchBySourceId: - value: source.id%20eq%20%220oa2v0el0gP90aqjJ0g7%22 + value: source.id eq "0oa2v0el0gP90aqjJ0g7" summary: Search by source ID - description: >- - Search for groups that have the source app with the specified - source ID (0oa2v0el0gP90aqjJ0g7) + description: Search for groups that have the source app with the specified source ID (0oa2v0el0gP90aqjJ0g7) searchByIdTypeAndCreationDate: - value: >- - type%20eq%20%22APP_GROUP%22%20and%20%28created%20lt%20%222014-01-01T00%3A00%3A00.000Z%22%20and%20source.id%20eq%20%220oa2v0el0gP90aqjJ0g7%22%29 + value: type eq "APP_GROUP" and (created lt "2014-01-01T00:00:00.000Z" and source.id eq "0oa2v0el0gP90aqjJ0g7") summary: Search with multiple criteria - description: >- - List groups of type APP_GROUP that were created before - 01/01/2014 and whose source app has the ID 0oa2v0el0gP90aqjJ0g7 + description: List groups of type APP_GROUP that were created before 01/01/2014 and whose source app has the ID 0oa2v0el0gP90aqjJ0g7 - name: filter in: query - description: >- - Filter expression for groups. See - [Filter](https://developer.okta.com/docs/api/#filter). + description: |- + Filter expression for groups. See [Filter](https://developer.okta.com/docs/api/#filter). + Filtering supports the following limited number of properties: `id`, `type`, `lastUpdated`, and `lastMembershipUpdated`. - > **Note:** All filters must be [URL - encoded](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding). - For example, `filter=lastUpdated gt "2013-06-01T00:00:00.000Z"` is - encoded as - `filter=lastUpdated%20gt%20%222013-06-01T00:00:00.000Z%22`. + > **Note:** All filters must be [URL encoded](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding). For example, `filter=lastUpdated gt "2013-06-01T00:00:00.000Z"` is encoded as `filter=lastUpdated%20gt%20%222013-06-01T00:00:00.000Z%22`. See [Special characters](https://developer.okta.com/docs/api/#special-characters). schema: type: string examples: filterById: - value: id%20eq%20%2200g1emaKYZTWRYYRRTSK%22 + value: id eq "00g1emaKYZTWRYYRRTSK" summary: Filter by ID description: Filter group with a specific ID (00g1emaKYZTWRYYRRTSK) filterByType: - value: type%20eq%20%22OKTA_GROUP%22 + value: type eq "OKTA_GROUP" summary: Filter by type description: Filter groups that are of the type OKTA_GROUP filterByTypeAndProfileLastUpdatedAfterDate: - value: >- - type%20eq%20%22OKTA_GROUP%22%20and%20lastUpdated%20gt%20%222016-11-11T00%3A00%3A00.000Z%22 + value: type eq "OKTA_GROUP" and lastUpdated gt "2016-11-11T00:00:00.000Z" summary: Filter by type and last updated date - description: >- - Filter groups that are OKTA_GROUP type with profile updated - after 11/11/2016 + description: Filter groups that are OKTA_GROUP type with profile updated after 11/11/2016 filterByTypeAndProfileOrMembershipUpdatedBeforeDate: - value: >- - type%20eq%20%22OKTA_GROUP%22%20and%20%28lastUpdated%20lt%20%222015-11-11T00%3A00%3A00.000Z%22%20or%20lastMembershipUpdated%20lt%20%222015-11-11T00%3A00%3A00.000Z%22%29 + value: type eq "OKTA_GROUP" and (lastUpdated lt "2015-11-11T00:00:00.000Z" or lastMembershipUpdated lt "2015-11-11T00:00:00.000Z") summary: Filter by multiple criteria - description: >- - Filter groups that are OKTA_GROUP type, with profiles or - memberships updated before 11/11/2015 + description: Filter groups that are OKTA_GROUP type, with profiles or memberships updated before 11/11/2015 - name: q in: query - description: >- + description: |- Finds a group that matches the `name` property. - - > **Note:** Paging and searching are currently mutually exclusive. - You can't page a query. The default limit for a query is 300 - results. Query is intended for an auto-complete picker use case - where users refine their search string to constrain the results. + > **Note:** Paging and searching are currently mutually exclusive. You can't page a query. The default limit for a query is 300 results. Query is intended for an auto-complete picker use case where users refine their search string to constrain the results. schema: type: string example: West&limit=10 - name: after in: query - description: >- - Specifies the pagination cursor for the next page of groups. The - `after` cursor should be treated as an opaque value and obtained - through the next link relation. See - [Pagination](https://developer.okta.com/docs/api/#pagination). + description: Specifies the pagination cursor for the next page of groups. The `after` cursor should be treated as an opaque value and obtained through the next link relation. See [Pagination](https://developer.okta.com/docs/api/#pagination). schema: type: string - name: limit in: query - description: >- + description: |- Specifies the number of group results in a page. + Okta recommends using a specific value other than the default or maximum. If your request times out, retry your request with a smaller `limit` and [page the results](https://developer.okta.com/docs/api/#pagination). - Okta recommends using a specific value other than the default or - maximum. If your request times out, retry your request with a - smaller `limit` and [page the - results](https://developer.okta.com/docs/api/#pagination). - - - The Okta default `Everyone` group isn't returned for users with a - group admin role. + The Okta default `Everyone` group isn't returned for users with a group admin role. schema: type: integer format: int32 maximum: 10000 - name: expand in: query - description: >- - If specified, additional metadata is included in the response. - Possible values are `stats` and `app`. This additional metadata is - listed in the - [`_embedded`](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/Group/#tag/Group/operation/addGroup!c=200&path=_embedded&t=response) - property of the response. + description: |- + If specified, additional metadata is included in the response. Possible values are `stats` and `app`. This additional metadata is listed in the [`_embedded`](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Group/#tag/Group/operation/addGroup!c=200&path=_embedded&t=response) property of the response. - - > **Note:** You can use the `stats` value to return the number of - users within a group. This is listed as the - `_embedded.stats.usersCount` value in the response. See this - [Knowledge Base - article](https://support.okta.com/help/s/article/Is-there-an-API-that-returns-the-number-of-users-in-a-group?language=en_US) - for more information and an example. + > **Note:** You can use the `stats` value to return the number of users within a group. This is listed as the `_embedded.stats.usersCount` value in the response. See this [Knowledge Base article](https://support.okta.com/help/s/article/Is-there-an-API-that-returns-the-number-of-users-in-a-group?language=en_US) for more information and an example. schema: type: string - name: sortBy in: query - description: >- - Specifies field to sort by **(for search queries only)**. `sortBy` - can be any single property, for example `sortBy=profile.name`. + description: Specifies the field to sort by (for search queries only). `sortBy` can be any single property, for example `sortBy=profile.name`. Groups with the same value for the `sortBy` property are ordered by `id`'. Use with `sortOrder` to control the order of results. schema: type: string example: lastUpdated - - name: sortOrder - in: query - description: >- - Specifies sort order: `asc` or `desc` (for search queries only). - This parameter is ignored if `sortBy` isn't present. Groups with the - same value for the `sortBy` property are ordered by `id`'. - schema: - type: string - default: asc + - $ref: '#/components/parameters/querySortOrder' responses: '200': description: Success content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/Group' + $ref: '#/components/schemas/ListGroupsResponse' examples: - ListGroupExample: + ListGroupsExample: $ref: '#/components/examples/list-groups-examples' + ListGroupsFilterExample: + $ref: '#/components/examples/list-groups-filter' + ListGroupsSearchExample: + $ref: '#/components/examples/list-groups-search' '403': $ref: '#/components/responses/ErrorAccessDenied403' '429': @@ -249,14 +164,10 @@ paths: isGenerallyAvailable: true post: summary: Add a group - description: >- + description: |- Adds a new group with the `OKTA_GROUP` type to your org. - - > **Note:** App import operations are responsible for syncing groups - with `APP_GROUP` type such as Active Directory groups. See - - [About groups](https://help.okta.com/okta_help.htm?id=Directory_Groups) - in the help documentation. + > **Note:** App import operations are responsible for syncing groups with `APP_GROUP` type such as Active Directory groups. See + [About groups](https://help.okta.com/okta_help.htm?id=Directory_Groups) in the help documentation. operationId: addGroup x-codegen-request-body-name: group requestBody: @@ -318,24 +229,19 @@ paths: description: Specifies the keyword to search rules for schema: type: string - - name: expand - in: query - description: If specified as `groupIdToGroupNameMap`, then displays group names - schema: - type: string - x-okta-added-version: 1.3.0 + - $ref: '#/components/parameters/queryExpandGroupIdToGroupNameMap' responses: '200': description: Success content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/GroupRule' + $ref: '#/components/schemas/ListGroupRulesResponse' examples: ListGroupRulesExample: $ref: '#/components/examples/list-group-rules-example' + ListGroupRulesExampleWithExpand: + $ref: '#/components/examples/list-group-rules-with-expand-parameter' '403': $ref: '#/components/responses/ErrorAccessDenied403' '429': @@ -351,10 +257,8 @@ paths: isGenerallyAvailable: true post: summary: Create a group rule - description: >- - Creates a group rule to dynamically add users to the specified group if - they match the condition - + description: |- + Creates a group rule to dynamically add users to the specified group if they match the condition. > **Note:** Group rules are created with the status set to `'INACTIVE'`. operationId: createGroupRule x-codegen-request-body-name: groupRule @@ -398,11 +302,8 @@ paths: description: Retrieves a specific group rule by ID from your org operationId: getGroupRule parameters: - - name: expand - in: query - description: If specified as `groupIdToGroupNameMap`, then show group names - schema: - type: string + - $ref: '#/components/parameters/queryExpandGroupIdToGroupNameMap' + - $ref: '#/components/parameters/pathGroupRuleId' responses: '200': description: Success @@ -430,15 +331,11 @@ paths: isGenerallyAvailable: true put: summary: Replace a group rule - description: >- + description: |- Replaces a group rule - - > **Notes:** You can only update rules with a group whose status is set - to `'INACTIVE'`. - + > **Notes:** You can only update rules with a group whose status is set to `INACTIVE`. > - - > You currently can't update the `action` section. + > You currently can't update the `actions` section. operationId: replaceGroupRule x-codegen-request-body-name: groupRule requestBody: @@ -474,6 +371,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathGroupRuleId' delete: summary: Delete a group rule description: Deletes a specific group rule by `groupRuleId` @@ -483,8 +382,9 @@ paths: in: query description: If set to `true`, removes users from groups assigned by this rule schema: - type: boolean - default: false + type: string + default: 'false' + - $ref: '#/components/parameters/pathGroupRuleId' responses: '202': description: Accepted @@ -504,8 +404,6 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathGroupRuleId' /api/v1/groups/rules/{groupRuleId}/lifecycle/activate: post: summary: Activate a group rule @@ -530,8 +428,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathGroupRuleId' + parameters: + - $ref: '#/components/parameters/pathGroupRuleId' /api/v1/groups/rules/{groupRuleId}/lifecycle/deactivate: post: summary: Deactivate a group rule @@ -556,8 +454,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathGroupRuleId' + parameters: + - $ref: '#/components/parameters/pathGroupRuleId' /api/v1/groups/{groupId}: get: summary: Retrieve a group @@ -588,18 +486,15 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathGroupId' put: summary: Replace a group - description: >- + description: |- Replaces the profile for a group of `OKTA_GROUP` type from your org. - - > **Note :** You only can modify profiles for groups of the `OKTA_GROUP` - type. - + > **Note :** You only can modify profiles for groups of the `OKTA_GROUP` type. > - - > App imports are responsible for updating profiles for groups of the - `APP_GROUP` type, such as Active Directory groups. + > App imports are responsible for updating profiles for groups of the `APP_GROUP` type, such as Active Directory groups. operationId: replaceGroup x-codegen-request-body-name: group requestBody: @@ -638,13 +533,13 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathGroupId' delete: summary: Delete a group - description: >- + description: |- Deletes a group of the `OKTA_GROUP` or `APP_GROUP` type from your org. - - > **Note:** You can't remove groups of type `APP_GROUP` if they are used - in a group push mapping. + > **Note:** You can't remove groups of type `APP_GROUP` if they are used in a group push mapping. operationId: deleteGroup responses: '204': @@ -665,14 +560,12 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathGroupId' + parameters: + - $ref: '#/components/parameters/pathGroupId' /api/v1/groups/{groupId}/apps: get: summary: List all assigned apps - description: >- - Lists all apps that are assigned to a group. See [Application Groups - API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/ApplicationGroups/). + description: Lists all apps that are assigned to a group. See [Application Groups API](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/applicationgroups/). operationId: listAssignedApplicationsForGroup parameters: - name: after @@ -687,15 +580,14 @@ paths: type: integer format: int32 default: 20 + - $ref: '#/components/parameters/pathGroupId' responses: '200': description: Success content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/Application' + $ref: '#/components/schemas/ListAssignedApplicationsForGroupResponse' examples: ListAppsExample: $ref: '#/components/examples/list-apps-example' @@ -714,8 +606,6 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathGroupId' /api/v1/groups/{groupId}/owners: get: summary: List all group owners @@ -724,9 +614,7 @@ paths: parameters: - name: search in: query - description: >- - SCIM filter expression for group owners. Allows you to filter owners - by type. + description: SCIM filter expression for group owners. Allows you to filter owners by type. schema: type: string - name: after @@ -741,15 +629,14 @@ paths: type: integer format: int32 default: 1000 + - $ref: '#/components/parameters/pathGroupId' responses: '200': description: Success content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/GroupOwner' + $ref: '#/components/schemas/ListGroupOwnersResponse' examples: ListsOneOwnerOfaGroup: $ref: '#/components/examples/ListsOwnerOneResponse' @@ -812,8 +699,6 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathGroupId' /api/v1/groups/{groupId}/owners/{ownerId}: delete: summary: Delete a group owner @@ -838,9 +723,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathGroupId' - - $ref: '#/components/parameters/pathOwnerId' + parameters: + - $ref: '#/components/parameters/pathGroupId' + - $ref: '#/components/parameters/pathOwnerId' /api/v1/groups/{groupId}/roles: get: summary: List all group role assignments @@ -848,23 +733,20 @@ paths: operationId: listGroupAssignedRoles parameters: - $ref: '#/components/parameters/pathQueryRoleExpand' + - $ref: '#/components/parameters/pathGroupId' responses: '200': description: Success content: application/json: schema: - type: array - items: - oneOf: - - $ref: '#/components/schemas/StandardRole' - - $ref: '#/components/schemas/CustomRole' + $ref: '#/components/schemas/ListGroupAssignedRolesResponse' examples: - Standard Roles: + Standard roles: $ref: '#/components/examples/StandardRolesListResponseGroup' - Custom Roles: + Custom roles: $ref: '#/components/examples/CustomRolesListResponseGroup' - IAM-Based Standard Roles: + IAM-Based standard roles: $ref: '#/components/examples/IAMStandardRolesListResponseGroup' '403': $ref: '#/components/responses/ErrorAccessDenied403' @@ -883,42 +765,73 @@ paths: isGenerallyAvailable: true post: summary: Assign a role to a group - description: >- - Assigns a [standard - role](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#standard-roles) to a group. - - - You can also assign a custom role to a group, but the preferred method - to assign a custom role to a group is to create a binding between the - custom role, the resource set, and the group. See [Create a role - resource set - binding](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/RoleDResourceSetBinding/#tag/RoleDResourceSetBinding/operation/createResourceSetBinding). + description: |- + Assigns a [standard role](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#standard-roles) to a group. + You can also assign a custom role to a group, but the preferred method to assign a custom role to a group is to create a binding between the custom role, the resource set, and the group. See [Create a role resource set binding](https://developer.okta.com/docs/api/openapi/okta-management/management/roledresourcesetbinding/createresourcesetbinding). > **Notes:** - - > * The request payload is different for standard and custom role - assignments. - - > * For IAM-based standard role assignments, use the request payload for - standard roles. However, the response payload for IAM-based role - assignments is similar to the custom role's assignment response. + > * The request payload is different for standard and custom role assignments. + > * For IAM-based standard role assignments, use the request payload for standard roles. However, the response payload for IAM-based role assignments is similar to the custom role's assignment response. operationId: assignRoleToGroup parameters: - name: disableNotifications in: query description: Grants the group third-party admin status when set to `true` schema: - type: boolean - default: false + type: string + default: 'false' + - $ref: '#/components/parameters/pathGroupId' x-codegen-request-body-name: assignRoleRequest requestBody: content: application/json: schema: - oneOf: - - $ref: '#/components/schemas/StandardRoleAssignmentSchema' - - $ref: '#/components/schemas/CustomRoleAssignmentSchema' + discriminator: + propertyName: type + mapping: + API_ACCESS_MANAGEMENT_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + APP_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + GROUP_MEMBERSHIP_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + HELP_DESK_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + ORG_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + READ_ONLY_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + REPORT_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + SUPER_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + USER_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + WORKFLOWS_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + ACCESS_CERTIFICATIONS_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + ACCESS_REQUESTS_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + CUSTOM: '#/components/schemas/CustomRoleAssignmentSchema' + title: Standard role + type: object + properties: + type: + type: string + description: 'Specify a [standard admin role](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#standard-roles), an [IAM-based standard role](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#iam-based-standard-roles), or `CUSTOM` for a custom role type:' + enum: + - ACCESS_CERTIFICATIONS_ADMIN + - ACCESS_REQUESTS_ADMIN + - API_ACCESS_MANAGEMENT_ADMIN + - APP_ADMIN + - GROUP_MEMBERSHIP_ADMIN + - HELP_DESK_ADMIN + - ORG_ADMIN + - READ_ONLY_ADMIN + - REPORT_ADMIN + - SUPER_ADMIN + - USER_ADMIN + - WORKFLOWS_ADMIN + resource-set: + type: string + description: Resource set ID + role: + type: string + description: Custom role ID + required: + - type + - role + - resource-set required: true responses: '200': @@ -926,16 +839,93 @@ paths: content: application/json: schema: - oneOf: - - $ref: '#/components/schemas/StandardRole' - - $ref: '#/components/schemas/CustomRole' + discriminator: + propertyName: type + mapping: + API_ACCESS_MANAGEMENT_ADMIN: '#/components/schemas/StandardRole' + APP_ADMIN: '#/components/schemas/StandardRole' + GROUP_MEMBERSHIP_ADMIN: '#/components/schemas/StandardRole' + HELP_DESK_ADMIN: '#/components/schemas/StandardRole' + ORG_ADMIN: '#/components/schemas/StandardRole' + READ_ONLY_ADMIN: '#/components/schemas/StandardRole' + REPORT_ADMIN: '#/components/schemas/StandardRole' + SUPER_ADMIN: '#/components/schemas/StandardRole' + USER_ADMIN: '#/components/schemas/StandardRole' + WORKFLOWS_ADMIN: '#/components/schemas/CustomRole' + ACCESS_CERTIFICATIONS_ADMIN: '#/components/schemas/CustomRole' + ACCESS_REQUESTS_ADMIN: '#/components/schemas/CustomRole' + CUSTOM: '#/components/schemas/CustomRole' + title: Standard role assignment + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + assignmentType: + $ref: '#/components/schemas/RoleAssignmentType' + created: + type: string + description: Timestamp when the object was created + format: date-time + readOnly: true + id: + type: string + description: Role assignment ID + readOnly: true + label: + type: string + description: Label for the role assignment + readOnly: true + lastUpdated: + type: string + description: Timestamp when the object was last updated + format: date-time + readOnly: true + status: + type: string + enum: + - ACTIVE + - INACTIVE + description: Status of the role assignment + type: + $ref: '#/components/schemas/RoleType' + _embedded: + type: object + description: Optional embedded resources for the role assignment + properties: + targets: + type: object + description: Targets configured for the role assignment + properties: + groups: + type: array + description: Group targets + items: + $ref: '#/components/schemas/Group' + catalog: + description: App targets + properties: + apps: + type: array + items: + $ref: '#/components/schemas/CatalogApplication' + type: object + _links: + $ref: '#/components/schemas/LinksAssignee' + resource-set: + type: string + description: Resource set ID + readOnly: true + role: + type: string + description: Role ID + readOnly: true + required: + - type examples: - Standard Roles: - $ref: >- - #/components/examples/CreateStandardRoleAssignmentResponseGroup - Custom Roles: + Standard roles: + $ref: '#/components/examples/CreateStandardRoleAssignmentResponseGroup' + Custom roles: $ref: '#/components/examples/CreateCustomRoleResponseGroup' - IAM-based Standard Roles: + IAM-based standard roles: $ref: '#/components/examples/CreateIAMStandardRoleResponseGroup' '201': description: Success @@ -957,15 +947,10 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathGroupId' /api/v1/groups/{groupId}/roles/{roleAssignmentId}: get: summary: Retrieve a group role assignment - description: >- - Retrieves a role assigned to a group (identified by the `groupId`). The - `roleAssignmentId` is the unique identifier for either a standard role - group assignment object or a custom role resource set binding object. + description: Retrieves a role assigned to a group (identified by the `groupId`). The `roleAssignmentId` is the unique identifier for either a standard role group assignment object or a custom role resource set binding object. operationId: getGroupAssignedRole responses: '200': @@ -973,16 +958,93 @@ paths: content: application/json: schema: - oneOf: - - $ref: '#/components/schemas/StandardRole' - - $ref: '#/components/schemas/CustomRole' + discriminator: + propertyName: type + mapping: + API_ACCESS_MANAGEMENT_ADMIN: '#/components/schemas/StandardRole' + APP_ADMIN: '#/components/schemas/StandardRole' + GROUP_MEMBERSHIP_ADMIN: '#/components/schemas/StandardRole' + HELP_DESK_ADMIN: '#/components/schemas/StandardRole' + ORG_ADMIN: '#/components/schemas/StandardRole' + READ_ONLY_ADMIN: '#/components/schemas/StandardRole' + REPORT_ADMIN: '#/components/schemas/StandardRole' + SUPER_ADMIN: '#/components/schemas/StandardRole' + USER_ADMIN: '#/components/schemas/StandardRole' + WORKFLOWS_ADMIN: '#/components/schemas/CustomRole' + ACCESS_CERTIFICATIONS_ADMIN: '#/components/schemas/CustomRole' + ACCESS_REQUESTS_ADMIN: '#/components/schemas/CustomRole' + CUSTOM: '#/components/schemas/CustomRole' + title: Standard role assignment + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + assignmentType: + $ref: '#/components/schemas/RoleAssignmentType' + created: + type: string + description: Timestamp when the object was created + format: date-time + readOnly: true + id: + type: string + description: Role assignment ID + readOnly: true + label: + type: string + description: Label for the role assignment + readOnly: true + lastUpdated: + type: string + description: Timestamp when the object was last updated + format: date-time + readOnly: true + status: + type: string + enum: + - ACTIVE + - INACTIVE + description: Status of the role assignment + type: + $ref: '#/components/schemas/RoleType' + _embedded: + type: object + description: Optional embedded resources for the role assignment + properties: + targets: + type: object + description: Targets configured for the role assignment + properties: + groups: + type: array + description: Group targets + items: + $ref: '#/components/schemas/Group' + catalog: + description: App targets + properties: + apps: + type: array + items: + $ref: '#/components/schemas/CatalogApplication' + type: object + _links: + $ref: '#/components/schemas/LinksAssignee' + resource-set: + type: string + description: Resource set ID + readOnly: true + role: + type: string + description: Role ID + readOnly: true + required: + - type examples: - Standard Roles: - $ref: >- - #/components/examples/CreateStandardRoleAssignmentResponseGroup - Custom Roles: + Standard roles: + $ref: '#/components/examples/CreateStandardRoleAssignmentResponseGroup' + Custom roles: $ref: '#/components/examples/CreateCustomRoleResponseGroup' - IAM-based Standard Roles: + IAM-based standard roles: $ref: '#/components/examples/CreateIAMStandardRoleResponseGroup' '403': $ref: '#/components/responses/ErrorAccessDenied403' @@ -999,11 +1061,12 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathGroupId' + - $ref: '#/components/parameters/pathRoleAssignmentId' delete: summary: Unassign a group role - description: >- - Unassigns a role assignment (identified by `roleAssignmentId`) from a - group (identified by the `groupId`) + description: Unassigns a role assignment (identified by `roleAssignmentId`) from a group (identified by the `groupId`) operationId: unassignRoleFromGroup responses: '204': @@ -1024,30 +1087,26 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathGroupId' - - $ref: '#/components/parameters/pathRoleAssignmentId' + parameters: + - $ref: '#/components/parameters/pathGroupId' + - $ref: '#/components/parameters/pathRoleAssignmentId' /api/v1/groups/{groupId}/roles/{roleAssignmentId}/targets/catalog/apps: get: summary: List all group role app targets - description: >- - Lists all app targets for an `APP_ADMIN` role assignment to a group. The - response includes a list of OIN-cataloged apps or app instances. The - response payload for an app instance contains the `id` property, but an - OIN-cataloged app doesn't. + description: Lists all app targets for an `APP_ADMIN` role assignment to a group. The response includes a list of OIN-cataloged apps or app instances. The response payload for an app instance contains the `id` property, but an OIN-cataloged app doesn't. operationId: listApplicationTargetsForApplicationAdministratorRoleForGroup parameters: - $ref: '#/components/parameters/queryAfter' - $ref: '#/components/parameters/queryLimit' + - $ref: '#/components/parameters/pathGroupId' + - $ref: '#/components/parameters/pathRoleAssignmentId' responses: '200': description: Success content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/CatalogApplication' + $ref: '#/components/schemas/ListApplicationTargetsForApplicationAdministratorRoleForGroupResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -1063,21 +1122,10 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathGroupId' - - $ref: '#/components/parameters/pathRoleAssignmentId' /api/v1/groups/{groupId}/roles/{roleAssignmentId}/targets/catalog/apps/{appName}: put: summary: Assign a group role app target - description: >- - Assigns an OIN app target to an `APP_ADMIN` role assignment to a group. - When you assign the first OIN app target, you reduce the scope of the - role assignment. The role no longer applies to all app targets, but - applies only to the specified target. An OIN app target that's assigned - to the role overrides any existing instance targets of the OIN app. For - example, if a user is assigned to administer a specific Facebook - instance, a successful request to add an OIN app with `facebook` for - `appName` makes that user the administrator for all Facebook instances. + description: Assigns an OIN app target to an `APP_ADMIN` role assignment to a group. When you assign the first OIN app target, you reduce the scope of the role assignment. The role no longer applies to all app targets, but applies only to the specified target. An OIN app target that's assigned to the role overrides any existing instance targets of the OIN app. For example, if a user is assigned to administer a specific Facebook instance, a successful request to add an OIN app with `facebook` for `appName` makes that user the administrator for all Facebook instances. operationId: assignAppTargetToAdminRoleForGroup responses: '200': @@ -1098,19 +1146,17 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathGroupId' + - $ref: '#/components/parameters/pathRoleAssignmentId' + - $ref: '#/components/parameters/pathAppName' delete: summary: Unassign a group role app target - description: > - Unassigns an OIN app target from an `APP_ADMIN` role assignment to a - group - + description: | + Unassigns an OIN app target from an `APP_ADMIN` role assignment to a group > **Note:** You can't remove the last app target from a role assignment. - - > If you need a role assignment that applies to all apps, delete the - `APP_ADMIN` role assignment with the target and create another one. See - [Unassign a group - role](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/RoleAssignmentBGroup/#tag/RoleAssignmentBGroup/operation/unassignRoleFromGroup). + > If you need a role assignment that applies to all apps, delete the `APP_ADMIN` role assignment with the target and create another one. See [Unassign a group role](https://developer.okta.com/docs/api/openapi/okta-management/management/roleassignmentbgroup/unassignrolefromgroup). operationId: unassignAppTargetToAdminRoleForGroup responses: '204': @@ -1131,29 +1177,19 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathGroupId' - - $ref: '#/components/parameters/pathRoleAssignmentId' - - $ref: '#/components/parameters/pathAppName' + parameters: + - $ref: '#/components/parameters/pathGroupId' + - $ref: '#/components/parameters/pathRoleAssignmentId' + - $ref: '#/components/parameters/pathAppName' /api/v1/groups/{groupId}/roles/{roleAssignmentId}/targets/catalog/apps/{appName}/{appId}: put: summary: Assign a group role app instance target - description: >- - Assigns an app instance target to an `APP_ADMIN` role assignment to a - group. When you assign the first OIN app or app instance target, you - reduce the scope of the role assignment. - - The role no longer applies to all app targets, but applies only to the - specified target. - - - > **Note:** You can target a mixture of both OIN app and app instance - targets, but you can't assign permissions to manage all instances of an - OIN app and then assign a subset of permissions to the same app. + description: |- + Assigns an app instance target to an `APP_ADMIN` role assignment to a group. When you assign the first OIN app or app instance target, you reduce the scope of the role assignment. + The role no longer applies to all app targets, but applies only to the specified target. - > For example, you can't specify that an admin has access to manage all - instances of the Salesforce app and then also manage specific - configurations of the Salesforce app. + > **Note:** You can target a mixture of both OIN app and app instance targets, but you can't assign permissions to manage all instances of an OIN app and then assign a subset of permissions to the same app. + > For example, you can't specify that an admin has access to manage all instances of the Salesforce app and then also manage specific configurations of the Salesforce app. operationId: assignAppInstanceTargetToAppAdminRoleForGroup responses: '204': @@ -1174,20 +1210,18 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathGroupId' + - $ref: '#/components/parameters/pathRoleAssignmentId' + - $ref: '#/components/parameters/pathAppName' + - $ref: '#/components/parameters/pathAppId' delete: summary: Unassign a group role app instance target - description: >- - Unassigns an app instance target from an `APP_ADMIN` role assignment to - a group - - - > **Note:** You can't remove the last app instance target from a role - assignment. + description: |- + Unassigns an app instance target from an `APP_ADMIN` role assignment to a group - > If you need a role assignment that applies to all apps, delete the - `APP_ADMIN` role assignment with the target and create another one. See - [Unassign a group - role](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/RoleAssignmentBGroup/#tag/RoleAssignmentBGroup/operation/unassignRoleFromGroup). + > **Note:** You can't remove the last app instance target from a role assignment. + > If you need a role assignment that applies to all apps, delete the `APP_ADMIN` role assignment with the target and create another one. See [Unassign a group role](https://developer.okta.com/docs/api/openapi/okta-management/management/roleassignmentbgroup/unassignrolefromgroup). operationId: unassignAppInstanceTargetToAppAdminRoleForGroup responses: '204': @@ -1208,35 +1242,30 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathGroupId' - - $ref: '#/components/parameters/pathRoleAssignmentId' - - $ref: '#/components/parameters/pathAppName' - - $ref: '#/components/parameters/pathAppId' + parameters: + - $ref: '#/components/parameters/pathGroupId' + - $ref: '#/components/parameters/pathRoleAssignmentId' + - $ref: '#/components/parameters/pathAppName' + - $ref: '#/components/parameters/pathAppId' /api/v1/groups/{groupId}/roles/{roleAssignmentId}/targets/groups: get: summary: List all group role group targets - description: >- - Lists all group targets for a - [`USER_ADMIN`](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#standard-roles), - `HELP_DESK_ADMIN`, or `GROUP_MEMBERSHIP_ADMIN` role assignment to a - group. - - If the role isn't scoped to specific group targets, Okta returns an - empty array `[]`. + description: |- + Lists all group targets for a [`USER_ADMIN`](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#standard-roles), `HELP_DESK_ADMIN`, or `GROUP_MEMBERSHIP_ADMIN` role assignment to a group. + If the role isn't scoped to specific group targets, Okta returns an empty array `[]`. operationId: listGroupTargetsForGroupRole parameters: - $ref: '#/components/parameters/queryAfter' - $ref: '#/components/parameters/queryLimit' + - $ref: '#/components/parameters/pathGroupId' + - $ref: '#/components/parameters/pathRoleAssignmentId' responses: '200': description: Success content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/Group' + $ref: '#/components/schemas/ListGroupTargetsForGroupRoleResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -1252,21 +1281,12 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathGroupId' - - $ref: '#/components/parameters/pathRoleAssignmentId' /api/v1/groups/{groupId}/roles/{roleAssignmentId}/targets/groups/{targetGroupId}: put: summary: Assign a group role group target - description: >- - Assigns a group target to a - [`USER_ADMIN`](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#standard-roles), - `HELP_DESK_ADMIN`, or `GROUP_MEMBERSHIP_ADMIN` role assignment to a - group. - - When you assign the first group target, you reduce the scope of the role - assignment. The role no longer applies to all targets but applies only - to the specified target. + description: |- + Assigns a group target to a [`USER_ADMIN`](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#standard-roles), `HELP_DESK_ADMIN`, or `GROUP_MEMBERSHIP_ADMIN` role assignment to a group. + When you assign the first group target, you reduce the scope of the role assignment. The role no longer applies to all targets but applies only to the specified target. operationId: assignGroupTargetToGroupAdminRole responses: '204': @@ -1287,13 +1307,13 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathGroupId' + - $ref: '#/components/parameters/pathRoleAssignmentId' + - $ref: '#/components/parameters/pathTargetGroupId' delete: summary: Unassign a group role group target - description: >- - Unassigns a group target from a - [`USER_ADMIN`](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#standard-roles), - `HELP_DESK_ADMIN`, or `GROUP_MEMBERSHIP_ADMIN` role assignment to a - group. + description: Unassigns a group target from a [`USER_ADMIN`](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#standard-roles), `HELP_DESK_ADMIN`, or `GROUP_MEMBERSHIP_ADMIN` role assignment to a group. operationId: unassignGroupTargetFromGroupAdminRole responses: '204': @@ -1314,20 +1334,16 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathGroupId' - - $ref: '#/components/parameters/pathRoleAssignmentId' - - $ref: '#/components/parameters/pathTargetGroupId' + parameters: + - $ref: '#/components/parameters/pathGroupId' + - $ref: '#/components/parameters/pathRoleAssignmentId' + - $ref: '#/components/parameters/pathTargetGroupId' /api/v1/groups/{groupId}/users: get: summary: List all member users - description: >- + description: |- Lists all users that are a member of a group. - - The default user limit is set to a very high number due to historical - reasons that are no longer valid for most orgs. This will change in a - future version of this API. The recommended page limit is now - `limit=200`. + The default user limit is set to a very high number due to historical reasons that are no longer valid for most orgs. This will change in a future version of this API. The recommended page limit is now `limit=200`. operationId: listGroupUsers parameters: - $ref: '#/components/parameters/queryAfter' @@ -1338,15 +1354,14 @@ paths: type: integer format: int32 default: 1000 + - $ref: '#/components/parameters/pathGroupId' responses: '200': description: Success content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/User' + $ref: '#/components/schemas/ListGroupUsersResponse' examples: ListMemberUserResponse: $ref: '#/components/examples/ListUsersResponse' @@ -1365,18 +1380,12 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathGroupId' /api/v1/groups/{groupId}/users/{userId}: put: summary: Assign a user to a group - description: >- + description: |- Assigns a user to a group with the `OKTA_GROUP` type. - - > **Note:** You only can modify memberships for groups of the - `OKTA_GROUP` type. App imports are responsible for managing group - memberships for groups of the `APP_GROUP` type, such as Active Directory - groups. + > **Note:** You only can modify memberships for groups of the `OKTA_GROUP` type. App imports are responsible for managing group memberships for groups of the `APP_GROUP` type, such as Active Directory groups. operationId: assignUserToGroup responses: '204': @@ -1397,18 +1406,16 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathGroupId' + - $ref: '#/components/parameters/pathUserId' delete: summary: Unassign a user from a group - description: >- + description: |- Unassigns a user from a group with the `OKTA_GROUP` type. - - > **Note:** You only can modify memberships for groups of the - `OKTA_GROUP` type. - + > **Note:** You only can modify memberships for groups of the `OKTA_GROUP` type. > - - > App imports are responsible for managing group memberships for groups - of the `APP_GROUP` type, such as Active Directory groups. + > App imports are responsible for managing group memberships for groups of the `APP_GROUP` type, such as Active Directory groups. operationId: unassignUserFromGroup responses: '204': @@ -1429,12 +1436,13 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathGroupId' - - $ref: '#/components/parameters/pathUserId' + parameters: + - $ref: '#/components/parameters/pathGroupId' + - $ref: '#/components/parameters/pathUserId' components: schemas: Group: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: created: @@ -1470,38 +1478,71 @@ components: _embedded: type: object description: Embedded resources related to the group - additionalProperties: - type: object - properties: {} readOnly: true - _links: - description: >- - [Discoverable - resources](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Group/#tag/Group/operation/listGroups!c=200&path=_links&t=response) - related to the group - allOf: - - $ref: '#/components/schemas/LinksSelf' - - properties: - apps: - $ref: '#/components/schemas/HrefObject' - logo: - type: array - items: - $ref: '#/components/schemas/HrefObject' - source: - $ref: '#/components/schemas/HrefObject' - users: - $ref: '#/components/schemas/HrefObject' + properties: + stats: + description: Statistics about the group + type: object + properties: + usersCount: + type: integer + format: int32 + description: Number of users in the group + appsCount: + type: integer + format: int32 + description: Number of apps associated with the group + groupPushMappingsCount: + type: integer + format: int32 + description: Number of group push mappings associated with the group + hasAdminPrivlege: + type: boolean + description: Indicates if the group has admin privileges via a group-level role assignment + app: + description: If the group is sourced from an app, this object contains information about that app type: object + properties: + id: + type: string + description: The ID of the `AppInstance` + name: + type: string + description: The name of the `AppInstance` + label: + type: string + description: The user-facing display name of the `AppInstance` + signOnMode: + type: string + description: The configured sign-on mode for the `AppInstance` + example: SAML_1_1 + _links: + description: '[Discoverable resources](https://developer.okta.com/docs/api/openapi/okta-management/management/group/listgroups#group/listgroups/t=response&c=200&path=_links/source) related to the group' + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + apps: + $ref: '#/components/schemas/HrefObject' + logo: + type: array + items: + $ref: '#/components/schemas/HrefObject' + source: + $ref: '#/components/schemas/HrefObject' + users: + $ref: '#/components/schemas/HrefObject' + readOnly: true OktaUserGroupProfile: - description: >- - Profile for any group that is not imported from Active Directory. - Specifies the standard - + description: |- + Profile for any group that is not imported from Active Directory. Specifies the standard and custom profile properties for a group. - The `objectClass` for these groups is `okta:user_group`. + + You can extend group profiles with custom properties, but you must first add the properties to the group profile schema before you can reference them. Use the Profile Editor in the Admin Console or the [Schemas API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/) to manage schema extensions. + + Custom properties can contain HTML tags. It is the client's responsibility to escape or encode this data before displaying it. Use [best-practices](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) to prevent cross-site scripting. type: object properties: description: @@ -1543,9 +1584,18 @@ components: $ref: '#/components/schemas/GroupRuleStatus' type: type: string - description: >- - Type to indicate a group rule operation. Only `group_rule` is - allowed. + description: Type to indicate a group rule operation. Only `group_rule` is allowed. + _embedded: + type: object + description: This object appears with embedded resources related to the group rule if you use the `expand` query parameter + readOnly: true + properties: + groupIdToGroupNameMap: + type: object + description: A mapping of group IDs to group names + readOnly: true + additionalProperties: + type: string CreateGroupRuleRequest: type: object properties: @@ -1563,6 +1613,7 @@ components: enum: - group_rule Application: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: accessibility: @@ -1572,14 +1623,13 @@ components: format: date-time readOnly: true description: Timestamp when the application object was created + expressConfiguration: + $ref: '#/components/schemas/ApplicationExpressConfiguration' features: type: array - description: > + description: | Enabled app features - - > **Note:** See [Application - Features](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/ApplicationFeatures/) - for app provisioning features. + > **Note:** See [Application Features](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/applicationfeatures/) for app provisioning features. readOnly: true items: type: string @@ -1627,52 +1677,21 @@ components: - ENTITLEMENT_MANAGEMENT - PUSH_NEW_USERS_WITH_HASHED_PASSWORD x-enumDescriptions: - GROUP_PUSH: >- - Creates or links a group in the app when a mapping is defined - for a group in Okta. Okta is the source for group memberships - and all group members in Okta who are also assigned to the app - are synced as group members to the app. + GROUP_PUSH: Creates or links a group in the app when a mapping is defined for a group in Okta. Okta is the source for group memberships and all group members in Okta who are also assigned to the app are synced as group members to the app. IMPORT_NEW_USERS: Creates or links a user in Okta to a user from the app - IMPORT_PROFILE_UPDATES: >- - Updates a linked user's app profile during manual or scheduled - imports - IMPORT_USER_SCHEMA: >- - Discovers the profile schema for a user from the app - automatically - PROFILE_MASTERING: >- - Designates the app as the identity lifecycle and profile - attribute authority for linked users. The user's profile in Okta - is read-only. - PUSH_NEW_USERS: >- - Creates or links a user account in the app when assigning the - app to a user in Okta - PUSH_PASSWORD_UPDATES: >- - Updates the user's app password when their password changes in - Okta - PUSH_PROFILE_UPDATES: >- - Updates a user's profile in the app when the user's profile - changes in Okta (the profile source) - PUSH_USER_DEACTIVATION: >- - Deactivates a user's account in the app when unassigned from the - app in Okta or deactivated - REACTIVATE_USERS: >- - Reactivates an existing inactive user when provisioning a user - to the app - OUTBOUND_DEL_AUTH: >- - Okta user authentication requests are delegated to a third-party - app - DESKTOP_SSO: >- - Okta user authentication requests are handled by desktop SSO - negotiation (if possible) - FEDERATED_PROFILE: >- - App user profiles are synchronized at sign-in and profile-view - instances instead of during bulk imports - SUPPRESS_ACTIVATION_EMAIL: >- - Activation emails aren't sent to users sourced by AD and orgs - with DelAuth enabled - PUSH_PENDING_USERS: >- - Users are in PENDING state in Okta and are created but not - active in the sourced app user + IMPORT_PROFILE_UPDATES: Updates a linked user's app profile during manual or scheduled imports + IMPORT_USER_SCHEMA: Discovers the profile schema for a user from the app automatically + PROFILE_MASTERING: Designates the app as the identity lifecycle and profile attribute authority for linked users. The user's profile in Okta is read-only. + PUSH_NEW_USERS: Creates or links a user account in the app when assigning the app to a user in Okta + PUSH_PASSWORD_UPDATES: Updates the user's app password when their password changes in Okta + PUSH_PROFILE_UPDATES: Updates a user's profile in the app when the user's profile changes in Okta (the profile source) + PUSH_USER_DEACTIVATION: Deactivates a user's account in the app when unassigned from the app in Okta or deactivated + REACTIVATE_USERS: Reactivates an existing inactive user when provisioning a user to the app + OUTBOUND_DEL_AUTH: Okta user authentication requests are delegated to a third-party app + DESKTOP_SSO: Okta user authentication requests are handled by desktop SSO negotiation (if possible) + FEDERATED_PROFILE: App user profiles are synchronized at sign-in and profile-view instances instead of during bulk imports + SUPPRESS_ACTIVATION_EMAIL: Activation emails aren't sent to users sourced by AD and orgs with DelAuth enabled + PUSH_PENDING_USERS: Users are in PENDING state in Okta and are created but not active in the sourced app user MFA: App can verify credentials as a second factor UPDATE_EXISTING_USERNAME: App can update the user name for existing users EXCLUDE_USERNAME_UPDATE_ON_PROFILE_PUSH: Exclude username update during profile push @@ -1681,47 +1700,25 @@ components: IMPORT_SYNC_CONTACTS: Synchronize contacts DEVICE_COMPLIANCE: Apps support device compliance rules VPN_CONFIG: App supports pushing VPN configuration to OMM enrolled devices - IMPORT_SCHEMA_ENUM_VALUES: >- - App supports downloading schema enum values. You can download - custom objects and integrating them with UD without being tied - to the type metadata system. - SCIM_PROVISIONING: >- - App supports generic SCIM client provisioning and can leverage - SCIM standard for provisioning and push custom attributes to a - third-party app + IMPORT_SCHEMA_ENUM_VALUES: App supports downloading schema enum values. You can download custom objects and integrating them with UD without being tied to the type metadata system. + SCIM_PROVISIONING: App supports generic SCIM client provisioning and can leverage SCIM standard for provisioning and push custom attributes to a third-party app DEVICE_FILTER_IN_SIGN_ON_RULES: App supports filtering by client type in app sign-on rules - PROFILE_TEMPLATE_UPGRADE: >- - App supports profile template upgrades. This is primarily to - help roll out the profile template upgrade feature for - individual apps - DEFAULT_PUSH_STATUS_TO_PUSH: >- - App defaults Push status to `PUSH`. This feature is for apps, - such as SharePoint, that want to receive App User profile - updates even though they didn't implement traditional - PUSH_PROFILE_UPDATES in the client API. + PROFILE_TEMPLATE_UPGRADE: App supports profile template upgrades. This is primarily to help roll out the profile template upgrade feature for individual apps + DEFAULT_PUSH_STATUS_TO_PUSH: App defaults Push status to `PUSH`. This feature is for apps, such as SharePoint, that want to receive App User profile updates even though they didn't implement traditional PUSH_PROFILE_UPDATES in the client API. REAL_TIME_SYNC: Apps support real-time synchronization SSO: Apps support establishing a subject based on claims from an IdP - AUTHN_CONTEXT: >- - Apps support establishing an authentication context based on - claims from an IdP + AUTHN_CONTEXT: Apps support establishing an authentication context based on claims from an IdP JIT_PROVISIONING: Apps support provisioning a user based on claims from an IdP - GROUP_SYNC: >- - Apps support syncing group information based on claims from an - IdP + GROUP_SYNC: Apps support syncing group information based on claims from an IdP OPP_SCIM_INCREMENTAL_IMPORTS: Apps support incremental imports. Used for SCIM app instances - IN_MEMORY_APP_USER: >- - Apps support in-memory app users. This feature is used as an - alternative to Implicit App Assignment for a non-persisted app - user. + IN_MEMORY_APP_USER: Apps support in-memory app users. This feature is used as an alternative to Implicit App Assignment for a non-persisted app user. LOG_STREAMING: Apps support log streaming OAUTH_INTEGRATION: App is an OAuth 2.0 integration IDP: Apps support IdP functionalities PUSH_NEW_USERS_WITHOUT_PASSWORD: Don't send generated password for new users SKYHOOK_SERVICE: Use the Skyhook microservice for LCM operations ENTITLEMENT_MANAGEMENT: Marker to showcase which OIN apps are entitlement enabled - PUSH_NEW_USERS_WITH_HASHED_PASSWORD: >- - Send hashed password for new users. This feature is only used - for CIS to CIC migration. + PUSH_NEW_USERS_WITH_HASHED_PASSWORD: Send hashed password for new users. This feature is only used for CIS to CIC migration. id: type: string readOnly: true @@ -1741,22 +1738,13 @@ components: description: The Okta resource name (ORN) for the current app instance profile: type: object - description: >- - Contains any valid JSON schema for specifying properties that can be - referenced from a request (only available to OAuth 2.0 client apps). - - For example, add an app manager contact email address or define an - allowlist of groups that you can then reference using the Okta - Expression Language `getFilteredGroups` function. - + description: |- + Contains any valid JSON schema for specifying properties that can be referenced from a request (only available to OAuth 2.0 client apps). + For example, add an app manager contact email address or define an allowlist of groups that you can then reference using the Okta Expression Language `getFilteredGroups` function. > **Notes:** - > * `profile` isn't encrypted, so don't store sensitive data in it. - - > * `profile` doesn't limit the level of nesting in the JSON schema - you created, but there is a practical size limit. Okta recommends a - JSON schema size of 1 MB or less for best performance. + > * `profile` doesn't limit the level of nesting in the JSON schema you created, but there is a practical size limit. Okta recommends a JSON schema size of 1 MB or less for best performance. additionalProperties: true signOnMode: $ref: '#/components/schemas/ApplicationSignOnMode' @@ -1768,21 +1756,11 @@ components: $ref: '#/components/schemas/ApplicationVisibility' _embedded: type: object - description: >- - Embedded resources related to the app using the [JSON Hypertext - Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. If the `expand=user/{userId}` query parameter is - specified, then the assigned [Application - User](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/ApplicationUsers/) is - embedded. + description: Embedded resources related to the app using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. If the `expand=user/{userId}` query parameter is specified, then the assigned [Application User](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/applicationusers) is embedded. properties: user: type: object - description: >- - The specified [Application - User](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/ApplicationUsers/) - assigned to the app + description: The specified [Application User](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/applicationusers) assigned to the app additionalProperties: type: object properties: {} @@ -1820,17 +1798,12 @@ components: format: date-time readOnly: true originId: - description: >- - The ID of the app instance if the `originType` is `APPLICATION`. - This value is `NULL` if `originType` is `OKTA_DIRECTORY`. + description: The ID of the app instance if the `originType` is `APPLICATION`. This value is `NULL` if `originType` is `OKTA_DIRECTORY`. type: string originType: $ref: '#/components/schemas/GroupOwnerOriginType' resolved: - description: >- - If `originType`is APPLICATION, this parameter is set to `FALSE` - until the owner's `originId` is reconciled with an associated Okta - ID. + description: If `originType`is APPLICATION, this parameter is set to `FALSE` until the owner's `originId` is reconciled with an associated Okta ID. type: boolean type: $ref: '#/components/schemas/GroupOwnerType' @@ -1843,7 +1816,8 @@ components: type: $ref: '#/components/schemas/GroupOwnerType' StandardRole: - title: Standard Role Assignment + title: Standard role assignment + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: assignmentType: @@ -1867,9 +1841,11 @@ components: format: date-time readOnly: true status: - allOf: - - $ref: '#/components/schemas/LifecycleStatus' - - description: Status of the role assignment + type: string + enum: + - ACTIVE + - INACTIVE + description: Status of the role assignment type: $ref: '#/components/schemas/RoleType' _embedded: @@ -1895,8 +1871,11 @@ components: type: object _links: $ref: '#/components/schemas/LinksAssignee' + required: + - type CustomRole: title: Custom role assignment + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: assignmentType: @@ -1912,7 +1891,7 @@ components: readOnly: true label: type: string - description: Label for the custom role assignment + description: Label for the role assignment readOnly: true lastUpdated: type: string @@ -1925,28 +1904,42 @@ components: readOnly: true role: type: string - description: Custom role ID + description: Role ID readOnly: true status: - allOf: - - $ref: '#/components/schemas/LifecycleStatus' - - description: Status of the custom role assignment - type: type: string - description: CUSTOM for a custom role enum: - - CUSTOM + - ACTIVE + - INACTIVE + description: Status of the role assignment + type: + $ref: '#/components/schemas/RoleType' _links: $ref: '#/components/schemas/LinksCustomRoleResponse' + required: + - type StandardRoleAssignmentSchema: - title: Standard Role + title: Standard role type: object properties: type: type: string - description: >- - Specify the standard or IAM-based role type. See [standard - roles](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#standard-roles). + description: 'Specify a [standard admin role](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#standard-roles), an [IAM-based standard role](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#iam-based-standard-roles), or `CUSTOM` for a custom role type:' + enum: + - ACCESS_CERTIFICATIONS_ADMIN + - ACCESS_REQUESTS_ADMIN + - API_ACCESS_MANAGEMENT_ADMIN + - APP_ADMIN + - GROUP_MEMBERSHIP_ADMIN + - HELP_DESK_ADMIN + - ORG_ADMIN + - READ_ONLY_ADMIN + - REPORT_ADMIN + - SUPER_ADMIN + - USER_ADMIN + - WORKFLOWS_ADMIN + required: + - type CustomRoleAssignmentSchema: title: Custom Role type: object @@ -1959,9 +1952,13 @@ components: description: Custom role ID type: type: string - description: The type of role. Specify `CUSTOM` for a custom role. + description: 'Specify a [standard admin role](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#standard-roles), an [IAM-based standard role](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#iam-based-standard-roles), or `CUSTOM` for a custom role type:' enum: - CUSTOM + required: + - type + - role + - resource-set CatalogApplication: description: An app in the OIN catalog type: object @@ -1982,17 +1979,13 @@ components: features: type: array readOnly: true - description: >- - Features supported by the app. See app - [features](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Application/#tag/Application/operation/listApplications!c=200&path=0/features&t=response). + description: Features supported by the app. See app [features](https://developer.okta.com/docs/api/openapi/okta-management/management/application/listapplications#application/listapplications/t=response&c=200&path=&d=0/features). items: type: string id: type: string readOnly: true - description: >- - ID of the app instance. Okta returns this property only for apps not - in the OIN catalog. + description: ID of the app instance. Okta returns this property only for apps not in the OIN catalog. lastUpdated: type: string description: Timestamp when the object was last updated @@ -2001,14 +1994,10 @@ components: example: '2024-09-19T23:37:37.000Z' name: type: string - description: >- - App key name. For OIN catalog apps, this is a unique key for the app - definition. + description: App key name. For OIN catalog apps, this is a unique key for the app definition. signOnModes: type: array - description: >- - Authentication mode for the app. See app - [signOnMode](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Application/#tag/Application/operation/listApplications!c=200&path=0/signOnMode&t=response). + description: Authentication mode for the app. See app [signOnMode](https://developer.okta.com/docs/api/openapi/okta-management/management/application/listapplications#application/listapplications/t=response&c=200&path=&d=0/signonmode). items: type: string status: @@ -2022,12 +2011,7 @@ components: description: Website of the OIN catalog app _links: type: object - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using - the [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification readOnly: true properties: logo: @@ -2038,6 +2022,7 @@ components: self: $ref: '#/components/schemas/HrefObjectSelfLink' User: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: activated: @@ -2078,9 +2063,7 @@ components: $ref: '#/components/schemas/UserProfile' realmId: type: string - description: >- - The ID of the realm in which the user is residing. See - [Realms](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Realm/). + description: The ID of the realm in which the user is residing. See [Realms](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/realm). example: guo1bfiNtSnZYILxO0g4 readOnly: true status: @@ -2093,9 +2076,7 @@ components: nullable: true transitioningToStatus: type: string - description: >- - The target status of an in-progress asynchronous status transition. - This property is only returned if the user's state is transitioning. + description: The target status of an in-progress asynchronous status transition. This property is only returned if the user's state is transitioning. readOnly: true nullable: true enum: @@ -2104,136 +2085,448 @@ components: - PROVISIONED type: type: object - description: >- - The user type that determines the schema for the user's profile. The - `type` property is a map that identifies the [User - Types](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/#tag/UserType). + description: |- + The user type that determines the schema for the user's profile. The `type` property is a map that identifies the [User Types](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/#tag/UserType). - - Currently it contains a single element, `id`. It can be specified - when creating a new user, and ca be updated by an admin on a full - replace of an existing user (but not a partial update). + Currently it contains a single element, `id`. It can be specified when creating a new user, and can be updated by an admin on a full replace of an existing user (but not a partial update). properties: id: type: string description: The ID of the user type _embedded: type: object - description: >- - Embedded resources related to the user using the [JSON Hypertext - Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification + description: Embedded resources related to the user using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification additionalProperties: type: object properties: {} readOnly: true _links: - description: >- - Specifies link relations (see [Web - Linking](https://datatracker.ietf.org/doc/html/rfc8288) available - for the current status of a user. - - The links object is used for dynamic discovery of related resources, - lifecycle operations, and credential operations. The links object is - read-only. - - - For an individual user result, the links object contains a full set - of link relations available for that user as determined by your - policies. + description: |- + Specifies link relations (see [Web Linking](https://datatracker.ietf.org/doc/html/rfc8288) available for the current status of a user. + The links object is used for dynamic discovery of related resources, lifecycle operations, and credential operations. The links object is read-only. - For a collection of users, the links object contains only the `self` - link. Operations that return a collection of users include [List all - users](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#tag/User/operation/listUsers) - and [List all group member - users](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/Group/#tag/Group/operation/listGroupUsers). - allOf: - - $ref: '#/components/schemas/LinksSelf' - - type: object + For an individual user result, the links object contains a full set of link relations available for that user as determined by your policies. + For a collection of users, the links object contains only the `self` link. Operations that return a collection of users include [List all users](https://developer.okta.com/docs/api/openapi/okta-management/management/user/listusers) and [List all group member users](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Group/#tag/Group/operation/listGroupUsers). + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + activate: + description: URL to activate the user + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + resetPassword: + description: URL to reset the user's password + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + resetFactors: + description: URL to reset the user's factors + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + expirePassword: + description: URL to expire the user's password + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + forgotPassword: + description: URL to initiate a forgot password operation + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + changeRecoveryQuestion: + description: URL to change the user's recovery question + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object properties: - self: - description: URL to the individual user - allOf: - - $ref: '#/components/schemas/HrefObject' - activate: - description: URL to activate the user - allOf: - - $ref: '#/components/schemas/HrefObject' - resetPassword: - description: URL to reset the user's password - allOf: - - $ref: '#/components/schemas/HrefObject' - resetFactors: - description: URL to reset the user's factors - allOf: - - $ref: '#/components/schemas/HrefObject' - expirePassword: - description: URL to expire the user's password - allOf: - - $ref: '#/components/schemas/HrefObject' - forgotPassword: - description: URL to initiate a forgot password operation - allOf: - - $ref: '#/components/schemas/HrefObject' - changeRecoveryQuestion: - description: URL to change the user's recovery question - allOf: - - $ref: '#/components/schemas/HrefObject' - deactivate: - description: URL to deactivate a user - allOf: - - $ref: '#/components/schemas/HrefObject' - reactivate: - description: URL to reactivate the user - allOf: - - $ref: '#/components/schemas/HrefObject' - changePassword: - description: URL to change the user's password - allOf: - - $ref: '#/components/schemas/HrefObject' - schema: - description: URL to the user's profile schema - allOf: - - $ref: '#/components/schemas/HrefObject' - suspend: - description: URL to suspend the user - allOf: - - $ref: '#/components/schemas/HrefObject' - unsuspend: - description: URL to unsuspend the user - allOf: - - $ref: '#/components/schemas/HrefObject' - unlock: - description: URL to unlock the locked-out user - allOf: - - $ref: '#/components/schemas/HrefObject' + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true type: - description: URL to the user type - allOf: - - $ref: '#/components/schemas/HrefObject' - - readOnly: true + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + deactivate: + description: URL to deactivate a user + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + reactivate: + description: URL to reactivate the user + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + changePassword: + description: URL to change the user's password + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + schema: + description: URL to the user's profile schema + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + suspend: + description: URL to suspend the user + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + unsuspend: + description: URL to unsuspend the user + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + unlock: + description: URL to unlock the locked-out user + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + type: + description: URL to the user type + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + readOnly: true GroupProfile: - description: >- - Specifies required and optional properties for a group. The - `objectClass` of a group determines which additional properties are - available. - + description: |- + Profile for any group that is not imported from Active Directory. Specifies the standard + and custom profile properties for a group. - You can extend group profiles with custom properties, but you must first - add the properties to the group profile schema before you can reference - them. Use the Profile Editor in the Admin Console or the [Schemas - API](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/)to - manage schema extensions. + The `objectClass` for these groups is `okta:user_group`. + You can extend group profiles with custom properties, but you must first add the properties to the group profile schema before you can reference them. Use the Profile Editor in the Admin Console or the [Schemas API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/) to manage schema extensions. - Custom properties can contain HTML tags. It is the client's - responsibility to escape or encode this data before displaying it. Use - [best-practices](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) - to prevent cross-site scripting. - anyOf: - - $ref: '#/components/schemas/OktaUserGroupProfile' - - $ref: '#/components/schemas/OktaActiveDirectoryGroupProfile' + Custom properties can contain HTML tags. It is the client's responsibility to escape or encode this data before displaying it. Use [best-practices](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) to prevent cross-site scripting. + type: object + properties: + description: + type: string + example: All users West of The Rockies + description: Description of the group + name: + type: string + example: West Coast users + description: Name of the group + dn: + type: string + example: CN=West Coast users,OU=West Coast,DC=example,DC=com + description: The distinguished name of the Windows group + externalId: + type: string + example: VKzYZ1C+IkSZxIWlrW5ITg== + description: Base-64 encoded GUID (`objectGUID`) of the Windows group + samAccountName: + type: string + example: West Coast users + description: Pre-Windows 2000 name of the Windows group + windowsDomainQualifiedName: + type: string + example: EXAMPLE\\West Coast users + description: Fully qualified name of the Windows group + x-okta-extensible: true GroupType: description: Determines how a group's profile and memberships are managed type: string @@ -2242,29 +2535,18 @@ components: - BUILT_IN - OKTA_GROUP x-enumDescriptions: - APP_GROUP: >- - Group profile and memberships are imported and must be managed within - the app (such as Active Directory or LDAP) that imported the group - BUILT_IN: >- - Group profile and memberships are managed by Okta and can't be - modified - OKTA_GROUP: >- - Group profile and memberships are directly managed in Okta via static - assignments or indirectly through group rules + APP_GROUP: Group profile and memberships are imported and must be managed within the app (such as Active Directory or LDAP) that imported the group + BUILT_IN: Group profile and memberships are managed by Okta and can't be modified + OKTA_GROUP: Group profile and memberships are directly managed in Okta via static assignments or indirectly through group rules LinksSelf: - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the - [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. This object is used for dynamic discovery of related - resources and lifecycle operations. + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. type: object properties: self: $ref: '#/components/schemas/HrefObjectSelfLink' readOnly: true HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object additionalProperties: true type: object @@ -2281,15 +2563,11 @@ components: readOnly: true templated: type: boolean - description: >- - Indicates whether the link object's `href` property is a URI - template. + description: Indicates whether the link object's `href` property is a URI template. readOnly: true type: type: string - description: >- - The media type of the link. If omitted, it is implicitly - `application/json`. + description: The media type of the link. If omitted, it is implicitly `application/json`. readOnly: true required: - href @@ -2306,18 +2584,13 @@ components: description: An Okta code for this type of error errorId: type: string - description: >- - A unique identifier for this error. This can be used by Okta Support - to help with troubleshooting. + description: A unique identifier for this error. This can be used by Okta Support to help with troubleshooting. errorLink: type: string description: An Okta code for this type of error errorSummary: type: string - description: >- - A short description of what caused this error. Sometimes this - contains dynamically-generated information about your specific - error. + description: A short description of what caused this error. Sometimes this contains dynamically-generated information about your specific error. GroupRuleAction: description: Defines which users and groups to assign type: object @@ -2333,7 +2606,7 @@ components: people: $ref: '#/components/schemas/GroupRulePeopleCondition' GroupRuleStatus: - description: Status of group rule + description: Status of group rule. You can't update the status of a rule from `INACTIVE` to `ACTIVE`. You must use the activate and deactivate lifecycle operations. type: string enum: - ACTIVE @@ -2348,62 +2621,60 @@ components: description: Custom error page URL for the app loginRedirectUrl: type: string - description: >- + description: |- Custom login page URL for the app - - > **Note:** The `loginRedirectUrl` property is deprecated in - Identity Engine. This property is used with the custom app login - feature. Orgs that actively use this feature can continue to do so. - See [Okta-hosted sign-in (redirect - authentication)](https://developer.okta.com/docs/guides/redirect-authentication/) - or [configure IdP routing - rules](https://help.okta.com/okta_help.htm?type=oie&id=ext-cfg-routing-rules) - to redirect users to the appropriate sign-in app for orgs that don't - use the custom app login feature. + > **Note:** The `loginRedirectUrl` property is deprecated in Identity Engine. This property is used with the custom app login feature. Orgs that actively use this feature can continue to do so. See [Okta-hosted sign-in (redirect authentication)](https://developer.okta.com/docs/guides/redirect-authentication/) or [configure IdP routing rules](https://help.okta.com/okta_help.htm?type=oie&id=ext-cfg-routing-rules) to redirect users to the appropriate sign-in app for orgs that don't use the custom app login feature. selfService: type: boolean description: Represents whether the app can be self-assignable by users - ApplicationLabel: - description: User-defined display name for app - type: string - ApplicationLicensing: - description: Licenses for the app + ApplicationExpressConfiguration: + description: |- +

+ Indicates which Express Configuration capabilities the app supports and has enabled + type: object + properties: + enabledCapabilities: + type: array + description: Capabilities currently enabled for the app + items: + $ref: '#/components/schemas/ApplicationCapability' + example: + - SSO + supportedCapabilities: + type: array + description: Capabilities supported by the app + items: + $ref: '#/components/schemas/ApplicationCapability' + example: + - SSO + - PROVISIONING + - UNIVERSAL_LOGOUT + readOnly: true + ApplicationLabel: + description: User-defined display name for app + type: string + ApplicationLicensing: + description: Licenses for the app type: object properties: seatCount: type: integer description: Number of licenses purchased for the app ApplicationSignOnMode: - description: > + description: | Authentication mode for the app - | signOnMode | Description | - | ---------- | ----------- | - | AUTO_LOGIN | Secure Web Authentication (SWA) | - | BASIC_AUTH | HTTP Basic Authentication with Okta Browser Plugin | - | BOOKMARK | Just a bookmark (no-authentication) | - - | BROWSER_PLUGIN | Secure Web Authentication (SWA) with Okta Browser - Plugin | - + | BROWSER_PLUGIN | Secure Web Authentication (SWA) with Okta Browser Plugin | | OPENID_CONNECT | Federated Authentication with OpenID Connect (OIDC) | - - | SAML_1_1 | Federated Authentication with SAML 1.1 WebSSO (not - supported for custom apps) | - + | SAML_1_1 | Federated Authentication with SAML 1.1 WebSSO (not supported for custom apps) | | SAML_2_0 | Federated Authentication with SAML 2.0 WebSSO | - - | SECURE_PASSWORD_STORE | Secure Web Authentication (SWA) with POST - (plugin not required) | - - | WS_FEDERATION | Federated Authentication with WS-Federation Passive - Requestor Profile | - + | SECURE_PASSWORD_STORE | Secure Web Authentication (SWA) with POST (plugin not required) | + | WS_FEDERATION | Federated Authentication with WS-Federation Passive Requestor Profile | Select the `signOnMode` for your custom app: type: string @@ -2426,12 +2697,9 @@ components: - INACTIVE readOnly: true ApplicationUniversalLogout: - description: >- -
- - Universal Logout properties for the app. These properties are only - returned and can't be updated. + description: |- +
+ Universal Logout properties for the app. These properties are only returned and can't be updated. x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false @@ -2441,9 +2709,7 @@ components: properties: identityStack: type: string - description: >- - Indicates whether the app uses a shared identity stack that may - cause the user to sign out of other apps by the same company + description: Indicates whether the app uses a shared identity stack that may cause the user to sign out of other apps by the same company enum: - SHARED - NOT_SHARED @@ -2456,11 +2722,7 @@ components: - GLOBAL_TOKEN_REVOCATION x-enumDescriptions: PROPRIETARY: Universal Logout is implemented with a proprietary method. - GLOBAL_TOKEN_REVOCATION: >- - Universal Logout is implemented with the [Global Token - Revocation](https://datatracker.ietf.org/doc/draft-parecki-oauth-global-token-revocation/) - protocol. See the [Global Token Revocation - API](https://developer.okta.com/docs/api/openapi/okta-oauth/oauth/tag/GlobalTokenRevocation/). + GLOBAL_TOKEN_REVOCATION: Universal Logout is implemented with the [Global Token Revocation](https://datatracker.ietf.org/doc/draft-parecki-oauth-global-token-revocation/) protocol. See the [Global Token Revocation API](https://developer.okta.com/docs/api/openapi/okta-oauth/oauth/tag/GlobalTokenRevocation/). example: PROPRIETARY status: type: string @@ -2471,26 +2733,18 @@ components: - UNSUPPORTED example: ENABLED x-enumDescriptions: - ENABLED: >- - Universal Logout is enabled. Users are signed out of the app - instance when the Okta system or an admin initiates logout. + ENABLED: Universal Logout is enabled. Users are signed out of the app instance when the Okta system or an admin initiates logout. DISABLED: Universal Logout is disabled UNSUPPORTED: The app doesn't support Universal Logout supportType: type: string - description: >- - Indicates whether the app supports full or partial Universal Logout - (UL). + description: Indicates whether the app supports full or partial Universal Logout (UL). enum: - FULL - PARTIAL x-enumDescriptions: - FULL: >- - Full UL support (users are signed out of an app when the Okta - system or an admin initiates logout) - PARTIAL: >- - This app's sign-out behavior can be different from other supported - UL apps. + FULL: Full UL support (users are signed out of an app when the Okta system or an admin initiates logout) + PARTIAL: This app's sign-out behavior can be different from other supported UL apps. example: FULL readOnly: true ApplicationVisibility: @@ -2499,9 +2753,7 @@ components: properties: appLinks: type: object - description: >- - Links or icons that appear on the End-User Dashboard if they're set - to `true`. + description: Links or icons that appear on the End-User Dashboard if they're set to `true`. additionalProperties: type: boolean autoLaunch: @@ -2572,59 +2824,46 @@ components: - ACTIVE - INACTIVE RoleType: - description: Standard role type + title: roleType + description: |- + | Role type | Description | + |------------------------------|-------------------------------------------------------------| + | ACCESS_CERTIFICATIONS_ADMIN | Access Certifications Administrator IAM-based standard role | + | ACCESS_REQUESTS_ADMIN | Access Requests Administrator IAM-based standard role | + | API_ACCESS_MANAGEMENT_ADMIN | Access Management Administrator standard role | + | APP_ADMIN | Application Administrator standard role | + | CUSTOM | Custom admin role | + | GROUP_MEMBERSHIP_ADMIN | Group Membership Administrator standard role | + | HELP_DESK_ADMIN | Help Desk Administrator standard role | + | ORG_ADMIN | Organizational Administrator standard role | + | READ_ONLY_ADMIN | Read-Only Administrator standard role | + | REPORT_ADMIN | Report Administrator standard role | + | SUPER_ADMIN | Super Administrator standard role | + | USER_ADMIN | User Administrator standard role | + | WORKFLOWS_ADMIN | Workflows Administrator IAM-based standard role | type: string enum: - ACCESS_CERTIFICATIONS_ADMIN - ACCESS_REQUESTS_ADMIN - API_ACCESS_MANAGEMENT_ADMIN - - API_ADMIN - APP_ADMIN - CUSTOM - GROUP_MEMBERSHIP_ADMIN - HELP_DESK_ADMIN - - MOBILE_ADMIN - ORG_ADMIN - READ_ONLY_ADMIN - REPORT_ADMIN - SUPER_ADMIN - USER_ADMIN - WORKFLOWS_ADMIN - x-enumDescriptions: - API_ACCESS_MANAGEMENT_ADMIN: Access Management Administrator - API_ADMIN: Access Management Administrator - APP_ADMIN: Application Administrator - CUSTOM: Custom label specified by the client - GROUP_MEMBERSHIP_ADMIN: Group Membership Administrator - HELP_DESK_ADMIN: Help Desk Administrator - MOBILE_ADMIN: Mobile Administrator - ORG_ADMIN: Organizational Administrator - READ_ONLY_ADMIN: Read-Only Administrator - REPORT_ADMIN: Report Administrator - SUPER_ADMIN: Super Administrator - USER_ADMIN: Group Administrator - WORKFLOWS_ADMIN: Workflows Administrator - ACCESS_CERTIFICATIONS_ADMIN: Access Certifications Administrator (predefined resource sets) - ACCESS_REQUESTS_ADMIN: Access Requests Administrator (predefined resource sets) LinksAssignee: - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the - [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. type: object properties: assignee: $ref: '#/components/schemas/HrefObjectAssigneeLink' LinksCustomRoleResponse: - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the - [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. This object is used for dynamic discovery of related - resources. + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources. type: object properties: assignee: @@ -2644,18 +2883,61 @@ components: - ACTIVE - INACTIVE HrefObjectLogoLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the logo resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the logo resource HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) UserCredentials: - description: >- - Specifies primary authentication and recovery credentials for a user. - Credential types and requirements vary depending on the provider and - security policy of the org. + description: Specifies primary authentication and recovery credentials for a user. Credential types and requirements vary depending on the provider and security policy of the org. type: object properties: password: @@ -2666,37 +2948,17 @@ components: $ref: '#/components/schemas/RecoveryQuestionCredential' UserProfile: additionalProperties: true - description: >- + description: |- Specifies the default and custom profile properties for a user. + The default user profile is based on the [System for Cross-domain Identity Management: Core Schema](https://datatracker.ietf.org/doc/html/rfc7643). - The default user profile is based on the [System for Cross-domain - Identity Management: Core - Schema](https://datatracker.ietf.org/doc/html/rfc7643). - - - The only permitted customizations of the default profile are to update - permissions, change whether the `firstName` and `lastName` properties - are nullable, and specify a - [pattern](https://developer.okta.com/docs/reference/api/schemas/#login-pattern-validation) - for `login`. You can use the Profile Editor in the Admin Console or the - [Schemas - API](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/UISchema/#tag/UISchema) - to make schema modifications. + The only permitted customizations of the default profile are to update permissions, change whether the `firstName` and `lastName` properties are nullable, and specify a [pattern](https://developer.okta.com/docs/reference/api/schemas/#login-pattern-validation) for `login`. You can use the Profile Editor in the Admin Console or the [Schemas API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UISchema/#tag/UISchema) to make schema modifications. + You can extend user profiles with custom properties. You must first add the custom property to the user profile schema before you reference it. + You can use the Profile Editor in the Admin Console or the [Schemas API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UISchema/#tag/UISchema) to manage schema extensions. - You can extend user profiles with custom properties. You must first add - the custom property to the user profile schema before you reference it. - - You can use the Profile Editor in the Admin Console or the [Schemas - API](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/UISchema/#tag/UISchema) - to manage schema extensions. - - - Custom attributes can contain HTML tags. It's the client's - responsibility to escape or encode this data before displaying it. Use - [best-practices](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) - to prevent cross-site scripting. + Custom attributes can contain HTML tags. It's the client's responsibility to escape or encode this data before displaying it. Use [best-practices](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) to prevent cross-site scripting. type: object properties: city: @@ -2709,10 +2971,7 @@ components: description: Name of the cost center assigned to a user nullable: true countryCode: - description: >- - The country name component of the user's address (`country`). For - validation, see [ISO 3166-1 alpha 2 "short" code - format](https://datatracker.ietf.org/doc/html/draft-ietf-scim-core-schema-22#ref-ISO3166). + description: The country name component of the user's address (`country`). For validation, see [ISO 3166-1 alpha 2 "short" code format](https://datatracker.ietf.org/doc/html/draft-ietf-scim-core-schema-22#ref-ISO3166). type: string maxLength: 2 nullable: true @@ -2729,10 +2988,7 @@ components: nullable: true email: type: string - description: >- - The primary email address of the user. For validation, see [RFC 5322 - Section - 3.2.3](https://datatracker.ietf.org/doc/html/rfc5322#section-3.2.3). + description: The primary email address of the user. For validation, see [RFC 5322 Section 3.2.3](https://datatracker.ietf.org/doc/html/rfc5322#section-3.2.3). format: email minLength: 5 maxLength: 100 @@ -2761,47 +3017,20 @@ components: nullable: true locale: type: string - description: >- - The user's default location for purposes of localizing items such as - currency, date time format, numerical representations, and so on. - - A locale value is a concatenation of the ISO 639-1 two-letter - language code, an underscore, and the ISO 3166-1 two-letter country - code. For example, en_US specifies the language English and country - US. This value is `en_US` by default. + description: |- + The user's default location for purposes of localizing items such as currency, date time format, numerical representations, and so on. + A locale value is a concatenation of the ISO 639-1 two-letter language code, an underscore, and the ISO 3166-1 two-letter country code. For example, en_US specifies the language English and country US. This value is `en_US` by default. login: type: string - description: >- - The unique identifier for the user (`username`). For validation, see - [Login pattern - validation](https://developer.okta.com/docs/reference/api/schemas/#login-pattern-validation). - - - Every user within your Okta org must have a unique identifier for a - login. This constraint applies to all users you import from other - systems or applications such as Active Directory. Your organization - is the top-level namespace to mix and match logins from all your - connected applications or directories. Careful consideration of - naming conventions for your login identifier will make it easier to - onboard new applications in the future. + description: |- + The unique identifier for the user (`username`). For validation, see [Login pattern validation](https://developer.okta.com/docs/reference/api/schemas/#login-pattern-validation). + Every user within your Okta org must have a unique identifier for a login. This constraint applies to all users you import from other systems or applications such as Active Directory. Your organization is the top-level namespace to mix and match logins from all your connected applications or directories. Careful consideration of naming conventions for your login identifier will make it easier to onboard new applications in the future. - Logins are not considered unique if they differ only in case and/or - diacritical marks. If one of your users has a login of - Isaac.Brock@example.com, there cannot be another user whose login is - isaac.brock@example.com, nor isáàc.bröck@example.com. + Logins are not considered unique if they differ only in case and/or diacritical marks. If one of your users has a login of `Isaac.Brock@example.com`, there cannot be another user whose login is `isaac.brock@example.com`, nor `isáàc.bröck@example.com`. - - Okta has a default ambiguous name resolution policy for usernames - that include @-signs. (By default, usernames must be formatted as - email addresses and thus always include @-signs. You can remove that - restriction using either the Admin Console or the [Schemas - API](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/). - Users can sign in with their non-qualified short name (for example: - isaac.brock with username isaac.brock@example.com) as long as the - short name is still unique within the organization. - - maxLength: 100 + Okta has a default ambiguous name resolution policy for usernames that include @-signs. By default, usernames must be formatted as email addresses and thus always include @-signs. You can remove that restriction using either the Admin Console or the [Schemas API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/). Users can sign in with their non-qualified short name (for example: `isaac.brock` with username `isaac.brock@example.com`) as long as the short name is still unique within the org. + maxLength: 100 minLength: 5 manager: type: string @@ -2836,10 +3065,7 @@ components: nullable: true preferredLanguage: type: string - description: >- - The user's preferred written or spoken language. For validation, see - [RFC 7231 Section - 5.3.5](https://datatracker.ietf.org/doc/html/rfc7231#section-5.3.5). + description: The user's preferred written or spoken language. For validation, see [RFC 7231 Section 5.3.5](https://datatracker.ietf.org/doc/html/rfc7231#section-5.3.5). nullable: true primaryPhone: type: string @@ -2849,18 +3075,12 @@ components: nullable: true profileUrl: type: string - description: >- - The URL of the user's online profile. For example, a web page. See - [URL](https://datatracker.ietf.org/doc/html/rfc1808). + description: The URL of the user's online profile. For example, a web page. See [URL](https://datatracker.ietf.org/doc/html/rfc1808). nullable: true secondEmail: type: string format: email - description: >- - The secondary email address of the user typically used for account - recovery. For validation, see [RFC 5322 Section - 3.2.3](https://datatracker.ietf.org/doc/html/rfc5322#section-3.2.3). - minLength: 5 + description: The secondary email address of the user typically used for account recovery. For validation, see [RFC 5322 Section 3.2.3](https://datatracker.ietf.org/doc/html/rfc5322#section-3.2.3). maxLength: 100 nullable: true state: @@ -2883,29 +3103,23 @@ components: nullable: true userType: type: string - description: >- - The property used to describe the organization-to-user relationship, - such as employee or contractor + description: |- + The property used to describe the organization-to-user relationship, such as employee or contractor + + > **Note:** The `userType` property is a standard string attribute and should be treated as a descriptive label rather than a functional setting. Unlike a user's assigned user [`type`](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#tag/User/operation/createUser!path=type&t=request), this property is purely informational and doesn't influence the behavior of the Okta platform. nullable: true zipCode: type: string - description: >- - The ZIP code or postal code component of the user's address - (`postalCode`) + description: The ZIP code or postal code component of the user's address (`postalCode`) maxLength: 50 nullable: true UserStatus: - description: >- + description: |- The current status of the user. + The status of a user changes in response to explicit events, such as admin-driven lifecycle changes, user login, or self-service password recovery. Okta doesn't asynchronously sweep through users and update their password expiry state, for example. Instead, Okta evaluates password policy at login time, notices the password has expired, and moves the user to the expired state. When running reports, remember that the data is valid as of the last login or lifecycle event for that user. - The status of a user changes in response to explicit events, such as - admin-driven lifecycle changes, user login, or self-service password - recovery. Okta doesn't asynchronously sweep through users and update - their password expiry state, for example. Instead, Okta evaluates - password policy at login time, notices the password has expired, and - moves the user to the expired state. When running reports, remember that - the data is valid as of the last login or lifecycle event for that user. + > **Note:** The `ACTIVATING` status is a transitional status that occurs when a user is being activated but hasn't completed the activation process. This status isn't directly settable through the API, nor should you use it for any of your user management workflows. type: string enum: - ACTIVE @@ -2922,6 +3136,10 @@ components: Profile for a group that is imported from Active Directory. The `objectClass` for such groups is `okta:windows_security_principal`. + + You can extend group profiles with custom properties, but you must first add the properties to the group profile schema before you can reference them. Use the Profile Editor in the Admin Console or the [Schemas API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/) to manage schema extensions. + + Custom properties can contain HTML tags. It is the client's responsibility to escape or encode this data before displaying it. Use [best-practices](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) to prevent cross-site scripting. type: object properties: description: @@ -2959,130 +3177,389 @@ components: ErrorCause: type: object properties: - errorSummary: + errorSummary: + type: string + GroupRuleGroupAssignment: + description: Contains the `groupIds` array + type: object + properties: + groupIds: + description: Array of `groupIds` to which users are added + type: array + items: + type: string + GroupRuleExpression: + description: Defines Okta specific [group-rules expression](https://developer.okta.com/docs/reference/okta-expression-language/#expressions-in-group-rules) + type: object + properties: + type: + type: string + description: Expression type. Only valid value is '`urn:okta:expression:1.0`'. + value: + type: string + description: Okta expression that would result in a Boolean value + example: user.role==\"Engineer\" + GroupRulePeopleCondition: + description: Defines conditions for `people` in a group rule + type: object + properties: + groups: + $ref: '#/components/schemas/GroupRuleGroupCondition' + users: + $ref: '#/components/schemas/GroupRuleUserCondition' + ApplicationCapability: + description: Capabilities supported by the app + type: string + enum: + - PROVISIONING + - SSO + - UNIVERSAL_LOGOUT + ApplicationVisibilityHide: + description: Hides the app for specific end-user apps + type: object + properties: + iOS: + type: boolean + description: Okta Mobile for iOS or Android (pre-dates Android) + default: false + example: false + web: + type: boolean + description: Okta End-User Dashboard on a web browser + default: false + example: true + AccessPolicyLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the app access policy resource + HrefObjectActivateLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to activate the resource + HrefObjectDeactivateLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to deactivate the resource + GroupsLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the [Application Groups](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/applicationgroups/other/listapplicationgroupassignments) resource + HelpLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the app help resource + MetadataLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the [SAML metadata](https://developer.okta.com/docs/api/openapi/okta-management/management/applicationsso/previewsamlmetadataforapplication) for SSO + UsersLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the [Application Users](https://developer.okta.com/docs/api/openapi/okta-management/management/applicationusers#tag/ApplicationUsers/operation/listApplicationUsers) resource + HrefObjectAssigneeLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the assignee resource + HrefObjectMemberLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the member resource + HrefObjectPermissionsLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the permissions resource + HrefObjectResourceSetLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: type: string - GroupRuleGroupAssignment: - description: Contains the `groupIds` array - type: object - properties: - groupIds: - description: Array of `groupIds` to which users are added - type: array - items: - type: string - GroupRuleExpression: - description: >- - Defines Okta specific [group-rules - expression](https://developer.okta.com/docs/reference/okta-expression-language/#expressions-in-group-rules) - type: object - properties: - type: + description: Link URI + name: type: string - description: Expression type. Only valid value is '`urn:okta:expression:1.0`'. - value: + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: type: string - description: Okta expression that would result in a Boolean value - example: user.role==\"Engineer\" - GroupRulePeopleCondition: - description: Defines conditions for `people` in a group rule - type: object - properties: - groups: - $ref: '#/components/schemas/GroupRuleGroupCondition' - users: - $ref: '#/components/schemas/GroupRuleUserCondition' - ApplicationVisibilityHide: - description: Hides the app for specific end-user apps + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the resource set resource + HrefObjectRoleLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true type: object properties: - iOS: - type: boolean - description: Okta Mobile for iOS or Android (pre-dates Android) - default: false - example: false - web: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: type: boolean - description: Okta End-User Dashboard on a web browser - default: false - example: true - AccessPolicyLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the app access policy resource - HrefObjectActivateLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to activate the resource - HrefObjectDeactivateLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to deactivate the resource - GroupsLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: >- - Link to the [Application - Groups](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/ApplicationGroups/#tag/ApplicationGroups/operation/listApplicationGroupAssignments) - resource - HelpLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the app help resource - MetadataLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: >- - Link to the [SAML - metadata](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/ApplicationSSO/#tag/ApplicationSSO/operation/previewSAMLmetadataForApplication) - for SSO - UsersLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: >- - Link to the [Application - Users](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/ApplicationUsers/#tag/ApplicationUsers/operation/listApplicationUsers) - resource - HrefObjectAssigneeLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the assignee resource - HrefObjectMemberLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the member resource - HrefObjectPermissionsLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the permissions resource - HrefObjectResourceSetLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource set resource - HrefObjectRoleLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the role resource + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the role resource PasswordCredential: - description: >- + description: |- Specifies a password for a user. + When a user has a valid password, imported hashed password, or password hook, and a response object contains + a password credential, then the password object is a bare object without the value property defined (for example, `password: {}`). This indicates that a password value exists. You can modify password policy requirements in the Admin Console by editing the Password authenticator: **Security** > **Authenticators** > **Password** (or for Okta Classic orgs, use **Security** > **Authentication** > **Password**). - When a user has a valid password, imported hashed password, or password - hook, and a response object contains - - a password credential, then the password object is a bare object without - the value property defined (for example, `password: {}`). This indicates - that a password value exists. You can modify password policy - requirements in the Admin Console by editing the Password - authenticator: **Security** > **Authenticators** > **Password** (or for - Okta Classic orgs, use **Security** > **Authentication** > - **Password**). - - - For information on defaults and configuring your password policies, see - [Configure the password - authenticator](https://help.okta.com/okta_help.htm?type=oie&id=ext-configure-password) - in the help documentation. + For information on defaults and configuring your password policies, see [Configure the password authenticator](https://help.okta.com/okta_help.htm?type=oie&id=ext-configure-password) in the help documentation. type: object properties: hash: @@ -3092,17 +3569,11 @@ components: value: type: string writeOnly: true - description: >- - Specifies the password for a user. The password policy validates - this password. + description: Specifies the password for a user. The password policy validates this password. format: password example: pa$$word AuthenticationProvider: - description: >- - Specifies the authentication provider that validates the user's password - credential. The user's current provider is managed by the **Delegated - Authentication** settings for your org. The provider object is - **read-only**. + description: Specifies the authentication provider that validates the user's password credential. The user's current provider is managed by the **Delegated Authentication** settings for your org. The provider object is **read-only**. type: object properties: name: @@ -3114,10 +3585,8 @@ components: $ref: '#/components/schemas/AuthenticationProviderType' readOnly: true RecoveryQuestionCredential: - description: >- - Specifies a secret question and answer that's validated (case - insensitive) when a user forgets their - + description: |- + Specifies a secret question and answer that's validated (case insensitive) when a user forgets their password or unlocks their account. The answer property is write-only. type: object properties: @@ -3160,14 +3629,11 @@ components: items: type: string PasswordCredentialHash: - description: >- - Specifies a hashed password to import into Okta. This allows an existing - password to be imported into Okta directly - - from some other store. Okta supports the BCRYPT, SHA-512, SHA-256, - SHA-1, MD5, and PBKDF2 hash functions for password import. + description: |- + Specifies a hashed password to import into Okta. This allows an existing password to be imported into Okta directly + from some other store. Okta supports the BCRYPT, SHA-512, SHA-256, SHA-1, MD5, and PBKDF2 hash functions for password import. A hashed password may be specified in a password object when creating or updating a user, but not for other operations. - See the [Create user with imported hashed password](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#create-user-with-imported-hashed-password) description. When you update a user with a hashed password, the user must be in the `STAGED` status. + See the [Create user with imported hashed password](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#create-user-with-imported-hashed-password) description. When you update a user with a hashed password, the user must be in the `STAGED` status. type: object properties: algorithm: @@ -3176,59 +3642,33 @@ components: $ref: '#/components/schemas/DigestAlgorithm' iterationCount: type: integer - description: >- - The number of iterations used when hashing passwords using PBKDF2. - Must be >= 4096. Only required for PBKDF2 algorithm. + description: The number of iterations used when hashing passwords using PBKDF2. Must be >= 4096. Only required for PBKDF2 algorithm. keySize: type: integer - description: >- - Size of the derived key in bytes. Only required for PBKDF2 - algorithm. + description: Size of the derived key in bytes. Only required for PBKDF2 algorithm. salt: - description: >- - Only required for salted hashes. For BCRYPT, this specifies Radix-64 - as the encoded salt used to generate the hash, - - which must be 22 characters long. For other salted hashes, this - specifies the Base64-encoded salt used to - + description: |- + Only required for salted hashes. For BCRYPT, this specifies Radix-64 as the encoded salt used to generate the hash, + which must be 22 characters long. For other salted hashes, this specifies the Base64-encoded salt used to generate the hash. type: string saltOrder: type: string - description: >- - Specifies whether salt was pre- or postfixed to the password before - hashing. Only required for salted algorithms. + description: Specifies whether salt was pre- or postfixed to the password before hashing. Only required for salted algorithms. value: - description: >- - For SHA-512, SHA-256, SHA-1, MD5, and PBKDF2, this is the actual - base64-encoded hash of the password (and salt, if used). - - This is the Base64-encoded `value` of the - SHA-512/SHA-256/SHA-1/MD5/PBKDF2 digest that was computed by either - pre-fixing or post-fixing - - the `salt` to the `password`, depending on the `saltOrder`. If a - `salt` was not used in the `source` system, then this should just be - - the Base64-encoded `value` of the password's - SHA-512/SHA-256/SHA-1/MD5/PBKDF2 digest. For BCRYPT, this is the - actual Radix-64 encoded hashed password. + description: |- + For SHA-512, SHA-256, SHA-1, MD5, and PBKDF2, this is the actual base64-encoded hash of the password (and salt, if used). + This is the Base64-encoded `value` of the SHA-512/SHA-256/SHA-1/MD5/PBKDF2 digest that was computed by either pre-fixing or post-fixing + the `salt` to the `password`, depending on the `saltOrder`. If a `salt` was not used in the `source` system, then this should just be + the Base64-encoded `value` of the password's SHA-512/SHA-256/SHA-1/MD5/PBKDF2 digest. For BCRYPT, this is the actual Radix-64 encoded hashed password. type: string workFactor: type: integer - description: >- - Governs the strength of the hash and the time required to compute - it. Only required for BCRYPT algorithm. + description: Governs the strength of the hash and the time required to compute it. Only required for BCRYPT algorithm. minimum: 1 maximum: 20 PasswordCredentialHook: - description: >- - Specify a [password import inline - hook](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/InlineHook/#tag/InlineHook/operation/createPasswordImportInlineHook) - to trigger verification of the user's password the first time the user - signs in. This allows an existing password to be imported into Okta - directly from some other store. + description: Specify a [password import inline hook](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/inlinehook/createpasswordimportinlinehook) to trigger verification of the user's password the first time the user signs in. This allows an existing password to be imported into Okta directly from some other store. type: object properties: type: @@ -3245,26 +3685,15 @@ components: - OKTA - SOCIAL x-enumDescriptions: - ACTIVE_DIRECTORY: >- - Specifies the Microsoft Active Directory instance name as the `name` - property - FEDERATION: >- - Specifies a federated identity provider (such as an SAML IdP) that - validates the user's password credentials. Doesn't support a - `password` or `recovery question` credential. The user must - authenticate through a trusted identity provider. + ACTIVE_DIRECTORY: Specifies the Microsoft Active Directory instance name as the `name` property + FEDERATION: Specifies a federated identity provider (such as an SAML IdP) that validates the user's password credentials. Doesn't support a `password` or `recovery question` credential. The user must authenticate through a trusted identity provider. IMPORT: Specifies a hashed password that was imported from an external source LDAP: Specifies the LDAP directory instance name as the `name` property OKTA: Specifies the Okta identity provider - SOCIAL: >- - Specifies an OIDC or third-party social identity provider. Doesn't - support a `password` or `recovery question` credential. The user must - authenticate through a trusted identity provider. + SOCIAL: Specifies an OIDC or third-party social identity provider. Doesn't support a `password` or `recovery question` credential. The user must authenticate through a trusted identity provider. readOnly: true PasswordCredentialHashAlgorithm: - description: >- - The algorithm used to generate the hash using the password (and salt, - when applicable). + description: The algorithm used to generate the hash using the password (and salt, when applicable). type: string enum: - BCRYPT @@ -3274,13 +3703,86 @@ components: - SHA-256 - SHA-512 DigestAlgorithm: - description: >- - Algorithm used to generate the key. Only required for the PBKDF2 - algorithm. + description: Algorithm used to generate the key. Only required for the PBKDF2 algorithm. type: string enum: - SHA256_HMAC - SHA512_HMAC + ListGroupsResponse: + type: object + properties: + groups: + type: array + items: + $ref: '#/components/schemas/Group' + ListGroupRulesResponse: + type: object + properties: + group_rules: + type: array + items: + $ref: '#/components/schemas/GroupRule' + ListAssignedApplicationsForGroupResponse: + type: object + properties: + assigned_applications_for_group: + type: array + items: + $ref: '#/components/schemas/Application' + ListGroupOwnersResponse: + type: object + properties: + group_owners: + type: array + items: + $ref: '#/components/schemas/GroupOwner' + ListGroupAssignedRolesResponse: + type: object + properties: + group_assigned_roles: + type: array + items: + oneOf: + - $ref: '#/components/schemas/StandardRole' + - $ref: '#/components/schemas/CustomRole' + discriminator: + propertyName: type + mapping: + API_ACCESS_MANAGEMENT_ADMIN: '#/components/schemas/StandardRole' + APP_ADMIN: '#/components/schemas/StandardRole' + GROUP_MEMBERSHIP_ADMIN: '#/components/schemas/StandardRole' + HELP_DESK_ADMIN: '#/components/schemas/StandardRole' + MOBILE_ADMIN: '#/components/schemas/StandardRole' + ORG_ADMIN: '#/components/schemas/StandardRole' + READ_ONLY_ADMIN: '#/components/schemas/StandardRole' + REPORT_ADMIN: '#/components/schemas/StandardRole' + SUPER_ADMIN: '#/components/schemas/StandardRole' + USER_ADMIN: '#/components/schemas/StandardRole' + WORKFLOWS_ADMIN: '#/components/schemas/CustomRole' + ACCESS_CERTIFICATIONS_ADMIN: '#/components/schemas/CustomRole' + ACCESS_REQUESTS_ADMIN: '#/components/schemas/CustomRole' + CUSTOM: '#/components/schemas/CustomRole' + ListApplicationTargetsForApplicationAdministratorRoleForGroupResponse: + type: object + properties: + application_targets_for_application_administrator_role_for_group: + type: array + items: + $ref: '#/components/schemas/CatalogApplication' + ListGroupTargetsForGroupRoleResponse: + type: object + properties: + group_targets_for_group_role: + type: array + items: + $ref: '#/components/schemas/Group' + ListGroupUsersResponse: + type: object + properties: + group_users: + type: array + items: + $ref: '#/components/schemas/User' responses: ErrorAccessDenied403: description: Forbidden @@ -3319,6 +3821,22 @@ components: ResourceNotFound: $ref: '#/components/examples/ErrorResourceNotFound' parameters: + querySortOrder: + name: sortOrder + in: query + description: 'Specifies sort order: `asc` or `desc` (for search queries only). This parameter is ignored if `sortBy` isn''t present.' + schema: + type: string + default: asc + queryExpandGroupIdToGroupNameMap: + name: expand + in: query + description: If specified, returns the mapping of group IDs to group names in the `_embedded` object. + schema: + type: string + enum: + - groupIdToGroupNameMap + x-okta-added-version: 1.3.0 pathGroupRuleId: name: groupRuleId description: The `id` of the group rule @@ -3345,10 +3863,7 @@ components: example: 00u1emaK22TWRYd3TtG pathQueryRoleExpand: name: expand - description: >- - An optional parameter used to return targets configured for the standard - role assignment in the `embedded` property. Supported values: - `targets/groups` or `targets/catalog/apps` + description: 'An optional parameter used to return targets configured for the standard role assignment in the `embedded` property. Supported values: `targets/groups` or `targets/catalog/apps`' in: query required: false schema: @@ -3373,11 +3888,7 @@ components: in: query schema: type: string - description: >- - The cursor to use for pagination. It is an opaque string that specifies - your current location in the list and is obtained from the `Link` - response header. See - [Pagination](https://developer.okta.com/docs/api/#pagination). + description: The cursor to use for pagination. It is an opaque string that specifies your current location in the list and is obtained from the `Link` response header. See [Pagination](https://developer.okta.com/docs/api/#pagination) and [Link header](https://developer.okta.com/docs/api/#link-header). queryLimit: name: limit in: query @@ -3442,8 +3953,7 @@ components: href: https://{yourOktaDomain}/img/logos/groups/okta-large.png type: image/png users: - href: >- - https://{yourOktaDomain}/api/v1/groups/00g1emaKYZTWRYYRRTSK/users + href: https://{yourOktaDomain}/api/v1/groups/00g1emaKYZTWRYYRRTSK/users apps: href: https://{yourOktaDomain}/api/v1/groups/00g1emaKYZTWRYYRRTSK/apps - id: 00garwpuyxHaWOkdV0g4 @@ -3463,25 +3973,120 @@ components: dn: CN=Engineering users,OU=Engineering,DC=corp,DC=example,DC=com windowsDomainQualifiedName: CORP\Engineering users externalId: OZJdWdONCU6h7WjQKp+LPA== - source: - id: 0oa2v0el0gP90aqjJ0g7 _links: logo: - name: medium - href: >- - https://{yourOktaDomain}/img/logos/groups/active_directory-medium.png + href: https://{yourOktaDomain}/img/logos/groups/active_directory-medium.png type: image/png - name: large - href: >- - https://{yourOktaDomain}/img/logos/groups/active_directory-large.png + href: https://{yourOktaDomain}/img/logos/groups/active_directory-large.png type: image/png source: href: https://{yourOktaDomain}/api/v1/apps/0oa2v0el0gP90aqjJ0g7 users: - href: >- - https://{yourOktaDomain}/api/v1/groups/00garwpuyxHaWOkdV0g4/users + href: https://{yourOktaDomain}/api/v1/groups/00garwpuyxHaWOkdV0g4/users apps: href: https://{yourOktaDomain}/api/v1/groups/00garwpuyxHaWOkdV0g4/apps + list-groups-filter: + summary: List all groups with filter by type + description: Response with `filter=type+eq+%22OKTA_GROUP%22` + value: + - id: 00g1emaKYZTWRYYRRTSK + created: '2015-02-06T10:11:28.000Z' + lastUpdated: '2015-10-05T19:16:43.000Z' + lastMembershipUpdated: '2015-11-28T19:15:32.000Z' + objectClass: + - okta:user_group + type: OKTA_GROUP + profile: + name: West Coast users + description: All users West of The Rockies + _links: + logo: + - name: medium + href: https://{yourOktaDomain}/img/logos/groups/okta-medium.png + type: image/png + - name: large + href: https://{yourOktaDomain}/img/logos/groups/okta-large.png + type: image/png + users: + href: https://{yourOktaDomain}/api/v1/groups/00g1emaKYZTWRYYRRTSK/users + apps: + href: https://{yourOktaDomain}/api/v1/groups/00g1emaKYZTWRYYRRTSK/apps + - id: 00gak46y5hydV6NdM0g4 + created: '2015-07-22T08:45:03.000Z' + lastUpdated: '2015-07-22T08:45:03.000Z' + lastMembershipUpdated: '2015-10-22T08:45:03.000Z' + objectClass: + - okta:user_group + type: OKTA_GROUP + profile: + name: Squabble of users + description: Keep Calm and Single Sign-On + _links: + logo: + - name: medium + href: https://{yourOktaDomain}/img/logos/groups/okta-medium.png + type: image/png + - name: large + href: https://{yourOktaDomain}/img/logos/groups/okta-large.png + type: image/png + users: + href: https://{yourOktaDomain}/api/v1/groups/00gak46y5hydV6NdM0g4/users + apps: + href: https://{yourOktaDomain}/api/v1/groups/00gak46y5hydV6NdM0g4/apps + list-groups-search: + summary: List all groups with search + description: Response with `search=lastUpdated+gt+%222015-10-01T00:00:00.000Z%22+or+lastMembershipUpdated+gt+%222015-10-01T00:00:00.000Z%22` + value: + - id: 00g1emaKYZTWRYYRRTSK + created: '2015-02-06T10:11:28.000Z' + lastUpdated: '2015-10-05T19:16:43.000Z' + lastMembershipUpdated: '2015-11-28T19:15:32.000Z' + objectClass: + - okta:user_group + type: OKTA_GROUP + profile: + name: West Coast users + description: All users West of The Rockies + _links: + logo: + - name: medium + href: https://{yourOktaDomain}/img/logos/groups/okta-medium.png + type: image/png + - name: large + href: https://{yourOktaDomain}/img/logos/groups/okta-large.png + type: image/png + users: + href: https://{yourOktaDomain}/api/v1/groups/00g1emaKYZTWRYYRRTSK/users + apps: + href: https://{yourOktaDomain}/api/v1/groups/00g1emaKYZTWRYYRRTSK/apps + source: + href: https://{yourOktaDomain}/api/v1/apps/0oa2v0el0gP90aqjJ0g7 + - id: 00gak46y5hydV6NdM0g4 + created: '2015-07-22T08:45:03.000Z' + lastUpdated: '2015-07-22T08:45:03.000Z' + lastMembershipUpdated: '2015-10-22T08:45:03.000Z' + objectClass: + - okta:user_group + type: OKTA_GROUP + profile: + name: Squabble of users + description: Keep Calm and Single Sign-On + _links: + logo: + - name: medium + href: https://{yourOktaDomain}/img/logos/groups/okta-medium.png + type: image/png + - name: large + href: https://{yourOktaDomain}/img/logos/groups/okta-large.png + type: image/png + users: + href: https://{yourOktaDomain}/api/v1/groups/00gak46y5hydV6NdM0g4/users + apps: + href: https://{yourOktaDomain}/api/v1/groups/00gak46y5hydV6NdM0g4/apps + source: + href: https://{yourOktaDomain}/api/v1/apps/0oa2v0el0gP90aqjJ0g7 group-example: summary: Group example description: Example of a group @@ -3532,6 +4137,33 @@ components: assignUserToGroups: groupIds: - 00gjitX9HqABSoqTB0g3 + list-group-rules-with-expand-parameter: + summary: List group rules (expanded) + description: Example response when `expand=groupIdToGroupNameMap` is specified in the query parameter + value: + - type: group_rule + id: 0pr3f7zMZZHPgUoWO0g4 + status: INACTIVE + name: Engineering group rule + created: '2016-12-01T14:40:04.000Z' + lastUpdated: '2016-12-01T14:40:04.000Z' + conditions: + people: + users: + exclude: + - 00u22w79JPMEeeuLr0g4 + groups: + exclude: [] + expression: + value: user.role=="Engineer" + type: urn:okta:expression:1.0 + actions: + assignUserToGroups: + groupIds: + - 00gjitX9HqABSoqTB0g3 + _embedded: + groupIdToGroupNameMap: + 00gjitX9HqABSoqTB0g3: Engineering create-group-rule-request-example: summary: Create group rule request example value: @@ -3608,15 +4240,13 @@ components: authURL: https://example.com/auth.html _links: appLinks: - - href: >- - https://{yourOktaDomain}/home/template_basic_auth/0oafwvZDWJKVLDCUWUAC/1438 + - href: https://{yourOktaDomain}/home/template_basic_auth/0oafwvZDWJKVLDCUWUAC/1438 name: login type: text/html users: href: https://{yourOktaDomain}/api/v1/apps/0oafwvZDWJKVLDCUWUAC/users deactivate: - href: >- - https://{yourOktaDomain}/api/v1/apps/0oafwvZDWJKVLDCUWUAC/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/apps/0oafwvZDWJKVLDCUWUAC/lifecycle/deactivate groups: href: https://{yourOktaDomain}/api/v1/apps/0oafwvZDWJKVLDCUWUAC/groups ListsOwnerOneResponse: @@ -3686,18 +4316,15 @@ components: resource-set: iamoJDFKaJxGIr0oamd9g _links: assignee: - href": https://{yourOktaDomain}/api/v1/groups/00g1emaKYZTWRYYRRTSK + href: https://{yourOktaDomain}/api/v1/groups/00g1emaKYZTWRYYRRTSK resource-set: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g member: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings/cr0Yq6IJxGIr0ouum0g3/members/irb1qe6PGuMc7Oh8N0g4 + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings/cr0Yq6IJxGIr0ouum0g3/members/irb1qe6PGuMc7Oh8N0g4 role: href: https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3 permissions: - href: >- - https://{yourOktaDomain}/api/v1/iam/permission-sets/cr0Yq6IJxGIr0ouum0g3/permissions + href: https://{yourOktaDomain}/api/v1/iam/permission-sets/cr0Yq6IJxGIr0ouum0g3/permissions IAMStandardRolesListResponseGroup: value: - id: irb5e92YgBazyyQ3x1q5 @@ -3707,23 +4334,19 @@ components: status: ACTIVE created: '2019-02-06T16:20:57.000Z' lastUpdated: '2019-02-06T16:20:57.000Z' - assignmentType: Group + assignmentType: GROUP resource-set: ACCESS_CERTIFICATIONS_IAM_POLICY _links: assignee: href: https://{yourOktaDomain}/api/v1/groups/00g1emaKYZTWRYYRRTSK resource-set: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/ACCESS_CERTIFICATIONS_IAM_POLICY + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/ACCESS_CERTIFICATIONS_IAM_POLICY member: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/ACCESS_CERTIFICATIONS_IAM_POLICY/bindings/ACCESS_CERTIFICATIONS_ADMIN/members/irb1qe6PGuMc7Oh8N0g4 + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/ACCESS_CERTIFICATIONS_IAM_POLICY/bindings/ACCESS_CERTIFICATIONS_ADMIN/members/irb1qe6PGuMc7Oh8N0g4 role: - href: >- - https://{yourOktaDomain}/api/v1/iam/roles/ACCESS_CERTIFICATIONS_ADMIN + href: https://{yourOktaDomain}/api/v1/iam/roles/ACCESS_CERTIFICATIONS_ADMIN permissions: - href: >- - https://{yourOktaDomain}/api/v1/iam/permission-sets/OKTA_IAM_TEST_DELIVERED_ROLE/permissions + href: https://{yourOktaDomain}/api/v1/iam/permission-sets/OKTA_IAM_TEST_DELIVERED_ROLE/permissions CreateStandardRoleAssignmentResponseGroup: value: id: grasraHPx7i79ajaJ0g3 @@ -3749,15 +4372,13 @@ components: resource-set: iamoJDFKaJxGIr0oamd9g _links: assignee: - href": https://{yourOktaDomain}/api/v1/groups/00gsr2IepS8YhHRFf0g3 + href: https://{yourOktaDomain}/api/v1/groups/00gsr2IepS8YhHRFf0g3 resource-set: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g role: href: https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3 permissions: - href: >- - https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3/permissions + href: https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3/permissions CreateIAMStandardRoleResponseGroup: value: id: irb1q92TFAHzySt3x0g4 @@ -3773,16 +4394,13 @@ components: assignee: href: https://{yourOktaDomain}/api/v1/groups/00gsr2IepS8YhHRFf0g3 resource-set: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/ACCESS_CERTIFICATIONS_IAM_POLICY + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/ACCESS_CERTIFICATIONS_IAM_POLICY role: href: https://{yourOktaDomain}/api/v1/iam/roles/ACCESS_REQUESTS_ADMIN permissions: - href: >- - https://{yourOktaDomain}/api/v1/iam/roles/ACCESS_REQUESTS_ADMIN/permissions + href: https://{yourOktaDomain}/api/v1/iam/roles/ACCESS_REQUESTS_ADMIN/permissions member: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/ACCESS_CERTIFICATIONS_IAM_POLICY/bindings/ACCESS_REQUESTS_ADMIN/members/irb4jlomnnDBuBDyJ0g7 + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/ACCESS_CERTIFICATIONS_IAM_POLICY/bindings/ACCESS_REQUESTS_ADMIN/members/irb4jlomnnDBuBDyJ0g7 ListUsersResponse: summary: List all users value: @@ -3855,7 +4473,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.groups + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListGroupsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"groups\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 add_group: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1groups/post' response: @@ -3868,6 +4498,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_group: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1groups~1{groupId}/put' response: @@ -3877,12 +4510,12 @@ components: operation: $ref: '#/paths/~1api~1v1~1groups~1{groupId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: '#/components/x-stackQL-resources/groups/methods/list_groups' - $ref: '#/components/x-stackQL-resources/groups/methods/get_group' + - $ref: '#/components/x-stackQL-resources/groups/methods/list_groups' insert: - $ref: '#/components/x-stackQL-resources/groups/methods/add_group' update: [] @@ -3901,7 +4534,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.group_rules + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListGroupRulesResponse' + transform: + body: |- + {{- $wrapped := printf "{\"group_rules\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_group_rule: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1groups~1rules/post' response: @@ -3914,6 +4559,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_group_rule: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1groups~1rules~1{groupRuleId}/put' response: @@ -3923,26 +4571,24 @@ components: operation: $ref: '#/paths/~1api~1v1~1groups~1rules~1{groupRuleId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '202' activate_group_rule: operation: - $ref: >- - #/paths/~1api~1v1~1groups~1rules~1{groupRuleId}~1lifecycle~1activate/post + $ref: '#/paths/~1api~1v1~1groups~1rules~1{groupRuleId}~1lifecycle~1activate/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' deactivate_group_rule: operation: - $ref: >- - #/paths/~1api~1v1~1groups~1rules~1{groupRuleId}~1lifecycle~1deactivate/post + $ref: '#/paths/~1api~1v1~1groups~1rules~1{groupRuleId}~1lifecycle~1deactivate/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: '#/components/x-stackQL-resources/rules/methods/list_group_rules' - $ref: '#/components/x-stackQL-resources/rules/methods/get_group_rule' + - $ref: '#/components/x-stackQL-resources/rules/methods/list_group_rules' insert: - $ref: '#/components/x-stackQL-resources/rules/methods/create_group_rule' update: [] @@ -3961,10 +4607,18 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.assigned_applications_for_group + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListAssignedApplicationsForGroupResponse' + transform: + body: |- + {{- $wrapped := printf "{\"assigned_applications_for_group\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/assigned_apps/methods/list_assigned_applications_for_group + - $ref: '#/components/x-stackQL-resources/assigned_apps/methods/list_assigned_applications_for_group' insert: [] update: [] delete: [] @@ -3980,7 +4634,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.group_owners + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListGroupOwnersResponse' + transform: + body: |- + {{- $wrapped := printf "{\"group_owners\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 assign_group_owner: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1groups~1{groupId}~1owners/post' response: @@ -3990,7 +4656,7 @@ components: operation: $ref: '#/paths/~1api~1v1~1groups~1{groupId}~1owners~1{ownerId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: @@ -4012,7 +4678,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.group_assigned_roles + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListGroupAssignedRolesResponse' + transform: + body: |- + {{- $wrapped := printf "{\"group_assigned_roles\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 assign_role_to_group: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1groups~1{groupId}~1roles/post' response: @@ -4020,31 +4698,25 @@ components: openAPIDocKey: '200' get_group_assigned_role: operation: - $ref: >- - #/paths/~1api~1v1~1groups~1{groupId}~1roles~1{roleAssignmentId}/get + $ref: '#/paths/~1api~1v1~1groups~1{groupId}~1roles~1{roleAssignmentId}/get' response: mediaType: application/json openAPIDocKey: '200' unassign_role_from_group: operation: - $ref: >- - #/paths/~1api~1v1~1groups~1{groupId}~1roles~1{roleAssignmentId}/delete + $ref: '#/paths/~1api~1v1~1groups~1{groupId}~1roles~1{roleAssignmentId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/assigned_roles/methods/list_group_assigned_roles - - $ref: >- - #/components/x-stackQL-resources/assigned_roles/methods/get_group_assigned_role + - $ref: '#/components/x-stackQL-resources/assigned_roles/methods/get_group_assigned_role' + - $ref: '#/components/x-stackQL-resources/assigned_roles/methods/list_group_assigned_roles' insert: - - $ref: >- - #/components/x-stackQL-resources/assigned_roles/methods/assign_role_to_group + - $ref: '#/components/x-stackQL-resources/assigned_roles/methods/assign_role_to_group' update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/assigned_roles/methods/unassign_role_from_group + - $ref: '#/components/x-stackQL-resources/assigned_roles/methods/unassign_role_from_group' replace: [] app_targets: id: okta.groups.app_targets @@ -4053,37 +4725,40 @@ components: methods: list_application_targets_for_application_administrator_role_for_group: operation: - $ref: >- - #/paths/~1api~1v1~1groups~1{groupId}~1roles~1{roleAssignmentId}~1targets~1catalog~1apps/get + $ref: '#/paths/~1api~1v1~1groups~1{groupId}~1roles~1{roleAssignmentId}~1targets~1catalog~1apps/get' response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.application_targets_for_application_administrator_role_for_group + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListApplicationTargetsForApplicationAdministratorRoleForGroupResponse' + transform: + body: |- + {{- $wrapped := printf "{\"application_targets_for_application_administrator_role_for_group\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 assign_app_target_to_admin_role_for_group: operation: - $ref: >- - #/paths/~1api~1v1~1groups~1{groupId}~1roles~1{roleAssignmentId}~1targets~1catalog~1apps~1{appName}/put + $ref: '#/paths/~1api~1v1~1groups~1{groupId}~1roles~1{roleAssignmentId}~1targets~1catalog~1apps~1{appName}/put' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '200' unassign_app_target_to_admin_role_for_group: operation: - $ref: >- - #/paths/~1api~1v1~1groups~1{groupId}~1roles~1{roleAssignmentId}~1targets~1catalog~1apps~1{appName}/delete + $ref: '#/paths/~1api~1v1~1groups~1{groupId}~1roles~1{roleAssignmentId}~1targets~1catalog~1apps~1{appName}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/app_targets/methods/list_application_targets_for_application_administrator_role_for_group + - $ref: '#/components/x-stackQL-resources/app_targets/methods/list_application_targets_for_application_administrator_role_for_group' insert: [] update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/app_targets/methods/unassign_app_target_to_admin_role_for_group + - $ref: '#/components/x-stackQL-resources/app_targets/methods/unassign_app_target_to_admin_role_for_group' replace: - - $ref: >- - #/components/x-stackQL-resources/app_targets/methods/assign_app_target_to_admin_role_for_group + - $ref: '#/components/x-stackQL-resources/app_targets/methods/assign_app_target_to_admin_role_for_group' app_instance_targets: id: okta.groups.app_instance_targets name: app_instance_targets @@ -4091,28 +4766,24 @@ components: methods: assign_app_instance_target_to_app_admin_role_for_group: operation: - $ref: >- - #/paths/~1api~1v1~1groups~1{groupId}~1roles~1{roleAssignmentId}~1targets~1catalog~1apps~1{appName}~1{appId}/put + $ref: '#/paths/~1api~1v1~1groups~1{groupId}~1roles~1{roleAssignmentId}~1targets~1catalog~1apps~1{appName}~1{appId}/put' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' unassign_app_instance_target_to_app_admin_role_for_group: operation: - $ref: >- - #/paths/~1api~1v1~1groups~1{groupId}~1roles~1{roleAssignmentId}~1targets~1catalog~1apps~1{appName}~1{appId}/delete + $ref: '#/paths/~1api~1v1~1groups~1{groupId}~1roles~1{roleAssignmentId}~1targets~1catalog~1apps~1{appName}~1{appId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: [] insert: [] update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/app_instance_targets/methods/unassign_app_instance_target_to_app_admin_role_for_group + - $ref: '#/components/x-stackQL-resources/app_instance_targets/methods/unassign_app_instance_target_to_app_admin_role_for_group' replace: - - $ref: >- - #/components/x-stackQL-resources/app_instance_targets/methods/assign_app_instance_target_to_app_admin_role_for_group + - $ref: '#/components/x-stackQL-resources/app_instance_targets/methods/assign_app_instance_target_to_app_admin_role_for_group' group_targets: id: okta.groups.group_targets name: group_targets @@ -4120,37 +4791,40 @@ components: methods: list_group_targets_for_group_role: operation: - $ref: >- - #/paths/~1api~1v1~1groups~1{groupId}~1roles~1{roleAssignmentId}~1targets~1groups/get + $ref: '#/paths/~1api~1v1~1groups~1{groupId}~1roles~1{roleAssignmentId}~1targets~1groups/get' response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.group_targets_for_group_role + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListGroupTargetsForGroupRoleResponse' + transform: + body: |- + {{- $wrapped := printf "{\"group_targets_for_group_role\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 assign_group_target_to_group_admin_role: operation: - $ref: >- - #/paths/~1api~1v1~1groups~1{groupId}~1roles~1{roleAssignmentId}~1targets~1groups~1{targetGroupId}/put + $ref: '#/paths/~1api~1v1~1groups~1{groupId}~1roles~1{roleAssignmentId}~1targets~1groups~1{targetGroupId}/put' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' unassign_group_target_from_group_admin_role: operation: - $ref: >- - #/paths/~1api~1v1~1groups~1{groupId}~1roles~1{roleAssignmentId}~1targets~1groups~1{targetGroupId}/delete + $ref: '#/paths/~1api~1v1~1groups~1{groupId}~1roles~1{roleAssignmentId}~1targets~1groups~1{targetGroupId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/group_targets/methods/list_group_targets_for_group_role + - $ref: '#/components/x-stackQL-resources/group_targets/methods/list_group_targets_for_group_role' insert: [] update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/group_targets/methods/unassign_group_target_from_group_admin_role + - $ref: '#/components/x-stackQL-resources/group_targets/methods/unassign_group_target_from_group_admin_role' replace: - - $ref: >- - #/components/x-stackQL-resources/group_targets/methods/assign_group_target_to_group_admin_role + - $ref: '#/components/x-stackQL-resources/group_targets/methods/assign_group_target_to_group_admin_role' users: id: okta.groups.users name: users @@ -4162,17 +4836,26 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.group_users + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListGroupUsersResponse' + transform: + body: |- + {{- $wrapped := printf "{\"group_users\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 assign_user_to_group: operation: $ref: '#/paths/~1api~1v1~1groups~1{groupId}~1users~1{userId}/put' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' unassign_user_from_group: operation: $ref: '#/paths/~1api~1v1~1groups~1{groupId}~1users~1{userId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: @@ -4180,17 +4863,23 @@ components: insert: [] update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/users/methods/unassign_user_from_group + - $ref: '#/components/x-stackQL-resources/users/methods/unassign_user_from_group' replace: - - $ref: >- - #/components/x-stackQL-resources/users/methods/assign_user_to_group + - $ref: '#/components/x-stackQL-resources/users/methods/assign_user_to_group' servers: - url: https://{subdomain}.okta.com/ variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/hook_keys.yaml b/providers/src/okta/v00.00.00000/services/hook_keys.yaml index bc3d3860..cdf25538 100644 --- a/providers/src/okta/v00.00.00000/services/hook_keys.yaml +++ b/providers/src/okta/v00.00.00000/services/hook_keys.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: hook_keys API description: okta hook_keys API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/hook-keys: get: @@ -15,9 +15,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/HookKey' + $ref: '#/components/schemas/ListHookKeysResponse' examples: ResponseExample: $ref: '#/components/examples/ListAllKeysResponse' @@ -48,9 +46,9 @@ paths: The total number of keys that you can create in an Okta org is limited to 50. - The response is a [Key object](https://developer.okta.com/docs/reference/api/hook-keys/#key-object) that represents the - key that you create. The `id` property in the response serves as the unique ID for the key, which you can specify when - invoking other CRUD operations. The `keyId` provided in the response is the alias of the public key that you can use to get + The response is a [Key object](https://developer.okta.com/docs/reference/api/hook-keys/#key-object) that represents the + key that you create. The `id` property in the response serves as the unique ID for the key, which you can specify when + invoking other CRUD operations. The `keyId` provided in the response is the alias of the public key that you can use to get details of the public key data in a separate call. > **Note:** The keyId is the alias of the public key that you can use to @@ -121,8 +119,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathPublicKeyId' + parameters: + - $ref: '#/components/parameters/pathPublicKeyId' /api/v1/hook-keys/{id}: get: summary: Retrieve a key by ID @@ -211,6 +209,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathHookKeyId' delete: summary: Delete a key description: > @@ -239,8 +239,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathHookKeyId' + parameters: + - $ref: '#/components/parameters/pathHookKeyId' components: schemas: HookKey: @@ -409,6 +409,13 @@ components: properties: errorSummary: type: string + ListHookKeysResponse: + type: object + properties: + hook_keys: + type: array + items: + $ref: '#/components/schemas/HookKey' responses: ErrorAccessDenied403: description: Forbidden @@ -569,7 +576,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.hook_keys + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListHookKeysResponse' + transform: + body: |- + {{- $wrapped := printf "{\"hook_keys\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_hook_key: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1hook-keys/post' response: @@ -582,6 +601,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_hook_key: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1hook-keys~1{id}/put' response: @@ -591,12 +613,12 @@ components: operation: $ref: '#/paths/~1api~1v1~1hook-keys~1{id}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: '#/components/x-stackQL-resources/hook_keys/methods/list_hook_keys' - $ref: '#/components/x-stackQL-resources/hook_keys/methods/get_hook_key' + - $ref: '#/components/x-stackQL-resources/hook_keys/methods/list_hook_keys' insert: - $ref: '#/components/x-stackQL-resources/hook_keys/methods/create_hook_key' update: [] @@ -629,7 +651,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/iam.yaml b/providers/src/okta/v00.00.00000/services/iam.yaml index a6d3fe2c..9fc89ff9 100644 --- a/providers/src/okta/v00.00.00000/services/iam.yaml +++ b/providers/src/okta/v00.00.00000/services/iam.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: iam API description: okta iam API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/iam/assignees/users: get: @@ -53,8 +53,8 @@ paths: isGenerallyAvailable: true /api/v1/iam/governance/bundles: get: - summary: List all governance bundles for the Admin Console - description: Lists all Governance Bundles for the Admin Console in your org + summary: List all governance bundles + description: Lists all governance bundles for the Admin Console in your org operationId: listGovernanceBundles parameters: - $ref: '#/components/parameters/queryAfter' @@ -80,8 +80,8 @@ paths: tags: - GovernanceBundle post: - summary: Create a governance bundle for the Admin Console in RAMP - description: Creates a Governance Bundle for the Admin Console in RAMP + summary: Create a governance bundle + description: Creates a governance bundle of entitlements for the Admin Console operationId: createGovernanceBundle requestBody: content: @@ -90,11 +90,9 @@ paths: $ref: '#/components/schemas/GovernanceBundleCreateRequest' examples: GovernanceBundleCreateRequestStandardRole: - $ref: >- - #/components/examples/GovernanceBundleCreateRequestStandardRole + $ref: '#/components/examples/GovernanceBundleCreateRequestStandardRole' GovernanceBundleCreateRequestScopedStandardRole: - $ref: >- - #/components/examples/GovernanceBundleCreateRequestScopedStandardRole + $ref: '#/components/examples/GovernanceBundleCreateRequestScopedStandardRole' GovernanceBundleCreateRequestCustomRole: $ref: '#/components/examples/GovernanceBundleCreateRequestCustomRole' required: true @@ -106,7 +104,7 @@ paths: schema: $ref: '#/components/schemas/GovernanceBundle' examples: - createGovernanceBundleResponse: + GovernanceBundleCreateRequestStandardRole: $ref: '#/components/examples/GovernanceBundle' '400': $ref: '#/components/responses/ErrorApiValidationFailed400' @@ -126,8 +124,8 @@ paths: SKUs: [] /api/v1/iam/governance/bundles/{bundleId}: get: - summary: Retrieve a governance bundle from RAMP - description: Retrieves a Governance Bundle from RAMP + summary: Retrieve a governance bundle + description: Retrieves a governance bundle for the Admin Console operationId: getGovernanceBundle responses: '200': @@ -151,9 +149,11 @@ paths: - okta.roles.read tags: - GovernanceBundle + parameters: + - $ref: '#/components/parameters/pathBundleId' put: - summary: Replace a governance bundle in RAMP - description: Replaces a Governance Bundle in RAMP + summary: Replace a governance bundle + description: Replaces the properties of a governance bundle for the Admin Console operationId: replaceGovernanceBundle requestBody: content: @@ -162,11 +162,9 @@ paths: $ref: '#/components/schemas/GovernanceBundleUpdateRequest' examples: GovernanceBundleUpdateRequestStandardRole: - $ref: >- - #/components/examples/GovernanceBundleUpdateRequestStandardRole + $ref: '#/components/examples/GovernanceBundleUpdateRequestStandardRole' GovernanceBundleUpdateRequestScopedStandardRole: - $ref: >- - #/components/examples/GovernanceBundleUpdateRequestScopedStandardRole + $ref: '#/components/examples/GovernanceBundleUpdateRequestScopedStandardRole' GovernanceBundleUpdateRequestCustomRole: $ref: '#/components/examples/GovernanceBundleUpdateRequestCustomRole' required: true @@ -192,9 +190,11 @@ paths: - okta.roles.manage tags: - GovernanceBundle + parameters: + - $ref: '#/components/parameters/pathBundleId' delete: - summary: Delete a governance bundle from RAMP - description: Deletes a Governance Bundle from RAMP + summary: Delete a governance bundle + description: Deletes an Admin Console governance bundle operationId: deleteGovernanceBundle responses: '204': @@ -209,20 +209,21 @@ paths: - okta.roles.manage tags: - GovernanceBundle + parameters: + - $ref: '#/components/parameters/pathBundleId' x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false SKUs: [] - parameters: - - $ref: '#/components/parameters/pathBundleId' /api/v1/iam/governance/bundles/{bundleId}/entitlements: get: summary: List all entitlements for a governance bundle - description: Lists all Entitlements specific to a Governance Bundle + description: Lists all entitlements specific to a governance bundle operationId: listBundleEntitlements parameters: - $ref: '#/components/parameters/queryAfter' - $ref: '#/components/parameters/queryLimit' + - $ref: '#/components/parameters/pathBundleId' responses: '200': description: OK @@ -247,16 +248,16 @@ paths: lifecycle: GA isGenerallyAvailable: false SKUs: [] - parameters: - - $ref: '#/components/parameters/pathBundleId' /api/v1/iam/governance/bundles/{bundleId}/entitlements/{entitlementId}/values: get: - summary: List all entitlement values for a bundle entitlement - description: Lists all Entitlement Values specific to a Bundle Entitlement + summary: List all values for a governance bundle entitlement + description: Lists all entitlement values that are specific to a governance bundle entitlement operationId: listBundleEntitlementValues parameters: - $ref: '#/components/parameters/queryAfter' - $ref: '#/components/parameters/queryLimit' + - $ref: '#/components/parameters/pathBundleId' + - $ref: '#/components/parameters/pathEntitlementId' responses: '200': description: OK @@ -281,13 +282,10 @@ paths: lifecycle: GA isGenerallyAvailable: false SKUs: [] - parameters: - - $ref: '#/components/parameters/pathBundleId' - - $ref: '#/components/parameters/pathEntitlementId' /api/v1/iam/governance/optIn: get: - summary: Retrieve the opt-in status from RAMP - description: Retrieves the opt-in status of the Admin Console from RAMP + summary: Retrieve the Admin Console opt-in status + description: Retrieves the entitlement management opt-in status for the Admin Console operationId: getOptInStatus responses: '200': @@ -310,19 +308,12 @@ paths: tags: - GovernanceBundle post: - summary: Opt in the Admin Console to RAMP - description: Opts in the Admin Console to RAMP + summary: Opt in the Admin Console to entitlement management + description: Opts in the Admin Console to entitlement management operationId: optIn responses: '200': description: Success - content: - application/json: - schema: - $ref: '#/components/schemas/OptInStatusResponse' - examples: - OptInStatusResponse: - $ref: '#/components/examples/OptInStatusResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '429': @@ -339,19 +330,12 @@ paths: SKUs: [] /api/v1/iam/governance/optOut: post: - summary: Opt out the Admin Console from RAMP - description: Opts out the Admin Console from RAMP + summary: Opt out the Admin Console from entitlement management + description: Opts out the Admin Console from entitlement management operationId: optOut responses: '200': description: Success - content: - application/json: - schema: - $ref: '#/components/schemas/OptInStatusResponse' - examples: - OptOutStatusResponse: - $ref: '#/components/examples/OptOutStatusResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '429': @@ -398,15 +382,10 @@ paths: isGenerallyAvailable: true post: summary: Create a resource set - description: >- - Creates a new resource set. See [Supported - resources](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#supported-resources). + description: |- + Creates a new resource set. See [Supported resources](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#supported-resources). - - > **Note:** The maximum number of `resources` allowed in a resource set - object is 1000. Resources are identified by either an Okta Resource Name - (ORN) or by a REST URL format. See [Okta Resource - Name](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#okta-resource-name-orn). + > **Note:** The maximum number of `resources` allowed in a resource set object is 1000. Resources are identified by either an Okta Resource Name (ORN) or by a REST URL format. See [Okta Resource Name](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#okta-resource-name-orn). operationId: createResourceSet x-codegen-request-body-name: instance requestBody: @@ -480,9 +459,11 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathResourceSetIdOrLabel' put: summary: Replace a resource set - description: Replaces the label and description of a resource set + description: Replaces the label and description of a resource set. See [Supported resources](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#supported-resources). operationId: replaceResourceSet x-codegen-request-body-name: instance requestBody: @@ -521,6 +502,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathResourceSetIdOrLabel' delete: summary: Delete a resource set description: Deletes a resource set by `resourceSetIdOrLabel` @@ -551,22 +534,19 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathResourceSetIdOrLabel' + parameters: + - $ref: '#/components/parameters/pathResourceSetIdOrLabel' /api/v1/iam/resource-sets/{resourceSetIdOrLabel}/bindings: get: summary: List all role resource set bindings - description: >- + description: |- Lists all bindings for a resource set with pagination support. - - The returned `roles` array contains the roles for each binding - associated with the specified resource set. If there are more than 100 - bindings for the specified resource set, `links.next` provides the - resource with pagination for the next list of bindings. + The returned `roles` array contains the roles for each binding associated with the specified resource set. If there are more than 100 bindings for the specified resource set, `links.next` provides the resource with pagination for the next list of bindings. operationId: listBindings parameters: - $ref: '#/components/parameters/queryAfter' + - $ref: '#/components/parameters/pathResourceSetIdOrLabel' responses: '200': description: OK @@ -594,14 +574,10 @@ paths: isGenerallyAvailable: true post: summary: Create a role resource set binding - description: >- - Creates a binding for the resource set, custom role, and members (users - or groups) - + description: |- + Creates a binding for the resource set, custom role, and members (users or groups) - > **Note:** If you use a custom role with permissions that don't apply - to the resources in the resource set, it doesn't affect the admin role. - For example, + > **Note:** If you use a custom role with permissions that don't apply to the resources in the resource set, it doesn't affect the admin role. For example, the `okta.users.userprofile.manage` permission gives the admin no privileges if it's granted to a resource set that only includes `https://{yourOktaDomain}/api/v1/groups/{targetGroupId}` resources. If you want the admin to be able to manage the users within the group, the resource set must include the corresponding `https://{yourOktaDomain}/api/v1/groups/{targetGroupId}/users` resource. operationId: createResourceSetBinding @@ -649,14 +625,12 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathResourceSetIdOrLabel' + parameters: + - $ref: '#/components/parameters/pathResourceSetIdOrLabel' /api/v1/iam/resource-sets/{resourceSetIdOrLabel}/bindings/{roleIdOrLabel}: get: summary: Retrieve a role resource set binding - description: >- - Retrieves the binding of a role (identified by `roleIdOrLabel`) for a - resource set (identified by `resourceSetIdOrLabel`) + description: Retrieves the binding of a role (identified by `roleIdOrLabel`) for a resource set (identified by `resourceSetIdOrLabel`) operationId: getBinding responses: '200': @@ -667,8 +641,7 @@ paths: $ref: '#/components/schemas/ResourceSetBindingResponse' examples: Example Response: - $ref: >- - #/components/examples/ResourceSetBindingResponseWithIdExample + $ref: '#/components/examples/ResourceSetBindingResponseWithIdExample' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -684,11 +657,12 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathResourceSetIdOrLabel' + - $ref: '#/components/parameters/pathRoleIdOrLabel' delete: summary: Delete a role resource set binding - description: >- - Deletes a binding of a role (identified by `roleIdOrLabel`) and a - resource set (identified by `resourceSetIdOrLabel`) + description: Deletes a binding of a role (identified by `roleIdOrLabel`) and a resource set (identified by `resourceSetIdOrLabel`) operationId: deleteBinding responses: '204': @@ -716,9 +690,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathResourceSetIdOrLabel' - - $ref: '#/components/parameters/pathRoleIdOrLabel' + parameters: + - $ref: '#/components/parameters/pathResourceSetIdOrLabel' + - $ref: '#/components/parameters/pathRoleIdOrLabel' /api/v1/iam/resource-sets/{resourceSetIdOrLabel}/bindings/{roleIdOrLabel}/members: get: summary: List all role resource set binding members @@ -726,6 +700,8 @@ paths: operationId: listMembersOfBinding parameters: - $ref: '#/components/parameters/queryAfter' + - $ref: '#/components/parameters/pathResourceSetIdOrLabel' + - $ref: '#/components/parameters/pathRoleIdOrLabel' responses: '200': description: OK @@ -763,8 +739,7 @@ paths: $ref: '#/components/schemas/ResourceSetBindingAddMembersRequest' examples: Example Request: - $ref: >- - #/components/examples/ResourceSetBindingAddMembersRequestExample + $ref: '#/components/examples/ResourceSetBindingAddMembersRequestExample' required: true responses: '200': @@ -800,15 +775,13 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathResourceSetIdOrLabel' - - $ref: '#/components/parameters/pathRoleIdOrLabel' + parameters: + - $ref: '#/components/parameters/pathResourceSetIdOrLabel' + - $ref: '#/components/parameters/pathRoleIdOrLabel' /api/v1/iam/resource-sets/{resourceSetIdOrLabel}/bindings/{roleIdOrLabel}/members/{memberId}: get: summary: Retrieve a role resource set binding member - description: >- - Retrieves a member (identified by `memberId`) that belongs to a role - resource set binding + description: Retrieves a member (identified by `memberId`) that belongs to a role resource set binding operationId: getMemberOfBinding responses: '200': @@ -835,11 +808,13 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathResourceSetIdOrLabel' + - $ref: '#/components/parameters/pathRoleIdOrLabel' + - $ref: '#/components/parameters/pathMemberId' delete: summary: Unassign a role resource set binding member - description: >- - Unassigns a member (identified by `memberId`) from a role resource set - binding + description: Unassigns a member (identified by `memberId`) from a role resource set binding operationId: unassignMemberFromBinding x-codegen-request-body-name: instance responses: @@ -868,15 +843,31 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathResourceSetIdOrLabel' - - $ref: '#/components/parameters/pathRoleIdOrLabel' - - $ref: '#/components/parameters/pathMemberId' + parameters: + - $ref: '#/components/parameters/pathResourceSetIdOrLabel' + - $ref: '#/components/parameters/pathRoleIdOrLabel' + - $ref: '#/components/parameters/pathMemberId' /api/v1/iam/resource-sets/{resourceSetIdOrLabel}/resources: get: summary: List all resource set resources description: Lists all resources for the resource set operationId: listResourceSetResources + parameters: + - name: after + description: Specifies the pagination cursor for the next page of targets + in: query + schema: + type: string + required: false + - name: limit + in: query + description: Specifies the number of results returned. Defaults to `100`. + schema: + type: integer + format: int32 + default: 100 + required: false + - $ref: '#/components/parameters/pathResourceSetIdOrLabel' responses: '200': description: OK @@ -950,6 +941,8 @@ paths: - okta.roles.manage tags: - RoleCResourceSetResource + parameters: + - $ref: '#/components/parameters/pathResourceSetIdOrLabel' patch: summary: Add more resources to a resource set description: Adds more resources to a resource set @@ -998,8 +991,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathResourceSetIdOrLabel' + parameters: + - $ref: '#/components/parameters/pathResourceSetIdOrLabel' /api/v1/iam/resource-sets/{resourceSetIdOrLabel}/resources/{resourceId}: get: x-okta-lifecycle: @@ -1039,14 +1032,15 @@ paths: - okta.roles.read tags: - RoleCResourceSetResource + parameters: + - $ref: '#/components/parameters/pathResourceSetIdOrLabel' + - $ref: '#/components/parameters/pathResourceId' put: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true summary: Replace the resource set resource conditions - description: >- - Replaces the conditions of a resource identified by `resourceId` in a - resource set + description: Replaces the conditions of a resource identified by `resourceId` in a resource set operationId: replaceResourceSetResource requestBody: content: @@ -1088,6 +1082,9 @@ paths: - okta.roles.manage tags: - RoleCResourceSetResource + parameters: + - $ref: '#/components/parameters/pathResourceSetIdOrLabel' + - $ref: '#/components/parameters/pathResourceId' delete: summary: Delete a resource set resource description: Deletes a resource (identified by `resourceId`) from a resource set @@ -1118,9 +1115,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathResourceSetIdOrLabel' - - $ref: '#/components/parameters/pathResourceId' + parameters: + - $ref: '#/components/parameters/pathResourceSetIdOrLabel' + - $ref: '#/components/parameters/pathResourceId' /api/v1/iam/roles: get: summary: List all custom roles @@ -1227,6 +1224,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathRoleIdOrLabel' put: summary: Replace a custom role description: Replaces the label and description for a custom role by `roleIdOrLabel` @@ -1268,6 +1267,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathRoleIdOrLabel' delete: summary: Delete a custom role description: Deletes a custom role by `roleIdOrLabel` @@ -1298,8 +1299,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathRoleIdOrLabel' + parameters: + - $ref: '#/components/parameters/pathRoleIdOrLabel' /api/v1/iam/roles/{roleIdOrLabel}/permissions: get: summary: List all custom role permissions @@ -1330,14 +1331,12 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathRoleIdOrLabel' + parameters: + - $ref: '#/components/parameters/pathRoleIdOrLabel' /api/v1/iam/roles/{roleIdOrLabel}/permissions/{permissionType}: get: summary: Retrieve a custom role permission - description: >- - Retrieves a permission (identified by `permissionType`) for a custom - role + description: Retrieves a permission (identified by `permissionType`) for a custom role operationId: getRolePermission responses: '200': @@ -1366,6 +1365,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathRoleIdOrLabel' + - $ref: '#/components/parameters/pathPermissionType' post: summary: Create a custom role permission description: Creates a permission (specified by `permissionType`) for a custom role @@ -1381,11 +1383,9 @@ paths: $ref: '#/components/schemas/CreateUpdateIamRolePermissionRequest' examples: Example Request with include: - $ref: >- - #/components/examples/CreateUpdateIamRolePermissionRequestExampleWithInclude + $ref: '#/components/examples/CreateUpdateIamRolePermissionRequestExampleWithInclude' Example Request with exclude: - $ref: >- - #/components/examples/CreateUpdateIamRolePermissionRequestExampleWithExclude + $ref: '#/components/examples/CreateUpdateIamRolePermissionRequestExampleWithExclude' required: false responses: '204': @@ -1407,6 +1407,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathRoleIdOrLabel' + - $ref: '#/components/parameters/pathPermissionType' put: x-okta-lifecycle: lifecycle: GA @@ -1422,11 +1425,9 @@ paths: $ref: '#/components/schemas/CreateUpdateIamRolePermissionRequest' examples: Example Request with include: - $ref: >- - #/components/examples/CreateUpdateIamRolePermissionRequestExampleWithInclude + $ref: '#/components/examples/CreateUpdateIamRolePermissionRequestExampleWithInclude' Example Request with exclude: - $ref: >- - #/components/examples/CreateUpdateIamRolePermissionRequestExampleWithExclude + $ref: '#/components/examples/CreateUpdateIamRolePermissionRequestExampleWithExclude' required: false responses: '200': @@ -1452,6 +1453,9 @@ paths: - okta.roles.manage tags: - RoleECustomPermission + parameters: + - $ref: '#/components/parameters/pathRoleIdOrLabel' + - $ref: '#/components/parameters/pathPermissionType' delete: summary: Delete a custom role permission description: Deletes a permission (identified by `permissionType`) from a custom role @@ -1482,9 +1486,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathRoleIdOrLabel' - - $ref: '#/components/parameters/pathPermissionType' + parameters: + - $ref: '#/components/parameters/pathRoleIdOrLabel' + - $ref: '#/components/parameters/pathPermissionType' components: schemas: RoleAssignedUsers: @@ -1509,130 +1513,178 @@ components: description: An Okta code for this type of error errorId: type: string - description: >- - A unique identifier for this error. This can be used by Okta Support - to help with troubleshooting. + description: A unique identifier for this error. This can be used by Okta Support to help with troubleshooting. errorLink: type: string description: An Okta code for this type of error errorSummary: type: string - description: >- - A short description of what caused this error. Sometimes this - contains dynamically-generated information about your specific - error. + description: A short description of what caused this error. Sometimes this contains dynamically-generated information about your specific error. GovernanceBundlesResponse: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: bundles: type: array + description: List of governance bundles items: $ref: '#/components/schemas/GovernanceBundle' _links: - anyOf: - - $ref: '#/components/schemas/LinksSelf' - - $ref: '#/components/schemas/LinksNext' + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + next: + $ref: '#/components/schemas/HrefObjectNextLink' + readOnly: true GovernanceBundleCreateRequest: + description: Request to create a governance bundle type: object properties: description: type: string + description: Description of the governance bundle entitlements: type: array + description: List of entitlements to include in the governance bundle items: $ref: '#/components/schemas/IAMBundleEntitlement' name: type: string + description: Name of the governance bundle GovernanceBundle: type: object properties: description: type: string + description: Description of the governance bundle id: type: string + description: Governance bundle ID name: type: string + description: Name of the governance bundle orn: type: string + description: The governance bundle resource, in [ORN format](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#okta-resource-name-orn) status: type: string + description: Status of the governance bundle _links: - allOf: - - properties: - entitlements: - $ref: '#/components/schemas/HrefObject' - type: object + type: object + description: Link relations available + properties: + entitlements: + $ref: '#/components/schemas/EntitlementsLink' + self: + $ref: '#/components/schemas/HrefObjectSelfLink' GovernanceBundleUpdateRequest: + description: Request to update a governance bundle type: object properties: description: type: string + description: Description of the governance bundle entitlements: type: array + description: List of entitlements to include in the governance bundle items: $ref: '#/components/schemas/IAMBundleEntitlement' name: type: string + description: Name of the governance bundle BundleEntitlementsResponse: + x-okta-ignore-redocly-rules-for-sdk: true + description: Entitlement list for a governance bundle type: object properties: entitlements: type: array + description: List of bundle entitlements items: $ref: '#/components/schemas/BundleEntitlement' _links: + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. type: object - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using - the [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification - readOnly: true properties: - next: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the next resource self: $ref: '#/components/schemas/HrefObjectSelfLink' + next: + $ref: '#/components/schemas/HrefObjectNextLink' bundle: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the bundle resource + $ref: '#/components/schemas/BundleLink' + readOnly: true EntitlementValuesResponse: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: entitlementValues: type: array + description: List of entitlement values for a bundle entitlement items: $ref: '#/components/schemas/EntitlementValue' _links: - anyOf: - - $ref: '#/components/schemas/LinksSelf' - - $ref: '#/components/schemas/LinksNext' - - properties: - bundle: - $ref: '#/components/schemas/HrefObject' - entitlements: - $ref: '#/components/schemas/HrefObject' - type: object + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + bundle: + $ref: '#/components/schemas/BundleLink' + entitlements: + $ref: '#/components/schemas/EntitlementsLink' + next: + $ref: '#/components/schemas/HrefObjectNextLink' + readOnly: true OptInStatusResponse: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: optInStatus: type: string + description: The entitlement management opt-in status for the Admin Console enum: - OPTING_IN - OPTED_IN - OPTING_OUT - OPTED_OUT + x-enumDescriptions: + OPTING_IN: Okta is enabling entitlement management for the Admin Console + OPTED_IN: Entitlement management is enabled for the Admin Console + OPTING_OUT: Okta is disabling entitlement management for the Admin Console + OPTED_OUT: Entitlement management is disabled for the Admin Console _links: - allOf: - - properties: - optInStatus: - $ref: '#/components/schemas/HrefObject' + type: object + description: Link relations available + properties: + optInStatus: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the opt-in status resource ResourceSets: type: object properties: @@ -1653,11 +1705,7 @@ components: description: Unique name for the resource set resources: type: array - description: >- - The endpoint (URL) that references all resource objects included in - the resource set. Resources are identified by either an Okta - Resource Name (ORN) or by a REST URL format. See [Okta Resource - Name](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#okta-resource-name-orn). + description: The endpoint (URL) that references all resource objects included in the resource set. Resources are identified by either an Okta Resource Name (ORN) or by a REST URL format. See [Okta Resource Name](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#okta-resource-name-orn). maximum: 1000 items: type: string @@ -1666,6 +1714,7 @@ components: - label - resources ResourceSet: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: created: @@ -1689,38 +1738,61 @@ components: description: Timestamp when the role was last updated readOnly: true _links: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - properties: - resources: - $ref: '#/components/schemas/HrefObjectResourceSetResourcesLink' - bindings: - $ref: '#/components/schemas/HrefObjectBindingsLink' - type: object + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + resources: + $ref: '#/components/schemas/HrefObjectResourceSetResourcesLink' + bindings: + $ref: '#/components/schemas/HrefObjectBindingsLink' + readOnly: true ResourceSetBindings: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: roles: type: array - description: >- - Roles associated with the resource set binding. If there are more - than 100 bindings for the specified resource set, then the - `_links.next` resource is returned with the next list of bindings. + description: Roles associated with the resource set binding. If there are more than 100 bindings for the specified resource set, then the `_links.next` resource is returned with the next list of bindings. items: $ref: '#/components/schemas/ResourceSetBindingRole' _links: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - properties: - next: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: >- - Link to the next list of bindings for the specified - resource set - resource-set: - $ref: '#/components/schemas/HrefObjectResourceSetLink' + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + next: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the next list of bindings for the specified resource set + resource-set: + $ref: '#/components/schemas/HrefObjectResourceSetLink' + readOnly: true ResourceSetBindingCreateRequest: type: object properties: @@ -1733,56 +1805,83 @@ components: type: string description: Unique key for the role ResourceSetBindingEditResponse: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: _links: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - properties: - resource-set: - $ref: '#/components/schemas/HrefObjectResourceSetLink' - bindings: - $ref: '#/components/schemas/HrefObjectBindingsLink' - type: object + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + resource-set: + $ref: '#/components/schemas/HrefObjectResourceSetLink' + bindings: + $ref: '#/components/schemas/HrefObjectBindingsLink' + readOnly: true ResourceSetBindingResponse: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: id: type: string description: '`id` of the role resource set binding' _links: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - properties: - resource-set: - $ref: '#/components/schemas/HrefObjectResourceSetLink' - members: - $ref: '#/components/schemas/HrefObjectMembersLink' - type: object + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + resource-set: + $ref: '#/components/schemas/HrefObjectResourceSetLink' + members: + $ref: '#/components/schemas/HrefObjectMembersLink' + readOnly: true ResourceSetBindingMembers: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: members: type: array - description: >- - The members of the role resource set binding. If there are more than - 100 members for the binding, then the `_links.next` resource is - returned with the next list of members. + description: The members of the role resource set binding. If there are more than 100 members for the binding, then the `_links.next` resource is returned with the next list of members. items: $ref: '#/components/schemas/ResourceSetBindingMember' _links: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - properties: - next: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: >- - Link to the next list of binding members for the - specified role and resource set - binding: - $ref: '#/components/schemas/HrefObjectBindingLink' + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + next: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the next list of binding members for the specified role and resource set + binding: + $ref: '#/components/schemas/HrefObjectBindingLink' + readOnly: true ResourceSetBindingAddMembersRequest: type: object properties: @@ -1813,6 +1912,7 @@ components: _links: $ref: '#/components/schemas/LinksSelf' ResourceSetResources: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: resources: @@ -1820,12 +1920,14 @@ components: items: $ref: '#/components/schemas/ResourceSetResource' _links: - allOf: - - $ref: '#/components/schemas/LinksNext' - - properties: - resource-set: - $ref: '#/components/schemas/HrefObject' - type: object + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status of an application using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. Use the `LinksNext` object for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + next: + $ref: '#/components/schemas/HrefObjectNextLink' + resource-set: + $ref: '#/components/schemas/HrefObject' + readOnly: true ResourceSetResourcePostRequest: type: object properties: @@ -1838,6 +1940,7 @@ components: - resourceOrnOrUrl - conditions ResourceSetResource: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: conditions: @@ -1864,25 +1967,113 @@ components: readOnly: true properties: self: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: The REST API URL of the related resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: The REST API URL of the related resource resource: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to this resource set resource object (self) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to this resource set resource object (self) groups: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: >- - If applicable, the REST API URL of the related groups - resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: If applicable, the REST API URL of the related groups resource users: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: >- - If applicable, the REST API URL of the related users - resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: If applicable, the REST API URL of the related users resource type: object ResourceSetResourcePatchRequest: type: object @@ -1908,6 +2099,7 @@ components: _links: $ref: '#/components/schemas/LinksNext' CreateIamRoleRequest: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: description: @@ -1917,15 +2109,16 @@ components: type: string description: Unique label for the role permissions: + description: Array of permissions that the role grants. See [Permissions](https://developer.okta.com/docs/api/openapi/okta-management/guides/permissions). type: array - description: >- - Array of permissions that the role grants. See - [Permissions](https://developer.okta.com/docs/api/openapi/okta-management/guides/permissions). + items: + type: string required: - label - description - permissions IamRole: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: created: @@ -1949,12 +2142,14 @@ components: description: Timestamp when the role was last updated readOnly: true _links: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - properties: - permissions: - $ref: '#/components/schemas/HrefObject' - type: object + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + permissions: + $ref: '#/components/schemas/HrefObject' + readOnly: true required: - label - description @@ -1976,12 +2171,11 @@ components: properties: permissions: type: array - description: >- - Array of permissions assigned to the role. See - [Permissions](https://developer.okta.com/docs/api/openapi/okta-management/guides/permissions). + description: Array of permissions assigned to the role. See [Permissions](https://developer.okta.com/docs/api/openapi/okta-management/guides/permissions). items: $ref: '#/components/schemas/Permission' Permission: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: conditions: @@ -1993,9 +2187,7 @@ components: readOnly: true label: type: string - description: >- - The assigned Okta - [permission](https://developer.okta.com/docs/api/openapi/okta-management/guides/permissions) + description: The assigned Okta [permission](https://developer.okta.com/docs/api/openapi/okta-management/guides/permissions) readOnly: true example: okta.users.read lastUpdated: @@ -2004,12 +2196,14 @@ components: description: Timestamp when the permission was last updated readOnly: true _links: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - properties: - role: - $ref: '#/components/schemas/HrefObjectRoleLink' - type: object + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + role: + $ref: '#/components/schemas/HrefObjectRoleLink' + readOnly: true CreateUpdateIamRolePermissionRequest: type: object properties: @@ -2029,20 +2223,37 @@ components: _links: $ref: '#/components/schemas/LinksSelfAndRoles' LinksNextForRoleAssignments: - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the - [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. + x-okta-ignore-redocly-rules-for-sdk: true + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. type: object properties: next: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: >- - The next page of results if [pagination](#pagination) is - required + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: The next page of results if [pagination](#pagination) is required readOnly: true ErrorCause: type: object @@ -2050,45 +2261,87 @@ components: errorSummary: type: string LinksSelf: - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the - [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. This object is used for dynamic discovery of related - resources and lifecycle operations. + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. type: object properties: self: $ref: '#/components/schemas/HrefObjectSelfLink' readOnly: true - LinksNext: - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the - current status of an application using the [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. Use the `LinksNext` object for dynamic discovery of - related resources and lifecycle operations. + HrefObjectNextLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true type: object properties: - next: - $ref: '#/components/schemas/HrefObject' - readOnly: true + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the next resource IAMBundleEntitlement: + description: An entitlement in a governance bundle type: object properties: resourceSets: type: array + description: List of resource set IDs for the custom role items: type: string + description: Resource set ID role: type: string + description: The role targets: type: array + description: List of target resource IDs to scope the entitlement with the role items: type: string - HrefObject: + description: Target resource (app or group ID) + EntitlementsLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the entitlements resource + HrefObjectSelfLink: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object additionalProperties: true type: object @@ -2105,56 +2358,105 @@ components: readOnly: true templated: type: boolean - description: >- - Indicates whether the link object's `href` property is a URI - template. + description: Indicates whether the link object's `href` property is a URI template. readOnly: true type: type: string - description: >- - The media type of the link. If omitted, it is implicitly - `application/json`. + description: The media type of the link. If omitted, it is implicitly `application/json`. readOnly: true required: - href + description: Link to the resource (self) BundleEntitlement: + x-okta-ignore-redocly-rules-for-sdk: true + description: An entitlement in a governance bundle type: object properties: description: type: string + description: The description of the role id: type: string + description: Entitlement ID name: type: string + description: The name of the role role: type: string + description: The role key _links: - allOf: - - properties: - values: - $ref: '#/components/schemas/HrefObject' + type: object + description: Link relations available + properties: + values: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true type: object - HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the entitlement values resource + BundleLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the bundle resource EntitlementValue: type: object properties: id: type: string + description: Entitlement value ID name: type: string + description: The entitlement value resource name value: type: string + description: The entitlement value resource [ORN](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#okta-resource-name-orn) _links: type: object - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using - the [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification readOnly: true properties: group: @@ -2163,39 +2465,190 @@ components: $ref: '#/components/schemas/HrefObjectAppLink' resource-set: $ref: '#/components/schemas/HrefObjectResourceSetLink' + HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + LinksNext: + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status of an application using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. Use the `LinksNext` object for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + next: + $ref: '#/components/schemas/HrefObjectNextLink' + readOnly: true HrefObjectResourceSetResourcesLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to resource set resources + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to resource set resources HrefObjectBindingsLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the bindings resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the bindings resource ResourceSetBindingRole: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: id: type: string description: '`id` of the role' _links: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - properties: - members: - $ref: '#/components/schemas/HrefObjectMembersLink' - type: object + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + members: + $ref: '#/components/schemas/HrefObjectMembersLink' + readOnly: true HrefObjectResourceSetLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource set resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the resource set resource HrefObjectMembersLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the members resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the members resource HrefObjectBindingLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the binding resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the binding resource ResourceConditions: x-okta-lifecycle: lifecycle: GA @@ -2217,9 +2670,8 @@ components: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - description: >- - Conditions for further restricting a permission. See [Permission - conditions](https://help.okta.com/okta_help.htm?type=oie&id=ext-permission-conditions). + description: Conditions for further restricting a permission. See [Permission conditions](https://help.okta.com/okta_help.htm?type=oie&id=ext-permission-conditions). + x-okta-ignore-redocly-rules-for-sdk: true nullable: true type: object properties: @@ -2238,16 +2690,95 @@ components: properties: {} nullable: true HrefObjectRoleLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the role resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the role resource LinksSelfAndRoles: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - type: object - properties: - roles: - $ref: '#/components/schemas/HrefObjectRoleLink' + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + roles: + $ref: '#/components/schemas/HrefObjectRoleLink' + readOnly: true + HrefObjectGroupLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the group resource + HrefObjectAppLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the app resource HrefHints: description: Describes allowed HTTP verbs for the `href` type: object @@ -2256,14 +2787,6 @@ components: type: array items: $ref: '#/components/schemas/HttpMethod' - HrefObjectGroupLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the group resource - HrefObjectAppLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the app resource HttpMethod: type: string enum: @@ -2314,11 +2837,7 @@ components: in: query schema: type: string - description: >- - The cursor to use for pagination. It is an opaque string that specifies - your current location in the list and is obtained from the `Link` - response header. See - [Pagination](https://developer.okta.com/docs/api/#pagination). + description: The cursor to use for pagination. It is an opaque string that specifies your current location in the list and is obtained from the `Link` response header. See [Pagination](https://developer.okta.com/docs/api/#pagination) and [Link header](https://developer.okta.com/docs/api/#link-header). queryLimit: name: limit in: query @@ -2392,15 +2911,12 @@ components: orn: orn:okta:00o5rb5mt2H3d1TJd0h7:users:00u118oQYT4TBGuay0g4 _links: self: - href: >- - http://your-subdomain.okta.com/api/v1/users/00u118oQYT4TBGuay0g4 + href: http://your-subdomain.okta.com/api/v1/users/00u118oQYT4TBGuay0g4 roles: - href: >- - http://your-subdomain.okta.com/api/v1/users/00u118oQYT4TBGuay0g4/roles + href: http://your-subdomain.okta.com/api/v1/users/00u118oQYT4TBGuay0g4/roles _links: next: - href: >- - http://your-subdomain.okta.com/api/v1/iam/assignees/users?after=00u118oQYT4TBGuay0g4&limit=1 + href: http://your-subdomain.okta.com/api/v1/iam/assignees/users?after=00u118oQYT4TBGuay0g4&limit=1 GovernanceBundlesResponse: summary: List of governance bundles value: @@ -2409,18 +2925,14 @@ components: name: Group admin bundle description: Group bundle for administrative access status: ACTIVE - orn: >- - orn:okta:governance:00o5rb5mt2H3d1TJd0h7:bundles:0bbfxqCAJWWGELFTYAAA + orn: orn:okta:governance:00o5rb5mt2H3d1TJd0h7:bundles:0bbfxqCAJWWGELFTYAAA _links: - entitlements: >- - http://your-subdomain.okta.com/api/v1/iam/governance/bundles/0bbfxqCAJWWGELFTYAAA/entitlements + entitlements: http://your-subdomain.okta.com/api/v1/iam/governance/bundles/0bbfxqCAJWWGELFTYAAA/entitlements _links: self: - href: >- - http://your-subdomain.okta.com/api/v1/iam/governance/bundles?limit=2&after=10 + href: http://your-subdomain.okta.com/api/v1/iam/governance/bundles?limit=2&after=10 next: - href: >- - http://your-subdomain.okta.com/api/v1/iam/governance/bundles?after=bundleId12 + href: http://your-subdomain.okta.com/api/v1/iam/governance/bundles?after=bundleId12 GovernanceBundleCreateRequestStandardRole: summary: Create governance bundle with non-scoped standard role value: @@ -2455,10 +2967,8 @@ components: status: ACTIVE orn: orn:okta:governance:00o5rb5mt2H3d1TJd0h7:bundles:0bbfxqCAJWWGELFTYAAA _links: - self: >- - http://your-subdomain.okta.com/api/v1/iam/governance/bundles/0bbfxqCAJWWGELFTYAAA - entitlements: >- - http://your-subdomain.okta.com/api/v1/iam/governance/bundles/0bbfxqCAJWWGELFTYAAA/entitlements + self: http://your-subdomain.okta.com/api/v1/iam/governance/bundles/0bbfxqCAJWWGELFTYAAA + entitlements: http://your-subdomain.okta.com/api/v1/iam/governance/bundles/0bbfxqCAJWWGELFTYAAA/entitlements GovernanceBundleUpdateRequestStandardRole: summary: Update governance bundle with non-scoped standard role value: @@ -2493,18 +3003,14 @@ components: name: Group Membership Admin description: Perform all admin activities for groups in the org _links: - values: >- - http://your-subdomain.okta.com/api/v1/iam/governance/bundles/0bbfxqCAJWWGELFTYAAA/entitlements/espfxqCAJWWGELFTYASJ/values + values: http://your-subdomain.okta.com/api/v1/iam/governance/bundles/0bbfxqCAJWWGELFTYAAA/entitlements/espfxqCAJWWGELFTYASJ/values _links: self: - href: >- - http://your-subdomain.okta.com/api/v1/iam/governance/bundles?limit=2&after=10 + href: http://your-subdomain.okta.com/api/v1/iam/governance/bundles?limit=2&after=10 next: - href: >- - http://your-subdomain.okta.com/api/v1/iam/governance/bundles?after=bundleId12 + href: http://your-subdomain.okta.com/api/v1/iam/governance/bundles?after=bundleId12 bundle: - href: >- - http://your-subdomain.okta.com/api/v1/iam/governance/bundles/0bbfxqCAJWWGELFTYAAA + href: http://your-subdomain.okta.com/api/v1/iam/governance/bundles/0bbfxqCAJWWGELFTYAAA EntitlementValuesResponse: summary: List of bundle entitlement values value: @@ -2513,18 +3019,14 @@ components: value: orn:okta:00o5rb5mt2H3d1TJd0h7:groups:00guaxWZ0AOa5NFAj0g3 name: Restricted users group _links: - group: >- - http://your-subdomain.okta.com/api/v1/groups/00guaxWZ0AOa5NFAj0g3 + group: http://your-subdomain.okta.com/api/v1/groups/00guaxWZ0AOa5NFAj0g3 _links: self: - href: >- - http://your-subdomain.okta.com/api/v1/iam/governance/bundles?limit=2&after=10 + href: http://your-subdomain.okta.com/api/v1/iam/governance/bundles?limit=2&after=10 bundle: - href: >- - http://your-subdomain.okta.com/api/v1/iam/governance/bundles/0bbfxqCAJWWGELFTYAAA + href: http://your-subdomain.okta.com/api/v1/iam/governance/bundles/0bbfxqCAJWWGELFTYAAA entitlements: - href: >- - http://your-subdomain.okta.com/api/v1/iam/governance/bundles/0bbfxqCAJWWGELFTYAAA/entitlements + href: http://your-subdomain.okta.com/api/v1/iam/governance/bundles/0bbfxqCAJWWGELFTYAAA/entitlements OptInStatusResponse: summary: Opt in response value: @@ -2549,14 +3051,11 @@ components: lastUpdated: '2021-02-06T16:20:57.000Z' _links: self: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g resources: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/resources + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/resources bindings: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings - id: iamoJDFKaJxGIr0oamd0q label: SF-IT-2 description: Second San Francisco IT Resource Set @@ -2564,18 +3063,14 @@ components: lastUpdated: '2021-02-06T16:20:57.000Z' _links: self: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd0q + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd0q resources: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd0q/resources + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd0q/resources bindings: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd0q/bindings + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd0q/bindings _links: next: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets?after=iamoJDFKaJxGIr0oamd0q + href: https://{yourOktaDomain}/api/v1/iam/resource-sets?after=iamoJDFKaJxGIr0oamd0q ResourceSetRequest: value: label: SF-IT-People @@ -2595,14 +3090,11 @@ components: lastUpdated: '2021-02-06T16:20:57.000Z' _links: self: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g resources: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/resources + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/resources bindings: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings ErrorAccessDenied: summary: Access Denied value: @@ -2623,18 +3115,14 @@ components: self: href: https://{yourOktaDomain}/api/v1/iam/roles/cr0WxyzJxGIr0ouum0g4 members: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings/cr0WxyzJxGIr0ouum0g4/members + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings/cr0WxyzJxGIr0ouum0g4/members _links: self: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings resource-set: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g next: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings?after=cr0WxyzJxGIr0ouum0g4 + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings?after=cr0WxyzJxGIr0ouum0g4 ResourceSetBindingCreateRequestExample: value: role: cr0Yq6IJxGIr0ouum0g3 @@ -2644,27 +3132,21 @@ components: value: _links: self: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings/cr0Yq6IJxGIr0ouum0g3 + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings/cr0Yq6IJxGIr0ouum0g3 bindings: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings resource-set: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g ResourceSetBindingResponseWithIdExample: value: id: cr0Yq6IJxGIr0ouum0g3 _links: self: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings/cr0Yq6IJxGIr0ouum0g3 + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings/cr0Yq6IJxGIr0ouum0g3 members: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings/cr0Yq6IJxGIr0ouum0g3/members + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings/cr0Yq6IJxGIr0ouum0g3/members resource-set: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g ResourceSetBindingMembersResponse: value: members: @@ -2682,11 +3164,9 @@ components: href: https://{yourOktaDomain}/api/v1/groups/00guaxWZ0AOa5NFAj0g3 _links: self: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings/cr0Yq6IJxGIr0ouum0g3/members + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings/cr0Yq6IJxGIr0ouum0g3/members binding: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings/cr0Yq6IJxGIr0ouum0g3 + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings/cr0Yq6IJxGIr0ouum0g3 ResourceSetBindingAddMembersRequestExample: value: additions: @@ -2711,20 +3191,16 @@ components: self: href: https://{yourOktaDomain}/api/v1/groups/00guaxWZ0AOa5NFAj0g3 resource: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/resources/ire2snv2xSY7a4iSe0g1 + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/resources/ire2snv2xSY7a4iSe0g1 - id: ire106riDrTYl4qA70g4 - orn: >- - orn:{partition}:directory:{yourOrgId}:groups:00gu67DU2qNCjNZYO0g3:contained_resources + orn: orn:{partition}:directory:{yourOrgId}:groups:00gu67DU2qNCjNZYO0g3:contained_resources created: '2021-02-06T16:20:57.000Z' lastUpdated: '2021-02-06T16:20:57.000Z' _links: self: - href: >- - https://{yourOktaDomain}/api/v1/groups/00gu67DU2qNCjNZYO0g3/users + href: https://{yourOktaDomain}/api/v1/groups/00gu67DU2qNCjNZYO0g3/users resource: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/resources/ire2snv2xSY7a4iSe0g2 + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/resources/ire2snv2xSY7a4iSe0g2 - id: irezvo4AwE2ngpMw40g3 orn: orn:{partition}:directory:{yourOrgId}:users created: '2021-02-06T16:20:57.000Z' @@ -2744,15 +3220,12 @@ components: groups: href: https://{yourOktaDomain}/api/v1/groups resource: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/resources/ire2snv2xSY7a4iSe0g3 + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/resources/ire2snv2xSY7a4iSe0g3 _links: next: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/resources?after=irezvn1ZZxLSIBM2J0g3 + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/resources?after=irezvn1ZZxLSIBM2J0g3 resource-set: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g ResourceSetResourcePostRequestExample: summary: Resource set with conditions request value: @@ -2778,8 +3251,7 @@ components: self: href: https://{yourOktaDomain}/api/v1/apps resource: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/resources/ire2snv2xSY7a4iSe0g1 + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/resources/ire2snv2xSY7a4iSe0g1 ResourceSetResourcePatchRequestExample: value: additions: @@ -2802,8 +3274,7 @@ components: lastUpdated: '2021-02-06T16:20:57.000Z' _links: permissions: - href: >- - https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3/permissions + href: https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3/permissions self: href: https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3 - id: cr0Fw7HKcWIroo88m3r1 @@ -2813,14 +3284,12 @@ components: lastUpdated: '2021-02-06T16:20:57.000Z' _links: permissions: - href: >- - https://{yourOktaDomain}/api/v1/iam/roles/cr0Fw7HKcWIroo88m3r1/permissions + href: https://{yourOktaDomain}/api/v1/iam/roles/cr0Fw7HKcWIroo88m3r1/permissions self: href: https://{yourOktaDomain}/api/v1/iam/roles/cr0Fw7HKcWIroo88m3r1 _links: next: - href: >- - https://{yourOktaDomain}/api/v1/iam/roles?after=cr0Fw7HKcWIroo88m3r1 + href: https://{yourOktaDomain}/api/v1/iam/roles?after=cr0Fw7HKcWIroo88m3r1 RoleRequest: value: label: UserCreator @@ -2839,8 +3308,7 @@ components: lastUpdated: '2021-02-06T16:20:57.000Z' _links: permissions: - href: >- - https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3/permissions + href: https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3/permissions self: href: https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3 ReplaceRoleRequest: @@ -2857,8 +3325,7 @@ components: role: href: https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3 self: - href: >- - https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3/permissions/okta.users.create + href: https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3/permissions/okta.users.create - label: okta.users.read created: '2021-02-06T16:20:57.000Z' lastUpdated: '2021-02-06T16:20:57.000Z' @@ -2872,8 +3339,7 @@ components: role: href: https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3 self: - href: >- - https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3/permissions/okta.users.read + href: https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3/permissions/okta.users.read - label: okta.groups.read created: '2021-02-06T16:20:57.000Z' lastUpdated: '2021-02-06T16:20:57.000Z' @@ -2881,8 +3347,7 @@ components: role: href: https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3 self: - href: >- - https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3/permissions/okta.groups.read + href: https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3/permissions/okta.groups.read - label: okta.users.userprofile.manage created: '2021-02-06T16:20:57.000Z' lastUpdated: '2021-02-06T16:20:57.000Z' @@ -2890,8 +3355,7 @@ components: role: href: https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3 self: - href: >- - https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3/permissions/okta.users.userprofile.manage + href: https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3/permissions/okta.users.userprofile.manage PermissionResponse: value: label: okta.users.manage @@ -2901,8 +3365,7 @@ components: role: href: https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3 self: - href: >- - https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3/permissions/okta.users.manage + href: https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3/permissions/okta.users.manage PermissionResponseWithConditions: value: label: okta.users.read @@ -2918,8 +3381,7 @@ components: role: href: https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3 self: - href: >- - https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3/permissions/okta.users.read + href: https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3/permissions/okta.users.read CreateUpdateIamRolePermissionRequestExampleWithInclude: value: conditions: @@ -2971,8 +3433,7 @@ components: openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/users_with_role_assignments/methods/list_users_with_role_assignments + - $ref: '#/components/x-stackQL-resources/users_with_role_assignments/methods/list_users_with_role_assignments' insert: [] update: [] delete: [] @@ -2989,6 +3450,9 @@ components: mediaType: application/json openAPIDocKey: '200' create_governance_bundle: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1iam~1governance~1bundles/post' response: @@ -3001,6 +3465,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_governance_bundle: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1iam~1governance~1bundles~1{bundleId}/put' response: @@ -3010,24 +3477,19 @@ components: operation: $ref: '#/paths/~1api~1v1~1iam~1governance~1bundles~1{bundleId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/governance_bundles/methods/list_governance_bundles - - $ref: >- - #/components/x-stackQL-resources/governance_bundles/methods/get_governance_bundle + - $ref: '#/components/x-stackQL-resources/governance_bundles/methods/get_governance_bundle' + - $ref: '#/components/x-stackQL-resources/governance_bundles/methods/list_governance_bundles' insert: - - $ref: >- - #/components/x-stackQL-resources/governance_bundles/methods/create_governance_bundle + - $ref: '#/components/x-stackQL-resources/governance_bundles/methods/create_governance_bundle' update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/governance_bundles/methods/delete_governance_bundle + - $ref: '#/components/x-stackQL-resources/governance_bundles/methods/delete_governance_bundle' replace: - - $ref: >- - #/components/x-stackQL-resources/governance_bundles/methods/replace_governance_bundle + - $ref: '#/components/x-stackQL-resources/governance_bundles/methods/replace_governance_bundle' bundle_entitlements: id: okta.iam.bundle_entitlements name: bundle_entitlements @@ -3035,15 +3497,13 @@ components: methods: list_bundle_entitlements: operation: - $ref: >- - #/paths/~1api~1v1~1iam~1governance~1bundles~1{bundleId}~1entitlements/get + $ref: '#/paths/~1api~1v1~1iam~1governance~1bundles~1{bundleId}~1entitlements/get' response: mediaType: application/json openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/bundle_entitlements/methods/list_bundle_entitlements + - $ref: '#/components/x-stackQL-resources/bundle_entitlements/methods/list_bundle_entitlements' insert: [] update: [] delete: [] @@ -3055,15 +3515,13 @@ components: methods: list_bundle_entitlement_values: operation: - $ref: >- - #/paths/~1api~1v1~1iam~1governance~1bundles~1{bundleId}~1entitlements~1{entitlementId}~1values/get + $ref: '#/paths/~1api~1v1~1iam~1governance~1bundles~1{bundleId}~1entitlements~1{entitlementId}~1values/get' response: mediaType: application/json openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/bundle_entitlement_values/methods/list_bundle_entitlement_values + - $ref: '#/components/x-stackQL-resources/bundle_entitlement_values/methods/list_bundle_entitlement_values' insert: [] update: [] delete: [] @@ -3093,8 +3551,7 @@ components: openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/opt_in_status/methods/get_opt_in_status + - $ref: '#/components/x-stackQL-resources/opt_in_status/methods/get_opt_in_status' insert: [] update: [] delete: [] @@ -3111,6 +3568,9 @@ components: mediaType: application/json openAPIDocKey: '200' create_resource_set: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1iam~1resource-sets/post' response: @@ -3123,6 +3583,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_resource_set: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1iam~1resource-sets~1{resourceSetIdOrLabel}/put' response: @@ -3130,27 +3593,21 @@ components: openAPIDocKey: '200' delete_resource_set: operation: - $ref: >- - #/paths/~1api~1v1~1iam~1resource-sets~1{resourceSetIdOrLabel}/delete + $ref: '#/paths/~1api~1v1~1iam~1resource-sets~1{resourceSetIdOrLabel}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/role_resource_sets/methods/list_resource_sets - - $ref: >- - #/components/x-stackQL-resources/role_resource_sets/methods/get_resource_set + - $ref: '#/components/x-stackQL-resources/role_resource_sets/methods/get_resource_set' + - $ref: '#/components/x-stackQL-resources/role_resource_sets/methods/list_resource_sets' insert: - - $ref: >- - #/components/x-stackQL-resources/role_resource_sets/methods/create_resource_set + - $ref: '#/components/x-stackQL-resources/role_resource_sets/methods/create_resource_set' update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/role_resource_sets/methods/delete_resource_set + - $ref: '#/components/x-stackQL-resources/role_resource_sets/methods/delete_resource_set' replace: - - $ref: >- - #/components/x-stackQL-resources/role_resource_sets/methods/replace_resource_set + - $ref: '#/components/x-stackQL-resources/role_resource_sets/methods/replace_resource_set' role_resource_set_bindings: id: okta.iam.role_resource_set_bindings name: role_resource_set_bindings @@ -3158,45 +3615,40 @@ components: methods: list_bindings: operation: - $ref: >- - #/paths/~1api~1v1~1iam~1resource-sets~1{resourceSetIdOrLabel}~1bindings/get + $ref: '#/paths/~1api~1v1~1iam~1resource-sets~1{resourceSetIdOrLabel}~1bindings/get' response: mediaType: application/json openAPIDocKey: '200' create_resource_set_binding: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1iam~1resource-sets~1{resourceSetIdOrLabel}~1bindings/post + $ref: '#/paths/~1api~1v1~1iam~1resource-sets~1{resourceSetIdOrLabel}~1bindings/post' response: mediaType: application/json openAPIDocKey: '200' get_binding: operation: - $ref: >- - #/paths/~1api~1v1~1iam~1resource-sets~1{resourceSetIdOrLabel}~1bindings~1{roleIdOrLabel}/get + $ref: '#/paths/~1api~1v1~1iam~1resource-sets~1{resourceSetIdOrLabel}~1bindings~1{roleIdOrLabel}/get' response: mediaType: application/json openAPIDocKey: '200' delete_binding: operation: - $ref: >- - #/paths/~1api~1v1~1iam~1resource-sets~1{resourceSetIdOrLabel}~1bindings~1{roleIdOrLabel}/delete + $ref: '#/paths/~1api~1v1~1iam~1resource-sets~1{resourceSetIdOrLabel}~1bindings~1{roleIdOrLabel}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/role_resource_set_bindings/methods/list_bindings - - $ref: >- - #/components/x-stackQL-resources/role_resource_set_bindings/methods/get_binding + - $ref: '#/components/x-stackQL-resources/role_resource_set_bindings/methods/get_binding' + - $ref: '#/components/x-stackQL-resources/role_resource_set_bindings/methods/list_bindings' insert: - - $ref: >- - #/components/x-stackQL-resources/role_resource_set_bindings/methods/create_resource_set_binding + - $ref: '#/components/x-stackQL-resources/role_resource_set_bindings/methods/create_resource_set_binding' update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/role_resource_set_bindings/methods/delete_binding + - $ref: '#/components/x-stackQL-resources/role_resource_set_bindings/methods/delete_binding' replace: [] role_resource_set_binding_members: id: okta.iam.role_resource_set_binding_members @@ -3205,45 +3657,40 @@ components: methods: list_members_of_binding: operation: - $ref: >- - #/paths/~1api~1v1~1iam~1resource-sets~1{resourceSetIdOrLabel}~1bindings~1{roleIdOrLabel}~1members/get + $ref: '#/paths/~1api~1v1~1iam~1resource-sets~1{resourceSetIdOrLabel}~1bindings~1{roleIdOrLabel}~1members/get' response: mediaType: application/json openAPIDocKey: '200' add_members_to_binding: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1iam~1resource-sets~1{resourceSetIdOrLabel}~1bindings~1{roleIdOrLabel}~1members/patch + $ref: '#/paths/~1api~1v1~1iam~1resource-sets~1{resourceSetIdOrLabel}~1bindings~1{roleIdOrLabel}~1members/patch' response: mediaType: application/json openAPIDocKey: '200' get_member_of_binding: operation: - $ref: >- - #/paths/~1api~1v1~1iam~1resource-sets~1{resourceSetIdOrLabel}~1bindings~1{roleIdOrLabel}~1members~1{memberId}/get + $ref: '#/paths/~1api~1v1~1iam~1resource-sets~1{resourceSetIdOrLabel}~1bindings~1{roleIdOrLabel}~1members~1{memberId}/get' response: mediaType: application/json openAPIDocKey: '200' unassign_member_from_binding: operation: - $ref: >- - #/paths/~1api~1v1~1iam~1resource-sets~1{resourceSetIdOrLabel}~1bindings~1{roleIdOrLabel}~1members~1{memberId}/delete + $ref: '#/paths/~1api~1v1~1iam~1resource-sets~1{resourceSetIdOrLabel}~1bindings~1{roleIdOrLabel}~1members~1{memberId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/role_resource_set_binding_members/methods/list_members_of_binding - - $ref: >- - #/components/x-stackQL-resources/role_resource_set_binding_members/methods/get_member_of_binding + - $ref: '#/components/x-stackQL-resources/role_resource_set_binding_members/methods/get_member_of_binding' + - $ref: '#/components/x-stackQL-resources/role_resource_set_binding_members/methods/list_members_of_binding' insert: [] update: - - $ref: >- - #/components/x-stackQL-resources/role_resource_set_binding_members/methods/add_members_to_binding + - $ref: '#/components/x-stackQL-resources/role_resource_set_binding_members/methods/add_members_to_binding' delete: - - $ref: >- - #/components/x-stackQL-resources/role_resource_set_binding_members/methods/unassign_member_from_binding + - $ref: '#/components/x-stackQL-resources/role_resource_set_binding_members/methods/unassign_member_from_binding' replace: [] role_resource_set_resources: id: okta.iam.role_resource_set_resources @@ -3252,62 +3699,61 @@ components: methods: list_resource_set_resources: operation: - $ref: >- - #/paths/~1api~1v1~1iam~1resource-sets~1{resourceSetIdOrLabel}~1resources/get + $ref: '#/paths/~1api~1v1~1iam~1resource-sets~1{resourceSetIdOrLabel}~1resources/get' response: mediaType: application/json openAPIDocKey: '200' add_resource_set_resource: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1iam~1resource-sets~1{resourceSetIdOrLabel}~1resources/post + $ref: '#/paths/~1api~1v1~1iam~1resource-sets~1{resourceSetIdOrLabel}~1resources/post' response: mediaType: application/json openAPIDocKey: '200' add_resource_set_resources: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1iam~1resource-sets~1{resourceSetIdOrLabel}~1resources/patch + $ref: '#/paths/~1api~1v1~1iam~1resource-sets~1{resourceSetIdOrLabel}~1resources/patch' response: mediaType: application/json openAPIDocKey: '200' get_resource_set_resource: operation: - $ref: >- - #/paths/~1api~1v1~1iam~1resource-sets~1{resourceSetIdOrLabel}~1resources~1{resourceId}/get + $ref: '#/paths/~1api~1v1~1iam~1resource-sets~1{resourceSetIdOrLabel}~1resources~1{resourceId}/get' response: mediaType: application/json openAPIDocKey: '200' replace_resource_set_resource: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1iam~1resource-sets~1{resourceSetIdOrLabel}~1resources~1{resourceId}/put + $ref: '#/paths/~1api~1v1~1iam~1resource-sets~1{resourceSetIdOrLabel}~1resources~1{resourceId}/put' response: mediaType: application/json openAPIDocKey: '200' delete_resource_set_resource: operation: - $ref: >- - #/paths/~1api~1v1~1iam~1resource-sets~1{resourceSetIdOrLabel}~1resources~1{resourceId}/delete + $ref: '#/paths/~1api~1v1~1iam~1resource-sets~1{resourceSetIdOrLabel}~1resources~1{resourceId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/role_resource_set_resources/methods/list_resource_set_resources - - $ref: >- - #/components/x-stackQL-resources/role_resource_set_resources/methods/get_resource_set_resource - insert: [] + - $ref: '#/components/x-stackQL-resources/role_resource_set_resources/methods/get_resource_set_resource' + - $ref: '#/components/x-stackQL-resources/role_resource_set_resources/methods/list_resource_set_resources' + insert: + - $ref: '#/components/x-stackQL-resources/role_resource_set_resources/methods/add_resource_set_resource' update: - - $ref: >- - #/components/x-stackQL-resources/role_resource_set_resources/methods/add_resource_set_resources + - $ref: '#/components/x-stackQL-resources/role_resource_set_resources/methods/add_resource_set_resources' delete: - - $ref: >- - #/components/x-stackQL-resources/role_resource_set_resources/methods/delete_resource_set_resource + - $ref: '#/components/x-stackQL-resources/role_resource_set_resources/methods/delete_resource_set_resource' replace: - - $ref: >- - #/components/x-stackQL-resources/role_resource_set_resources/methods/replace_resource_set_resource + - $ref: '#/components/x-stackQL-resources/role_resource_set_resources/methods/replace_resource_set_resource' roles: id: okta.iam.roles name: roles @@ -3320,6 +3766,9 @@ components: mediaType: application/json openAPIDocKey: '200' create_role: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1iam~1roles/post' response: @@ -3332,6 +3781,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_role: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1iam~1roles~1{roleIdOrLabel}/put' response: @@ -3341,12 +3793,12 @@ components: operation: $ref: '#/paths/~1api~1v1~1iam~1roles~1{roleIdOrLabel}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: '#/components/x-stackQL-resources/roles/methods/list_roles' - $ref: '#/components/x-stackQL-resources/roles/methods/get_role' + - $ref: '#/components/x-stackQL-resources/roles/methods/list_roles' insert: - $ref: '#/components/x-stackQL-resources/roles/methods/create_role' update: [] @@ -3367,54 +3819,59 @@ components: openAPIDocKey: '200' get_role_permission: operation: - $ref: >- - #/paths/~1api~1v1~1iam~1roles~1{roleIdOrLabel}~1permissions~1{permissionType}/get + $ref: '#/paths/~1api~1v1~1iam~1roles~1{roleIdOrLabel}~1permissions~1{permissionType}/get' response: mediaType: application/json openAPIDocKey: '200' create_role_permission: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1iam~1roles~1{roleIdOrLabel}~1permissions~1{permissionType}/post + $ref: '#/paths/~1api~1v1~1iam~1roles~1{roleIdOrLabel}~1permissions~1{permissionType}/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' replace_role_permission: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1iam~1roles~1{roleIdOrLabel}~1permissions~1{permissionType}/put + $ref: '#/paths/~1api~1v1~1iam~1roles~1{roleIdOrLabel}~1permissions~1{permissionType}/put' response: mediaType: application/json openAPIDocKey: '200' delete_role_permission: operation: - $ref: >- - #/paths/~1api~1v1~1iam~1roles~1{roleIdOrLabel}~1permissions~1{permissionType}/delete + $ref: '#/paths/~1api~1v1~1iam~1roles~1{roleIdOrLabel}~1permissions~1{permissionType}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/role_permissions/methods/list_role_permissions - - $ref: >- - #/components/x-stackQL-resources/role_permissions/methods/get_role_permission + - $ref: '#/components/x-stackQL-resources/role_permissions/methods/get_role_permission' + - $ref: '#/components/x-stackQL-resources/role_permissions/methods/list_role_permissions' insert: - - $ref: >- - #/components/x-stackQL-resources/role_permissions/methods/create_role_permission + - $ref: '#/components/x-stackQL-resources/role_permissions/methods/create_role_permission' update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/role_permissions/methods/delete_role_permission + - $ref: '#/components/x-stackQL-resources/role_permissions/methods/delete_role_permission' replace: - - $ref: >- - #/components/x-stackQL-resources/role_permissions/methods/replace_role_permission + - $ref: '#/components/x-stackQL-resources/role_permissions/methods/replace_role_permission' servers: - url: https://{subdomain}.okta.com/ variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/identity_sources.yaml b/providers/src/okta/v00.00.00000/services/identity_sources.yaml index cdd4f5f4..21776985 100644 --- a/providers/src/okta/v00.00.00000/services/identity_sources.yaml +++ b/providers/src/okta/v00.00.00000/services/identity_sources.yaml @@ -2,8 +2,274 @@ openapi: 3.0.3 info: title: identity_sources API description: okta identity_sources API - version: 5.1.0 + version: 2026.07.2 paths: + /api/v1/identity-sources/{identitySourceId}/groups: + post: + summary: Create an identity source group + description: >- + Creates a group in an identity source for the given identity source + instance + operationId: createIdentitySourceGroups + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/GroupsRequestSchema' + examples: + createGroupsPayload: + $ref: '#/components/examples/GroupsPayload' + responses: + '200': + description: Success + content: + application/json: + schema: + $ref: '#/components/schemas/GroupsResponseSchema' + examples: + group: + $ref: '#/components/examples/GroupsResponse' + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: + - apiToken: [] + - oauth2: + - okta.identitySources.manage + tags: + - IdentitySource + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathIdentitySourceId' + /api/v1/identity-sources/{identitySourceId}/groups/{groupOrExternalId}: + get: + summary: Retrieve an identity source group + description: >- + Retrieves a group from an identity source for a given identity source ID + and group ID or external ID + operationId: getIdentitySourceGroup + responses: + '200': + description: Success + content: + application/json: + schema: + $ref: '#/components/schemas/GroupsResponseSchema' + examples: + group: + $ref: '#/components/examples/GroupsResponse' + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: + - apiToken: [] + - oauth2: + - okta.identitySources.read + tags: + - IdentitySource + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathIdentitySourceId' + - $ref: '#/components/parameters/pathIdentitySourceGroupOrExternalId' + post: + summary: Update an identity source group + description: >- + Updates a group to an identity source for the given identity source + instance and group ID + operationId: updateIdentitySourceGroups + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/GroupsRequestSchema' + examples: + createGroupsPayload: + $ref: '#/components/examples/GroupsPayload' + responses: + '200': + description: Success + content: + application/json: + schema: + $ref: '#/components/schemas/GroupsResponseSchema' + examples: + group: + $ref: '#/components/examples/GroupsResponse' + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: + - apiToken: [] + - oauth2: + - okta.identitySources.manage + tags: + - IdentitySource + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathIdentitySourceId' + - $ref: '#/components/parameters/pathIdentitySourceGroupOrExternalId' + delete: + summary: Delete an identity source group + description: >- + Deletes a group in an identity source for a given identity source ID and + group ID + operationId: deleteIdentitySourceGroup + responses: + '204': + description: No Content + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: + - apiToken: [] + - oauth2: + - okta.identitySources.manage + tags: + - IdentitySource + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathIdentitySourceId' + - $ref: '#/components/parameters/pathIdentitySourceGroupOrExternalId' + /api/v1/identity-sources/{identitySourceId}/groups/{groupOrExternalId}/membership: + get: + summary: Retrieve the memberships for the given identity source group + description: >- + Retrieves the group memberships for the given identity source group in + the given identity source instance + operationId: getIdentitySourceGroupMemberships + parameters: + - $ref: '#/components/parameters/queryAfter' + - name: limit + in: query + description: >- + Specifies the number of group membership results in a page. Okta + recommends using a specific value other than the default or maximum. + + If your request times out, retry your request with a smaller `limit` + and [page the + results](https://developer.okta.com/docs/api/#pagination). + schema: + type: integer + format: int32 + maximum: 1000 + - $ref: '#/components/parameters/pathIdentitySourceId' + - $ref: '#/components/parameters/pathIdentitySourceGroupOrExternalId' + responses: + '200': + description: Success + content: + application/json: + schema: + $ref: '#/components/schemas/GroupMembershipsResponseSchema' + examples: + groupMembershipsResponse: + $ref: '#/components/examples/GroupMemberships' + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: + - apiToken: [] + - oauth2: + - okta.identitySources.read + tags: + - IdentitySource + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: [] + post: + summary: Create the memberships for the given identity source group + description: Creates the group memberships for the given identity source group + operationId: createIdentitySourceGroupsMemberships + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/MembershipRequestSchema' + examples: + createGroupsPayload: + $ref: '#/components/examples/MembershipPayload' + responses: + '204': + description: No Content + '400': + $ref: '#/components/responses/ErrorApiValidationFailed400' + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: + - apiToken: [] + - oauth2: + - okta.identitySources.manage + tags: + - IdentitySource + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathIdentitySourceId' + - $ref: '#/components/parameters/pathIdentitySourceGroupOrExternalId' + /api/v1/identity-sources/{identitySourceId}/groups/{groupOrExternalId}/membership/{memberExternalId}: + delete: + summary: Delete the memberships for the specified identity source group + description: >- + Deletes group memberships for the specified identity source group using + member external IDs + operationId: deleteIdentitySourceGroupMemberships + responses: + '204': + description: No Content + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: + - apiToken: [] + - oauth2: + - okta.identitySources.manage + tags: + - IdentitySource + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathIdentitySourceId' + - $ref: '#/components/parameters/pathIdentitySourceGroupOrExternalId' + - $ref: '#/components/parameters/pathIdentitySourceMemberExternalId' /api/v1/identity-sources/{identitySourceId}/sessions: get: summary: List all identity source sessions @@ -17,9 +283,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/IdentitySourceSession' + $ref: '#/components/schemas/ListIdentitySourceSessionsResponse' examples: sessionsList: $ref: '#/components/examples/ListSessionsResponseForGetSessions' @@ -39,6 +303,8 @@ paths: lifecycle: GA isGenerallyAvailable: false SKUs: [] + parameters: + - $ref: '#/components/parameters/pathIdentitySourceId' post: summary: Create an identity source session description: >- @@ -71,8 +337,8 @@ paths: lifecycle: GA isGenerallyAvailable: false SKUs: [] - parameters: - - $ref: '#/components/parameters/pathIdentitySourceId' + parameters: + - $ref: '#/components/parameters/pathIdentitySourceId' /api/v1/identity-sources/{identitySourceId}/sessions/{sessionId}: get: summary: Retrieve an identity source session @@ -106,6 +372,9 @@ paths: lifecycle: GA isGenerallyAvailable: false SKUs: [] + parameters: + - $ref: '#/components/parameters/pathIdentitySourceId' + - $ref: '#/components/parameters/pathIdentitySourceSessionId' delete: summary: Delete an identity source session description: >- @@ -131,9 +400,9 @@ paths: lifecycle: GA isGenerallyAvailable: false SKUs: [] - parameters: - - $ref: '#/components/parameters/pathIdentitySourceId' - - $ref: '#/components/parameters/pathIdentitySourceSessionId' + parameters: + - $ref: '#/components/parameters/pathIdentitySourceId' + - $ref: '#/components/parameters/pathIdentitySourceSessionId' /api/v1/identity-sources/{identitySourceId}/sessions/{sessionId}/bulk-delete: post: summary: Upload the data to be deleted in Okta @@ -170,24 +439,24 @@ paths: lifecycle: GA isGenerallyAvailable: false SKUs: [] - parameters: - - $ref: '#/components/parameters/pathIdentitySourceId' - - $ref: '#/components/parameters/pathIdentitySourceSessionId' - /api/v1/identity-sources/{identitySourceId}/sessions/{sessionId}/bulk-upsert: + parameters: + - $ref: '#/components/parameters/pathIdentitySourceId' + - $ref: '#/components/parameters/pathIdentitySourceSessionId' + /api/v1/identity-sources/{identitySourceId}/sessions/{sessionId}/bulk-group-memberships-delete: post: - summary: Upload the data to be upserted in Okta + summary: Upload the group memberships to be deleted in Okta description: >- - Uploads entities that need to be inserted or updated in Okta from the + Uploads the group memberships that need to be deleted in Okta from the identity source for the given session - operationId: uploadIdentitySourceDataForUpsert + operationId: uploadIdentitySourceGroupMembershipsForDelete requestBody: content: application/json: schema: - $ref: '#/components/schemas/BulkUpsertRequestBody' + $ref: '#/components/schemas/BulkGroupMembershipsDeleteRequestBody' examples: - bulkUpsertPayload: - $ref: '#/components/examples/bulkUpsertPayload' + bulkGroupMembershipsDeletePayload: + $ref: '#/components/examples/bulkGroupMembershipsDeletePayload' responses: '202': description: Accepted @@ -209,26 +478,29 @@ paths: lifecycle: GA isGenerallyAvailable: false SKUs: [] - parameters: - - $ref: '#/components/parameters/pathIdentitySourceId' - - $ref: '#/components/parameters/pathIdentitySourceSessionId' - /api/v1/identity-sources/{identitySourceId}/sessions/{sessionId}/start-import: + parameters: + - $ref: '#/components/parameters/pathIdentitySourceId' + - $ref: '#/components/parameters/pathIdentitySourceSessionId' + /api/v1/identity-sources/{identitySourceId}/sessions/{sessionId}/bulk-group-memberships-upsert: post: - summary: Start the import from the identity source + summary: Upload the group memberships to be upserted in Okta description: >- - Starts the import from the identity source described by the uploaded - bulk operations - operationId: startImportFromIdentitySource + Uploads the group memberships that need to be inserted or updated in + Okta from the identity source for the given session + operationId: uploadIdentitySourceGroupMembershipsForUpsert + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/BulkGroupMembershipsUpsertRequestBody' + examples: + bulkGroupMembershipsUpsertPayload: + $ref: '#/components/examples/bulkGroupMembershipsUpsertPayload' responses: - '200': - description: Success - content: - application/json: - schema: - $ref: '#/components/schemas/IdentitySourceSession' - examples: - triggeredSession: - $ref: '#/components/examples/TriggerSessionResponse' + '202': + description: Accepted + '400': + $ref: '#/components/responses/ErrorApiValidationFailed400' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -245,55 +517,480 @@ paths: lifecycle: GA isGenerallyAvailable: false SKUs: [] - parameters: - - $ref: '#/components/parameters/pathIdentitySourceId' - - $ref: '#/components/parameters/pathIdentitySourceSessionId' -components: - schemas: - IdentitySourceSession: - type: object - properties: - created: - type: string - description: The timestamp when the identity source session was created - format: date-time - readOnly: true - id: - type: string - description: The ID of the identity source session - readOnly: true - identitySourceId: - type: string - description: >- - The ID of the custom identity source for which the session is - created - readOnly: true - importType: - type: string - description: The type of import. All imports are `INCREMENTAL` imports. - readOnly: true - lastUpdated: - type: string - description: The timestamp when the identity source session was created - format: date-time - readOnly: true - status: - $ref: '#/components/schemas/IdentitySourceSessionStatus' - BulkDeleteRequestBody: - type: object - properties: - entityType: - description: >- - The type of data to bulk delete in a session. Currently, only - `USERS` is supported. - type: string - enum: - - USERS - profiles: - type: array + parameters: + - $ref: '#/components/parameters/pathIdentitySourceId' + - $ref: '#/components/parameters/pathIdentitySourceSessionId' + /api/v1/identity-sources/{identitySourceId}/sessions/{sessionId}/bulk-groups-delete: + post: + summary: Upload the group external IDs to be deleted in Okta + description: >- + Uploads external IDs of groups that need to be deleted in Okta from the + identity source for the given session + operationId: uploadIdentitySourceGroupsDataForDelete + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/BulkGroupDeleteRequestBody' + examples: + bulkGroupDeletePayload: + $ref: '#/components/examples/bulkGroupDeletePayload' + responses: + '202': + description: Accepted + '400': + $ref: '#/components/responses/ErrorApiValidationFailed400' + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: + - apiToken: [] + - oauth2: + - okta.identitySources.manage + tags: + - IdentitySource + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathIdentitySourceId' + - $ref: '#/components/parameters/pathIdentitySourceSessionId' + /api/v1/identity-sources/{identitySourceId}/sessions/{sessionId}/bulk-groups-upsert: + post: + summary: Upload the group profiles without memberships to be upserted in Okta + description: >- + Uploads the group profiles without memberships that need to be inserted + or updated in Okta from the identity source for the given session + operationId: uploadIdentitySourceGroupsForUpsert + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/BulkGroupUpsertRequestBody' + examples: + bulkGroupUpsertPayload: + $ref: '#/components/examples/bulkGroupUpsertPayload' + responses: + '202': + description: Accepted + '400': + $ref: '#/components/responses/ErrorApiValidationFailed400' + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: + - apiToken: [] + - oauth2: + - okta.identitySources.manage + tags: + - IdentitySource + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathIdentitySourceId' + - $ref: '#/components/parameters/pathIdentitySourceSessionId' + /api/v1/identity-sources/{identitySourceId}/sessions/{sessionId}/bulk-upsert: + post: + summary: Upload the data to be upserted in Okta + description: >- + Uploads entities that need to be inserted or updated in Okta from the + identity source for the given session + operationId: uploadIdentitySourceDataForUpsert + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/BulkUpsertRequestBody' + examples: + bulkUpsertPayload: + $ref: '#/components/examples/bulkUpsertPayload' + responses: + '202': + description: Accepted + '400': + $ref: '#/components/responses/ErrorApiValidationFailed400' + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: + - apiToken: [] + - oauth2: + - okta.identitySources.manage + tags: + - IdentitySource + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathIdentitySourceId' + - $ref: '#/components/parameters/pathIdentitySourceSessionId' + /api/v1/identity-sources/{identitySourceId}/sessions/{sessionId}/start-import: + post: + summary: Start the import from the identity source + description: >- + Starts the import from the identity source described by the uploaded + bulk operations + operationId: startImportFromIdentitySource + responses: + '200': + description: Success + content: + application/json: + schema: + $ref: '#/components/schemas/IdentitySourceSession' + examples: + triggeredSession: + $ref: '#/components/examples/TriggerSessionResponse' + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: + - apiToken: [] + - oauth2: + - okta.identitySources.manage + tags: + - IdentitySource + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathIdentitySourceId' + - $ref: '#/components/parameters/pathIdentitySourceSessionId' + /api/v1/identity-sources/{identitySourceId}/users: + post: + summary: Create an identity source user + description: >- + Creates a user in an identity source for the given identity source + instance + operationId: createIdentitySourceUser + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserRequestSchema' + examples: + userCreatePayload: + $ref: '#/components/examples/UserPayload' + responses: + '200': + description: Success + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: + - apiToken: [] + - oauth2: + - okta.identitySources.manage + tags: + - IdentitySource + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathIdentitySourceId' + /api/v1/identity-sources/{identitySourceId}/users/{externalId}: + get: + summary: Retrieve an identity source user + description: >- + Retrieves a user by external ID in an identity source for the given + identity source instance + operationId: getIdentitySourceUser + responses: + '200': + description: Success + content: + application/json: + schema: + $ref: '#/components/schemas/UserResponseSchema' + examples: + userResponse: + $ref: '#/components/examples/UserResponse' + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: + - apiToken: [] + - oauth2: + - okta.identitySources.read + tags: + - IdentitySource + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathIdentitySourceId' + - $ref: '#/components/parameters/pathExternalUserId' + put: + summary: Replace an existing identity source user + description: >- + Replaces an existing user for the given identity source instance and + external ID + operationId: replaceExistingIdentitySourceUser + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserRequestSchema' + examples: + userReplacePayload: + $ref: '#/components/examples/UserReplacePayload' + responses: + '200': + description: Success + content: + application/json: + schema: + $ref: '#/components/schemas/UserResponseSchema' + examples: + userResponse: + $ref: '#/components/examples/UserReplaceResponse' + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: + - apiToken: [] + - oauth2: + - okta.identitySources.manage + tags: + - IdentitySource + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathIdentitySourceId' + - $ref: '#/components/parameters/pathExternalUserId' + patch: + summary: Update an identity source user + description: >- + Updates a user to an identity source for the given identity source + instance and external ID + operationId: updateIdentitySourceUsers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UsersUpdateRequestSchema' + examples: + userCreatePayload: + $ref: '#/components/examples/UserUpdatePayload' + responses: + '200': + description: Success + content: + application/json: + schema: + $ref: '#/components/schemas/UserResponseSchema' + examples: + userResponse: + $ref: '#/components/examples/UserUpdateResponse' + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: + - apiToken: [] + - oauth2: + - okta.identitySources.manage + tags: + - IdentitySource + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathIdentitySourceId' + - $ref: '#/components/parameters/pathExternalUserId' + delete: + summary: Delete an identity source user + description: >- + Deletes a user in an identity source for the given identity source + instance and external ID + operationId: deleteIdentitySourceUser + responses: + '204': + description: No Content + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: + - apiToken: [] + - oauth2: + - okta.identitySources.manage + tags: + - IdentitySource + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathIdentitySourceId' + - $ref: '#/components/parameters/pathExternalUserId' +components: + schemas: + GroupsRequestSchema: + type: object + properties: + externalId: + type: string + description: The external ID of the identity source group to be created + maxLength: 255 + profile: + $ref: '#/components/schemas/IdentitySourceGroupProfileForUpsert' + GroupsResponseSchema: + type: object + properties: + externalId: + type: string + description: The external ID of the identity source group + maxLength: 255 + id: + type: string + description: The Okta group ID of the identity source group + readOnly: true + profile: + type: object + description: The profile information of the group + properties: + profile: + $ref: '#/components/schemas/IdentitySourceGroupProfileForUpsert' + GroupMembershipsResponseSchema: + type: object + properties: + memberExternalIds: + type: array + description: >- + A list of app user external IDs that are members of the group in + Okta + items: + type: string + maxLength: 255 + MembershipRequestSchema: + type: object + properties: + memberExternalId: + type: string + description: >- + The external ID of the user to be added as a member of the group in + Okta + maxLength: 255 + IdentitySourceSession: + type: object + properties: + created: + type: string + description: The timestamp when the identity source session was created + format: date-time + readOnly: true + id: + type: string + description: The ID of the identity source session + readOnly: true + identitySourceId: + type: string + description: >- + The ID of the custom identity source for which the session is + created + readOnly: true + importType: + type: string + description: The type of import. All imports are `INCREMENTAL` imports. + readOnly: true + lastUpdated: + type: string + description: The timestamp when the identity source session was created + format: date-time + readOnly: true + status: + $ref: '#/components/schemas/IdentitySourceSessionStatus' + BulkDeleteRequestBody: + type: object + properties: + entityType: + description: >- + The type of data to bulk delete in a session. Currently, only + `USERS` is supported. + type: string + enum: + - USERS + profiles: + type: array description: Array of profiles to be deleted items: $ref: '#/components/schemas/IdentitySourceUserProfileForDelete' + BulkGroupMembershipsDeleteRequestBody: + type: object + properties: + memberships: + $ref: '#/components/schemas/IdentitySourceGroupMembershipsDeleteProfile' + BulkGroupMembershipsUpsertRequestBody: + type: object + properties: + memberships: + $ref: '#/components/schemas/IdentitySourceGroupMembershipsUpsertProfile' + BulkGroupDeleteRequestBody: + type: object + properties: + externalIds: + type: array + description: Array of external IDs of groups that need to be deleted in Okta + minItems: 1 + maxItems: 200 + items: + type: string + maxLength: 255 + BulkGroupUpsertRequestBody: + type: object + properties: + profiles: + type: array + description: Array of group profiles that needs to be inserted or updated in Okta + minItems: 1 + maxItems: 200 + items: + type: object + properties: + externalId: + type: string + description: >- + The external ID of the group that needs to be created or + updated in Okta + maxLength: 255 + profile: + $ref: '#/components/schemas/IdentitySourceGroupProfileForUpsert' BulkUpsertRequestBody: type: object properties: @@ -302,22 +999,107 @@ components: The type of data to upsert into the session. Currently, only `USERS` is supported. type: string - enum: - - USERS - profiles: - type: array - description: Array of user profiles to be uploaded - items: - type: object - properties: - externalId: - type: string - description: >- - The external ID of the entity that needs to be created or - updated in Okta - maxLength: 512 - profile: - $ref: '#/components/schemas/IdentitySourceUserProfileForUpsert' + enum: + - USERS + profiles: + type: array + description: Array of user profiles to be uploaded + items: + type: object + properties: + externalId: + type: string + description: >- + The external ID of the entity that needs to be created or + updated in Okta + maxLength: 512 + profile: + $ref: '#/components/schemas/IdentitySourceUserProfileForUpsert' + UserRequestSchema: + type: object + properties: + externalId: + type: string + description: The external ID of the user in the identity source + maxLength: 512 + profile: + $ref: '#/components/schemas/IdentitySourceUserProfileForUpsertRequired' + UserResponseSchema: + type: object + properties: + created: + type: string + description: The timestamp when the user was created in the identity source + format: date-time + readOnly: true + externalId: + type: string + description: The external ID of the user in the identity source + readOnly: true + maxLength: 255 + id: + type: string + description: The ID of the user in the identity source + readOnly: true + lastUpdated: + type: string + description: The timestamp when the user was last updated in the identity source + format: date-time + readOnly: true + profile: + $ref: '#/components/schemas/IdentitySourceUserProfileForUpsert' + UsersUpdateRequestSchema: + type: object + properties: + profile: + $ref: '#/components/schemas/IdentitySourceUserProfileForUpsertRequired' + IdentitySourceGroupProfileForUpsert: + description: >- + Contains a set of external group attributes and their values that are + mapped to Okta standard properties. See the group [`profile` + object](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Group/#tag/Group/operation/getGroup!c=200&path=profile&t=response) + and Declaration of a Custom Identity Source Schema in [Using anything as + a + source](https://help.okta.com/okta_help.htm?type=oie&id=ext-anything-as-a-source). + + > **Note:** Profile attributes can only be of the string type. + type: object + properties: + description: + type: string + description: Description of the group + maxLength: 1024 + nullable: true + displayName: + type: string + description: Name of the group + minLength: 1 + maxLength: 255 + Error: + title: Error + type: object + properties: + errorCauses: + type: array + items: + $ref: '#/components/schemas/ErrorCause' + errorCode: + type: string + description: An Okta code for this type of error + errorId: + type: string + description: >- + A unique identifier for this error. This can be used by Okta Support + to help with troubleshooting. + errorLink: + type: string + description: An Okta code for this type of error + errorSummary: + type: string + description: >- + A short description of what caused this error. Sometimes this + contains dynamically-generated information about your specific + error. IdentitySourceSessionStatus: description: The current status of the identity source session type: string @@ -347,31 +1129,6 @@ components: ERROR: >- The processing of import data in the session encountered an error. You need to open a new session to upload the data again. - Error: - title: Error - type: object - properties: - errorCauses: - type: array - items: - $ref: '#/components/schemas/ErrorCause' - errorCode: - type: string - description: An Okta code for this type of error - errorId: - type: string - description: >- - A unique identifier for this error. This can be used by Okta Support - to help with troubleshooting. - errorLink: - type: string - description: An Okta code for this type of error - errorSummary: - type: string - description: >- - A short description of what caused this error. Sometimes this - contains dynamically-generated information about your specific - error. IdentitySourceUserProfileForDelete: type: object properties: @@ -379,12 +1136,109 @@ components: type: string description: The external ID of the entity that needs to be deleted in Okta maxLength: 512 + IdentitySourceGroupMembershipsDeleteProfile: + description: Array of group memberships that need to be deleted in Okta + minItems: 1 + maxItems: 200 + items: + type: object + properties: + groupExternalId: + type: string + description: >- + The external ID of the group whose memberships need to be deleted + in Okta + maxLength: 255 + memberExternalIds: + type: array + description: >- + Array of external IDs of member profiles that need to be inserted + in this group in Okta + items: + type: string + maxLength: 255 + type: array + IdentitySourceGroupMembershipsUpsertProfile: + description: Array of group memberships that need to be inserted or updated in Okta + minItems: 1 + maxItems: 200 + items: + type: object + properties: + groupExternalId: + type: string + description: >- + The external ID of the group whose memberships need to be inserted + or updated in Okta + maxLength: 255 + memberExternalIds: + type: array + description: >- + Array of external IDs of member profiles that need to be inserted + in this group in Okta + items: + type: string + maxLength: 255 + type: array IdentitySourceUserProfileForUpsert: + x-okta-ignore-redocly-rules-for-sdk: true + description: >- + Contains a set of external user attributes and their values that are + mapped to Okta standard and custom profile properties. See the + [`profile` + object](https://developer.okta.com/docs/api/openapi/okta-management/management/user/getuser#user/getuser/t=response&c=200&path=profile) + and Declaration of a Custom Identity Source Schema in [Using anything as + a + source](https://help.okta.com/okta_help.htm?type=oie&id=ext-anything-as-a-source). + + > **Note:** Profile attributes can only be of the string type. + type: object + properties: + email: + type: string + format: email + description: Email address of the user + minLength: 5 + maxLength: 100 + firstName: + type: string + description: First name of the user + minLength: 1 + maxLength: 50 + nullable: true + homeAddress: + type: string + description: Home address of the user + maxLength: 4096 + nullable: true + lastName: + type: string + description: Last name of the user + minLength: 1 + maxLength: 50 + nullable: true + mobilePhone: + type: string + description: Mobile phone number of the user + maxLength: 100 + nullable: true + secondEmail: + type: string + description: Alternative email address of the user + format: email + minLength: 5 + maxLength: 100 + userName: + type: string + description: Username of the user + maxLength: 100 + IdentitySourceUserProfileForUpsertRequired: + x-okta-ignore-redocly-rules-for-sdk: true description: >- Contains a set of external user attributes and their values that are mapped to Okta standard and custom profile properties. See the [`profile` - object](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#tag/User/operation/getUser!c=200&path=profile&t=response) + object](https://developer.okta.com/docs/api/openapi/okta-management/management/user/getuser#user/getuser/t=response&c=200&path=profile) and Declaration of a Custom Identity Source Schema in [Using anything as a source](https://help.okta.com/okta_help.htm?type=oie&id=ext-anything-as-a-source). @@ -430,11 +1284,21 @@ components: type: string description: Username of the user maxLength: 100 + required: + - email + - userName ErrorCause: type: object properties: errorSummary: type: string + ListIdentitySourceSessionsResponse: + type: object + properties: + identity_source_sessions: + type: array + items: + $ref: '#/components/schemas/IdentitySourceSession' responses: ErrorAccessDenied403: description: Forbidden @@ -481,6 +1345,33 @@ components: example: 0oa3l6l6WK6h0R0QW0g4 schema: type: string + pathIdentitySourceGroupOrExternalId: + name: groupOrExternalId + in: path + required: true + description: The Okta group ID or external ID of the identity source group + example: 00gsl4xM9ys8TdnbZ0g4 or GROUPEXT123456784C2IF + schema: + type: string + queryAfter: + name: after + in: query + schema: + type: string + description: >- + The cursor to use for pagination. It is an opaque string that specifies + your current location in the list and is obtained from the `Link` + response header. See + [Pagination](https://developer.okta.com/docs/api/#pagination) and [Link + header](https://developer.okta.com/docs/api/#link-header). + pathIdentitySourceMemberExternalId: + name: memberExternalId + in: path + required: true + description: The external ID of the identity source user + example: USEREXT123456784C2IFA + schema: + type: string pathIdentitySourceSessionId: name: sessionId in: path @@ -489,7 +1380,37 @@ components: example: aps1qqonvr2SZv6o70h8 schema: type: string + pathExternalUserId: + name: externalId + in: path + required: true + description: The external ID of the user + example: 00u7m9p9ZT8k2S2EX1f7 + schema: + type: string examples: + GroupsPayload: + value: + externalId: GROUPEXT123456784C2IF + profile: + displayName: West Coast users + description: All users West of The Rockies + GroupsResponse: + value: + id: 00gsl4xM9ys8TdnbZ0g4 + externalId: GROUPEXT123456784C2IF + profile: + displayName: West Coast users + description: All users West of The Rockies + GroupMemberships: + value: + memberExternalIds: + - USEREXT123456784C2IFA + - USEREXT123456784C3IFB + - USEREXT123456784C4IFC + MembershipPayload: + value: + memberExternalId: USEREXT123456784C2IFA ListSessionsResponseForGetSessions: value: - id: aps1qqonvr2SZv6o70h8 @@ -537,6 +1458,49 @@ components: - externalId: EXT123456784C2IF - externalId: EXT123456784C3IF - externalId: EXT123456784C4IF + bulkGroupMembershipsDeletePayload: + value: + memberships: + - groupExternalId: GROUPEXT123456784C2IFA + memberExternalIds: + - USEREXT123456784C2IFA + - USEREXT123456784C3IFB + - USEREXT123456784C4IFC + - groupExternalId: GROUPEXT123456784C2IFB + memberExternalIds: + - USEREXT123456784C2IFA + - USEREXT123456784C3IFB + - USEREXT123456784C4IFC + bulkGroupMembershipsUpsertPayload: + value: + memberships: + - groupExternalId: GROUPEXT123456784C2IFA + memberExternalIds: + - USEREXT123456784C2IFA + - USEREXT123456784C3IFB + - USEREXT123456784C4IFC + - groupExternalId: GROUPEXT123456784C2IFB + memberExternalIds: + - USEREXT123456784C2IFA + - USEREXT123456784C3IFB + - USEREXT123456784C4IFC + bulkGroupDeletePayload: + value: + externalIds: + - GROUPEXT123456784C2IF + - GROUPEXT123456784C3IF + - GROUPEXT123456784C4IF + bulkGroupUpsertPayload: + value: + profiles: + - externalId: GROUPEXT123456784C2IF + profile: + displayName: group1 + description: group1 description + - externalId: GROUPEXT123456784C3IF + profile: + displayName: group2 + description: group2 description bulkUpsertPayload: value: entityType: USERS @@ -549,7 +1513,16 @@ components: email: isaac.brock@example.com secondEmail: isaac2.brock@example.com mobilePhone: 123-456-7890 - homeAddress: Kirkland, WA + homeAddress: '10800 NE 8th St #600, Bellevue, WA 98004' + - externalId: EXT123456784C3IF + profile: + userName: jane.smith@example.com + firstName: Jane + lastName: Smith + email: jane.smith@example.com + secondEmail: jane2.smith@example.com + mobilePhone: 555-123-4567 + homeAddress: Seattle, WA 98101 TriggerSessionResponse: value: - id: aps1qqonvr2SZv6o70h8 @@ -558,6 +1531,65 @@ components: importType: INCREMENTAL created: '2022-04-04T15:56:05.000Z' lastUpdated: '2022-05-05T18:15:44.000Z' + UserPayload: + value: + externalId: EXT987654321Z9Y7X + profile: + userName: emily.jones@example.com + firstName: Emily + lastName: Jones + email: emily.jones@example.com + secondEmail: emily.secondary@example.com + mobilePhone: 987-654-3210 + homeAddress: '10800 NE 8th St #600, Bellevue, WA 98004' + UserResponse: + value: + id: 00u7m9p9ZT8k2S2EX1f7 + externalId: EXT987654321Z9Y7X + created: '2025-07-24T12:06:05.000Z' + lastUpdated: '2025-08-05T16:15:44.000Z' + profile: + userName: emily.jones@example.com + firstName: Emily + lastName: Jones + email: emily.jones@example.com + secondEmail: emily.secondary@example.com + mobilePhone: 987-654-3210 + homeAddress: '10800 NE 8th St #600, Bellevue, WA 98004' + UserReplacePayload: + value: + profile: + firstName: Emily + lastName: Brock + email: brockly@email.com + userName: brockly@email.com + UserReplaceResponse: + value: + profile: + firstName: Emily + lastName: Brock + email: brockly@email.com + userName: brockly@email.com + secondEmail: null + mobilePhone: null + homeAddress: null + UserUpdatePayload: + value: + profile: + firstName: Emily + lastName: Brock + email: emily.brock@update.com + userName: emily.brock@update.com + UserUpdateResponse: + value: + profile: + firstName: Emily + lastName: Brock + email: emily.brock@update.com + userName: emily.brock@update.com + secondEmail: emily.secondary@example.com + mobilePhone: 987-654-3210 + homeAddress: '10800 NE 8th St #600, Bellevue, WA 98004' ErrorAccessDenied: summary: Access Denied value: @@ -591,6 +1623,101 @@ components: errorId: sampleiCF-8D5rLW6myqiPItW errorCauses: [] x-stackQL-resources: + groups: + id: okta.identity_sources.groups + name: groups + title: Groups + methods: + create_identity_source_groups: + config: + requestBodyTranslate: + algorithm: naive + operation: + $ref: >- + #/paths/~1api~1v1~1identity-sources~1{identitySourceId}~1groups/post + response: + mediaType: application/json + openAPIDocKey: '200' + get_identity_source_group: + operation: + $ref: >- + #/paths/~1api~1v1~1identity-sources~1{identitySourceId}~1groups~1{groupOrExternalId}/get + response: + mediaType: application/json + openAPIDocKey: '200' + update_identity_source_groups: + config: + requestBodyTranslate: + algorithm: naive + operation: + $ref: >- + #/paths/~1api~1v1~1identity-sources~1{identitySourceId}~1groups~1{groupOrExternalId}/post + response: + mediaType: application/json + openAPIDocKey: '200' + delete_identity_source_group: + operation: + $ref: >- + #/paths/~1api~1v1~1identity-sources~1{identitySourceId}~1groups~1{groupOrExternalId}/delete + response: + mediaType: application/json + openAPIDocKey: '204' + sqlVerbs: + select: + - $ref: >- + #/components/x-stackQL-resources/groups/methods/get_identity_source_group + insert: + - $ref: >- + #/components/x-stackQL-resources/groups/methods/create_identity_source_groups + update: + - $ref: >- + #/components/x-stackQL-resources/groups/methods/update_identity_source_groups + delete: + - $ref: >- + #/components/x-stackQL-resources/groups/methods/delete_identity_source_group + replace: [] + group_memberships: + id: okta.identity_sources.group_memberships + name: group_memberships + title: Group Memberships + methods: + get_identity_source_group_memberships: + operation: + $ref: >- + #/paths/~1api~1v1~1identity-sources~1{identitySourceId}~1groups~1{groupOrExternalId}~1membership/get + response: + mediaType: application/json + openAPIDocKey: '200' + objectKey: $.memberExternalIds + create_identity_source_groups_memberships: + config: + requestBodyTranslate: + algorithm: naive + operation: + $ref: >- + #/paths/~1api~1v1~1identity-sources~1{identitySourceId}~1groups~1{groupOrExternalId}~1membership/post + response: + mediaType: application/json + openAPIDocKey: '204' + delete_identity_source_group_memberships: + operation: + $ref: >- + #/paths/~1api~1v1~1identity-sources~1{identitySourceId}~1groups~1{groupOrExternalId}~1membership~1{memberExternalId}/delete + response: + mediaType: application/json + openAPIDocKey: '204' + sqlVerbs: + select: + - $ref: >- + #/components/x-stackQL-resources/group_memberships/methods/get_identity_source_group_memberships + insert: + - $ref: >- + #/components/x-stackQL-resources/group_memberships/methods/create_identity_source_groups_memberships + update: [] + delete: + - $ref: >- + #/components/x-stackQL-resources/group_memberships/methods/delete_identity_source_group_memberships + replace: [] sessions: id: okta.identity_sources.sessions name: sessions @@ -603,6 +1730,15 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.identity_source_sessions + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListIdentitySourceSessionsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"identity_source_sessions\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_identity_source_session: operation: $ref: >- @@ -622,14 +1758,14 @@ components: $ref: >- #/paths/~1api~1v1~1identity-sources~1{identitySourceId}~1sessions~1{sessionId}/delete response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/sessions/methods/list_identity_source_sessions - $ref: >- #/components/x-stackQL-resources/sessions/methods/get_identity_source_session + - $ref: >- + #/components/x-stackQL-resources/sessions/methods/list_identity_source_sessions insert: - $ref: >- #/components/x-stackQL-resources/sessions/methods/create_identity_source_session @@ -644,18 +1780,64 @@ components: title: Identity Sources methods: upload_identity_source_data_for_delete: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: >- #/paths/~1api~1v1~1identity-sources~1{identitySourceId}~1sessions~1{sessionId}~1bulk-delete/post response: - mediaType: '' + mediaType: application/json + openAPIDocKey: '202' + upload_identity_source_group_memberships_for_delete: + config: + requestBodyTranslate: + algorithm: naive + operation: + $ref: >- + #/paths/~1api~1v1~1identity-sources~1{identitySourceId}~1sessions~1{sessionId}~1bulk-group-memberships-delete/post + response: + mediaType: application/json + openAPIDocKey: '202' + upload_identity_source_group_memberships_for_upsert: + config: + requestBodyTranslate: + algorithm: naive + operation: + $ref: >- + #/paths/~1api~1v1~1identity-sources~1{identitySourceId}~1sessions~1{sessionId}~1bulk-group-memberships-upsert/post + response: + mediaType: application/json + openAPIDocKey: '202' + upload_identity_source_groups_data_for_delete: + config: + requestBodyTranslate: + algorithm: naive + operation: + $ref: >- + #/paths/~1api~1v1~1identity-sources~1{identitySourceId}~1sessions~1{sessionId}~1bulk-groups-delete/post + response: + mediaType: application/json + openAPIDocKey: '202' + upload_identity_source_groups_for_upsert: + config: + requestBodyTranslate: + algorithm: naive + operation: + $ref: >- + #/paths/~1api~1v1~1identity-sources~1{identitySourceId}~1sessions~1{sessionId}~1bulk-groups-upsert/post + response: + mediaType: application/json openAPIDocKey: '202' upload_identity_source_data_for_upsert: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: >- #/paths/~1api~1v1~1identity-sources~1{identitySourceId}~1sessions~1{sessionId}~1bulk-upsert/post response: - mediaType: '' + mediaType: application/json openAPIDocKey: '202' start_import_from_identity_source: operation: @@ -670,12 +1852,85 @@ components: update: [] delete: [] replace: [] + users: + id: okta.identity_sources.users + name: users + title: Users + methods: + create_identity_source_user: + config: + requestBodyTranslate: + algorithm: naive + operation: + $ref: >- + #/paths/~1api~1v1~1identity-sources~1{identitySourceId}~1users/post + response: + mediaType: application/json + openAPIDocKey: '200' + get_identity_source_user: + operation: + $ref: >- + #/paths/~1api~1v1~1identity-sources~1{identitySourceId}~1users~1{externalId}/get + response: + mediaType: application/json + openAPIDocKey: '200' + replace_existing_identity_source_user: + config: + requestBodyTranslate: + algorithm: naive + operation: + $ref: >- + #/paths/~1api~1v1~1identity-sources~1{identitySourceId}~1users~1{externalId}/put + response: + mediaType: application/json + openAPIDocKey: '200' + update_identity_source_users: + config: + requestBodyTranslate: + algorithm: naive + operation: + $ref: >- + #/paths/~1api~1v1~1identity-sources~1{identitySourceId}~1users~1{externalId}/patch + response: + mediaType: application/json + openAPIDocKey: '200' + delete_identity_source_user: + operation: + $ref: >- + #/paths/~1api~1v1~1identity-sources~1{identitySourceId}~1users~1{externalId}/delete + response: + mediaType: application/json + openAPIDocKey: '204' + sqlVerbs: + select: + - $ref: >- + #/components/x-stackQL-resources/users/methods/get_identity_source_user + insert: + - $ref: >- + #/components/x-stackQL-resources/users/methods/create_identity_source_user + update: + - $ref: >- + #/components/x-stackQL-resources/users/methods/update_identity_source_users + delete: + - $ref: >- + #/components/x-stackQL-resources/users/methods/delete_identity_source_user + replace: + - $ref: >- + #/components/x-stackQL-resources/users/methods/replace_existing_identity_source_user servers: - url: https://{subdomain}.okta.com/ variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/idps.yaml b/providers/src/okta/v00.00.00000/services/idps.yaml index 3b21573b..f37ffe49 100644 --- a/providers/src/okta/v00.00.00000/services/idps.yaml +++ b/providers/src/okta/v00.00.00000/services/idps.yaml @@ -2,15 +2,12 @@ openapi: 3.0.3 info: title: idps API description: okta idps API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/idps: get: summary: List all IdPs - description: >- - Lists all identity provider (IdP) integrations with pagination. A subset - of IdPs can be returned that match a supported filter expression or - query. + description: Lists all identity provider (IdP) integrations with pagination. A subset of IdPs can be returned that match a supported filter expression or query. operationId: listIdentityProviders parameters: - name: q @@ -32,9 +29,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/IdentityProvider' + $ref: '#/components/schemas/ListIdentityProvidersResponse' examples: MultipleIdPsResponse: $ref: '#/components/examples/MultipleIdPsResponse' @@ -53,91 +48,46 @@ paths: isGenerallyAvailable: true post: summary: Create an IdP - description: >- + description: |- Creates a new identity provider (IdP) integration. - #### SAML 2.0 IdP + You must first add the IdP's signature certificate to the IdP key store before you can add a SAML 2.0 IdP with a `kid` credential reference. - You must first add the IdP's signature certificate to the IdP key store - before you can add a SAML 2.0 IdP with a `kid` credential reference. - - - Don't use `fromURI` to automatically redirect a user to a particular app - after successfully authenticating with a third-party IdP. Instead, use - SAML deep links. Using `fromURI` isn't tested or supported. For more - information about using deep links when signing users in using an - SP-initiated flow, see [Understanding SP-Initiated Login - flow](https://developer.okta.com/docs/concepts/saml/#understanding-sp-initiated-login-flow). - - - Use SAML deep links to automatically redirect the user to an app after - successfully authenticating with a third-party IdP. To use deep links, - assemble these three parts into a URL: + Don't use `fromURI` to automatically redirect a user to a particular app after successfully authenticating with a third-party IdP. Instead, use SAML deep links. Using `fromURI` isn't tested or supported. For more information about using deep links when signing users in using an SP-initiated flow, see [Understanding SP-Initiated Login flow](https://developer.okta.com/docs/concepts/saml/#understanding-sp-initiated-login-flow). + Use SAML deep links to automatically redirect the user to an app after successfully authenticating with a third-party IdP. To use deep links, assemble these three parts into a URL: * SP ACS URL
- For example: `https://${yourOktaDomain}/sso/saml2/:idpId` - - * The app to which the user is automatically redirected after - successfully authenticating with the IdP
- + * The app to which the user is automatically redirected after successfully authenticating with the IdP
For example: `/app/:app-location/:appId/sso/saml` - - * Optionally, if the app is an outbound SAML app, you can specify the - `relayState` passed to it.
- + * Optionally, if the app is an outbound SAML app, you can specify the `relayState` passed to it.
For example: `?RelayState=:anyUrlEncodedValue` - The deep link for the above three parts is:
- `https://${yourOktaDomain}/sso/saml2/:idpId/app/:app-location/:appId/sso/saml?RelayState=:anyUrlEncodedValue` - #### Smart Card X509 IdP - - You must first add the IdP's server certificate to the IdP key store - before you can add a Smart Card `X509` IdP with a `kid` credential - reference. - - You need to upload the whole trust chain as a single key using the [Key - Store - API](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProviderKeys/#tag/IdentityProviderKeys/operation/createIdentityProviderKey). - - Depending on the information stored in the smart card, select the proper - [template](https://developer.okta.com/docs/reference/okta-expression-language/#idp-user-profile) - `idpuser.subjectAltNameEmail` or `idpuser.subjectAltNameUpn`. - + You must first add the IdP's server certificate to the IdP key store before you can add a Smart Card `X509` IdP with a `kid` credential reference. + You need to upload the whole trust chain as a single key using the [Key Store API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProviderKeys/#tag/IdentityProviderKeys/operation/createIdentityProviderKey). + Depending on the information stored in the smart card, select the proper [template](https://developer.okta.com/docs/reference/okta-expression-language/#idp-user-profile) `idpuser.subjectAltNameEmail` or `idpuser.subjectAltNameUpn`. #### Identity verification vendors as identity providers + Identity verification (IDV) vendors work like IdPs, with a few key differences. IDV vendors verify your user's identities by requiring them to submit a proof of identity. There are many ways to verify user identities. For example, a proof of identity can be a selfie to determine liveliness or it can be requiring users to submit a photo of their driver's license and matching that information with a database. - Identity verification vendors (IDVs) work like IdPs, with a few key - differences. IDVs verify your user's identities by requiring them to - submit a proof of identity. There are many ways to verify user - identities. For example, a proof of identity can be a selfie to - determine liveliness or it can be requiring users to submit a photo of - their driver's license and matching that information with a database. - - - There are three IDVs that you can configure as IdPs in your org by - creating an account with the vendor, and then creating an IdP - integration. Control how the IDVs verify your users by using [Okta - account management policy - rules](https://developer.okta.com/docs/guides/okta-account-management-policy/main/). - + There are three IDV vendors (Persona, CLEAR Verified, and Incode) with specific configuration settings and another IDV vendor type (Custom IDV) that lets you create a custom IDV vendor, using a [standardized IDV process](https://developer.okta.com/docs/guides/idv-integration/main/). You can configure each of the IDV vendors as IdPs in your org by creating an account with the vendor, and then creating an IdP integration. Control how the IDVs verify your users by using [Okta account management policy rules](https://developer.okta.com/docs/guides/okta-account-management-policy/main/). * [Persona](https://withpersona.com/) - * [CLEAR Verified](https://www.clearme.com/) - * [Incode](https://incode.com/) + + * [Custom IDV](https://help.okta.com/okta_help.htm?type=oie&id=idp-add-custom-idv-vendor) operationId: createIdentityProvider x-codegen-request-body-name: identityProvider requestBody: @@ -147,6 +97,8 @@ paths: schema: $ref: '#/components/schemas/IdentityProvider' examples: + CreateOktaIntegrationIdPRequest: + $ref: '#/components/examples/CreateOktaIntegrationIdPRequest' CreateGenericOidcIdPRequest: $ref: '#/components/examples/CreateGenericOidcIdPRequest' CreateSamlIdPRequest: @@ -167,6 +119,8 @@ paths: $ref: '#/components/examples/CreateCLEARIDVRequest' CreateIncodeIDVRequest: $ref: '#/components/examples/CreateIncodeIDVRequest' + CreateCustomIDVRequest: + $ref: '#/components/examples/CreateCustomIDVRequest' required: true responses: '200': @@ -196,6 +150,8 @@ paths: $ref: '#/components/examples/CLEARIDVResponse' CreateIncodeIDVResponse: $ref: '#/components/examples/IncodeIDVResponse' + CreateCustomIDVResponse: + $ref: '#/components/examples/CustomIDVResponse' '400': $ref: '#/components/responses/ErrorApiValidationFailed400' '403': @@ -225,9 +181,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/IdPKeyCredential' + $ref: '#/components/schemas/ListIdentityProviderKeysResponse' examples: ListIdPKeyCredentialsResponse: $ref: '#/components/examples/MultipleIdPKeyCredentialsResponse' @@ -246,14 +200,9 @@ paths: isGenerallyAvailable: true post: summary: Create an IdP key credential - description: >- - Creates a new X.509 certificate credential in the identity provider - (IdP) key store - - > **Note:** RSA-based certificates are supported for all IdP types. Okta - currently supports EC-based certificates only for the `X509` IdP type. - For EC-based certificates we support only P-256, P-384, and P-521 - curves. + description: |- + Creates a new X.509 certificate credential in the identity provider (IdP) key store + > **Note:** RSA-based certificates are supported for all IdP types. Okta currently supports EC-based certificates only for the `X509` IdP type. For EC-based certificates we support only P-256, P-384, and P-521 curves. operationId: createIdentityProviderKey x-codegen-request-body-name: jsonWebKey requestBody: @@ -317,6 +266,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathKid' put: summary: Replace an IdP key credential description: Replaces an identity provider (IdP) key credential by `kid` @@ -358,11 +309,11 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathKid' delete: summary: Delete an IdP key credential - description: >- - Deletes a specific identity provider (IdP) key credential by `kid` if it - isn't currently being used by an active or inactive IdP + description: Deletes a specific identity provider (IdP) key credential by `kid` if it isn't currently being used by an active or inactive IdP operationId: deleteIdentityProviderKey responses: '204': @@ -383,8 +334,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathKid' + parameters: + - $ref: '#/components/parameters/pathKid' /api/v1/idps/{idpId}: get: summary: Retrieve an IdP @@ -417,6 +368,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathIdpId' put: summary: Replace an IdP description: Replaces an identity provider (IdP) integration by `idpId` @@ -459,16 +412,14 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathIdpId' delete: summary: Delete an IdP - description: >- + description: |- Deletes an identity provider (IdP) integration by `idpId` - - * All existing IdP users are unlinked with the highest order profile - source taking precedence for each IdP user. - - * Unlinked users keep their existing authentication provider such as - `FEDERATION` or `SOCIAL`. + * All existing IdP users are unlinked with the highest order profile source taking precedence for each IdP user. + * Unlinked users keep their existing authentication provider such as `FEDERATION` or `SOCIAL`. operationId: deleteIdentityProvider responses: '204': @@ -489,14 +440,12 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathIdpId' + parameters: + - $ref: '#/components/parameters/pathIdpId' /api/v1/idps/{idpId}/credentials/csrs: get: summary: List all certificate signing requests - description: >- - Lists all certificate signing requests (CSRs) for an identity provider - (IdP) + description: Lists all certificate signing requests (CSRs) for an identity provider (IdP) operationId: listCsrsForIdentityProvider responses: '200': @@ -504,9 +453,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/IdPCsr' + $ref: '#/components/schemas/ListCsrsForIdentityProviderResponse' examples: MultipleIdPCsrsResponse: $ref: '#/components/examples/MultipleIdPCsrsResponse' @@ -525,16 +472,13 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathIdpId' post: summary: Generate a certificate signing request - description: >- - Generates a new key pair and returns a certificate signing request (CSR) - for it - - > **Note:** The private key isn't listed in the [signing key credentials - for the identity provider - (IdP)](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProviderSigningKeys/#tag/IdentityProviderSigningKeys/operation/listIdentityProviderSigningKeys) - until it's published. + description: |- + Generates a new key pair and returns a certificate signing request (CSR) for it + > **Note:** The private key isn't listed in the [signing key credentials for the identity provider (IdP)](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProviderSigningKeys/#tag/IdentityProviderSigningKeys/operation/listIdentityProviderSigningKeys) until it's published. operationId: generateCsrForIdentityProvider x-codegen-request-body-name: metadata requestBody: @@ -576,8 +520,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathIdpId' + parameters: + - $ref: '#/components/parameters/pathIdpId' /api/v1/idps/{idpId}/credentials/csrs/{idpCsrId}: get: summary: Retrieve a certificate signing request @@ -614,11 +558,12 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathIdpId' + - $ref: '#/components/parameters/pathIdpCsrId' delete: summary: Revoke a certificate signing request - description: >- - Revokes a certificate signing request (CSR) and deletes the key pair - from the identity provider (IdP) + description: Revokes a certificate signing request (CSR) and deletes the key pair from the identity provider (IdP) operationId: revokeCsrForIdentityProvider responses: '204': @@ -639,24 +584,17 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathIdpId' - - $ref: '#/components/parameters/pathIdpCsrId' + parameters: + - $ref: '#/components/parameters/pathIdpId' + - $ref: '#/components/parameters/pathIdpCsrId' /api/v1/idps/{idpId}/credentials/csrs/{idpCsrId}/lifecycle/publish: post: summary: Publish a certificate signing request - description: >- - Publishes the certificate signing request (CSR) with a signed X.509 - certificate and adds it into the signing key credentials for the - identity provider (IdP) - + description: |- + Publishes the certificate signing request (CSR) with a signed X.509 certificate and adds it into the signing key credentials for the identity provider (IdP) > **Notes:** - - > * Publishing a certificate completes the lifecycle of the CSR, and - it's no longer accessible. - - > * If the validity period of the certificate is less than 90 days, a - 400 error response is returned. + > * Publishing a certificate completes the lifecycle of the CSR, and it's no longer accessible. + > * If the validity period of the certificate is less than 90 days, a 400 error response is returned. operationId: publishCsrForIdentityProvider requestBody: required: true @@ -665,25 +603,18 @@ paths: schema: type: string format: binary - description: >- - X.509 certificate in `DER` format. - - The client can either post in binary or Base64URL-encoded. If - the post is Base64URL-encoded, set the - `Content-Transfer-Encoding` header to `base64`. - example: >- - MIIFgjCCA2qgAwIBAgICEAcwDQYJKoZIhvcNAQELBQAwXjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMQ0wCwYDVQQKDARPa3RhMQwwCgYDVQQLDANFbmcxDTALBgNVBAMMBFJvb3QwHhcNMTcwMzI3MjEyMDQ3WhcNMTgwNDA2MjEyMDQ3WjB4MQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzETMBEGA1UECgwKT2t0YSwgSW5jLjEQMA4GA1UECwwHSmFua3lDbzEVMBMGA1UEAwwMSWRQIElzc3VlciA3MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmkC6yAJVvFwUlmM9gKjb2d+YK5qHFt+mXSsbjWKKs4EfNm+BoQeeovBZtSACyaqLc8IYFTPEURFcbDQ9DkAL04uUIRD2gaHYY7uK0jsluEaXGq2RAIsmzAwNTzkiDw4q9pDL/q7n0f/SDt1TsMaMQayB6bU5jWsmqcWJ8MCRJ1aJMjZ16un5UVx51IIeCbe4QRDxEXGAvYNczsBoZxspDt28esSpq5W0dBFxcyGVudyl54Er3FzAguhgfMVjH+bUec9j2Tl40qDTktrYgYfxz9pfjm01Hl4WYP1YQxeETpSL7cQ5Ihz4jGDtHUEOcZ4GfJrPzrGpUrak8Qp5xcwCqQIDAQABo4IBLjCCASowCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBkAwMwYJYIZIAYb4QgENBCYWJE9wZW5TU0wgR2VuZXJhdGVkIFNlcnZlciBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUVqJukDmyENw/2pTApbxc/HRKbngwgZAGA1UdIwSBiDCBhYAUFx245ZZXqWTTbARfMlFWN77L9EahYqRgMF4xCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEMMAoGA1UECwwDRW5nMQ0wCwYDVQQDDARSb290ggkAlIfpwZjO5o8wDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA0GCSqGSIb3DQEBCwUAA4ICAQCcoBSRtY+9cJY00hLvq6AloYZcdn/kUQupfmyz4n3lKE3wV2FB0swKnK0QDi8iNuQJFdag/19vDHC4/LhoSuv1Q+KXM61pPZVRXXPyC1+e7Y6hj93tEI5HcqLPcDRH1AIG2l8tE7LBn+MQB5Vh6oxjG2IdoWxg6abMfISU+MauPWql4vMDUWo9iNShAo44Z5fd+nuz+hlAinU9Xn9Jf2QsfKvcbMRq7iuqgkabgdmObmWb9KK0Vm7TDkxCH0pB0onPr6epVUP8Obg/pT1Oj/1hOLbfR8CHHWdAWzUBGGvp2TIy2A8LUaEoFnwkxZfdL7Bnd0RH/ClBtAjzLOxmUo7NbZmEnYCcD5pZz7BdZI0db/eBXFqfOlA88rEe+9Sv+NndIq0/WNIIsJi2RgjJnxsxvB5MjhhzmItpFIUl5yqoO3C9jcCp6HDBJxtCGbvAr5ALPn5RCJeBIr67WpAiTd7L3Ebu9SQZlXnoHX8kP04EA6ylR3W0EFbh7KUtq8M2H2vo0wjMj7ysl/3tT7cEZ97s1ygO5iJx3GfMDyrDhtLXSBJ20uSxTJeptRw8SDiwTqunIh1WyKlcQz1WGauSbW4eXdj/r9KYMJ3qMMkdP/9THQUtTcOYx51r8RV9pdzqF2HPnZZNziBa+wXJZHEWp70NyoakNthgYwtypqiDHs2f3Q== + description: |- + X.509 certificate in `DER` format. + The client can either post in binary or Base64URL-encoded. If the post is Base64URL-encoded, set the `Content-Transfer-Encoding` header to `base64`. + example: MIIFgjCCA2qgAwIBAgICEAcwDQYJKoZIhvcNAQELBQAwXjELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMQ0wCwYDVQQKDARPa3RhMQwwCgYDVQQLDANFbmcxDTALBgNVBAMMBFJvb3QwHhcNMTcwMzI3MjEyMDQ3WhcNMTgwNDA2MjEyMDQ3WjB4MQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzETMBEGA1UECgwKT2t0YSwgSW5jLjEQMA4GA1UECwwHSmFua3lDbzEVMBMGA1UEAwwMSWRQIElzc3VlciA3MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmkC6yAJVvFwUlmM9gKjb2d+YK5qHFt+mXSsbjWKKs4EfNm+BoQeeovBZtSACyaqLc8IYFTPEURFcbDQ9DkAL04uUIRD2gaHYY7uK0jsluEaXGq2RAIsmzAwNTzkiDw4q9pDL/q7n0f/SDt1TsMaMQayB6bU5jWsmqcWJ8MCRJ1aJMjZ16un5UVx51IIeCbe4QRDxEXGAvYNczsBoZxspDt28esSpq5W0dBFxcyGVudyl54Er3FzAguhgfMVjH+bUec9j2Tl40qDTktrYgYfxz9pfjm01Hl4WYP1YQxeETpSL7cQ5Ihz4jGDtHUEOcZ4GfJrPzrGpUrak8Qp5xcwCqQIDAQABo4IBLjCCASowCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBkAwMwYJYIZIAYb4QgENBCYWJE9wZW5TU0wgR2VuZXJhdGVkIFNlcnZlciBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUVqJukDmyENw/2pTApbxc/HRKbngwgZAGA1UdIwSBiDCBhYAUFx245ZZXqWTTbARfMlFWN77L9EahYqRgMF4xCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEMMAoGA1UECwwDRW5nMQ0wCwYDVQQDDARSb290ggkAlIfpwZjO5o8wDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA0GCSqGSIb3DQEBCwUAA4ICAQCcoBSRtY+9cJY00hLvq6AloYZcdn/kUQupfmyz4n3lKE3wV2FB0swKnK0QDi8iNuQJFdag/19vDHC4/LhoSuv1Q+KXM61pPZVRXXPyC1+e7Y6hj93tEI5HcqLPcDRH1AIG2l8tE7LBn+MQB5Vh6oxjG2IdoWxg6abMfISU+MauPWql4vMDUWo9iNShAo44Z5fd+nuz+hlAinU9Xn9Jf2QsfKvcbMRq7iuqgkabgdmObmWb9KK0Vm7TDkxCH0pB0onPr6epVUP8Obg/pT1Oj/1hOLbfR8CHHWdAWzUBGGvp2TIy2A8LUaEoFnwkxZfdL7Bnd0RH/ClBtAjzLOxmUo7NbZmEnYCcD5pZz7BdZI0db/eBXFqfOlA88rEe+9Sv+NndIq0/WNIIsJi2RgjJnxsxvB5MjhhzmItpFIUl5yqoO3C9jcCp6HDBJxtCGbvAr5ALPn5RCJeBIr67WpAiTd7L3Ebu9SQZlXnoHX8kP04EA6ylR3W0EFbh7KUtq8M2H2vo0wjMj7ysl/3tT7cEZ97s1ygO5iJx3GfMDyrDhtLXSBJ20uSxTJeptRw8SDiwTqunIh1WyKlcQz1WGauSbW4eXdj/r9KYMJ3qMMkdP/9THQUtTcOYx51r8RV9pdzqF2HPnZZNziBa+wXJZHEWp70NyoakNthgYwtypqiDHs2f3Q== x-okta-operationId: publishBinaryDerCertForIdentityProvider application/x-x509-ca-cert: schema: type: string format: binary - description: >- + description: |- X.509 certificate in `CER` format. - - The client can either post in binary or Base64URL-encoded. If - the post is Base64URL-encoded, set the - `Content-Transfer-Encoding` header to `base64`. + The client can either post in binary or Base64URL-encoded. If the post is Base64URL-encoded, set the `Content-Transfer-Encoding` header to `base64`. example: '@certificate.cer' x-okta-operationId: publishBinaryCerCertForIdentityProvider application/x-pem-file: @@ -696,10 +627,6 @@ paths: responses: '201': description: Created - content: - application/json: - schema: - $ref: '#/components/schemas/IdPKeyCredential' '400': $ref: '#/components/responses/ErrorApiValidationFailed400' '403': @@ -717,9 +644,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathIdpId' - - $ref: '#/components/parameters/pathIdpCsrId' + parameters: + - $ref: '#/components/parameters/pathIdpId' + - $ref: '#/components/parameters/pathIdpCsrId' /api/v1/idps/{idpId}/credentials/keys: get: summary: List all signing key credentials for IdP @@ -731,13 +658,10 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/IdPKeyCredential' + $ref: '#/components/schemas/ListIdentityProviderSigningKeysResponse' examples: MultipleIdPSigningKeyCredentialsResponse: - $ref: >- - #/components/examples/MultipleIdPSigningKeyCredentialsResponse + $ref: '#/components/examples/MultipleIdPSigningKeyCredentialsResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -753,8 +677,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathIdpId' + parameters: + - $ref: '#/components/parameters/pathIdpId' /api/v1/idps/{idpId}/credentials/keys/active: get: summary: List the active signing key credential for IdP @@ -766,9 +690,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/IdPKeyCredential' + $ref: '#/components/schemas/ListActiveIdentityProviderSigningKeyResponse' examples: ActiveIdPSigningKeyCredentialResponse: $ref: '#/components/examples/ActiveIdPSigningKeyCredentialResponse' @@ -787,21 +709,14 @@ paths: isCorsEnabled: true lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathIdpId' + parameters: + - $ref: '#/components/parameters/pathIdpId' /api/v1/idps/{idpId}/credentials/keys/generate: post: summary: Generate a new signing key credential for IdP - description: >- - Generates a new X.509 certificate for an identity provider (IdP) signing - key credential to be used for signing assertions sent to the IdP. IdP - signing keys are read-only. - - > **Note:** To update an IdP with the newly generated key credential, - [update your - IdP](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/replaceIdentityProvider) - using the returned key's `kid` in the [signing - credential](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/replaceIdentityProvider!path=protocol/0/credentials/signing/kid&t=request). + description: |- + Generates a new X.509 certificate for an identity provider (IdP) signing key credential to be used for signing assertions sent to the IdP. IdP signing keys are read-only. + > **Note:** To update an IdP with the newly generated key credential, [update your IdP](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/replaceIdentityProvider) using the returned key's `kid` in the [signing credential](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/replaceIdentityProvider!path=protocol/0/credentials/signing/kid&t=request). operationId: generateIdentityProviderSigningKey parameters: - name: validityYears @@ -813,6 +728,7 @@ paths: format: int32 minimum: 2 maximum: 10 + - $ref: '#/components/parameters/pathIdpId' responses: '200': description: Success @@ -838,8 +754,6 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathIdpId' /api/v1/idps/{idpId}/credentials/keys/{kid}: get: summary: Retrieve a signing key credential for IdP @@ -870,22 +784,17 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathIdpId' - - $ref: '#/components/parameters/pathKid' + parameters: + - $ref: '#/components/parameters/pathIdpId' + - $ref: '#/components/parameters/pathKid' /api/v1/idps/{idpId}/credentials/keys/{kid}/clone: post: summary: Clone a signing key credential for IdP - description: >- - Clones an X.509 certificate for an identity provider (IdP) signing key - credential from a source IdP to target IdP - - > **Caution:** Sharing certificates isn't a recommended security - practice. + description: |- + Clones an X.509 certificate for an identity provider (IdP) signing key credential from a source IdP to target IdP + > **Caution:** Sharing certificates isn't a recommended security practice. - - > **Note:** If the key is already present in the list of key credentials - for the target IdP, you receive a 400 error response. + > **Note:** If the key is already present in the list of key credentials for the target IdP, you receive a 400 error response. operationId: cloneIdentityProviderKey parameters: - name: targetIdpId @@ -894,16 +803,11 @@ paths: description: '`id` of the target IdP' schema: type: string + - $ref: '#/components/parameters/pathIdpId' + - $ref: '#/components/parameters/pathKid' responses: '201': description: Created - content: - application/json: - schema: - $ref: '#/components/schemas/IdPKeyCredential' - examples: - IdPSigningKeyCredentialResponse: - $ref: '#/components/examples/IdPSigningKeyCredentialResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -919,9 +823,6 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathIdpId' - - $ref: '#/components/parameters/pathKid' /api/v1/idps/{idpId}/lifecycle/activate: post: summary: Activate an IdP @@ -952,8 +853,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathIdpId' + parameters: + - $ref: '#/components/parameters/pathIdpId' /api/v1/idps/{idpId}/lifecycle/deactivate: post: summary: Deactivate an IdP @@ -984,8 +885,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathIdpId' + parameters: + - $ref: '#/components/parameters/pathIdpId' /api/v1/idps/{idpId}/users: get: summary: List all users for IdP @@ -1001,15 +902,14 @@ paths: schema: type: string example: user + - $ref: '#/components/parameters/pathIdpId' responses: '200': description: Success content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/IdentityProviderApplicationUser' + $ref: '#/components/schemas/ListIdentityProviderApplicationUsersResponse' examples: ListIdPUsersResponse: $ref: '#/components/examples/ListIdPUsersResponse' @@ -1028,8 +928,6 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathIdpId' /api/v1/idps/{idpId}/users/{userId}: get: summary: Retrieve a user for IdP @@ -1060,20 +958,16 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathIdpId' + - $ref: '#/components/parameters/pathUserId' post: summary: Link a user to IdP - description: >- - Links an Okta user to an existing SAML or social identity provider - (IdP). - - - The SAML IdP must have `honorPersistentNameId` set to `true` to use this - API. + description: |- + Links an Okta user to an existing SAML or social identity provider (IdP). - The [Name Identifier - Format](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/replaceIdentityProvider!path=protocol/0/settings&t=request) - of the incoming assertion must be - `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent`. + The SAML IdP must have `honorPersistentNameId` set to `true` to use this API. + The [Name Identifier Format](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/replaceIdentityProvider!path=protocol/0/settings&t=request) of the incoming assertion must be `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent`. operationId: linkUserToIdentityProvider x-codegen-request-body-name: userIdentityProviderLinkRequest requestBody: @@ -1109,12 +1003,12 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathIdpId' + - $ref: '#/components/parameters/pathUserId' delete: summary: Unlink a user from IdP - description: >- - Unlinks the Okta user and the identity provider (IdP) user. The next - time the user federates into Okta through this IdP, they have to re-link - their account according to the account link policy. + description: Unlinks the Okta user and the identity provider (IdP) user. The next time the user federates into Okta through this IdP, they have to re-link their account according to the account link policy. operationId: unlinkUserFromIdentityProvider responses: '204': @@ -1135,21 +1029,16 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathIdpId' - - $ref: '#/components/parameters/pathUserId' + parameters: + - $ref: '#/components/parameters/pathIdpId' + - $ref: '#/components/parameters/pathUserId' /api/v1/idps/{idpId}/users/{userId}/credentials/tokens: get: summary: List all tokens from OIDC IdP - description: >- - Lists the tokens minted by the social authentication provider when the - user authenticates with Okta via Social Auth. + description: |- + Lists the tokens minted by the social authentication provider when the user authenticates with Okta via Social Auth. - - Okta doesn't import all the user information from a social provider. If - the app needs information that isn't imported, it can get the user token - from this endpoint. Then the app can make an API call to the social - provider with the token to request the additional information. + Okta doesn't import all the user information from a social provider. If the app needs information that isn't imported, it can get the user token from this endpoint. Then the app can make an API call to the social provider with the token to request the additional information. operationId: listSocialAuthTokens responses: '200': @@ -1157,9 +1046,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/SocialAuthToken' + $ref: '#/components/schemas/ListSocialAuthTokensResponse' examples: SocialAuthTokensResponse: $ref: '#/components/examples/SocialAuthTokensResponse' @@ -1178,183 +1065,46 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathIdpId' - - $ref: '#/components/parameters/pathUserId' + parameters: + - $ref: '#/components/parameters/pathIdpId' + - $ref: '#/components/parameters/pathUserId' components: schemas: IdentityProviderType: - description: >- - The IdP object's `type` property identifies the social or enterprise IdP - used for authentication. - - Each IdP uses a specific protocol, therefore the `protocol` object must - correspond with the IdP `type`. - - If the protocol is OAuth 2.0-based, the `protocol` object's `scopes` - property must also correspond with the scopes supported by the IdP - `type`. - - For policy actions supported by each IdP type, see [IdP type policy - actions](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=policy&t=request). - - - | Type | - Description - | Corresponding protocol | Corresponding protocol - scopes | - - | ------------------ | - ----------------------------------------------------------------------------------------------------------------------------------------------------- - | ---------------------- | - -------------------------------------------------------------------- | - - | `AMAZON` | - [Amazon](https://developer.amazon.com/settings/console/registration?return_to=/) as - the IdP | OpenID Connect - | `profile`, `profile:user_id` - | - - | `APPLE` | - [Apple](https://developer.apple.com/sign-in-with-apple/) as the - IdP | - OpenID Connect | `names`, `email`, - `openid` | - - | `DISCORD` | [Discord](https://discord.com/login) as the - IdP - | OAuth 2.0 | `identify`, - `email` | - - | `FACEBOOK` | - [Facebook](https://developers.facebook.com) as the - IdP - | OAuth 2.0 | `public_profile`, - `email` | - - | `GITHUB` | [GitHub](https://github.com/join) as the - IdP - | OAuth 2.0 | - `user` | - - | `GITLAB` | - [GitLab](https://gitlab.com/users/sign_in) as the - IdP - | OpenID Connect | `openid`, `read_user`, `profile`, - `email` | - - | `GOOGLE` | - [Google](https://accounts.google.com/signup) as the - IdP - | OpenID Connect | `openid`, `email`, - `profile` | - - | `IDV_PERSONA` | - [Persona](https://app.withpersona.com/dashboard/login) as the IDV - IdP | ID - verification - | - | - - | `IDV_CLEAR` | [CLEAR - Verified](https://www.clearme.com/) as the IDV - IdP - | ID verification | `openid`, `profile`, - `identity_assurance` | - - | `IDV_INCODE` | [Incode](https://incode.com/) as the IDV - IdP - | ID verification | `openid`, `profile`, - `identity_assurance` | - - | `LINKEDIN` | - [LinkedIn](https://developer.linkedin.com/) as the - IdP - | OAuth 2.0 | `r_emailaddress`, - `r_liteprofile` | - - | `LOGINGOV` | - [Login.gov](https://developers.login.gov/) as the - IdP - | OpenID Connect | `email`, `profile`, - `profile:name` | - - | `LOGINGOV_SANDBOX` | [Login.gov's identity - sandbox](https://developers.login.gov/testing/) as the - IdP | OpenID - Connect | `email`, `profile`, - `profile:name` | - - | `MICROSOFT` | [Microsoft Enterprise - SSO](https://azure.microsoft.com/) as the - IdP | - OpenID Connect | `openid`, `email`, `profile`, - `https://graph.microsoft.com/User.Read` | - - | `OIDC` | IdP that supports [OpenID - Connect](https://openid.net/specs/openid-connect-core-1_0.html) - | OpenID Connect | `openid`, `email`, - `profile` | - - | `PAYPAL` | [Paypal](https://www.paypal.com/signin) as - the - IdP - | OpenID Connect | `openid`, `email`, - `profile` | - - | `PAYPAL_SANDBOX` | [Paypal - Sandbox](https://developer.paypal.com/tools/sandbox/) as the - IdP | OpenID - Connect | `openid`, `email`, - `profile` | - - | `SALESFORCE` | - [SalesForce](https://login.salesforce.com/) as the - IdP - | OAuth 2.0 | `id`, `email`, - `profile` | - - | `SAML2` | Enterprise IdP that supports the [SAML 2.0 Web - Browser SSO - Profile](https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf)| - SAML 2.0 - | - | - - | `SPOTIFY` | [Spotify](https://developer.spotify.com/) as - the - IdP - | OpenID Connect | `user-read-email`, - `user-read-private` | - - | `X509` | [Smart Card - IdP](https://tools.ietf.org/html/rfc5280) - | Mutual TLS - | - | - - | `XERO` | - [Xero](https://www.xero.com/us/signup/api/) as the - IdP - | OpenID Connect | `openid`, `profile`, - `email` | - - | `YAHOO` | [Yahoo](https://login.yahoo.com/) as the - IdP - | OpenID Connect | `openid`, `profile`, - `email` | - - | `YAHOOJP` | [Yahoo - Japan](https://login.yahoo.co.jp/config/login) as the - IdP | - OpenID Connect | `openid`, `profile`, - `email` | - - | `OKTA_INTEGRATION` | IdP that supports the [OpenID - Connect](https://openid.net/specs/openid-connect-core-1_0.html) Org2Org - IdP | OpenID - Connect | `openid`, `email`, - `profile` | + description: |- + The IdP object's `type` property identifies the social or enterprise IdP used for authentication. + Each IdP uses a specific protocol, therefore the `protocol` object must correspond with the IdP `type`. + If the protocol is OAuth 2.0-based, the `protocol` object's `scopes` property must also correspond with the scopes supported by the IdP `type`. + For policy actions supported by each IdP type, see [IdP type policy actions](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=policy&t=request). + + | Type | Description | Corresponding protocol | Corresponding protocol scopes | + | ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------- | -------------------------------------------------------------------- | + | `AMAZON` | [Amazon](https://developer.amazon.com/settings/console/registration?return_to=/) as the IdP | OpenID Connect | `profile`, `profile:user_id` | + | `APPLE` | [Apple](https://developer.apple.com/sign-in-with-apple/) as the IdP | OpenID Connect | `names`, `email`, `openid` | + | `DISCORD` | [Discord](https://discord.com/login) as the IdP | OAuth 2.0 | `identify`, `email` | + | `FACEBOOK` | [Facebook](https://developers.facebook.com) as the IdP | OAuth 2.0 | `public_profile`, `email` | + | `GITHUB` | [GitHub](https://github.com/join) as the IdP | OAuth 2.0 | `user` | + | `GITLAB` | [GitLab](https://gitlab.com/users/sign_in) as the IdP | OpenID Connect | `openid`, `read_user`, `profile`, `email` | + | `GOOGLE` | [Google](https://accounts.google.com/signup) as the IdP | OpenID Connect | `openid`, `email`, `profile` | + | `IDV_PERSONA` | [Persona](https://app.withpersona.com/dashboard/login) as the IDV IdP | ID verification | | + | `IDV_CLEAR` | [CLEAR Verified](https://www.clearme.com/) as the IDV IdP | ID verification | `openid`, `profile`, `identity_assurance` | + | `IDV_INCODE` | [Incode](https://incode.com/) as the IDV IdP | ID verification | `openid`, `profile`, `identity_assurance` | + | `IDV_STANDARD` | Custom IDV as the IDV IdP | ID verification | `openid`, `profile`, `identity_assurance` | + | `LINKEDIN` | [LinkedIn](https://developer.linkedin.com/) as the IdP | OAuth 2.0 | `r_emailaddress`, `r_liteprofile` | + | `LOGINGOV` | [Login.gov](https://developers.login.gov/) as the IdP | OpenID Connect | `email`, `profile`, `profile:name` | + | `LOGINGOV_SANDBOX` | [Login.gov's identity sandbox](https://developers.login.gov/testing/) as the IdP | OpenID Connect | `email`, `profile`, `profile:name` | + | `MICROSOFT` | [Microsoft Enterprise SSO](https://azure.microsoft.com/) as the IdP | OpenID Connect | `openid`, `email`, `profile`, `https://graph.microsoft.com/User.Read` | + | `OIDC` | IdP that supports [OpenID Connect](https://openid.net/specs/openid-connect-core-1_0.html) | OpenID Connect | `openid`, `email`, `profile` | + | `PAYPAL` | [Paypal](https://www.paypal.com/signin) as the IdP | OpenID Connect | `openid`, `email`, `profile` | + | `PAYPAL_SANDBOX` | [Paypal Sandbox](https://developer.paypal.com/tools/sandbox/) as the IdP | OpenID Connect | `openid`, `email`, `profile` | + | `SALESFORCE` | [SalesForce](https://login.salesforce.com/) as the IdP | OAuth 2.0 | `id`, `email`, `profile` | + | `SAML2` | Enterprise IdP that supports the [SAML 2.0 Web Browser SSO Profile](https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf)| SAML 2.0 | | + | `SPOTIFY` | [Spotify](https://developer.spotify.com/) as the IdP | OpenID Connect | `user-read-email`, `user-read-private` | + | `X509` | [Smart Card IdP](https://tools.ietf.org/html/rfc5280) | Mutual TLS | | + | `XERO` | [Xero](https://www.xero.com/us/signup/api/) as the IdP | OpenID Connect | `openid`, `profile`, `email` | + | `YAHOO` | [Yahoo](https://login.yahoo.com/) as the IdP | OpenID Connect | `openid`, `profile`, `email` | + | `YAHOOJP` | [Yahoo Japan](https://login.yahoo.co.jp/config/login) as the IdP | OpenID Connect | `openid`, `profile`, `email` | + | `OKTA_INTEGRATION` | IdP that supports the [OpenID Connect](https://openid.net/specs/openid-connect-core-1_0.html) Org2Org IdP | OpenID Connect | `openid`, `email`, `profile` | type: string enum: - AMAZON @@ -1367,6 +1117,7 @@ components: - IDV_CLEAR - IDV_INCODE - IDV_PERSONA + - IDV_STANDARD - LINKEDIN - LOGINGOV - LOGINGOV_SANDBOX @@ -1383,6 +1134,7 @@ components: - YAHOO - YAHOOJP IdentityProvider: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: created: @@ -1406,15 +1158,41 @@ components: properties: $ref: '#/components/schemas/IdentityProviderProperties' protocol: - description: >- - IdP-specific protocol settings for endpoints, bindings, and - algorithms used to connect with the IdP and validate messages - oneOf: - - $ref: '#/components/schemas/ProtocolSaml' - - $ref: '#/components/schemas/ProtocolOAuth' - - $ref: '#/components/schemas/ProtocolOidc' - - $ref: '#/components/schemas/ProtocolMtls' - - $ref: '#/components/schemas/ProtocolIdVerification' + description: IdP-specific protocol settings for endpoints, bindings, and algorithms used to connect with the IdP and validate messages + discriminator: + propertyName: type + mapping: + SAML2: '#/components/schemas/ProtocolSaml' + OAUTH2: '#/components/schemas/ProtocolOAuth' + OIDC: '#/components/schemas/ProtocolOidc' + MTLS: '#/components/schemas/ProtocolMtls' + ID_PROOFING: '#/components/schemas/ProtocolIdVerification' + title: SAML 2.0 Protocol + type: object + properties: + algorithms: + $ref: '#/components/schemas/SamlAlgorithms' + credentials: + $ref: '#/components/schemas/SamlCredentials' + endpoints: + $ref: '#/components/schemas/SamlEndpoints' + relayState: + $ref: '#/components/schemas/SamlRelayState' + settings: + $ref: '#/components/schemas/SamlSettings' + type: + type: string + description: SAML 2.0 protocol + enum: + - SAML2 + scopes: + $ref: '#/components/schemas/OAuthScopes' + issuer: + $ref: '#/components/schemas/OidcIssuer' + oktaIdpOrgUrl: + type: string + description: URL of the IdP org + example: https://idp.example.com status: $ref: '#/components/schemas/LifecycleStatus' type: @@ -1422,50 +1200,229 @@ components: _links: type: object additionalProperties: true - allOf: - - $ref: '#/components/schemas/LinksSelf' - - properties: - acs: - description: SAML 2.0 Assertion Consumer Service URL for the Okta SP - allOf: - - $ref: '#/components/schemas/HrefObject' - authorize: - description: >- - OAuth 2.0 authorization endpoint for the IdP OAuth 2.0 - Authorization Code flow - allOf: - - $ref: '#/components/schemas/HrefObject' - clientRedirectUri: - description: Redirect URI for the OAuth 2.0 Authorization Code flow - allOf: - - $ref: '#/components/schemas/HrefObject' - metadata: - description: >- - Federation metadata document for the IdP (for example: SAML - 2.0 Metadata) - allOf: - - $ref: '#/components/schemas/HrefObject' - users: - description: IdP users - allOf: - - $ref: '#/components/schemas/HrefObject' - deactivate: - description: Deactivate IdP - allOf: - - $ref: '#/components/schemas/HrefObject' - activate: - description: Activate IdP - allOf: - - $ref: '#/components/schemas/HrefObject' - keys: - description: IdP keys - allOf: - - $ref: '#/components/schemas/HrefObject' + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + acs: + description: SAML 2.0 Assertion Consumer Service URL for the Okta SP + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + authorize: + description: OAuth 2.0 authorization endpoint for the IdP OAuth 2.0 Authorization Code flow + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + clientRedirectUri: + description: Redirect URI for the OAuth 2.0 Authorization Code flow + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + metadata: + description: 'Federation metadata document for the IdP (for example: SAML 2.0 Metadata)' + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + users: + description: IdP users + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + deactivate: + description: Deactivate IdP + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + activate: + description: Activate IdP + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + keys: + description: IdP keys + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + readOnly: true IdPKeyCredential: - description: >- - A [JSON Web Key](https://tools.ietf.org/html/rfc7517) for a signature or - encryption credential for an IdP + description: A [JSON Web Key](https://tools.ietf.org/html/rfc7517) for a signature or encryption credential for an IdP additionalProperties: true type: object properties: @@ -1490,8 +1447,7 @@ components: 'n': description: The modulus value for the RSA public key type: string - example: >- - 101438407598598116085679865987760095721749307901605456708912786847324207000576780508113360584555007890315805735307890113536927352312915634368993759211767770602174860126854831344273970871509573365292777620005537635317282520456901584213746937262823585533063042033441296629204165064680610660631365266976782082747 + example: '101438407598598116085679865987760095721749307901605456708912786847324207000576780508113360584555007890315805735307890113536927352312915634368993759211767770602174860126854831344273970871509573365292777620005537635317282520456901584213746937262823585533063042033441296629204165064680610660631365266976782082747' use: description: Intended use of the public key type: string @@ -1499,9 +1455,7 @@ components: x5c: $ref: '#/components/schemas/X5c' x5t#S256: - description: >- - Base64url-encoded SHA-256 thumbprint of the DER encoding of an X.509 - certificate + description: Base64url-encoded SHA-256 thumbprint of the DER encoding of an X.509 certificate type: string example: wzPVobIrveR1x-PCbjsFGNV-6zn7Rm9KuOWOG4Rk6jE IdPCertificateCredential: @@ -1512,6 +1466,7 @@ components: required: - x5c IdPCsr: + x-okta-ignore-redocly-rules-for-sdk: true description: Defines a CSR for a signature or decryption credential for an IdP type: object properties: @@ -1521,8 +1476,7 @@ components: description: Base64-encoded CSR in DER format type: string readOnly: true - example: >- - MIIC4DCCAcgCAQAwcTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk9rdGEsIEluYy4xDDAKBgNVBAsMA0RldjESMBAGA1UEAwwJU1AgSXNzdWVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6m8jHVCr9/tKvvbFN59T4raoCs/78KRm4fSefHQOv1TKLXo4wTLbsqYWRWc5u0sd5orUMQgPQOyj3i6qh13mALY4BzrT057EG1BUNjGg29QgYlnOk2iX890e5BIDMQQEIKFrvOi2V8cLUkLvE2ydRn0VO1Q1frbUkYeStJYC5Api2JQsYRwa+1ZeDH1ITnIzUaugWhW2WB2lSnwZkenne5KtffxMPYVu+IhNRHoKaRA6Z51YNhMJIx17JM2hs/H4Ka3drk6kzDf7ofk/yBpb9yBWyU7CTSQhdoHidxqFprMDaT66W928t3AeOENHBuwn8c2K9WeGG+bELNyQRJVmawIDAQABoCowKAYJKoZIhvcNAQkOMRswGTAXBgNVHREEEDAOggxkZXYub2t0YS5jb20wDQYJKoZIhvcNAQELBQADggEBAA2hsVJRVM+A83X9MekjTnIbt19UNT8wX7wlE9jUKirWsxceLiZBpVGn9qfKhhVIpvdaIRSeoFYS2Kg/m1G6bCvjmZLcrQ5FcEBjZH2NKfNppGVnfC2ugtUkBtCB+UUzOhKhRKJtGugenKbP33zRWWIqnd2waF6Cy8TIuqQVPbwEDN9bCbAs7ND6CFYNguY7KYjWzQOeAR716eqpEEXuPYAS4nx/ty4ylonR8cv+gpq51rvq80A4k/36aoeM0Y6I4w64vhTfuvWW2UYFUD+/+y2FA2CSP4JfctySrf1s525v6fzTFZ3qZbB5OZQtP2b8xYWktMzywsxGKDoVDB4wkH4= + example: MIIC4DCCAcgCAQAwcTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk9rdGEsIEluYy4xDDAKBgNVBAsMA0RldjESMBAGA1UEAwwJU1AgSXNzdWVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6m8jHVCr9/tKvvbFN59T4raoCs/78KRm4fSefHQOv1TKLXo4wTLbsqYWRWc5u0sd5orUMQgPQOyj3i6qh13mALY4BzrT057EG1BUNjGg29QgYlnOk2iX890e5BIDMQQEIKFrvOi2V8cLUkLvE2ydRn0VO1Q1frbUkYeStJYC5Api2JQsYRwa+1ZeDH1ITnIzUaugWhW2WB2lSnwZkenne5KtffxMPYVu+IhNRHoKaRA6Z51YNhMJIx17JM2hs/H4Ka3drk6kzDf7ofk/yBpb9yBWyU7CTSQhdoHidxqFprMDaT66W928t3AeOENHBuwn8c2K9WeGG+bELNyQRJVmawIDAQABoCowKAYJKoZIhvcNAQkOMRswGTAXBgNVHREEEDAOggxkZXYub2t0YS5jb20wDQYJKoZIhvcNAQELBQADggEBAA2hsVJRVM+A83X9MekjTnIbt19UNT8wX7wlE9jUKirWsxceLiZBpVGn9qfKhhVIpvdaIRSeoFYS2Kg/m1G6bCvjmZLcrQ5FcEBjZH2NKfNppGVnfC2ugtUkBtCB+UUzOhKhRKJtGugenKbP33zRWWIqnd2waF6Cy8TIuqQVPbwEDN9bCbAs7ND6CFYNguY7KYjWzQOeAR716eqpEEXuPYAS4nx/ty4ylonR8cv+gpq51rvq80A4k/36aoeM0Y6I4w64vhTfuvWW2UYFUD+/+y2FA2CSP4JfctySrf1s525v6fzTFZ3qZbB5OZQtP2b8xYWktMzywsxGKDoVDB4wkH4= id: description: Unique identifier for the CSR type: string @@ -1535,14 +1489,38 @@ components: _links: type: object additionalProperties: true - allOf: - - $ref: '#/components/schemas/LinksSelf' - - properties: - publish: - description: Publish the CSR - allOf: - - $ref: '#/components/schemas/HrefObject' + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + publish: + description: Publish the CSR + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + readOnly: true CsrMetadata: type: object properties: @@ -1555,6 +1533,7 @@ components: format: base64 type: string IdentityProviderApplicationUser: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: created: @@ -1573,18 +1552,12 @@ components: $ref: '#/components/schemas/LastUpdated' profile: type: object - description: >- + description: |- IdP-specific profile for the user. + IdP user profiles are IdP-specific but may be customized by the Profile Editor in the Admin Console. - IdP user profiles are IdP-specific but may be customized by the - Profile Editor in the Admin Console. - - - > **Note:** Okta variable names have reserved characters that may - conflict with the name of an IdP assertion attribute. You can use - the **External name** to define the attribute name as defined in an - IdP assertion such as a SAML attribute name. + > **Note:** Okta variable names have reserved characters that may conflict with the name of an IdP assertion attribute. You can use the **External name** to define the attribute name as defined in an IdP assertion such as a SAML attribute name. additionalProperties: type: object properties: {} @@ -1612,23 +1585,71 @@ components: _links: type: object additionalProperties: true - allOf: - - $ref: '#/components/schemas/LinksSelf' - - $ref: '#/components/schemas/LinksNext' - - properties: - idp: - description: The IdP instance - example: - href: https://{yourOktaDomain}/api/v1/idps/0oa1k5d68qR2954hb0g4 - allOf: - - $ref: '#/components/schemas/HrefObject' - user: - description: The linked Okta user - example: - href: https://{yourOktaDomain}/api/v1/users/00ulwodIu7wCfdiVR0g3 - allOf: - - $ref: '#/components/schemas/HrefObject' + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + next: + $ref: '#/components/schemas/HrefObjectNextLink' + idp: + description: The IdP instance + example: + href: https://{yourOktaDomain}/api/v1/idps/0oa1k5d68qR2954hb0g4 + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + user: + description: The linked Okta user + example: + href: https://{yourOktaDomain}/api/v1/users/00ulwodIu7wCfdiVR0g3 + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + readOnly: true UserIdentityProviderLinkRequest: type: object properties: @@ -1637,10 +1658,7 @@ components: description: Unique IdP-specific identifier for a user example: '121749775026145' SocialAuthToken: - description: >- - The social authentication token object provides the tokens and - associated metadata provided by social providers during social - authentication. + description: The social authentication token object provides the tokens and associated metadata provided by social providers during social authentication. type: object properties: expiresAt: @@ -1672,9 +1690,7 @@ components: tokenType: type: string readOnly: true - description: >- - The type of token defined by the [OAuth Token Exchange - Spec](https://tools.ietf.org/html/draft-ietf-oauth-token-exchange-07#section-3) + description: The type of token defined by the [OAuth Token Exchange Spec](https://tools.ietf.org/html/draft-ietf-oauth-token-exchange-07#section-3) example: urn:ietf:params:oauth:token-type:access_token Created: format: date-time @@ -1683,9 +1699,7 @@ components: type: string readOnly: true IdentityProviderIssuerMode: - description: >- - Indicates whether Okta uses the original Okta org domain URL or a custom - domain URL in the request to the social IdP + description: Indicates whether Okta uses the original Okta org domain URL or a custom domain URL in the request to the social IdP default: DYNAMIC type: string enum: @@ -1693,20 +1707,9 @@ components: - DYNAMIC - ORG_URL x-enumDescriptions: - ORG_URL: >- - In the authorize request to the social IdP, Okta uses the Okta org's - original domain URL (`https://${yourOktaDomain}`) as the domain in the - `redirect_uri`. - CUSTOM_URL: >- - In the authorize request to the social IdP, Okta uses the custom - domain URL as the domain in the `redirect_uri`. You can set - `issuerMode` to `CUSTOM_URL` only if you have a custom URL domain - configured. - DYNAMIC: >- - In the authorize request to the social IdP, Okta uses the custom - domain URL as the domain in the `redirect_uri` if the request was made - from the custom domain URL. Otherwise, Okta uses the Okta org's - original domain URL if the request was made from the Okta org domain. + ORG_URL: In the authorize request to the social IdP, Okta uses the Okta org's original domain URL (`https://${yourOktaDomain}`) as the domain in the `redirect_uri`. + CUSTOM_URL: In the authorize request to the social IdP, Okta uses the custom domain URL as the domain in the `redirect_uri`. You can set `issuerMode` to `CUSTOM_URL` only if you have a custom URL domain configured. + DYNAMIC: In the authorize request to the social IdP, Okta uses the custom domain URL as the domain in the `redirect_uri` if the request was made from the custom domain URL. Otherwise, Okta uses the Okta org's original domain URL if the request was made from the Okta org domain. LastUpdated: format: date-time description: Timestamp when the object was last updated @@ -1714,69 +1717,45 @@ components: type: string readOnly: true IdentityProviderPolicy: - description: >- + x-okta-ignore-redocly-rules-for-sdk: true + description: |- Policy settings for the IdP. - - The following provisioning and account linking actions are supported by - each IdP provider: - - | IdP type | - User provisioning actions | Group provisioning actions | - Account link actions | Account link filters | - - | ----------------------------------------------------------------- | - ------------------------- | ------------------------------------- | - -------------------- | -------------------- | - - | `SAML2` | - `AUTO` or `DISABLED` | `NONE`, `ASSIGN`, `APPEND`, or `SYNC` | - `AUTO`, `DISABLED` | `groups`, `users` | - - | `X509`, `IDV_PERSONA`, `IDV_INCODE`, and `IDV_CLEAR` | - `DISABLED` | No support for JIT provisioning - | | | - - | All other IdP types | - `AUTO`, `DISABLED` | `NONE` or `ASSIGN` | - `AUTO`, `DISABLED` | `groups`, `users` | - allOf: - - type: object - properties: - accountLink: - $ref: '#/components/schemas/PolicyAccountLink' - maxClockSkew: - type: integer - description: >- - Maximum allowable clock skew when processing messages from the - IdP - example: 120000 - provisioning: - $ref: '#/components/schemas/Provisioning' - subject: - $ref: '#/components/schemas/PolicySubject' + The following provisioning and account linking actions are supported by each IdP provider: + | IdP type | User provisioning actions | Group provisioning actions | Account link actions | Account link filters | + | ----------------------------------------------------------------- | ------------------------- | ------------------------------------- | -------------------- | -------------------- | + | `SAML2` | `AUTO` or `DISABLED` | `NONE`, `ASSIGN`, `APPEND`, or `SYNC` | `AUTO`, `DISABLED` | `groups`, `users` | + | `X509`, `IDV_PERSONA`, `IDV_INCODE`, `IDV_CLEAR` and `IDV_STANDARD`| `DISABLED` | No support for JIT provisioning | | | + | All other IdP types | `AUTO`, `DISABLED` | `NONE` or `ASSIGN` | `AUTO`, `DISABLED` | `groups`, `users` | + type: object + properties: + accountLink: + $ref: '#/components/schemas/PolicyAccountLink' + maxClockSkew: + type: integer + description: Maximum allowable clock skew when processing messages from the IdP + example: 120000 + trustClaims: + type: boolean + description: Indicates whether to trust authentication claims from the IdP + default: false + provisioning: + $ref: '#/components/schemas/Provisioning' + subject: + $ref: '#/components/schemas/PolicySubject' IdentityProviderProperties: nullable: true - description: >- - The properties in the IdP `properties` object vary depending on the IdP - type + description: The properties in the IdP `properties` object vary depending on the IdP type type: object properties: aalValue: type: string nullable: true - description: >- - The [authentication assurance - level](https://developers.login.gov/oidc/#aal-values) (AAL) value - for the Login.gov IdP. - - See [Add a Login.gov - IdP](https://developer.okta.com/docs/guides/add-logingov-idp/). - Applies to `LOGINGOV` and `LOGINGOV_SANDBOX` IdP types. + description: |- + The [authentication assurance level](https://developers.login.gov/oidc/#aal-values) (AAL) value for the Login.gov IdP. + See [Add a Login.gov IdP](https://developer.okta.com/docs/guides/add-logingov-idp/). Applies to `LOGINGOV` and `LOGINGOV_SANDBOX` IdP types. additionalAmr: type: array - description: >- - The additional Assurance Methods References (AMR) values for Smart - Card IdPs. Applies to `X509` IdP type. + description: The additional Assurance Methods References (AMR) values for Smart Card IdPs. Applies to `X509` IdP type. nullable: true items: type: string @@ -1790,31 +1769,48 @@ components: hwk: Hardware-secured key pin: Personal identification number mfa: Multifactor authentication + allowDynamicUserMatching: + type: boolean + description: |- + Enables authenticated users to enroll a Smart Card if the users can't be identified using the configured `matchAttribute`. Applies to `X509` IdP type. + + > **Note:** Enrollment requires a PIN if the Smart Card is PIN-protected. And enrollment is also blocked if the X.509 certificate contains restricted attributes (`login`, `email`, `secondEmail`, and configured attributes that are used in multiple identifiers). + default: false + allowUserUpdates: + type: boolean + description: |- + Enables attribute synchronization from the X.509 certificate to the user's Okta profile. If it's set to `true`, Okta overwrites user profile attributes with values found in the X.509 certificate. Applies to `X509` IdP type. + + > **Note:** Some attributes are restricted and won't be updated, including `login`, `email`, `secondEmail`, and configured attributes that are used in multiple identifiers. + default: false ialValue: type: string nullable: true - description: >- - The [type of identity - verification](https://developers.login.gov/oidc/#ial-values) (IAL) - value for the Login.gov IdP. - - See [Add a Login.gov - IdP](https://developer.okta.com/docs/guides/add-logingov-idp/). - Applies to `LOGINGOV` and `LOGINGOV_SANDBOX` IdP types. + description: |- + The [type of identity verification](https://developers.login.gov/oidc/#ial-values) (IAL) value for the Login.gov IdP. + See [Add a Login.gov IdP](https://developer.okta.com/docs/guides/add-logingov-idp/). Applies to `LOGINGOV` and `LOGINGOV_SANDBOX` IdP types. + idvMetadata: + type: object + description: Metadata about the IDV vendor. Available only for `IDV_STANDARD` IdPs. + properties: + vendorDisplayName: + type: string + description: The display name of the IDV vendor + termsOfUse: + type: string + description: A URL that links to the terms of use for the IDV vendor + privacyPolicy: + type: string + description: A URL that links to the privacy policy for the IDV vendor inquiryTemplateId: type: string - description: >- - The ID of the inquiry template from your Persona dashboard. The - inquiry template always starts with `itmpl`. Applies to the - `IDV_PERSONA` IdP type. + description: The ID of the inquiry template from your Persona dashboard. The inquiry template always starts with `itmpl`. Applies to the `IDV_PERSONA` IdP type. example: itmpl_HSctx8fNvXoHtrQfz2hxUVH8RBjG required: - inquiryTemplateId ProtocolSaml: title: SAML 2.0 Protocol - description: >- - Protocol settings for the [SAML 2.0 Authentication Request - Protocol](http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf) + description: Protocol settings for the [SAML 2.0 Authentication Request Protocol](http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf) type: object properties: algorithms: @@ -1834,9 +1830,7 @@ components: - SAML2 ProtocolOAuth: title: OAuth 2.0 Protocol - description: >- - Protocol settings for authentication using the [OAuth 2.0 Authorization - Code flow](https://tools.ietf.org/html/rfc6749#section-4.1) + description: Protocol settings for authentication using the [OAuth 2.0 Authorization Code flow](https://tools.ietf.org/html/rfc6749#section-4.1) type: object properties: credentials: @@ -1852,9 +1846,7 @@ components: - OAUTH2 ProtocolOidc: title: OpenID Connect Protocol - description: >- - Protocol settings for authentication using the [OpenID Connect - Protocol](http://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth) + description: Protocol settings for authentication using the [OpenID Connect Protocol](http://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth) type: object properties: algorithms: @@ -1863,19 +1855,17 @@ components: $ref: '#/components/schemas/OAuthCredentials' endpoints: $ref: '#/components/schemas/OAuthEndpoints' + issuer: + $ref: '#/components/schemas/OidcIssuer' oktaIdpOrgUrl: type: string description: URL of the IdP org example: https://idp.example.com scopes: type: array - description: >- - OpenID Connect and IdP-defined permission bundles to request - delegated access from the user - - > **Note:** The [IdP - type](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=type&t=request) - table lists the scopes that are supported for each IdP. + description: |- + OpenID Connect and IdP-defined permission bundles to request delegated access from the user + > **Note:** The [IdP type](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=type&t=request) table lists the scopes that are supported for each IdP. items: type: string example: openid @@ -1888,9 +1878,7 @@ components: - OIDC ProtocolMtls: title: Mutual TLS Protocol - description: >- - Protocol settings for the [MTLS - Protocol](https://tools.ietf.org/html/rfc5246#section-7.4.4) + description: Protocol settings for the [MTLS Protocol](https://tools.ietf.org/html/rfc5246#section-7.4.4) type: object properties: credentials: @@ -1904,7 +1892,7 @@ components: - MTLS ProtocolIdVerification: title: ID Verification - description: Protocol settings for the IDV + description: Protocol settings for the IDV vendor type: object properties: credentials: @@ -1924,19 +1912,14 @@ components: - ACTIVE - INACTIVE LinksSelf: - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the - [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. This object is used for dynamic discovery of related - resources and lifecycle operations. + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. type: object properties: self: $ref: '#/components/schemas/HrefObjectSelfLink' readOnly: true HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object additionalProperties: true type: object @@ -1953,15 +1936,11 @@ components: readOnly: true templated: type: boolean - description: >- - Indicates whether the link object's `href` property is a URI - template. + description: Indicates whether the link object's `href` property is a URI template. readOnly: true type: type: string - description: >- - The media type of the link. If omitted, it is implicitly - `application/json`. + description: The media type of the link. If omitted, it is implicitly `application/json`. readOnly: true required: - href @@ -1978,18 +1957,13 @@ components: description: An Okta code for this type of error errorId: type: string - description: >- - A unique identifier for this error. This can be used by Okta Support - to help with troubleshooting. + description: A unique identifier for this error. This can be used by Okta Support to help with troubleshooting. errorLink: type: string description: An Okta code for this type of error errorSummary: type: string - description: >- - A short description of what caused this error. Sometimes this - contains dynamically-generated information about your specific - error. + description: A short description of what caused this error. Sometimes this contains dynamically-generated information about your specific error. ExpiresAt: format: date-time description: Timestamp when the object expires @@ -2000,8 +1974,7 @@ components: description: Base64-encoded X.509 certificate chain with DER encoding items: type: string - example: >- - MIIDnjCCAoagAwIBAgIGAVG3MN+PMA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB2V4YW1wbGUxHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMTUxMjE4MjIyMjMyWhcNMjUxMjE4MjIyMzMyWjCBjzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdleGFtcGxlMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtcnyvuVCrsFEKCwHDenS3Ocjed8eWDv3zLtD2K/iZfE8BMj2wpTfn6Ry8zCYey3mWlKdxIybnV9amrujGRnE0ab6Q16v9D6RlFQLOG6dwqoRKuZy33Uyg8PGdEudZjGbWuKCqqXEp+UKALJHV+k4wWeVH8g5d1n3KyR2TVajVJpCrPhLFmq1Il4G/IUnPe4MvjXqB6CpKkog1+ThWsItPRJPAM+RweFHXq7KfChXsYE7Mmfuly8sDQlvBmQyxZnFHVuiPfCvGHJjpvHy11YlHdOjfgqHRvZbmo30+y0X/oY/yV4YEJ00LL6eJWU4wi7ViY3HP6/VCdRjHoRdr5L/DwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQCzzhOFkvyYLNFj2WDcq1YqD4sBy1iCia9QpRH3rjQvMKDwQDYWbi6EdOX0TQ/IYR7UWGj+2pXd6v0t33lYtoKocp/4lUvT3tfBnWZ5KnObi+J2uY2teUqoYkASN7F+GRPVOuMVoVgm05ss8tuMb2dLc9vsx93sDt+XlMTv/2qi5VPwaDtqduKkzwW9lUfn4xIMkTiVvCpe0X2HneD2Bpuao3/U8Rk0uiPfq6TooWaoW3kjsmErhEAs9bA7xuqo1KKY9CdHcFhkSsMhoeaZylZHtzbnoipUlQKSLMdJQiiYZQ0bYL83/Ta9fulr1EERICMFt3GUmtYaZZKHpWSfdJp9 + example: MIIDnjCCAoagAwIBAgIGAVG3MN+PMA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB2V4YW1wbGUxHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMTUxMjE4MjIyMjMyWhcNMjUxMjE4MjIyMzMyWjCBjzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdleGFtcGxlMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtcnyvuVCrsFEKCwHDenS3Ocjed8eWDv3zLtD2K/iZfE8BMj2wpTfn6Ry8zCYey3mWlKdxIybnV9amrujGRnE0ab6Q16v9D6RlFQLOG6dwqoRKuZy33Uyg8PGdEudZjGbWuKCqqXEp+UKALJHV+k4wWeVH8g5d1n3KyR2TVajVJpCrPhLFmq1Il4G/IUnPe4MvjXqB6CpKkog1+ThWsItPRJPAM+RweFHXq7KfChXsYE7Mmfuly8sDQlvBmQyxZnFHVuiPfCvGHJjpvHy11YlHdOjfgqHRvZbmo30+y0X/oY/yV4YEJ00LL6eJWU4wi7ViY3HP6/VCdRjHoRdr5L/DwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQCzzhOFkvyYLNFj2WDcq1YqD4sBy1iCia9QpRH3rjQvMKDwQDYWbi6EdOX0TQ/IYR7UWGj+2pXd6v0t33lYtoKocp/4lUvT3tfBnWZ5KnObi+J2uY2teUqoYkASN7F+GRPVOuMVoVgm05ss8tuMb2dLc9vsx93sDt+XlMTv/2qi5VPwaDtqduKkzwW9lUfn4xIMkTiVvCpe0X2HneD2Bpuao3/U8Rk0uiPfq6TooWaoW3kjsmErhEAs9bA7xuqo1KKY9CdHcFhkSsMhoeaZylZHtzbnoipUlQKSLMdJQiiYZQ0bYL83/Ta9fulr1EERICMFt3GUmtYaZZKHpWSfdJp9 type: array CsrMetadataSubject: type: object @@ -2020,9 +1993,7 @@ components: example: San Francisco organizationalUnitName: type: string - description: >- - Name of the smaller organization, for example, the department or the - division + description: Name of the smaller organization, for example, the department or the division example: Dev organizationName: type: string @@ -2042,17 +2013,11 @@ components: type: string example: dev.okta.com LinksNext: - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the - current status of an application using the [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. Use the `LinksNext` object for dynamic discovery of - related resources and lifecycle operations. + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status of an application using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. Use the `LinksNext` object for dynamic discovery of related resources and lifecycle operations. type: object properties: next: - $ref: '#/components/schemas/HrefObject' + $ref: '#/components/schemas/HrefObjectNextLink' readOnly: true PolicyAccountLink: description: Specifies the behavior for linking an IdP user to an existing Okta user @@ -2063,9 +2028,7 @@ components: filter: $ref: '#/components/schemas/PolicyAccountLinkFilter' Provisioning: - description: >- - Specifies the behavior for just-in-time (JIT) provisioning of an IdP - user as a new Okta user and their group memberships + description: Specifies the behavior for just-in-time (JIT) provisioning of an IdP user as a new Okta user and their group memberships type: object properties: action: @@ -2076,50 +2039,27 @@ components: $ref: '#/components/schemas/ProvisioningGroups' profileMaster: type: boolean - description: >- - Determines if the IdP should act as a source of truth for user - profile attributes + description: Determines if the IdP should act as a source of truth for user profile attributes PolicySubject: - description: >- - Specifies the behavior for establishing, validating, and matching a - username for an IdP user + description: Specifies the behavior for establishing, validating, and matching a username for an IdP user type: object properties: filter: type: string - description: >- - Optional [regular expression - pattern](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Regular_expressions) - used to filter untrusted IdP usernames. - - * As a best security practice, you should define a regular - expression pattern to filter untrusted IdP usernames. This is - especially important if multiple IdPs are connected to your org. The - filter prevents an IdP from issuing an assertion for any user, - including partners or directory users in your Okta org. - - * For example, the filter pattern `(\S+@example\.com)` allows only - Users that have an `@example.com` username suffix. It rejects - assertions that have any other suffix such as `@corp.example.com` or - `@partner.com`. - - * Only `SAML2` and `OIDC` IdP providers support the `filter` - property. + description: |- + Optional [regular expression pattern](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Regular_expressions) used to filter untrusted IdP usernames. + * As a best security practice, you should define a regular expression pattern to filter untrusted IdP usernames. This is especially important if multiple IdPs are connected to your org. The filter prevents an IdP from issuing an assertion for any user, including partners or directory users in your Okta org. + * For example, the filter pattern `(\S+@example\.com)` allows only Users that have an `@example.com` username suffix. It rejects assertions that have any other suffix such as `@corp.example.com` or `@partner.com`. + * Only `SAML2` and `OIDC` IdP providers support the `filter` property. maxLength: 1024 example: (\S+@example\.com) matchAttribute: type: string - description: >- - Okta user profile attribute for matching a transformed IdP username. - Only for matchType `CUSTOM_ATTRIBUTE`. - - The `matchAttribute` must be a valid Okta user profile attribute of - one of the following types: - + description: |- + Okta user profile attribute for matching a transformed IdP username. Only for matchType `CUSTOM_ATTRIBUTE`. + The `matchAttribute` must be a valid Okta user profile attribute of one of the following types: * String (with no format or 'email' format only) - * Integer - * Number example: login matchType: @@ -2135,9 +2075,7 @@ components: response: $ref: '#/components/schemas/SamlResponseAlgorithm' SamlCredentials: - description: >- - Federation Trust Credentials for verifying assertions from the IdP and - signing requests to the IdP + description: Federation Trust Credentials for verifying assertions from the IdP and signing requests to the IdP type: object properties: signing: @@ -2166,29 +2104,19 @@ components: properties: honorPersistentNameId: type: boolean - description: >- - Determines if the IdP should persist account linking when the - incoming assertion NameID format is - `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent` + description: Determines if the IdP should persist account linking when the incoming assertion NameID format is `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent` default: true nameFormat: $ref: '#/components/schemas/SamlNameIdFormat' participateSlo: type: boolean - description: >- - Set to `true` to have Okta send a logout request to the upstream IdP - when a user signs out of Okta or a downstream app. + description: Set to `true` to have Okta send a logout request to the upstream IdP when a user signs out of Okta or a downstream app. sendApplicationContext: type: boolean - description: >- - Determines if the IdP should send the application context as - `` and `` in the - `` element of the `` message + description: Determines if the IdP should send the application context as `` and `` in the `` element of the `` message default: false OAuthCredentials: - description: >- - Client authentication credentials for an [OAuth 2.0 Authorization - Server](https://tools.ietf.org/html/rfc6749#section-2.3) + description: Client authentication credentials for an [OAuth 2.0 Authorization Server](https://tools.ietf.org/html/rfc6749#section-2.3) type: object properties: client: @@ -2196,16 +2124,10 @@ components: signing: $ref: '#/components/schemas/AppleClientSigning' OAuthEndpoints: - description: >- - The `OAUTH2` and `OIDC` protocols support the `authorization` and - `token` endpoints. Also, the `OIDC` protocol supports the `userInfo` and - `jwks` endpoints. - + description: |- + The `OAUTH2` and `OIDC` protocols support the `authorization` and `token` endpoints. Also, the `OIDC` protocol supports the `userInfo` and `jwks` endpoints. - The IdP Authorization Server (AS) endpoints are currently defined as - part of the [IdP - provider]((https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=type&t=request)) - and are read-only. + The IdP Authorization Server (AS) endpoints are currently defined as part of the [IdP provider]((https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=type&t=request)) and are read-only. type: object properties: authorization: @@ -2219,13 +2141,9 @@ components: userInfo: $ref: '#/components/schemas/OidcUserInfoEndpoint' OAuthScopes: - description: >- - IdP-defined permission bundles to request delegated access from the - user. - - > **Note:** The [identity provider - type](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=type&t=request) - table lists the scopes that are supported for each IdP. + description: |- + IdP-defined permission bundles to request delegated access from the user. + > **Note:** The [identity provider type](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=type&t=request) table lists the scopes that are supported for each IdP. items: type: string example: public_profile @@ -2235,25 +2153,27 @@ components: properties: request: $ref: '#/components/schemas/OidcRequestAlgorithm' + OidcIssuer: + description: OIDC issuer identifier (issuer URL / expected `iss` value) for the external IdP + type: object + properties: + url: + type: string + description: Issuer URL identifying the external IdP (the expected `iss` value in OIDC tokens) + example: https://idp.example.com OidcSettings: description: Advanced settings for the OpenID Connect protocol type: object properties: participateSlo: type: boolean - description: >- - Set to `true` to have Okta send a logout request to the upstream IdP - when a user signs out of Okta or a downstream app. + description: Set to `true` to have Okta send a logout request to the upstream IdP when a user signs out of Okta or a downstream app. sendApplicationContext: type: boolean - description: >- - Determines if the IdP should send the application context as - `OktaAppInstanceId` and `OktaAppName` params in the request + description: Determines if the IdP should send the application context as `OktaAppInstanceId` and `OktaAppName` params in the request default: false MtlsCredentials: - description: >- - Certificate chain description for verifying assertions from the Smart - Card + description: Certificate chain description for verifying assertions from the Smart Card type: object properties: trust: @@ -2264,7 +2184,7 @@ components: sso: $ref: '#/components/schemas/MtlsSsoEndpoint' IDVCredentials: - description: Credentials for verifying requests to the IDV + description: Credentials for verifying requests to the IDV vendor type: object properties: bearer: @@ -2278,17 +2198,14 @@ components: - apiKey client: type: object - description: >- - Client credentials - for `IDV_CLEAR` and `IDV_INCODE` IdP types + description: Client credentials for `IDV_CLEAR` and `IDV_INCODE` IdP types properties: client_id: type: string - description: The client ID that you generate in your IDV + description: The client ID that you generate in your IDV vendor client_secret: type: string - description: The client secret that you generate in your IDV + description: The client secret that you generate in your IDV vendor required: - client_id - client_secret @@ -2297,20 +2214,49 @@ components: isGenerallyAvailable: false SKUs: [] IDVEndpoints: - description: Contains the endpoints for the IDV + description: Contains endpoints for the IDV vendor. When you create an `IDV_STANDARD` IdP, you must include the `par`, `authorization`, `token`, and `jwks` endpoints in the request body. type: object properties: authorization: $ref: '#/components/schemas/IDVAuthorizationEndpoint' + jwks: + $ref: '#/components/schemas/OidcJwksEndpoint' par: $ref: '#/components/schemas/IDVParEndpoint' token: $ref: '#/components/schemas/IDVTokenEndpoint' - readOnly: true + required: + - par + - authorization + - token + - jwks HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) HrefHints: description: Describes allowed HTTP verbs for the `href` type: object @@ -2324,6 +2270,33 @@ components: properties: errorSummary: type: string + HrefObjectNextLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the next resource PolicyAccountLinkAction: description: Specifies the account linking action for an IdP user type: string @@ -2331,20 +2304,10 @@ components: - AUTO - DISABLED x-enumDescriptions: - AUTO: >- - The IdP user is automatically linked to an Okta user when the - transformed IdP user matches an existing Okta user according to - [subject match - rules](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=policy/subject&t=request). - DISABLED: >- - Okta never attempts to link the IdP user to an existing Okta user, but - may still attempt to provision a new Okta user according to the - [provisioning action - type](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=policy/provisioning/action&t=request). + AUTO: The IdP user is automatically linked to an Okta user when the transformed IdP user matches an existing Okta user according to [subject match rules](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=policy/subject&t=request). + DISABLED: Okta never attempts to link the IdP user to an existing Okta user, but may still attempt to provision a new Okta user according to the [provisioning action type](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=policy/provisioning/action&t=request). PolicyAccountLinkFilter: - description: >- - Specifies filters on which users are available for account linking by an - IdP + description: Specifies filters on which users are available for account linking by an IdP type: object properties: groups: @@ -2352,30 +2315,18 @@ components: users: $ref: '#/components/schemas/PolicyAccountLinkFilterUsers' ProvisioningAction: - description: >- - Specifies the user provisioning action during authentication when an IdP - user isn't linked to an existing Okta user. - - * To successfully provision a new Okta user, you must enable - just-in-time (JIT) provisioning in your org security settings. - - * If the target username isn't unique or the resulting Okta user profile - is missing a required profile attribute, JIT provisioning may fail. - - * New Okta users are provisioned with either a `FEDERATION` or `SOCIAL` - authentication provider depending on the IdP type. + description: |- + Specifies the user provisioning action during authentication when an IdP user isn't linked to an existing Okta user. + * To successfully provision a new Okta user, you must enable just-in-time (JIT) provisioning in your org security settings. + * If the target username isn't unique or the resulting Okta user profile is missing a required profile attribute, JIT provisioning may fail. + * New Okta users are provisioned with either a `FEDERATION` or `SOCIAL` authentication provider depending on the IdP type. type: string enum: - AUTO - DISABLED x-enumDescriptions: - AUTO: >- - The IdP user profile is transformed through defined universal - directory profile mappings to an Okta user profile and automatically - provisioned as an Okta user. - DISABLED: >- - Okta rejects the authentication request and skips provisioning of a - new Okta user if the IdP user isn't linked to an existing Okta user. + AUTO: The IdP user profile is transformed through defined universal directory profile mappings to an Okta user profile and automatically provisioned as an Okta user. + DISABLED: Okta rejects the authentication request and skips provisioning of a new Okta user if the IdP user isn't linked to an existing Okta user. ProvisioningConditions: description: Conditional behaviors for an IdP user during authentication type: object @@ -2392,31 +2343,23 @@ components: $ref: '#/components/schemas/ProvisioningGroupsAction' assignments: type: array - description: >- - List of `OKTA_GROUP` group identifiers to add an IdP user as a - member with the `ASSIGN` action + description: List of `OKTA_GROUP` group identifiers to add an IdP user as a member with the `ASSIGN` action items: type: string example: 00gak46y5hydV6NdM0g4 filter: type: array - description: >- - Allowlist of `OKTA_GROUP` group identifiers for the `APPEND` or - `SYNC` provisioning action + description: Allowlist of `OKTA_GROUP` group identifiers for the `APPEND` or `SYNC` provisioning action items: type: string example: 00gak46y5hydV6NdM0g4 sourceAttributeName: type: string - description: >- - IdP user profile attribute name (case-insensitive) for an array - value that contains group memberships + description: IdP user profile attribute name (case-insensitive) for an array value that contains group memberships maxLength: 1024 example: Groups PolicySubjectMatchType: - description: >- - Determines the Okta user profile attribute match conditions for account - linking and authentication of the transformed IdP username + description: Determines the Okta user profile attribute match conditions for account linking and authentication of the transformed IdP username type: string enum: - CUSTOM_ATTRIBUTE @@ -2424,20 +2367,10 @@ components: - USERNAME - USERNAME_OR_EMAIL PolicyUserNameTemplate: - description: >- - [Okta Expression Language (EL) - expression](https://developer.okta.com/docs/reference/okta-expression-language/) - to generate or transform a unique username for the IdP user. - - * IdP user profile attributes can be referenced with the `idpuser` - prefix such as `idpuser.subjectNameId`. - - * You must define an IdP user profile attribute before it can be - referenced in an Okta EL expression. To define an IdP user attribute - policy, you may need to create a new IdP instance without a base profile - property. Then edit the IdP user profile to update the IdP instance with - an expression that references the IdP user profile attribute that you - just created. + description: |- + [Okta Expression Language (EL) expression](https://developer.okta.com/docs/reference/okta-expression-language/) to generate or transform a unique username for the IdP user. + * IdP user profile attributes can be referenced with the `idpuser` prefix such as `idpuser.subjectNameId`. + * You must define an IdP user profile attribute before it can be referenced in an Okta EL expression. To define an IdP user attribute policy, you may need to create a new IdP instance without a base profile property. Then edit the IdP user profile to update the IdP instance with an expression that references the IdP user profile attribute that you just created. type: object properties: template: @@ -2449,12 +2382,12 @@ components: description: Algorithm settings used to secure an `` message type: object properties: + digest: + $ref: '#/components/schemas/SamlRequestDigestAlgorithm' signature: $ref: '#/components/schemas/SamlRequestSignatureAlgorithm' SamlResponseAlgorithm: - description: >- - Algorithm settings for verifying `` messages and - `` elements from the IdP + description: Algorithm settings for verifying `` messages and `` elements from the IdP type: object properties: signature: @@ -2470,33 +2403,25 @@ components: type: object properties: additionalKids: - description: >- - Additional IdP key credential reference to the Okta X.509 signature - certificate + description: Additional IdP key credential reference to the Okta X.509 signature certificate type: array maxItems: 1 items: $ref: '#/components/schemas/ProtocolCredentialsKeyId' audience: type: string - description: >- - URI that identifies the target Okta IdP instance (SP) for an - `` + description: URI that identifies the target Okta IdP instance (SP) for an `` maxLength: 1024 example: https://www.okta.com/saml2/service-provider/spgv32vOnpdyeGSaiUpL issuer: type: string - description: >- - URI that identifies the issuer (IdP) of a `` message - `` element + description: URI that identifies the issuer (IdP) of a `` message `` element maxLength: 1024 example: urn:example:idp kid: $ref: '#/components/schemas/ProtocolCredentialsKeyId' SamlAcsEndpoint: - description: >- - Okta's `SPSSODescriptor` endpoint where the IdP sends a `` - message + description: Okta's `SPSSODescriptor` endpoint where the IdP sends a `` message type: object properties: binding: @@ -2504,56 +2429,39 @@ components: type: $ref: '#/components/schemas/SamlEndpointType' SamlSloEndpoint: - description: >- - IdP's `SingleLogoutService` endpoint where Okta sends a - `` message + description: IdP's `SingleLogoutService` endpoint where Okta sends a `` message type: object properties: binding: $ref: '#/components/schemas/ProtocolEndpointBinding' url: type: string - description: >- - URL of the binding-specific IdP endpoint where Okta sends a - `` + description: URL of the binding-specific IdP endpoint where Okta sends a `` maxLength: 1014 example: https://idp.example.com/saml2/slo SamlSsoEndpoint: - description: >- - IdP's `SingleSignOnService` endpoint where Okta sends an - `` message + description: IdP's `SingleSignOnService` endpoint where Okta sends an `` message type: object properties: binding: $ref: '#/components/schemas/ProtocolEndpointBinding' destination: type: string - description: >- - URI reference that indicates the address to which the - `` message is sent. - - The `destination` property is required if request signatures are - specified. See [SAML 2.0 Request Algorithm - object](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=protocol/0/algorithms/request&t=request). + description: |- + URI reference that indicates the address to which the `` message is sent. + The `destination` property is required if request signatures are specified. See [SAML 2.0 Request Algorithm object](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=protocol/0/algorithms/request&t=request). maxLength: 512 example: https://idp.example.com/saml2/sso url: type: string - description: >- - URL of the binding-specific endpoint to send an `` - message to the IdP. - - The value of `url` defaults to the same value as the `sso` endpoint - if omitted during creation of a new IdP instance. - - The `url` should be the same value as the `Location` attribute for a - published binding in the IdP's SAML Metadata `IDPSSODescriptor`. + description: |- + URL of the binding-specific endpoint to send an `` message to the IdP. + The value of `url` defaults to the same value as the `sso` endpoint if omitted during creation of a new IdP instance. + The `url` should be the same value as the `Location` attribute for a published binding in the IdP's SAML Metadata `IDPSSODescriptor`. maxLength: 1014 example: https://idp.example.com/saml2/sso SamlRelayStateFormat: - description: >- - The format used to generate the `relayState` in the SAML request. The - `FROM_URL` format is used if this value is null. + description: The format used to generate the `relayState` in the SAML request. The `FROM_URL` format is used if this value is null. type: string enum: - FROM_URL @@ -2568,63 +2476,43 @@ components: - urn:oasis:names:tc:SAML:2.0:nameid-format:persistent - urn:oasis:names:tc:SAML:2.0:nameid-format:transient OAuthCredentialsClient: - description: >- + description: |- OAuth 2.0 and OpenID Connect Client object - - > **Note:** You must complete client registration with the IdP - Authorization Server for your Okta IdP instance to obtain client - credentials. + > **Note:** You must complete client registration with the IdP Authorization Server for your Okta IdP instance to obtain client credentials. type: object properties: client_id: type: string - description: >- - The [Unique - identifier](https://tools.ietf.org/html/rfc6749#section-2.2) issued - by the AS for the Okta IdP instance + description: The [Unique identifier](https://tools.ietf.org/html/rfc6749#section-2.2) issued by the AS for the Okta IdP instance maxLength: 1024 example: your-client-id client_secret: type: string - description: >- - The [Client - secret](https://tools.ietf.org/html/rfc6749#section-2.3.1) issued by - the AS for the Okta IdP instance + description: The [Client secret](https://tools.ietf.org/html/rfc6749#section-2.3.1) issued by the AS for the Okta IdP instance maxLength: 1024 example: your-client-secret pkce_required: type: boolean - description: >- - Require Proof Key for Code Exchange (PKCE) for additional - verification + description: Require Proof Key for Code Exchange (PKCE) for additional verification token_endpoint_auth_method: type: string description: Client authentication methods supported by the token endpoint enum: - private_key_jwt AppleClientSigning: - description: >- - Information used to generate the secret JSON Web Token for the token - requests to Apple IdP - - > **Note:** The `privateKey` property is required for a CREATE request. - For an UPDATE request, it can be null and keeps the existing value if - it's null. The `privateKey` property isn't returned for LIST and GET - requests or UPDATE requests if it's null. + description: |- + Information used to generate the secret JSON Web Token for the token requests to Apple IdP + > **Note:** The `privateKey` property is required for a CREATE request. For an UPDATE request, it can be null and keeps the existing value if it's null. The `privateKey` property isn't returned for LIST and GET requests or UPDATE requests if it's null. type: object properties: kid: type: string - description: >- - The key ID that you obtained from Apple when you created the private - key for the client + description: The key ID that you obtained from Apple when you created the private key for the client maxLength: 1024 example: test key id privateKey: type: string - description: >- - The PKCS \#8 encoded private key that you created for the client and - downloaded from Apple + description: The PKCS \#8 encoded private key that you created for the client and downloaded from Apple maxLength: 1024 example: MIGTAgEAMBM........Cb9PnybCnzDv+3cWSGWqpAIsQQZ teamId: @@ -2633,9 +2521,7 @@ components: maxLength: 1024 example: test team id OAuthAuthorizationEndpoint: - description: >- - Endpoint for an [OAuth 2.0 Authorization Server - (AS)](https://tools.ietf.org/html/rfc6749#page-18) + description: Endpoint for an [OAuth 2.0 Authorization Server (AS)](https://tools.ietf.org/html/rfc6749#page-18) type: object properties: binding: @@ -2645,11 +2531,7 @@ components: description: URL of the IdP Authorization Server (AS) authorization endpoint example: https://idp.example.com/authorize OidcJwksEndpoint: - description: >- - Endpoint for the JSON Web Key Set (JWKS) document. This document - contains signing keys that are used to validate the signatures from the - provider. For more information on JWKS, see [JSON Web - Key](https://tools.ietf.org/html/rfc7517). + description: Endpoint for the JSON Web Key Set (JWKS) document. This document contains signing keys that are used to validate the signatures from the provider. For more information on JWKS, see [JSON Web Key](https://tools.ietf.org/html/rfc7517). type: object properties: binding: @@ -2668,9 +2550,7 @@ components: maxLength: 1014 example: https://idp.example.com/saml2/slo OAuthTokenEndpoint: - description: >- - Endpoint for an [OAuth 2.0 Authorization Server - (AS)](https://tools.ietf.org/html/rfc6749#page-18) + description: Endpoint for an [OAuth 2.0 Authorization Server (AS)](https://tools.ietf.org/html/rfc6749#page-18) type: object properties: binding: @@ -2680,10 +2560,7 @@ components: description: URL of the IdP Authorization Server (AS) token endpoint example: https://idp.example.com/token OidcUserInfoEndpoint: - description: >- - Endpoint for getting identity information about the user. For more - information on the `/userinfo` endpoint, see [OpenID - Connect](https://openid.net/specs/openid-connect-core-1_0.html#UserInfo). + description: Endpoint for getting identity information about the user. For more information on the `/userinfo` endpoint, see [OpenID Connect](https://openid.net/specs/openid-connect-core-1_0.html#UserInfo). type: object properties: binding: @@ -2716,13 +2593,17 @@ components: $ref: '#/components/schemas/MtlsTrustCredentialsRevocation' revocationCacheLifetime: type: number - description: Time in minutes to cache the certificate revocation information + description: |- + Time in minutes to cache the certificate revocation information + + > **Note:** This property isn't supported. Okta now handles CRL caching automatically. As of October 8, 2025, in Preview orgs, and October 13, 2025, in Production orgs, this property is ignored if it's specified in any API requests. Specifying this property in your API requests doesn't cause errors since the property has no effect. + > + > See [Deprecation Notice - Smart Card IdP Legacy CRL Cache Setting](https://support.okta.com/help/s/article/deprecation-notice-smart-card-idp-legacy-crl-cache-setting?language=en_US). + deprecated: true maximum: 4320 example: 2880 MtlsSsoEndpoint: - description: >- - The Single Sign-On (SSO) endpoint is the IdP's `SingleSignOnService` - endpoint + description: The Single Sign-On (SSO) endpoint is the IdP's `SingleSignOnService` endpoint type: object properties: url: @@ -2739,8 +2620,7 @@ components: - HTTP-REDIRECT url: type: string - description: URL of the IDV `authorization` endpoint - readOnly: true + description: URL of the `authorization` endpoint of the IDV vendor IDVParEndpoint: description: IDV [PAR](https://datatracker.ietf.org/doc/html/rfc9126) endpoint type: object @@ -2751,10 +2631,9 @@ components: - HTTP-POST url: type: string - description: URL of the IDV `par` endpoint - readOnly: true + description: URL of the `par` endpoint of the IDV vendor IDVTokenEndpoint: - description: IDV token endpoint + description: Token endpoint of the IDV vendor type: object properties: binding: @@ -2763,8 +2642,7 @@ components: - HTTP-POST url: type: string - description: URL of the IDV `token` endpoint - readOnly: true + description: URL of the `token` endpoint of the IDV vendor HttpMethod: type: string enum: @@ -2778,9 +2656,7 @@ components: properties: include: type: array - description: >- - Specifies the allowlist of Group identifiers to match against. Group - memberships are restricted to type `OKTA_GROUP`. + description: Specifies the allowlist of Group identifiers to match against. Group memberships are restricted to type `OKTA_GROUP`. items: type: string example: 00gjg5lzfBpn62wuF0g3 @@ -2793,92 +2669,60 @@ components: properties: exclude: type: array - description: >- - Specifies the blocklist of user identifiers to exclude from account - linking + description: Specifies the blocklist of user identifiers to exclude from account linking items: type: string example: 00u2c0nz7wj4UBs8V0g5 excludeAdmins: type: boolean - description: >- - Specifies whether admin users should be excluded from account - linking + description: Specifies whether admin users should be excluded from account linking default: false ProvisioningDeprovisionedCondition: - description: >- - Behavior for a previously deprovisioned IdP user during authentication. - Not supported with OIDC IdPs. + description: Behavior for a previously deprovisioned IdP user during authentication type: object properties: action: $ref: '#/components/schemas/ProvisioningDeprovisionedAction' ProvisioningSuspendedCondition: - description: >- - Behavior for a previously suspended IdP user during authentication. Not - supported with OIDC IdPs. + description: Behavior for a previously suspended IdP user during authentication type: object properties: action: $ref: '#/components/schemas/ProvisioningSuspendedAction' ProvisioningGroupsAction: - description: >- + description: |- Provisioning action for the IdP user's group memberships + | Enum | Description | Existing OKTA_GROUP Memberships | Existing APP_GROUP Memberships | Existing BUILT_IN Memberships | + | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | ------------------------------ | ----------------------------- | + | `APPEND` | Adds a user to any group defined by the IdP as a value of the `sourceAttributeName` array that matches the name of the allow listed group defined in the `filter` | Unchanged | Unchanged | Unchanged | + | `ASSIGN` | Assigns a user to groups defined in the `assignments` array | Unchanged | Unchanged | Unchanged | + | `NONE` | Skips processing of group memberships | Unchanged | Unchanged | Unchanged | + | `SYNC` | Group memberships are sourced by the IdP as a value of the `sourceAttributeName` array that matches the name of the group defined in the `filter` | Removed if not defined by the IdP in `sourceAttributeName` and matching name of the group in `filter` | Unchanged | Unchanged | - | Enum | - Description - | Existing OKTA_GROUP - Memberships - | Existing APP_GROUP Memberships | Existing BUILT_IN Memberships | - - | -------- | - ----------------------------------------------------------------------------------------------------------------------------------------------------------------- - | - ----------------------------------------------------------------------------------------------------- - | ------------------------------ | ----------------------------- | - - | `APPEND` | Adds a user to any group defined by the IdP as a value of - the `sourceAttributeName` array that matches the name of the allow - listed group defined in the `filter` | - Unchanged - | Unchanged | Unchanged | - - | `ASSIGN` | Assigns a user to groups defined in the `assignments` - array - | - Unchanged - | Unchanged | Unchanged | - - | `NONE` | Skips processing of group - memberships - | - Unchanged - | Unchanged | Unchanged | - - | `SYNC` | Group memberships are sourced by the IdP as a value of the - `sourceAttributeName` array that matches the name of the group defined - in the `filter` | Removed if not defined by the IdP in - `sourceAttributeName` and matching name of the group in `filter` | - Unchanged | Unchanged | - - - > **Note:** Group provisioning action is processed independently from - profile sourcing. You can sync group memberships through SAML with - profile sourcing disabled. + > **Note:** Group provisioning action is processed independently from profile sourcing. You can sync group memberships through SAML with profile sourcing disabled. type: string enum: - APPEND - ASSIGN - NONE - SYNC + SamlRequestDigestAlgorithm: + description: |- + XML Digest Algorithm setting for cryptographically hashing `` messages sent to the IdP + > **Note:** This property is ignored when you disable request signatures (`scope` set as `NONE`). + example: SHA-256 + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: true + type: string + enum: + - SHA-1 + - SHA-256 SamlRequestSignatureAlgorithm: - description: >- - XML digital Signature Algorithm settings for signing `` - messages sent to the IdP - - > **Note:** The `algorithm` property is ignored when you disable - request signatures (`scope` set as `NONE`). + description: |- + XML digital Signature Algorithm settings for signing `` messages sent to the IdP + > **Note:** The `algorithm` property is ignored when you disable request signatures (`scope` set as `NONE`). type: object properties: algorithm: @@ -2886,9 +2730,7 @@ components: scope: $ref: '#/components/schemas/ProtocolAlgorithmRequestScope' SamlResponseSignatureAlgorithm: - description: >- - XML digital Signature Algorithm settings for verifying `` - messages and `` elements from the IdP + description: XML digital Signature Algorithm settings for verifying `` messages and `` elements from the IdP type: object properties: algorithm: @@ -2905,21 +2747,16 @@ components: - HTTP-POST - HTTP-REDIRECT SamlEndpointType: - description: >- - Determines whether to publish an instance-specific (trust) or - organization (shared) ACS endpoint in the SAML metadata + description: Determines whether to publish an instance-specific (trust) or organization (shared) ACS endpoint in the SAML metadata default: INSTANCE type: string enum: - INSTANCE - ORG OidcRequestSignatureAlgorithm: - description: >- - Signature Algorithm settings for signing authorization requests sent to - the IdP - - > **Note:** The `algorithm` property is ignored when you disable - request signatures (`scope` set as `NONE`). + description: |- + Signature Algorithm settings for signing authorization requests sent to the IdP + > **Note:** The `algorithm` property is ignored when you disable request signatures (`scope` set as `NONE`). type: object properties: algorithm: @@ -2927,7 +2764,13 @@ components: scope: $ref: '#/components/schemas/ProtocolAlgorithmRequestScope' MtlsTrustCredentialsRevocation: - description: Mechanism to validate the certificate + description: |- + Mechanism to validate the certificate + + > **Note:** This property isn't supported. Okta now handles CRL caching automatically. As of October 8, 2025, in Preview orgs, and October 13, 2025, in Production orgs, this property is ignored if it's specified in any API requests. Specifying the property in your API requests doesn't cause any errors since the property has no effect. + > + > See [Deprecation Notice - Smart Card IdP Legacy CRL Cache Setting](https://support.okta.com/help/s/article/deprecation-notice-smart-card-idp-legacy-crl-cache-setting?language=en_US). + deprecated: true example: CRL type: string enum: @@ -2935,37 +2778,23 @@ components: - DELTA_CRL - OCSP ProvisioningDeprovisionedAction: - description: >- - Specifies the action during authentication when an IdP user is linked to - a previously deprovisioned Okta user + description: Specifies the action during authentication when an IdP user is linked to a previously deprovisioned Okta user type: string enum: - NONE - REACTIVATE x-enumDescriptions: - NONE: >- - Take no action. If an IdP user that matches a previously deprovisioned - Okta user attempts to authenticate, authentication fails. - REACTIVATE: >- - If an IdP user that matches a previously deprovisioned Okta user - attempts to authenticate, reactivate the matching user in Okta and - allow the authentication attempt to proceed. + NONE: Take no action. If an IdP user that matches a previously deprovisioned Okta user attempts to authenticate, authentication fails. + REACTIVATE: If an IdP user that matches a previously deprovisioned Okta user attempts to authenticate, reactivate the matching user in Okta and allow the authentication attempt to proceed. ProvisioningSuspendedAction: - description: >- - Specifies the action during authentication when an IdP user is linked to - a previously suspended Okta user + description: Specifies the action during authentication when an IdP user is linked to a previously suspended Okta user type: string enum: - NONE - UNSUSPEND x-enumDescriptions: - NONE: >- - Take no action. If an IdP user that matches a previously suspended - Okta user attempts to authenticate, authentication fails. - UNSUSPEND: >- - If an IdP user that matches a previously suspended Okta user attempts - to authenticate, unsuspend the matching user in Okta and allow the - authentication attempt to proceed. + NONE: Take no action. If an IdP user that matches a previously suspended Okta user attempts to authenticate, authentication fails. + UNSUSPEND: If an IdP user that matches a previously suspended Okta user attempts to authenticate, unsuspend the matching user in Okta and allow the authentication attempt to proceed. SamlSigningAlgorithm: example: SHA-256 type: string @@ -2996,6 +2825,55 @@ components: - RS256 - RS384 - RS512 + ListIdentityProvidersResponse: + type: object + properties: + identity_providers: + type: array + items: + $ref: '#/components/schemas/IdentityProvider' + ListIdentityProviderKeysResponse: + type: object + properties: + identity_provider_keys: + type: array + items: + $ref: '#/components/schemas/IdPKeyCredential' + ListCsrsForIdentityProviderResponse: + type: object + properties: + csrs_for_identity_provider: + type: array + items: + $ref: '#/components/schemas/IdPCsr' + ListIdentityProviderSigningKeysResponse: + type: object + properties: + identity_provider_signing_keys: + type: array + items: + $ref: '#/components/schemas/IdPKeyCredential' + ListActiveIdentityProviderSigningKeyResponse: + type: object + properties: + active_identity_provider_signing_key: + type: array + items: + $ref: '#/components/schemas/IdPKeyCredential' + ListIdentityProviderApplicationUsersResponse: + type: object + properties: + identity_provider_application_users: + type: array + items: + $ref: '#/components/schemas/IdentityProviderApplicationUser' + ListSocialAuthTokensResponse: + type: object + properties: + social_auth_tokens: + type: array + items: + $ref: '#/components/schemas/SocialAuthToken' responses: ErrorAccessDenied403: description: Forbidden @@ -3039,11 +2917,7 @@ components: in: query schema: type: string - description: >- - The cursor to use for pagination. It is an opaque string that specifies - your current location in the list and is obtained from the `Link` - response header. See - [Pagination](https://developer.okta.com/docs/api/#pagination). + description: The cursor to use for pagination. It is an opaque string that specifies your current location in the list and is obtained from the `Link` response header. See [Pagination](https://developer.okta.com/docs/api/#pagination) and [Link header](https://developer.okta.com/docs/api/#link-header). queryLimit: name: limit in: query @@ -3137,11 +3011,11 @@ components: filter: null matchType: USERNAME mapAMRClaims: false + trustClaims: false maxClockSkew: 0 _links: authorize: - href: >- - https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oa62b57p7c8PaGpU0h7&client_id={clientId}&response_type={responseType}&response_mode={responseMode}&scope={scopes}&redirect_uri={redirectUri}&state={state} + href: https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oa62b57p7c8PaGpU0h7&client_id={clientId}&response_type={responseType}&response_mode={responseMode}&scope={scopes}&redirect_uri={redirectUri}&state={state} templated: true hints: allow: @@ -3183,6 +3057,8 @@ components: issuer: https://idp.example.com audience: http://www.okta.com/123 kid: your-key-id + additionalKids: + - additional-key-id policy: provisioning: action: AUTO @@ -3203,11 +3079,11 @@ components: filter: (\S+@example\.com) matchType: USERNAME mapAMRClaims: false + trustClaims: false maxClockSkew: 0 _links: metadata: - href: >- - https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/metadata.xml + href: https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/metadata.xml type: application/xml hints: allow: @@ -3224,8 +3100,7 @@ components: allow: - GET deactivate: - href: >- - https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/lifecycle/deactivate hints: allow: - POST @@ -3272,11 +3147,11 @@ components: filter: null matchType: USERNAME mapAMRClaims: false + trustClaims: false maxClockSkew: 0 _links: authorize: - href: >- - https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oa62bfdiumsUndnZ0h7&client_id={clientId}&response_type={responseType}&response_mode={responseMode}&scope={scopes}&redirect_uri={redirectUri}&state={state} + href: https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oa62bfdiumsUndnZ0h7&client_id={clientId}&response_type={responseType}&response_mode={responseMode}&scope={scopes}&redirect_uri={redirectUri}&state={state} templated: true hints: allow: @@ -3328,11 +3203,11 @@ components: filter: null matchType: USERNAME mapAMRClaims: false + trustClaims: false maxClockSkew: 0 _links: authorize: - href: >- - https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oa62bfdjnK55Z5x80h7&client_id={clientId}&response_type={responseType}&response_mode={responseMode}&scope={scopes}&redirect_uri={redirectUri}&state={state} + href: https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oa62bfdjnK55Z5x80h7&client_id={clientId}&response_type={responseType}&response_mode={responseMode}&scope={scopes}&redirect_uri={redirectUri}&state={state} templated: true hints: allow: @@ -3386,11 +3261,11 @@ components: filter: null matchType: USERNAME mapAMRClaims: false + trustClaims: false maxClockSkew: 0 _links: authorize: - href: >- - https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oajmvdFawBih4gey0g3&client_id={clientId}&response_type={responseType}&response_mode={responseMode}&scope={scopes}&redirect_uri={redirectUri}&state={state} + href: https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oajmvdFawBih4gey0g3&client_id={clientId}&response_type={responseType}&response_mode={responseMode}&scope={scopes}&redirect_uri={redirectUri}&state={state} templated: true hints: allow: @@ -3450,11 +3325,11 @@ components: matchType: USERNAME matchAttribute: null mapAMRClaims: false + trustClaims: false maxClockSkew: 0 _links: authorize: - href: >- - https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oaulob4BFVa4zQvt0g3&client_id={clientId}&response_type={responseType}&response_mode={responseMode}&scope={scopes}&redirect_uri={redirectUri}&state={state}&nonce={nonce} + href: https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oaulob4BFVa4zQvt0g3&client_id={clientId}&response_type={responseType}&response_mode={responseMode}&scope={scopes}&redirect_uri={redirectUri}&state={state}&nonce={nonce} templated: true hints: allow: @@ -3500,26 +3375,54 @@ components: matchType: EMAIL matchAttribute: null mapAMRClaims: false + trustClaims: false maxClockSkew: 0 _links: deactivate: - href: >- - https://{yourOktaDomain}.okta.com/api/v1/idps/0oa6jxasyhwM2ZHJh0g4/lifecycle/deactivate + href: https://{yourOktaDomain}.okta.com/api/v1/idps/0oa6jxasyhwM2ZHJh0g4/lifecycle/deactivate hints: allow: - POST users: - href: >- - https://{yourOktaDomain}.okta.com/api/v1/idps/0oa6jxasyhwM2ZHJh0g4/users + href: https://{yourOktaDomain}.okta.com/api/v1/idps/0oa6jxasyhwM2ZHJh0g4/users hints: allow: - GET keys: - href: >- - https://{yourOktaDomain}.okta.com/api/v1/idps/credentials/keys/45dec5ff-8cdc-48c0-85fe-a4869f1753dc + href: https://{yourOktaDomain}.okta.com/api/v1/idps/credentials/keys/45dec5ff-8cdc-48c0-85fe-a4869f1753dc hints: allow: - GET + CreateOktaIntegrationIdPRequest: + summary: Create Okta Integration IdP + value: + type: OKTA_INTEGRATION + name: Example Okta Integration IdP + protocol: + type: SAML2 + credentials: + client: + token_endpoint_auth_method: private_key_jwt + client_id: your-client-id + oktaIdpOrgUrl: https://your-spoke-org.example.com + policy: + accountLink: + action: AUTO + filter: null + provisioning: + action: AUTO + conditions: + deprovisioned: + action: NONE + suspended: + action: NONE + groups: + action: NONE + maxClockSkew: 120000 + subject: + userNameTemplate: + template: idpuser.email + matchType: USERNAME CreateGenericOidcIdPRequest: summary: Create generic OpenID Connect IdP value: @@ -3577,6 +3480,7 @@ components: groups: action: NONE mapAMRClaims: false + trustClaims: false maxClockSkew: 120000 subject: userNameTemplate: @@ -3708,6 +3612,7 @@ components: filter: null matchType: USERNAME mapAMRClaims: false + trustClaims: false maxClockSkew: 0 CreateGoogleIdPRequest: summary: Create Google IdP @@ -3744,6 +3649,7 @@ components: filter: null matchType: USERNAME mapAMRClaims: false + trustClaims: false maxClockSkew: 0 CreateMicrosoftIdPRequest: summary: Create Microsoft IdP @@ -3781,6 +3687,7 @@ components: filter: null matchType: USERNAME mapAMRClaims: false + trustClaims: false maxClockSkew: 0 CreateSmartCardIdPRequest: summary: Create SmartCard IdP @@ -3806,6 +3713,7 @@ components: provisioning: action: DISABLED mapAMRClaims: false + trustClaims: false maxClockSkew: 120000 subject: matchType: EMAIL @@ -3904,6 +3812,60 @@ components: matchType: USERNAME matchAttribute: null maxClockSkew: 0 + CreateCustomIDVRequest: + x-okta-lifecycle: + lifecycle: LIMITED_GA + isGenerallyAvailable: false + SKUs: [] + summary: Create Custom IDV as IdP + value: + type: IDV_STANDARD + name: Custom IDV + protocol: + type: ID_PROOFING + endpoints: + par: + url: https://idv.example.com/par + binding: HTTP-REDIRECT + authorization: + url: https://idv.example.com/authorize + binding: HTTP-REDIRECT + token: + url: https://idv.example.com/token + binding: HTTP-POST + jwks: + url: https://idv.example.com/jwks + binding: HTTP-REDIRECT + issuer: + url: https://idv.example.com + scopes: + - profile + - identity_assurance + - openid + credentials: + client: + client_id: your-client-id + client_secret: your-client-secret + policy: + provisioning: + action: DISABLED + profileMaster: false + groups: null + accountLink: + filter: null + action: AUTO + subject: + userNameTemplate: + template: source.userName + filter: null + matchType: USERNAME + matchAttribute: null + maxClockSkew: 0 + properties: + idvMetadata: + vendorDisplayName: Custom IDV + termsOfUse: https://idv.example.com/terms + privacyPolicy: https://idv.example.com/privacy GenericOidcIdpResponse: summary: Generic OpenID Connect IdP value: @@ -3968,11 +3930,11 @@ components: matchType: USERNAME matchAttribute: null mapAMRClaims: false + trustClaims: false maxClockSkew: 0 _links: authorize: - href: >- - https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oaulob4BFVa4zQvt0g3&client_id={clientId}&response_type={responseType}&response_mode={responseMode}&scope={scopes}&redirect_uri={redirectUri}&state={state}&nonce={nonce} + href: https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oaulob4BFVa4zQvt0g3&client_id={clientId}&response_type={responseType}&response_mode={responseMode}&scope={scopes}&redirect_uri={redirectUri}&state={state}&nonce={nonce} templated: true hints: allow: @@ -4043,11 +4005,11 @@ components: filter: (\S+@example\.com) matchType: USERNAME mapAMRClaims: false + trustClaims: false maxClockSkew: 0 _links: metadata: - href: >- - https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/metadata.xml + href: https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/metadata.xml type: application/xml hints: allow: @@ -4064,8 +4026,7 @@ components: allow: - GET deactivate: - href: >- - https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/lifecycle/deactivate hints: allow: - POST @@ -4120,11 +4081,11 @@ components: matchType: USERNAME matchAttribute: null mapAMRClaims: false + trustClaims: false maxClockSkew: 0 _links: authorize: - href: >- - https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oa18hsHsG3boVejU0g4&client_id={clientId}&response_type={responseType}&response_mode={responseMode}&scope={scopes}&redirect_uri=${redirectUri}&state={state}&nonce={nonce} + href: https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oa18hsHsG3boVejU0g4&client_id={clientId}&response_type={responseType}&response_mode={responseMode}&scope={scopes}&redirect_uri=${redirectUri}&state={state}&nonce={nonce} templated: true hints: allow: @@ -4179,10 +4140,11 @@ components: filter: null matchType: USERNAME mapAMRClaims: false + trustClaims: false maxClockSkew: 0 _links: authorize: - href: >- + href: |- https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oa62b57p7c8PaGpU0h7& client_id={clientId}&response_type={responseType}&response_mode={responseMode}& scope={scopes}&redirect_uri={redirectUri}&state={state} @@ -4241,10 +4203,11 @@ components: filter: null matchType: USERNAME mapAMRClaims: false + trustClaims: false maxClockSkew: 0 _links: authorize: - href: >- + href: |- https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oa62bfdiumsUndnZ0h7& client_id={clientId}&response_type={responseType}&response_mode={responseMode}& scope={scopes}&redirect_uri={redirectUri}&state={state} @@ -4304,10 +4267,11 @@ components: filter: null matchType: USERNAME mapAMRClaims: false + trustClaims: false maxClockSkew: 0 _links: authorize: - href: >- + href: |- https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oajmvdFawBih4gey0g3& client_id={clientId}&response_type={responseType}&response_mode={responseMode}& scope={scopes}&redirect_uri={redirectUri}&state={state} @@ -4359,23 +4323,21 @@ components: matchType: EMAIL matchAttribute: null mapAMRClaims: false + trustClaims: false maxClockSkew: 120000 _links: deactivate: - href: >- - https://{yourOktaDomain}.okta.com/api/v1/idps/0oa6jxasyhwM2ZHJh0g4/lifecycle/deactivate + href: https://{yourOktaDomain}.okta.com/api/v1/idps/0oa6jxasyhwM2ZHJh0g4/lifecycle/deactivate hints: allow: - POST users: - href: >- - https://{yourOktaDomain}.okta.com/api/v1/idps/0oa6jxasyhwM2ZHJh0g4/users + href: https://{yourOktaDomain}.okta.com/api/v1/idps/0oa6jxasyhwM2ZHJh0g4/users hints: allow: - GET keys: - href: >- - https://{yourOktaDomain}.okta.com/api/v1/idps/credentials/keys/45dec5ff-8cdc-48c0-85fe-a4869f1753dc + href: https://{yourOktaDomain}.okta.com/api/v1/idps/credentials/keys/45dec5ff-8cdc-48c0-85fe-a4869f1753dc hints: allow: - GET @@ -4419,14 +4381,12 @@ components: - GET - DELETE activate: - href: >- - https://{yourOktaDomain}/api/v1/idps/0oa62bfdjnK55Z5x80h7/lifecycle/activate + href: https://{yourOktaDomain}/api/v1/idps/0oa62bfdjnK55Z5x80h7/lifecycle/activate hints: allow: - POST deactivate: - href: >- - https://{yourOktaDomain}/api/v1/idps/0oa62bfdjnK55Z5x80h7/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/idps/0oa62bfdjnK55Z5x80h7/lifecycle/deactivate hints: allow: - POST @@ -4482,8 +4442,7 @@ components: allow: - GET deactivate: - href: >- - https://{yourOktaDomain}/api/v1/idps/0oab50jh0UPiB6xde0w6/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/idps/0oab50jh0UPiB6xde0w6/lifecycle/deactivate hints: allow: - POST @@ -4539,8 +4498,73 @@ components: allow: - GET deactivate: - href: >- - https://{yourOktaDomain}/api/v1/idps/0oaf35tu47hnH9mlZ0w6/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/idps/0oaf35tu47hnH9mlZ0w6/lifecycle/deactivate + hints: + allow: + - POST + CustomIDVResponse: + x-okta-lifecycle: + lifecycle: LIMITED_GA + isGenerallyAvailable: false + SKUs: [] + summary: Custom IDV as IdP + value: + id: 0oa2pstvoFV4GYCw30g5 + name: Custom IDV IdP + status: ACTIVE + created: '2025-01-15T20:54:04.000Z' + lastUpdated: '2025-01-15T20:54:05.000Z' + protocol: + type: ID_PROOFING + endpoints: + par: + url: https://idv.example.com/par + binding: HTTP-REDIRECT + authorization: + url: https://idv.example.com/authorize + binding: HTTP-REDIRECT + token: + url: https://idv.example.com/token + binding: HTTP-POST + jwks: + url: https://idv.example.com/jwks + binding: HTTP-REDIRECT + issuer: + url: https://idv.example.com + scopes: + - openid + - profile + - identity_assurance + credentials: + client: + client_id: your-client-id + client_secret: your-client-secret + policy: + provisioning: + action: DISABLED + profileMaster: false + groups: null + subject: + userNameTemplate: + template: source.userName + filter: null + matchType: USERNAME + matchAttribute: null + maxClockSkew: 0 + properties: + idvMetadata: + vendorDisplayName: Custom IDV + termsOfUse: https://idv.example.com/terms + privacyPolicy: https://idv.example.com/privacy + type: IDV_STANDARD + _links: + users: + href: https://{yourOktaDomain}/api/v1/idps/0oa2pstvoFV4GYCw30g5/users + hints: + allow: + - GET + deactivate: + href: https://{yourOktaDomain}/api/v1/idps/0oa2pstvoFV4GYCw30g5/lifecycle/deactivate hints: allow: - POST @@ -4551,13 +4575,11 @@ components: created: '2016-01-03T18:15:47.000Z' lastUpdated: '2016-01-03T18:15:47.000Z' e: '65537' - 'n': >- - 101438407598598116085679865987760095721749307901605456708912786847324207000576780508113360584555007890315805735307890113536927352312915634368993759211767770602174860126854831344273970871509573365292777620005537635317282520456901584213746937262823585533063042033441296629204165064680610660631365266976782082747 + 'n': '101438407598598116085679865987760095721749307901605456708912786847324207000576780508113360584555007890315805735307890113536927352312915634368993759211767770602174860126854831344273970871509573365292777620005537635317282520456901584213746937262823585533063042033441296629204165064680610660631365266976782082747' kty: RSA use: sig x5c: - - >- - MIIDnjCCAoagAwIBAgIGAVG3MN+PMA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB2V4YW1wbGUxHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMTUxMjE4MjIyMjMyWhcNMjUxMjE4MjIyMzMyWjCBjzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdleGFtcGxlMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtcnyvuVCrsFEKCwHDenS3Ocjed8eWDv3zLtD2K/iZfE8BMj2wpTfn6Ry8zCYey3mWlKdxIybnV9amrujGRnE0ab6Q16v9D6RlFQLOG6dwqoRKuZy33Uyg8PGdEudZjGbWuKCqqXEp+UKALJHV+k4wWeVH8g5d1n3KyR2TVajVJpCrPhLFmq1Il4G/IUnPe4MvjXqB6CpKkog1+ThWsItPRJPAM+RweFHXq7KfChXsYE7Mmfuly8sDQlvBmQyxZnFHVuiPfCvGHJjpvHy11YlHdOjfgqHRvZbmo30+y0X/oY/yV4YEJ00LL6eJWU4wi7ViY3HP6/VCdRjHoRdr5L/DwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQCzzhOFkvyYLNFj2WDcq1YqD4sBy1iCia9QpRH3rjQvMKDwQDYWbi6EdOX0TQ/IYR7UWGj+2pXd6v0t33lYtoKocp/4lUvT3tfBnWZ5KnObi+J2uY2teUqoYkASN7F+GRPVOuMVoVgm05ss8tuMb2dLc9vsx93sDt+XlMTv/2qi5VPwaDtqduKkzwW9lUfn4xIMkTiVvCpe0X2HneD2Bpuao3/U8Rk0uiPfq6TooWaoW3kjsmErhEAs9bA7xuqo1KKY9CdHcFhkSsMhoeaZylZHtzbnoipUlQKSLMdJQiiYZQ0bYL83/Ta9fulr1EERICMFt3GUmtYaZZKHpWSfdJp9 + - MIIDnjCCAoagAwIBAgIGAVG3MN+PMA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB2V4YW1wbGUxHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMTUxMjE4MjIyMjMyWhcNMjUxMjE4MjIyMzMyWjCBjzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdleGFtcGxlMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtcnyvuVCrsFEKCwHDenS3Ocjed8eWDv3zLtD2K/iZfE8BMj2wpTfn6Ry8zCYey3mWlKdxIybnV9amrujGRnE0ab6Q16v9D6RlFQLOG6dwqoRKuZy33Uyg8PGdEudZjGbWuKCqqXEp+UKALJHV+k4wWeVH8g5d1n3KyR2TVajVJpCrPhLFmq1Il4G/IUnPe4MvjXqB6CpKkog1+ThWsItPRJPAM+RweFHXq7KfChXsYE7Mmfuly8sDQlvBmQyxZnFHVuiPfCvGHJjpvHy11YlHdOjfgqHRvZbmo30+y0X/oY/yV4YEJ00LL6eJWU4wi7ViY3HP6/VCdRjHoRdr5L/DwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQCzzhOFkvyYLNFj2WDcq1YqD4sBy1iCia9QpRH3rjQvMKDwQDYWbi6EdOX0TQ/IYR7UWGj+2pXd6v0t33lYtoKocp/4lUvT3tfBnWZ5KnObi+J2uY2teUqoYkASN7F+GRPVOuMVoVgm05ss8tuMb2dLc9vsx93sDt+XlMTv/2qi5VPwaDtqduKkzwW9lUfn4xIMkTiVvCpe0X2HneD2Bpuao3/U8Rk0uiPfq6TooWaoW3kjsmErhEAs9bA7xuqo1KKY9CdHcFhkSsMhoeaZylZHtzbnoipUlQKSLMdJQiiYZQ0bYL83/Ta9fulr1EERICMFt3GUmtYaZZKHpWSfdJp9 x5t#S256: wzPVobIrveR1x-PCbjsFGNV-6zn7Rm9KuOWOG4Rk6jE - kty: EC created: '2020-04-24T20:51:20.000Z' @@ -4565,12 +4587,9 @@ components: expiresAt: '2040-03-01T20:22:29.000Z' alg: EC x5c: - - >- - MIICqDCCAgqgAwIBAgIJAOkmCa/S8dHiMAoGCCqGSM49BAMCMG0xCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMRAwDgYDVQQKDAdKYW5reUNvMR8wHQYDVQQDDBZUZXN0IElkZW50aXR5IFByb3ZpZGVyMB4XDTIwMDMwNjIwMjIyOVoXDTQwMDMwMTIwMjIyOVowbTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEDAOBgNVBAoMB0phbmt5Q28xHzAdBgNVBAMMFlRlc3QgSWRlbnRpdHkgUHJvdmlkZXIwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABABW/lGHl17mKDtCD4D7gcMYYOWgyWTGno8MTefDOABA8PddessTsbfrguF49Gli6lCzrZaAKhhvgINc3R6t/dYleAE3lY6LAocOoLe9xDkeggXNcSuP5fDc1x5R9GHTXl44vLoJOLSLsMbOXVMXIXoqbPDzTSYUy24aFdv4W4LZxW6ak6NQME4wHQYDVR0OBBYEFChTXNWvs4z1qjRVemPDD/hqlDQ4MB8GA1UdIwQYMBaAFChTXNWvs4z1qjRVemPDD/hqlDQ4MAwGA1UdEwQFMAMBAf8wCgYIKoZIzj0EAwIDgYsAMIGHAkIBuDhHMNLbBIsorbKtjxJzHJ2ItCSD2wAwqYv/6JBtA2ulKN5gRTSqdNCnqFsZ1/nYY7FFVXHEuQ2N3pPq7Ri8h84CQSgCq1UQyd0lFtb7+57JbiGb6LVaRqRm7vwx8zLRA+tVjIM1DlQ2Gbxkj3nlkzmM93j9wchiqGdQidyKnF6EBnfd - x: >- - Vv5Rh5de5ig7Qg-A-4HDGGDloMlkxp6PDE3nwzgAQPD3XXrLE7G364LhePRpYupQs62WgCoYb4CDXN0erf3WJXg - 'y': >- - ATeVjosChw6gt73EOR6CBc1xK4_l8NzXHlH0YdNeXji8ugk4tIuwxs5dUxcheips8PNNJhTLbhoV2_hbgtnFbpqT + - MIICqDCCAgqgAwIBAgIJAOkmCa/S8dHiMAoGCCqGSM49BAMCMG0xCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMRAwDgYDVQQKDAdKYW5reUNvMR8wHQYDVQQDDBZUZXN0IElkZW50aXR5IFByb3ZpZGVyMB4XDTIwMDMwNjIwMjIyOVoXDTQwMDMwMTIwMjIyOVowbTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEDAOBgNVBAoMB0phbmt5Q28xHzAdBgNVBAMMFlRlc3QgSWRlbnRpdHkgUHJvdmlkZXIwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABABW/lGHl17mKDtCD4D7gcMYYOWgyWTGno8MTefDOABA8PddessTsbfrguF49Gli6lCzrZaAKhhvgINc3R6t/dYleAE3lY6LAocOoLe9xDkeggXNcSuP5fDc1x5R9GHTXl44vLoJOLSLsMbOXVMXIXoqbPDzTSYUy24aFdv4W4LZxW6ak6NQME4wHQYDVR0OBBYEFChTXNWvs4z1qjRVemPDD/hqlDQ4MB8GA1UdIwQYMBaAFChTXNWvs4z1qjRVemPDD/hqlDQ4MAwGA1UdEwQFMAMBAf8wCgYIKoZIzj0EAwIDgYsAMIGHAkIBuDhHMNLbBIsorbKtjxJzHJ2ItCSD2wAwqYv/6JBtA2ulKN5gRTSqdNCnqFsZ1/nYY7FFVXHEuQ2N3pPq7Ri8h84CQSgCq1UQyd0lFtb7+57JbiGb6LVaRqRm7vwx8zLRA+tVjIM1DlQ2Gbxkj3nlkzmM93j9wchiqGdQidyKnF6EBnfd + x: Vv5Rh5de5ig7Qg-A-4HDGGDloMlkxp6PDE3nwzgAQPD3XXrLE7G364LhePRpYupQs62WgCoYb4CDXN0erf3WJXg + 'y': ATeVjosChw6gt73EOR6CBc1xK4_l8NzXHlH0YdNeXji8ugk4tIuwxs5dUxcheips8PNNJhTLbhoV2_hbgtnFbpqT crv: P-521 kid: your-kid use: sig @@ -4582,23 +4601,19 @@ components: created: '2016-01-03T18:15:47.000Z' lastUpdated: '2016-01-03T18:15:47.000Z' e: '65537' - 'n': >- - 101438407598598116085679865987760095721749307901605456708912786847324207000576780508113360584555007890315805735307890113536927352312915634368993759211767770602174860126854831344273970871509573365292777620005537635317282520456901584213746937262823585533063042033441296629204165064680610660631365266976782082747 + 'n': '101438407598598116085679865987760095721749307901605456708912786847324207000576780508113360584555007890315805735307890113536927352312915634368993759211767770602174860126854831344273970871509573365292777620005537635317282520456901584213746937262823585533063042033441296629204165064680610660631365266976782082747' kty: RSA use: sig x5c: - - >- - MIIDnjCCAoagAwIBAgIGAVG3MN+PMA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB2V4YW1wbGUxHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMTUxMjE4MjIyMjMyWhcNMjUxMjE4MjIyMzMyWjCBjzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdleGFtcGxlMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtcnyvuVCrsFEKCwHDenS3Ocjed8eWDv3zLtD2K/iZfE8BMj2wpTfn6Ry8zCYey3mWlKdxIybnV9amrujGRnE0ab6Q16v9D6RlFQLOG6dwqoRKuZy33Uyg8PGdEudZjGbWuKCqqXEp+UKALJHV+k4wWeVH8g5d1n3KyR2TVajVJpCrPhLFmq1Il4G/IUnPe4MvjXqB6CpKkog1+ThWsItPRJPAM+RweFHXq7KfChXsYE7Mmfuly8sDQlvBmQyxZnFHVuiPfCvGHJjpvHy11YlHdOjfgqHRvZbmo30+y0X/oY/yV4YEJ00LL6eJWU4wi7ViY3HP6/VCdRjHoRdr5L/DwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQCzzhOFkvyYLNFj2WDcq1YqD4sBy1iCia9QpRH3rjQvMKDwQDYWbi6EdOX0TQ/IYR7UWGj+2pXd6v0t33lYtoKocp/4lUvT3tfBnWZ5KnObi+J2uY2teUqoYkASN7F+GRPVOuMVoVgm05ss8tuMb2dLc9vsx93sDt+XlMTv/2qi5VPwaDtqduKkzwW9lUfn4xIMkTiVvCpe0X2HneD2Bpuao3/U8Rk0uiPfq6TooWaoW3kjsmErhEAs9bA7xuqo1KKY9CdHcFhkSsMhoeaZylZHtzbnoipUlQKSLMdJQiiYZQ0bYL83/Ta9fulr1EERICMFt3GUmtYaZZKHpWSfdJp9 + - MIIDnjCCAoagAwIBAgIGAVG3MN+PMA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB2V4YW1wbGUxHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMTUxMjE4MjIyMjMyWhcNMjUxMjE4MjIyMzMyWjCBjzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdleGFtcGxlMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtcnyvuVCrsFEKCwHDenS3Ocjed8eWDv3zLtD2K/iZfE8BMj2wpTfn6Ry8zCYey3mWlKdxIybnV9amrujGRnE0ab6Q16v9D6RlFQLOG6dwqoRKuZy33Uyg8PGdEudZjGbWuKCqqXEp+UKALJHV+k4wWeVH8g5d1n3KyR2TVajVJpCrPhLFmq1Il4G/IUnPe4MvjXqB6CpKkog1+ThWsItPRJPAM+RweFHXq7KfChXsYE7Mmfuly8sDQlvBmQyxZnFHVuiPfCvGHJjpvHy11YlHdOjfgqHRvZbmo30+y0X/oY/yV4YEJ00LL6eJWU4wi7ViY3HP6/VCdRjHoRdr5L/DwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQCzzhOFkvyYLNFj2WDcq1YqD4sBy1iCia9QpRH3rjQvMKDwQDYWbi6EdOX0TQ/IYR7UWGj+2pXd6v0t33lYtoKocp/4lUvT3tfBnWZ5KnObi+J2uY2teUqoYkASN7F+GRPVOuMVoVgm05ss8tuMb2dLc9vsx93sDt+XlMTv/2qi5VPwaDtqduKkzwW9lUfn4xIMkTiVvCpe0X2HneD2Bpuao3/U8Rk0uiPfq6TooWaoW3kjsmErhEAs9bA7xuqo1KKY9CdHcFhkSsMhoeaZylZHtzbnoipUlQKSLMdJQiiYZQ0bYL83/Ta9fulr1EERICMFt3GUmtYaZZKHpWSfdJp9 x5t#S256: wzPVobIrveR1x-PCbjsFGNV-6zn7Rm9KuOWOG4Rk6jE IdPKeyCredentialRequest: summary: IdP key credential value: e: '65537' - 'n': >- - 101438407598598116085679865987760095721749307901605456708912786847324207000576780508113360584555007890315805735307890113536927352312915634368993759211767770602174860126854831344273970871509573365292777620005537635317282520456901584213746937262823585533063042033441296629204165064680610660631365266976782082747 + 'n': '101438407598598116085679865987760095721749307901605456708912786847324207000576780508113360584555007890315805735307890113536927352312915634368993759211767770602174860126854831344273970871509573365292777620005537635317282520456901584213746937262823585533063042033441296629204165064680610660631365266976782082747' x5c: - - >- - MIIDnjCCAoagAwIBAgIGAVG3MN+PMA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB2V4YW1wbGUxHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMTUxMjE4MjIyMjMyWhcNMjUxMjE4MjIyMzMyWjCBjzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdleGFtcGxlMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtcnyvuVCrsFEKCwHDenS3Ocjed8eWDv3zLtD2K/iZfE8BMj2wpTfn6Ry8zCYey3mWlKdxIybnV9amrujGRnE0ab6Q16v9D6RlFQLOG6dwqoRKuZy33Uyg8PGdEudZjGbWuKCqqXEp+UKALJHV+k4wWeVH8g5d1n3KyR2TVajVJpCrPhLFmq1Il4G/IUnPe4MvjXqB6CpKkog1+ThWsItPRJPAM+RweFHXq7KfChXsYE7Mmfuly8sDQlvBmQyxZnFHVuiPfCvGHJjpvHy11YlHdOjfgqHRvZbmo30+y0X/oY/yV4YEJ00LL6eJWU4wi7ViY3HP6/VCdRjHoRdr5L/DwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQCzzhOFkvyYLNFj2WDcq1YqD4sBy1iCia9QpRH3rjQvMKDwQDYWbi6EdOX0TQ/IYR7UWGj+2pXd6v0t33lYtoKocp/4lUvT3tfBnWZ5KnObi+J2uY2teUqoYkASN7F+GRPVOuMVoVgm05ss8tuMb2dLc9vsx93sDt+XlMTv/2qi5VPwaDtqduKkzwW9lUfn4xIMkTiVvCpe0X2HneD2Bpuao3/U8Rk0uiPfq6TooWaoW3kjsmErhEAs9bA7xuqo1KKY9CdHcFhkSsMhoeaZylZHtzbnoipUlQKSLMdJQiiYZQ0bYL83/Ta9fulr1EERICMFt3GUmtYaZZKHpWSfdJp9 + - MIIDnjCCAoagAwIBAgIGAVG3MN+PMA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB2V4YW1wbGUxHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMTUxMjE4MjIyMjMyWhcNMjUxMjE4MjIyMzMyWjCBjzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdleGFtcGxlMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtcnyvuVCrsFEKCwHDenS3Ocjed8eWDv3zLtD2K/iZfE8BMj2wpTfn6Ry8zCYey3mWlKdxIybnV9amrujGRnE0ab6Q16v9D6RlFQLOG6dwqoRKuZy33Uyg8PGdEudZjGbWuKCqqXEp+UKALJHV+k4wWeVH8g5d1n3KyR2TVajVJpCrPhLFmq1Il4G/IUnPe4MvjXqB6CpKkog1+ThWsItPRJPAM+RweFHXq7KfChXsYE7Mmfuly8sDQlvBmQyxZnFHVuiPfCvGHJjpvHy11YlHdOjfgqHRvZbmo30+y0X/oY/yV4YEJ00LL6eJWU4wi7ViY3HP6/VCdRjHoRdr5L/DwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQCzzhOFkvyYLNFj2WDcq1YqD4sBy1iCia9QpRH3rjQvMKDwQDYWbi6EdOX0TQ/IYR7UWGj+2pXd6v0t33lYtoKocp/4lUvT3tfBnWZ5KnObi+J2uY2teUqoYkASN7F+GRPVOuMVoVgm05ss8tuMb2dLc9vsx93sDt+XlMTv/2qi5VPwaDtqduKkzwW9lUfn4xIMkTiVvCpe0X2HneD2Bpuao3/U8Rk0uiPfq6TooWaoW3kjsmErhEAs9bA7xuqo1KKY9CdHcFhkSsMhoeaZylZHtzbnoipUlQKSLMdJQiiYZQ0bYL83/Ta9fulr1EERICMFt3GUmtYaZZKHpWSfdJp9 x5t#S256: wzPVobIrveR1x-PCbjsFGNV-6zn7Rm9KuOWOG4Rk6jE ReplaceIdPRequestResponse: summary: Replace an IdP @@ -4639,6 +4654,8 @@ components: issuer: https://idp.example.com audience: https://www.okta.com/saml2/service-provider/spCQJRNaaxs7ANqKBO7M kid: your-key-id + additionalKids: + - additional-key-id policy: provisioning: action: AUTO @@ -4659,11 +4676,11 @@ components: filter: null matchType: USERNAME mapAMRClaims: false + trustClaims: false maxClockSkew: 120000 _links: metadata: - href: >- - https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/metadata.xml + href: https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/metadata.xml type: application/xml hints: allow: @@ -4680,8 +4697,7 @@ components: allow: - GET activate: - href: >- - https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/lifecycle/activate + href: https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/lifecycle/activate hints: allow: - POST @@ -4690,39 +4706,33 @@ components: value: - id: h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50 created: '2017-03-28T01:11:10.000Z' - csr: >- - MIIC4DCCAcgCAQAwcTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk9rdGEsIEluYy4xDDAKBgNVBAsMA0RldjESMBAGA1UEAwwJU1AgSXNzdWVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6m8jHVCr9/tKvvbFN59T4raoCs/78KRm4fSefHQOv1TKLXo4wTLbsqYWRWc5u0sd5orUMQgPQOyj3i6qh13mALY4BzrT057EG1BUNjGg29QgYlnOk2iX890e5BIDMQQEIKFrvOi2V8cLUkLvE2ydRn0VO1Q1frbUkYeStJYC5Api2JQsYRwa+1ZeDH1ITnIzUaugWhW2WB2lSnwZkenne5KtffxMPYVu+IhNRHoKaRA6Z51YNhMJIx17JM2hs/H4Ka3drk6kzDf7ofk/yBpb9yBWyU7CTSQhdoHidxqFprMDaT66W928t3AeOENHBuwn8c2K9WeGG+bELNyQRJVmawIDAQABoCowKAYJKoZIhvcNAQkOMRswGTAXBgNVHREEEDAOggxkZXYub2t0YS5jb20wDQYJKoZIhvcNAQELBQADggEBAA2hsVJRVM+A83X9MekjTnIbt19UNT8wX7wlE9jUKirWsxceLiZBpVGn9qfKhhVIpvdaIRSeoFYS2Kg/m1G6bCvjmZLcrQ5FcEBjZH2NKfNppGVnfC2ugtUkBtCB+UUzOhKhRKJtGugenKbP33zRWWIqnd2waF6Cy8TIuqQVPbwEDN9bCbAs7ND6CFYNguY7KYjWzQOeAR716eqpEEXuPYAS4nx/ty4ylonR8cv+gpq51rvq80A4k/36aoeM0Y6I4w64vhTfuvWW2UYFUD+/+y2FA2CSP4JfctySrf1s525v6fzTFZ3qZbB5OZQtP2b8xYWktMzywsxGKDoVDB4wkH4= + csr: MIIC4DCCAcgCAQAwcTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk9rdGEsIEluYy4xDDAKBgNVBAsMA0RldjESMBAGA1UEAwwJU1AgSXNzdWVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6m8jHVCr9/tKvvbFN59T4raoCs/78KRm4fSefHQOv1TKLXo4wTLbsqYWRWc5u0sd5orUMQgPQOyj3i6qh13mALY4BzrT057EG1BUNjGg29QgYlnOk2iX890e5BIDMQQEIKFrvOi2V8cLUkLvE2ydRn0VO1Q1frbUkYeStJYC5Api2JQsYRwa+1ZeDH1ITnIzUaugWhW2WB2lSnwZkenne5KtffxMPYVu+IhNRHoKaRA6Z51YNhMJIx17JM2hs/H4Ka3drk6kzDf7ofk/yBpb9yBWyU7CTSQhdoHidxqFprMDaT66W928t3AeOENHBuwn8c2K9WeGG+bELNyQRJVmawIDAQABoCowKAYJKoZIhvcNAQkOMRswGTAXBgNVHREEEDAOggxkZXYub2t0YS5jb20wDQYJKoZIhvcNAQELBQADggEBAA2hsVJRVM+A83X9MekjTnIbt19UNT8wX7wlE9jUKirWsxceLiZBpVGn9qfKhhVIpvdaIRSeoFYS2Kg/m1G6bCvjmZLcrQ5FcEBjZH2NKfNppGVnfC2ugtUkBtCB+UUzOhKhRKJtGugenKbP33zRWWIqnd2waF6Cy8TIuqQVPbwEDN9bCbAs7ND6CFYNguY7KYjWzQOeAR716eqpEEXuPYAS4nx/ty4ylonR8cv+gpq51rvq80A4k/36aoeM0Y6I4w64vhTfuvWW2UYFUD+/+y2FA2CSP4JfctySrf1s525v6fzTFZ3qZbB5OZQtP2b8xYWktMzywsxGKDoVDB4wkH4= kty: RSA _links: self: - href: >- - https://{yourOktaDomain}/api/v1/idps/0oad5lTSBOMUBOBVVQSC/credentials/csrs/h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50 + href: https://{yourOktaDomain}/api/v1/idps/0oad5lTSBOMUBOBVVQSC/credentials/csrs/h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50 hints: allow: - GET - DELETE publish: - href: >- - https://{yourOktaDomain}/api/v1/idps/0oad5lTSBOMUBOBVVQSC/credentials/csrs/h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50/lifecycle/publish + href: https://{yourOktaDomain}/api/v1/idps/0oad5lTSBOMUBOBVVQSC/credentials/csrs/h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50/lifecycle/publish hints: allow: - POST - id: '-_-BFwAGoUYN-DDvsSKQFdx7OXaPZqrEPpFDO1hu-rg' created: '2017-03-28T01:21:10.000Z' - csr: >- - MIIC4DCCAcgCAQAwcTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk9rdGEsIEluYy4xDDAKBgNVBAsMA0RldjESMBAGA1UEAwwJU1AgSXNzdWVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6m8jHVCr9/tKvvbFN59T4raoCs/78KRm4fSefHQOv1TKLXo4wTLbsqYWRWc5u0sd5orUMQgPQOyj3i6qh13mALY4BzrT057EG1BUNjGg29QgYlnOk2iX890e5BIDMQQEIKFrvOi2V8cLUkLvE2ydRn0VO1Q1frbUkYeStJYC5Api2JQsYRwa+1ZeDH1ITnIzUaugWhW2WB2lSnwZkenne5KtffxMPYVu+IhNRHoKaRA6Z51YNhMJIx17JM2hs/H4Ka3drk6kzDf7ofk/yBpb9yBWyU7CTSQhdoHidxqFprMDaT66W928t3AeOENHBuwn8c2K9WeGG+bELNyQRJVmawIDAQABoCowKAYJKoZIhvcNAQkOMRswGTAXBgNVHREEEDAOggxkZXYub2t0YS5jb20wDQYJKoZIhvcNAQELBQADggEBAA2hsVJRVM+A83X9MekjTnIbt19UNT8wX7wlE9jUKirWsxceLiZBpVGn9qfKhhVIpvdaIRSeoFYS2Kg/m1G6bCvjmZLcrQ5FcEBjZH2NKfNppGVnfC2ugtUkBtCB+UUzOhKhRKJtGugenKbP33zRWWIqnd2waF6Cy8TIuqQVPbwEDN9bCbAs7ND6CFYNguY7KYjWzQOeAR716eqpEEXuPYAS4nx/ty4ylonR8cv+gpq51rvq80A4k/36aoeM0Y6I4w64vhTfuvWW2UYFUD+/+y2FA2CSP4JfctySrf1s525v6fzTFZ3qZbB5OZQtP2b8xYWktMzywsxGKDoVDB4wkH4= + csr: MIIC4DCCAcgCAQAwcTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk9rdGEsIEluYy4xDDAKBgNVBAsMA0RldjESMBAGA1UEAwwJU1AgSXNzdWVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6m8jHVCr9/tKvvbFN59T4raoCs/78KRm4fSefHQOv1TKLXo4wTLbsqYWRWc5u0sd5orUMQgPQOyj3i6qh13mALY4BzrT057EG1BUNjGg29QgYlnOk2iX890e5BIDMQQEIKFrvOi2V8cLUkLvE2ydRn0VO1Q1frbUkYeStJYC5Api2JQsYRwa+1ZeDH1ITnIzUaugWhW2WB2lSnwZkenne5KtffxMPYVu+IhNRHoKaRA6Z51YNhMJIx17JM2hs/H4Ka3drk6kzDf7ofk/yBpb9yBWyU7CTSQhdoHidxqFprMDaT66W928t3AeOENHBuwn8c2K9WeGG+bELNyQRJVmawIDAQABoCowKAYJKoZIhvcNAQkOMRswGTAXBgNVHREEEDAOggxkZXYub2t0YS5jb20wDQYJKoZIhvcNAQELBQADggEBAA2hsVJRVM+A83X9MekjTnIbt19UNT8wX7wlE9jUKirWsxceLiZBpVGn9qfKhhVIpvdaIRSeoFYS2Kg/m1G6bCvjmZLcrQ5FcEBjZH2NKfNppGVnfC2ugtUkBtCB+UUzOhKhRKJtGugenKbP33zRWWIqnd2waF6Cy8TIuqQVPbwEDN9bCbAs7ND6CFYNguY7KYjWzQOeAR716eqpEEXuPYAS4nx/ty4ylonR8cv+gpq51rvq80A4k/36aoeM0Y6I4w64vhTfuvWW2UYFUD+/+y2FA2CSP4JfctySrf1s525v6fzTFZ3qZbB5OZQtP2b8xYWktMzywsxGKDoVDB4wkH4= kty: RSA _links: self: - href: >- - https://{yourOktaDomain}/api/v1/idps/0oad5lTSBOMUBOBVVQSC/credentials/csrs/-_-BFwAGoUYN-DDvsSKQFdx7OXaPZqrEPpFDO1hu-rg + href: https://{yourOktaDomain}/api/v1/idps/0oad5lTSBOMUBOBVVQSC/credentials/csrs/-_-BFwAGoUYN-DDvsSKQFdx7OXaPZqrEPpFDO1hu-rg hints: allow: - GET - DELETE publish: - href: >- - https://{yourOktaDomain}/api/v1/idps/0oad5lTSBOMUBOBVVQSC/credentials/csrs/-_-BFwAGoUYN-DDvsSKQFdx7OXaPZqrEPpFDO1hu-rg/lifecycle/publish + href: https://{yourOktaDomain}/api/v1/idps/0oad5lTSBOMUBOBVVQSC/credentials/csrs/-_-BFwAGoUYN-DDvsSKQFdx7OXaPZqrEPpFDO1hu-rg/lifecycle/publish hints: allow: - POST @@ -4731,35 +4741,30 @@ components: value: id: h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50 created: '2017-03-28T01:11:10.000Z' - csr: >- - MIIC4DCCAcgCAQAwcTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk9rdGEsIEluYy4xDDAKBgNVBAsMA0RldjESMBAGA1UEAwwJU1AgSXNzdWVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6m8jHVCr9/tKvvbFN59T4raoCs/78KRm4fSefHQOv1TKLXo4wTLbsqYWRWc5u0sd5orUMQgPQOyj3i6qh13mALY4BzrT057EG1BUNjGg29QgYlnOk2iX890e5BIDMQQEIKFrvOi2V8cLUkLvE2ydRn0VO1Q1frbUkYeStJYC5Api2JQsYRwa+1ZeDH1ITnIzUaugWhW2WB2lSnwZkenne5KtffxMPYVu+IhNRHoKaRA6Z51YNhMJIx17JM2hs/H4Ka3drk6kzDf7ofk/yBpb9yBWyU7CTSQhdoHidxqFprMDaT66W928t3AeOENHBuwn8c2K9WeGG+bELNyQRJVmawIDAQABoCowKAYJKoZIhvcNAQkOMRswGTAXBgNVHREEEDAOggxkZXYub2t0YS5jb20wDQYJKoZIhvcNAQELBQADggEBAA2hsVJRVM+A83X9MekjTnIbt19UNT8wX7wlE9jUKirWsxceLiZBpVGn9qfKhhVIpvdaIRSeoFYS2Kg/m1G6bCvjmZLcrQ5FcEBjZH2NKfNppGVnfC2ugtUkBtCB+UUzOhKhRKJtGugenKbP33zRWWIqnd2waF6Cy8TIuqQVPbwEDN9bCbAs7ND6CFYNguY7KYjWzQOeAR716eqpEEXuPYAS4nx/ty4ylonR8cv+gpq51rvq80A4k/36aoeM0Y6I4w64vhTfuvWW2UYFUD+/+y2FA2CSP4JfctySrf1s525v6fzTFZ3qZbB5OZQtP2b8xYWktMzywsxGKDoVDB4wkH4= + csr: MIIC4DCCAcgCAQAwcTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk9rdGEsIEluYy4xDDAKBgNVBAsMA0RldjESMBAGA1UEAwwJU1AgSXNzdWVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6m8jHVCr9/tKvvbFN59T4raoCs/78KRm4fSefHQOv1TKLXo4wTLbsqYWRWc5u0sd5orUMQgPQOyj3i6qh13mALY4BzrT057EG1BUNjGg29QgYlnOk2iX890e5BIDMQQEIKFrvOi2V8cLUkLvE2ydRn0VO1Q1frbUkYeStJYC5Api2JQsYRwa+1ZeDH1ITnIzUaugWhW2WB2lSnwZkenne5KtffxMPYVu+IhNRHoKaRA6Z51YNhMJIx17JM2hs/H4Ka3drk6kzDf7ofk/yBpb9yBWyU7CTSQhdoHidxqFprMDaT66W928t3AeOENHBuwn8c2K9WeGG+bELNyQRJVmawIDAQABoCowKAYJKoZIhvcNAQkOMRswGTAXBgNVHREEEDAOggxkZXYub2t0YS5jb20wDQYJKoZIhvcNAQELBQADggEBAA2hsVJRVM+A83X9MekjTnIbt19UNT8wX7wlE9jUKirWsxceLiZBpVGn9qfKhhVIpvdaIRSeoFYS2Kg/m1G6bCvjmZLcrQ5FcEBjZH2NKfNppGVnfC2ugtUkBtCB+UUzOhKhRKJtGugenKbP33zRWWIqnd2waF6Cy8TIuqQVPbwEDN9bCbAs7ND6CFYNguY7KYjWzQOeAR716eqpEEXuPYAS4nx/ty4ylonR8cv+gpq51rvq80A4k/36aoeM0Y6I4w64vhTfuvWW2UYFUD+/+y2FA2CSP4JfctySrf1s525v6fzTFZ3qZbB5OZQtP2b8xYWktMzywsxGKDoVDB4wkH4= kty: RSA _links: self: - href: >- - https://{yourOktaDomain}/api/v1/idps/0oad5lTSBOMUBOBVVQSC/credentials/csrs/h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50 + href: https://{yourOktaDomain}/api/v1/idps/0oad5lTSBOMUBOBVVQSC/credentials/csrs/h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50 hints: allow: - GET - DELETE publish: - href: >- - https://{yourOktaDomain}/api/v1/idps/0oad5lTSBOMUBOBVVQSC/credentials/csrs/h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50/lifecycle/publish + href: https://{yourOktaDomain}/api/v1/idps/0oad5lTSBOMUBOBVVQSC/credentials/csrs/h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50/lifecycle/publish hints: allow: - POST CsrPkcs10Response: summary: CSR in DER format - value: >- - MIIC4DCCAcgCAQAwcTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk9rdGEsIEluYy4xDDAKBgNVBAsMA0RldjESMBAGA1UEAwwJU1AgSXNzdWVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6m8jHVCr9 + value: MIIC4DCCAcgCAQAwcTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk9rdGEsIEluYy4xDDAKBgNVBAsMA0RldjESMBAGA1UEAwwJU1AgSXNzdWVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6m8jHVCr9 MultipleIdPSigningKeyCredentialsResponse: summary: IdP signing key credentials value: - created: '2015-12-10T18:56:23.000Z' expiresAt: '2017-12-10T18:56:22.000Z' x5c: - - >- - MIIDqDCCApCgAwIBAgIGAVGNQFX5MA0GCSqGSIb3DQEBBQUAMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGJhbGFjb21wdGVzdDEcMBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTAeFw0xNTEyMTAxODU1MjJaFw0xNzEyMTAxODU2MjJaMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGJhbGFjb21wdGVzdDEcMBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJJjrcnI6cXBiXNq9YDgfYrQe2O5qEHG4MXP8Ue0sMeefFkFEHYHnHUeZCq6WTAGqR+1LFgOl+Eq9We5V+qNlGIfkFkQ3iHGBrIALKqLCd0Et76HicDiegz7j9DtN+lo0hG/gfcw5783L5g5xeQ7zVmCQMkFwoUA0uA3bsfUSrmfORHJL+EMNQT8XIXD8NkG4g6u7ylHVRTLgXbe+W/p04m3EP6l41xl+MhIpBaPxDsyUvcKCNwkZN3aZIin1O9Y4YJuDHxrM64/VtLLp0sC05iawAmfsLunF7rdJAkWUpPn+xkviyNQ3UpvwAYuDr+jKLUdh2reRnm1PezxMIXzBVMCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEARnFIjyitrCGbleFr3KeAwdOyeHiRmgeKupX5ZopgXtcseJoToUIinX5DVw2fVZPahqs0Q7/a0wcVnTRpw6946qZCwKd/PvZ1feVuVEA5Ui3+XvHuSH5xLp7NvYG1snNEvlbN3+NDUMlWj2NEbihowUBt9+UxTpQO3+N08q3aZk3hOZ+tHt+1Te7KEEL/4CM28GZ9MY7fSrS7MAgp1+ZXtn+kRlMrXnQ49qBda37brwDRqmSY9PwNMbev3r+9ZHwxr9W5wXW4Ev4C4xngA7RkVoyDbItSUho0I0M0u/LHuppclnXrw97xyO5Z883eIBvPVjfRcxsJxXJ8jx70ATDskw== + - MIIDqDCCApCgAwIBAgIGAVGNQFX5MA0GCSqGSIb3DQEBBQUAMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGJhbGFjb21wdGVzdDEcMBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTAeFw0xNTEyMTAxODU1MjJaFw0xNzEyMTAxODU2MjJaMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGJhbGFjb21wdGVzdDEcMBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJJjrcnI6cXBiXNq9YDgfYrQe2O5qEHG4MXP8Ue0sMeefFkFEHYHnHUeZCq6WTAGqR+1LFgOl+Eq9We5V+qNlGIfkFkQ3iHGBrIALKqLCd0Et76HicDiegz7j9DtN+lo0hG/gfcw5783L5g5xeQ7zVmCQMkFwoUA0uA3bsfUSrmfORHJL+EMNQT8XIXD8NkG4g6u7ylHVRTLgXbe+W/p04m3EP6l41xl+MhIpBaPxDsyUvcKCNwkZN3aZIin1O9Y4YJuDHxrM64/VtLLp0sC05iawAmfsLunF7rdJAkWUpPn+xkviyNQ3UpvwAYuDr+jKLUdh2reRnm1PezxMIXzBVMCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEARnFIjyitrCGbleFr3KeAwdOyeHiRmgeKupX5ZopgXtcseJoToUIinX5DVw2fVZPahqs0Q7/a0wcVnTRpw6946qZCwKd/PvZ1feVuVEA5Ui3+XvHuSH5xLp7NvYG1snNEvlbN3+NDUMlWj2NEbihowUBt9+UxTpQO3+N08q3aZk3hOZ+tHt+1Te7KEEL/4CM28GZ9MY7fSrS7MAgp1+ZXtn+kRlMrXnQ49qBda37brwDRqmSY9PwNMbev3r+9ZHwxr9W5wXW4Ev4C4xngA7RkVoyDbItSUho0I0M0u/LHuppclnXrw97xyO5Z883eIBvPVjfRcxsJxXJ8jx70ATDskw== kid: akm5hvbbevE341ovl0h7 kty: RSA use: sig @@ -4767,8 +4772,7 @@ components: - created: '2015-12-10T18:55:35.000Z' expiresAt: '2045-01-23T02:15:23.000Z' x5c: - - >- - MIIDqDCCApCgAwIBAgIGAVGNQFX5MA0GCSqGSIb3DQEBBQUAMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGJhbGFjb21wdGVzdDEcMBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTAeFw0xNTEyMTAxODU1MjJaFw0xNzEyMTAxODU2MjJaMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGJhbGFjb21wdGVzdDEcMBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJJjrcnI6cXBiXNq9YDgfYrQe2O5qEHG4MXP8Ue0sMeefFkFEHYHnHUeZCq6WTAGqR+1LFgOl+Eq9We5V+qNlGIfkFkQ3iHGBrIALKqLCd0Et76HicDiegz7j9DtN+lo0hG/gfcw5783L5g5xeQ7zVmCQMkFwoUA0uA3bsfUSrmfORHJL+EMNQT8XIXD8NkG4g6u7ylHVRTLgXbe+W/p04m3EP6l41xl+MhIpBaPxDsyUvcKCNwkZN3aZIin1O9Y4YJuDHxrM64/VtLLp0sC05iawAmfsLunF7rdJAkWUpPn+xkviyNQ3UpvwAYuDr+jKLUdh2reRnm1PezxMIXzBVMCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEARnFIjyitrCGbleFr3KeAwdOyeHiRmgeKupX5ZopgXtcseJoToUIinX5DVw2fVZPahqs0Q7/a0wcVnTRpw6946qZCwKd/PvZ1feVuVEA5Ui3+XvHuSH5xLp7NvYG1snNEvlbN3+NDUMlWj2NEbihowUBt9+UxTpQO3+N08q3aZk3hOZ+tHt+1Te7KEEL/4CM28GZ9MY7fSrS7MAgp1+ZXtn+kRlMrXnQ49qBda37brwDRqmSY9PwNMbev3r+9ZHwxr9W5wXW4Ev4C4xngA7RkVoyDbItSUho0I0M0u/LHuppclnXrw97xyO5Z883eIBvPVjfRcxsJxXJ8jx70ATDskw== + - MIIDqDCCApCgAwIBAgIGAVGNQFX5MA0GCSqGSIb3DQEBBQUAMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGJhbGFjb21wdGVzdDEcMBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTAeFw0xNTEyMTAxODU1MjJaFw0xNzEyMTAxODU2MjJaMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGJhbGFjb21wdGVzdDEcMBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJJjrcnI6cXBiXNq9YDgfYrQe2O5qEHG4MXP8Ue0sMeefFkFEHYHnHUeZCq6WTAGqR+1LFgOl+Eq9We5V+qNlGIfkFkQ3iHGBrIALKqLCd0Et76HicDiegz7j9DtN+lo0hG/gfcw5783L5g5xeQ7zVmCQMkFwoUA0uA3bsfUSrmfORHJL+EMNQT8XIXD8NkG4g6u7ylHVRTLgXbe+W/p04m3EP6l41xl+MhIpBaPxDsyUvcKCNwkZN3aZIin1O9Y4YJuDHxrM64/VtLLp0sC05iawAmfsLunF7rdJAkWUpPn+xkviyNQ3UpvwAYuDr+jKLUdh2reRnm1PezxMIXzBVMCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEARnFIjyitrCGbleFr3KeAwdOyeHiRmgeKupX5ZopgXtcseJoToUIinX5DVw2fVZPahqs0Q7/a0wcVnTRpw6946qZCwKd/PvZ1feVuVEA5Ui3+XvHuSH5xLp7NvYG1snNEvlbN3+NDUMlWj2NEbihowUBt9+UxTpQO3+N08q3aZk3hOZ+tHt+1Te7KEEL/4CM28GZ9MY7fSrS7MAgp1+ZXtn+kRlMrXnQ49qBda37brwDRqmSY9PwNMbev3r+9ZHwxr9W5wXW4Ev4C4xngA7RkVoyDbItSUho0I0M0u/LHuppclnXrw97xyO5Z883eIBvPVjfRcxsJxXJ8jx70ATDskw== kid: akm5hvbn1vojA9Fsa0h7 kty: RSA use: sig @@ -4783,12 +4787,10 @@ components: kid: your-key-id use: sig x5c: - - >- - MIIDmDCCAoCgAwIBAgIGAZY1ItxEMA0GCSqGSIb3DQEBCwUAMIGMMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxDTALBgNVBAMMBHJhaW4xHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMjUwNDE0MTYyODU5WhcNMzUwNDE0MTYyOTU5WjCBjDELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMQ0wCwYDVQQDDARyYWluMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwdmW7pNqxzmlrsWbHq6rQJDiMu4T344AKEzQ1jGffyCLCU+HKk5WqIVtQ4EJ5FU3Rk6kNeoTdkQbxn7t2QFj37ScHZkxXDbNEhFbZpvGh7+rYBG7TCnk8jO9ct/bpT+PCLCgC9L/67H2eCXXN+/gFVZAx7KEibb4NgUET2p34b5scGI2LwEefS+z8UBGlNkg9+SmI9PvjMXplFKazb6qlb27fp0PSfC4S5g8kOCqEGC9oNOCBHO5jyzlzcFq04AIaAX9N1X13UULrj+262O1+RCnQNTadbdrO6FXwfQ6lsLmvWCFBVzLTqxYxCGNY85lhAH1zjoEvXnInKYgnvmcuwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQCXAU2SAJeWoQKz32ShqIwt2ESJS+IoIc+daB/e8mEPUoOgYscjdoUaWBsqXG7RizxrYNub0PXMb90f6Xdk5R4QjB/WqkR/+iupLfIxS1CbTNIzxudY2sfkSC0w8NOq77v4nE786NWDOlOaOOTn/aGLc57rBqwz6spQzNkabtAPw7umm7MpJBJ1K7yNAlwkoRTCM7rsxCvzjGf4OFe+1MaV0MlEr76wkIs6SqGodzPFFnbl2GzKf7NlL0FAdjWsJP9560b8MybAhHpXiQx8AsNW2Ggjvo2ejQKB3Yw/BaHLfcjgij/lcumfQD/P8Pox4trjSuQoRkKXxfdQvlnS9pB7 + - MIIDmDCCAoCgAwIBAgIGAZY1ItxEMA0GCSqGSIb3DQEBCwUAMIGMMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxDTALBgNVBAMMBHJhaW4xHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMjUwNDE0MTYyODU5WhcNMzUwNDE0MTYyOTU5WjCBjDELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMQ0wCwYDVQQDDARyYWluMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwdmW7pNqxzmlrsWbHq6rQJDiMu4T344AKEzQ1jGffyCLCU+HKk5WqIVtQ4EJ5FU3Rk6kNeoTdkQbxn7t2QFj37ScHZkxXDbNEhFbZpvGh7+rYBG7TCnk8jO9ct/bpT+PCLCgC9L/67H2eCXXN+/gFVZAx7KEibb4NgUET2p34b5scGI2LwEefS+z8UBGlNkg9+SmI9PvjMXplFKazb6qlb27fp0PSfC4S5g8kOCqEGC9oNOCBHO5jyzlzcFq04AIaAX9N1X13UULrj+262O1+RCnQNTadbdrO6FXwfQ6lsLmvWCFBVzLTqxYxCGNY85lhAH1zjoEvXnInKYgnvmcuwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQCXAU2SAJeWoQKz32ShqIwt2ESJS+IoIc+daB/e8mEPUoOgYscjdoUaWBsqXG7RizxrYNub0PXMb90f6Xdk5R4QjB/WqkR/+iupLfIxS1CbTNIzxudY2sfkSC0w8NOq77v4nE786NWDOlOaOOTn/aGLc57rBqwz6spQzNkabtAPw7umm7MpJBJ1K7yNAlwkoRTCM7rsxCvzjGf4OFe+1MaV0MlEr76wkIs6SqGodzPFFnbl2GzKf7NlL0FAdjWsJP9560b8MybAhHpXiQx8AsNW2Ggjvo2ejQKB3Yw/BaHLfcjgij/lcumfQD/P8Pox4trjSuQoRkKXxfdQvlnS9pB7 x5t#S256: pX0kpGWPotMaEqqtIoOH9L-sFBa-htNFu0MZiJz1Hi4 e: AQAB - 'n': >- - wdmW7pNqxzmlrsWbHq6rQJDiMu4T344AKEzQ1jGffyCLCU-HKk5WqIVtQ4EJ5FU3Rk6kNeoTdkQbxn7t2QFj37ScHZkxXDbNEhFbZpvGh7-rYBG7TCnk8jO9ct_bpT-PCLCgC9L_67H2eCXXN-_gFVZAx7KEibb4NgUET2p34b5scGI2LwEefS-z8UBGlNkg9+SmI9PvjMXplFKazb6qlb27fp0PSfC4S5g8kOCqEGC9oNOCBHO5jyzlzcFq04AIaAX9N1X13UULrj-262O1-RCnQNTadbdrO6FXwfQ6lsLmvWCFBVzLTqxYxCGNY85lhAH1zjoEvXnInKYgnvmcuw + 'n': wdmW7pNqxzmlrsWbHq6rQJDiMu4T344AKEzQ1jGffyCLCU-HKk5WqIVtQ4EJ5FU3Rk6kNeoTdkQbxn7t2QFj37ScHZkxXDbNEhFbZpvGh7-rYBG7TCnk8jO9ct_bpT-PCLCgC9L_67H2eCXXN-_gFVZAx7KEibb4NgUET2p34b5scGI2LwEefS-z8UBGlNkg9+SmI9PvjMXplFKazb6qlb27fp0PSfC4S5g8kOCqEGC9oNOCBHO5jyzlzcFq04AIaAX9N1X13UULrj-262O1-RCnQNTadbdrO6FXwfQ6lsLmvWCFBVzLTqxYxCGNY85lhAH1zjoEvXnInKYgnvmcuw IdPSigningKeyCredentialResponse: summary: IdP signing key credential value: @@ -4798,8 +4800,7 @@ components: kty: RSA use: sig x5c: - - >- - MIIDnjCCAoagAwIBAgIGAVG3MN+PMA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB2V4YW1wbGUxHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMTUxMjE4MjIyMjMyWhcNMjUxMjE4MjIyMzMyWjCBjzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdleGFtcGxlMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtcnyvuVCrsFEKCwHDenS3Ocjed8eWDv3zLtD2K/iZfE8BMj2wpTfn6Ry8zCYey3mWlKdxIybnV9amrujGRnE0ab6Q16v9D6RlFQLOG6dwqoRKuZy33Uyg8PGdEudZjGbWuKCqqXEp+UKALJHV+k4wWeVH8g5d1n3KyR2TVajVJpCrPhLFmq1Il4G/IUnPe4MvjXqB6CpKkog1+ThWsItPRJPAM+RweFHXq7KfChXsYE7Mmfuly8sDQlvBmQyxZnFHVuiPfCvGHJjpvHy11YlHdOjfgqHRvZbmo30+y0X/oY/yV4YEJ00LL6eJWU4wi7ViY3HP6/VCdRjHoRdr5L/DwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQCzzhOFkvyYLNFj2WDcq1YqD4sBy1iCia9QpRH3rjQvMKDwQDYWbi6EdOX0TQ/IYR7UWGj+2pXd6v0t33lYtoKocp/4lUvT3tfBnWZ5KnObi+J2uY2teUqoYkASN7F+GRPVOuMVoVgm05ss8tuMb2dLc9vsx93sDt+XlMTv/2qi5VPwaDtqduKkzwW9lUfn4xIMkTiVvCpe0X2HneD2Bpuao3/U8Rk0uiPfq6TooWaoW3kjsmErhEAs9bA7xuqo1KKY9CdHcFhkSsMhoeaZylZHtzbnoipUlQKSLMdJQiiYZQ0bYL83/Ta9fulr1EERICMFt3GUmtYaZZKHpWSfdJp9 + - MIIDnjCCAoagAwIBAgIGAVG3MN+PMA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB2V4YW1wbGUxHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMTUxMjE4MjIyMjMyWhcNMjUxMjE4MjIyMzMyWjCBjzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdleGFtcGxlMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtcnyvuVCrsFEKCwHDenS3Ocjed8eWDv3zLtD2K/iZfE8BMj2wpTfn6Ry8zCYey3mWlKdxIybnV9amrujGRnE0ab6Q16v9D6RlFQLOG6dwqoRKuZy33Uyg8PGdEudZjGbWuKCqqXEp+UKALJHV+k4wWeVH8g5d1n3KyR2TVajVJpCrPhLFmq1Il4G/IUnPe4MvjXqB6CpKkog1+ThWsItPRJPAM+RweFHXq7KfChXsYE7Mmfuly8sDQlvBmQyxZnFHVuiPfCvGHJjpvHy11YlHdOjfgqHRvZbmo30+y0X/oY/yV4YEJ00LL6eJWU4wi7ViY3HP6/VCdRjHoRdr5L/DwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQCzzhOFkvyYLNFj2WDcq1YqD4sBy1iCia9QpRH3rjQvMKDwQDYWbi6EdOX0TQ/IYR7UWGj+2pXd6v0t33lYtoKocp/4lUvT3tfBnWZ5KnObi+J2uY2teUqoYkASN7F+GRPVOuMVoVgm05ss8tuMb2dLc9vsx93sDt+XlMTv/2qi5VPwaDtqduKkzwW9lUfn4xIMkTiVvCpe0X2HneD2Bpuao3/U8Rk0uiPfq6TooWaoW3kjsmErhEAs9bA7xuqo1KKY9CdHcFhkSsMhoeaZylZHtzbnoipUlQKSLMdJQiiYZQ0bYL83/Ta9fulr1EERICMFt3GUmtYaZZKHpWSfdJp9 x5t#S256: wzPVobIrveR1x-PCbjsFGNV-6zn7Rm9KuOWOG4Rk6jE ActivateIdPResponse: summary: Activate an IdP @@ -4847,10 +4848,11 @@ components: filter: null matchType: USERNAME mapAMRClaims: false + trustClaims: false maxClockSkew: 0 _links: authorize: - href: >- + href: |- https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oa62bfdiumsUndnZ0h7& client_id={clientId}&response_type={responseType}&response_mode={responseMode}& scope={scopes}&redirect_uri={redirectUri}&state={state} @@ -4909,10 +4911,11 @@ components: filter: null matchType: USERNAME mapAMRClaims: false + trustClaims: false maxClockSkew: 0 _links: authorize: - href: >- + href: |- https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oa62bfdiumsUndnZ0h7& client_id={clientId}&response_type={responseType}&response_mode={responseMode}& scope={scopes}&redirect_uri={redirectUri}&state={state} @@ -4941,8 +4944,7 @@ components: profile: https://www.facebook.com/app_scoped_user_id/109912936038778/ _links: self: - href: >- - https://{yourOktaDomain}/api/v1/idps/0oa4lb6lbtmH355Hx0h7/users/00u5cl9lo7nMjHjPr0h7 + href: https://{yourOktaDomain}/api/v1/idps/0oa4lb6lbtmH355Hx0h7/users/00u5cl9lo7nMjHjPr0h7 hints: allow: - GET @@ -4971,8 +4973,7 @@ components: idp: href: https://{yourOktaDomain}/api/v1/idps/0oa62bfdiumsUndnZ0h7 self: - href: >- - https://{yourOktaDomain}/api/v1/idps/0oa62bfdiumsUndnZ0h7/users/00u5t60iloOHN9pBi0h7 + href: https://{yourOktaDomain}/api/v1/idps/0oa62bfdiumsUndnZ0h7/users/00u5t60iloOHN9pBi0h7 hints: allow: - GET @@ -4988,8 +4989,7 @@ components: lastUpdated: '2017-03-30T02:19:51.000Z' _links: self: - href: >- - https://{yourOktaDomain}/api/v1/idps/0oa62b57p7c8PaGpU0h7/users/00ub0oNGTSWTBKOLGLNR + href: https://{yourOktaDomain}/api/v1/idps/0oa62b57p7c8PaGpU0h7/users/00ub0oNGTSWTBKOLGLNR hints: allow: - GET @@ -5057,7 +5057,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.identity_providers + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListIdentityProvidersResponse' + transform: + body: |- + {{- $wrapped := printf "{\"identity_providers\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_identity_provider: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1idps/post' response: @@ -5070,6 +5082,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_identity_provider: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1idps~1{idpId}/put' response: @@ -5079,7 +5094,7 @@ components: operation: $ref: '#/paths/~1api~1v1~1idps~1{idpId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' activate_identity_provider: operation: @@ -5095,20 +5110,15 @@ components: openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/identity_providers/methods/list_identity_providers - - $ref: >- - #/components/x-stackQL-resources/identity_providers/methods/get_identity_provider + - $ref: '#/components/x-stackQL-resources/identity_providers/methods/get_identity_provider' + - $ref: '#/components/x-stackQL-resources/identity_providers/methods/list_identity_providers' insert: - - $ref: >- - #/components/x-stackQL-resources/identity_providers/methods/create_identity_provider + - $ref: '#/components/x-stackQL-resources/identity_providers/methods/create_identity_provider' update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/identity_providers/methods/delete_identity_provider + - $ref: '#/components/x-stackQL-resources/identity_providers/methods/delete_identity_provider' replace: - - $ref: >- - #/components/x-stackQL-resources/identity_providers/methods/replace_identity_provider + - $ref: '#/components/x-stackQL-resources/identity_providers/methods/replace_identity_provider' keys: id: okta.idps.keys name: keys @@ -5120,7 +5130,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.identity_provider_keys + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListIdentityProviderKeysResponse' + transform: + body: |- + {{- $wrapped := printf "{\"identity_provider_keys\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_identity_provider_key: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1idps~1credentials~1keys/post' response: @@ -5133,6 +5155,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_identity_provider_key: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1idps~1credentials~1keys~1{kid}/put' response: @@ -5142,24 +5167,19 @@ components: operation: $ref: '#/paths/~1api~1v1~1idps~1credentials~1keys~1{kid}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/keys/methods/list_identity_provider_keys - - $ref: >- - #/components/x-stackQL-resources/keys/methods/get_identity_provider_key + - $ref: '#/components/x-stackQL-resources/keys/methods/get_identity_provider_key' + - $ref: '#/components/x-stackQL-resources/keys/methods/list_identity_provider_keys' insert: - - $ref: >- - #/components/x-stackQL-resources/keys/methods/create_identity_provider_key + - $ref: '#/components/x-stackQL-resources/keys/methods/create_identity_provider_key' update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/keys/methods/delete_identity_provider_key + - $ref: '#/components/x-stackQL-resources/keys/methods/delete_identity_provider_key' replace: - - $ref: >- - #/components/x-stackQL-resources/keys/methods/replace_identity_provider_key + - $ref: '#/components/x-stackQL-resources/keys/methods/replace_identity_provider_key' csrs: id: okta.idps.csrs name: csrs @@ -5171,7 +5191,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.csrs_for_identity_provider + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListCsrsForIdentityProviderResponse' + transform: + body: |- + {{- $wrapped := printf "{\"csrs_for_identity_provider\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 generate_csr_for_identity_provider: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1idps~1{idpId}~1credentials~1csrs/post' response: @@ -5179,38 +5211,34 @@ components: openAPIDocKey: '201' get_csr_for_identity_provider: operation: - $ref: >- - #/paths/~1api~1v1~1idps~1{idpId}~1credentials~1csrs~1{idpCsrId}/get + $ref: '#/paths/~1api~1v1~1idps~1{idpId}~1credentials~1csrs~1{idpCsrId}/get' response: mediaType: application/json openAPIDocKey: '200' revoke_csr_for_identity_provider: operation: - $ref: >- - #/paths/~1api~1v1~1idps~1{idpId}~1credentials~1csrs~1{idpCsrId}/delete + $ref: '#/paths/~1api~1v1~1idps~1{idpId}~1credentials~1csrs~1{idpCsrId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' publish_csr_for_identity_provider: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1idps~1{idpId}~1credentials~1csrs~1{idpCsrId}~1lifecycle~1publish/post + $ref: '#/paths/~1api~1v1~1idps~1{idpId}~1credentials~1csrs~1{idpCsrId}~1lifecycle~1publish/post' response: mediaType: application/json openAPIDocKey: '201' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/csrs/methods/list_csrs_for_identity_provider - - $ref: >- - #/components/x-stackQL-resources/csrs/methods/get_csr_for_identity_provider + - $ref: '#/components/x-stackQL-resources/csrs/methods/get_csr_for_identity_provider' + - $ref: '#/components/x-stackQL-resources/csrs/methods/list_csrs_for_identity_provider' insert: - - $ref: >- - #/components/x-stackQL-resources/csrs/methods/generate_csr_for_identity_provider + - $ref: '#/components/x-stackQL-resources/csrs/methods/generate_csr_for_identity_provider' update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/csrs/methods/revoke_csr_for_identity_provider + - $ref: '#/components/x-stackQL-resources/csrs/methods/revoke_csr_for_identity_provider' replace: [] signing_keys: id: okta.idps.signing_keys @@ -5223,6 +5251,15 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.identity_provider_signing_keys + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListIdentityProviderSigningKeysResponse' + transform: + body: |- + {{- $wrapped := printf "{\"identity_provider_signing_keys\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 generate_identity_provider_signing_key: operation: $ref: '#/paths/~1api~1v1~1idps~1{idpId}~1credentials~1keys~1generate/post' @@ -5237,20 +5274,16 @@ components: openAPIDocKey: '200' clone_identity_provider_key: operation: - $ref: >- - #/paths/~1api~1v1~1idps~1{idpId}~1credentials~1keys~1{kid}~1clone/post + $ref: '#/paths/~1api~1v1~1idps~1{idpId}~1credentials~1keys~1{kid}~1clone/post' response: mediaType: application/json openAPIDocKey: '201' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/signing_keys/methods/list_identity_provider_signing_keys - - $ref: >- - #/components/x-stackQL-resources/signing_keys/methods/get_identity_provider_signing_key + - $ref: '#/components/x-stackQL-resources/signing_keys/methods/get_identity_provider_signing_key' + - $ref: '#/components/x-stackQL-resources/signing_keys/methods/list_identity_provider_signing_keys' insert: - - $ref: >- - #/components/x-stackQL-resources/signing_keys/methods/generate_identity_provider_signing_key + - $ref: '#/components/x-stackQL-resources/signing_keys/methods/generate_identity_provider_signing_key' update: [] delete: [] replace: [] @@ -5265,10 +5298,18 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.active_identity_provider_signing_key + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListActiveIdentityProviderSigningKeyResponse' + transform: + body: |- + {{- $wrapped := printf "{\"active_identity_provider_signing_key\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/active_idp_signing_keys/methods/list_active_identity_provider_signing_key + - $ref: '#/components/x-stackQL-resources/active_idp_signing_keys/methods/list_active_identity_provider_signing_key' insert: [] update: [] delete: [] @@ -5284,6 +5325,15 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.identity_provider_application_users + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListIdentityProviderApplicationUsersResponse' + transform: + body: |- + {{- $wrapped := printf "{\"identity_provider_application_users\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 get_identity_provider_application_user: operation: $ref: '#/paths/~1api~1v1~1idps~1{idpId}~1users~1{userId}/get' @@ -5291,6 +5341,9 @@ components: mediaType: application/json openAPIDocKey: '200' link_user_to_identity_provider: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1idps~1{idpId}~1users~1{userId}/post' response: @@ -5300,19 +5353,16 @@ components: operation: $ref: '#/paths/~1api~1v1~1idps~1{idpId}~1users~1{userId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/idp_users/methods/list_identity_provider_application_users - - $ref: >- - #/components/x-stackQL-resources/idp_users/methods/get_identity_provider_application_user + - $ref: '#/components/x-stackQL-resources/idp_users/methods/get_identity_provider_application_user' + - $ref: '#/components/x-stackQL-resources/idp_users/methods/list_identity_provider_application_users' insert: [] update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/idp_users/methods/unlink_user_from_identity_provider + - $ref: '#/components/x-stackQL-resources/idp_users/methods/unlink_user_from_identity_provider' replace: [] social_auth_tokens: id: okta.idps.social_auth_tokens @@ -5321,15 +5371,22 @@ components: methods: list_social_auth_tokens: operation: - $ref: >- - #/paths/~1api~1v1~1idps~1{idpId}~1users~1{userId}~1credentials~1tokens/get + $ref: '#/paths/~1api~1v1~1idps~1{idpId}~1users~1{userId}~1credentials~1tokens/get' response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.social_auth_tokens + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListSocialAuthTokensResponse' + transform: + body: |- + {{- $wrapped := printf "{\"social_auth_tokens\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/social_auth_tokens/methods/list_social_auth_tokens + - $ref: '#/components/x-stackQL-resources/social_auth_tokens/methods/list_social_auth_tokens' insert: [] update: [] delete: [] @@ -5339,7 +5396,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/inlinehooks.yaml b/providers/src/okta/v00.00.00000/services/inlinehooks.yaml index 5e33dd5a..f296ba5e 100644 --- a/providers/src/okta/v00.00.00000/services/inlinehooks.yaml +++ b/providers/src/okta/v00.00.00000/services/inlinehooks.yaml @@ -2,25 +2,23 @@ openapi: 3.0.3 info: title: inlinehooks API description: okta inlinehooks API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/inlineHooks: get: summary: List all inline hooks - description: >- + description: |- Lists all inline hooks or all inline hooks of a specific type. - - When listing a specific inline hook, you need to specify its type. The - following types are currently supported: + When listing a specific inline hook, you need to specify its type. The following types are currently supported: | Type Value | Name | |------------------------------------|----------------------------------------------------------------| - | `com.okta.import.transform` | [User import inline hook](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/InlineHook/#tag/InlineHook/operation/createUserImportInlineHook) | - | `com.okta.oauth2.tokens.transform` | [Token inline hook](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/InlineHook/#tag/InlineHook/operation/createTokenInlineHook) | - | `com.okta.saml.tokens.transform` | [SAML assertion inline hook](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/InlineHook/#tag/InlineHook/operation/createSAMLAssertionInlineHook) | - | `com.okta.telephony.provider` | [Telephony inline hook](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/InlineHook/#tag/InlineHook/operation/createTelephonyInlineHook) | - | `com.okta.user.credential.password.import` | [Password import inline hook](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/InlineHook/#tag/InlineHook/operation/createPasswordImportInlineHook)| - | `com.okta.user.pre-registration` | [Registration inline hook](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/InlineHook/#tag/InlineHook/operation/create-registration-hook) | + | `com.okta.import.transform` | [User import inline hook](https://developer.okta.com/docs/api/openapi/okta-management/management/management/inlinehook/createuserimportinlinehook) | + | `com.okta.oauth2.tokens.transform` | [Token inline hook](https://developer.okta.com/docs/api/openapi/okta-management/management/management/inlinehook/createtokeninlinehook) | + | `com.okta.saml.tokens.transform` | [SAML assertion inline hook](https://developer.okta.com/docs/api/openapi/okta-management/management/management/inlinehook/createsamlassertioninlinehook) | + | `com.okta.telephony.provider` | [Telephony inline hook](https://developer.okta.com/docs/api/openapi/okta-management/management/management/inlinehook/createtelephonyinlinehook) | + | `com.okta.user.credential.password.import` | [Password import inline hook](openapi/okta-management/management/management/inlinehook/createpasswordimportinlinehook)| + | `com.okta.user.pre-registration` | [Registration inline hook](https://developer.okta.com/docs/api/openapi/okta-management/management/management/inlinehook/create-registration-hook) | operationId: listInlineHooks parameters: - $ref: '#/components/parameters/inlineHookType' @@ -30,9 +28,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/InlineHook' + $ref: '#/components/schemas/ListInlineHooksResponse' examples: InlineHooktMgmtListAllexample: $ref: '#/components/examples/InlineHooktMgmtListAllexample' @@ -51,58 +47,31 @@ paths: isGenerallyAvailable: true post: summary: Create an inline hook - description: >- + description: |- Creates an inline hook - - This endpoint creates an inline hook for your org in an `ACTIVE` status. - You need to pass an inline hooks object in the JSON payload of your - request. - - That object represents the set of required information about the inline - hook that you're registering, including: - + This endpoint creates an inline hook for your org in an `ACTIVE` status. You need to pass an inline hooks object in the JSON payload of your request. + That object represents the set of required information about the inline hook that you're registering, including: * The URI of your external service endpoint - * The type of inline hook you're registering - * The type of authentication you're registering + There are two authentication options that you can configure for your inline hook: HTTP headers and OAuth 2.0 tokens. - There are two authentication options that you can configure for your - inline hook: HTTP headers and OAuth 2.0 tokens. - - - HTTP headers let you specify a secret API key that you want Okta to pass - to your external service endpoint (so that your external service can - check for its presence as a security measure). - - - >**Note:** The API key that you set here is unrelated to the Okta API - token you must supply when making calls to Okta APIs. - - - You can also optionally specify extra headers that you want Okta to pass - to your external service with each call. + HTTP headers let you specify a secret API key that you want Okta to pass to your external service endpoint (so that your external service can check for its presence as a security measure). + >**Note:** The API key that you set here is unrelated to the Okta API token you must supply when making calls to Okta APIs. - To configure HTTP header authentication, see parameters for the `config` - object. + You can also optionally specify extra headers that you want Okta to pass to your external service with each call. + To configure HTTP header authentication, see parameters for the `config` object. - OAuth 2.0 tokens provide enhanced security between Okta and your - external service. You can configure these tokens for the following - types—client secret and private key. + OAuth 2.0 tokens provide enhanced security between Okta and your external service. You can configure these tokens for the following types—client secret and private key. + >**Note:** Your external service's endpoint needs to be a valid HTTPS endpoint. The URI you specify should always begin with `https://`. - >**Note:** Your external service's endpoint needs to be a valid HTTPS - endpoint. The URI you specify should always begin with `https://`. - - - The total number of inline hooks that you can create in an Okta org is - limited to 50, which is a combined total for any combination of inline - hook types. + The total number of inline hooks that you can create in an Okta org is limited to 50, which is a combined total for any combination of inline hook types. operationId: createInlineHook x-codegen-request-body-name: inlineHookCreate requestBody: @@ -114,11 +83,9 @@ paths: CreateInlineHookHTTP: $ref: '#/components/examples/InlineHookMgmtCreateHTTPRequest' CreateInlineHookOAuthClientSecret: - $ref: >- - #/components/examples/InlineHookMgmtCreateOAuthClientSecretRequest + $ref: '#/components/examples/InlineHookMgmtCreateOAuthClientSecretRequest' CreateInlineHookOAuthPrivateKey: - $ref: >- - #/components/examples/InlineHookMgmtCreateOAuthPrivateKeyRequest + $ref: '#/components/examples/InlineHookMgmtCreateOAuthPrivateKeyRequest' required: true responses: '200': @@ -131,11 +98,9 @@ paths: CreateInlineHookHTTP: $ref: '#/components/examples/InlineHookMgmtCreateHTTPResponse' CreateInlineHookOAuthClientSecret: - $ref: >- - #/components/examples/InlineHookMgmtCreateOAuthClientSecretResponse + $ref: '#/components/examples/InlineHookMgmtCreateOAuthClientSecretResponse' CreateInlineHookOAuthPrivateKey: - $ref: >- - #/components/examples/InlineHookMgmtCreateOAuthPrivateKeyResponse + $ref: '#/components/examples/InlineHookMgmtCreateOAuthPrivateKeyResponse' '400': $ref: '#/components/responses/ErrorApiValidationFailed400' '403': @@ -185,6 +150,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathInlineHookId' post: summary: Update an inline hook description: Updates an inline hook by `inlineHookId` @@ -226,12 +193,12 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathInlineHookId' put: summary: Replace an inline hook - description: >- - Replaces an inline hook by `inlineHookId`. The submitted inline hook - properties replace the existing properties after passing validation. - + description: |- + Replaces an inline hook by `inlineHookId`. The submitted inline hook properties replace the existing properties after passing validation. >**Note:** Some properties are immutable and can't be updated. operationId: replaceInlineHook @@ -272,12 +239,11 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathInlineHookId' delete: summary: Delete an inline hook - description: >- - Deletes an inline hook by `inlineHookId`. After it's deleted, the inline - hook is unrecoverable. As a safety precaution, only inline hooks with a - status of `INACTIVE` are eligible for deletion. + description: Deletes an inline hook by `inlineHookId`. After it's deleted, the inline hook is unrecoverable. As a safety precaution, only inline hooks with a status of `INACTIVE` are eligible for deletion. operationId: deleteInlineHook responses: '204': @@ -298,46 +264,66 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathInlineHookId' + parameters: + - $ref: '#/components/parameters/pathInlineHookId' /api/v1/inlineHooks/{inlineHookId}/execute: post: summary: Execute an inline hook - description: >- - Executes the inline hook that matches the provided `inlineHookId` by - using the request body as the input. This inline hook sends the - provided + description: |- + Executes the inline hook that matches the provided `inlineHookId` by using the request body as the input. This inline hook sends the provided + data through the `channel` object and returns a response if it matches the correct data contract. Otherwise it returns an error. You need to + construct a JSON payload that matches the payloads that Okta would send to your external service for this inline hook type. - data through the `channel` object and returns a response if it matches - the correct data contract. Otherwise it returns an error. You need to + A timeout of three seconds is enforced on all outbound requests, with one retry in the event of a timeout or an error response from the remote system. + If a successful response isn't received after the request, a 400 error is returned with more information about what failed. - construct a JSON payload that matches the payloads that Okta would send - to your external service for this inline hook type. - - - A timeout of three seconds is enforced on all outbound requests, with - one retry in the event of a timeout or an error response from the remote - system. - - If a successful response isn't received after the request, a 400 error - is returned with more information about what failed. - - - >**Note:** This execution endpoint isn't tied to any other functionality - in Okta, and you should only use it for testing purposes. + >**Note:** This execution endpoint isn't tied to any other functionality in Okta, and you should only use it for testing purposes. operationId: executeInlineHook x-codegen-request-body-name: payloadData requestBody: content: application/json: schema: - oneOf: - - $ref: '#/components/schemas/PasswordImportRequestExecute' - - $ref: '#/components/schemas/TelephonyRequestExecute' - - $ref: '#/components/schemas/RegistrationInlineHookRequest' - - $ref: '#/components/schemas/TokenRequest' - - $ref: '#/components/schemas/SAMLPayloadExecute' - - $ref: '#/components/schemas/UserImportRequestExecute' + description: Password import inline hook request + type: object + properties: + cloudEventVersion: + description: The inline hook cloud version + example: 0.1 + type: string + contentType: + description: The inline hook request header content + example: application/JSON + type: string + eventId: + type: string + description: The individual inline hook request ID + example: 3o9jBzq1SmOGmmsDsqyyeQ + eventTime: + type: string + description: The time the inline hook request was sent + example: '2020-01-17T21:23:56.000Z' + eventTypeVersion: + description: The inline hook version + example: 1 + type: string + data: + $ref: '#/components/schemas/PasswordImportRequestData' + eventType: + type: string + description: The type of inline hook. The password import inline hook type is `com.okta.user.credential.password.import`. + source: + description: The ID and URL of the password import inline hook + type: string + requestType: + type: string + description: The type of inline hook request. For example, `com.okta.user.telephony.pre-enrollment`. + discriminator: + propertyName: requestType + mapping: + self.service.registration: '#/components/schemas/RegistrationInlineHookSSRData' + progressive.profile: '#/components/schemas/RegistrationInlineHookPPData' + x-okta-ignore-redocly-rules-for-sdk: true examples: PasswordImportPayloadExample: $ref: '#/components/examples/PasswordImportPayloadExample' @@ -355,29 +341,6 @@ paths: responses: '200': description: Success - content: - application/json: - schema: - oneOf: - - $ref: '#/components/schemas/PasswordImportResponse' - - $ref: '#/components/schemas/TelephonyResponse' - - $ref: '#/components/schemas/RegistrationInlineHookResponse' - - $ref: '#/components/schemas/TokenHookResponse' - - $ref: '#/components/schemas/SAMLHookResponse' - - $ref: '#/components/schemas/UserImportResponse' - examples: - PasswordImportPayloadExample: - $ref: '#/components/examples/PasswordImportVerifiedResponse' - TelephonyPayloadExample: - $ref: '#/components/examples/TelephonySuccessResponse' - ProfileEnrollmentRequest: - $ref: '#/components/examples/ProfileEnrollmentResponse' - TokenPayLoadExample: - $ref: '#/components/examples/TokenHookResponse' - SAMLPayloadExample: - $ref: '#/components/examples/SAMLHookResponseExample' - UserImportPayloadExample: - $ref: '#/components/examples/UserImportChangeAppUserProfileExample' '400': $ref: '#/components/responses/ErrorApiValidationFailed400' '403': @@ -395,8 +358,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathInlineHookId' + parameters: + - $ref: '#/components/parameters/pathInlineHookId' /api/v1/inlineHooks/{inlineHookId}/lifecycle/activate: post: summary: Activate an inline hook @@ -427,8 +390,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathInlineHookId' + parameters: + - $ref: '#/components/parameters/pathInlineHookId' /api/v1/inlineHooks/{inlineHookId}/lifecycle/deactivate: post: summary: Deactivate an inline hook @@ -459,8 +422,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathInlineHookId' + parameters: + - $ref: '#/components/parameters/pathInlineHookId' components: schemas: InlineHook: @@ -494,9 +457,7 @@ components: $ref: '#/components/schemas/InlineHookType' version: type: string - description: >- - Version of the inline hook type. The currently supported version is - `1.0.0`. + description: Version of the inline hook type. The currently supported version is `1.0.0`. readOnly: true _links: $ref: '#/components/schemas/InlineHookLinks' @@ -515,9 +476,7 @@ components: $ref: '#/components/schemas/InlineHookType' version: type: string - description: >- - Version of the inline hook type. The currently supported version is - `1.0.0`. + description: Version of the inline hook type. The currently supported version is `1.0.0`. InlineHookCreateResponse: description: An inline hook object that specifies the details of the inline hook type: object @@ -549,9 +508,7 @@ components: $ref: '#/components/schemas/InlineHookType' version: type: string - description: >- - Version of the inline hook type. The currently supported version is - `1.0.0`. + description: Version of the inline hook type. The currently supported version is `1.0.0`. readOnly: true _links: $ref: '#/components/schemas/InlineHookLinksCreate' @@ -568,28 +525,81 @@ components: minimum: 1 version: type: string - description: >- - Version of the inline hook type. The currently supported version is - `1.0.0`. + description: Version of the inline hook type. The currently supported version is `1.0.0`. PasswordImportRequestExecute: description: Password import inline hook request - allOf: - - $ref: '#/components/schemas/InlineHookBasePayload' - - $ref: '#/components/schemas/PasswordImportRequest' + type: object + properties: + cloudEventVersion: + description: The inline hook cloud version + example: 0.1 + type: string + contentType: + description: The inline hook request header content + example: application/JSON + type: string + eventId: + type: string + description: The individual inline hook request ID + example: 3o9jBzq1SmOGmmsDsqyyeQ + eventTime: + type: string + description: The time the inline hook request was sent + example: '2020-01-17T21:23:56.000Z' + eventTypeVersion: + description: The inline hook version + example: 1 + type: string + data: + $ref: '#/components/schemas/PasswordImportRequestData' + eventType: + type: string + description: The type of inline hook. The password import inline hook type is `com.okta.user.credential.password.import`. + source: + description: The ID and URL of the password import inline hook + type: string TelephonyRequestExecute: description: Telephony inline hook request body - allOf: - - $ref: '#/components/schemas/InlineHookBasePayload' - - $ref: '#/components/schemas/TelephonyRequest' + type: object + properties: + cloudEventVersion: + description: The inline hook cloud version + example: 0.1 + type: string + contentType: + description: The inline hook request header content + example: application/JSON + type: string + eventId: + type: string + description: The individual inline hook request ID + example: 3o9jBzq1SmOGmmsDsqyyeQ + eventTime: + type: string + description: The time the inline hook request was sent + example: '2020-01-17T21:23:56.000Z' + eventTypeVersion: + description: The inline hook version + example: 1 + type: string + data: + $ref: '#/components/schemas/TelephonyRequestData' + eventType: + type: string + description: The type of inline hook. The telephony inline hook type is `com.okta.telephony.provider`. + requestType: + type: string + description: The type of inline hook request. For example, `com.okta.user.telephony.pre-enrollment`. + source: + description: The ID and URL of the telephony inline hook + type: string RegistrationInlineHookRequest: description: Registration inline hook request type: object properties: eventType: type: string - description: >- - The type of inline hook. The registration inline hook type is - `com.okta.user.pre-registration`. + description: The type of inline hook. The registration inline hook type is `com.okta.user.pre-registration`. requestType: $ref: '#/components/schemas/RegistrationInlineHookRequestType' source: @@ -602,54 +612,636 @@ components: progressive.profile: '#/components/schemas/RegistrationInlineHookPPData' TokenRequest: description: Token inline hook request - allOf: - - $ref: '#/components/schemas/InlineHookBasePayload' - - $ref: '#/components/schemas/TokenPayLoad' + type: object + properties: + cloudEventVersion: + description: The inline hook cloud version + example: 0.1 + type: string + contentType: + description: The inline hook request header content + example: application/JSON + type: string + eventId: + type: string + description: The individual inline hook request ID + example: 3o9jBzq1SmOGmmsDsqyyeQ + eventTime: + type: string + description: The time the inline hook request was sent + example: '2020-01-17T21:23:56.000Z' + eventTypeVersion: + description: The inline hook version + example: 1 + type: string + data: + type: object + properties: + context: + description: This object contains a number of sub-objects, each of which provide some type of contextual information. + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + request: + $ref: '#/components/schemas/InlineHookRequestObject' + session: + description: Details of the user session + type: object + properties: + id: + description: The unique identifier for the user's session + type: string + example: 102LN9Bnuc4S_ewfc9BYwageA + userId: + description: The unique identifier for the user + type: string + example: 00uq8tMo3zV0OfJON0g3 + login: + description: The username used to identify the user. This is often the user's email address. + type: string + example: user@example.com + createdAt: + description: Timestamp of when the session was created + type: string + format: date-time + example: '2019-03-28T16:45:55.000Z' + expiresAt: + description: Timestamp of when the session expires + type: string + format: date-time + example: '2019-03-28T21:15:23.000Z' + status: + description: Represents the current status of the user's session + type: string + example: ACTIVE + lastPasswordVerification: + description: Timestamp of when the user was last authenticated + type: string + format: date-time + example: '2019-03-28T16:45:55.000Z' + amr: + description: The authentication method reference + type: array + items: + type: string + example: + - PASSWORD + idp: + $ref: '#/components/schemas/SessionIdentityProvider' + mfaActive: + description: Describes whether multifactor authentication was enabled + type: boolean + example: false + user: + description: Identifies the Okta user that the token was generated to authenticate and provides details of their Okta user profile + type: object + properties: + id: + description: The unique identifier for the user + type: string + example: 00uq8tMo3zV0OfJON0g3 + passwordChanged: + description: The timestamp when the user's password was last updated + type: string + format: date-time + example: '2018-09-11T23:19:12.000Z' + profile: + type: object + properties: + login: + description: The username used to identify the user. This is often the user's email address. + type: string + example: user@example.com + firstName: + description: The first name of the user + type: string + example: John + lastName: + description: The last name of the user + type: string + example: Smith + locale: + description: |- + The user's default location for purposes of localizing items such as currency, date time format, numerical representations, and so on. + A locale value is a concatenation of the [ISO 639-1](https://en.wikipedia.org/wiki/List_of_ISO_639_language_codes) two-letter language code, an underscore, and the [ISO 3166-1](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2) two-letter country code. For example, `en_US` specifies the language English and country US. This value is `en_US` by default. + type: string + example: en_US + timeZone: + description: The user's timezone + type: string + example: America/Los_Angeles + _links: + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status of the user. These links are used to discover what groups the user is a part of and what factors they have enrolled. + type: object + properties: + groups: + description: URL to retrieve the individual user's group memberships + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + factors: + description: URL to retrieve individual user's factor enrollments + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + protocol: + description: Details of the authentication protocol + type: object + properties: + type: + description: The type of authentication protocol used + type: string + example: OAUTH2.0 + request: + $ref: '#/components/schemas/TokenProtocolRequest' + OriginalGrant: + description: Information about the original token request used to get the refresh token being used, when in a refresh token request + type: object + properties: + authorization: + $ref: '#/components/schemas/TokenProtocolRequest' + refresh_token: + $ref: '#/components/schemas/RefreshToken' + issuer: + description: The authorization server's issuer identifier + type: object + properties: + uri: + description: The authorization server's issuer identifier + type: string + format: uri + client: + description: The client making the token request + type: object + properties: + id: + description: The unique identifier of the client + type: string + name: + description: The name of the client + type: string + type: + description: The type of client + type: string + example: PUBLIC + policy: + description: The authorization server policy used to mint the token + type: object + properties: + id: + description: The unique identifier for the policy + type: string + example: 00p4ktaq2ryOYtsHC0g7 + rule: + description: The authorization server policy rule used to mint the token + type: object + properties: + id: + description: The unique identifier for the policy rule + type: string + example: 0pr4ktb7elD3ZvrMy0g7 + identity: + description: Provides information on the properties of the ID token that Okta has generated, including the existing claims that it contains + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + claims: + description: Claims included in the token. Consists of name-value pairs for each included claim. For descriptions of the claims that you can include, see the Okta [OpenID Connect and OAuth 2.0 API reference](https://developer.okta.com/docs/api/openapi/okta-oauth/guides/overview/#claims). (opaque JSON object) + type: string + token: + description: The token + type: object + properties: + lifetime: + description: Lifetime of the token + type: object + properties: + expiration: + description: Time in seconds until the token expires + type: integer + access: + description: Provides information on the properties of the access token that Okta has generated, including the existing claims that it contains + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + claims: + description: Claims included in the token. Consists of name-value pairs for each included claim. For descriptions of the claims that you can include, see the Okta [OpenID Connect and OAuth 2.0 API reference](https://developer.okta.com/docs/api/openapi/okta-oauth/guides/overview/#claims). (opaque JSON object) + type: string + token: + description: The token + type: object + properties: + lifetime: + description: Lifetime of the token + type: object + properties: + expiration: + description: Time in seconds until the token expires + type: integer + scopes: + description: The scopes contained in the token. For descriptions of the scopes that you can include, see the Okta [OpenID Connect and OAuth 2.0 API reference](https://developer.okta.com/docs/api/openapi/okta-oauth/guides/overview/#scopes). (opaque JSON object) + type: string + refresh_token: + $ref: '#/components/schemas/RefreshToken' + eventType: + type: string + description: The type of inline hook. The token inline hook type is `com.okta.oauth2.tokens.transform`. + source: + description: The URL of the token inline hook + type: string + x-okta-ignore-redocly-rules-for-sdk: true SAMLPayloadExecute: description: SAML assertion inline hook request - allOf: - - $ref: '#/components/schemas/InlineHookBasePayload' - - $ref: '#/components/schemas/SAMLPayLoad' + type: object + properties: + cloudEventVersion: + description: The inline hook cloud version + example: 0.1 + type: string + contentType: + description: The inline hook request header content + example: application/JSON + type: string + eventId: + type: string + description: The individual inline hook request ID + example: 3o9jBzq1SmOGmmsDsqyyeQ + eventTime: + type: string + description: The time the inline hook request was sent + example: '2020-01-17T21:23:56.000Z' + eventTypeVersion: + description: The inline hook version + example: 1 + type: string + data: + type: object + properties: + context: + description: This object contains a number of sub-objects, each of which provide some type of contextual information. + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + request: + $ref: '#/components/schemas/InlineHookRequestObject' + session: + description: Details of the user session + type: object + properties: + id: + description: The unique identifier for the user's session + type: string + example: 102LN9Bnuc4S_ewfc9BYwageA + userId: + description: The unique identifier for the user + type: string + example: 00uq8tMo3zV0OfJON0g3 + login: + description: The username used to identify the user. This is often the user's email address. + type: string + example: user@example.com + createdAt: + description: Timestamp of when the session was created + type: string + format: date-time + example: '2019-03-28T16:45:55.000Z' + expiresAt: + description: Timestamp of when the session expires + type: string + format: date-time + example: '2019-03-28T21:15:23.000Z' + status: + description: Represents the current status of the user's session + type: string + example: ACTIVE + lastPasswordVerification: + description: Timestamp of when the user was last authenticated + type: string + format: date-time + example: '2019-03-28T16:45:55.000Z' + amr: + description: The authentication method reference + type: array + items: + type: string + example: + - PASSWORD + idp: + $ref: '#/components/schemas/SessionIdentityProvider' + mfaActive: + description: Describes whether multifactor authentication was enabled + type: boolean + example: false + user: + description: Identifies the Okta user that the token was generated to authenticate and provides details of their Okta user profile + type: object + properties: + id: + description: The unique identifier for the user + type: string + example: 00uq8tMo3zV0OfJON0g3 + passwordChanged: + description: The timestamp when the user's password was last updated + type: string + format: date-time + example: '2018-09-11T23:19:12.000Z' + profile: + type: object + properties: + login: + description: The username used to identify the user. This is often the user's email address. + type: string + example: user@example.com + firstName: + description: The first name of the user + type: string + example: John + lastName: + description: The last name of the user + type: string + example: Smith + locale: + description: |- + The user's default location for purposes of localizing items such as currency, date time format, numerical representations, and so on. + A locale value is a concatenation of the [ISO 639-1](https://en.wikipedia.org/wiki/List_of_ISO_639_language_codes) two-letter language code, an underscore, and the [ISO 3166-1](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2) two-letter country code. For example, `en_US` specifies the language English and country US. This value is `en_US` by default. + type: string + example: en_US + timeZone: + description: The user's timezone + type: string + example: America/Los_Angeles + _links: + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status of the user. These links are used to discover what groups the user is a part of and what factors they have enrolled. + type: object + properties: + groups: + description: URL to retrieve the individual user's group memberships + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + factors: + description: URL to retrieve individual user's factor enrollments + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + protocol: + description: Details of the assertion protocol being used + type: object + properties: + type: + description: The type of authentication protocol being used for the assertion + type: string + example: SAML2.0 + issuer: + type: object + properties: + id: + description: The unique identifier of the issuer that provided the SAML assertion + type: string + example: 0oath92zlO60urQOP0g3 + name: + description: The name of the issuer that provided the SAML assertion + type: string + example: SAML 2.0 App + uri: + description: The base URI of the SAML endpoint that's used to assert the authorization + type: string + example: http://www.okta.com/exkth8lMzFm0HZOTU0g3 + assertion: + description: Details of the SAML assertion that was generated + type: object + properties: + subject: + description: Provides a JSON representation of the `` element of the SAML assertion + type: object + properties: + nameId: + description: The unique identifier of the user + type: string + example: user@example.com + nameFormat: + description: Indicates how to interpret the attribute name + type: string + example: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified + confirmation: + type: object + properties: + method: + description: Used to indicate how the authorization server confirmed the SAML assertion + type: string + example: urn:oasis:names:tc:SAML:2.0:cm:bearer + data: + type: object + properties: + recipient: + description: The token endpoint URL of the authorization server + type: string + example: http://www.example.com:7070/saml/sso + authentication: + description: Provides a JSON representation of the `` element of the SAML assertion + type: object + properties: + sessionIndex: + description: The unique identifier describing the assertion statement + type: string + example: id1553800523546.312669168 + authnContext: + description: Details of the authentication methods used for the SAML assertion + type: object + properties: + authnContextClassRef: + description: Describes the identity provider's supported authentication context classes + type: string + example: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport + conditions: + description: Provides a JSON representation of the `` element of the SAML assertion + type: object + properties: + audienceRestriction: + description: Describes which service providers the assertion is valid for + type: array + items: + type: string + example: + - urn:example:sp + claims: + description: Provides a JSON representation of the `` element contained in the generated SAML assertion. Contains any optional SAML attribute statements that you have defined for the app using the Admin Console's **SAML Settings**. + type: object + additionalProperties: + type: object + properties: + attributes: + type: object + properties: + NameFormat: + type: string + description: Indicates how to interpret the attribute name + attributeValues: + type: array + items: + type: object + properties: + attributes: + type: object + properties: + xsi:type: + type: string + description: Used to derive the type of the attribute + value: + type: string + description: The actual value of the attribute + lifetime: + description: Specifies the expiration time, in seconds, of the SAML assertion + type: object + properties: + expiration: + description: The expiration time in seconds + type: integer + example: 300 + eventType: + type: string + description: The type of inline hook. The SAML assertion inline hook type is `com.okta.saml.tokens.transform`. + source: + description: The ID and URL of the SAML assertion inline hook + type: string UserImportRequestExecute: description: User import inline hook request - allOf: - - $ref: '#/components/schemas/InlineHookBasePayload' - - $ref: '#/components/schemas/UserImportRequest' + type: object + properties: + cloudEventVersion: + description: The inline hook cloud version + example: 0.1 + type: string + contentType: + description: The inline hook request header content + example: application/JSON + type: string + eventId: + type: string + description: The individual inline hook request ID + example: 3o9jBzq1SmOGmmsDsqyyeQ + eventTime: + type: string + description: The time the inline hook request was sent + example: '2020-01-17T21:23:56.000Z' + eventTypeVersion: + description: The inline hook version + example: 1 + type: string + data: + $ref: '#/components/schemas/UserImportRequestData' + eventType: + type: string + description: The type of inline hook. The user import inline hook type is `com.okta.import.transform`. + source: + description: The ID of the user import inline hook + type: string PasswordImportResponse: description: Password import inline hook response type: object properties: commands: - description: >- - The `commands` object specifies whether Okta accepts the end user's - sign-in credentials as valid or not. For the password import inline - hook, you typically only return one `commands` object with one array - element in it. + description: The `commands` object specifies whether Okta accepts the end user's sign-in credentials as valid or not. For the password import inline hook, you typically only return one `commands` object with one array element in it. type: array items: type: object properties: type: - description: >- - The location where you specify the command. For the password - import inline hook, there's only one command, - `com.okta.action.update`. + description: The location where you specify the command. For the password import inline hook, there's only one command, `com.okta.action.update`. value: - description: >- + description: |- The parameter value of the command. - - * To indicate that the supplied credentials are valid, supply - a type property set to `com.okta.action.update` together with - a value property set to `{"credential": "VERIFIED"}`. - - * To indicate that the supplied credentials are invalid, - supply a type property set to `com.okta.action.update` - together with a value property set to `{"credential": - "UNVERIFIED"}`. - - Alternatively, you can send an empty response (`204`). By - default, the `data.action.credential` is always set to - `UNVERIFIED`. + * To indicate that the supplied credentials are valid, supply a type property set to `com.okta.action.update` together with a value property set to `{"credential": "VERIFIED"}`. + * To indicate that the supplied credentials are invalid, supply a type property set to `com.okta.action.update` together with a value property set to `{"credential": "UNVERIFIED"}`. + Alternatively, you can send an empty response (`204`). By default, the `data.action.credential` is always set to `UNVERIFIED`. type: object properties: credential: @@ -662,26 +1254,16 @@ components: type: object properties: commands: - description: >- - The `commands` object specifies whether Okta accepts the end user's - sign-in credentials as valid or not. For the telephony inline hook, - you typically only return one `commands` object with one array - element in it. + description: The `commands` object specifies whether Okta accepts the end user's sign-in credentials as valid or not. For the telephony inline hook, you typically only return one `commands` object with one array element in it. type: array items: type: object properties: type: - description: >- - The location where you specify the command. For the telephony - inline hook, there's only one command, - `com.okta.telephony.action`. + description: The location where you specify the command. For the telephony inline hook, there's only one command, `com.okta.telephony.action`. type: string value: - description: >- - The status of the telephony operation along with optional - additional information about the provider, transaction ID and - any other transaction metadata. + description: The status of the telephony operation along with optional additional information about the provider, transaction ID and any other transaction metadata. type: array items: type: object @@ -694,15 +1276,9 @@ components: - PENDING - FAILED x-enumDescriptions: - SUCCESSFUL: >- - External web service was able to deliver the OTP to - the Requester. - PENDING: >- - External web service wasn't able to confirm delivery - of the OTP to the Requester. - FAILED: >- - External web service was unable to deliver the OTP to - the Requester. + SUCCESSFUL: External web service was able to deliver the OTP to the Requester. + PENDING: External web service wasn't able to confirm delivery of the OTP to the Requester. + FAILED: External web service was unable to deliver the OTP to the Requester. provider: type: string description: Telephony provider for sms/voice @@ -714,67 +1290,46 @@ components: description: Any relevant metadata for the telephony transaction RegistrationInlineHookResponse: description: Registration inline hook response + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: commands: type: array TokenHookResponse: - description: >- - For the token inline hook, the `commands` and `error` objects that you - can return in the JSON payload of your response are defined in the - following sections. - + x-okta-ignore-redocly-rules-for-sdk: true + description: |- + For the token inline hook, the `commands` and `error` objects that you can return in the JSON payload of your response are defined in the following sections. > **Note:** The size of your response payload must be less than 256 KB. type: object properties: commands: - description: >- - You can use the `commands` object to provide commands to Okta. It's - where you can tell Okta to add more claims to the token. - - The `commands` object is an array, allowing you to send multiple - commands. In each array element, there needs to be a `type` property - and `value` property. The `type` property is where you specify which - of the supported commands you want to execute, and `value` is where - you supply an operand for that command. - - In the case of the token hook type, the `value` property is itself a - nested object in which you specify a particular operation, a path to - act on, and a value. + description: |- + You can use the `commands` object to provide commands to Okta. It's where you can tell Okta to add more claims to the token. + The `commands` object is an array, allowing you to send multiple commands. In each array element, there needs to be a `type` property and `value` property. The `type` property is where you specify which of the supported commands you want to execute, and `value` is where you supply an operand for that command. + In the case of the token hook type, the `value` property is itself a nested object in which you specify a particular operation, a path to act on, and a value. type: array items: type: object properties: type: - description: >- + description: |- One of the supported commands: `com.okta.identity.patch`: Modify an ID token `com.okta.access.patch`: Modify an access token - > **Note:** The `commands` array should only contain commands - that can be applied to the requested tokens. For example, if - only an ID token is requested, the `commands` array shouldn't - contain commands of the type `com.okta.access.patch`. + > **Note:** The `commands` array should only contain commands that can be applied to the requested tokens. For example, if only an ID token is requested, the `commands` array shouldn't contain commands of the type `com.okta.access.patch`. type: string value: - description: >- - The `value` object is where you specify the operation to - perform. It's an array, which allows you to request more than - one operation. + description: The `value` object is where you specify the operation to perform. It's an array, which allows you to request more than one operation. type: array items: type: object properties: op: - description: >- - The name of one of the supported ops: `add`: Add a - claim. `replace`: Modify an existing claim and update - the token lifetime. `remove`: Remove an existing claim. - + description: |- + The name of one of the supported ops: `add`: Add a claim. `replace`: Modify an existing claim and update the token lifetime. `remove`: Remove an existing claim. #### `op: add` notes -
- Add a claim Add a claim @@ -829,11 +1384,8 @@ components: > **Note:** If you use the `add` operation and include an existing claim in your response with a different value, that value is replaced. Use the `replace` operation instead. If you attempt to remove a system-specific claim or use an invalid operation, the entire PATCH fails and errors are logged in the token hooks events. See `op: replace` notes.
-
- - Add new members to existing JSON - objects + Add new members to existing JSON objects If you have a JSON object in a claim called `employee_profile`, and you want to add the `department_id` member to the claim, the existing JSON is updated by specifying the claim in the path, followed by the name of the object member. @@ -882,9 +1434,7 @@ components: > **Note:** If you attempt to add a member within a JSON object that doesn't exist or using an invalid operation, the entire PATCH fails and errors are logged in the token hooks events.
-
- Add new elements to existing arrays Append an element to an array by specifying the name of the array, followed by the index where you want to insert the element in the path. Alternatively, you can specify the array name followed by a hyphen (-) in the path to append an element at the end of the array. For example, you have an array that contains the user's preferred airports, and you want to add a new airport to the array. The existing target JSON object is updated by specifying the claim in the path, followed by the index of where to insert the claim. @@ -936,21 +1486,18 @@ components: > **Note:** If you attempt to add an element within an array that doesn't exist or specify an invalid index, the entire PATCH fails and errors are logged in the token hooks events.
- #### `op: replace` notes -
- Modify an existing claim You can modify (`replace`) existing custom claims or OIDC standard profile claims, such as `birthdate` and `locale`. You can't, however, modify any system-specific claims, such as `iss` or `ver`. Also, you can't modify a claim that isn't currently part of the token in the request payload. Attempting to modify a system-specific claim or using an invalid operation results in the entire PATCH failing and errors logged in the token hooks events. - See [Access Tokens Scopes and Claims](/openapi/okta-oauth/guides/overview/#access-token-scopes-and-claims) for the list of access token-reserved claims that you can't modify. + See [Access Tokens Scopes and Claims](https://developer.okta.com/docs/api/openapi/okta-oauth/guides/overview/#access-token-scopes-and-claims) for the list of access token-reserved claims that you can't modify. > **Note:** Although the `aud` and `sub` claims are listed as reserved claims, you can modify those claims in access tokens. You can't modify these claims in ID tokens. - See [ID Token Claims](/openapi/okta-oauth/guides/overview/#id-token-claims) for a list of ID token-reserved claims that you can't modify. + See [ID Token Claims](https://developer.okta.com/docs/api/openapi/okta-oauth/guides/overview/#id-token-claims) for a list of ID token-reserved claims that you can't modify. **Existing target JSON object** @@ -998,11 +1545,8 @@ components:
-
- - Modify members within existing JSON objects and - arrays + Modify members within existing JSON objects and arrays Use the `replace` operation to modify members within JSON objects and elements within arrays. For example, you have a JSON object in a claim called `employee_profile`, and you want to update the email address of the employee. The existing target JSON object is updated by specifying the claim in the path, followed by the name of the object member that you want to modify. @@ -1054,9 +1598,7 @@ components: Similarly, you can replace elements in an array by specifying the array name and the valid index of the element that you want to replace in the path.
-
- Modify token lifetimes You can modify how long the access and ID tokens are valid by specifying the `lifetime` in seconds. The `lifetime` value must be a minimum of five minutes (300 seconds) and a maximum of 24 hours (86,400 seconds). @@ -1091,19 +1633,16 @@ components:
- #### `op: remove` notes -
- Remove a claim You can remove existing custom claims or OIDC standard profile claims, such as `birthdate` or `locale`. You can't, however, remove any system-specific claims, such as `iss` or `ver`. You also can't remove a claim that isn't currently part of the token in the request payload. If you attempt to remove a system-specific claim or use an invalid operation, the entire PATCH fails and errors are logged in the token hooks events. - See [Access Tokens Scopes and Claims](/openapi/okta-oauth/guides/overview/#access-token-scopes-and-claims) for the list of access token-reserved claims that you can't modify. + See [Access Tokens Scopes and Claims](https://developer.okta.com/docs/api/openapi/okta-oauth/guides/overview/#access-token-scopes-and-claims) for the list of access token-reserved claims that you can't modify. - See [ID Token Claims](/openapi/okta-oauth/guides/overview/#id-token-claims) for a list of ID token-reserved claims that you can't modify. + See [ID Token Claims](https://developer.okta.com/docs/api/openapi/okta-oauth/guides/overview/#id-token-claims) for a list of ID token-reserved claims that you can't modify. **Operation** @@ -1137,9 +1676,7 @@ components:
-
- Remove members from existing arrays Use the `remove` operation to remove members from existing arrays. For example, you have an array that contains the user's preferred airports, and you want to remove an airport from the array. The existing target JSON object is updated by specifying the array name followed by the index of the element that you want to remove. You don't need to specify a value for the remove operation, but you can specify `null` as the value if you want. @@ -1189,19 +1726,14 @@ components:
-
- - Remove members from existing JSON - objects + Remove members from existing JSON objects Use the `remove` operation to remove members from existing JSON objects. Do this by specifying the JSON object in the path, followed by the claim member that you would like to remove. For example, you have an `employee_profile` claim, and you want to remove `email` from it. **Existing target JSON object** - ``` - { "employee_profile": { "employee_id":"1234", @@ -1209,15 +1741,11 @@ components: "email":"anna.v@company.com" } } - ``` - **Operation** - ``` - { "commands": [ { @@ -1231,76 +1759,47 @@ components: } ] } - ``` - **Updated JSON** - ``` - { "employee_profile": { "employee_id":"1234", "name":"Anna", } } - ``` -
type: string path: - description: >- - Location within the token to apply the operation, - specified as a slash-delimited path. When you add, - replace, or remove a claim, this path always begins with - `/claims/` and is followed by the name of the new claim - that you're adding. When you replace a token lifetime, - the path should always be `/token/lifetime/expiration`. + description: Location within the token to apply the operation, specified as a slash-delimited path. When you add, replace, or remove a claim, this path always begins with `/claims/` and is followed by the name of the new claim that you're adding. When you replace a token lifetime, the path should always be `/token/lifetime/expiration`. type: string value: description: Value to set the claim to. oneOf: - type: string - type: integer - - type: object + - type: string + description: (opaque JSON object) error: - description: >- - When an error object is returned, it causes Okta to return an OAuth - 2.0 error to the requester of the token. In the error response, the - value of `error` is `server_error`, and the value of - `error_description` is the string that you supplied in the - `errorSummary` property of the `error` object that you returned. + description: When an error object is returned, it causes Okta to return an OAuth 2.0 error to the requester of the token. In the error response, the value of `error` is `server_error`, and the value of `error_description` is the string that you supplied in the `errorSummary` property of the `error` object that you returned. type: object properties: errorSummary: - description: >- - Human-readable summary of the error. If the error object doesn't - include the `errorSummary` property defined, the following - common default message is returned to the end user: `The - callback service returned an error`. + description: 'Human-readable summary of the error. If the error object doesn''t include the `errorSummary` property defined, the following common default message is returned to the end user: `The callback service returned an error`.' type: string SAMLHookResponse: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: commands: - description: >- - The `commands` object is where you tell Okta to add additional - claims to the assertion or to modify the existing assertion - statements. + description: |- + The `commands` object is where you tell Okta to add additional claims to the assertion or to modify the existing assertion statements. - - `commands` is an array, allowing you to send multiple commands. In - each array element, include a `type` property and a `value` - property. The `type` property is where you specify which of the - supported commands you want to execute, and `value` is where you - supply an operand for that command. - - In the case of the SAML assertion inline hook, the `value` property - is itself a nested object, in which you specify a particular - operation, a path to act on, and a value. + `commands` is an array, allowing you to send multiple commands. In each array element, include a `type` property and a `value` property. The `type` property is where you specify which of the supported commands you want to execute, and `value` is where you supply an operand for that command. + In the case of the SAML assertion inline hook, the `value` property is itself a nested object, in which you specify a particular operation, a path to act on, and a value. type: array items: type: object @@ -1327,33 +1826,25 @@ components: oneOf: - type: string - type: integer - - type: object - description: >- - The value of the claim that you add or replace, and can - also include other attributes. If adding to a claim, add - another `value` attribute residing within an array - called `attributeValues`. - + - type: string + description: (opaque JSON object) + description: |- + The value of the claim that you add or replace, and can also include other attributes. If adding to a claim, add another `value` attribute residing within an array called `attributeValues`. See the following examples: - #### Simple value (integer or string) - `"value": 300` or `"value": "replacementString"` - #### Attribute value (object) - ` "value": { "authContextClassRef": "replacementValue" }` #### AttributeValues array value (object) - ` "value": { "attributes": { "NameFormat": "urn:oasis:names:tc:SAML:2.0:attrname-format:basic" @@ -1366,24 +1857,13 @@ components: ] }` error: - description: >- - An object to return an error. Returning an error causes Okta to - record a failure event in the Okta System Log. - - The string supplied in the `errorSummary` property is recorded in - the System Log event. - - > **Note:** If the error object doesn't include the defined - `errorSummary` property, the following common default message + description: |- + An object to return an error. Returning an error causes Okta to record a failure event in the Okta System Log. + The string supplied in the `errorSummary` property is recorded in the System Log event. + > **Note:** If the error object doesn't include the defined `errorSummary` property, the following common default message + is returned to the end user: `The callback service returned an error`. - is returned to the end user: `The callback service returned an - error`. - - - > **Note:** If a response to a SAML inline hook request isn't - received from your external service within three seconds, a timeout - occurs. In this scenario, the Okta SAML inline hook process - continues, and the user is created. + > **Note:** If a response to a SAML inline hook request isn't received from your external service within three seconds, a timeout occurs. In this scenario, the Okta SAML inline hook process continues, and the user is created. type: object properties: errorSummary: @@ -1393,23 +1873,17 @@ components: type: object properties: commands: - description: >- - The `commands` object is where you can provide commands to Okta. It - is an array that allows you to send multiple commands. - + description: |- + The `commands` object is where you can provide commands to Okta. It is an array that allows you to send multiple commands. Each array element needs to consist of a type-value pair. type: array items: type: object properties: type: - description: >- + description: |- The command types supported for the import inline hook. - - When using the `com.okta.action.update` command to specify - that the user should be treated as a match, you need to also - provide a `com.okta.user.update` command that sets the ID of - the Okta user. + When using the `com.okta.action.update` command to specify that the user should be treated as a match, you need to also provide a `com.okta.user.update` command that sets the ID of the Okta user. type: string enum: - com.okta.appUser.profile.update @@ -1419,40 +1893,22 @@ components: x-enumDescriptions: com.okta.appUser.profile.update: Change values of attributes in the user's app user profile com.okta.user.profile.update: Change values of attributes in the user's Okta user profile - com.okta.action.update: >- - Specify whether to create a new Okta user for the user being - imported or treat them as a match of an existing Okta user - com.okta.user.update: >- - Specify the existing Okta user that the imported user should - be treated as a match of. + com.okta.action.update: Specify whether to create a new Okta user for the user being imported or treat them as a match of an existing Okta user + com.okta.user.update: Specify the existing Okta user that the imported user should be treated as a match of. value: - description: >- - The `value` object is the parameter to pass to the command. In - the case of the `com.okta.appUser.profile.update` and - `com.okta.user.profile.update` commands, - - the parameter should be a list of one or more profile - attributes and the values you wish to set them to. In the case - of the `com.okta.action.update` command, - - the parameter should be a `result` property set to either - `CREATE_USER` or `LINK_USER`. + description: |- + The `value` object is the parameter to pass to the command. In the case of the `com.okta.appUser.profile.update` and `com.okta.user.profile.update` commands, + the parameter should be a list of one or more profile attributes and the values you wish to set them to. In the case of the `com.okta.action.update` command, + the parameter should be a `result` property set to either `CREATE_USER` or `LINK_USER`. type: object additionalProperties: type: string error: - description: >- - An object to return an error. Returning an error causes Okta to - record a failure event in the Okta System Log. - - The string supplied in the `errorSummary` property is recorded in - the System Log event. - + description: |- + An object to return an error. Returning an error causes Okta to record a failure event in the Okta System Log. + The string supplied in the `errorSummary` property is recorded in the System Log event. - >**Note:** If a response to an import inline hook request is not - received from your external service within three seconds, a timeout - occurs. In this scenario, the Okta import process continues and the - user is created. + >**Note:** If a response to an import inline hook request is not received from your external service within three seconds, a timeout occurs. In this scenario, the Okta import process continues and the user is created. type: object properties: errorSummary: @@ -1465,9 +1921,7 @@ components: $ref: '#/components/schemas/InlineHookChannelType' version: type: string - description: >- - Version of the inline hook type. The currently supported version is - `1.0.0`. + description: Version of the inline hook type. The currently supported version is `1.0.0`. discriminator: propertyName: type mapping: @@ -1489,26 +1943,121 @@ components: - com.okta.user.credential.password.import - com.okta.user.pre-registration InlineHookLinks: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - type: object + x-okta-ignore-redocly-rules-for-sdk: true + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + activate: + description: URL to activate the inline hook + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object properties: - activate: - description: URL to activate the inline hook - allOf: - - $ref: '#/components/schemas/HrefObject' - deactivate: - description: URL to deactivate the inline hook - allOf: - - $ref: '#/components/schemas/HrefObject' - delete: - description: URL to delete the inline hook - allOf: - - $ref: '#/components/schemas/HrefObject' - execute: - description: URL to test the inline hook - allOf: - - $ref: '#/components/schemas/HrefObject' + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + deactivate: + description: URL to deactivate the inline hook + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + delete: + description: URL to delete the inline hook + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + execute: + description: URL to test the inline hook + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + readOnly: true Error: title: Error type: object @@ -1522,18 +2071,13 @@ components: description: An Okta code for this type of error errorId: type: string - description: >- - A unique identifier for this error. This can be used by Okta Support - to help with troubleshooting. + description: A unique identifier for this error. This can be used by Okta Support to help with troubleshooting. errorLink: type: string description: An Okta code for this type of error errorSummary: type: string - description: >- - A short description of what caused this error. Sometimes this - contains dynamically-generated information about your specific - error. + description: A short description of what caused this error. Sometimes this contains dynamically-generated information about your specific error. InlineHookChannelCreate: type: object properties: @@ -1541,27 +2085,74 @@ components: $ref: '#/components/schemas/InlineHookChannelType' version: type: string - description: >- - Version of the inline hook type. The currently supported version is - `1.0.0`. + description: Version of the inline hook type. The currently supported version is `1.0.0`. discriminator: propertyName: type mapping: HTTP: '#/components/schemas/InlineHookChannelHttpCreate' OAUTH: '#/components/schemas/InlineHookChannelOAuthCreate' InlineHookLinksCreate: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - type: object + x-okta-ignore-redocly-rules-for-sdk: true + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + deactivate: + description: URL to deactivate the inline hook + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object properties: - deactivate: - description: URL to deactivate the inline hook - allOf: - - $ref: '#/components/schemas/HrefObject' - execute: - description: URL to test the inline hook - allOf: - - $ref: '#/components/schemas/HrefObject' + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + execute: + description: URL to test the inline hook + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + readOnly: true InlineHookBasePayload: type: object properties: @@ -1592,9 +2183,7 @@ components: $ref: '#/components/schemas/PasswordImportRequestData' eventType: type: string - description: >- - The type of inline hook. The password import inline hook type is - `com.okta.user.credential.password.import`. + description: The type of inline hook. The password import inline hook type is `com.okta.user.credential.password.import`. source: description: The ID and URL of the password import inline hook type: string @@ -1605,127 +2194,279 @@ components: $ref: '#/components/schemas/TelephonyRequestData' eventType: type: string - description: >- - The type of inline hook. The telephony inline hook type is - `com.okta.telephony.provider`. + description: The type of inline hook. The telephony inline hook type is `com.okta.telephony.provider`. requestType: type: string - description: >- - The type of inline hook request. For example, - `com.okta.user.telephony.pre-enrollment`. + description: The type of inline hook request. For example, `com.okta.user.telephony.pre-enrollment`. source: description: The ID and URL of the telephony inline hook type: string RegistrationInlineHookRequestType: - description: >- - The type of registration hook. Use either `self.service.registration` or - `progressive.profile`. + description: The type of registration hook. Use either `self.service.registration` or `progressive.profile`. type: string enum: - progressive.profile - self.service.registration TokenPayLoad: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: data: type: object properties: context: - allOf: - - $ref: '#/components/schemas/BaseContext' - - type: object + description: This object contains a number of sub-objects, each of which provide some type of contextual information. + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + request: + $ref: '#/components/schemas/InlineHookRequestObject' + session: + description: Details of the user session + type: object + properties: + id: + description: The unique identifier for the user's session + type: string + example: 102LN9Bnuc4S_ewfc9BYwageA + userId: + description: The unique identifier for the user + type: string + example: 00uq8tMo3zV0OfJON0g3 + login: + description: The username used to identify the user. This is often the user's email address. + type: string + example: user@example.com + createdAt: + description: Timestamp of when the session was created + type: string + format: date-time + example: '2019-03-28T16:45:55.000Z' + expiresAt: + description: Timestamp of when the session expires + type: string + format: date-time + example: '2019-03-28T21:15:23.000Z' + status: + description: Represents the current status of the user's session + type: string + example: ACTIVE + lastPasswordVerification: + description: Timestamp of when the user was last authenticated + type: string + format: date-time + example: '2019-03-28T16:45:55.000Z' + amr: + description: The authentication method reference + type: array + items: + type: string + example: + - PASSWORD + idp: + $ref: '#/components/schemas/SessionIdentityProvider' + mfaActive: + description: Describes whether multifactor authentication was enabled + type: boolean + example: false + user: + description: Identifies the Okta user that the token was generated to authenticate and provides details of their Okta user profile + type: object properties: - protocol: - description: Details of the authentication protocol + id: + description: The unique identifier for the user + type: string + example: 00uq8tMo3zV0OfJON0g3 + passwordChanged: + description: The timestamp when the user's password was last updated + type: string + format: date-time + example: '2018-09-11T23:19:12.000Z' + profile: type: object properties: - type: - description: The type of authentication protocol used + login: + description: The username used to identify the user. This is often the user's email address. type: string - example: OAUTH2.0 - request: - $ref: '#/components/schemas/TokenProtocolRequest' - OriginalGrant: - description: >- - Information about the original token request used to - get the refresh token being used, when in a refresh - token request - type: object - properties: - request: - $ref: '#/components/schemas/TokenProtocolRequest' - refresh_token: - $ref: '#/components/schemas/RefreshToken' - issuer: - description: The authorization server's issuer identifier + example: user@example.com + firstName: + description: The first name of the user + type: string + example: John + lastName: + description: The last name of the user + type: string + example: Smith + locale: + description: |- + The user's default location for purposes of localizing items such as currency, date time format, numerical representations, and so on. + A locale value is a concatenation of the [ISO 639-1](https://en.wikipedia.org/wiki/List_of_ISO_639_language_codes) two-letter language code, an underscore, and the [ISO 3166-1](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2) two-letter country code. For example, `en_US` specifies the language English and country US. This value is `en_US` by default. + type: string + example: en_US + timeZone: + description: The user's timezone + type: string + example: America/Los_Angeles + _links: + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status of the user. These links are used to discover what groups the user is a part of and what factors they have enrolled. + type: object + properties: + groups: + description: URL to retrieve the individual user's group memberships + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true type: object properties: - uri: - description: The authorization server's issuer identifier + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: type: string - format: uri - client: - description: The client making the token request + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + factors: + description: URL to retrieve individual user's factor enrollments + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true type: object properties: - id: - description: The unique identifier of the client + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: type: string + description: Link URI name: - description: The name of the client type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true type: - description: The type of client type: string - example: PUBLIC - policy: - description: The authorization server policy used to mint the token + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + protocol: + description: Details of the authentication protocol + type: object + properties: + type: + description: The type of authentication protocol used + type: string + example: OAUTH2.0 + request: + $ref: '#/components/schemas/TokenProtocolRequest' + OriginalGrant: + description: Information about the original token request used to get the refresh token being used, when in a refresh token request + type: object + properties: + authorization: + $ref: '#/components/schemas/TokenProtocolRequest' + refresh_token: + $ref: '#/components/schemas/RefreshToken' + issuer: + description: The authorization server's issuer identifier + type: object + properties: + uri: + description: The authorization server's issuer identifier + type: string + format: uri + client: + description: The client making the token request type: object properties: id: - description: The unique identifier for the policy + description: The unique identifier of the client type: string - example: 00p4ktaq2ryOYtsHC0g7 - rule: - description: >- - The authorization server policy rule used to mint - the token - type: object - properties: - id: - description: The unique identifier for the policy rule - type: string - example: 0pr4ktb7elD3ZvrMy0g7 + name: + description: The name of the client + type: string + type: + description: The type of client + type: string + example: PUBLIC + policy: + description: The authorization server policy used to mint the token + type: object + properties: + id: + description: The unique identifier for the policy + type: string + example: 00p4ktaq2ryOYtsHC0g7 + rule: + description: The authorization server policy rule used to mint the token + type: object + properties: + id: + description: The unique identifier for the policy rule + type: string + example: 0pr4ktb7elD3ZvrMy0g7 identity: - allOf: - - description: >- - Provides information on the properties of the ID token that - Okta has generated, including the existing claims that it - contains - - $ref: '#/components/schemas/BaseToken' + description: Provides information on the properties of the ID token that Okta has generated, including the existing claims that it contains + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + claims: + description: Claims included in the token. Consists of name-value pairs for each included claim. For descriptions of the claims that you can include, see the Okta [OpenID Connect and OAuth 2.0 API reference](https://developer.okta.com/docs/api/openapi/okta-oauth/guides/overview/#claims). (opaque JSON object) + type: string + token: + description: The token + type: object + properties: + lifetime: + description: Lifetime of the token + type: object + properties: + expiration: + description: Time in seconds until the token expires + type: integer access: - allOf: - - description: >- - Provides information on the properties of the access token - that Okta has generated, including the existing claims that - it contains - - $ref: '#/components/schemas/BaseToken' - - type: object + description: Provides information on the properties of the access token that Okta has generated, including the existing claims that it contains + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + claims: + description: Claims included in the token. Consists of name-value pairs for each included claim. For descriptions of the claims that you can include, see the Okta [OpenID Connect and OAuth 2.0 API reference](https://developer.okta.com/docs/api/openapi/okta-oauth/guides/overview/#claims). (opaque JSON object) + type: string + token: + description: The token + type: object properties: - scopes: - description: >- - The scopes contained in the token. For descriptions of - the scopes that you can include, see the Okta [OpenID - Connect and OAuth 2.0 API - reference](/openapi/okta-oauth/guides/overview/#scopes). + lifetime: + description: Lifetime of the token type: object + properties: + expiration: + description: Time in seconds until the token expires + type: integer + scopes: + description: The scopes contained in the token. For descriptions of the scopes that you can include, see the Okta [OpenID Connect and OAuth 2.0 API reference](https://developer.okta.com/docs/api/openapi/okta-oauth/guides/overview/#scopes). (opaque JSON object) + type: string refresh_token: $ref: '#/components/schemas/RefreshToken' eventType: type: string - description: >- - The type of inline hook. The token inline hook type is - `com.okta.oauth2.tokens.transform`. + description: The type of inline hook. The token inline hook type is `com.okta.oauth2.tokens.transform`. source: description: The URL of the token inline hook type: string @@ -1736,49 +2477,185 @@ components: type: object properties: context: - allOf: - - $ref: '#/components/schemas/BaseContext' - - type: object + description: This object contains a number of sub-objects, each of which provide some type of contextual information. + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + request: + $ref: '#/components/schemas/InlineHookRequestObject' + session: + description: Details of the user session + type: object + properties: + id: + description: The unique identifier for the user's session + type: string + example: 102LN9Bnuc4S_ewfc9BYwageA + userId: + description: The unique identifier for the user + type: string + example: 00uq8tMo3zV0OfJON0g3 + login: + description: The username used to identify the user. This is often the user's email address. + type: string + example: user@example.com + createdAt: + description: Timestamp of when the session was created + type: string + format: date-time + example: '2019-03-28T16:45:55.000Z' + expiresAt: + description: Timestamp of when the session expires + type: string + format: date-time + example: '2019-03-28T21:15:23.000Z' + status: + description: Represents the current status of the user's session + type: string + example: ACTIVE + lastPasswordVerification: + description: Timestamp of when the user was last authenticated + type: string + format: date-time + example: '2019-03-28T16:45:55.000Z' + amr: + description: The authentication method reference + type: array + items: + type: string + example: + - PASSWORD + idp: + $ref: '#/components/schemas/SessionIdentityProvider' + mfaActive: + description: Describes whether multifactor authentication was enabled + type: boolean + example: false + user: + description: Identifies the Okta user that the token was generated to authenticate and provides details of their Okta user profile + type: object properties: - protocol: - description: Details of the assertion protocol being used + id: + description: The unique identifier for the user + type: string + example: 00uq8tMo3zV0OfJON0g3 + passwordChanged: + description: The timestamp when the user's password was last updated + type: string + format: date-time + example: '2018-09-11T23:19:12.000Z' + profile: type: object properties: - type: - description: >- - The type of authentication protocol being used for - the assertion + login: + description: The username used to identify the user. This is often the user's email address. + type: string + example: user@example.com + firstName: + description: The first name of the user type: string - example: SAML2.0 - issuer: + example: John + lastName: + description: The last name of the user + type: string + example: Smith + locale: + description: |- + The user's default location for purposes of localizing items such as currency, date time format, numerical representations, and so on. + A locale value is a concatenation of the [ISO 639-1](https://en.wikipedia.org/wiki/List_of_ISO_639_language_codes) two-letter language code, an underscore, and the [ISO 3166-1](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2) two-letter country code. For example, `en_US` specifies the language English and country US. This value is `en_US` by default. + type: string + example: en_US + timeZone: + description: The user's timezone + type: string + example: America/Los_Angeles + _links: + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status of the user. These links are used to discover what groups the user is a part of and what factors they have enrolled. + type: object + properties: + groups: + description: URL to retrieve the individual user's group memberships + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + factors: + description: URL to retrieve individual user's factor enrollments + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true type: object properties: - id: - description: >- - The unique identifier of the issuer that - provided the SAML assertion + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: type: string - example: 0oath92zlO60urQOP0g3 + description: Link URI name: - description: >- - The name of the issuer that provided the SAML - assertion type: string - example: SAML 2.0 App - uri: - description: >- - The base URI of the SAML endpoint that's used to - assert the authorization + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: type: string - example: http://www.okta.com/exkth8lMzFm0HZOTU0g3 + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + protocol: + description: Details of the assertion protocol being used + type: object + properties: + type: + description: The type of authentication protocol being used for the assertion + type: string + example: SAML2.0 + issuer: + type: object + properties: + id: + description: The unique identifier of the issuer that provided the SAML assertion + type: string + example: 0oath92zlO60urQOP0g3 + name: + description: The name of the issuer that provided the SAML assertion + type: string + example: SAML 2.0 App + uri: + description: The base URI of the SAML endpoint that's used to assert the authorization + type: string + example: http://www.okta.com/exkth8lMzFm0HZOTU0g3 assertion: description: Details of the SAML assertion that was generated type: object properties: subject: - description: >- - Provides a JSON representation of the `` - element of the SAML assertion + description: Provides a JSON representation of the `` element of the SAML assertion type: object properties: nameId: @@ -1793,24 +2670,18 @@ components: type: object properties: method: - description: >- - Used to indicate how the authorization server - confirmed the SAML assertion + description: Used to indicate how the authorization server confirmed the SAML assertion type: string example: urn:oasis:names:tc:SAML:2.0:cm:bearer data: type: object properties: recipient: - description: >- - The token endpoint URL of the authorization - server + description: The token endpoint URL of the authorization server type: string example: http://www.example.com:7070/saml/sso authentication: - description: >- - Provides a JSON representation of the - `` element of the SAML assertion + description: Provides a JSON representation of the `` element of the SAML assertion type: object properties: sessionIndex: @@ -1818,40 +2689,26 @@ components: type: string example: id1553800523546.312669168 authnContext: - description: >- - Details of the authentication methods used for the SAML - assertion + description: Details of the authentication methods used for the SAML assertion type: object properties: authnContextClassRef: - description: >- - Describes the identity provider's supported - authentication context classes + description: Describes the identity provider's supported authentication context classes type: string - example: >- - urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport + example: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport conditions: - description: >- - Provides a JSON representation of the `` - element of the SAML assertion + description: Provides a JSON representation of the `` element of the SAML assertion type: object properties: audienceRestriction: - description: >- - Describes which service providers the assertion is valid - for + description: Describes which service providers the assertion is valid for type: array items: type: string example: - urn:example:sp claims: - description: >- - Provides a JSON representation of the - `` element contained in the - generated SAML assertion. Contains any optional SAML - attribute statements that you have defined for the app using - the Admin Console's **SAML Settings**. + description: Provides a JSON representation of the `` element contained in the generated SAML assertion. Contains any optional SAML attribute statements that you have defined for the app using the Admin Console's **SAML Settings**. type: object additionalProperties: type: object @@ -1877,9 +2734,7 @@ components: type: string description: The actual value of the attribute lifetime: - description: >- - Specifies the expiration time, in seconds, of the SAML - assertion + description: Specifies the expiration time, in seconds, of the SAML assertion type: object properties: expiration: @@ -1888,9 +2743,7 @@ components: example: 300 eventType: type: string - description: >- - The type of inline hook. The SAML assertion inline hook type is - `com.okta.saml.tokens.transform`. + description: The type of inline hook. The SAML assertion inline hook type is `com.okta.saml.tokens.transform`. source: description: The ID and URL of the SAML assertion inline hook type: string @@ -1901,9 +2754,7 @@ components: $ref: '#/components/schemas/UserImportRequestData' eventType: type: string - description: >- - The type of inline hook. The user import inline hook type is - `com.okta.import.transform`. + description: The type of inline hook. The user import inline hook type is `com.okta.import.transform`. source: description: The ID of the user import inline hook type: string @@ -1913,19 +2764,14 @@ components: - HTTP - OAUTH LinksSelf: - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the - [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. This object is used for dynamic discovery of related - resources and lifecycle operations. + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. type: object properties: self: $ref: '#/components/schemas/HrefObjectSelfLink' readOnly: true HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object additionalProperties: true type: object @@ -1942,15 +2788,11 @@ components: readOnly: true templated: type: boolean - description: >- - Indicates whether the link object's `href` property is a URI - template. + description: Indicates whether the link object's `href` property is a URI template. readOnly: true type: type: string - description: >- - The media type of the link. If omitted, it is implicitly - `application/json`. + description: The media type of the link. If omitted, it is implicitly `application/json`. readOnly: true required: - href @@ -1964,16 +2806,10 @@ components: properties: action: type: object - description: >- - This object specifies the default action Okta is set to take. Okta - takes this action if your external service sends an empty HTTP 204 - response. You can override the default action by returning a - commands object in your response specifying the action to take. + description: This object specifies the default action Okta is set to take. Okta takes this action if your external service sends an empty HTTP 204 response. You can override the default action by returning a commands object in your response specifying the action to take. properties: credential: - description: >- - The status of the user credential, either `UNVERIFIED` or - `VERIFIED` + description: The status of the user credential, either `UNVERIFIED` or `VERIFIED` default: UNVERIFIED type: string context: @@ -1985,14 +2821,10 @@ components: type: object properties: username: - description: >- - The `username` that the user supplied when attempting to - sign in to Okta. + description: The `username` that the user supplied when attempting to sign in to Okta. type: string password: - description: >- - The `password` that the user supplied when attempting to - sign in to Okta. + description: The `password` that the user supplied when attempting to sign in to Okta. type: string TelephonyRequestData: type: object @@ -2004,9 +2836,7 @@ components: $ref: '#/components/schemas/InlineHookRequestObject' messageProfile: type: object - description: >- - Message profile specifies information about the telephony - (sms/voice) message to be sent to the Okta user + description: Message profile specifies information about the telephony (sms/voice) message to be sent to the Okta user properties: msgTemplate: description: Default or Okta org configured sms or voice message template @@ -2043,9 +2873,8 @@ components: description: The user's Okta user ID type: string BaseContext: - description: >- - This object contains a number of sub-objects, each of which provide some - type of contextual information. + description: This object contains a number of sub-objects, each of which provide some type of contextual information. + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: request: @@ -2063,9 +2892,7 @@ components: type: string example: 00uq8tMo3zV0OfJON0g3 login: - description: >- - The username used to identify the user. This is often the user's - email address. + description: The username used to identify the user. This is often the user's email address. type: string example: user@example.com createdAt: @@ -2101,9 +2928,7 @@ components: type: boolean example: false user: - description: >- - Identifies the Okta user that the token was generated to - authenticate and provides details of their Okta user profile + description: Identifies the Okta user that the token was generated to authenticate and provides details of their Okta user profile type: object properties: id: @@ -2119,9 +2944,7 @@ components: type: object properties: login: - description: >- - The username used to identify the user. This is often the - user's email address. + description: The username used to identify the user. This is often the user's email address. type: string example: user@example.com firstName: @@ -2133,18 +2956,9 @@ components: type: string example: Smith locale: - description: >- - The user's default location for purposes of localizing items - such as currency, date time format, numerical - representations, and so on. - - A locale value is a concatenation of the [ISO - 639-1](https://en.wikipedia.org/wiki/List_of_ISO_639_language_codes) - two-letter language code, an underscore, and the [ISO - 3166-1](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2) - two-letter country code. For example, `en_US` specifies the - language English and country US. This value is `en_US` by - default. + description: |- + The user's default location for purposes of localizing items such as currency, date time format, numerical representations, and so on. + A locale value is a concatenation of the [ISO 639-1](https://en.wikipedia.org/wiki/List_of_ISO_639_language_codes) two-letter language code, an underscore, and the [ISO 3166-1](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2) two-letter country code. For example, `en_US` specifies the language English and country US. This value is `en_US` by default. type: string example: en_US timeZone: @@ -2152,22 +2966,63 @@ components: type: string example: America/Los_Angeles _links: - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for - the current status of the user. These links are used to discover - what groups the user is a part of and what factors they have - enrolled. + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status of the user. These links are used to discover what groups the user is a part of and what factors they have enrolled. type: object properties: groups: description: URL to retrieve the individual user's group memberships - allOf: - - $ref: '#/components/schemas/HrefObject' + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href factors: description: URL to retrieve individual user's factor enrollments - allOf: - - $ref: '#/components/schemas/HrefObject' + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href TokenProtocolRequest: description: Details of the token request type: object @@ -2210,15 +3065,12 @@ components: description: The refresh token ID type: string BaseToken: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: claims: - description: >- - Claims included in the token. Consists of name-value pairs for each - included claim. For descriptions of the claims that you can include, - see the Okta [OpenID Connect and OAuth 2.0 API - reference](/openapi/okta-oauth/guides/overview/#claims). - type: object + description: Claims included in the token. Consists of name-value pairs for each included claim. For descriptions of the claims that you can include, see the Okta [OpenID Connect and OAuth 2.0 API reference](https://developer.okta.com/docs/api/openapi/okta-oauth/guides/overview/#claims). (opaque JSON object) + type: string token: description: The token type: object @@ -2238,39 +3090,26 @@ components: description: The object that specifies the default action Okta is set to take properties: result: - description: >- - The current default action that results when Okta imports a - user. The two possible values are `CREATE_USER` and `LINK_USER`. - You - - can change the action that is taken by means of the commands - object you return. + description: |- + The current default action that results when Okta imports a user. The two possible values are `CREATE_USER` and `LINK_USER`. You + can change the action that is taken by means of the commands object you return. type: string enum: - CREATE_USER - LINK_USER x-enumDescriptions: CREATE_USER: A new Okta user profile is created for the user - LINK_USER: >- - The user is treated as a match for the existing Okta user - identified by the value of `data.user.id` + LINK_USER: The user is treated as a match for the existing Okta user identified by the value of `data.user.id` appUser: type: object description: The app user profile being imported properties: profile: type: object - description: >- - Provides the name-value pairs of the attributes contained in the - app user profile of the user who is being imported. You can - change - - the values of attributes in the user's app profile by means of - the `commands` object you return. If you change attributes in - the app - - profile, they then flow through to the Okta user profile, based - on matching and mapping rules. + description: |- + Provides the name-value pairs of the attributes contained in the app user profile of the user who is being imported. You can change + the values of attributes in the user's app profile by means of the `commands` object you return. If you change attributes in the app + profile, they then flow through to the Okta user profile, based on matching and mapping rules. additionalProperties: type: string context: @@ -2313,9 +3152,7 @@ components: description: The type of import job matches: type: array - description: >- - The list of Okta users currently matched to the app user based - on import matching. There can be more than one match. + description: The list of Okta users currently matched to the app user based on import matching. There can be more than one match. items: additionalProperties: true type: string @@ -2327,31 +3164,46 @@ components: type: string user: type: object - description: >- - Provides information on the Okta user profile currently set to be - used for the user who is being imported, based on the matching - + description: |- + Provides information on the Okta user profile currently set to be used for the user who is being imported, based on the matching rules and attribute mappings that were applied. properties: profile: - description: >- - The `data.user.profile` contains the name-value pairs of the - attributes in the user profile. If the user has been matched to - an existing - - Okta user, a `data.user.id` object is included, containing the - unique identifier of the Okta user profile. - + description: |- + The `data.user.profile` contains the name-value pairs of the attributes in the user profile. If the user has been matched to an existing + Okta user, a `data.user.id` object is included, containing the unique identifier of the Okta user profile. - You can change the values of the attributes by means of the - `commands` object you return. + You can change the values of the attributes by means of the `commands` object you return. type: object additionalProperties: type: string HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) HrefHints: description: Describes allowed HTTP verbs for the `href` type: object @@ -2386,15 +3238,11 @@ components: id: type: string readOnly: true - description: >- - Identity Provider ID. If the `type` is `OKTA`, then the `id` is the - org ID. + description: Identity Provider ID. If the `type` is `OKTA`, then the `id` is the org ID. type: $ref: '#/components/schemas/SessionIdentityProviderType' GrantType: - description: >- - Determines the mechanism Okta uses to authorize the creation of the - tokens. + description: Determines the mechanism Okta uses to authorize the creation of the tokens. type: string enum: - authorization_code @@ -2427,6 +3275,13 @@ components: - LDAP - OKTA - SOCIAL + ListInlineHooksResponse: + type: object + properties: + inline_hooks: + type: array + items: + $ref: '#/components/schemas/InlineHook' responses: ErrorAccessDenied403: description: Forbidden @@ -2509,17 +3364,14 @@ components: lastUpdated: '2024-09-05T16:06:09.000Z' _links: activate: - href: >- - https://subdomain.okta.com/api/v1/inlineHooks/calb7gacafgwgE7hc5e4/lifecycle/activate + href: https://subdomain.okta.com/api/v1/inlineHooks/calb7gacafgwgE7hc5e4/lifecycle/activate hints: allow: - POST self: - href: >- - https://subdomain.okta.com/api/v1/inlineHooks/calb7gacafgwgE7hc5e4 + href: https://subdomain.okta.com/api/v1/inlineHooks/calb7gacafgwgE7hc5e4 delete: - href: >- - https://subdomain.okta.com/api/v1/inlineHooks/calb7gacafgwgE7hc5e4 + href: https://subdomain.okta.com/api/v1/inlineHooks/calb7gacafgwgE7hc5e4 hints: allow: - DELETE @@ -2544,17 +3396,14 @@ components: lastUpdated: '2024-09-05T16:06:09.000Z' _links: self: - href: >- - https://subdomain.okta.com/api/v1/inlineHooks/calj4fythrqj5Bxol5e5 + href: https://subdomain.okta.com/api/v1/inlineHooks/calj4fythrqj5Bxol5e5 execute: - href: >- - https://subdomain.okta.com/api/v1/inlineHooks/calj4fythrqj5Bxol5e5/execute + href: https://subdomain.okta.com/api/v1/inlineHooks/calj4fythrqj5Bxol5e5/execute hints: allow: - POST deactivate: - href: >- - https://subdomain.okta.com/api/v1/inlineHooks/calj4fythrqj5Bxol5e5/lifecycle/activate + href: https://subdomain.okta.com/api/v1/inlineHooks/calj4fythrqj5Bxol5e5/lifecycle/activate hints: allow: - POST @@ -2580,17 +3429,14 @@ components: lastUpdated: '2024-09-05T16:06:09.000Z' _links: self: - href: >- - https://subdomain.okta.com/api/v1/inlineHooks/calj4fythrqj5Bxol4ai6 + href: https://subdomain.okta.com/api/v1/inlineHooks/calj4fythrqj5Bxol4ai6 execute: - href: >- - https://subdomain.okta.com/api/v1/inlineHooks/calj4fythrqj5Bxol4ai6/execute + href: https://subdomain.okta.com/api/v1/inlineHooks/calj4fythrqj5Bxol4ai6/execute hints: allow: - POST deactivate: - href: >- - https://subdomain.okta.com/api/v1/inlineHooks/calj4fythrqj5Bxol4ai6/lifecycle/activate + href: https://subdomain.okta.com/api/v1/inlineHooks/calj4fythrqj5Bxol4ai6/lifecycle/activate hints: allow: - POST @@ -2671,8 +3517,7 @@ components: lastUpdated: '2024-09-05T16:06:09.000Z' _links: activate: - href: >- - https://subdomain.okta.com/api/v1/inlineHooks/calb7gacafgwgE7hc5e4/lifecycle/activate + href: https://subdomain.okta.com/api/v1/inlineHooks/calb7gacafgwgE7hc5e4/lifecycle/activate hints: allow: - POST @@ -2709,14 +3554,12 @@ components: self: href: https://subdomain.okta.com/api/v1/inlineHooks/calj4fythrqj5Bxol5e5 execute: - href: >- - https://subdomain.okta.com/api/v1/inlineHooks/calj4fythrqj5Bxol5e5/execute + href: https://subdomain.okta.com/api/v1/inlineHooks/calj4fythrqj5Bxol5e5/execute hints: allow: - POST deactivate: - href: >- - https://subdomain.okta.com/api/v1/inlineHooks/calj4fythrqj5Bxol5e5/lifecycle/activate + href: https://subdomain.okta.com/api/v1/inlineHooks/calj4fythrqj5Bxol5e5/lifecycle/activate hints: allow: - POST @@ -2745,17 +3588,14 @@ components: lastUpdated: '2024-09-05T16:06:09.000Z' _links: self: - href: >- - https://subdomain.okta.com/api/v1/inlineHooks/calj4fythrqj5Bxol4ai6 + href: https://subdomain.okta.com/api/v1/inlineHooks/calj4fythrqj5Bxol4ai6 execute: - href: >- - https://subdomain.okta.com/api/v1/inlineHooks/calj4fythrqj5Bxol4ai6/execute + href: https://subdomain.okta.com/api/v1/inlineHooks/calj4fythrqj5Bxol4ai6/execute hints: allow: - POST deactivate: - href: >- - https://subdomain.okta.com/api/v1/inlineHooks/calj4fythrqj5Bxol4ai6/lifecycle/activate + href: https://subdomain.okta.com/api/v1/inlineHooks/calj4fythrqj5Bxol4ai6/lifecycle/activate hints: allow: - POST @@ -2781,8 +3621,7 @@ components: lastUpdated: '2024-09-05T16:06:09.000Z' _links: activate: - href: >- - https://subdomain.okta.com/api/v1/inlineHooks/calb7gacafgwgE7hc5e4/lifecycle/activate + href: https://subdomain.okta.com/api/v1/inlineHooks/calb7gacafgwgE7hc5e4/lifecycle/activate hints: allow: - POST @@ -2819,14 +3658,12 @@ components: self: href: https://subdomain.okta.com/api/v1/inlineHooks/calj4fythrqj5Bxol5e5 execute: - href: >- - https://subdomain.okta.com/api/v1/inlineHooks/calj4fythrqj5Bxol5e5/execute + href: https://subdomain.okta.com/api/v1/inlineHooks/calj4fythrqj5Bxol5e5/execute hints: allow: - POST deactivate: - href: >- - https://subdomain.okta.com/api/v1/inlineHooks/calj4fythrqj5Bxol5e5/lifecycle/activate + href: https://subdomain.okta.com/api/v1/inlineHooks/calj4fythrqj5Bxol5e5/lifecycle/activate hints: allow: - POST @@ -2855,17 +3692,14 @@ components: lastUpdated: '2024-09-05T16:06:09.000Z' _links: self: - href: >- - https://subdomain.okta.com/api/v1/inlineHooks/calj4fythrqj5Bxol4ai6 + href: https://subdomain.okta.com/api/v1/inlineHooks/calj4fythrqj5Bxol4ai6 execute: - href: >- - https://subdomain.okta.com/api/v1/inlineHooks/calj4fythrqj5Bxol4ai6/execute + href: https://subdomain.okta.com/api/v1/inlineHooks/calj4fythrqj5Bxol4ai6/execute hints: allow: - POST deactivate: - href: >- - https://subdomain.okta.com/api/v1/inlineHooks/calj4fythrqj5Bxol4ai6/lifecycle/activate + href: https://subdomain.okta.com/api/v1/inlineHooks/calj4fythrqj5Bxol4ai6/lifecycle/activate hints: allow: - POST @@ -2908,8 +3742,7 @@ components: lastUpdated: '2024-09-05T16:06:09.000Z' _links: activate: - href: >- - https://subdomain.okta.com/api/v1/inlineHooks/calb7gacafgwgE7hc5e4/lifecycle/activate + href: https://subdomain.okta.com/api/v1/inlineHooks/calb7gacafgwgE7hc5e4/lifecycle/activate hints: allow: - POST @@ -2960,8 +3793,7 @@ components: id: reqRgSk8IBBRhuo0YdlEDTmUw method: POST url: - value: >- - /api/internal/v1/inlineHooks/com.okta.telephony.provider/generatePreview + value: /api/internal/v1/inlineHooks/com.okta.telephony.provider/generatePreview ipAddress: 127.0.0.1 userProfile: firstName: test @@ -2976,9 +3808,7 @@ components: otpCode: 11111 locale: EN-US ProfileEnrollmentRequest: - summary: >- - An example registration hook profile enrollment (SSR) inline hook - request body + summary: An example registration hook profile enrollment (SSR) inline hook request body value: eventId: 04Dmt8BcT_aEgM eventTime: '2022-04-25T17:35:27.000Z' @@ -3019,8 +3849,7 @@ components: id: reqv66CbCaCStGEFc8AdfS0ng method: GET url: - value: >- - https://{yourOktaDomain}/oauth2/default/v1/authorize?scope=openid+profile+email&response_type=token+id_token&redirect_uri=https%3A%2F%2Fhttpbin.org%2Fget&state=state&nonce=asf&client_id=customClientIdNative + value: https://{yourOktaDomain}/oauth2/default/v1/authorize?scope=openid+profile+email&response_type=token+id_token&redirect_uri=https%3A%2F%2Fhttpbin.org%2Fget&state=state&nonce=asf&client_id=customClientIdNative ipAddress: 127.0.0.1 protocol: type: OAUTH2.0 @@ -3064,8 +3893,7 @@ components: groups: href: https://{yourOktaDomain}/00uq8tMo3zV0OfJON0g3/groups factors: - href: >- - https://{yourOktaDomain}/api/v1/users/00uq8tMo3zV0OfJON0g3/factors + href: https://{yourOktaDomain}/api/v1/users/00uq8tMo3zV0OfJON0g3/factors policy: id: 00pq8lGaLlI8APuqY0g3 rule: @@ -3117,8 +3945,7 @@ components: SAMLPayLoadExample: summary: An example SAML assertion inline hook request body value: - source: >- - https://${yourOktaDomain}/app/saml20app_1/exkth8lMzFm0HZOTU0g3/sso/saml + source: https://${yourOktaDomain}/app/saml20app_1/exkth8lMzFm0HZOTU0g3/sso/saml eventId: XMFoHCM1S4Wi_SGWzL8T9A eventTime: '2019-03-28T19:15:23.000Z' data: @@ -3127,8 +3954,7 @@ components: id: reqqXypjzYJRSu2j1G1imUovA method: GET url: - value: >- - https://${yourOktaDomain}/app/saml20app_1/exkth8lMzFm0HZOTU0g3/sso/saml + value: https://${yourOktaDomain}/app/saml20app_1/exkth8lMzFm0HZOTU0g3/sso/saml ipAddress: 127.0.0.1 protocol: type: SAML2.0 @@ -3163,8 +3989,7 @@ components: groups: href: https://${yourOktaDomain}/00uq8tMo3zV0OfJON0g3/groups factors: - href: >- - https://${yourOktaDomain}/api/v1/users/00uq8tMo3zV0OfJON0g3/factors + href: https://${yourOktaDomain}/api/v1/users/00uq8tMo3zV0OfJON0g3/factors assertion: subject: nameId: user@example.com @@ -3176,8 +4001,7 @@ components: authentication: sessionIndex: id1553800523546.312669168 authnContext: - authnContextClassRef: >- - urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport + authnContextClassRef: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport conditions: audienceRestriction: - urn:example:sp @@ -3289,21 +4113,17 @@ components: value: credential: VERIFIED TelephonySuccessResponse: - summary: >- - An example telephony hook response for an external web service returning - success + summary: An example telephony hook response for an external web service returning success value: commands: - type: com.okta.telephony.action - - value: - status: SUCCESS - provider: VONAGE - transactionId: SM49a8ece2822d44e4adaccd7ed268f954 - transactionMetadata: Duration=300ms + value: + - status: SUCCESSFUL + provider: VONAGE + transactionId: SM49a8ece2822d44e4adaccd7ed268f954 + transactionMetadata: Duration=300ms ProfileEnrollmentResponse: - summary: >- - An example registration hook profile enrollment (SSR) inline hook - response + summary: An example registration hook profile enrollment (SSR) inline hook response value: commands: - type: com.action.update @@ -3354,9 +4174,7 @@ components: path: /authentication/sessionIndex value: exampleSession UserImportChangeAppUserProfileExample: - summary: >- - An example user import inline hook response that updates an app user's - profile + summary: An example user import inline hook response that updates an app user's profile value: commands: - type: com.okta.appUser.profile.update @@ -3383,8 +4201,7 @@ components: lastUpdated: '2024-09-05T16:06:09.000Z' _links: activate: - href: >- - https://subdomain.okta.com/api/v1/inlineHooks/calb7gacafgwgE7hc5e4/lifecycle/activate + href: https://subdomain.okta.com/api/v1/inlineHooks/calb7gacafgwgE7hc5e4/lifecycle/activate hints: allow: - POST @@ -3439,7 +4256,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.inline_hooks + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListInlineHooksResponse' + transform: + body: |- + {{- $wrapped := printf "{\"inline_hooks\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_inline_hook: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1inlineHooks/post' response: @@ -3452,12 +4281,18 @@ components: mediaType: application/json openAPIDocKey: '200' update_inline_hook: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1inlineHooks~1{inlineHookId}/post' response: mediaType: application/json openAPIDocKey: '200' replace_inline_hook: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1inlineHooks~1{inlineHookId}/put' response: @@ -3467,9 +4302,12 @@ components: operation: $ref: '#/paths/~1api~1v1~1inlineHooks~1{inlineHookId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' execute_inline_hook: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1inlineHooks~1{inlineHookId}~1execute/post' response: @@ -3477,42 +4315,42 @@ components: openAPIDocKey: '200' activate_inline_hook: operation: - $ref: >- - #/paths/~1api~1v1~1inlineHooks~1{inlineHookId}~1lifecycle~1activate/post + $ref: '#/paths/~1api~1v1~1inlineHooks~1{inlineHookId}~1lifecycle~1activate/post' response: mediaType: application/json openAPIDocKey: '200' deactivate_inline_hook: operation: - $ref: >- - #/paths/~1api~1v1~1inlineHooks~1{inlineHookId}~1lifecycle~1deactivate/post + $ref: '#/paths/~1api~1v1~1inlineHooks~1{inlineHookId}~1lifecycle~1deactivate/post' response: mediaType: application/json openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/inline_hooks/methods/list_inline_hooks - - $ref: >- - #/components/x-stackQL-resources/inline_hooks/methods/get_inline_hook + - $ref: '#/components/x-stackQL-resources/inline_hooks/methods/get_inline_hook' + - $ref: '#/components/x-stackQL-resources/inline_hooks/methods/list_inline_hooks' insert: - - $ref: >- - #/components/x-stackQL-resources/inline_hooks/methods/create_inline_hook + - $ref: '#/components/x-stackQL-resources/inline_hooks/methods/create_inline_hook' update: - - $ref: >- - #/components/x-stackQL-resources/inline_hooks/methods/update_inline_hook + - $ref: '#/components/x-stackQL-resources/inline_hooks/methods/update_inline_hook' delete: - - $ref: >- - #/components/x-stackQL-resources/inline_hooks/methods/delete_inline_hook + - $ref: '#/components/x-stackQL-resources/inline_hooks/methods/delete_inline_hook' replace: - - $ref: >- - #/components/x-stackQL-resources/inline_hooks/methods/replace_inline_hook + - $ref: '#/components/x-stackQL-resources/inline_hooks/methods/replace_inline_hook' servers: - url: https://{subdomain}.okta.com/ variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/integrations.yaml b/providers/src/okta/v00.00.00000/services/integrations.yaml index b0c446ee..b25ed404 100644 --- a/providers/src/okta/v00.00.00000/services/integrations.yaml +++ b/providers/src/okta/v00.00.00000/services/integrations.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: integrations API description: okta integrations API - version: 5.1.0 + version: 2026.07.2 paths: /integrations/api/v1/api-services: get: @@ -17,9 +17,8 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/APIServiceIntegrationInstance' + $ref: >- + #/components/schemas/ListApiServiceIntegrationInstancesResponse examples: APIServiceIntegrationResponseExample: $ref: '#/components/examples/APIServiceIntegrationListResponse' @@ -119,6 +118,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathApiServiceId' delete: summary: Delete an API service integration instance description: >- @@ -146,8 +147,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathApiServiceId' + parameters: + - $ref: '#/components/parameters/pathApiServiceId' /integrations/api/v1/api-services/{apiServiceId}/credentials/secrets: get: summary: List all API service integration instance secrets @@ -161,9 +162,8 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/APIServiceIntegrationInstanceSecret' + $ref: >- + #/components/schemas/ListApiServiceIntegrationInstanceSecretsResponse examples: APIServiceIntegrationResponseExample: $ref: >- @@ -185,6 +185,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathApiServiceId' post: summary: Create an API service integration instance secret description: >- @@ -220,8 +222,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathApiServiceId' + parameters: + - $ref: '#/components/parameters/pathApiServiceId' /integrations/api/v1/api-services/{apiServiceId}/credentials/secrets/{secretId}: delete: summary: Delete an API service integration instance secret @@ -249,9 +251,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathApiServiceId' - - $ref: '#/components/parameters/pathSecretId' + parameters: + - $ref: '#/components/parameters/pathApiServiceId' + - $ref: '#/components/parameters/pathSecretId' /integrations/api/v1/api-services/{apiServiceId}/credentials/secrets/{secretId}/lifecycle/activate: post: summary: Activate an API service integration instance secret @@ -285,9 +287,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathApiServiceId' - - $ref: '#/components/parameters/pathSecretId' + parameters: + - $ref: '#/components/parameters/pathApiServiceId' + - $ref: '#/components/parameters/pathSecretId' /integrations/api/v1/api-services/{apiServiceId}/credentials/secrets/{secretId}/lifecycle/deactivate: post: summary: Deactivate an API service integration instance secret @@ -321,9 +323,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathApiServiceId' - - $ref: '#/components/parameters/pathSecretId' + parameters: + - $ref: '#/components/parameters/pathApiServiceId' + - $ref: '#/components/parameters/pathSecretId' components: schemas: APIServiceIntegrationInstance: @@ -405,16 +407,64 @@ components: - type - grantedScopes postAPIServiceIntegrationInstance: - allOf: - - $ref: '#/components/schemas/APIServiceIntegrationInstance' - - type: object - properties: - clientSecret: - type: string - description: >- - The client secret for the API Service Integration instance. This - property is only returned in a POST response. - readOnly: true + type: object + properties: + configGuideUrl: + type: string + description: The URL to the API service integration configuration guide + example: https://{docDomain}/my-app-cie/configuration-guide + readOnly: true + createdAt: + type: string + description: Timestamp when the API Service Integration instance was created + example: '2023-02-21T20:08:24.000Z' + readOnly: true + createdBy: + type: string + description: The user ID of the API Service Integration instance creator + example: 00uu3u0ujW1P6AfZC2d5 + readOnly: true + grantedScopes: + type: array + description: >- + The list of Okta management scopes granted to the API Service + Integration instance. See [Okta management OAuth 2.0 + scopes]https://developer.okta.com/docs/api/oauth2/#okta-admin-management. + items: + type: string + example: + - okta.logs.read + id: + type: string + description: The ID of the API Service Integration instance + readOnly: true + example: 0oa72lrepvp4WqEET1d9 + name: + type: string + description: >- + The name of the API service integration that corresponds with the + `type` property. This is the full name of the API service + integration listed in the Okta Integration Network (OIN) catalog. + readOnly: true + example: My App Cloud Identity Engine + properties: + $ref: '#/components/schemas/AppProperties' + type: + type: string + description: >- + The type of the API service integration. This string is an + underscore-concatenated, lowercased API service integration name. + For example, `my_api_log_integration`. + example: my_app_cie + _links: + $ref: '#/components/schemas/APIServiceIntegrationLinks' + readOnly: true + clientSecret: + type: string + description: >- + The client secret for the API Service Integration instance. This + property is only returned in a POST response. + readOnly: true APIServiceIntegrationInstanceSecret: type: object properties: @@ -546,35 +596,198 @@ components: readOnly: true type: object HrefObjectClientLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the client resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to the client resource HrefObjectLogoLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the logo resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to the logo resource HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) ErrorCause: type: object properties: errorSummary: type: string HrefObjectActivateLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to activate the resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to activate the resource HrefObjectDeactivateLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to deactivate the resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to deactivate the resource HrefObjectDeleteLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to delete the resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to delete the resource HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object additionalProperties: true type: object @@ -618,6 +831,20 @@ components: - GET - POST - PUT + ListApiServiceIntegrationInstancesResponse: + type: object + properties: + api_service_integration_instances: + type: array + items: + $ref: '#/components/schemas/APIServiceIntegrationInstance' + ListApiServiceIntegrationInstanceSecretsResponse: + type: object + properties: + api_service_integration_instance_secrets: + type: array + items: + $ref: '#/components/schemas/APIServiceIntegrationInstanceSecret' responses: ErrorInvalidToken401: description: Unauthorized @@ -674,7 +901,8 @@ components: The cursor to use for pagination. It is an opaque string that specifies your current location in the list and is obtained from the `Link` response header. See - [Pagination](https://developer.okta.com/docs/api/#pagination). + [Pagination](https://developer.okta.com/docs/api/#pagination) and [Link + header](https://developer.okta.com/docs/api/#link-header). pathApiServiceId: name: apiServiceId in: path @@ -1014,7 +1242,21 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.api_service_integration_instances + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListApiServiceIntegrationInstancesResponse' + transform: + body: >- + {{- $wrapped := printf + "{\"api_service_integration_instances\":%s}" . -}} + + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_api_service_integration_instance: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1integrations~1api~1v1~1api-services/post' response: @@ -1031,14 +1273,14 @@ components: $ref: >- #/paths/~1integrations~1api~1v1~1api-services~1{apiServiceId}/delete response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/instances/methods/list_api_service_integration_instances - $ref: >- #/components/x-stackQL-resources/instances/methods/get_api_service_integration_instance + - $ref: >- + #/components/x-stackQL-resources/instances/methods/list_api_service_integration_instances insert: - $ref: >- #/components/x-stackQL-resources/instances/methods/create_api_service_integration_instance @@ -1059,6 +1301,18 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.api_service_integration_instance_secrets + overrideMediaType: application/json + schema_override: + $ref: >- + #/components/schemas/ListApiServiceIntegrationInstanceSecretsResponse + transform: + body: >- + {{- $wrapped := printf + "{\"api_service_integration_instance_secrets\":%s}" . -}} + + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_api_service_integration_instance_secret: operation: $ref: >- @@ -1071,7 +1325,7 @@ components: $ref: >- #/paths/~1integrations~1api~1v1~1api-services~1{apiServiceId}~1credentials~1secrets~1{secretId}/delete response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' activate_api_service_integration_instance_secret: operation: @@ -1104,7 +1358,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/logs.yaml b/providers/src/okta/v00.00.00000/services/logs.yaml index f7953254..fcf3b60a 100644 --- a/providers/src/okta/v00.00.00000/services/logs.yaml +++ b/providers/src/okta/v00.00.00000/services/logs.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: logs API description: okta logs API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/logs: get: @@ -99,14 +99,14 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/LogEvent' + $ref: '#/components/schemas/ListLogEventsResponse' examples: ListLogs: $ref: '#/components/examples/ListLogs' LogTargetChangeDetails: $ref: '#/components/examples/LogTargetChangeDetails' + ListLogsWithAdditionalSecurityContext: + $ref: '#/components/examples/ListLogsWithAdditionalSecurityContext' '400': $ref: '#/components/responses/ErrorApiValidationFailed400' '403': @@ -178,7 +178,7 @@ components: > **Note:** When searching the target array, search for a given `type` rather than the array location. Target types, such as `User` - and `AppInstance`, + and `AppInstance`, for a given `eventType` are not always in the same array location. items: @@ -320,7 +320,7 @@ components: zone: description: >- The `name` of the - [Zone](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/NetworkZone/#tag/NetworkZone/operation/getNetworkZone) + [Zone](https://developer.okta.com/docs/api/openapi/okta-management/management/networkzone/#tag/NetworkZone/operation/getNetworkZone) that the client's location is mapped to type: string readOnly: true @@ -436,28 +436,48 @@ components: request was sourced to type: integer readOnly: true + nullable: true asOrg: description: >- The organization that is associated with the autonomous system that the event request is sourced to type: string readOnly: true + nullable: true + botProtection: + $ref: '#/components/schemas/LogBotProtection' domain: description: >- The domain name that's associated with the IP address of the inbound event request type: string readOnly: true + nullable: true + ipDetails: + $ref: '#/components/schemas/LogIpDetails' isp: description: >- The Internet service provider that's used to send the event's request type: string readOnly: true + nullable: true isProxy: description: Specifies whether an event's request is from a known proxy type: boolean readOnly: true + nullable: true + risk: + $ref: '#/components/schemas/LogRisk' + userBehaviors: + description: >- + The result of the user behavior detection models associated with the + event + type: array + readOnly: true + nullable: true + items: + $ref: '#/components/schemas/LogUserBehavior' LogSeverity: description: Indicates how severe the event is type: string @@ -516,7 +536,7 @@ components: LogTransaction: description: >- A `transaction` object comprises contextual information associated with - its respective event. + its respective event. This information is useful for understanding sequences of correlated events. @@ -746,6 +766,8 @@ components: description: IP address type: string readOnly: true + ipDetails: + $ref: '#/components/schemas/LogIpDetails' source: description: Details regarding the source type: string @@ -754,6 +776,145 @@ components: description: IP address version type: string readOnly: true + LogBotProtection: + x-okta-lifecycle: + lifecycle: LIMITED_GA + isGenerallyAvailable: false + SKUs: [] + description: >- + The result of the bot + protection detection associated with the event + nullable: true + type: object + properties: + level: + description: >- + The bot detected level associated with the bot protection + configuration target + type: string + readOnly: true + nullable: true + enum: + - NONE + - LOW + - MEDIUM + - HIGH + readOnly: true + LogIpDetails: + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: true + description: Details about the associated IP address + nullable: true + type: object + properties: + asNumber: + description: >- + The [Autonomous + system](https://docs.telemetry.mozilla.org/datasets/other/asn_aggregates/reference) + number that's associated with the IP address + type: integer + readOnly: true + nullable: true + asOrg: + description: The name associated with the Autonomous System Number (ASN) + type: string + readOnly: true + nullable: true + domain: + description: The domain name associated with the IP address + type: string + readOnly: true + nullable: true + ipServiceCategories: + description: The associated IP service categories for the IP address + type: array + readOnly: true + nullable: true + items: + $ref: '#/components/schemas/LogIpServiceCategory' + isp: + description: The internet service provider associated with the IP address + type: string + readOnly: true + nullable: true + readOnly: true + LogRisk: + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: true + description: Risk associated with the event + nullable: true + type: object + properties: + detectionName: + description: The name of the detection mechanism that identified the risk + type: string + readOnly: true + nullable: true + issuer: + description: The entity that issued the associated risk + type: string + readOnly: true + nullable: true + level: + description: The risk level associated with the request + type: string + readOnly: true + nullable: true + enum: + - LOW + - MEDIUM + - HIGH + previousLevel: + description: The previous risk level (if any) associated with the user + type: string + readOnly: true + nullable: true + enum: + - LOW + - MEDIUM + - HIGH + reasons: + description: Reasons for the associated risk + type: array + readOnly: true + nullable: true + items: + type: string + readOnly: true + LogUserBehavior: + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: true + description: >- + The result of the user behavior detection models associated with the + event + type: object + properties: + id: + description: The unique identifier of the user behavior detection model + type: string + readOnly: true + nullable: true + name: + description: >- + The name of the user behavior detection model [configured by + admins](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Behavior/) + type: string + readOnly: true + nullable: true + result: + description: The result of the user behavior analysis + type: string + readOnly: true + nullable: true + enum: + - UNKNOWN + - POSITIVE + - NEGATIVE + - BAD_REQUEST ErrorCause: type: object properties: @@ -781,6 +942,41 @@ components: type: number format: double readOnly: true + LogIpServiceCategory: + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: true + description: Describes the IP service category associated with an IP. + type: object + properties: + isAnonymous: + description: Indicates whether the service is an anonymizer + type: boolean + readOnly: true + nullable: true + operator: + description: The name of the associated operator + type: string + readOnly: true + nullable: true + type: + description: The type of service provided from this IP address + type: string + readOnly: true + nullable: true + enum: + - VPN + - Proxy + - Tor + - Residential Proxy + - Blockchain VPN + ListLogEventsResponse: + type: object + properties: + log_events: + type: array + items: + $ref: '#/components/schemas/LogEvent' responses: ErrorApiValidationFailed400: description: Bad Request @@ -924,6 +1120,129 @@ components: include: - ALL_ZONES exclude: null + ListLogsWithAdditionalSecurityContext: + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: true + summary: List all System Log events with more security context + value: + actor: + id: 00uttidj01jqL21aM1d6 + type: User + alternateId: john.doe@example.com + displayName: John Doe + detailEntry: null + client: + userAgent: + rawUserAgent: >- + Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 + (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 + os: Mac OS X + browser: CHROME + zone: null + device: Computer + id: null + ipAddress: 10.0.0.1 + geographicalContext: + city: New York + state: New York + country: United States + postalCode: 10013 + geolocation: + lat: 40.3157 + lon: -74.01 + device: + id: guofdhyjex1feOgbN1d9 + name: Mac15,6 + os_platform: OSX + os_version: 14.6.0 + managed: false + registered: true + device_integrator: null + disk_encryption_type: ALL_INTERNAL_VOLUMES + screen_lock_type: BIOMETRIC + jailbreak: null + secure_hardware_present: true + authenticationContext: + authenticationProvider: null + credentialProvider: null + credentialType: null + issuer: null + interface: null + authenticationStep: 0 + rootSessionId: idxBager62CSveUkTxvgRtonA + externalSessionId: idxBager62CSveUkTxvgRtonA + displayMessage: User login to Okta + eventType: user.session.start + outcome: + result: SUCCESS + reason: null + published: '2024-08-13T15:58:20.353Z' + securityContext: + asNumber: 394089 + asOrg: ASN 0000 + isp: google + domain: null + isProxy: false + risk: + level: HIGH + reasons: + - Anomalous Device + detectionName: Suspected Session Hijacking + ipDetails: + asNumber: 394089 + asOrg: ASN 0000 + isp: google + userBehaviors: + - id: bhv3pcdHYo3rVDL0w0g4 + name: New Device + result: NEGATIVE + - id: bhvexm4UkQc71MgEw0g4 + name: New Geo-Location + result: POSITIVE + botProtection: + level: LOW + severity: INFO + debugContext: + debugData: + requestId: ab609228fe84ce59cdcbfa690bcce016 + requestUri: /idp/idx/authenticators/poll + url: /idp/idx/authenticators/poll + legacyEventType: core.user_auth.login_success + transaction: + type: WEB + id: ab609228fe84ce59cdcbfa690bgce016 + detail: null + uuid: dc9fd3c0-598c-11ef-8478-2b7584bf8d5a + version: 0 + request: + ipChain: + - ip: 10.0.0.1 + geographicalContext: + city: New York + state: New York + country: United States + postalCode: 10013 + geolocation: + lat: 40.3157 + lon: -74.01 + version: V4 + source: null + ipDetails: + asNumber: 394089 + asOrg: ASN 0000 + isp: google + target: + - id: pfdfdhyjf0HMbkP2e1d7 + type: AuthenticatorEnrollment + alternateId: unknown + displayName: Okta Verify + detailEntry: null + - id: 0oatxlef9sQvvqInq5d6 + type: AppInstance + alternateId: Okta Admin Console + displayName: Okta Admin Console + detailEntry: null ErrorApiValidationFailed: summary: API Validation Failed value: @@ -960,6 +1279,15 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.log_events + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListLogEventsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"log_events\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 sqlVerbs: select: - $ref: >- @@ -973,7 +1301,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/logstreams.yaml b/providers/src/okta/v00.00.00000/services/logstreams.yaml index 72b6a16b..d6b5433b 100644 --- a/providers/src/okta/v00.00.00000/services/logstreams.yaml +++ b/providers/src/okta/v00.00.00000/services/logstreams.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: logstreams API description: okta logstreams API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/logStreams: get: @@ -30,9 +30,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/LogStream' + $ref: '#/components/schemas/ListLogStreamsResponse' examples: ExampleGetAllResponse: $ref: '#/components/examples/LogStreamGetAllResponse' @@ -128,6 +126,8 @@ paths: lifecycle: GA isGenerallyAvailable: false SKUs: [] + parameters: + - $ref: '#/components/parameters/pathLogStreamId' put: summary: Replace a log stream description: >- @@ -141,7 +141,7 @@ paths: properties can't be modified after the log stream is initially created. Use the [Retrieve the log stream schema for the schema - type](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/#tag/Schema/operation/getLogStreamSchema) + type](https://developer.okta.com/docs/api/openapi/okta-management/management/schema/getlogstreamschema) request to determine which properties you can update for the specific log stream type. @@ -195,6 +195,8 @@ paths: lifecycle: GA isGenerallyAvailable: false SKUs: [] + parameters: + - $ref: '#/components/parameters/pathLogStreamId' delete: summary: Delete a log stream description: Deletes a log stream object from your org by ID @@ -226,8 +228,8 @@ paths: lifecycle: GA isGenerallyAvailable: false SKUs: [] - parameters: - - $ref: '#/components/parameters/pathLogStreamId' + parameters: + - $ref: '#/components/parameters/pathLogStreamId' /api/v1/logStreams/{logStreamId}/lifecycle/activate: post: summary: Activate a log stream @@ -259,8 +261,8 @@ paths: lifecycle: GA isGenerallyAvailable: false SKUs: [] - parameters: - - $ref: '#/components/parameters/pathLogStreamId' + parameters: + - $ref: '#/components/parameters/pathLogStreamId' /api/v1/logStreams/{logStreamId}/lifecycle/deactivate: post: summary: Deactivate a log stream @@ -292,8 +294,8 @@ paths: lifecycle: GA isGenerallyAvailable: false SKUs: [] - parameters: - - $ref: '#/components/parameters/pathLogStreamId' + parameters: + - $ref: '#/components/parameters/pathLogStreamId' components: schemas: LogStream: @@ -426,17 +428,59 @@ components: errorSummary: type: string LogStreamActivateLink: - allOf: - - $ref: '#/components/schemas/LogStreamLinkObject' - - description: Link to activate the resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Log stream link object + type: object + properties: + href: + type: string + description: The URI of the resource + method: + type: string + description: HTTP method allowed for the resource + enum: + - GET + - POST + required: + - href + readOnly: true + description: Link to activate the resource LogStreamDeactivateLink: - allOf: - - $ref: '#/components/schemas/LogStreamLinkObject' - - description: Link to deactivate the resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Log stream link object + type: object + properties: + href: + type: string + description: The URI of the resource + method: + type: string + description: HTTP method allowed for the resource + enum: + - GET + - POST + required: + - href + readOnly: true + description: Link to deactivate the resource LogStreamSelfLink: - allOf: - - $ref: '#/components/schemas/LogStreamLinkObject' - - description: Link to the resource (self) + x-okta-ignore-redocly-rules-for-sdk: true + title: Log stream link object + type: object + properties: + href: + type: string + description: The URI of the resource + method: + type: string + description: HTTP method allowed for the resource + enum: + - GET + - POST + required: + - href + readOnly: true + description: Link to the resource (self) LogStreamLinkObject: title: Log stream link object type: object @@ -453,6 +497,13 @@ components: required: - href readOnly: true + ListLogStreamsResponse: + type: object + properties: + log_streams: + type: array + items: + $ref: '#/components/schemas/LogStream' responses: ErrorAccessDenied403: description: Forbidden @@ -500,7 +551,8 @@ components: The cursor to use for pagination. It is an opaque string that specifies your current location in the list and is obtained from the `Link` response header. See - [Pagination](https://developer.okta.com/docs/api/#pagination). + [Pagination](https://developer.okta.com/docs/api/#pagination) and [Link + header](https://developer.okta.com/docs/api/#link-header). queryLimit: name: limit in: query @@ -685,7 +737,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.log_streams + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListLogStreamsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"log_streams\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_log_stream: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1logStreams/post' response: @@ -698,6 +762,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_log_stream: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1logStreams~1{logStreamId}/put' response: @@ -707,7 +774,7 @@ components: operation: $ref: '#/paths/~1api~1v1~1logStreams~1{logStreamId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' activate_log_stream: operation: @@ -725,10 +792,10 @@ components: openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/log_streams/methods/list_log_streams - $ref: >- #/components/x-stackQL-resources/log_streams/methods/get_log_stream + - $ref: >- + #/components/x-stackQL-resources/log_streams/methods/list_log_streams insert: - $ref: >- #/components/x-stackQL-resources/log_streams/methods/create_log_stream @@ -744,7 +811,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/mappings.yaml b/providers/src/okta/v00.00.00000/services/mappings.yaml index 5262f216..f267176b 100644 --- a/providers/src/okta/v00.00.00000/services/mappings.yaml +++ b/providers/src/okta/v00.00.00000/services/mappings.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: mappings API description: okta mappings API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/mappings: get: @@ -39,7 +39,12 @@ paths: type: string - name: limit in: query - description: Specifies the number of results per page + description: >- + Specifies the number of results per page + + > **Note:** If you encounter timeout errors with larger values, + reduce the limit (for example, `50`) and use pagination with the + `after` parameter to retrieve the results. schema: type: integer format: int32 @@ -67,9 +72,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/ListProfileMappings' + $ref: '#/components/schemas/ListProfileMappingsResponse' examples: MappingList: summary: List all profile mappings response @@ -120,6 +123,8 @@ paths: lifecycle: GA isGenerallyAvailable: false SKUs: [] + parameters: + - $ref: '#/components/parameters/pathMappingId' post: summary: Update a profile mapping description: >- @@ -181,8 +186,8 @@ paths: lifecycle: GA isGenerallyAvailable: false SKUs: [] - parameters: - - $ref: '#/components/parameters/pathMappingId' + parameters: + - $ref: '#/components/parameters/pathMappingId' components: schemas: ListProfileMappings: @@ -233,7 +238,6 @@ components: $ref: '#/components/schemas/ProfileMappingTarget' _links: $ref: '#/components/schemas/LinksSelf' - ProfileMappingRequest: description: The updated request body properties @@ -241,7 +245,6 @@ components: properties: $ref: '#/components/schemas/ProfileMappingProperty' - required: - properties - expression @@ -355,18 +358,81 @@ components: pushStatus: $ref: '#/components/schemas/ProfileMappingPropertyPushStatus' SourceLinks: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - + x-okta-ignore-redocly-rules-for-sdk: true + description: >- + Specifies link relations (see [Web + Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the + [JSON Hypertext Application + Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) + specification. This object is used for dynamic discovery of related + resources and lifecycle operations. + + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + schema: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + properties: - schema: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: The associated schema + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: The associated schema + readOnly: true HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) ErrorCause: properties: @@ -388,6 +454,7 @@ components: - DONT_PUSH - PUSH HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object additionalProperties: true @@ -431,6 +498,13 @@ components: - GET - POST - PUT + ListProfileMappingsResponse: + + properties: + profile_mappings: + type: array + items: + $ref: '#/components/schemas/ListProfileMappings' responses: ErrorAccessDenied403: description: Forbidden @@ -718,6 +792,15 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.profile_mappings + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListProfileMappingsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"profile_mappings\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 get_profile_mapping: operation: $ref: '#/paths/~1api~1v1~1mappings~1{mappingId}/get' @@ -725,6 +808,9 @@ components: mediaType: application/json openAPIDocKey: '200' update_profile_mapping: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1mappings~1{mappingId}/post' response: @@ -732,10 +818,10 @@ components: openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/profile_mappings/methods/list_profile_mappings - $ref: >- #/components/x-stackQL-resources/profile_mappings/methods/get_profile_mapping + - $ref: >- + #/components/x-stackQL-resources/profile_mappings/methods/list_profile_mappings insert: [] update: - $ref: >- @@ -747,7 +833,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/meta.yaml b/providers/src/okta/v00.00.00000/services/meta.yaml index 635bac88..1b4b931a 100644 --- a/providers/src/okta/v00.00.00000/services/meta.yaml +++ b/providers/src/okta/v00.00.00000/services/meta.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: meta API description: okta meta API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/meta/schemas/apps/{appId}/default: get: @@ -21,7 +21,7 @@ paths: The [User - Types](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/) + Types](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/) feature does not extend to apps. All users assigned to a given app use the same app user schema. Therefore, unlike the user schema operations, the app user schema operations all specify `default` and don't accept a @@ -52,6 +52,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathAppId' post: x-okta-iam-permissions: - okta.apps.manage @@ -72,7 +74,7 @@ paths: The [User - Types](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/) + Types](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/) feature does not extend to apps. All users assigned to a given app use the same app user schema. Therefore, unlike the user schema operations, the app user schema operations all specify `default` and don't accept a @@ -115,8 +117,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathAppId' + parameters: + - $ref: '#/components/parameters/pathAppId' /api/v1/meta/schemas/group/default: get: x-okta-iam-permissions: @@ -131,7 +133,7 @@ paths: The [User - Types](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/) + Types](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/) feature does not extend to groups. All groups use the same group schema. Unlike user schema operations, group schema operations all specify `default` and don't accept a schema ID. @@ -179,7 +181,7 @@ paths: The [User - Types](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/) + Types](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/) feature does not extend to groups. All groups use the same group schema. Unlike user schema operations, group schema operations all specify `default` and don't accept a schema ID. @@ -230,9 +232,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/LogStreamSchema' + $ref: '#/components/schemas/ListLogStreamSchemasResponse' examples: All log stream schemas for your org: $ref: '#/components/examples/LogStreamSchemaList' @@ -291,8 +291,8 @@ paths: lifecycle: GA isGenerallyAvailable: false SKUs: [] - parameters: - - $ref: '#/components/parameters/pathLogStreamType' + parameters: + - $ref: '#/components/parameters/pathLogStreamType' /api/v1/meta/schemas/user/linkedObjects: get: x-okta-iam-permissions: @@ -310,9 +310,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/LinkedObject' + $ref: '#/components/schemas/ListLinkedObjectDefinitionsResponse' examples: ListLinkedObjectsEx: $ref: '#/components/examples/ListLinkedObjects' @@ -413,6 +411,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathLinkedObjectName' delete: x-okta-iam-permissions: - okta.apps.manage @@ -445,8 +445,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathLinkedObjectName' + parameters: + - $ref: '#/components/parameters/pathLinkedObjectName' /api/v1/meta/schemas/user/{schemaId}: get: x-okta-iam-permissions: @@ -485,6 +485,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathSchemaId' post: x-okta-iam-admin-roles: - API_ACCESS_MANAGEMENT_ADMIN @@ -503,7 +505,7 @@ paths: You can't remove a property from the default schema if it's being referenced as a - [`matchAttribute`](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=policy/subject/matchAttribute&t=request) + [`matchAttribute`](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/identityprovider/other/createidentityprovider#other/createidentityprovider/t=request&path=policy/subject/matchattribute) in `SAML2` IdPs. Currently, all validation of SAML assertions are only performed against @@ -550,8 +552,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathSchemaId' + parameters: + - $ref: '#/components/parameters/pathSchemaId' /api/v1/meta/types/user: get: summary: List all user types @@ -563,9 +565,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/UserType' + $ref: '#/components/schemas/ListUserTypesResponse' examples: ListsAllUserTypes: $ref: '#/components/examples/ListsAllUserTypes' @@ -659,6 +659,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathTypeId' post: summary: Update a user type description: >- @@ -704,6 +706,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathTypeId' put: summary: Replace a user type description: >- @@ -749,6 +753,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathTypeId' delete: summary: Delete a user type description: >- @@ -776,8 +782,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathTypeId' + parameters: + - $ref: '#/components/parameters/pathTypeId' /api/v1/meta/uischemas: get: summary: List all UI schemas @@ -789,9 +795,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/UISchemasResponseObject' + $ref: '#/components/schemas/ListUISchemasResponse' examples: UIISchemaList: summary: Lists all UI schemas response @@ -885,6 +889,8 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine + parameters: + - $ref: '#/components/parameters/UISchemaId' put: summary: Replace a UI schema description: Replaces a UI Schema by `id` @@ -928,6 +934,8 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine + parameters: + - $ref: '#/components/parameters/UISchemaId' delete: summary: Delete a UI schema description: Deletes a UI Schema by `id` @@ -955,11 +963,12 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/UISchemaId' + parameters: + - $ref: '#/components/parameters/UISchemaId' components: schemas: UserSchema: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: $schema: @@ -971,8 +980,6 @@ components: readOnly: true description: Timestamp when the schema was created definitions: - allOf: - - $ref: '#/components/schemas/UserSchemaDefinitions' description: >- User profile subschemas @@ -983,6 +990,12 @@ components: Okta, while `#custom` properties are extensible. Custom property names for the profile object must be unique and can't conflict with a property name defined in the `#base` subschema. + type: object + properties: + base: + $ref: '#/components/schemas/UserSchemaBase' + custom: + $ref: '#/components/schemas/UserSchemaPublic' id: type: string readOnly: true @@ -996,9 +1009,11 @@ components: readOnly: true description: Name of the schema properties: - allOf: - - $ref: '#/components/schemas/UserSchemaProperties' description: User Object Properties + type: object + properties: + profile: + $ref: '#/components/schemas/UserSchemaPropertiesProfile' title: type: string description: User-defined display name for the schema @@ -1054,6 +1069,7 @@ components: $ref: '#/components/schemas/LinksSelf' x-okta-allow-null-property-value-for-updates: true LogStreamSchema: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: $schema: @@ -1061,11 +1077,12 @@ components: readOnly: true description: JSON schema version identifier errorMessage: - type: object + type: string description: >- A collection of error messages for individual properties in the schema. Okta implements a subset of - [ajv-errors](https://github.com/ajv-validator/ajv-errors). + [ajv-errors](https://github.com/ajv-validator/ajv-errors). (opaque + JSON object) id: type: string readOnly: true @@ -1097,8 +1114,8 @@ components: For `string` log stream schema property type, specifies the regular expression used to validate the property properties: - type: object - description: log stream schema properties object + type: string + description: log stream schema properties object (opaque JSON object) required: type: array items: @@ -1354,14 +1371,50 @@ components: errorSummary: type: string UserTypeLinks: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - type: object + x-okta-ignore-redocly-rules-for-sdk: true + description: >- + Specifies link relations (see [Web + Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the + [JSON Hypertext Application + Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) + specification. This object is used for dynamic discovery of related + resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + schema: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object properties: - schema: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: The associated schema + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: The associated schema + readOnly: true UISchemaObject: description: Properties of the UI schema type: object @@ -1373,7 +1426,9 @@ components: the enrollment form default: Submit elements: - $ref: '#/components/schemas/UIElement' + type: array + items: + $ref: '#/components/schemas/UIElement' label: type: string description: Specifies the label at the top of the enrollment form under the logo @@ -1382,6 +1437,7 @@ components: type: string description: Specifies the type of layout UserSchemaBase: + x-okta-ignore-redocly-rules-for-sdk: true description: >- All Okta-defined profile properties are defined in a profile subschema with the resolution scope `#base`. You can't modify these properties, @@ -1402,372 +1458,10599 @@ components: readOnly: true properties: description: The `#base` object properties - allOf: - - $ref: '#/components/schemas/UserSchemaBaseProperties' - required: - type: array - description: A collection indicating required property names - readOnly: true - items: - type: string - type: - type: string - description: The object type - readOnly: true - UserSchemaPublic: - description: >- - All custom profile properties are defined in a profile subschema with - the resolution scope `#custom`. + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + city: + description: City or locality component of the user's address (`locality`) + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user + creation or update, the `default` is used instead of setting + the value to `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. - > **Notes:** + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application - > * When you refer to custom profile attributes that differ only by - case, name collisions occur. This includes naming custom profile - attributes the same as base profile attributes, for example, `firstName` - and `FirstName`. - > * Certain attributes are reserved and can't be used for custom user - profiles. See [Review reserved - attributes](https://help.okta.com/okta_help.htm?type=oie&id=reserved-attributes). - type: object - properties: - id: - type: string - description: The subschema name - readOnly: true - properties: - type: object - description: The `#custom` object properties - additionalProperties: - $ref: '#/components/schemas/UserSchemaAttribute' - required: - type: array - description: A collection indicating required property names - readOnly: true - items: - type: string - type: - type: string - description: The object type - readOnly: true - UserSchemaPropertiesProfile: - type: object - properties: - allOf: - type: array - items: - $ref: '#/components/schemas/UserSchemaPropertiesProfileItem' - HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) - GroupSchemaBase: - type: object - properties: - id: - readOnly: true - type: string - description: The subschema name - properties: - description: The `#base` object properties - allOf: - - $ref: '#/components/schemas/GroupSchemaBaseProperties' - required: - items: - type: string - type: array - description: A collection indicating required property names - readOnly: true - type: - description: The object type - type: string - readOnly: true - GroupSchemaCustom: - description: >- - All custom profile properties are defined in a profile subschema with - the resolution scope `#custom` - type: object - properties: - id: - readOnly: true - type: string - description: The subschema name - properties: - additionalProperties: - $ref: '#/components/schemas/GroupSchemaAttribute' - type: object - description: The `#custom` object properties - required: - items: - type: string - type: array - description: A collection indicating required property names - readOnly: true - type: - type: string - description: The object type - readOnly: true - LinkedObjectDetailsType: - description: The object type for this relationship - type: string - enum: - - USER - x-enumDescriptions: - USER: Specifies the type of object - LinkedHrefObject: - title: Link Object - additionalProperties: true - type: object - properties: - href: - type: string - description: Link URI - required: - - href - readOnly: true - HrefObject: - title: Link Object - additionalProperties: true - type: object - properties: - hints: - $ref: '#/components/schemas/HrefHints' - readOnly: true - href: - type: string - description: Link URI - name: - type: string - description: Link name - readOnly: true - templated: - type: boolean - description: >- - Indicates whether the link object's `href` property is a URI - template. - readOnly: true - type: - type: string - description: >- - The media type of the link. If omitted, it is implicitly - `application/json`. - readOnly: true - required: - - href - UIElement: - description: Specifies the configuration of an input field on an enrollment form - type: object - properties: - label: - type: string - description: Label name for the UI element - options: - type: object - description: UI Schema element options object - properties: - format: - type: string - description: Specifies how the input appears - enum: - - text - - radio - - select - - checkbox - - radio_yes_no - - radio_true_false - x-enumDescriptions: - text: The default format for the majority of property types - radio: >- - Radio button options. This option is only available for - `string` data types with an `enum` or `one of` constraint. - select: >- - Displays input as a dropdown list. This option is only - available for the `country-code` data type or a string data - type with an enum or one of constraint. - checkbox: >- - Displays input as a checkbox. This option is only available - for Boolean data types. - radio_yes_no: >- - Displays input as two radio buttons, one with the option `yes` - and the other `no`. This option is only available for Boolean - data types. - radio_true_false: >- - Displays input as two radio buttons, one with the option - `true` and the other `false`. This option is only available - for Boolean data types. - scope: - type: string - description: >- - Specifies the property bound to the input field. It must follow the - format `#/properties/PROPERTY_NAME` where `PROPERTY_NAME` is a - variable name for an attribute in `profile editor`. - type: - type: string - description: >- - Specifies the relationship between this input element and `scope`. - The `Control` value specifies that this input controls the value - represented by `scope`. - UserSchemaBaseProperties: - type: object - properties: - city: - allOf: - - $ref: '#/components/schemas/UserSchemaAttribute' - description: City or locality component of the user's address (`locality`) - costCenter: - allOf: - - $ref: '#/components/schemas/UserSchemaAttribute' - description: Name of a cost center assigned to the user - countryCode: - allOf: - - $ref: '#/components/schemas/UserSchemaAttribute' - description: >- - Country name component of the user's address (`country`.) This - property uses [ISO 3166-1 alpha 2 "short" code - format](https://tools.ietf.org/html/draft-ietf-scim-core-schema-22#ref-ISO3166). - department: - allOf: - - $ref: '#/components/schemas/UserSchemaAttribute' - description: Name of the user's department - displayName: - allOf: - - $ref: '#/components/schemas/UserSchemaAttribute' - description: Name of the user, suitable for display to end users + **NOTE**: When you add a custom property, only Identity + Provider app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` + and provides a mechanism to return a display name for the + `enum` value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must + keep the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular + expression used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + costCenter: + description: Name of a cost center assigned to the user + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user + creation or update, the `default` is used instead of setting + the value to `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity + Provider app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` + and provides a mechanism to return a display name for the + `enum` value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must + keep the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular + expression used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + countryCode: + description: >- + Country name component of the user's address (`country`.) This + property uses [ISO 3166-1 alpha 2 "short" code + format](https://tools.ietf.org/html/draft-ietf-scim-core-schema-22#ref-ISO3166). + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user + creation or update, the `default` is used instead of setting + the value to `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity + Provider app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` + and provides a mechanism to return a display name for the + `enum` value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must + keep the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular + expression used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + department: + description: Name of the user's department + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user + creation or update, the `default` is used instead of setting + the value to `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity + Provider app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` + and provides a mechanism to return a display name for the + `enum` value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must + keep the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular + expression used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + displayName: + description: Name of the user, suitable for display to end users + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user + creation or update, the `default` is used instead of setting + the value to `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity + Provider app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` + and provides a mechanism to return a display name for the + `enum` value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must + keep the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular + expression used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + division: + description: Name of the user's division + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user + creation or update, the `default` is used instead of setting + the value to `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity + Provider app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` + and provides a mechanism to return a display name for the + `enum` value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must + keep the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular + expression used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + email: + description: >- + Primary email address of the user. This property is formatted + according to [RFC 5322 Section + 3.2.3](https://datatracker.ietf.org/doc/html/rfc5322#section-3.2.3). + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user + creation or update, the `default` is used instead of setting + the value to `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity + Provider app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` + and provides a mechanism to return a display name for the + `enum` value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must + keep the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular + expression used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + employeeNumber: + description: Organization or company assigned unique identifier for the user + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user + creation or update, the `default` is used instead of setting + the value to `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity + Provider app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` + and provides a mechanism to return a display name for the + `enum` value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must + keep the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular + expression used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + firstName: + description: Given name of the user (`givenName`) + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user + creation or update, the `default` is used instead of setting + the value to `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity + Provider app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` + and provides a mechanism to return a display name for the + `enum` value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must + keep the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular + expression used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + honorificPrefix: + description: >- + Honorific prefix(es) of the user or title in most Western + languages + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user + creation or update, the `default` is used instead of setting + the value to `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity + Provider app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` + and provides a mechanism to return a display name for the + `enum` value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must + keep the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular + expression used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + honorificSuffix: + description: Honorific suffix(es) of the user + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user + creation or update, the `default` is used instead of setting + the value to `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity + Provider app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` + and provides a mechanism to return a display name for the + `enum` value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must + keep the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular + expression used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + lastName: + description: Family name of the user (`familyName`) + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user + creation or update, the `default` is used instead of setting + the value to `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity + Provider app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` + and provides a mechanism to return a display name for the + `enum` value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must + keep the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular + expression used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + locale: + description: >- + User's default location for purposes of localizing items such as + currency, date time format, numerical representations, and so + on. + + + A locale value is a concatenation of the ISO 639-1 two-letter + language code, an underscore, and the ISO 3166-1 two-letter + country code. For example: `en_US` specifies the language + English and country US. This value is `en_US` by default. + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user + creation or update, the `default` is used instead of setting + the value to `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity + Provider app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` + and provides a mechanism to return a display name for the + `enum` value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must + keep the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular + expression used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + login: + description: >- + Unique identifier for the user (`userName`) + + + The login property is validated according to its pattern + attribute, which is a string. By default, the attribute is null. + When the attribute is null, the username is required to be + formatted as an email address as defined by [RFC 6531 Section + 3.3](http://tools.ietf.org/html/rfc6531#section-3.3). The + pattern can be set through the API to one of the following + forms. (The Admin Console provides access to the same forms.) + * A login pattern of `".+"` indicates that there is no restriction on usernames. Any non-empty, unique value is permitted, and the minimum length of five isn't enforced. In this case, usernames don't need to include the `@` character. If a name does include `@`, the portion ahead of the `@` can be used for logging in, provided it identifies a unique user within the org. + * A login pattern of the form `"[...]+"` indicates that usernames must only contain characters from the set given between the brackets. The enclosing brackets and final `+` are required for this form. Character ranges can be indicated using hyphens. To include the hyphen itself in the allowed set, the hyphen must appear first. Any characters in the set except the hyphen, a-z, A-Z, and 0-9 must be preceded by a backslash (`\`). For example, `"[a-z13579\.]+"` would restrict usernames to lowercase letters, odd digits, and periods, while `"[-a-zA-Z0-9]+"` would allow basic alphanumeric characters and hyphens. + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user + creation or update, the `default` is used instead of setting + the value to `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity + Provider app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` + and provides a mechanism to return a display name for the + `enum` value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must + keep the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular + expression used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + manager: + description: The `displayName` of the user's manager + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user + creation or update, the `default` is used instead of setting + the value to `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity + Provider app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` + and provides a mechanism to return a display name for the + `enum` value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must + keep the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular + expression used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + managerId: + description: The `id` of the user's manager + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user + creation or update, the `default` is used instead of setting + the value to `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity + Provider app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` + and provides a mechanism to return a display name for the + `enum` value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must + keep the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular + expression used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + middleName: + description: Middle name(s) of the user + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user + creation or update, the `default` is used instead of setting + the value to `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity + Provider app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` + and provides a mechanism to return a display name for the + `enum` value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must + keep the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular + expression used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + mobilePhone: + description: Mobile phone number of the user + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user + creation or update, the `default` is used instead of setting + the value to `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity + Provider app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` + and provides a mechanism to return a display name for the + `enum` value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must + keep the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular + expression used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + nickName: + description: Casual way to address the user in real life + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user + creation or update, the `default` is used instead of setting + the value to `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity + Provider app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` + and provides a mechanism to return a display name for the + `enum` value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must + keep the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular + expression used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + organization: + description: Name of the user's organization + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user + creation or update, the `default` is used instead of setting + the value to `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity + Provider app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` + and provides a mechanism to return a display name for the + `enum` value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must + keep the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular + expression used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + postalAddress: + description: Mailing address component of the user's address + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user + creation or update, the `default` is used instead of setting + the value to `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity + Provider app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` + and provides a mechanism to return a display name for the + `enum` value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must + keep the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular + expression used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + preferredLanguage: + description: >- + User's preferred written or spoken languages. This property is + formatted according to [RFC 7231 Section + 5.3.5](https://tools.ietf.org/html/rfc7231#section-5.3.5). + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user + creation or update, the `default` is used instead of setting + the value to `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity + Provider app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` + and provides a mechanism to return a display name for the + `enum` value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must + keep the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular + expression used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + primaryPhone: + description: Primary phone number of the user, such as home number + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user + creation or update, the `default` is used instead of setting + the value to `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity + Provider app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` + and provides a mechanism to return a display name for the + `enum` value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must + keep the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular + expression used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + profileUrl: + description: >- + URL of the user's online profile (for example, a web page.) This + property is formatted according to the [Relative Uniform + Resource Locators + specification](https://tools.ietf.org/html/draft-ietf-scim-core-schema-22#ref-ISO3166). + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user + creation or update, the `default` is used instead of setting + the value to `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity + Provider app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` + and provides a mechanism to return a display name for the + `enum` value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must + keep the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular + expression used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + secondEmail: + description: >- + Secondary email address of the user typically used for account + recovery. This property is formatted according to [RFC 5322 + Section + 3.2.3](https://datatracker.ietf.org/doc/html/rfc5322#section-3.2.3). + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user + creation or update, the `default` is used instead of setting + the value to `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity + Provider app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` + and provides a mechanism to return a display name for the + `enum` value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must + keep the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular + expression used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + state: + description: State or region component of the user's address (`region`) + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user + creation or update, the `default` is used instead of setting + the value to `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity + Provider app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` + and provides a mechanism to return a display name for the + `enum` value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must + keep the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular + expression used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + streetAddress: + description: Full street address component of the user's address + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user + creation or update, the `default` is used instead of setting + the value to `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity + Provider app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` + and provides a mechanism to return a display name for the + `enum` value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must + keep the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular + expression used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + timezone: + description: >- + User's time zone. This property is formatted according to the + [IANA Time Zone database + format](https://tools.ietf.org/html/rfc6557). + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user + creation or update, the `default` is used instead of setting + the value to `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity + Provider app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` + and provides a mechanism to return a display name for the + `enum` value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must + keep the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular + expression used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + title: + description: User's title, such as "Vice President" + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user + creation or update, the `default` is used instead of setting + the value to `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity + Provider app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` + and provides a mechanism to return a display name for the + `enum` value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must + keep the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular + expression used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + userType: + description: >- + Used to describe the organization to the user relationship such + as "Employee" or "Contractor". + + + **Note:** The `userType` field is an arbitrary string value and + isn't related to the newer [User + Types](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/) + feature. + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user + creation or update, the `default` is used instead of setting + the value to `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity + Provider app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` + and provides a mechanism to return a display name for the + `enum` value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must + keep the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular + expression used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + zipCode: + description: >- + ZIP code or postal code component of the user's address + (`postalCode`) + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user + creation or update, the `default` is used instead of setting + the value to `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity + Provider app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` + and provides a mechanism to return a display name for the + `enum` value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must + keep the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular + expression used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + required: + type: array + description: A collection indicating required property names + readOnly: true + items: + type: string + type: + type: string + description: The object type + readOnly: true + UserSchemaPublic: + description: >- + All custom profile properties are defined in a profile subschema with + the resolution scope `#custom`. + + + > **Notes:** + + > * When you refer to custom profile attributes that differ only by + case, name collisions occur. This includes naming custom profile + attributes the same as base profile attributes, for example, `firstName` + and `FirstName`. + + > * Certain attributes are reserved and can't be used for custom user + profiles. See [Review reserved + attributes](https://help.okta.com/okta_help.htm?type=oie&id=reserved-attributes). + type: object + properties: + id: + type: string + description: The subschema name + readOnly: true + properties: + type: object + description: The `#custom` object properties + additionalProperties: + $ref: '#/components/schemas/UserSchemaAttribute' + required: + type: array + description: A collection indicating required property names + readOnly: true + items: + type: string + type: + type: string + description: The object type + readOnly: true + UserSchemaPropertiesProfile: + type: object + properties: + allOf: + type: array + items: + $ref: '#/components/schemas/UserSchemaPropertiesProfileItem' + HrefObjectSelfLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) + GroupSchemaBase: + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + id: + readOnly: true + type: string + description: The subschema name + properties: + description: The `#base` object properties + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + description: + description: Human readable description of the group + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + description: + type: string + description: Description of the property + enum: + items: + anyOf: + - type: string + - type: integer + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + externalName: + type: string + description: Name of the property as it exists in an external application + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + items: + $ref: '#/components/schemas/UserSchemaAttributeItems' + nullable: true + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + nullable: true + description: Maximum character length of a string property + minLength: + type: integer + nullable: true + description: Minimum character length of a string property + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` + and provides a mechanism to return a display name for the + `enum` value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must + keep the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + permissions: + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + type: array + nullable: true + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + description: >- + Determines whether a group attribute can be set at the + individual or group level + type: string + enum: + - NONE + - SELF + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + name: + description: Unique identifier for the group + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + description: + type: string + description: Description of the property + enum: + items: + anyOf: + - type: string + - type: integer + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + externalName: + type: string + description: Name of the property as it exists in an external application + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + items: + $ref: '#/components/schemas/UserSchemaAttributeItems' + nullable: true + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + nullable: true + description: Maximum character length of a string property + minLength: + type: integer + nullable: true + description: Minimum character length of a string property + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` + and provides a mechanism to return a display name for the + `enum` value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must + keep the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + permissions: + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + type: array + nullable: true + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + description: >- + Determines whether a group attribute can be set at the + individual or group level + type: string + enum: + - NONE + - SELF + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + required: + items: + type: string + type: array + description: A collection indicating required property names + readOnly: true + type: + description: The object type + type: string + readOnly: true + GroupSchemaCustom: + description: >- + All custom profile properties are defined in a profile subschema with + the resolution scope `#custom` + type: object + properties: + id: + readOnly: true + type: string + description: The subschema name + properties: + additionalProperties: + $ref: '#/components/schemas/GroupSchemaAttribute' + type: object + description: The `#custom` object properties + required: + items: + type: string + type: array + description: A collection indicating required property names + readOnly: true + type: + type: string + description: The object type + readOnly: true + LinkedObjectDetailsType: + description: The object type for this relationship + type: string + enum: + - USER + x-enumDescriptions: + USER: Specifies the type of object + LinkedHrefObject: + title: Link Object + additionalProperties: true + type: object + properties: + href: + type: string + description: Link URI + required: + - href + readOnly: true + HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + UIElement: + description: Specifies the configuration of an input field on an enrollment form + type: object + properties: + label: + type: string + description: Label name for the UI element + options: + type: object + description: UI Schema element options object + properties: + format: + type: string + description: Specifies how the input appears + enum: + - text + - radio + - select + - checkbox + - radio_yes_no + - radio_true_false + x-enumDescriptions: + text: The default format for the majority of property types + radio: >- + Radio button options. This option is only available for + `string` data types with an `enum` or `one of` constraint. + select: >- + Displays input as a dropdown list. This option is only + available for the `country-code` data type or a string data + type with an enum or one of constraint. + checkbox: >- + Displays input as a checkbox. This option is only available + for Boolean data types. + radio_yes_no: >- + Displays input as two radio buttons, one with the option `yes` + and the other `no`. This option is only available for Boolean + data types. + radio_true_false: >- + Displays input as two radio buttons, one with the option + `true` and the other `false`. This option is only available + for Boolean data types. + scope: + type: string + description: >- + Specifies the property bound to the input field. It must follow the + format `#/properties/PROPERTY_NAME` where `PROPERTY_NAME` is a + variable name for an attribute in `profile editor`. + type: + type: string + description: >- + Specifies the relationship between this input element and `scope`. + The `Control` value specifies that this input controls the value + represented by `scope`. + UserSchemaBaseProperties: + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + city: + description: City or locality component of the user's address (`locality`) + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user creation + or update, the `default` is used instead of setting the value to + `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity Provider + app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` and + provides a mechanism to return a display name for the `enum` + value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must keep + the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular expression + used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + costCenter: + description: Name of a cost center assigned to the user + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user creation + or update, the `default` is used instead of setting the value to + `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity Provider + app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` and + provides a mechanism to return a display name for the `enum` + value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must keep + the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular expression + used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + countryCode: + description: >- + Country name component of the user's address (`country`.) This + property uses [ISO 3166-1 alpha 2 "short" code + format](https://tools.ietf.org/html/draft-ietf-scim-core-schema-22#ref-ISO3166). + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user creation + or update, the `default` is used instead of setting the value to + `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity Provider + app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` and + provides a mechanism to return a display name for the `enum` + value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must keep + the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular expression + used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + department: + description: Name of the user's department + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user creation + or update, the `default` is used instead of setting the value to + `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity Provider + app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` and + provides a mechanism to return a display name for the `enum` + value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must keep + the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular expression + used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + displayName: + description: Name of the user, suitable for display to end users + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user creation + or update, the `default` is used instead of setting the value to + `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity Provider + app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` and + provides a mechanism to return a display name for the `enum` + value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must keep + the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular expression + used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true division: - allOf: - - $ref: '#/components/schemas/UserSchemaAttribute' description: Name of the user's division + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user creation + or update, the `default` is used instead of setting the value to + `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity Provider + app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` and + provides a mechanism to return a display name for the `enum` + value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must keep + the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular expression + used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true email: - allOf: - - $ref: '#/components/schemas/UserSchemaAttribute' description: >- - Primary email address of the user. This property is formatted - according to [RFC 5322 Section + Primary email address of the user. This property is formatted + according to [RFC 5322 Section + 3.2.3](https://datatracker.ietf.org/doc/html/rfc5322#section-3.2.3). + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user creation + or update, the `default` is used instead of setting the value to + `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity Provider + app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` and + provides a mechanism to return a display name for the `enum` + value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must keep + the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular expression + used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + employeeNumber: + description: Organization or company assigned unique identifier for the user + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user creation + or update, the `default` is used instead of setting the value to + `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity Provider + app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` and + provides a mechanism to return a display name for the `enum` + value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must keep + the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular expression + used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + firstName: + description: Given name of the user (`givenName`) + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user creation + or update, the `default` is used instead of setting the value to + `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity Provider + app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` and + provides a mechanism to return a display name for the `enum` + value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must keep + the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular expression + used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + honorificPrefix: + description: Honorific prefix(es) of the user or title in most Western languages + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user creation + or update, the `default` is used instead of setting the value to + `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity Provider + app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` and + provides a mechanism to return a display name for the `enum` + value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must keep + the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular expression + used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + honorificSuffix: + description: Honorific suffix(es) of the user + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user creation + or update, the `default` is used instead of setting the value to + `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity Provider + app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` and + provides a mechanism to return a display name for the `enum` + value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must keep + the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular expression + used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + lastName: + description: Family name of the user (`familyName`) + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user creation + or update, the `default` is used instead of setting the value to + `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity Provider + app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` and + provides a mechanism to return a display name for the `enum` + value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must keep + the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular expression + used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + locale: + description: >- + User's default location for purposes of localizing items such as + currency, date time format, numerical representations, and so on. + + + A locale value is a concatenation of the ISO 639-1 two-letter + language code, an underscore, and the ISO 3166-1 two-letter country + code. For example: `en_US` specifies the language English and + country US. This value is `en_US` by default. + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user creation + or update, the `default` is used instead of setting the value to + `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity Provider + app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` and + provides a mechanism to return a display name for the `enum` + value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must keep + the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular expression + used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + login: + description: >- + Unique identifier for the user (`userName`) + + + The login property is validated according to its pattern attribute, + which is a string. By default, the attribute is null. When the + attribute is null, the username is required to be formatted as an + email address as defined by [RFC 6531 Section + 3.3](http://tools.ietf.org/html/rfc6531#section-3.3). The pattern + can be set through the API to one of the following forms. (The Admin + Console provides access to the same forms.) + * A login pattern of `".+"` indicates that there is no restriction on usernames. Any non-empty, unique value is permitted, and the minimum length of five isn't enforced. In this case, usernames don't need to include the `@` character. If a name does include `@`, the portion ahead of the `@` can be used for logging in, provided it identifies a unique user within the org. + * A login pattern of the form `"[...]+"` indicates that usernames must only contain characters from the set given between the brackets. The enclosing brackets and final `+` are required for this form. Character ranges can be indicated using hyphens. To include the hyphen itself in the allowed set, the hyphen must appear first. Any characters in the set except the hyphen, a-z, A-Z, and 0-9 must be preceded by a backslash (`\`). For example, `"[a-z13579\.]+"` would restrict usernames to lowercase letters, odd digits, and periods, while `"[-a-zA-Z0-9]+"` would allow basic alphanumeric characters and hyphens. + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user creation + or update, the `default` is used instead of setting the value to + `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity Provider + app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` and + provides a mechanism to return a display name for the `enum` + value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must keep + the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular expression + used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + manager: + description: The `displayName` of the user's manager + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user creation + or update, the `default` is used instead of setting the value to + `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity Provider + app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` and + provides a mechanism to return a display name for the `enum` + value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must keep + the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular expression + used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + managerId: + description: The `id` of the user's manager + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user creation + or update, the `default` is used instead of setting the value to + `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity Provider + app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` and + provides a mechanism to return a display name for the `enum` + value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must keep + the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular expression + used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + middleName: + description: Middle name(s) of the user + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user creation + or update, the `default` is used instead of setting the value to + `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity Provider + app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` and + provides a mechanism to return a display name for the `enum` + value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must keep + the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular expression + used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + mobilePhone: + description: Mobile phone number of the user + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user creation + or update, the `default` is used instead of setting the value to + `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity Provider + app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` and + provides a mechanism to return a display name for the `enum` + value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must keep + the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular expression + used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + nickName: + description: Casual way to address the user in real life + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user creation + or update, the `default` is used instead of setting the value to + `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity Provider + app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` and + provides a mechanism to return a display name for the `enum` + value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must keep + the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular expression + used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + organization: + description: Name of the user's organization + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user creation + or update, the `default` is used instead of setting the value to + `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity Provider + app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` and + provides a mechanism to return a display name for the `enum` + value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must keep + the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular expression + used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + postalAddress: + description: Mailing address component of the user's address + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user creation + or update, the `default` is used instead of setting the value to + `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity Provider + app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` and + provides a mechanism to return a display name for the `enum` + value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must keep + the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular expression + used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + preferredLanguage: + description: >- + User's preferred written or spoken languages. This property is + formatted according to [RFC 7231 Section + 5.3.5](https://tools.ietf.org/html/rfc7231#section-5.3.5). + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user creation + or update, the `default` is used instead of setting the value to + `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity Provider + app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` and + provides a mechanism to return a display name for the `enum` + value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must keep + the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular expression + used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + primaryPhone: + description: Primary phone number of the user, such as home number + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user creation + or update, the `default` is used instead of setting the value to + `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity Provider + app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` and + provides a mechanism to return a display name for the `enum` + value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must keep + the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular expression + used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + profileUrl: + description: >- + URL of the user's online profile (for example, a web page.) This + property is formatted according to the [Relative Uniform Resource + Locators + specification](https://tools.ietf.org/html/draft-ietf-scim-core-schema-22#ref-ISO3166). + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user creation + or update, the `default` is used instead of setting the value to + `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity Provider + app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` and + provides a mechanism to return a display name for the `enum` + value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must keep + the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular expression + used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + secondEmail: + description: >- + Secondary email address of the user typically used for account + recovery. This property is formatted according to [RFC 5322 Section 3.2.3](https://datatracker.ietf.org/doc/html/rfc5322#section-3.2.3). - employeeNumber: - allOf: - - $ref: '#/components/schemas/UserSchemaAttribute' - description: Organization or company assigned unique identifier for the user - firstName: - allOf: - - $ref: '#/components/schemas/UserSchemaAttribute' - description: Given name of the user (`givenName`) - honorificPrefix: - allOf: - - $ref: '#/components/schemas/UserSchemaAttribute' - description: Honorific prefix(es) of the user or title in most Western languages - honorificSuffix: - allOf: - - $ref: '#/components/schemas/UserSchemaAttribute' - description: Honorific suffix(es) of the user - lastName: - allOf: - - $ref: '#/components/schemas/UserSchemaAttribute' - description: Family name of the user (`familyName`) - locale: - allOf: - - $ref: '#/components/schemas/UserSchemaAttribute' + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user creation + or update, the `default` is used instead of setting the value to + `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity Provider + app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` and + provides a mechanism to return a display name for the `enum` + value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must keep + the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular expression + used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + state: + description: State or region component of the user's address (`region`) + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user creation + or update, the `default` is used instead of setting the value to + `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity Provider + app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` and + provides a mechanism to return a display name for the `enum` + value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must keep + the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular expression + used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + streetAddress: + description: Full street address component of the user's address + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user creation + or update, the `default` is used instead of setting the value to + `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity Provider + app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` and + provides a mechanism to return a display name for the `enum` + value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must keep + the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular expression + used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + timezone: description: >- - User's default location for purposes of localizing items such as - currency, date time format, numerical representations, and so on. + User's time zone. This property is formatted according to the [IANA + Time Zone database format](https://tools.ietf.org/html/rfc6557). + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user creation + or update, the `default` is used instead of setting the value to + `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity Provider + app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` and + provides a mechanism to return a display name for the `enum` + value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must keep + the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular expression + used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true + title: + description: User's title, such as "Vice President" + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user creation + or update, the `default` is used instead of setting the value to + `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity Provider + app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` and + provides a mechanism to return a display name for the `enum` + value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` - A locale value is a concatenation of the ISO 639-1 two-letter - language code, an underscore, and the ISO 3166-1 two-letter country - code. For example: `en_US` specifies the language English and - country US. This value is `en_US` by default. - login: - allOf: - - $ref: '#/components/schemas/UserSchemaAttribute' - description: >- - Unique identifier for the user (`userName`) + When `enum` is used in conjunction with `oneOf`, you must keep + the set of enumerated values and their order.
+ For example: - The login property is validated according to its pattern attribute, - which is a string. By default, the attribute is null. When the - attribute is null, the username is required to be formatted as an - email address as defined by [RFC 6531 Section - 3.3](http://tools.ietf.org/html/rfc6531#section-3.3). The pattern - can be set through the API to one of the following forms. (The Admin - Console provides access to the same forms.) - * A login pattern of `".+"` indicates that there is no restriction on usernames. Any non-empty, unique value is permitted, and the minimum length of five isn't enforced. In this case, usernames don't need to include the `@` character. If a name does include `@`, the portion ahead of the `@` can be used for logging in, provided it identifies a unique user within the org. - * A login pattern of the form `"[...]+"` indicates that usernames must only contain characters from the set given between the brackets. The enclosing brackets and final `+` are required for this form. Character ranges can be indicated using hyphens. To include the hyphen itself in the allowed set, the hyphen must appear first. Any characters in the set except the hyphen, a-z, A-Z, and 0-9 must be preceded by a backslash (`\`). For example, `"[a-z13579\.]+"` would restrict usernames to lowercase letters, odd digits, and periods, while `"[-a-zA-Z0-9]+"` would allow basic alphanumeric characters and hyphens. - manager: - allOf: - - $ref: '#/components/schemas/UserSchemaAttribute' - description: The `displayName` of the user's manager - managerId: - allOf: - - $ref: '#/components/schemas/UserSchemaAttribute' - description: The `id` of the user's manager - middleName: - allOf: - - $ref: '#/components/schemas/UserSchemaAttribute' - description: Middle name(s) of the user - mobilePhone: - allOf: - - $ref: '#/components/schemas/UserSchemaAttribute' - description: Mobile phone number of the user - nickName: - allOf: - - $ref: '#/components/schemas/UserSchemaAttribute' - description: Casual way to address the user in real life - organization: - allOf: - - $ref: '#/components/schemas/UserSchemaAttribute' - description: Name of the user's organization - postalAddress: - allOf: - - $ref: '#/components/schemas/UserSchemaAttribute' - description: Mailing address component of the user's address - preferredLanguage: - allOf: - - $ref: '#/components/schemas/UserSchemaAttribute' - description: >- - User's preferred written or spoken languages. This property is - formatted according to [RFC 7231 Section - 5.3.5](https://tools.ietf.org/html/rfc7231#section-5.3.5). - primaryPhone: - allOf: - - $ref: '#/components/schemas/UserSchemaAttribute' - description: Primary phone number of the user, such as home number - profileUrl: - allOf: - - $ref: '#/components/schemas/UserSchemaAttribute' - description: >- - URL of the user's online profile (for example, a web page.) This - property is formatted according to the [Relative Uniform Resource - Locators - specification](https://tools.ietf.org/html/draft-ietf-scim-core-schema-22#ref-ISO3166). - secondEmail: - allOf: - - $ref: '#/components/schemas/UserSchemaAttribute' - description: >- - Secondary email address of the user typically used for account - recovery. This property is formatted according to [RFC 5322 Section - 3.2.3](https://datatracker.ietf.org/doc/html/rfc5322#section-3.2.3). - state: - allOf: - - $ref: '#/components/schemas/UserSchemaAttribute' - description: State or region component of the user's address (`region`) - streetAddress: - allOf: - - $ref: '#/components/schemas/UserSchemaAttribute' - description: Full street address component of the user's address - timezone: - allOf: - - $ref: '#/components/schemas/UserSchemaAttribute' - description: >- - User's time zone. This property is formatted according to the [IANA - Time Zone database format](https://tools.ietf.org/html/rfc6557). - title: - allOf: - - $ref: '#/components/schemas/UserSchemaAttribute' - description: User's title, such as "Vice President" + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular expression + used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true userType: - allOf: - - $ref: '#/components/schemas/UserSchemaAttribute' description: >- Used to describe the organization to the user relationship such as "Employee" or "Contractor". @@ -1775,30 +12058,351 @@ components: **Note:** The `userType` field is an arbitrary string value and isn't related to the newer [User - Types](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/) + Types](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/) feature. + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user creation + or update, the `default` is used instead of setting the value to + `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity Provider + app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` and + provides a mechanism to return a display name for the `enum` + value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must keep + the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular expression + used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true zipCode: - allOf: - - $ref: '#/components/schemas/UserSchemaAttribute' description: >- ZIP code or postal code component of the user's address (`postalCode`) + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + default: + description: >- + If specified, assigns the value as the default value for the + custom attribute. This is a nullable property. If you don't + specify a value for this custom attribute during user creation + or update, the `default` is used instead of setting the value to + `null` or empty. + type: string + description: + type: string + description: Description of the property + enum: + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + items: + anyOf: + - type: string + - type: integer + externalName: + type: string + description: >- + Name of the property as it exists in an external application + + + **NOTE**: When you add a custom property, only Identity Provider + app user schemas require `externalName` to be + + included in the request body. If an existing custom Identity + Provider app user schema property has an empty + + `externalName`, requests aren't allowed to update other + properties until the `externalName` is defined. + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + description: Maximum character length of a string property + nullable: true + minLength: + type: integer + description: Minimum character length of a string property + nullable: true + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` and + provides a mechanism to return a display name for the `enum` + value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must keep + the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + pattern: + type: string + description: >- + For `string` property types, specifies the regular expression + used to validate the property + permissions: + type: array + nullable: true + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + $ref: '#/components/schemas/UserSchemaAttributeScope' + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true + x-okta-allow-null-property-value-for-updates: true UserSchemaAttribute: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: default: - oneOf: - - type: string - - type: boolean - - type: integer - - type: array - - type: object - - type: number description: >- If specified, assigns the value as the default value for the custom attribute. This is a nullable property. If you don't specify a value for this custom attribute during user creation or update, the `default` is used instead of setting the value to `null` or empty. + type: string description: type: string description: Description of the property @@ -1835,12 +12439,29 @@ components: description: Namespace from the external application format: description: Identifies the type of data represented by the string - allOf: - - $ref: '#/components/schemas/UserSchemaAttributeFormat' + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri master: - allOf: - - $ref: '#/components/schemas/UserSchemaAttributeMaster' description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' maxLength: type: integer description: Maximum character length of a string property @@ -1850,9 +12471,13 @@ components: description: Minimum character length of a string property nullable: true mutability: - allOf: - - $ref: '#/components/schemas/UserSchemaAttributeMutabilityString' description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY oneOf: type: array nullable: true @@ -1919,8 +12544,13 @@ components: description: User-defined display name for the property type: description: Type of property - allOf: - - $ref: '#/components/schemas/UserSchemaAttributeType' + type: string + enum: + - array + - boolean + - integer + - number + - string unique: description: Determines whether property values must be unique type: boolean @@ -1932,6 +12562,7 @@ components: $ref: type: string GroupSchemaBaseProperties: + x-okta-ignore-redocly-rules-for-sdk: true description: >- All Okta-defined profile properties are defined in a profile subschema with the resolution scope `#base`. These properties can't be removed or @@ -1940,13 +12571,306 @@ components: properties: description: description: Human readable description of the group - allOf: - - $ref: '#/components/schemas/GroupSchemaAttribute' + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + description: + type: string + description: Description of the property + enum: + items: + anyOf: + - type: string + - type: integer + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + externalName: + type: string + description: Name of the property as it exists in an external application + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + items: + $ref: '#/components/schemas/UserSchemaAttributeItems' + nullable: true + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + nullable: true + description: Maximum character length of a string property + minLength: + type: integer + nullable: true + description: Minimum character length of a string property + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` and + provides a mechanism to return a display name for the `enum` + value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must keep + the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + permissions: + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + type: array + nullable: true + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + description: >- + Determines whether a group attribute can be set at the + individual or group level + type: string + enum: + - NONE + - SELF + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true name: description: Unique identifier for the group - allOf: - - $ref: '#/components/schemas/GroupSchemaAttribute' + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + description: + type: string + description: Description of the property + enum: + items: + anyOf: + - type: string + - type: integer + type: array + nullable: true + description: >- + Enumerated value of the property. + + + The value of the property is limited to one of the values + specified in the enum definition. The list of values for the + enum must consist of unique elements. + externalName: + type: string + description: Name of the property as it exists in an external application + externalNamespace: + type: string + description: Namespace from the external application + format: + description: Identifies the type of data represented by the string + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri + items: + $ref: '#/components/schemas/UserSchemaAttributeItems' + nullable: true + master: + description: Identifies where the property is mastered + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' + maxLength: + type: integer + nullable: true + description: Maximum character length of a string property + minLength: + type: integer + nullable: true + description: Minimum character length of a string property + mutability: + description: Defines the mutability of the property + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY + oneOf: + items: + $ref: '#/components/schemas/UserSchemaAttributeEnum' + type: array + nullable: true + description: >- + Non-empty array of valid JSON schemas. + + + The `oneOf` key is only supported in conjunction with `enum` and + provides a mechanism to return a display name for the `enum` + value.
+ + Each schema has the following format: + + + ``` + + { + "const": "enumValue", + "title": "display name" + } + + ``` + + + When `enum` is used in conjunction with `oneOf`, you must keep + the set of enumerated values and their order.
+ + For example: + + + ``` + + "enum": ["S","M","L","XL"], + + "oneOf": [ + {"const": "S", "title": "Small"}, + {"const": "M", "title": "Medium"}, + {"const": "L", "title": "Large"}, + {"const": "XL", "title": "Extra Large"} + ] + ``` + permissions: + description: Access control permissions for the property + items: + $ref: '#/components/schemas/UserSchemaAttributePermission' + type: array + nullable: true + required: + type: boolean + nullable: true + description: Determines whether the property is required + scope: + description: >- + Determines whether a group attribute can be set at the + individual or group level + type: string + enum: + - NONE + - SELF + title: + type: string + minLength: 1 + description: User-defined display name for the property + type: + description: Type of property + type: string + enum: + - array + - boolean + - integer + - number + - string + unique: + description: Determines whether property values must be unique + type: boolean + nullable: true GroupSchemaAttribute: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: description: @@ -1974,15 +12898,32 @@ components: description: Namespace from the external application format: description: Identifies the type of data represented by the string - allOf: - - $ref: '#/components/schemas/UserSchemaAttributeFormat' + type: string + enum: + - country-code + - date-time + - email + - encrypted + - hashed + - language-code + - locale + - ref-id + - timezone + - uri items: $ref: '#/components/schemas/UserSchemaAttributeItems' nullable: true master: description: Identifies where the property is mastered - allOf: - - $ref: '#/components/schemas/UserSchemaAttributeMaster' + nullable: true + type: object + properties: + priority: + type: array + items: + $ref: '#/components/schemas/UserSchemaAttributeMasterPriority' + type: + $ref: '#/components/schemas/UserSchemaAttributeMasterType' maxLength: type: integer nullable: true @@ -1993,8 +12934,12 @@ components: description: Minimum character length of a string property mutability: description: Defines the mutability of the property - allOf: - - $ref: '#/components/schemas/UserSchemaAttributeMutabilityString' + type: string + enum: + - IMMUTABLE + - READ_ONLY + - READ_WRITE + - WRITE_ONLY oneOf: items: $ref: '#/components/schemas/UserSchemaAttributeEnum' @@ -2052,16 +12997,23 @@ components: description: >- Determines whether a group attribute can be set at the individual or group level - allOf: - - $ref: '#/components/schemas/UserSchemaAttributeScope' + type: string + enum: + - NONE + - SELF title: type: string minLength: 1 description: User-defined display name for the property type: description: Type of property - allOf: - - $ref: '#/components/schemas/UserSchemaAttributeType' + type: string + enum: + - array + - boolean + - integer + - number + - string unique: description: Determines whether property values must be unique type: boolean @@ -2159,6 +13111,34 @@ components: - OKTA - OVERRIDE - PROFILE_MASTER + ListLogStreamSchemasResponse: + type: object + properties: + log_stream_schemas: + type: array + items: + $ref: '#/components/schemas/LogStreamSchema' + ListLinkedObjectDefinitionsResponse: + type: object + properties: + linked_object_definitions: + type: array + items: + $ref: '#/components/schemas/LinkedObject' + ListUserTypesResponse: + type: object + properties: + user_types: + type: array + items: + $ref: '#/components/schemas/UserType' + ListUISchemasResponse: + type: object + properties: + uischemas: + type: array + items: + $ref: '#/components/schemas/UISchemasResponseObject' responses: ErrorAccessDenied403: description: Forbidden @@ -2286,9 +13266,9 @@ components: type: object properties: profile: - allOf: - - $ref: '#/definitions/base' - - $ref: '#/definitions/custom' + $ref_unresolved: + - '#/definitions/base' + - '#/definitions/custom' AppUserSchemaAddRequest: value: definitions: @@ -2343,9 +13323,9 @@ components: type: object properties: profile: - allOf: - - $ref: '#/definitions/base' - - $ref: '#/definitions/custom' + $ref_unresolved: + - '#/definitions/base' + - '#/definitions/custom' GroupSchemaResponse: value: $schema: http://json-schema.org/draft-04/schema# @@ -2384,9 +13364,9 @@ components: name: group properties: profile: - allOf: - - $ref: '#/definitions/custom' - - $ref: '#/definitions/base' + $ref_unresolved: + - '#/definitions/custom' + - '#/definitions/base' title: Okta group type: object GroupSchemaAddRequest: @@ -2795,9 +13775,9 @@ components: type: object properties: profile: - allOf: - - $ref: '#/definitions/base' - - $ref: '#/definitions/custom' + $ref_unresolved: + - '#/definitions/base' + - '#/definitions/custom' UserSchemaDefaultResponse: value: id: https://{yourOktaDomain}/meta/schemas/user/default @@ -2860,9 +13840,9 @@ components: type: object properties: profile: - allOf: - - $ref: '#/definitions/base' - - $ref: '#/definitions/custom' + $ref_unresolved: + - '#/definitions/base' + - '#/definitions/custom' UserSchemaAddRequest: value: definitions: @@ -3265,6 +14245,9 @@ components: mediaType: application/json openAPIDocKey: '200' update_application_user_profile: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1meta~1schemas~1apps~1{appId}~1default/post' response: @@ -3292,6 +14275,9 @@ components: mediaType: application/json openAPIDocKey: '200' update_group_schema: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1meta~1schemas~1group~1default/post' response: @@ -3318,6 +14304,15 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.log_stream_schemas + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListLogStreamSchemasResponse' + transform: + body: |- + {{- $wrapped := printf "{\"log_stream_schemas\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 get_log_stream_schema: operation: $ref: '#/paths/~1api~1v1~1meta~1schemas~1logStream~1{logStreamType}/get' @@ -3326,10 +14321,10 @@ components: openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/log_stream_schemas/methods/list_log_stream_schemas - $ref: >- #/components/x-stackQL-resources/log_stream_schemas/methods/get_log_stream_schema + - $ref: >- + #/components/x-stackQL-resources/log_stream_schemas/methods/list_log_stream_schemas insert: [] update: [] delete: [] @@ -3345,7 +14340,21 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.linked_object_definitions + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListLinkedObjectDefinitionsResponse' + transform: + body: >- + {{- $wrapped := printf "{\"linked_object_definitions\":%s}" . + -}} + + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_linked_object_definition: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1meta~1schemas~1user~1linkedObjects/post' response: @@ -3363,14 +14372,14 @@ components: $ref: >- #/paths/~1api~1v1~1meta~1schemas~1user~1linkedObjects~1{linkedObjectName}/delete response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/linked_object_definitions/methods/list_linked_object_definitions - $ref: >- #/components/x-stackQL-resources/linked_object_definitions/methods/get_linked_object_definition + - $ref: >- + #/components/x-stackQL-resources/linked_object_definitions/methods/list_linked_object_definitions insert: - $ref: >- #/components/x-stackQL-resources/linked_object_definitions/methods/create_linked_object_definition @@ -3391,6 +14400,9 @@ components: mediaType: application/json openAPIDocKey: '200' update_user_profile: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1meta~1schemas~1user~1{schemaId}/post' response: @@ -3417,7 +14429,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.user_types + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListUserTypesResponse' + transform: + body: |- + {{- $wrapped := printf "{\"user_types\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_user_type: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1meta~1types~1user/post' response: @@ -3430,12 +14454,18 @@ components: mediaType: application/json openAPIDocKey: '200' update_user_type: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1meta~1types~1user~1{typeId}/post' response: mediaType: application/json openAPIDocKey: '200' replace_user_type: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1meta~1types~1user~1{typeId}/put' response: @@ -3445,13 +14475,13 @@ components: operation: $ref: '#/paths/~1api~1v1~1meta~1types~1user~1{typeId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: + - $ref: '#/components/x-stackQL-resources/user_types/methods/get_user_type' - $ref: >- #/components/x-stackQL-resources/user_types/methods/list_user_types - - $ref: '#/components/x-stackQL-resources/user_types/methods/get_user_type' insert: - $ref: >- #/components/x-stackQL-resources/user_types/methods/create_user_type @@ -3475,7 +14505,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.uischemas + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListUISchemasResponse' + transform: + body: |- + {{- $wrapped := printf "{\"uischemas\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_uischema: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1meta~1uischemas/post' response: @@ -3488,6 +14530,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_uischemas: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1meta~1uischemas~1{id}/put' response: @@ -3497,12 +14542,12 @@ components: operation: $ref: '#/paths/~1api~1v1~1meta~1uischemas~1{id}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: '#/components/x-stackQL-resources/ui_schemas/methods/list_uischemas' - $ref: '#/components/x-stackQL-resources/ui_schemas/methods/get_uischema' + - $ref: '#/components/x-stackQL-resources/ui_schemas/methods/list_uischemas' insert: - $ref: >- #/components/x-stackQL-resources/ui_schemas/methods/create_uischema @@ -3518,10 +14563,18 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 definitions: base: type: object diff --git a/providers/src/okta/v00.00.00000/services/oauth2.yaml b/providers/src/okta/v00.00.00000/services/oauth2.yaml index 9434038d..8113f0b2 100644 --- a/providers/src/okta/v00.00.00000/services/oauth2.yaml +++ b/providers/src/okta/v00.00.00000/services/oauth2.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: oauth2 API description: okta oauth2 API - version: 5.1.0 + version: 2026.07.2 paths: /oauth2/v1/clients/{clientId}/roles: get: @@ -15,15 +15,13 @@ paths: content: application/json: schema: - oneOf: - - $ref: '#/components/schemas/StandardRole' - - $ref: '#/components/schemas/CustomRole' + $ref: '#/components/schemas/ListRolesForClientResponse' examples: - Standard Roles: + Standard roles: $ref: '#/components/examples/StandardRolesListResponseClient' - Custom Roles: + Custom roles: $ref: '#/components/examples/CustomRolesListResponseClient' - IAM-based Standard Roles: + IAM-based standard roles: $ref: '#/components/examples/IAMStandardRolesListResponseClient' '403': $ref: '#/components/responses/ErrorAccessDenied403' @@ -40,6 +38,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathClientId' post: summary: Assign a client role description: >- @@ -52,7 +52,7 @@ paths: method to assign a custom role to a client is to create a binding between the custom role, the resource set, and the client app. See [Create a role resource set - binding](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/RoleDResourceSetBinding/#tag/RoleDResourceSetBinding/operation/createResourceSetBinding). + binding](https://developer.okta.com/docs/api/openapi/okta-management/management/roledresourcesetbinding/createresourcesetbinding). > **Notes:** @@ -69,13 +69,60 @@ paths: content: application/json: schema: - oneOf: - - $ref: '#/components/schemas/StandardRoleAssignmentSchema' - - $ref: '#/components/schemas/CustomRoleAssignmentSchema' + discriminator: + propertyName: type + mapping: + API_ACCESS_MANAGEMENT_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + APP_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + GROUP_MEMBERSHIP_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + HELP_DESK_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + ORG_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + READ_ONLY_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + REPORT_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + SUPER_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + USER_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + ACCESS_CERTIFICATIONS_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + ACCESS_REQUESTS_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + WORKFLOWS_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + CUSTOM: '#/components/schemas/CustomRoleAssignmentSchema' + title: Standard role + type: object + properties: + type: + type: string + description: >- + Specify a [standard admin + role](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#standard-roles), + an [IAM-based standard + role](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#iam-based-standard-roles), + or `CUSTOM` for a custom role type: + enum: + - ACCESS_CERTIFICATIONS_ADMIN + - ACCESS_REQUESTS_ADMIN + - API_ACCESS_MANAGEMENT_ADMIN + - APP_ADMIN + - GROUP_MEMBERSHIP_ADMIN + - HELP_DESK_ADMIN + - ORG_ADMIN + - READ_ONLY_ADMIN + - REPORT_ADMIN + - SUPER_ADMIN + - USER_ADMIN + - WORKFLOWS_ADMIN + resource-set: + type: string + description: Resource set ID + role: + type: string + description: Custom role ID + required: + - type + - role + - resource-set examples: - Standard Role: + Standard role: $ref: '#/components/examples/StandardRoleAssignmentRequest' - Custom Role Assignment: + Custom role assignment: $ref: '#/components/examples/CustomRoleAssignmentRequest' responses: '200': @@ -83,15 +130,93 @@ paths: content: application/json: schema: - oneOf: - - $ref: '#/components/schemas/StandardRole' - - $ref: '#/components/schemas/CustomRole' + discriminator: + propertyName: type + mapping: + API_ACCESS_MANAGEMENT_ADMIN: '#/components/schemas/StandardRole' + APP_ADMIN: '#/components/schemas/StandardRole' + GROUP_MEMBERSHIP_ADMIN: '#/components/schemas/StandardRole' + HELP_DESK_ADMIN: '#/components/schemas/StandardRole' + ORG_ADMIN: '#/components/schemas/StandardRole' + READ_ONLY_ADMIN: '#/components/schemas/StandardRole' + REPORT_ADMIN: '#/components/schemas/StandardRole' + SUPER_ADMIN: '#/components/schemas/StandardRole' + USER_ADMIN: '#/components/schemas/StandardRole' + ACCESS_CERTIFICATIONS_ADMIN: '#/components/schemas/CustomRole' + ACCESS_REQUESTS_ADMIN: '#/components/schemas/CustomRole' + WORKFLOWS_ADMIN: '#/components/schemas/CustomRole' + CUSTOM: '#/components/schemas/CustomRole' + title: Standard role assignment + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + assignmentType: + $ref: '#/components/schemas/RoleAssignmentType' + created: + type: string + description: Timestamp when the object was created + format: date-time + readOnly: true + id: + type: string + description: Role assignment ID + readOnly: true + label: + type: string + description: Label for the role assignment + readOnly: true + lastUpdated: + type: string + description: Timestamp when the object was last updated + format: date-time + readOnly: true + status: + type: string + enum: + - ACTIVE + - INACTIVE + description: Status of the role assignment + type: + $ref: '#/components/schemas/RoleType' + _embedded: + type: object + description: Optional embedded resources for the role assignment + properties: + targets: + type: object + description: Targets configured for the role assignment + properties: + groups: + type: array + description: Group targets + items: + $ref: '#/components/schemas/Group' + catalog: + description: App targets + properties: + apps: + type: array + items: + $ref: '#/components/schemas/CatalogApplication' + type: object + _links: + $ref: '#/components/schemas/LinksAssignee' + resource-set: + type: string + description: Resource set ID + readOnly: true + role: + type: string + description: Role ID + readOnly: true + required: + - type examples: - Standard Role: + Standard role: $ref: '#/components/examples/StandardRoleResponseClient' - Custom Role Assignment: + Custom role assignment: $ref: '#/components/examples/CustomRoleResponseClient' - IAM-based Role Assignment: + IAM-based role assignment: $ref: '#/components/examples/IAMStandardRolesListResponseClient' '403': $ref: '#/components/responses/ErrorAccessDenied403' @@ -108,8 +233,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathClientId' + parameters: + - $ref: '#/components/parameters/pathClientId' /oauth2/v1/clients/{clientId}/roles/{roleAssignmentId}: get: summary: Retrieve a client role @@ -123,15 +248,93 @@ paths: content: application/json: schema: - oneOf: - - $ref: '#/components/schemas/StandardRole' - - $ref: '#/components/schemas/CustomRole' + discriminator: + propertyName: type + mapping: + API_ACCESS_MANAGEMENT_ADMIN: '#/components/schemas/StandardRole' + APP_ADMIN: '#/components/schemas/StandardRole' + GROUP_MEMBERSHIP_ADMIN: '#/components/schemas/StandardRole' + HELP_DESK_ADMIN: '#/components/schemas/StandardRole' + ORG_ADMIN: '#/components/schemas/StandardRole' + READ_ONLY_ADMIN: '#/components/schemas/StandardRole' + REPORT_ADMIN: '#/components/schemas/StandardRole' + SUPER_ADMIN: '#/components/schemas/StandardRole' + USER_ADMIN: '#/components/schemas/StandardRole' + ACCESS_CERTIFICATIONS_ADMIN: '#/components/schemas/CustomRole' + ACCESS_REQUESTS_ADMIN: '#/components/schemas/CustomRole' + WORKFLOWS_ADMIN: '#/components/schemas/CustomRole' + CUSTOM: '#/components/schemas/CustomRole' + title: Standard role assignment + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + assignmentType: + $ref: '#/components/schemas/RoleAssignmentType' + created: + type: string + description: Timestamp when the object was created + format: date-time + readOnly: true + id: + type: string + description: Role assignment ID + readOnly: true + label: + type: string + description: Label for the role assignment + readOnly: true + lastUpdated: + type: string + description: Timestamp when the object was last updated + format: date-time + readOnly: true + status: + type: string + enum: + - ACTIVE + - INACTIVE + description: Status of the role assignment + type: + $ref: '#/components/schemas/RoleType' + _embedded: + type: object + description: Optional embedded resources for the role assignment + properties: + targets: + type: object + description: Targets configured for the role assignment + properties: + groups: + type: array + description: Group targets + items: + $ref: '#/components/schemas/Group' + catalog: + description: App targets + properties: + apps: + type: array + items: + $ref: '#/components/schemas/CatalogApplication' + type: object + _links: + $ref: '#/components/schemas/LinksAssignee' + resource-set: + type: string + description: Resource set ID + readOnly: true + role: + type: string + description: Role ID + readOnly: true + required: + - type examples: - Standard Role: + Standard role: $ref: '#/components/examples/StandardRoleResponseClient' - Custom Role Assignment: + Custom role assignment: $ref: '#/components/examples/CustomRoleResponseClient' - IAM-based Standard Role Assignment: + IAM-based standard role assignment: $ref: '#/components/examples/IAMStandardRoleResponseClient' '403': $ref: '#/components/responses/ErrorAccessDenied403' @@ -148,6 +351,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathClientId' + - $ref: '#/components/parameters/pathRoleAssignmentId' delete: summary: Unassign a client role description: >- @@ -173,9 +379,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathClientId' - - $ref: '#/components/parameters/pathRoleAssignmentId' + parameters: + - $ref: '#/components/parameters/pathClientId' + - $ref: '#/components/parameters/pathRoleAssignmentId' /oauth2/v1/clients/{clientId}/roles/{roleAssignmentId}/targets/catalog/apps: get: summary: List all client role app targets @@ -186,15 +392,15 @@ paths: parameters: - $ref: '#/components/parameters/queryAfter' - $ref: '#/components/parameters/queryLimit' + - $ref: '#/components/parameters/pathClientId' + - $ref: '#/components/parameters/pathRoleAssignmentId' responses: '200': description: Success content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/CatalogApplication' + $ref: '#/components/schemas/ListAppTargetRoleToClientResponse' examples: ClientRoleTargetExample: $ref: '#/components/examples/ClientRoleTargetResponseFacebookEx' @@ -215,9 +421,6 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathClientId' - - $ref: '#/components/parameters/pathRoleAssignmentId' /oauth2/v1/clients/{clientId}/roles/{roleAssignmentId}/targets/catalog/apps/{appName}: put: summary: Assign a client role app target @@ -256,6 +459,10 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathClientId' + - $ref: '#/components/parameters/pathRoleAssignmentId' + - $ref: '#/components/parameters/pathAppName' delete: summary: Unassign a client role app target description: >- @@ -268,7 +475,7 @@ paths: > If you need a role assignment that applies to all apps, delete the role assignment with the target and create another one. See [Unassign a client - role](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/RoleAssignmentClient/#tag/RoleAssignmentClient/operation/deleteRoleFromClient). + role](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/roleassignmentclient/other/deleterolefromclient). operationId: removeAppTargetRoleFromClient responses: '204': @@ -289,10 +496,10 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathClientId' - - $ref: '#/components/parameters/pathRoleAssignmentId' - - $ref: '#/components/parameters/pathAppName' + parameters: + - $ref: '#/components/parameters/pathClientId' + - $ref: '#/components/parameters/pathRoleAssignmentId' + - $ref: '#/components/parameters/pathAppName' /oauth2/v1/clients/{clientId}/roles/{roleAssignmentId}/targets/catalog/apps/{appName}/{appId}: put: summary: Assign a client role app instance target @@ -332,6 +539,11 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathClientId' + - $ref: '#/components/parameters/pathRoleAssignmentId' + - $ref: '#/components/parameters/pathAppName' + - $ref: '#/components/parameters/pathAppId' delete: summary: Unassign a client role app instance target description: >- @@ -344,7 +556,7 @@ paths: > If you need a role assignment that applies to all the apps, delete the role assignment with the instance target and create another one. See [Unassign a client - role](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/RoleAssignmentClient/#tag/RoleAssignmentClient/operation/deleteRoleFromClient). + role](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/roleassignmentclient/other/deleterolefromclient). operationId: removeAppTargetInstanceRoleForClient responses: '204': @@ -365,11 +577,11 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathClientId' - - $ref: '#/components/parameters/pathRoleAssignmentId' - - $ref: '#/components/parameters/pathAppName' - - $ref: '#/components/parameters/pathAppId' + parameters: + - $ref: '#/components/parameters/pathClientId' + - $ref: '#/components/parameters/pathRoleAssignmentId' + - $ref: '#/components/parameters/pathAppName' + - $ref: '#/components/parameters/pathAppId' /oauth2/v1/clients/{clientId}/roles/{roleAssignmentId}/targets/groups: get: summary: List all client role group targets @@ -383,15 +595,15 @@ paths: parameters: - $ref: '#/components/parameters/queryAfter' - $ref: '#/components/parameters/queryLimit' + - $ref: '#/components/parameters/pathClientId' + - $ref: '#/components/parameters/pathRoleAssignmentId' responses: '200': description: Success content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/Group' + $ref: '#/components/schemas/ListGroupTargetRoleForClientResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -407,9 +619,6 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathClientId' - - $ref: '#/components/parameters/pathRoleAssignmentId' /oauth2/v1/clients/{clientId}/roles/{roleAssignmentId}/targets/groups/{groupId}: put: summary: Assign a client role group target @@ -440,6 +649,10 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathClientId' + - $ref: '#/components/parameters/pathRoleAssignmentId' + - $ref: '#/components/parameters/pathGroupId' delete: summary: Unassign a client role group target description: >- @@ -451,7 +664,7 @@ paths: assignment. If you need a role assignment that applies to all groups, delete the role assignment with the target and create another one. See [Unassign a client - role](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/RoleAssignmentClient/#tag/RoleAssignmentClient/operation/deleteRoleFromClient). + role](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/roleassignmentclient/other/deleterolefromclient). operationId: removeGroupTargetRoleFromClient responses: '204': @@ -472,14 +685,15 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathClientId' - - $ref: '#/components/parameters/pathRoleAssignmentId' - - $ref: '#/components/parameters/pathGroupId' + parameters: + - $ref: '#/components/parameters/pathClientId' + - $ref: '#/components/parameters/pathRoleAssignmentId' + - $ref: '#/components/parameters/pathGroupId' components: schemas: StandardRole: - title: Standard Role Assignment + title: Standard role assignment + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: assignmentType: @@ -503,9 +717,11 @@ components: format: date-time readOnly: true status: - allOf: - - $ref: '#/components/schemas/LifecycleStatus' - - description: Status of the role assignment + type: string + enum: + - ACTIVE + - INACTIVE + description: Status of the role assignment type: $ref: '#/components/schemas/RoleType' _embedded: @@ -531,8 +747,11 @@ components: type: object _links: $ref: '#/components/schemas/LinksAssignee' + required: + - type CustomRole: title: Custom role assignment + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: assignmentType: @@ -548,7 +767,7 @@ components: readOnly: true label: type: string - description: Label for the custom role assignment + description: Label for the role assignment readOnly: true lastUpdated: type: string @@ -561,28 +780,47 @@ components: readOnly: true role: type: string - description: Custom role ID + description: Role ID readOnly: true status: - allOf: - - $ref: '#/components/schemas/LifecycleStatus' - - description: Status of the custom role assignment - type: type: string - description: CUSTOM for a custom role enum: - - CUSTOM + - ACTIVE + - INACTIVE + description: Status of the role assignment + type: + $ref: '#/components/schemas/RoleType' _links: $ref: '#/components/schemas/LinksCustomRoleResponse' + required: + - type StandardRoleAssignmentSchema: - title: Standard Role + title: Standard role type: object properties: type: type: string description: >- - Specify the standard or IAM-based role type. See [standard - roles](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#standard-roles). + Specify a [standard admin + role](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#standard-roles), an + [IAM-based standard + role](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#iam-based-standard-roles), + or `CUSTOM` for a custom role type: + enum: + - ACCESS_CERTIFICATIONS_ADMIN + - ACCESS_REQUESTS_ADMIN + - API_ACCESS_MANAGEMENT_ADMIN + - APP_ADMIN + - GROUP_MEMBERSHIP_ADMIN + - HELP_DESK_ADMIN + - ORG_ADMIN + - READ_ONLY_ADMIN + - REPORT_ADMIN + - SUPER_ADMIN + - USER_ADMIN + - WORKFLOWS_ADMIN + required: + - type CustomRoleAssignmentSchema: title: Custom Role type: object @@ -595,9 +833,18 @@ components: description: Custom role ID type: type: string - description: The type of role. Specify `CUSTOM` for a custom role. + description: >- + Specify a [standard admin + role](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#standard-roles), an + [IAM-based standard + role](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#iam-based-standard-roles), + or `CUSTOM` for a custom role type: enum: - CUSTOM + required: + - type + - role + - resource-set CatalogApplication: description: An app in the OIN catalog type: object @@ -620,7 +867,7 @@ components: readOnly: true description: >- Features supported by the app. See app - [features](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Application/#tag/Application/operation/listApplications!c=200&path=0/features&t=response). + [features](https://developer.okta.com/docs/api/openapi/okta-management/management/application/listapplications#application/listapplications/t=response&c=200&path=&d=0/features). items: type: string id: @@ -644,7 +891,7 @@ components: type: array description: >- Authentication mode for the app. See app - [signOnMode](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Application/#tag/Application/operation/listApplications!c=200&path=0/signOnMode&t=response). + [signOnMode](https://developer.okta.com/docs/api/openapi/okta-management/management/application/listapplications#application/listapplications/t=response&c=200&path=&d=0/signonmode). items: type: string status: @@ -674,6 +921,7 @@ components: self: $ref: '#/components/schemas/HrefObjectSelfLink' Group: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: created: @@ -709,29 +957,68 @@ components: _embedded: type: object description: Embedded resources related to the group - additionalProperties: - type: object - properties: {} readOnly: true + properties: + stats: + description: Statistics about the group + type: object + properties: + usersCount: + type: integer + format: int32 + description: Number of users in the group + appsCount: + type: integer + format: int32 + description: Number of apps associated with the group + groupPushMappingsCount: + type: integer + format: int32 + description: Number of group push mappings associated with the group + hasAdminPrivlege: + type: boolean + description: >- + Indicates if the group has admin privileges via a + group-level role assignment + app: + description: >- + If the group is sourced from an app, this object contains + information about that app + type: object + properties: + id: + type: string + description: The ID of the `AppInstance` + name: + type: string + description: The name of the `AppInstance` + label: + type: string + description: The user-facing display name of the `AppInstance` + signOnMode: + type: string + description: The configured sign-on mode for the `AppInstance` + example: SAML_1_1 _links: description: >- [Discoverable - resources](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Group/#tag/Group/operation/listGroups!c=200&path=_links&t=response) + resources](https://developer.okta.com/docs/api/openapi/okta-management/management/group/listgroups#group/listgroups/t=response&c=200&path=_links/source) related to the group - allOf: - - $ref: '#/components/schemas/LinksSelf' - - properties: - apps: - $ref: '#/components/schemas/HrefObject' - logo: - type: array - items: - $ref: '#/components/schemas/HrefObject' - source: - $ref: '#/components/schemas/HrefObject' - users: - $ref: '#/components/schemas/HrefObject' - type: object + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + apps: + $ref: '#/components/schemas/HrefObject' + logo: + type: array + items: + $ref: '#/components/schemas/HrefObject' + source: + $ref: '#/components/schemas/HrefObject' + users: + $ref: '#/components/schemas/HrefObject' + readOnly: true RoleAssignmentType: description: Role assignment type type: string @@ -749,40 +1036,66 @@ components: - ACTIVE - INACTIVE RoleType: - description: Standard role type + title: roleType + description: >- + | Role type | + Description | + + |------------------------------|-------------------------------------------------------------| + + | ACCESS_CERTIFICATIONS_ADMIN | Access Certifications Administrator + IAM-based standard role | + + | ACCESS_REQUESTS_ADMIN | Access Requests Administrator IAM-based + standard role | + + | API_ACCESS_MANAGEMENT_ADMIN | Access Management Administrator + standard role | + + | APP_ADMIN | Application Administrator standard + role | + + | CUSTOM | Custom admin + role | + + | GROUP_MEMBERSHIP_ADMIN | Group Membership Administrator standard + role | + + | HELP_DESK_ADMIN | Help Desk Administrator standard + role | + + | ORG_ADMIN | Organizational Administrator standard + role | + + | READ_ONLY_ADMIN | Read-Only Administrator standard + role | + + | REPORT_ADMIN | Report Administrator standard + role | + + | SUPER_ADMIN | Super Administrator standard + role | + + | USER_ADMIN | User Administrator standard + role | + + | WORKFLOWS_ADMIN | Workflows Administrator IAM-based + standard role | type: string enum: - ACCESS_CERTIFICATIONS_ADMIN - ACCESS_REQUESTS_ADMIN - API_ACCESS_MANAGEMENT_ADMIN - - API_ADMIN - APP_ADMIN - CUSTOM - GROUP_MEMBERSHIP_ADMIN - HELP_DESK_ADMIN - - MOBILE_ADMIN - ORG_ADMIN - READ_ONLY_ADMIN - REPORT_ADMIN - SUPER_ADMIN - USER_ADMIN - WORKFLOWS_ADMIN - x-enumDescriptions: - API_ACCESS_MANAGEMENT_ADMIN: Access Management Administrator - API_ADMIN: Access Management Administrator - APP_ADMIN: Application Administrator - CUSTOM: Custom label specified by the client - GROUP_MEMBERSHIP_ADMIN: Group Membership Administrator - HELP_DESK_ADMIN: Help Desk Administrator - MOBILE_ADMIN: Mobile Administrator - ORG_ADMIN: Organizational Administrator - READ_ONLY_ADMIN: Read-Only Administrator - REPORT_ADMIN: Report Administrator - SUPER_ADMIN: Super Administrator - USER_ADMIN: Group Administrator - WORKFLOWS_ADMIN: Workflows Administrator - ACCESS_CERTIFICATIONS_ADMIN: Access Certifications Administrator (predefined resource sets) - ACCESS_REQUESTS_ADMIN: Access Requests Administrator (predefined resource sets) LinksAssignee: description: >- Specifies link relations (see [Web @@ -846,34 +1159,116 @@ components: - ACTIVE - INACTIVE HrefObjectLogoLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the logo resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to the logo resource HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) GroupProfile: description: >- - Specifies required and optional properties for a group. The - `objectClass` of a group determines which additional properties are - available. + Profile for any group that is not imported from Active Directory. + Specifies the standard + + and custom profile properties for a group. + + + The `objectClass` for these groups is `okta:user_group`. You can extend group profiles with custom properties, but you must first add the properties to the group profile schema before you can reference them. Use the Profile Editor in the Admin Console or the [Schemas - API](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/)to - manage schema extensions. + API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/) + to manage schema extensions. Custom properties can contain HTML tags. It is the client's responsibility to escape or encode this data before displaying it. Use [best-practices](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) to prevent cross-site scripting. - anyOf: - - $ref: '#/components/schemas/OktaUserGroupProfile' - - $ref: '#/components/schemas/OktaActiveDirectoryGroupProfile' + type: object + properties: + description: + type: string + example: All users West of The Rockies + description: Description of the group + name: + type: string + example: West Coast users + description: Name of the group + dn: + type: string + example: CN=West Coast users,OU=West Coast,DC=example,DC=com + description: The distinguished name of the Windows group + externalId: + type: string + example: VKzYZ1C+IkSZxIWlrW5ITg== + description: Base-64 encoded GUID (`objectGUID`) of the Windows group + samAccountName: + type: string + example: West Coast users + description: Pre-Windows 2000 name of the Windows group + windowsDomainQualifiedName: + type: string + example: EXAMPLE\\West Coast users + description: Fully qualified name of the Windows group + x-okta-extensible: true GroupType: description: Determines how a group's profile and memberships are managed type: string @@ -905,6 +1300,7 @@ components: $ref: '#/components/schemas/HrefObjectSelfLink' readOnly: true HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object additionalProperties: true type: object @@ -934,25 +1330,160 @@ components: required: - href HrefObjectAssigneeLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the assignee resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to the assignee resource HrefObjectMemberLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the member resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to the member resource HrefObjectPermissionsLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the permissions resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to the permissions resource HrefObjectResourceSetLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource set resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to the resource set resource HrefObjectRoleLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the role resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to the role resource ErrorCause: type: object properties: @@ -967,6 +1498,19 @@ components: The `objectClass` for these groups is `okta:user_group`. + + + You can extend group profiles with custom properties, but you must first + add the properties to the group profile schema before you can reference + them. Use the Profile Editor in the Admin Console or the [Schemas + API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/) + to manage schema extensions. + + + Custom properties can contain HTML tags. It is the client's + responsibility to escape or encode this data before displaying it. Use + [best-practices](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) + to prevent cross-site scripting. type: object properties: description: @@ -979,10 +1523,24 @@ components: description: Name of the group x-okta-extensible: true OktaActiveDirectoryGroupProfile: - description: |- + description: >- Profile for a group that is imported from Active Directory. + The `objectClass` for such groups is `okta:windows_security_principal`. + + + You can extend group profiles with custom properties, but you must first + add the properties to the group profile schema before you can reference + them. Use the Profile Editor in the Admin Console or the [Schemas + API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/) + to manage schema extensions. + + + Custom properties can contain HTML tags. It is the client's + responsibility to escape or encode this data before displaying it. Use + [best-practices](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) + to prevent cross-site scripting. type: object properties: description: @@ -1024,6 +1582,45 @@ components: - GET - POST - PUT + ListRolesForClientResponse: + type: object + properties: + roles_for_client: + type: array + items: + oneOf: + - $ref: '#/components/schemas/StandardRole' + - $ref: '#/components/schemas/CustomRole' + discriminator: + propertyName: type + mapping: + API_ACCESS_MANAGEMENT_ADMIN: '#/components/schemas/StandardRole' + APP_ADMIN: '#/components/schemas/StandardRole' + GROUP_MEMBERSHIP_ADMIN: '#/components/schemas/StandardRole' + HELP_DESK_ADMIN: '#/components/schemas/StandardRole' + ORG_ADMIN: '#/components/schemas/StandardRole' + READ_ONLY_ADMIN: '#/components/schemas/StandardRole' + REPORT_ADMIN: '#/components/schemas/StandardRole' + SUPER_ADMIN: '#/components/schemas/StandardRole' + USER_ADMIN: '#/components/schemas/StandardRole' + ACCESS_CERTIFICATIONS_ADMIN: '#/components/schemas/CustomRole' + ACCESS_REQUESTS_ADMIN: '#/components/schemas/CustomRole' + WORKFLOWS_ADMIN: '#/components/schemas/CustomRole' + CUSTOM: '#/components/schemas/CustomRole' + ListAppTargetRoleToClientResponse: + type: object + properties: + app_target_role_to_client: + type: array + items: + $ref: '#/components/schemas/CatalogApplication' + ListGroupTargetRoleForClientResponse: + type: object + properties: + group_target_role_for_client: + type: array + items: + $ref: '#/components/schemas/Group' responses: ErrorAccessDenied403: description: Forbidden @@ -1055,7 +1652,7 @@ components: parameters: pathClientId: name: clientId - description: Client app ID + description: '`client_id` of the app' in: path required: true schema: @@ -1078,7 +1675,8 @@ components: The cursor to use for pagination. It is an opaque string that specifies your current location in the list and is obtained from the `Link` response header. See - [Pagination](https://developer.okta.com/docs/api/#pagination). + [Pagination](https://developer.okta.com/docs/api/#pagination) and [Link + header](https://developer.okta.com/docs/api/#link-header). queryLimit: name: limit in: query @@ -1314,7 +1912,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.roles_for_client + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListRolesForClientResponse' + transform: + body: |- + {{- $wrapped := printf "{\"roles_for_client\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 assign_role_to_client: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1oauth2~1v1~1clients~1{clientId}~1roles/post' response: @@ -1332,14 +1942,14 @@ components: $ref: >- #/paths/~1oauth2~1v1~1clients~1{clientId}~1roles~1{roleAssignmentId}/delete response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/client_roles/methods/list_roles_for_client - $ref: >- #/components/x-stackQL-resources/client_roles/methods/retrieve_client_role + - $ref: >- + #/components/x-stackQL-resources/client_roles/methods/list_roles_for_client insert: - $ref: >- #/components/x-stackQL-resources/client_roles/methods/assign_role_to_client @@ -1360,33 +1970,44 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.app_target_role_to_client + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListAppTargetRoleToClientResponse' + transform: + body: >- + {{- $wrapped := printf "{\"app_target_role_to_client\":%s}" . + -}} + + {{- $wrapped -}} + type: golang_template_text_v0.3.0 assign_app_target_role_to_client: operation: $ref: >- #/paths/~1oauth2~1v1~1clients~1{clientId}~1roles~1{roleAssignmentId}~1targets~1catalog~1apps~1{appName}/put response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' remove_app_target_role_from_client: operation: $ref: >- #/paths/~1oauth2~1v1~1clients~1{clientId}~1roles~1{roleAssignmentId}~1targets~1catalog~1apps~1{appName}/delete response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' assign_app_target_instance_role_for_client: operation: $ref: >- #/paths/~1oauth2~1v1~1clients~1{clientId}~1roles~1{roleAssignmentId}~1targets~1catalog~1apps~1{appName}~1{appId}/put response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' remove_app_target_instance_role_for_client: operation: $ref: >- #/paths/~1oauth2~1v1~1clients~1{clientId}~1roles~1{roleAssignmentId}~1targets~1catalog~1apps~1{appName}~1{appId}/delete response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: @@ -1395,10 +2016,10 @@ components: insert: [] update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/app_target_roles/methods/remove_app_target_role_from_client - $ref: >- #/components/x-stackQL-resources/app_target_roles/methods/remove_app_target_instance_role_for_client + - $ref: >- + #/components/x-stackQL-resources/app_target_roles/methods/remove_app_target_role_from_client replace: - $ref: >- #/components/x-stackQL-resources/app_target_roles/methods/assign_app_target_role_to_client @@ -1414,19 +2035,30 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.group_target_role_for_client + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListGroupTargetRoleForClientResponse' + transform: + body: >- + {{- $wrapped := printf "{\"group_target_role_for_client\":%s}" . + -}} + + {{- $wrapped -}} + type: golang_template_text_v0.3.0 assign_group_target_role_for_client: operation: $ref: >- #/paths/~1oauth2~1v1~1clients~1{clientId}~1roles~1{roleAssignmentId}~1targets~1groups~1{groupId}/put response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' remove_group_target_role_from_client: operation: $ref: >- #/paths/~1oauth2~1v1~1clients~1{clientId}~1roles~1{roleAssignmentId}~1targets~1groups~1{groupId}/delete response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: @@ -1445,7 +2077,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/okta_personal_settings.yaml b/providers/src/okta/v00.00.00000/services/okta_personal_settings.yaml index 1b3f0e8d..dee78fcb 100644 --- a/providers/src/okta/v00.00.00000/services/okta_personal_settings.yaml +++ b/providers/src/okta/v00.00.00000/services/okta_personal_settings.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: okta_personal_settings API description: okta okta_personal_settings API - version: 5.1.0 + version: 2026.07.2 paths: /okta-personal-settings/api/v1/edit-feature: put: @@ -124,14 +124,17 @@ components: Allow users to migrate apps from a Workforce account to an Okta Personal account PersonalAppsBlockList: + x-okta-ignore-redocly-rules-for-sdk: true description: >- Defines a list of email domains with a subset of the properties for each domain type: object properties: domains: - type: array description: List of blocked email domains + type: array + items: + type: string Error: title: Error type: object @@ -247,10 +250,13 @@ components: title: Settings methods: replace_okta_personal_admin_settings: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1okta-personal-settings~1api~1v1~1edit-feature/put' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: [] @@ -285,10 +291,13 @@ components: title: Blocked Email Domains methods: replace_blocked_email_domains: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1okta-personal-settings~1api~1v1~1export-blocklists/put' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: [] @@ -303,7 +312,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/orgs.yaml b/providers/src/okta/v00.00.00000/services/orgs.yaml index c8e24e52..53b76e0e 100644 --- a/providers/src/okta/v00.00.00000/services/orgs.yaml +++ b/providers/src/okta/v00.00.00000/services/orgs.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: orgs API description: okta orgs API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/orgs: post: @@ -213,7 +213,7 @@ components: `lastName`, and `login`. See - [profile](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#tag/User/operation/getUser!c=200&path=profile&t=response) + [profile](https://developer.okta.com/docs/api/openapi/okta-management/management/user/getuser#user/getuser/t=response&c=200&path=profile) for additional profile attributes. properties: firstName: @@ -455,6 +455,9 @@ components: title: Child Orgs methods: create_child_org: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1orgs/post' response: @@ -473,7 +476,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/policies.yaml b/providers/src/okta/v00.00.00000/services/policies.yaml index bc3f92bd..8b0a2ce3 100644 --- a/providers/src/okta/v00.00.00000/services/policies.yaml +++ b/providers/src/okta/v00.00.00000/services/policies.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: policies API description: okta policies API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/policies: get: @@ -14,36 +14,18 @@ paths: in: query required: true schema: - type: string - enum: - - OKTA_SIGN_ON - - PASSWORD - - MFA_ENROLL - - IDP_DISCOVERY - - ACCESS_POLICY - - DEVICE_SIGNAL_COLLECTION - - PROFILE_ENROLLMENT - - POST_AUTH_SESSION - - ENTITY_RISK - description: >- - Specifies the type of policy to return. The following policy types - are available only with the Okta Identity Engine - `ACCESS_POLICY`, - `DEVICE_SIGNAL_COLLECTION`, - `PROFILE_ENROLLMENT`, `POST_AUTH_SESSION`, and `ENTITY_RISK`. + $ref: '#/components/schemas/PolicyType' + description: Specifies the type of policy to return - name: status in: query schema: type: string - description: >- - Refines the query by the `status` of the policy - `ACTIVE` or - `INACTIVE` + description: Refines the query by the `status` of the policy - `ACTIVE` or `INACTIVE` - name: q in: query schema: type: string - description: >- - Refines the query by policy name prefix (startWith method) passed in - as `q=string` + description: Refines the query by policy name prefix (startWith method) passed in as `q=string` - name: expand in: query schema: @@ -58,9 +40,7 @@ paths: in: query schema: type: string - description: >- - Defines the number of policies returned, see - [Pagination](https://developer.okta.com/docs/api/#pagination) + description: Defines the number of policies returned, see [Pagination](https://developer.okta.com/docs/api/#pagination) - name: resourceId in: query schema: @@ -70,40 +50,43 @@ paths: in: query schema: type: string - description: >- - End page cursor for pagination, see - [Pagination](https://developer.okta.com/docs/api/#pagination) + description: End page cursor for pagination, see [Pagination](https://developer.okta.com/docs/api/#pagination) responses: '200': description: Success content: application/json: schema: - $ref: '#/components/schemas/Policy' + $ref: '#/components/schemas/ListPoliciesResponse' examples: password: - $ref: '#/components/examples/password-policy-response' + $ref: '#/components/examples/list-password-policy-response' mfa-enroll: - $ref: >- - #/components/examples/mfa-enroll-policy-with-grace-period-response + $ref: '#/components/examples/list-mfa-enroll-policy-response' idp-discovery: - $ref: '#/components/examples/idp-discovery-policy-response' + $ref: '#/components/examples/list-idp-discovery-policy-response' profile-enrollment: - $ref: '#/components/examples/profile-enrollment-policy-response' + $ref: '#/components/examples/list-profile-enrollment-policy-response' access-policy: $ref: '#/components/examples/list-access-policy-response' device-signal-collection-policy: - $ref: >- - #/components/examples/list-device-signal-collection-policy-response + $ref: '#/components/examples/list-device-signal-collection-policy-response' okta-sign-on-policy: $ref: '#/components/examples/list-okta-sign-on-policy-response' entity-risk-policy: $ref: '#/components/examples/list-entity-risk-policy-response' post-auth-session-policy: $ref: '#/components/examples/list-post-auth-session-policy-response' + session-violation-detection-policy: + $ref: '#/components/examples/list-session-violation-detection-policy-response' passwordWithBreachedProtection: - $ref: >- - #/components/examples/password-policy-with-breached-protection-response + $ref: '#/components/examples/list-password-policy-with-breached-protection-response' + mfa-enroll-grace-period: + $ref: '#/components/examples/list-mfa-enroll-policy-with-grace-period-response' + mfa-enroll-auto-enroll-disabled: + $ref: '#/components/examples/list-mfa-enroll-policy-auto-enroll-disabled-response' + identity-claim-sourcing-policy: + $ref: '#/components/examples/list-identity-claim-sourcing-policy-response' '403': $ref: '#/components/responses/ErrorAccessDenied403' '429': @@ -119,19 +102,15 @@ paths: isGenerallyAvailable: true post: summary: Create a policy - description: >- - Creates a policy. There are many types of policies that you can create. - See [Policies](https://developer.okta.com/docs/concepts/policies/) for - an overview of the types of policies available and links to more indepth - information. + description: Creates a policy. There are many types of policies that you can create. See [Policies](https://developer.okta.com/docs/concepts/policies/) for an overview of the types of policies available and links to more indepth information. operationId: createPolicy parameters: - name: activate description: This query parameter is only valid for Classic Engine orgs. in: query schema: - type: boolean - default: true + type: string + default: 'true' x-codegen-request-body-name: policy requestBody: content: @@ -150,8 +129,7 @@ paths: password: $ref: '#/components/examples/password-policy-response' mfa-enroll: - $ref: >- - #/components/examples/mfa-enroll-policy-with-grace-period-response + $ref: '#/components/examples/mfa-enroll-policy-with-grace-period-response' idp-discovery: $ref: '#/components/examples/idp-discovery-policy-response' profile-enrollment: @@ -159,13 +137,13 @@ paths: access-policy: $ref: '#/components/examples/create-access-policy-response' device-signal-collection-policy: - $ref: >- - #/components/examples/device-signal-collection-policy-response + $ref: '#/components/examples/device-signal-collection-policy-response' okta-sign-on-policy: $ref: '#/components/examples/create-okta-sign-on-policy-response' passwordWithBreachedProtection: - $ref: >- - #/components/examples/password-policy-with-breached-protection-response + $ref: '#/components/examples/password-policy-with-breached-protection-response' + mfa-enroll-auto-enroll-disabled: + $ref: '#/components/examples/mfa-enroll-policy-auto-enroll-disabled-response' '400': $ref: '#/components/responses/ErrorApiValidationFailed400' '403': @@ -184,14 +162,9 @@ paths: /api/v1/policies/simulate: post: summary: Create a policy simulation - description: >- - Creates a policy or policy rule simulation. The access simulation - evaluates policy and policy rules based on the existing policy rule - configuration. - - The evaluation result simulates what the real-world authentication flow - is and what policy rules have been applied or matched to the - authentication flow. + description: |- + Creates a policy or policy rule simulation. The access simulation evaluates policy and policy rules based on the existing policy rule configuration. + The evaluation result simulates what the real-world authentication flow is and what policy rules have been applied or matched to the authentication flow. operationId: createPolicySimulation x-codegen-request-body-name: simulatePolicy requestBody: @@ -208,13 +181,6 @@ paths: responses: '200': description: Success - content: - application/json: - schema: - $ref: '#/components/schemas/SimulatePolicyResponse' - examples: - SimulatePolicy: - $ref: '#/components/examples/SimulatePolicyResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -232,8 +198,8 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/simulateParameter' + parameters: + - $ref: '#/components/parameters/simulateParameter' /api/v1/policies/{policyId}: get: summary: Retrieve a policy @@ -245,6 +211,7 @@ paths: schema: type: string default: '' + - $ref: '#/components/parameters/pathPolicyId' responses: '200': description: Success @@ -256,8 +223,7 @@ paths: password: $ref: '#/components/examples/password-policy-response' mfa-enroll: - $ref: >- - #/components/examples/mfa-enroll-policy-with-grace-period-response + $ref: '#/components/examples/mfa-enroll-policy-response' idp-discovery: $ref: '#/components/examples/idp-discovery-policy-response' profile-enrollment: @@ -265,17 +231,23 @@ paths: access-policy: $ref: '#/components/examples/create-access-policy-response' device-signal-collection-policy: - $ref: >- - #/components/examples/device-signal-collection-policy-response + $ref: '#/components/examples/device-signal-collection-policy-response' okta-sign-on-policy: $ref: '#/components/examples/create-okta-sign-on-policy-response' entity-risk-policy: $ref: '#/components/examples/get-entity-risk-policy-response' post-auth-session-policy: $ref: '#/components/examples/get-post-auth-session-policy-response' + session-violation-detection-policy: + $ref: '#/components/examples/get-session-violation-detection-policy-response' passwordWithBreachedProtection: - $ref: >- - #/components/examples/password-policy-with-breached-protection-response + $ref: '#/components/examples/password-policy-with-breached-protection-response' + mfa-enroll-grace-period: + $ref: '#/components/examples/mfa-enroll-policy-with-grace-period-response' + mfa-enroll-auto-enroll-disabled: + $ref: '#/components/examples/mfa-enroll-policy-auto-enroll-disabled-response' + identity-claim-sourcing-policy: + $ref: '#/components/examples/get-identity-claim-sourcing-policy-response' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -313,8 +285,7 @@ paths: password: $ref: '#/components/examples/password-policy-response' mfa-enroll: - $ref: >- - #/components/examples/mfa-enroll-policy-with-grace-period-response + $ref: '#/components/examples/mfa-enroll-policy-response' idp-discovery: $ref: '#/components/examples/idp-discovery-policy-response' profile-enrollment: @@ -322,13 +293,15 @@ paths: access-policy: $ref: '#/components/examples/create-access-policy-response' device-signal-collection-policy: - $ref: >- - #/components/examples/device-signal-collection-policy-response + $ref: '#/components/examples/device-signal-collection-policy-response' okta-sign-on-policy: $ref: '#/components/examples/create-okta-sign-on-policy-response' passwordWithBreachedProtection: - $ref: >- - #/components/examples/password-policy-with-breached-protection-response + $ref: '#/components/examples/password-policy-with-breached-protection-response' + mfa-enroll-with-grace-period: + $ref: '#/components/examples/mfa-enroll-policy-with-grace-period-response' + mfa-enroll-auto-enroll-disabled: + $ref: '#/components/examples/mfa-enroll-policy-auto-enroll-disabled-response' '400': $ref: '#/components/responses/ErrorApiValidationFailed400' '403': @@ -346,6 +319,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathPolicyId' delete: summary: Delete a policy description: Deletes a policy @@ -368,19 +343,16 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathPolicyId' + parameters: + - $ref: '#/components/parameters/pathPolicyId' /api/v1/policies/{policyId}/app: get: deprecated: true summary: List all apps mapped to a policy - description: >- + description: |- Lists all applications mapped to a policy identified by `policyId` - - > **Note:** Use [List all resources mapped to a - Policy](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/Policy/#tag/Policy/operation/listPolicyMappings) - to list all applications mapped to a policy. + > **Note:** Use [List all resources mapped to a policy](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/policy/#tag/Policy/operation/listPolicyMappings) to list all applications mapped to a policy. operationId: listPolicyApps responses: '200': @@ -388,9 +360,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/Application' + $ref: '#/components/schemas/ListPolicyAppsResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -406,8 +376,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathPolicyId' + parameters: + - $ref: '#/components/parameters/pathPolicyId' /api/v1/policies/{policyId}/clone: post: summary: Clone an existing policy @@ -424,8 +394,7 @@ paths: password: $ref: '#/components/examples/password-policy-response' mfa-enroll: - $ref: >- - #/components/examples/mfa-enroll-policy-with-grace-period-response + $ref: '#/components/examples/mfa-enroll-policy-response' idp-discovery: $ref: '#/components/examples/idp-discovery-policy-response' profile-enrollment: @@ -435,8 +404,11 @@ paths: okta-sign-on-policy: $ref: '#/components/examples/create-okta-sign-on-policy-response' passwordWithBreachedProtection: - $ref: >- - #/components/examples/password-policy-with-breached-protection-response + $ref: '#/components/examples/password-policy-with-breached-protection-response' + mfa-enroll-with-grace-period: + $ref: '#/components/examples/mfa-enroll-policy-with-grace-period-response' + mfa-enroll-auto-enroll-disabled: + $ref: '#/components/examples/mfa-enroll-policy-auto-enroll-disabled-response' '400': $ref: '#/components/responses/ErrorApiValidationFailed400' '403': @@ -456,8 +428,8 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathPolicyId' + parameters: + - $ref: '#/components/parameters/pathPolicyId' /api/v1/policies/{policyId}/lifecycle/activate: post: summary: Activate a policy @@ -482,8 +454,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathPolicyId' + parameters: + - $ref: '#/components/parameters/pathPolicyId' /api/v1/policies/{policyId}/lifecycle/deactivate: post: summary: Deactivate a policy @@ -508,8 +480,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathPolicyId' + parameters: + - $ref: '#/components/parameters/pathPolicyId' /api/v1/policies/{policyId}/mappings: get: summary: List all resources mapped to a policy @@ -521,9 +493,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/PolicyMapping' + $ref: '#/components/schemas/ListPolicyMappingsResponse' examples: policy-mapping-response: $ref: '#/components/examples/policy-mapping-list-response' @@ -542,9 +512,14 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathPolicyId' post: summary: Map a resource to a policy - description: Maps a resource to a policy identified by `policyId` + description: |- + Maps a resource to a policy identified by `policyId` + + > **Note:** Use the [Assign an app sign-in policy](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/ApplicationPolicies/#tag/ApplicationPolicies/operation/assignApplicationPolicy) endpoint to assign an app sign-in policy to an app. operationId: mapResourceToPolicy requestBody: content: @@ -579,14 +554,12 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathPolicyId' + parameters: + - $ref: '#/components/parameters/pathPolicyId' /api/v1/policies/{policyId}/mappings/{mappingId}: get: summary: Retrieve a policy resource mapping - description: >- - Retrieves a resource mapping for a policy identified by `policyId` and - `mappingId` + description: Retrieves a resource mapping for a policy identified by `policyId` and `mappingId` operationId: getPolicyMapping responses: '200': @@ -613,11 +586,12 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathPolicyId' + - $ref: '#/components/parameters/pathPolicyMappingId' delete: summary: Delete a policy resource mapping - description: >- - Deletes the resource mapping for a policy identified by `policyId` and - `mappingId` + description: Deletes the resource mapping for a policy identified by `policyId` and `mappingId` operationId: deletePolicyResourceMapping responses: '204': @@ -638,9 +612,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathPolicyId' - - $ref: '#/components/parameters/pathPolicyMappingId' + parameters: + - $ref: '#/components/parameters/pathPolicyId' + - $ref: '#/components/parameters/pathPolicyMappingId' /api/v1/policies/{policyId}/rules: get: summary: List all policy rules @@ -652,34 +626,30 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/PolicyRule' + $ref: '#/components/schemas/ListPolicyRulesResponse' examples: okta-sign-on: $ref: '#/components/examples/list-all-sign-on-policy-rule-response' access: $ref: '#/components/examples/list-all-access-policy-rule-response' device-signal-collection: - $ref: >- - #/components/examples/list-all-device-signal-collection-rule-response + $ref: '#/components/examples/list-all-device-signal-collection-rule-response' entity-risk: - $ref: >- - #/components/examples/list-all-entity-risk-policy-rule-response + $ref: '#/components/examples/list-all-entity-risk-policy-rule-response' + identity-claim-sourcing: + $ref: '#/components/examples/list-all-identity-claim-sourcing-policy-rule-response' post-auth-session: - $ref: >- - #/components/examples/list-all-post-auth-session-policy-rule-response + $ref: '#/components/examples/list-all-post-auth-session-policy-rule-response' password: $ref: '#/components/examples/list-all-password-policy-rule-response' idp-discovery: - $ref: >- - #/components/examples/list-all-idp-discovery-policy-rule-response + $ref: '#/components/examples/list-all-idp-discovery-policy-rule-response' mfa-enroll: - $ref: >- - #/components/examples/list-all-mfa-enroll-policy-rule-response + $ref: '#/components/examples/list-all-mfa-enroll-policy-rule-response' profile-enrollment: - $ref: >- - #/components/examples/list-all-profile-enrollment-policy-rule-response + $ref: '#/components/examples/list-all-profile-enrollment-policy-rule-response' + session-violation-detection: + $ref: '#/components/examples/list-all-session-violation-detection-policy-rule-response' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -695,22 +665,25 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathPolicyId' + - $ref: '#/components/parameters/limitParameter' post: summary: Create a policy rule - description: >- + description: |- Creates a policy rule - - > **Note:** You can't create additional rules for the - `PROFILE_ENROLLMENT` or `POST_AUTH_SESSION` policies. + > **Note:** You can't create additional rules for the `PROFILE_ENROLLMENT`, `POST_AUTH_SESSION`, `CLIENT_UPDATE`, or `IDENTITY_CLAIM_SOURCING` policies. operationId: createPolicyRule parameters: - name: activate description: Set this parameter to `false` to create an `INACTIVE` rule. in: query schema: - type: boolean - default: true + type: string + default: 'true' + - $ref: '#/components/parameters/pathPolicyId' + - $ref: '#/components/parameters/limitParameter' x-codegen-request-body-name: policyRule requestBody: content: @@ -718,25 +691,18 @@ paths: schema: $ref: '#/components/schemas/PolicyRule' examples: - EnableSsprSecurityQuestionStepUp: - $ref: '#/components/examples/sspr-enabled-sq-step-up' - EnableSsprSSOStepUp: - $ref: '#/components/examples/sspr-enabled-sso-step-up' - EnableSsprNoStepUp: - $ref: '#/components/examples/sspr-enabled-no-step-up' - EnableSsprOAMP: - $ref: '#/components/examples/sspr-enabled-OAMP' + CreateAuthPolicyRuleDevicePlatformCondition: + $ref: '#/components/examples/create-auth-policy-rule-condition' Enable2FAPreciseAuth: - $ref: >- - #/components/examples/twofa-enabled-disallow-password-allow-phishing + $ref: '#/components/examples/twofa-enabled-disallow-password-allow-phishing' + CreateAuthPolicyRule2FAEnablePostAuthKmsi: + $ref: '#/components/examples/twofa-enabled-post-auth-kmsi-enabled' + CreateAuthPolicyRule2FADisablePostAuthKmsi: + $ref: '#/components/examples/twofa-enabled-post-auth-kmsi-disabled' + CreateAuthPolicyRuleAmc2Chains: + $ref: '#/components/examples/amc-two-chain' DeviceSignalCollectionRule: $ref: '#/components/examples/create-device-signal-collection-rule' - EnableSpecificRoutingRule: - $ref: '#/components/examples/idp-discovery-specific-routing-rule' - EnableDynamicRoutingRule: - $ref: '#/components/examples/idp-discovery-dynamic-routing-rule' - CreateAuthPolicyRuleDevicePlatformCondition: - $ref: '#/components/examples/create-auth-policy-rule-condition' SignOnPolicy: $ref: '#/components/examples/sign-on-policy-rule' SkipFactorChallengeOnPremRule: @@ -747,17 +713,32 @@ paths: $ref: '#/components/examples/cloud-rule' DenyRule: $ref: '#/components/examples/deny-rule' - CreateAuthPolicyRule2FAEnablePostAuthKmsi: - $ref: '#/components/examples/twofa-enabled-post-auth-kmsi-enabled' - CreateAuthPolicyRule2FADisablePostAuthKmsi: - $ref: '#/components/examples/twofa-enabled-post-auth-kmsi-disabled' - CreateAuthPolicyRuleAmc2Chains: - $ref: '#/components/examples/amc-two-chain' + EnableSpecificRoutingRule: + $ref: '#/components/examples/idp-discovery-specific-routing-rule' + EnableDynamicRoutingRule: + $ref: '#/components/examples/idp-discovery-dynamic-routing-rule' + EnableSsprSecurityQuestionStepUp: + $ref: '#/components/examples/sspr-enabled-sq-step-up' + EnableSsprSSOStepUp: + $ref: '#/components/examples/sspr-enabled-sso-step-up' + EnableSsprNoStepUp: + $ref: '#/components/examples/sspr-enabled-no-step-up' + EnableSsprOAMP: + $ref: '#/components/examples/sspr-enabled-OAMP' EnableSsprWithConstraints: - $ref: >- - #/components/examples/sspr-enabled-sso-step-up-with-constraints + $ref: '#/components/examples/sspr-enabled-sso-step-up-with-constraints' + EnableSsprNoEmailEnroll: + $ref: '#/components/examples/sspr-recovery-email-without-enrollment' EnableIdProofingForOamp: $ref: '#/components/examples/oamp-id-proofing-policy-rule' + DeviceConditionWithOamp: + $ref: '#/components/examples/device-condition-with-oamp-request' + PostAuthSessionRule: + $ref: '#/components/examples/post-auth-session-rule-example' + EntityRiskRule: + $ref: '#/components/examples/entity-risk-rule-example' + SessionViolationDetectionRule: + $ref: '#/components/examples/session-violation-detection-rule-example' required: true responses: '200': @@ -767,52 +748,54 @@ paths: schema: $ref: '#/components/schemas/PolicyRule' examples: - EnableSsprSecurityQuestionStepUp: - $ref: '#/components/examples/sspr-enabled-sq-step-up-response' - EnableSsprSSOStepUp: - $ref: '#/components/examples/sspr-enabled-sso-step-up-response' - EnableSsprNoStepUp: - $ref: '#/components/examples/sspr-enabled-no-step-up-response' - EnableSsprWithOAMP: - $ref: '#/components/examples/sspr-enabled-OAMP-response' Enable2FAPreciseAuth: - $ref: >- - #/components/examples/twofa-enabled-disallow-password-allow-phishing-response - EnableSpecificRoutingRule: - $ref: >- - #/components/examples/idp-discovery-specific-routing-rule-response - EnableDynamicRoutingRule: - $ref: >- - #/components/examples/idp-discovery-dynamic-routing-rule-response + $ref: '#/components/examples/twofa-enabled-disallow-password-allow-phishing-response' + CreateAuthPolicyRuleDevicePlatformCondition: + $ref: '#/components/examples/create-auth-policy-rule-condition-response' + CreateAuthPolicyRule2FAEnablePostAuthKmsi: + $ref: '#/components/examples/twofa-enabled-post-auth-kmsi-enabled-response' + CreateAuthPolicyRule2FADisablePostAuthKmsi: + $ref: '#/components/examples/twofa-enabled-post-auth-kmsi-disabled-response' + CreateAuthPolicyRuleAmc2Chains: + $ref: '#/components/examples/amc-two-chain' DeviceSignalCollectionRule: $ref: '#/components/examples/device-signal-collection-rule-response' - CreateAuthPolicyRuleDevicePlatformCondition: - $ref: >- - #/components/examples/create-auth-policy-rule-condition-response SignOnPolicy: $ref: '#/components/examples/sign-on-policy-rule-response' SkipFactorChallengeOnPremRule: - $ref: >- - #/components/examples/skip-factor-challenge-on-prem-rule-response + $ref: '#/components/examples/skip-factor-challenge-on-prem-rule-response' RadiusRule: $ref: '#/components/examples/radius-rule-response' CloudRule: $ref: '#/components/examples/cloud-rule-response' DenyRule: $ref: '#/components/examples/deny-rule-response' - CreateAuthPolicyRule2FAEnablePostAuthKmsi: - $ref: >- - #/components/examples/twofa-enabled-post-auth-kmsi-enabled-response - CreateAuthPolicyRule2FADisablePostAuthKmsi: - $ref: >- - #/components/examples/twofa-enabled-post-auth-kmsi-disabled-response - CreateAuthPolicyRuleAmc2Chains: - $ref: '#/components/examples/amc-two-chain' + EnableSpecificRoutingRule: + $ref: '#/components/examples/idp-discovery-specific-routing-rule-response' + EnableDynamicRoutingRule: + $ref: '#/components/examples/idp-discovery-dynamic-routing-rule-response' + EnableSsprSecurityQuestionStepUp: + $ref: '#/components/examples/sspr-enabled-sq-step-up-response' + EnableSsprSSOStepUp: + $ref: '#/components/examples/sspr-enabled-sso-step-up-response' + EnableSsprNoStepUp: + $ref: '#/components/examples/sspr-enabled-no-step-up-response' + EnableSsprWithOAMP: + $ref: '#/components/examples/sspr-enabled-OAMP-response' EnableSsprWithConstraints: - $ref: >- - #/components/examples/sspr-enabled-sso-step-up-with-constraints-response + $ref: '#/components/examples/sspr-enabled-sso-step-up-with-constraints-response' + EnableSsprNoEmailEnroll: + $ref: '#/components/examples/sspr-recovery-email-without-enrollment-response' EnableIdProofingForOamp: $ref: '#/components/examples/oamp-id-proofing-policy-rule-response' + DeviceConditionWithOamp: + $ref: '#/components/examples/device-condition-with-oamp-response' + PostAuthSessionRule: + $ref: '#/components/examples/post-auth-session-rule-response' + EntityRiskRule: + $ref: '#/components/examples/entity-risk-rule-response' + SessionViolationDetectionRule: + $ref: '#/components/examples/session-violation-detection-rule-response' '400': $ref: '#/components/responses/ErrorApiValidationFailed400' '403': @@ -830,9 +813,6 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathPolicyId' - - $ref: '#/components/parameters/limitParameter' /api/v1/policies/{policyId}/rules/{ruleId}: get: summary: Retrieve a policy rule @@ -846,45 +826,48 @@ paths: schema: $ref: '#/components/schemas/PolicyRule' examples: - EnableSsprSecurityQuestionStepUp: - $ref: '#/components/examples/sspr-enabled-sq-step-up-update' - EnableSsprSSOStepUp: - $ref: '#/components/examples/sspr-enabled-sso-step-up-update' - EnableSsprNoStepUp: - $ref: '#/components/examples/sspr-enabled-no-step-up-update' - EnableSsprWithOAMP: - $ref: '#/components/examples/sspr-enabled-OAMP-update' - EnableSpecificRoutingRule: - $ref: >- - #/components/examples/idp-discovery-specific-routing-rule-response - EnableDynamicRoutingRule: - $ref: >- - #/components/examples/idp-discovery-dynamic-routing-rule-response + AuthenticationPolicyRuleWithPlatformDeviceConstraints: + $ref: '#/components/examples/update-auth-policy-rule-condition-response' + AuthPolicyRule2FAEnablePostAuthKmsi: + $ref: '#/components/examples/twofa-enabled-post-auth-kmsi-enabled-response' + AuthPolicyRule2FADisablePostAuthKmsi: + $ref: '#/components/examples/twofa-enabled-post-auth-kmsi-disabled-response' + DeviceSignalCollectionRule: + $ref: '#/components/examples/device-signal-collection-rule-response' SignOnPolicy: $ref: '#/components/examples/sign-on-policy-rule-response' SkipFactorChallengeOnPremRule: - $ref: >- - #/components/examples/skip-factor-challenge-on-prem-rule-response + $ref: '#/components/examples/skip-factor-challenge-on-prem-rule-response' RadiusRule: $ref: '#/components/examples/radius-rule-response' CloudRule: $ref: '#/components/examples/cloud-rule-response' DenyRule: $ref: '#/components/examples/deny-rule-response' - DeviceSignalCollectionRule: - $ref: '#/components/examples/device-signal-collection-rule-response' - AuthenticationPolicyRuleWithPlatformDeviceConstraints: - $ref: >- - #/components/examples/update-auth-policy-rule-condition-response - AuthPolicyRule2FAEnablePostAuthKmsi: - $ref: >- - #/components/examples/twofa-enabled-post-auth-kmsi-enabled-response - AuthPolicyRule2FADisablePostAuthKmsi: - $ref: >- - #/components/examples/twofa-enabled-post-auth-kmsi-disabled-response + EnableSpecificRoutingRule: + $ref: '#/components/examples/idp-discovery-specific-routing-rule-response' + EnableDynamicRoutingRule: + $ref: '#/components/examples/idp-discovery-dynamic-routing-rule-response' + EnableSsprSecurityQuestionStepUp: + $ref: '#/components/examples/sspr-enabled-sq-step-up-update' + EnableSsprSSOStepUp: + $ref: '#/components/examples/sspr-enabled-sso-step-up-update' + EnableSsprNoStepUp: + $ref: '#/components/examples/sspr-enabled-no-step-up-update' + EnableSsprWithOAMP: + $ref: '#/components/examples/sspr-enabled-OAMP-update' EnableSsprWithConstraints: - $ref: >- - #/components/examples/sspr-enabled-sso-step-up-with-constraints-update + $ref: '#/components/examples/sspr-enabled-sso-step-up-with-constraints-update' + EnableSsprNoEmailEnroll: + $ref: '#/components/examples/sspr-recovery-email-without-enrollment-update' + PostAuthSessionRule: + $ref: '#/components/examples/post-auth-session-rule-response' + EntityRiskRule: + $ref: '#/components/examples/entity-risk-rule-response' + SessionViolationDetectionRule: + $ref: '#/components/examples/session-violation-detection-rule-response' + IdentityClaimSourcingRule: + $ref: '#/components/examples/identity-claim-sourcing-rule-response' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -900,11 +883,12 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathPolicyId' + - $ref: '#/components/parameters/pathRuleId' put: summary: Replace a policy rule - description: >- - Replaces the properties for a policy rule identified by `policyId` and - `ruleId` + description: Replaces the properties for a policy rule identified by `policyId` and `ruleId` operationId: replacePolicyRule x-codegen-request-body-name: policyRule requestBody: @@ -913,27 +897,14 @@ paths: schema: $ref: '#/components/schemas/PolicyRule' examples: - EnableSsprSecurityQuestionStepUp: - $ref: '#/components/examples/sspr-enabled-sq-step-up-update' - EnableSsprSSOStepUp: - $ref: '#/components/examples/sspr-enabled-sso-step-up-update' - EnableSsprNoStepUp: - $ref: '#/components/examples/sspr-enabled-no-step-up-update' - UpdateAuthenticationPolicyRuleWithPlatformDeviceConstraints: - $ref: '#/components/examples/update-auth-policy-rule-condition' - UpdateAllowedIdentifiersInUserProfilePolicy: - $ref: >- - #/components/examples/update-identifiers-in-user-profile-policy UpdateAuthPolicyRule2FAEnablePostAuthKmsi: $ref: '#/components/examples/twofa-enabled-post-auth-kmsi-enabled' UpdateAuthPolicyRule2FADisablePostAuthKmsi: $ref: '#/components/examples/twofa-enabled-post-auth-kmsi-disabled' + UpdateAuthenticationPolicyRuleWithPlatformDeviceConstraints: + $ref: '#/components/examples/update-auth-policy-rule-condition' UpdateDeviceSignalCollectionRule: $ref: '#/components/examples/update-device-signal-collection-rule' - EnableSpecificRoutingRule: - $ref: '#/components/examples/idp-discovery-specific-routing-rule' - EnableDynamicRoutingRule: - $ref: '#/components/examples/idp-discovery-dynamic-routing-rule' SignOnPolicy: $ref: '#/components/examples/sign-on-policy-rule' SkipFactorChallengeOnPremRule: @@ -944,9 +915,30 @@ paths: $ref: '#/components/examples/cloud-rule' DenyRule: $ref: '#/components/examples/deny-rule' + EnableSpecificRoutingRule: + $ref: '#/components/examples/idp-discovery-specific-routing-rule' + EnableDynamicRoutingRule: + $ref: '#/components/examples/idp-discovery-dynamic-routing-rule' + EnableSsprSecurityQuestionStepUp: + $ref: '#/components/examples/sspr-enabled-sq-step-up-update' + EnableSsprSSOStepUp: + $ref: '#/components/examples/sspr-enabled-sso-step-up-update' + EnableSsprNoStepUp: + $ref: '#/components/examples/sspr-enabled-no-step-up-update' + UpdateAllowedIdentifiersInUserProfilePolicy: + $ref: '#/components/examples/update-identifiers-in-user-profile-policy' EnableSsprWithConstraints: - $ref: >- - #/components/examples/sspr-enabled-sso-step-up-with-constraints-update + $ref: '#/components/examples/sspr-enabled-sso-step-up-with-constraints-update' + EnableSsprNoEmailEnroll: + $ref: '#/components/examples/sspr-recovery-email-without-enrollment-update' + PostAuthSessionRule: + $ref: '#/components/examples/post-auth-session-rule-example' + EntityRiskRule: + $ref: '#/components/examples/entity-risk-rule-example' + SessionViolationDetectionRule: + $ref: '#/components/examples/session-violation-detection-rule-example' + IdentityClaimSourcingRule: + $ref: '#/components/examples/identity-claim-sourcing-rule-example' required: true responses: '200': @@ -956,47 +948,48 @@ paths: schema: $ref: '#/components/schemas/PolicyRule' examples: - EnableSsprSecurityQuestionStepUp: - $ref: '#/components/examples/sspr-enabled-sq-step-up-response' - EnableSsprSSOStepUp: - $ref: '#/components/examples/sspr-enabled-sso-step-up-response' - EnableSsprNoStepUp: - $ref: '#/components/examples/sspr-enabled-no-step-up-response' - UpdateAuthenticationPolicyRuleWithPlatformDeviceConstraints: - $ref: >- - #/components/examples/update-auth-policy-rule-condition-response - UpdateAllowedIdentifiersInUserProfilePolicy: - $ref: >- - #/components/examples/update-identifiers-in-user-profile-policy-response UpdateAuthPolicyRule2FAEnablePostAuthKmsi: - $ref: >- - #/components/examples/twofa-enabled-post-auth-kmsi-enabled-response + $ref: '#/components/examples/twofa-enabled-post-auth-kmsi-enabled-response' UpdateAuthPolicyRule2FADisablePostAuthKmsi: - $ref: >- - #/components/examples/twofa-enabled-post-auth-kmsi-disabled-response + $ref: '#/components/examples/twofa-enabled-post-auth-kmsi-disabled-response' + UpdateAuthenticationPolicyRuleWithPlatformDeviceConstraints: + $ref: '#/components/examples/update-auth-policy-rule-condition-response' UpdateDeviceSignalCollectionRule: - $ref: >- - #/components/examples/update-device-signal-collection-rule-response + $ref: '#/components/examples/update-device-signal-collection-rule-response' EnableSpecificRoutingRule: - $ref: >- - #/components/examples/idp-discovery-specific-routing-rule-response + $ref: '#/components/examples/idp-discovery-specific-routing-rule-response' EnableDynamicRoutingRule: - $ref: >- - #/components/examples/idp-discovery-dynamic-routing-rule-response + $ref: '#/components/examples/idp-discovery-dynamic-routing-rule-response' SignOnPolicy: $ref: '#/components/examples/sign-on-policy-rule-response' SkipFactorChallengeOnPremRule: - $ref: >- - #/components/examples/skip-factor-challenge-on-prem-rule-response + $ref: '#/components/examples/skip-factor-challenge-on-prem-rule-response' RadiusRule: $ref: '#/components/examples/radius-rule-response' CloudRule: $ref: '#/components/examples/cloud-rule-response' DenyRule: $ref: '#/components/examples/deny-rule-response' + EnableSsprSecurityQuestionStepUp: + $ref: '#/components/examples/sspr-enabled-sq-step-up-response' + EnableSsprSSOStepUp: + $ref: '#/components/examples/sspr-enabled-sso-step-up-response' + EnableSsprNoStepUp: + $ref: '#/components/examples/sspr-enabled-no-step-up-response' + UpdateAllowedIdentifiersInUserProfilePolicy: + $ref: '#/components/examples/update-identifiers-in-user-profile-policy-response' EnableSsprWithConstraints: - $ref: >- - #/components/examples/sspr-enabled-sso-step-up-with-constraints-response + $ref: '#/components/examples/sspr-enabled-sso-step-up-with-constraints-response' + EnableSsprNoEmailEnroll: + $ref: '#/components/examples/sspr-recovery-email-without-enrollment-response' + PostAuthSessionRule: + $ref: '#/components/examples/post-auth-session-rule-response' + EntityRiskRule: + $ref: '#/components/examples/entity-risk-rule-response' + SessionViolationDetectionRule: + $ref: '#/components/examples/session-violation-detection-rule-response' + IdentityClaimSourcingRule: + $ref: '#/components/examples/identity-claim-sourcing-rule-response' '400': $ref: '#/components/responses/ErrorApiValidationFailed400' '403': @@ -1014,6 +1007,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathPolicyId' + - $ref: '#/components/parameters/pathRuleId' delete: summary: Delete a policy rule description: Deletes a policy rule identified by `policyId` and `ruleId` @@ -1037,9 +1033,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathPolicyId' - - $ref: '#/components/parameters/pathRuleId' + parameters: + - $ref: '#/components/parameters/pathPolicyId' + - $ref: '#/components/parameters/pathRuleId' /api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/activate: post: summary: Activate a policy rule @@ -1063,9 +1059,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathPolicyId' - - $ref: '#/components/parameters/pathRuleId' + parameters: + - $ref: '#/components/parameters/pathPolicyId' + - $ref: '#/components/parameters/pathRuleId' /api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate: post: summary: Deactivate a policy rule @@ -1089,12 +1085,42 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathPolicyId' - - $ref: '#/components/parameters/pathRuleId' + parameters: + - $ref: '#/components/parameters/pathPolicyId' + - $ref: '#/components/parameters/pathRuleId' components: schemas: + PolicyType: + description: All Okta orgs contain only one IdP discovery policy with an immutable default rule routing to your org's sign-in page. All Okta orgs also contain just one entity risk policy, one session protection policy, and one identity claims sourcing policy. + type: string + enum: + - ACCESS_POLICY + - ENTITY_RISK + - IDP_DISCOVERY + - MFA_ENROLL + - OKTA_SIGN_ON + - PASSWORD + - POST_AUTH_SESSION + - PROFILE_ENROLLMENT + - DEVICE_SIGNAL_COLLECTION + - SESSION_VIOLATION_DETECTION + - CLIENT_UPDATE + - IDENTITY_CLAIM_SOURCING + x-enumDescriptions: + ACCESS_POLICY: App sign-in policy + MFA_ENROLL: Authenticator enrollment policy + ENTITY_RISK: (Read-only) Entity risk policy + OKTA_SIGN_ON: Global session policy + IDP_DISCOVERY: (Read-only) IdP discovery policy + POST_AUTH_SESSION: (Read-only) Session violation enforcement policy + PASSWORD: Password policy + PROFILE_ENROLLMENT: User profile policy + DEVICE_SIGNAL_COLLECTION: Device signal collection policy + SESSION_VIOLATION_DETECTION: (Read-only) Session violation detection policy + CLIENT_UPDATE: (Read-only) Client update policy + IDENTITY_CLAIM_SOURCING: (Read-only) Identity claims sourcing policy Policy: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: created: @@ -1122,17 +1148,15 @@ components: description: Name of the policy type: string priority: - description: >- - Specifies the order in which this policy is evaluated in relation to - the other policies + description: Specifies the order in which this policy is evaluated in relation to the other policies type: integer default: Last / Lowest Priority, for example `1` status: - allOf: - - $ref: '#/components/schemas/LifecycleStatus' - - description: >- - Whether or not the policy is active. Use the `activate` query - parameter to set the status of a policy. + type: string + enum: + - ACTIVE + - INACTIVE + description: Whether or not the policy is active. Use the `activate` query parameter to set the status of a policy. system: description: Specifies whether Okta created the policy type: boolean @@ -1161,8 +1185,12 @@ components: PROFILE_ENROLLMENT: '#/components/schemas/ProfileEnrollmentPolicy' POST_AUTH_SESSION: '#/components/schemas/PostAuthSessionPolicy' ENTITY_RISK: '#/components/schemas/EntityRiskPolicy' + SESSION_VIOLATION_DETECTION: '#/components/schemas/SessionViolationDetectionPolicy' DEVICE_SIGNAL_COLLECTION: '#/components/schemas/DeviceSignalCollectionPolicy' + CLIENT_UPDATE: '#/components/schemas/ClientUpdatePolicy' + IDENTITY_CLAIM_SOURCING: '#/components/schemas/IdentityClaimSourcingPolicy' CreateOrUpdatePolicy: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: created: @@ -1190,17 +1218,15 @@ components: description: Name of the policy type: string priority: - description: >- - Specifies the order in which this policy is evaluated in relation to - the other policies + description: Specifies the order in which this policy is evaluated in relation to the other policies type: integer default: Last / Lowest Priority, for example `1` status: - allOf: - - $ref: '#/components/schemas/LifecycleStatus' - - description: >- - Whether or not the policy is active. Use the `activate` query - parameter to set the status of a policy. + type: string + enum: + - ACTIVE + - INACTIVE + description: Whether or not the policy is active. Use the `activate` query parameter to set the status of a policy. system: description: Specifies whether Okta created the policy type: boolean @@ -1238,21 +1264,18 @@ components: $ref: '#/components/schemas/PolicyContext' policyTypes: type: array - description: >- - Supported policy types for a simulate operation. The default value, - `null`, returns all types. + description: Supported policy types for a simulate operation. The default value, `null`, returns all types. items: $ref: '#/components/schemas/PolicyTypeSimulation' required: - appInstance SimulatePolicyResponse: - description: >- - The response body returned for a simulate policy operation. An array of - `evaluations`. + description: The response body returned for a simulate policy operation. An array of `evaluations`. items: $ref: '#/components/schemas/SimulatePolicyEvaluations' type: array Application: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: accessibility: @@ -1262,14 +1285,13 @@ components: format: date-time readOnly: true description: Timestamp when the application object was created + expressConfiguration: + $ref: '#/components/schemas/ApplicationExpressConfiguration' features: type: array - description: > + description: | Enabled app features - - > **Note:** See [Application - Features](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/ApplicationFeatures/) - for app provisioning features. + > **Note:** See [Application Features](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/applicationfeatures/) for app provisioning features. readOnly: true items: type: string @@ -1317,52 +1339,21 @@ components: - ENTITLEMENT_MANAGEMENT - PUSH_NEW_USERS_WITH_HASHED_PASSWORD x-enumDescriptions: - GROUP_PUSH: >- - Creates or links a group in the app when a mapping is defined - for a group in Okta. Okta is the source for group memberships - and all group members in Okta who are also assigned to the app - are synced as group members to the app. + GROUP_PUSH: Creates or links a group in the app when a mapping is defined for a group in Okta. Okta is the source for group memberships and all group members in Okta who are also assigned to the app are synced as group members to the app. IMPORT_NEW_USERS: Creates or links a user in Okta to a user from the app - IMPORT_PROFILE_UPDATES: >- - Updates a linked user's app profile during manual or scheduled - imports - IMPORT_USER_SCHEMA: >- - Discovers the profile schema for a user from the app - automatically - PROFILE_MASTERING: >- - Designates the app as the identity lifecycle and profile - attribute authority for linked users. The user's profile in Okta - is read-only. - PUSH_NEW_USERS: >- - Creates or links a user account in the app when assigning the - app to a user in Okta - PUSH_PASSWORD_UPDATES: >- - Updates the user's app password when their password changes in - Okta - PUSH_PROFILE_UPDATES: >- - Updates a user's profile in the app when the user's profile - changes in Okta (the profile source) - PUSH_USER_DEACTIVATION: >- - Deactivates a user's account in the app when unassigned from the - app in Okta or deactivated - REACTIVATE_USERS: >- - Reactivates an existing inactive user when provisioning a user - to the app - OUTBOUND_DEL_AUTH: >- - Okta user authentication requests are delegated to a third-party - app - DESKTOP_SSO: >- - Okta user authentication requests are handled by desktop SSO - negotiation (if possible) - FEDERATED_PROFILE: >- - App user profiles are synchronized at sign-in and profile-view - instances instead of during bulk imports - SUPPRESS_ACTIVATION_EMAIL: >- - Activation emails aren't sent to users sourced by AD and orgs - with DelAuth enabled - PUSH_PENDING_USERS: >- - Users are in PENDING state in Okta and are created but not - active in the sourced app user + IMPORT_PROFILE_UPDATES: Updates a linked user's app profile during manual or scheduled imports + IMPORT_USER_SCHEMA: Discovers the profile schema for a user from the app automatically + PROFILE_MASTERING: Designates the app as the identity lifecycle and profile attribute authority for linked users. The user's profile in Okta is read-only. + PUSH_NEW_USERS: Creates or links a user account in the app when assigning the app to a user in Okta + PUSH_PASSWORD_UPDATES: Updates the user's app password when their password changes in Okta + PUSH_PROFILE_UPDATES: Updates a user's profile in the app when the user's profile changes in Okta (the profile source) + PUSH_USER_DEACTIVATION: Deactivates a user's account in the app when unassigned from the app in Okta or deactivated + REACTIVATE_USERS: Reactivates an existing inactive user when provisioning a user to the app + OUTBOUND_DEL_AUTH: Okta user authentication requests are delegated to a third-party app + DESKTOP_SSO: Okta user authentication requests are handled by desktop SSO negotiation (if possible) + FEDERATED_PROFILE: App user profiles are synchronized at sign-in and profile-view instances instead of during bulk imports + SUPPRESS_ACTIVATION_EMAIL: Activation emails aren't sent to users sourced by AD and orgs with DelAuth enabled + PUSH_PENDING_USERS: Users are in PENDING state in Okta and are created but not active in the sourced app user MFA: App can verify credentials as a second factor UPDATE_EXISTING_USERNAME: App can update the user name for existing users EXCLUDE_USERNAME_UPDATE_ON_PROFILE_PUSH: Exclude username update during profile push @@ -1371,47 +1362,25 @@ components: IMPORT_SYNC_CONTACTS: Synchronize contacts DEVICE_COMPLIANCE: Apps support device compliance rules VPN_CONFIG: App supports pushing VPN configuration to OMM enrolled devices - IMPORT_SCHEMA_ENUM_VALUES: >- - App supports downloading schema enum values. You can download - custom objects and integrating them with UD without being tied - to the type metadata system. - SCIM_PROVISIONING: >- - App supports generic SCIM client provisioning and can leverage - SCIM standard for provisioning and push custom attributes to a - third-party app + IMPORT_SCHEMA_ENUM_VALUES: App supports downloading schema enum values. You can download custom objects and integrating them with UD without being tied to the type metadata system. + SCIM_PROVISIONING: App supports generic SCIM client provisioning and can leverage SCIM standard for provisioning and push custom attributes to a third-party app DEVICE_FILTER_IN_SIGN_ON_RULES: App supports filtering by client type in app sign-on rules - PROFILE_TEMPLATE_UPGRADE: >- - App supports profile template upgrades. This is primarily to - help roll out the profile template upgrade feature for - individual apps - DEFAULT_PUSH_STATUS_TO_PUSH: >- - App defaults Push status to `PUSH`. This feature is for apps, - such as SharePoint, that want to receive App User profile - updates even though they didn't implement traditional - PUSH_PROFILE_UPDATES in the client API. + PROFILE_TEMPLATE_UPGRADE: App supports profile template upgrades. This is primarily to help roll out the profile template upgrade feature for individual apps + DEFAULT_PUSH_STATUS_TO_PUSH: App defaults Push status to `PUSH`. This feature is for apps, such as SharePoint, that want to receive App User profile updates even though they didn't implement traditional PUSH_PROFILE_UPDATES in the client API. REAL_TIME_SYNC: Apps support real-time synchronization SSO: Apps support establishing a subject based on claims from an IdP - AUTHN_CONTEXT: >- - Apps support establishing an authentication context based on - claims from an IdP + AUTHN_CONTEXT: Apps support establishing an authentication context based on claims from an IdP JIT_PROVISIONING: Apps support provisioning a user based on claims from an IdP - GROUP_SYNC: >- - Apps support syncing group information based on claims from an - IdP + GROUP_SYNC: Apps support syncing group information based on claims from an IdP OPP_SCIM_INCREMENTAL_IMPORTS: Apps support incremental imports. Used for SCIM app instances - IN_MEMORY_APP_USER: >- - Apps support in-memory app users. This feature is used as an - alternative to Implicit App Assignment for a non-persisted app - user. + IN_MEMORY_APP_USER: Apps support in-memory app users. This feature is used as an alternative to Implicit App Assignment for a non-persisted app user. LOG_STREAMING: Apps support log streaming OAUTH_INTEGRATION: App is an OAuth 2.0 integration IDP: Apps support IdP functionalities PUSH_NEW_USERS_WITHOUT_PASSWORD: Don't send generated password for new users SKYHOOK_SERVICE: Use the Skyhook microservice for LCM operations ENTITLEMENT_MANAGEMENT: Marker to showcase which OIN apps are entitlement enabled - PUSH_NEW_USERS_WITH_HASHED_PASSWORD: >- - Send hashed password for new users. This feature is only used - for CIS to CIC migration. + PUSH_NEW_USERS_WITH_HASHED_PASSWORD: Send hashed password for new users. This feature is only used for CIS to CIC migration. id: type: string readOnly: true @@ -1431,22 +1400,13 @@ components: description: The Okta resource name (ORN) for the current app instance profile: type: object - description: >- - Contains any valid JSON schema for specifying properties that can be - referenced from a request (only available to OAuth 2.0 client apps). - - For example, add an app manager contact email address or define an - allowlist of groups that you can then reference using the Okta - Expression Language `getFilteredGroups` function. - + description: |- + Contains any valid JSON schema for specifying properties that can be referenced from a request (only available to OAuth 2.0 client apps). + For example, add an app manager contact email address or define an allowlist of groups that you can then reference using the Okta Expression Language `getFilteredGroups` function. > **Notes:** - > * `profile` isn't encrypted, so don't store sensitive data in it. - - > * `profile` doesn't limit the level of nesting in the JSON schema - you created, but there is a practical size limit. Okta recommends a - JSON schema size of 1 MB or less for best performance. + > * `profile` doesn't limit the level of nesting in the JSON schema you created, but there is a practical size limit. Okta recommends a JSON schema size of 1 MB or less for best performance. additionalProperties: true signOnMode: $ref: '#/components/schemas/ApplicationSignOnMode' @@ -1458,21 +1418,11 @@ components: $ref: '#/components/schemas/ApplicationVisibility' _embedded: type: object - description: >- - Embedded resources related to the app using the [JSON Hypertext - Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. If the `expand=user/{userId}` query parameter is - specified, then the assigned [Application - User](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/ApplicationUsers/) is - embedded. + description: Embedded resources related to the app using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. If the `expand=user/{userId}` query parameter is specified, then the assigned [Application User](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/applicationusers) is embedded. properties: user: type: object - description: >- - The specified [Application - User](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/ApplicationUsers/) - assigned to the app + description: The specified [Application User](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/applicationusers) assigned to the app additionalProperties: type: object properties: {} @@ -1495,32 +1445,82 @@ components: SECURE_PASSWORD_STORE: '#/components/schemas/SecurePasswordStoreApplication' WS_FEDERATION: '#/components/schemas/WsFederationApplication' PolicyMapping: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: id: type: string _links: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - properties: - application: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the mapped application - policy: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the mapped policy + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + application: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the mapped application + policy: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the mapped policy + readOnly: true PolicyMappingRequest: type: object properties: resourceId: type: string - description: Unique identifier of the resource to map + description: '[Policy ID](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/policy/#tag/Policy/operation/listPolicies!c=200&path=0/id&t=response) of the app sign-in policy that you want to map' resourceType: $ref: '#/components/schemas/PolicyMappingResourceType' PolicyRule: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: created: @@ -1547,16 +1547,14 @@ components: description: Priority of the rule nullable: true status: - allOf: - - $ref: '#/components/schemas/LifecycleStatus' - - description: >- - Whether or not the rule is active. Use the `activate` query - parameter to set the status of a rule. + type: string + enum: + - ACTIVE + - INACTIVE + description: Whether or not the rule is active. Use the `activate` query parameter to set the status of a rule. system: type: boolean - description: >- - Specifies whether Okta created the policy rule (`system=true`). You - can't delete policy rules that have `system` set to `true`. + description: Specifies whether Okta created the policy rule (`system=true`). You can't delete policy rules that have `system` set to `true`. default: false type: $ref: '#/components/schemas/PolicyRuleType' @@ -1573,35 +1571,15 @@ components: POST_AUTH_SESSION: '#/components/schemas/PostAuthSessionPolicyRule' ENTITY_RISK: '#/components/schemas/EntityRiskPolicyRule' MFA_ENROLL: '#/components/schemas/AuthenticatorEnrollmentPolicyRule' + SESSION_VIOLATION_DETECTION: '#/components/schemas/SessionViolationDetectionPolicyRule' DEVICE_SIGNAL_COLLECTION: '#/components/schemas/DeviceSignalCollectionPolicyRule' + CLIENT_UPDATE: '#/components/schemas/ClientUpdatePolicyRule' + IDENTITY_CLAIM_SOURCING: '#/components/schemas/IdentityClaimSourcingPolicyRule' LifecycleStatus: type: string enum: - ACTIVE - INACTIVE - PolicyType: - description: >- - All Okta orgs contain only one IdP discovery policy with an immutable - default rule routing to your org's sign-in page, one entity risk policy, - and one session protection policy. - - Creating or replacing a policy with the `IDP_DISCOVERY` type, the - `ENTITY_RISK` type, or the `POST_AUTH_SESSION` type isn't supported. - - The following policy types are available with Identity Engine: - `ACCESS_POLICY`, `PROFILE_ENROLLMENT`, `POST_AUTH_SESSION`, `DEVICE_SIGNAL_COLLECTION`, and `ENTITY_RISK`. - type: string - enum: - - DEVICE_SIGNAL_COLLECTION - - ACCESS_POLICY - - ENTITY_RISK - - IDP_DISCOVERY - - MFA_ENROLL - - OKTA_SIGN_ON - - PASSWORD - - POST_AUTH_SESSION - - PROFILE_ENROLLMENT PolicyLinks: type: object properties: @@ -1629,19 +1607,15 @@ components: description: An Okta code for this type of error errorId: type: string - description: >- - A unique identifier for this error. This can be used by Okta Support - to help with troubleshooting. + description: A unique identifier for this error. This can be used by Okta Support to help with troubleshooting. errorLink: type: string description: An Okta code for this type of error errorSummary: type: string - description: >- - A short description of what caused this error. Sometimes this - contains dynamically-generated information about your specific - error. + description: A short description of what caused this error. Sometimes this contains dynamically-generated information about your specific error. PolicyContext: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: device: @@ -1661,9 +1635,7 @@ components: description: The device assurance policy ID for the simulation groups: type: object - description: >- - An array of Group IDs for the simulate operation. Only user IDs or - Group IDs are allowed, not both. + description: An array of Group IDs for the simulate operation. Only user IDs or Group IDs are allowed, not both. properties: ids: type: array @@ -1685,11 +1657,19 @@ components: - LOW - MEDIUM - HIGH + minRiskLevel: + type: string + enum: + - LOW + - MEDIUM + - HIGH + x-okta-lifecycle: + lifecycle: LIMITED_GA + isGenerallyAvailable: false + SKUs: [] user: type: object - description: >- - The user ID for the simulate operation. Only user IDs or Group IDs - are allowed, not both. + description: The user ID for the simulate operation. Only user IDs or Group IDs are allowed, not both. properties: id: type: string @@ -1747,21 +1727,35 @@ components: description: Custom error page URL for the app loginRedirectUrl: type: string - description: >- + description: |- Custom login page URL for the app - - > **Note:** The `loginRedirectUrl` property is deprecated in - Identity Engine. This property is used with the custom app login - feature. Orgs that actively use this feature can continue to do so. - See [Okta-hosted sign-in (redirect - authentication)](https://developer.okta.com/docs/guides/redirect-authentication/) - or [configure IdP routing - rules](https://help.okta.com/okta_help.htm?type=oie&id=ext-cfg-routing-rules) - to redirect users to the appropriate sign-in app for orgs that don't - use the custom app login feature. + > **Note:** The `loginRedirectUrl` property is deprecated in Identity Engine. This property is used with the custom app login feature. Orgs that actively use this feature can continue to do so. See [Okta-hosted sign-in (redirect authentication)](https://developer.okta.com/docs/guides/redirect-authentication/) or [configure IdP routing rules](https://help.okta.com/okta_help.htm?type=oie&id=ext-cfg-routing-rules) to redirect users to the appropriate sign-in app for orgs that don't use the custom app login feature. selfService: type: boolean description: Represents whether the app can be self-assignable by users + ApplicationExpressConfiguration: + description: |- +
+ Indicates which Express Configuration capabilities the app supports and has enabled + type: object + properties: + enabledCapabilities: + type: array + description: Capabilities currently enabled for the app + items: + $ref: '#/components/schemas/ApplicationCapability' + example: + - SSO + supportedCapabilities: + type: array + description: Capabilities supported by the app + items: + $ref: '#/components/schemas/ApplicationCapability' + example: + - SSO + - PROVISIONING + - UNIVERSAL_LOGOUT + readOnly: true ApplicationLabel: description: User-defined display name for app type: string @@ -1773,36 +1767,20 @@ components: type: integer description: Number of licenses purchased for the app ApplicationSignOnMode: - description: > + description: | Authentication mode for the app - | signOnMode | Description | - | ---------- | ----------- | - | AUTO_LOGIN | Secure Web Authentication (SWA) | - | BASIC_AUTH | HTTP Basic Authentication with Okta Browser Plugin | - | BOOKMARK | Just a bookmark (no-authentication) | - - | BROWSER_PLUGIN | Secure Web Authentication (SWA) with Okta Browser - Plugin | - + | BROWSER_PLUGIN | Secure Web Authentication (SWA) with Okta Browser Plugin | | OPENID_CONNECT | Federated Authentication with OpenID Connect (OIDC) | - - | SAML_1_1 | Federated Authentication with SAML 1.1 WebSSO (not - supported for custom apps) | - + | SAML_1_1 | Federated Authentication with SAML 1.1 WebSSO (not supported for custom apps) | | SAML_2_0 | Federated Authentication with SAML 2.0 WebSSO | - - | SECURE_PASSWORD_STORE | Secure Web Authentication (SWA) with POST - (plugin not required) | - - | WS_FEDERATION | Federated Authentication with WS-Federation Passive - Requestor Profile | - + | SECURE_PASSWORD_STORE | Secure Web Authentication (SWA) with POST (plugin not required) | + | WS_FEDERATION | Federated Authentication with WS-Federation Passive Requestor Profile | Select the `signOnMode` for your custom app: type: string @@ -1825,12 +1803,9 @@ components: - INACTIVE readOnly: true ApplicationUniversalLogout: - description: >- -
- - Universal Logout properties for the app. These properties are only - returned and can't be updated. + description: |- +
+ Universal Logout properties for the app. These properties are only returned and can't be updated. x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false @@ -1840,9 +1815,7 @@ components: properties: identityStack: type: string - description: >- - Indicates whether the app uses a shared identity stack that may - cause the user to sign out of other apps by the same company + description: Indicates whether the app uses a shared identity stack that may cause the user to sign out of other apps by the same company enum: - SHARED - NOT_SHARED @@ -1855,11 +1828,7 @@ components: - GLOBAL_TOKEN_REVOCATION x-enumDescriptions: PROPRIETARY: Universal Logout is implemented with a proprietary method. - GLOBAL_TOKEN_REVOCATION: >- - Universal Logout is implemented with the [Global Token - Revocation](https://datatracker.ietf.org/doc/draft-parecki-oauth-global-token-revocation/) - protocol. See the [Global Token Revocation - API](https://developer.okta.com/docs/api/openapi/okta-oauth/oauth/tag/GlobalTokenRevocation/). + GLOBAL_TOKEN_REVOCATION: Universal Logout is implemented with the [Global Token Revocation](https://datatracker.ietf.org/doc/draft-parecki-oauth-global-token-revocation/) protocol. See the [Global Token Revocation API](https://developer.okta.com/docs/api/openapi/okta-oauth/oauth/tag/GlobalTokenRevocation/). example: PROPRIETARY status: type: string @@ -1870,26 +1839,18 @@ components: - UNSUPPORTED example: ENABLED x-enumDescriptions: - ENABLED: >- - Universal Logout is enabled. Users are signed out of the app - instance when the Okta system or an admin initiates logout. + ENABLED: Universal Logout is enabled. Users are signed out of the app instance when the Okta system or an admin initiates logout. DISABLED: Universal Logout is disabled UNSUPPORTED: The app doesn't support Universal Logout supportType: type: string - description: >- - Indicates whether the app supports full or partial Universal Logout - (UL). + description: Indicates whether the app supports full or partial Universal Logout (UL). enum: - FULL - PARTIAL x-enumDescriptions: - FULL: >- - Full UL support (users are signed out of an app when the Okta - system or an admin initiates logout) - PARTIAL: >- - This app's sign-out behavior can be different from other supported - UL apps. + FULL: Full UL support (users are signed out of an app when the Okta system or an admin initiates logout) + PARTIAL: This app's sign-out behavior can be different from other supported UL apps. example: FULL readOnly: true ApplicationVisibility: @@ -1898,9 +1859,7 @@ components: properties: appLinks: type: object - description: >- - Links or icons that appear on the End-User Dashboard if they're set - to `true`. + description: Links or icons that appear on the End-User Dashboard if they're set to `true`. additionalProperties: type: boolean autoLaunch: @@ -1943,19 +1902,14 @@ components: readOnly: true type: object LinksSelf: - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the - [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. This object is used for dynamic discovery of related - resources and lifecycle operations. + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. type: object properties: self: $ref: '#/components/schemas/HrefObjectSelfLink' readOnly: true HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object additionalProperties: true type: object @@ -1972,27 +1926,19 @@ components: readOnly: true templated: type: boolean - description: >- - Indicates whether the link object's `href` property is a URI - template. + description: Indicates whether the link object's `href` property is a URI template. readOnly: true type: type: string - description: >- - The media type of the link. If omitted, it is implicitly - `application/json`. + description: The media type of the link. If omitted, it is implicitly `application/json`. readOnly: true required: - href PolicyMappingResourceType: - description: >- - Specifies the type of resource to map. You can either map an app onto a - policy, or map a device signal collection policy onto an authentication - policy. + description: Specifies the type of resource to map. You can only map an app sign-in policy to a device signal collection policy (the `policyId` path parameter). type: string enum: - ACCESS_POLICY - - APP PolicyRuleType: description: Rule type type: string @@ -2006,32 +1952,150 @@ components: - POST_AUTH_SESSION - PROFILE_ENROLLMENT - SIGN_ON + - SESSION_VIOLATION_DETECTION + - CLIENT_UPDATE + - IDENTITY_CLAIM_SOURCING HrefObjectActivateLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to activate the resource - HrefObjectDeactivateLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to deactivate the resource - HrefObjectMappingsLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the mappings resource - HrefObjectRulesLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the rules resource - HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) - ErrorCause: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true type: object properties: - errorSummary: - type: string - SimulateResultPolicies: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to activate the resource + HrefObjectDeactivateLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to deactivate the resource + HrefObjectMappingsLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the mappings resource + HrefObjectRulesLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the rules resource + HrefObjectSelfLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) + ErrorCause: + type: object + properties: + errorSummary: + type: string + SimulateResultPolicies: items: $ref: '#/components/schemas/SimulateResultPoliciesItems' type: array @@ -2048,6 +2112,13 @@ components: - MATCH - NOT_MATCH - UNDEFINED + ApplicationCapability: + description: Capabilities supported by the app + type: string + enum: + - PROVISIONING + - SSO + - UNIVERSAL_LOGOUT ApplicationVisibilityHide: description: Hides the app for specific end-user apps type: object @@ -2063,34 +2134,140 @@ components: default: false example: true AccessPolicyLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the app access policy resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the app access policy resource GroupsLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: >- - Link to the [Application - Groups](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/ApplicationGroups/#tag/ApplicationGroups/operation/listApplicationGroupAssignments) - resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the [Application Groups](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/applicationgroups/other/listapplicationgroupassignments) resource HelpLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the app help resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the app help resource MetadataLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: >- - Link to the [SAML - metadata](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/ApplicationSSO/#tag/ApplicationSSO/operation/previewSAMLmetadataForApplication) - for SSO + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the [SAML metadata](https://developer.okta.com/docs/api/openapi/okta-management/management/applicationsso/previewsamlmetadataforapplication) for SSO UsersLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: >- - Link to the [Application - Users](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/ApplicationUsers/#tag/ApplicationUsers/operation/listApplicationUsers) - resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the [Application Users](https://developer.okta.com/docs/api/openapi/okta-management/management/applicationusers#tag/ApplicationUsers/operation/listApplicationUsers) resource HrefHints: description: Describes allowed HTTP verbs for the `href` type: object @@ -2150,6 +2327,41 @@ components: description: The name of the policy rule status: $ref: '#/components/schemas/SimulateResultStatus' + ListPoliciesResponse: + type: object + properties: + policies: + type: array + items: + $ref: '#/components/schemas/Policy' + CreatePolicySimulationResponse: + type: object + properties: + create_policy_simulation: + type: array + items: + $ref: '#/components/schemas/SimulatePolicyEvaluations' + ListPolicyAppsResponse: + type: object + properties: + policy_apps: + type: array + items: + $ref: '#/components/schemas/Application' + ListPolicyMappingsResponse: + type: object + properties: + policy_mappings: + type: array + items: + $ref: '#/components/schemas/PolicyMapping' + ListPolicyRulesResponse: + type: object + properties: + policy_rules: + type: array + items: + $ref: '#/components/schemas/PolicyRule' responses: ErrorAccessDenied403: description: Forbidden @@ -2190,17 +2402,14 @@ components: parameters: simulateParameter: name: expand - description: >- - Use `expand=EVALUATED` to include a list of evaluated but not matched - policies and policy rules. Use `expand=RULE` to include details about - why a rule condition wasn't matched. + description: Use `expand=EVALUATED` to include a list of evaluated but not matched policies and policy rules. Use `expand=RULE` to include details about why a rule condition wasn't matched. in: query schema: type: string example: EVALUATED pathPolicyId: name: policyId - description: '`id` of the Policy' + description: '`id` of the policy' in: path required: true schema: @@ -2219,9 +2428,7 @@ components: in: query schema: type: string - description: >- - Defines the number of policy rules returned. See - [Pagination](https://developer.okta.com/docs/api/#pagination). + description: Defines the number of policy rules returned. See [Pagination](https://developer.okta.com/docs/api/#pagination). pathRuleId: name: ruleId description: '`id` of the policy rule' @@ -2231,207 +2438,69 @@ components: type: string example: ruld3hJ7jZh4fn0st0g3 examples: - password-policy-response: + list-password-policy-response: summary: PASSWORD value: - type: PASSWORD - id: policyId - status: ACTIVE - name: Policy name - description: Policy description - priority: 1 - system: true - created: createdDate - lastUpdated: lastUpdated - conditions: - people: - groups: - include: - - groupId - authProvider: - provider: provider - settings: - password: - complexity: - minLength: 8 - minLowerCase: 1 - minUpperCase: 1 - minNumber: null - minSymbol: 0 - excludeUsername: true - dictionary: - common: - exclude: false - excludeAttributes: [] - age: - maxAgeDays: 0 - expireWarnDays: 0 - minAgeMinutes: 0 - historyCount: 4 - lockout: - maxAttempts: 0 - autoUnlockMinutes: 0 - userLockoutNotificationChannels: [] - showLockoutFailures: false - recovery: - factors: - recovery_question: - status: ACTIVE - properties: - complexity: - complexity: 4 - type: object - okta_email: - status: ACTIVE - properties: - recoveryToken: - tokenLifetimeMinutes: 10080 - type: object - okta_sms: - status: INACTIVE - okta_call: - status: INACTIVE - delegation: - options: - skipUnlock: false - _links: - self: - href: https://{yourOktaDomain}/api/v1/policies/{policyId} - hints: - allow: - - GET - - PUT - rules: - href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules - hints: - allow: - - POST - - GET - mfa-enroll-policy-with-grace-period-response: - summary: MFA_ENROLL - value: - type: MFA_ENROLL - id: policyId - status: ACTIVE - name: Policy name - description: Policy description - priority: 1 - system: true - created: createdDate - lastUpdated: lastUpdated - conditions: - people: - groups: - include: - - groupId - settings: - type: AUTHENTICATORS - authenticators: - - key: okta_email - enroll: - self: NOT_ALLOWED - - key: okta_verify - enroll: - self: OPTIONAL - - key: okta_password - enroll: - self: REQUIRED - - key: phone_number - enroll: - self: REQUIRED - gracePeriod: - type: BY_DATE_TIME - expiry: '2025-01-01T18:30:45.000Z' - _links: - self: - href: https://{yourOktaDomain}/api/v1/policies/{policyId} - hints: - allow: - - GET - - PUT - rules: - href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules - hints: - allow: - - POST - - GET - mappings: - href: https://{yourOktaDomain}/api/v1/policies/{policyId}/mappings - hints: - allow: - - GET - - POST - deactivate: - href: >- - https://{yourOktaDomain}/api/v1/policies/{policyId}/lifecycle/deactivate - hints: - allow: - - POST - idp-discovery-policy-response: - summary: IDP_DISCOVERY - value: - type: IDP_DISCOVERY - id: policyId - status: ACTIVE - name: Policy name - description: Policy description - priority: 1 - system: true - created: createdDate - lastUpdated: lastUpdated - conditions: null - _links: - self: - href: https://{yourOktaDomain}/api/v1/policies/{policyId} - hints: - allow: - - GET - - PUT - rules: - href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules - hints: - allow: - - POST - - GET - profile-enrollment-policy-response: - summary: PROFILE_ENROLLMENT - value: - type: PROFILE_ENROLLMENT - id: policyId - status: ACTIVE - name: Policy name - description: Policy description - priority: 1 - system: true - created: createdDate - lastUpdated: lastUpdated - conditions: null - _links: - self: - href: https://{yourOktaDomain}/api/v1/policies/{policyId} - hints: - allow: - - GET - - PUT - rules: - href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules - hints: - allow: - - POST - - GET - list-access-policy-response: - summary: ACCESS_POLICY - value: - - type: ACCESS_POLICY + - type: PASSWORD id: policyId status: ACTIVE name: Policy name description: Policy description priority: 1 system: true - conditions: null - created: '2024-04-25T17:35:02.000Z' - lastUpdated: '2024-04-25T17:35:02.000Z' + created: createdDate + lastUpdated: lastUpdated + conditions: + people: + groups: + include: + - groupId + authProvider: + provider: provider + settings: + password: + complexity: + minLength: 8 + minLowerCase: 1 + minUpperCase: 1 + minNumber: null + minSymbol: 0 + excludeUsername: true + dictionary: + common: + exclude: false + excludeAttributes: [] + age: + maxAgeDays: 0 + expireWarnDays: 0 + minAgeMinutes: 0 + historyCount: 4 + lockout: + maxAttempts: 0 + autoUnlockMinutes: 0 + userLockoutNotificationChannels: [] + showLockoutFailures: false + recovery: + factors: + recovery_question: + status: ACTIVE + properties: + complexity: + complexity: 4 + type: object + okta_email: + status: ACTIVE + properties: + recoveryToken: + tokenLifetimeMinutes: 10080 + type: object + okta_sms: + status: INACTIVE + okta_call: + status: INACTIVE + delegation: + options: + skipUnlock: false _links: self: href: https://{yourOktaDomain}/api/v1/policies/{policyId} @@ -2443,25 +2512,37 @@ components: href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules hints: allow: - - GET - POST - list-device-signal-collection-policy-response: - x-okta-lifecycle: - lifecycle: EA - isGenerallyAvailable: false - SKUs: [] - summary: DEVICE_SIGNAL_COLLECTION + - GET + list-mfa-enroll-policy-response: + summary: MFA_ENROLL value: - - type: DEVICE_SIGNAL_COLLECTION + - type: MFA_ENROLL id: policyId status: ACTIVE name: Policy name description: Policy description priority: 1 - system: false - conditions: null - created: '2025-04-25T17:35:02.000Z' - lastUpdated: '2025-04-25T17:35:02.000Z' + system: true + created: createdDate + lastUpdated: lastUpdated + conditions: + people: + groups: + include: + - groupId + settings: + type: AUTHENTICATORS + authenticators: + - key: okta_email + enroll: + self: NOT_ALLOWED + - key: okta_verify + enroll: + self: OPTIONAL + - key: okta_password + enroll: + self: REQUIRED _links: self: href: https://{yourOktaDomain}/api/v1/policies/{policyId} @@ -2469,30 +2550,36 @@ components: allow: - GET - PUT - - DELETE rules: href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules + hints: + allow: + - POST + - GET + mappings: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/mappings hints: allow: - GET - POST - list-okta-sign-on-policy-response: - summary: OKTA_SIGN_ON + deactivate: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/lifecycle/deactivate + hints: + allow: + - POST + list-idp-discovery-policy-response: + summary: IDP_DISCOVERY value: - - type: OKTA_SIGN_ON + - type: IDP_DISCOVERY id: policyId status: ACTIVE name: Policy name description: Policy description priority: 1 system: true - conditions: - people: - groups: - include: - - groupId - created: '2024-04-25T17:35:02.000Z' - lastUpdated: '2024-04-25T17:35:02.000Z' + created: createdDate + lastUpdated: lastUpdated + conditions: null _links: self: href: https://{yourOktaDomain}/api/v1/policies/{policyId} @@ -2504,21 +2591,21 @@ components: href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules hints: allow: - - GET - POST - list-entity-risk-policy-response: - summary: ENTITY_RISK + - GET + list-profile-enrollment-policy-response: + summary: PROFILE_ENROLLMENT value: - - type: ENTITY_RISK + - type: PROFILE_ENROLLMENT id: policyId status: ACTIVE name: Policy name description: Policy description priority: 1 system: true + created: createdDate + lastUpdated: lastUpdated conditions: null - created: '2024-04-25T17:35:02.000Z' - lastUpdated: '2024-04-25T17:35:02.000Z' _links: self: href: https://{yourOktaDomain}/api/v1/policies/{policyId} @@ -2530,12 +2617,12 @@ components: href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules hints: allow: - - GET - POST - list-post-auth-session-policy-response: - summary: POST_AUTH_SESSION + - GET + list-access-policy-response: + summary: ACCESS_POLICY value: - - type: POST_AUTH_SESSION + - type: ACCESS_POLICY id: policyId status: ACTIVE name: Policy name @@ -2558,11 +2645,379 @@ components: allow: - GET - POST - password-policy-with-breached-protection-response: - summary: PASSWORD_WITH_BREACHED_PROTECTION + list-device-signal-collection-policy-response: + x-okta-lifecycle: + lifecycle: EA + isGenerallyAvailable: false + SKUs: [] + summary: DEVICE_SIGNAL_COLLECTION value: - type: PASSWORD - id: policyId + - type: DEVICE_SIGNAL_COLLECTION + id: policyId + status: ACTIVE + name: Policy name + description: Policy description + priority: 1 + system: false + conditions: null + created: '2025-04-25T17:35:02.000Z' + lastUpdated: '2025-04-25T17:35:02.000Z' + _links: + self: + href: https://{yourOktaDomain}/api/v1/policies/{policyId} + hints: + allow: + - GET + - PUT + - DELETE + rules: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules + hints: + allow: + - GET + - POST + list-okta-sign-on-policy-response: + summary: OKTA_SIGN_ON + value: + - type: OKTA_SIGN_ON + id: policyId + status: ACTIVE + name: Policy name + description: Policy description + priority: 1 + system: true + conditions: + people: + groups: + include: + - groupId + created: '2024-04-25T17:35:02.000Z' + lastUpdated: '2024-04-25T17:35:02.000Z' + _links: + self: + href: https://{yourOktaDomain}/api/v1/policies/{policyId} + hints: + allow: + - GET + - PUT + rules: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules + hints: + allow: + - GET + - POST + list-entity-risk-policy-response: + summary: ENTITY_RISK + value: + - type: ENTITY_RISK + id: policyId + status: ACTIVE + name: Policy name + description: Policy description + priority: 1 + system: true + conditions: null + created: '2024-04-25T17:35:02.000Z' + lastUpdated: '2024-04-25T17:35:02.000Z' + _links: + self: + href: https://{yourOktaDomain}/api/v1/policies/{policyId} + hints: + allow: + - GET + - PUT + rules: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules + hints: + allow: + - GET + - POST + list-post-auth-session-policy-response: + summary: POST_AUTH_SESSION + value: + - type: POST_AUTH_SESSION + id: policyId + status: ACTIVE + name: Policy name + description: Policy description + priority: 1 + system: true + conditions: null + created: '2024-04-25T17:35:02.000Z' + lastUpdated: '2024-04-25T17:35:02.000Z' + _links: + self: + href: https://{yourOktaDomain}/api/v1/policies/{policyId} + hints: + allow: + - GET + - PUT + rules: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules + hints: + allow: + - GET + - POST + list-session-violation-detection-policy-response: + x-okta-lifecycle: + lifecycle: LIMITED_GA + isGenerallyAvailable: false + SKUs: [] + summary: SESSION_VIOLATION_DETECTION + value: + - type: SESSION_VIOLATION_DETECTION + id: policyId + status: ACTIVE + name: Session Violation Detection Policy + description: Enables session violation detection for the org + priority: 1 + system: true + conditions: null + created: '2025-09-22T09:28:02.000Z' + lastUpdated: '2025-09-22T09:28:02.000Z' + _links: + self: + href: https://{yourOktaDomain}/api/v1/policies/{policyId} + hints: + allow: + - GET + - PUT + rules: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules + hints: + allow: + - GET + list-password-policy-with-breached-protection-response: + summary: PASSWORD with breached protection + value: + - type: PASSWORD + id: policyId + status: ACTIVE + name: Policy name + description: Policy description + priority: 1 + system: true + created: createdDate + lastUpdated: lastUpdated + conditions: + people: + groups: + include: + - groupId + authProvider: + provider: provider + settings: + password: + complexity: + minLength: 8 + minLowerCase: 1 + minUpperCase: 1 + minNumber: null + minSymbol: 0 + excludeUsername: true + dictionary: + common: + exclude: false + excludeAttributes: [] + age: + maxAgeDays: 0 + expireWarnDays: 0 + minAgeMinutes: 0 + historyCount: 4 + lockout: + maxAttempts: 0 + autoUnlockMinutes: 0 + userLockoutNotificationChannels: [] + showLockoutFailures: false + breachedProtection: + expireAfterDays: 1 + logoutEnabled: true + delegatedWorkflowId: workflowId + recovery: + factors: + recovery_question: + status: ACTIVE + properties: + complexity: + complexity: 4 + type: object + okta_email: + status: ACTIVE + properties: + recoveryToken: + tokenLifetimeMinutes: 10080 + type: object + okta_sms: + status: INACTIVE + okta_call: + status: INACTIVE + delegation: + options: + skipUnlock: false + _links: + self: + href: https://{yourOktaDomain}/api/v1/policies/{policyId} + hints: + allow: + - GET + - PUT + rules: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules + hints: + allow: + - POST + - GET + list-mfa-enroll-policy-with-grace-period-response: + summary: MFA_ENROLL with grace period + value: + - type: MFA_ENROLL + id: policyId + status: ACTIVE + name: Policy name + description: Policy description + priority: 1 + system: true + created: createdDate + lastUpdated: lastUpdated + conditions: + people: + groups: + include: + - groupId + settings: + type: AUTHENTICATORS + authenticators: + - key: okta_email + enroll: + self: NOT_ALLOWED + - key: okta_verify + enroll: + self: OPTIONAL + - key: okta_password + enroll: + self: REQUIRED + - key: phone_number + enroll: + self: REQUIRED + gracePeriod: + type: BY_DATE_TIME + expiry: '2025-01-01T18:30:45.000Z' + _links: + self: + href: https://{yourOktaDomain}/api/v1/policies/{policyId} + hints: + allow: + - GET + - PUT + rules: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules + hints: + allow: + - POST + - GET + mappings: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/mappings + hints: + allow: + - GET + - POST + deactivate: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/lifecycle/deactivate + hints: + allow: + - POST + list-mfa-enroll-policy-auto-enroll-disabled-response: + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: true + summary: MFA_ENROLL with email auto-enrollment disabled + value: + - type: MFA_ENROLL + id: policyId + status: ACTIVE + name: Policy name + description: Policy description + priority: 1 + system: true + created: createdDate + lastUpdated: lastUpdated + conditions: + people: + groups: + include: + - groupId + settings: + type: AUTHENTICATORS + authenticators: + - key: okta_email + enroll: + self: NOT_ALLOWED + autoEnroll: false + - key: okta_verify + enroll: + self: OPTIONAL + - key: okta_password + enroll: + self: REQUIRED + _links: + self: + href: https://{yourOktaDomain}/api/v1/policies/{policyId} + hints: + allow: + - GET + - PUT + rules: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules + hints: + allow: + - POST + - GET + mappings: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/mappings + hints: + allow: + - GET + - POST + deactivate: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/lifecycle/deactivate + hints: + allow: + - POST + list-identity-claim-sourcing-policy-response: + x-okta-lifecycle: + lifecycle: EA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + summary: IDENTITY_CLAIM_SOURCING + value: + - type: IDENTITY_CLAIM_SOURCING + id: policyId + status: ACTIVE + name: Default policy + priority: 1 + system: true + conditions: null + created: '2025-10-01T12:00:00.000Z' + lastUpdated: '2025-10-01T12:00:00.000Z' + _links: + self: + href: https://{yourOktaDomain}/api/v1/policies/{policyId} + hints: + allow: + - GET + - PUT + rules: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules + hints: + allow: + - GET + - POST + password-policy-response: + summary: PASSWORD + value: + type: PASSWORD + id: policyId status: ACTIVE name: Policy name description: Policy description @@ -2600,10 +3055,6 @@ components: autoUnlockMinutes: 0 userLockoutNotificationChannels: [] showLockoutFailures: false - breachedProtection: - expireAfterDays: 1 - logoutEnabled: true - deletegatedWorkflowId: workflowId recovery: factors: recovery_question: @@ -2638,7 +3089,124 @@ components: allow: - POST - GET - create-access-policy-response: + mfa-enroll-policy-with-grace-period-response: + summary: MFA_ENROLL with grace period + value: + type: MFA_ENROLL + id: policyId + status: ACTIVE + name: Policy name + description: Policy description + priority: 1 + system: true + created: createdDate + lastUpdated: lastUpdated + conditions: + people: + groups: + include: + - groupId + settings: + type: AUTHENTICATORS + authenticators: + - key: okta_email + enroll: + self: NOT_ALLOWED + - key: okta_verify + enroll: + self: OPTIONAL + - key: okta_password + enroll: + self: REQUIRED + - key: phone_number + enroll: + self: REQUIRED + gracePeriod: + type: BY_DATE_TIME + expiry: '2025-01-01T18:30:45.000Z' + - key: google_otp + enroll: + self: OPTIONAL + gracePeriod: + type: BY_SKIP_COUNT + skipCount: 3 + _links: + self: + href: https://{yourOktaDomain}/api/v1/policies/{policyId} + hints: + allow: + - GET + - PUT + rules: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules + hints: + allow: + - POST + - GET + mappings: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/mappings + hints: + allow: + - GET + - POST + deactivate: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/lifecycle/deactivate + hints: + allow: + - POST + idp-discovery-policy-response: + summary: IDP_DISCOVERY + value: + type: IDP_DISCOVERY + id: policyId + status: ACTIVE + name: Policy name + description: Policy description + priority: 1 + system: true + created: createdDate + lastUpdated: lastUpdated + conditions: null + _links: + self: + href: https://{yourOktaDomain}/api/v1/policies/{policyId} + hints: + allow: + - GET + - PUT + rules: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules + hints: + allow: + - POST + - GET + profile-enrollment-policy-response: + summary: PROFILE_ENROLLMENT + value: + type: PROFILE_ENROLLMENT + id: policyId + status: ACTIVE + name: Policy name + description: Policy description + priority: 1 + system: true + created: createdDate + lastUpdated: lastUpdated + conditions: null + _links: + self: + href: https://{yourOktaDomain}/api/v1/policies/{policyId} + hints: + allow: + - GET + - PUT + rules: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules + hints: + allow: + - POST + - GET + create-access-policy-response: summary: ACCESS_POLICY value: type: ACCESS_POLICY @@ -2672,16 +3240,14 @@ components: - GET - POST deviceSignalCollectionPolicy: - href: >- - https://{yourOktaDomain}/api/v1/policies/{deviceSignalCollectionPolicyId} + href: https://{yourOktaDomain}/api/v1/policies/{deviceSignalCollectionPolicyId} hints: allow: - GET - PUT - DELETE deactivate: - href: >- - https://{yourOktaDomain}/api/v1/policies/{policyId}/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/lifecycle/deactivate hints: allow: - POST @@ -2717,8 +3283,7 @@ components: - GET - POST deactivate: - href: >- - https://{yourOktaDomain}/api/v1/policies/{policyId}/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/lifecycle/deactivate hints: allow: - POST @@ -2760,8 +3325,144 @@ components: - GET - POST deactivate: - href: >- - https://{yourOktaDomain}/api/v1/policies/{policyId}/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/lifecycle/deactivate + hints: + allow: + - POST + password-policy-with-breached-protection-response: + summary: PASSWORD with breached protection + value: + type: PASSWORD + id: policyId + status: ACTIVE + name: Policy name + description: Policy description + priority: 1 + system: true + created: createdDate + lastUpdated: lastUpdated + conditions: + people: + groups: + include: + - groupId + authProvider: + provider: provider + settings: + password: + complexity: + minLength: 8 + minLowerCase: 1 + minUpperCase: 1 + minNumber: null + minSymbol: 0 + excludeUsername: true + dictionary: + common: + exclude: false + excludeAttributes: [] + age: + maxAgeDays: 0 + expireWarnDays: 0 + minAgeMinutes: 0 + historyCount: 4 + lockout: + maxAttempts: 0 + autoUnlockMinutes: 0 + userLockoutNotificationChannels: [] + showLockoutFailures: false + breachedProtection: + expireAfterDays: 1 + logoutEnabled: true + deletegatedWorkflowId: workflowId + recovery: + factors: + recovery_question: + status: ACTIVE + properties: + complexity: + complexity: 4 + type: object + okta_email: + status: ACTIVE + properties: + recoveryToken: + tokenLifetimeMinutes: 10080 + type: object + okta_sms: + status: INACTIVE + okta_call: + status: INACTIVE + delegation: + options: + skipUnlock: false + _links: + self: + href: https://{yourOktaDomain}/api/v1/policies/{policyId} + hints: + allow: + - GET + - PUT + rules: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules + hints: + allow: + - POST + - GET + mfa-enroll-policy-auto-enroll-disabled-response: + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: true + summary: MFA_ENROLL with email auto-enrollment disabled + value: + type: MFA_ENROLL + id: policyId + status: ACTIVE + name: Policy name + description: Policy description + priority: 1 + system: true + created: createdDate + lastUpdated: lastUpdated + conditions: + people: + groups: + include: + - groupId + settings: + type: AUTHENTICATORS + authenticators: + - key: okta_email + enroll: + self: OPTIONAL + autoEnroll: false + - key: okta_verify + enroll: + self: OPTIONAL + - key: okta_password + enroll: + self: REQUIRED + _links: + self: + href: https://{yourOktaDomain}/api/v1/policies/{policyId} + hints: + allow: + - GET + - PUT + rules: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules + hints: + allow: + - POST + - GET + mappings: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/mappings + hints: + allow: + - GET + - POST + deactivate: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/lifecycle/deactivate hints: allow: - POST @@ -2860,22 +3561,75 @@ components: policies: [] evaluated: policies: [] - get-entity-risk-policy-response: - summary: ENTITY_RISK + mfa-enroll-policy-response: + summary: MFA_ENROLL value: - type: ENTITY_RISK + type: MFA_ENROLL id: policyId status: ACTIVE name: Policy name description: Policy description priority: 1 system: true - conditions: null - created: '2024-04-25T17:35:02.000Z' - lastUpdated: '2024-04-25T17:35:02.000Z' - _links: - self: - href: https://{yourOktaDomain}/api/v1/policies/{policyId} + created: createdDate + lastUpdated: lastUpdated + conditions: + people: + groups: + include: + - groupId + settings: + type: AUTHENTICATORS + authenticators: + - key: okta_email + enroll: + self: NOT_ALLOWED + - key: okta_verify + enroll: + self: OPTIONAL + - key: okta_password + enroll: + self: REQUIRED + _links: + self: + href: https://{yourOktaDomain}/api/v1/policies/{policyId} + hints: + allow: + - GET + - PUT + rules: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules + hints: + allow: + - POST + - GET + mappings: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/mappings + hints: + allow: + - GET + - POST + deactivate: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/lifecycle/deactivate + hints: + allow: + - POST + get-entity-risk-policy-response: + summary: ENTITY_RISK + value: + type: ENTITY_RISK + id: policyId + status: ACTIVE + name: Policy name + description: Policy description + priority: 1 + system: true + conditions: null + created: '2024-04-25T17:35:02.000Z' + lastUpdated: '2024-04-25T17:35:02.000Z' + _links: + self: + href: https://{yourOktaDomain}/api/v1/policies/{policyId} hints: allow: - GET @@ -2912,6 +3666,65 @@ components: allow: - GET - POST + get-session-violation-detection-policy-response: + x-okta-lifecycle: + lifecycle: LIMITED_GA + isGenerallyAvailable: false + SKUs: [] + summary: SESSION_VIOLATION_DETECTION + value: + type: SESSION_VIOLATION_DETECTION + id: policyId + status: ACTIVE + name: Session Violation Detection Policy + description: Enables session violation detection for the org + priority: 1 + system: true + conditions: null + created: '2025-09-22T09:28:02.000Z' + lastUpdated: '2025-09-22T09:28:02.000Z' + _links: + self: + href: https://{yourOktaDomain}/api/v1/policies/{policyId} + hints: + allow: + - GET + - PUT + rules: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules + hints: + allow: + - GET + get-identity-claim-sourcing-policy-response: + x-okta-lifecycle: + lifecycle: EA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + summary: IDENTITY_CLAIM_SOURCING + value: + type: IDENTITY_CLAIM_SOURCING + id: policyId + status: ACTIVE + name: Default policy + priority: 1 + system: true + conditions: null + created: '2025-10-01T12:00:00.000Z' + lastUpdated: '2025-10-01T12:00:00.000Z' + _links: + self: + href: https://{yourOktaDomain}/api/v1/policies/{policyId} + hints: + allow: + - GET + - PUT + rules: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules + hints: + allow: + - GET + - POST policy-mapping-list-response: summary: List all mappings for a policy value: @@ -2925,8 +3738,7 @@ components: - PUT - DELETE self: - href: >- - https://{yourOktaDomain}/api/v1/policies/{policyId}/mappings/{mappingId} + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/mappings/{mappingId} hints: allow: - GET @@ -2952,8 +3764,7 @@ components: - PUT - DELETE self: - href: >- - https://{yourOktaDomain}/api/v1/policies/{policyId}/mappings/{mappingId} + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/mappings/{mappingId} hints: allow: - GET @@ -3001,16 +3812,14 @@ components: usePersistentCookie: false _links: self: - href: >- - https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} hints: allow: - GET - PUT - DELETE deactivate: - href: >- - https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} hints: allow: - POST @@ -3036,8 +3845,7 @@ components: constraints: [] _links: self: - href: >- - https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} hints: allow: - GET @@ -3077,8 +3885,7 @@ components: id: 0oa159mE9aOSpCwmr0g4 _links: self: - href: >- - https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} hints: allow: - GET @@ -3100,13 +3907,47 @@ components: actions: [] _links: self: - href: >- - https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} hints: allow: - GET - PUT type: ENTITY_RISK + list-all-identity-claim-sourcing-policy-rule-response: + x-okta-lifecycle: + lifecycle: EA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + summary: IDENTITY_CLAIM_SOURCING + value: + - id: ruleId + status: ACTIVE + name: Catch-all rule + priority: 99 + created: '2026-02-17T15:12:42.000Z' + lastUpdated: '2026-02-19T20:59:00.000Z' + system: true + conditions: null + actions: + claimSourcing: + redirectType: IDP_DISCOVERY + refresh: + redirectType: FIXED + filter: + include: + - id: idpId1 + name: idpName1 + - id: idpId2 + name: idpName2 + _links: + self: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} + hints: + allow: + - GET + - PUT + type: IDENTITY_CLAIM_SOURCING list-all-post-auth-session-policy-rule-response: summary: POST_AUTH_SESSION value: @@ -3126,16 +3967,14 @@ components: failureActions: [] _links: self: - href: >- - https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} hints: allow: - GET - PUT - DELETE deactivate: - href: >- - https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate hints: allow: - POST @@ -3153,8 +3992,7 @@ components: failureActions: [] _links: self: - href: >- - https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId2} + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId2} hints: allow: - GET @@ -3191,8 +4029,7 @@ components: access: DENY _links: self: - href: >- - https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} hints: allow: - GET @@ -3224,10 +4061,10 @@ components: providers: - type: OKTA idpSelectionType: SPECIFIC + shouldFallBackToOkta: false _links: self: - href: >- - https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} hints: allow: - GET @@ -3254,8 +4091,7 @@ components: self: CHALLENGE _links: self: - href: >- - https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} hints: allow: - GET @@ -3294,50 +4130,514 @@ components: progressiveProfilingAction: DISABLED _links: self: - href: >- - https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} hints: allow: - GET - PUT type: PROFILE_ENROLLMENT - sspr-enabled-sq-step-up: - summary: >- - Password policy - Self-service password change, reset, or unlock with - security question as step up + list-all-session-violation-detection-policy-rule-response: + x-okta-lifecycle: + lifecycle: LIMITED_GA + isGenerallyAvailable: false + SKUs: [] + summary: SESSION_VIOLATION_DETECTION value: - name: SSPR Rule - priority: 1 - status: ACTIVE + - id: ruleId + status: ACTIVE + name: Session Violation Detection Rule + priority: 0 + created: '2025-09-22T09:28:02.000Z' + lastUpdated: '2025-09-22T09:28:02.000Z' + system: false + conditions: + network: + connection: ZONE + include: + - nzo19rah4IjLGd3PD0g4 + riskScore: + minRiskLevel: LOW + actions: + sessionViolationDetection: + policyEvaluation: + enabled: true + _links: + self: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} + hints: + allow: + - GET + - PUT + - DELETE + deactivate: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate + hints: + allow: + - POST + type: SESSION_VIOLATION_DETECTION + - id: ruleId2 + status: ACTIVE + name: Catch-all rule + priority: 99 + created: '2025-09-22T09:28:02.000Z' + lastUpdated: '2025-09-22T09:28:02.000Z' + system: true + conditions: null + actions: + sessionViolationDetection: + policyEvaluation: + enabled: true + _links: + self: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId2} + hints: + allow: + - GET + - PUT + type: SESSION_VIOLATION_DETECTION + create-auth-policy-rule-condition: + summary: App sign-in policy - Create rule with conditions + value: + system: false + type: ACCESS_POLICY + name: Rule with conditions conditions: + userType: + include: [] + exclude: + - otyezu4m0xN6w5JEa1d7 + network: + connection: ZONE + exclude: + - 00u7yq5goxNFTiMjW1d7 + riskScore: + level: ANY people: users: + exclude: + - 00u7yq5goxNFTiMjW1d7 + include: [] + groups: + include: + - 00g9i12jictsYdZdi1d7 exclude: [] - network: - connection: ANYWHERE + platform: + include: + - type: MOBILE + os: + type: IOS + - type: MOBILE + os: + type: ANDROID + - type: DESKTOP + os: + type: MACOS + elCondition: + condition: security.risk.level == 'HIGH' actions: - passwordChange: + appSignOn: access: ALLOW - selfServicePasswordReset: + verificationMethod: + factorMode: 2FA + reauthenticateIn: PT2H + constraints: + - knowledge: + reauthenticateIn: PT2H + types: + - password + type: ASSURANCE + twofa-enabled-disallow-password-allow-phishing: + summary: App sign-in policy - 2FA with granular authentication + value: + name: Passwordless 2FA + actions: + appSignOn: access: ALLOW - requirement: - primary: - methods: - - push - - sms - stepUp: - required: true - methods: - - security_question + verificationMethod: + factorMode: 2FA + type: ASSURANCE + reauthenticateIn: PT0S + constraints: + knowledge: + excludedAuthenticationMethods: + key: okta_password + possession: + deviceBound: REQUIRED + phishingREsistant: REQUIRED + type: ACCESS_POLICY + twofa-enabled-post-auth-kmsi-enabled: + x-okta-lifecycle: + lifecycle: LIMITED_GA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + summary: App sign-in policy - 2FA with granular authentication with Keep Me Signed In (KMSI) enabled + value: + name: 2FA with Post Auth KMSI prompt enabled + actions: + appSignOn: + access: ALLOW + verificationMethod: + factorMode: 2FA + type: ASSURANCE + reauthenticateIn: PT2H + constraints: + knowledge: + excludedAuthenticationMethods: + key: okta_password + keepMeSignedIn: + postAuth: ALLOWED + postAuthPromptFrequency: P30D + twofa-enabled-post-auth-kmsi-disabled: + x-okta-lifecycle: + lifecycle: LIMITED_GA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + summary: App sign-in policy - 2FA with granular authentication with Keep Me Signed In (KMSI) disabled + value: + name: 2FA with Post Auth KMSI prompt disabled + actions: + appSignOn: + access: ALLOW + verificationMethod: + factorMode: 2FA + type: ASSURANCE + reauthenticateIn: PT2H + constraints: + knowledge: + excludedAuthenticationMethods: + key: okta_password + keepMeSignedIn: + postAuth: NOT_ALLOWED + type: ACCESS_POLICY + amc-two-chain: + summary: App sign-in policy - Allow two authentication method chains + value: + name: Allow two authentication method chains + actions: + appSignOn: + access: ALLOW + verificationMethod: + type: AUTH_METHOD_CHAIN + chains: + - authenticationMethods: + - key: okta_password + method: password + next: + - authenticationMethods: + - key: phone_number + method: sms + - authenticationMethods: + - key: okta_verify + method: signed_nonce + userVerification: REQUIRED + type: ACCESS_POLICY + _links: + self: + href: https://{yourOktaDomain}/api/v1/policies/rst7xus97faIAgmti1d7/rules/rul7yut96gmsOzKAA1d6 + hints: + allow: + - GET + - PUT + deactivate: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate + hints: + allow: + - POST + create-device-signal-collection-rule: + x-okta-lifecycle: + lifecycle: EA + isGenerallyAvailable: false + SKUs: [] + summary: Device signal collection policy - collect context for Okta Verify devices + value: + name: Device signal collection rule + actions: + deviceSignalCollection: + deviceContextProviders: + - key: OKTA_VERIFY + userIdentification: ALLOW + - key: DEVICE_POSTURE_IDP + id: 0oa159mE9aOSpCwmr0g4 + type: DEVICE_SIGNAL_COLLECTION + sign-on-policy-rule: + summary: Global session policy - rule with factor mode always + value: + type: SIGN_ON + name: Test Sign On + conditions: + network: + connection: ANYWHERE + riskScore: + level: ANY + identityProvider: + provider: ANY + authContext: + authType: ANY + actions: + signon: + requireFactor: false + factorPromptMode: ALWAYS + factorLifetime: 15 + access: ALLOW + session: + maxSessionIdleMinutes: 720 + maxSessionLifetimeMinutes: 0 + usePersistentCookie: false + primaryFactor: PASSWORD_IDP_ANY_FACTOR + skip-factor-challenge-on-prem-rule: + summary: Global session policy - Skip factor challenge for on-prem sign-in use + value: + type: SIGN_ON + status: ACTIVE + name: Skip Factor Challenge when On-Prem + conditions: + network: + connection: ZONE + include: + - 00u7yq5goxNFTiMjW1d7 + authContext: + authType: ANY + actions: + signon: + access: ALLOW + requireFactor: false + rememberDeviceByDefault: false + session: + usePersistentCookie: false + maxSessionIdleMinutes: 720 + maxSessionLifetimeMinutes: 0 + radius-rule: + summary: Global session policy - Challenge VPN users with Radius + value: + type: SIGN_ON + status: ACTIVE + name: Challenge VPN users + conditions: + network: + connection: ANYWHERE + authContext: + authType: RADIUS + people: + users: + exclude: [] + risk: + behaviors: [] + riskScore: + level: ANY + identityProvider: + provider: ANY + actions: + signon: + access: ALLOW + requireFactor: true + primaryFactor: PASSWORD_IDP_ANY_FACTOR + factorPromptMode: ALWAYS + rememberDeviceByDefault: false + session: + usePersistentCookie: false + maxSessionIdleMinutes: 720 + maxSessionLifetimeMinutes: 0 + cloud-rule: + summary: Global session policy - Challenge cloud users + value: + type: SIGN_ON + name: Challenge Cloud Users + conditions: + people: + users: + include: [] + exclude: [] + groups: + include: [] + exclude: [] + network: + connection: ZONE + include: + - 00u7yq5goxNFTiMjW1d7 + authContext: + authType: ANY + actions: + signon: + access: ALLOW + requireFactor: true + factorPromptMode: ALWAYS + rememberDeviceByDefault: false + session: + usePersistentCookie: false + maxSessionIdleMinutes: 720 + maxSessionLifetimeMinutes: 0 + deny-rule: + summary: Global session policy - Deny users + value: + type: SIGN_ON + name: Deny users + conditions: + network: + connection: ANYWHERE + authContext: + authType: ANY + actions: + signon: + access: DENY + requireFactor: false + idp-discovery-specific-routing-rule: + summary: IdP discovery policy - Routing rule with specific IdP + value: + name: Specific routing rule + priority: 1 + status: ACTIVE + conditions: + network: + connection: ANYWHERE + actions: + idp: + providers: + - type: GOOGLE + id: 0oa5ks3WmHLRh8Ivr0g4 + idpSelectionType: SPECIFIC + shouldFallBackToOkta: false + system: false + type: IDP_DISCOVERY + idp-discovery-dynamic-routing-rule: + summary: IdP discovery policy - Routing rule with dynamic IdP + value: + name: Dynamic routing rule + priority: 1 + status: ACTIVE + conditions: + network: + connection: ANYWHERE + actions: + idp: + providers: [] + idpSelectionType: DYNAMIC + matchCriteria: + - providerExpression: login.identifier.substringAfter('@') + propertyName: name + shouldFallBackToOkta: false + system: false + type: IDP_DISCOVERY + sspr-enabled-sq-step-up: + summary: Password policy - Self-service password change, reset, or unlock with security question as step up + value: + name: SSPR Rule + priority: 1 + status: ACTIVE + conditions: + people: + users: + exclude: [] + network: + connection: ANYWHERE + actions: + passwordChange: + access: ALLOW + selfServicePasswordReset: + access: ALLOW + requirement: + primary: + methods: + - push + - sms + stepUp: + required: true + methods: + - security_question + selfServiceUnlock: + access: ALLOW + system: false + type: PASSWORD + sspr-enabled-sso-step-up: + summary: Password policy - Self-service password change, reset, or unlock with any SSO authenticator as step up + value: + name: SSPR Rule + priority: 1 + status: ACTIVE + conditions: + people: + users: + exclude: [] + network: + connection: ANYWHERE + actions: + passwordChange: + access: ALLOW + selfServicePasswordReset: + access: ALLOW + requirement: + primary: + methods: + - push + - sms + stepUp: + required: true + selfServiceUnlock: + access: ALLOW + system: false + type: PASSWORD + sspr-enabled-no-step-up: + summary: Password policy - Self-service password change, reset, or unlock with no step up + value: + name: SSPR Rule + priority: 1 + status: ACTIVE + conditions: + people: + users: + exclude: [] + network: + connection: ANYWHERE + actions: + passwordChange: + access: ALLOW + selfServicePasswordReset: + access: ALLOW + requirement: + primary: + methods: + - sms + - email + stepUp: + required: false + selfServiceUnlock: + access: ALLOW + system: false + type: PASSWORD + sspr-enabled-OAMP: + summary: Password policy - Self-service password change, reset, or unlock requirements defined by Okta account management policy + value: + name: SSPR Rule + priority: 1 + status: ACTIVE + conditions: + people: + users: + exclude: [] + network: + connection: ANYWHERE + actions: + passwordChange: + access: ALLOW + selfServicePasswordReset: + access: ALLOW + requirement: + accessControl: AUTH_POLICY + primary: + methods: + - sms + - email + stepUp: + required: false selfServiceUnlock: access: ALLOW system: false type: PASSWORD - sspr-enabled-sso-step-up: - summary: >- - Password policy - Self-service password change, reset, or unlock with - any SSO authenticator as step up + sspr-enabled-sso-step-up-with-constraints: + summary: Password policy - Enable self-service password change, reset, or unlock with OTP enabled and Google Authenticator constraint value: + id: ruleId name: SSPR Rule priority: 1 status: ACTIVE @@ -3357,16 +4657,22 @@ components: methods: - push - sms + - otp + methodConstraints: + - method: otp + allowedAuthenticators: + - key: google_otp stepUp: required: true selfServiceUnlock: access: ALLOW system: false type: PASSWORD - sspr-enabled-no-step-up: - summary: >- - Password policy - Self-service password change, reset, or unlock with no - step up + sspr-recovery-email-without-enrollment: + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: true + summary: Password policy - Self-service password change, reset, or unlock allow recovery email without email enrollment value: name: SSPR Rule priority: 1 @@ -3382,6 +4688,8 @@ components: access: ALLOW selfServicePasswordReset: access: ALLOW + settings: + allowRecoveryEmailWithoutEnrollment: true requirement: primary: methods: @@ -3393,12 +4701,11 @@ components: access: ALLOW system: false type: PASSWORD - sspr-enabled-OAMP: - summary: >- - Password policy - Self-service password change, reset, or unlock - requirements defined by Okta account management policy + oamp-id-proofing-policy-rule: + summary: Okta account management policy with ID proofing enabled value: - name: SSPR Rule + id: ruleId + name: Account management policy rule priority: 1 status: ACTIVE conditions: @@ -3408,26 +4715,103 @@ components: network: connection: ANYWHERE actions: - passwordChange: - access: ALLOW - selfServicePasswordReset: - access: ALLOW - requirement: - accessControl: AUTH_POLICY - primary: - methods: - - sms - - email - stepUp: - required: false - selfServiceUnlock: + appSignOn: access: ALLOW + verificationMethod: + id: entity_id + type: ID_PROOFING + device-condition-with-oamp-request: + x-okta-lifecycle: + lifecycle: EA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + summary: Okta account management policy rule with device conditions + value: system: false - type: PASSWORD - twofa-enabled-disallow-password-allow-phishing: - summary: Authentication policy - 2FA with granular authentication + type: ACCESS_POLICY + name: OAMP rule with device conditions + conditions: + userType: + include: [] + exclude: [] + network: + connection: ANYWHERE + riskScore: + level: ANY + people: + users: + exclude: [] + include: [] + groups: + include: [] + exclude: [] + platform: + include: [] + elCondition: {} + device: + registered: true + managed: true + assurance: + include: + - dae1f42iavrXPlAtG0g5 + actions: + appSignOn: + access: ALLOW + verificationMethod: + factorMode: 2FA + reauthenticateIn: PT1H + constraints: + - possession: + phishingResistant: REQUIRED + userVerification: OPTIONAL + type: ASSURANCE + post-auth-session-rule-example: + summary: Session Violation Enforcement Rule + value: + type: POST_AUTH_SESSION + name: Terminate Session on Risk + status: ACTIVE + description: Defines the enforcement actions taken after a session violation is detected. In this example, the session is terminated if the policy re-evaluation fails. + actions: + postAuthSession: + failureActions: + - action: TERMINATE_SESSION + entity-risk-rule-example: + summary: Entity Risk Remediation Rule + value: + type: ENTITY_RISK + name: Risk Remediation Rule + status: ACTIVE + description: Monitors the org for entity risk changes (e.g., brute-force attacks, session hijacking). Configured here to automatically sign users out of all Okta and app sessions when specific identity-based threats are detected. + actions: + entityRisk: + actions: + - action: TERMINATE_ALL_SESSIONS + session-violation-detection-rule-example: + summary: Session Violation Detection Rule + value: + type: SESSION_VIOLATION_DETECTION + name: High Risk Session Detection + status: ACTIVE + conditions: + riskScore: + minRiskLevel: HIGH + actions: + sessionViolationDetection: + policyEvaluation: + enabled: true + twofa-enabled-disallow-password-allow-phishing-response: + summary: App sign-in policy - 2FA with granular authentication value: + id: rul7yut96gmsOzKAA1d6 + status: ACTIVE name: Passwordless 2FA + priority: 0 + created: '2023-05-01T21:13:15.000Z' + lastUpdated: '2023-05-01T21:13:15.000Z' + system: false + conditions: null actions: appSignOn: access: ALLOW @@ -3439,89 +4823,41 @@ components: knowledge: excludedAuthenticationMethods: key: okta_password + required: false possession: deviceBound: REQUIRED phishingREsistant: REQUIRED + required: true type: ACCESS_POLICY - create-device-signal-collection-rule: - x-okta-lifecycle: - lifecycle: EA - isGenerallyAvailable: false - SKUs: [] - summary: >- - Device signal collection policy - collect context for Okta Verify - devices - value: - name: Device signal collection rule - actions: - deviceSignalCollection: - deviceContextProviders: - - key: OKTA_VERIFY - userIdentification: ALLOW - - key: DEVICE_POSTURE_IDP - id: 0oa159mE9aOSpCwmr0g4 - type: DEVICE_SIGNAL_COLLECTION - idp-discovery-specific-routing-rule: - summary: IdP discovery policy - Routing rule with specific IdP - value: - name: Specific routing rule - priority: 1 - status: ACTIVE - conditions: - network: - connection: ANYWHERE - actions: - idp: - providers: - - type: GOOGLE - id: 0oa5ks3WmHLRh8Ivr0g4 - idpSelectionType: SPECIFIC - system: false - type: IDP_DISCOVERY - idp-discovery-dynamic-routing-rule: - summary: IdP discovery policy - Routing rule with dynamic IdP + _links: + self: + href: https://{yourOktaDomain}/api/v1/policies/rst7xus97faIAgmti1d7/rules/rul7yut96gmsOzKAA1d6 + hints: + allow: + - GET + - PUT + create-auth-policy-rule-condition-response: + summary: App sign-in policy - rule with conditions value: - name: Dynamic routing rule - priority: 1 + id: rule8jjozjGMGbHyC1d6 status: ACTIVE - conditions: - network: - connection: ANYWHERE - actions: - idp: - providers: [] - idpSelectionType: DYNAMIC - matchCriteria: - - providerExpression: login.identifier.substringAfter('@') - propertyName: name - system: false - type: IDP_DISCOVERY - create-auth-policy-rule-condition: - summary: Authentication policy - Create rule with conditions - value: - system: false - type: ACCESS_POLICY name: Rule with conditions + priority: 0 + created: '2024-04-25T17:35:02.000Z' + lastUpdated: '2024-04-25T17:35:02.000Z' + system: false conditions: - userType: - include: [] - exclude: - - otyezu4m0xN6w5JEa1d7 - network: - connection: ZONE - exclude: - - 00u7yq5goxNFTiMjW1d7 - riskScore: - level: ANY people: users: exclude: - 00u7yq5goxNFTiMjW1d7 - include: [] groups: include: - 00g9i12jictsYdZdi1d7 - exclude: [] + network: + connection: ZONE + exclude: + - nzo9o4rctwQCJNE6y1d7 platform: include: - type: MOBILE @@ -3533,6 +4869,13 @@ components: - type: DESKTOP os: type: MACOS + exclude: [] + riskScore: + level: ANY + userType: + include: [] + exclude: + - otyezu4m0xN6w5JEa1d7 elCondition: condition: security.risk.level == 'HIGH' actions: @@ -3540,18 +4883,158 @@ components: access: ALLOW verificationMethod: factorMode: 2FA - reauthenticateIn: PT2H - constraints: - - knowledge: - reauthenticateIn: PT2H - types: - - password type: ASSURANCE - sign-on-policy-rule: - summary: Sign-on policy - Rule with factor mode always + reauthenticateIn: PT2H + constraints: + knowledge: + required: true + types: + - password + reauthenticateIn: PT2H + type: ACCESS_POLICY + _links: + self: + href: https://{yourOktaDomain}/api/v1/policies/rst7xus97faIAgmti1d7/rules/rul7yut96gmsOzKAA1d6 + hints: + allow: + - GET + - PUT + - DELETE + deactivate: + href: https://{yourOktaDomain}/api/v1/policies/rst7xus97faIAgmti1d7/rules/rul7yut96gmsOzKAA1d6 + hints: + allow: + - GET + - PUT + - DELETE + twofa-enabled-post-auth-kmsi-enabled-response: + x-okta-lifecycle: + lifecycle: LIMITED_GA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + summary: App sign-in policy - 2FA with granular authentication with Keep Me Signed In (KMSI) enabled + value: + id: rul7yut96gmsOzKAA1d6 + status: ACTIVE + name: 2FA with Post Auth KMSI prompt enabled + priority: 0 + created: '2023-05-01T21:13:15.000Z' + lastUpdated: '2023-05-01T21:13:15.000Z' + system: false + conditions: null + actions: + appSignOn: + access: ALLOW + verificationMethod: + factorMode: 2FA + type: ASSURANCE + reauthenticateIn: PT0S + constraints: + knowledge: + excludedAuthenticationMethods: + key: okta_password + required: true + keepMeSignedIn: + postAuth: ALLOWED + postAuthPromptFrequency: PT720H + type: ACCESS_POLICY + _links: + self: + href: https://{yourOktaDomain}/api/v1/policies/rst7xus97faIAgmti1d7/rules/rul7yut96gmsOzKAA1d6 + hints: + allow: + - GET + - PUT + deactivate: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate + hints: + allow: + - POST + twofa-enabled-post-auth-kmsi-disabled-response: + x-okta-lifecycle: + lifecycle: LIMITED_GA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + summary: App sign-in policy - 2FA with granular authentication with Keep Me Signed In (KMSI) disabled + value: + id: rul7yut96gmsOzKAA1d6 + status: ACTIVE + name: 2FA with Post Auth KMSI prompt disabled + priority: 0 + created: '2023-05-01T21:13:15.000Z' + lastUpdated: '2023-05-01T21:13:15.000Z' + system: false + conditions: null + actions: + appSignOn: + access: ALLOW + verificationMethod: + factorMode: 2FA + type: ASSURANCE + reauthenticateIn: PT0S + constraints: + knowledge: + excludedAuthenticationMethods: + key: okta_password + required: true + keepMeSignedIn: + postAuth: NOT_ALLOWED + type: ACCESS_POLICY + _links: + self: + href: https://{yourOktaDomain}/api/v1/policies/rst7xus97faIAgmti1d7/rules/rul7yut96gmsOzKAA1d6 + hints: + allow: + - GET + - PUT + deactivate: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate + hints: + allow: + - POST + device-signal-collection-rule-response: + x-okta-lifecycle: + lifecycle: EA + isGenerallyAvailable: false + SKUs: [] + summary: Device signal collection policy - collect context for Okta Verify devices + value: + id: rul7yut96gmsOzKAA1d6 + status: ACTIVE + name: Device signal collection rule + priority: 0 + created: '2023-05-01T21:13:15.000Z' + lastUpdated: '2023-05-01T21:13:15.000Z' + system: false + conditions: null + actions: + deviceSignalCollection: + deviceContextProviders: + - key: OKTA_VERIFY + userIdentification: IGNORE + - key: DEVICE_POSTURE_IDP + id: 0oa159mE9aOSpCwmr0g4 + type: DEVICE_SIGNAL_COLLECTION + _links: + self: + href: https://{yourOktaDomain}/api/v1/policies/rst7xus97faIAgmti1d7/rules/rul7yut96gmsOzKAA1d6 + hints: + allow: + - GET + - PUT + sign-on-policy-rule-response: + summary: Global session policy - rule with factor mode always value: type: SIGN_ON name: Test Sign On + id: 0prh1sd28q5sXGW08697 + priority: 0 + created: '2024-04-25T17:35:02.000Z' + lastUpdated: '2024-04-25T17:35:02.000Z' + system: false + status: ACTIVE conditions: network: connection: ANYWHERE @@ -3561,6 +5044,9 @@ components: provider: ANY authContext: authType: ANY + people: + users: + exclude: [] actions: signon: requireFactor: false @@ -3572,12 +5058,31 @@ components: maxSessionLifetimeMinutes: 0 usePersistentCookie: false primaryFactor: PASSWORD_IDP_ANY_FACTOR - skip-factor-challenge-on-prem-rule: + _links: + self: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} + hints: + allow: + - GET + - PUT + - DELETE + deactivate: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} + hints: + allow: + - GET + - PUT + - DELETE + skip-factor-challenge-on-prem-rule-response: summary: Global session policy - Skip factor challenge for on-prem sign-in use value: - type: SIGN_ON + id: rule8jjozjGMGbHyC1d6 status: ACTIVE name: Skip Factor Challenge when On-Prem + priority: 0 + created: '2024-04-25T17:35:02.000Z' + lastUpdated: '2024-04-25T17:35:02.000Z' + system: false conditions: network: connection: ZONE @@ -3585,51 +5090,93 @@ components: - 00u7yq5goxNFTiMjW1d7 authContext: authType: ANY + people: + users: + exclude: [] + risk: + behaviors: [] + riskScore: + level: ANY + identityProvider: + provider: ANY actions: signon: access: ALLOW requireFactor: false + primaryFactor: PASSWORD_IDP_ANY_FACTOR rememberDeviceByDefault: false session: usePersistentCookie: false maxSessionIdleMinutes: 720 maxSessionLifetimeMinutes: 0 - radius-rule: + type: SIGN_ON + _links: + self: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} + hints: + allow: + - GET + - PUT + - DELETE + deactivate: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} + hints: + allow: + - GET + - PUT + - DELETE + radius-rule-response: summary: Global session policy - Challenge VPN users with Radius value: - type: SIGN_ON + id: rule8jjozjGMGbHyC1d6 status: ACTIVE + type: SIGN_ON name: Challenge VPN users + priority: 0 + created: '2024-04-25T17:35:02.000Z' + lastUpdated: '2024-04-25T17:35:02.000Z' + system: false conditions: network: connection: ANYWHERE authContext: authType: RADIUS - people: - users: - exclude: [] - risk: - behaviors: [] - riskScore: - level: ANY - identityProvider: - provider: ANY actions: signon: access: ALLOW requireFactor: true - primaryFactor: PASSWORD_IDP_ANY_FACTOR factorPromptMode: ALWAYS rememberDeviceByDefault: false session: usePersistentCookie: false maxSessionIdleMinutes: 720 maxSessionLifetimeMinutes: 0 - cloud-rule: + _links: + self: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} + hints: + allow: + - GET + - PUT + - DELETE + deactivate: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} + hints: + allow: + - GET + - PUT + - DELETE + cloud-rule-response: summary: Global session policy - Challenge cloud users value: + id: rule8jjozjGMGbHyC1d6 + status: ACTIVE type: SIGN_ON name: Challenge Cloud Users + priority: 0 + created: '2024-04-25T17:35:02.000Z' + lastUpdated: '2024-04-25T17:35:02.000Z' + system: false conditions: people: users: @@ -3644,179 +5191,73 @@ components: - 00u7yq5goxNFTiMjW1d7 authContext: authType: ANY - actions: - signon: - access: ALLOW - requireFactor: true - factorPromptMode: ALWAYS - rememberDeviceByDefault: false - session: - usePersistentCookie: false - maxSessionIdleMinutes: 720 - maxSessionLifetimeMinutes: 0 - deny-rule: - summary: Global session policy - Deny users - value: - type: SIGN_ON - name: Deny users - conditions: - network: - connection: ANYWHERE - authContext: - authType: ANY - actions: - signon: - access: DENY - requireFactor: false - twofa-enabled-post-auth-kmsi-enabled: - x-okta-lifecycle: - lifecycle: LIMITED_GA - isGenerallyAvailable: false - SKUs: - - Okta Identity Engine - summary: >- - Authentication policy - 2FA with granular authentication with Keep Me - Signed In (KMSI) enabled - value: - name: 2FA with Post Auth KMSI prompt enabled - actions: - appSignOn: - access: ALLOW - verificationMethod: - factorMode: 2FA - type: ASSURANCE - reauthenticateIn: PT2H - constraints: - knowledge: - excludedAuthenticationMethods: - key: okta_password - keepMeSignedIn: - postAuth: ALLOWED - postAuthPromptFrequency: P30D - twofa-enabled-post-auth-kmsi-disabled: - x-okta-lifecycle: - lifecycle: LIMITED_GA - isGenerallyAvailable: false - SKUs: - - Okta Identity Engine - summary: >- - Authentication policy - 2FA with granular authentication with Keep Me - Signed In (KMSI) disabled - value: - name: 2FA with Post Auth KMSI prompt disabled - actions: - appSignOn: - access: ALLOW - verificationMethod: - factorMode: 2FA - type: ASSURANCE - reauthenticateIn: PT2H - constraints: - knowledge: - excludedAuthenticationMethods: - key: okta_password - keepMeSignedIn: - postAuth: NOT_ALLOWED - type: ACCESS_POLICY - amc-two-chain: - summary: Authentication policy - Allow two authentication method chains - value: - name: Allow two authentication method chains - actions: - appSignOn: - access: ALLOW - verificationMethod: - type: AUTH_METHOD_CHAIN - chains: - - authenticationMethods: - - key: okta_password - method: password - next: - - authenticationMethods: - - key: phone_number - method: sms - - authenticationMethods: - - key: okta_verify - method: signed_nonce - userVerification: REQUIRED - type: ACCESS_POLICY + risk: + behaviors: [] + riskScore: + level: ANY + identityProvider: + provider: ANY + actions: + signon: + access: ALLOW + requireFactor: true + primaryFactor: PASSWORD_IDP_ANY_FACTOR + factorPromptMode: ALWAYS + rememberDeviceByDefault: false + session: + usePersistentCookie: false + maxSessionIdleMinutes: 720 + maxSessionLifetimeMinutes: 0 _links: self: - href: >- - https://{yourOktaDomain}/api/v1/policies/rst7xus97faIAgmti1d7/rules/rul7yut96gmsOzKAA1d6 + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} hints: allow: - GET - PUT + - DELETE deactivate: - href: >- - https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} hints: allow: - - POST - sspr-enabled-sso-step-up-with-constraints: - summary: >- - Password policy - Enable self-service password change, reset, or unlock - with OTP enabled and Google Authenticator constraint + - GET + - PUT + - DELETE + deny-rule-response: + summary: Global session policy - Deny users value: - id: ruleId - name: SSPR Rule - priority: 1 + id: rule8jjozjGMGbHyC1d6 status: ACTIVE - conditions: - people: - users: - exclude: [] - network: - connection: ANYWHERE - actions: - passwordChange: - access: ALLOW - selfServicePasswordReset: - access: ALLOW - requirement: - primary: - methods: - - push - - sms - - otp - methodConstraints: - - method: otp - allowedAuthenticators: - - key: google_otp - stepUp: - required: true - selfServiceUnlock: - access: ALLOW + type: SIGN_ON + name: Deny + priority: 0 + created: '2024-04-25T17:35:02.000Z' + lastUpdated: '2024-04-25T17:35:02.000Z' system: false - type: PASSWORD - oamp-id-proofing-policy-rule: - summary: >- - Account Management Policy - Account management policy rule with ID - proofing enabled - value: - id: ruleId - name: Account Management Policy Rule - priority: 1 - status: ACTIVE conditions: people: users: exclude: [] network: connection: ANYWHERE + authContext: + authType: ANY + risk: + behaviors: [] + riskScore: + level: ANY + identityProvider: + provider: ANY actions: - appSignOn: - access: ALLOW - verificationMethod: - id: entity_id - type: ID_PROOFING - sspr-enabled-sq-step-up-response: - summary: >- - Password policy - Self-service password change, reset, or unlock with - security question as step up - value: - id: ruleId + signon: + access: DENY + requireFactor: false + primaryFactor: PASSWORD_IDP + rememberDeviceByDefault: false + session: + usePersistentCookie: false + maxSessionIdleMinutes: 120 + maxSessionLifetimeMinutes: 0 _links: self: href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} @@ -3826,40 +5267,14 @@ components: - PUT - DELETE deactivate: - href: >- - https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} hints: allow: - - POST - name: SSPR Rule - priority: 1 - status: ACTIVE - conditions: - people: - users: - exclude: [] - network: - connection: ANYWHERE - actions: - passwordChange: - access: ALLOW - selfServicePasswordReset: - access: ALLOW - requirement: - primary: - methods: - - push - - sms - stepUp: - required: true - methods: - - security_question - selfServiceUnlock: - access: ALLOW - system: false - type: PASSWORD - sspr-enabled-sso-step-up-response: - summary: Password policy - SSPR with any SSO authenticator as step up + - GET + - PUT + - DELETE + idp-discovery-specific-routing-rule-response: + summary: IdP discovery policy - Routing rule with specific IdP value: id: ruleId _links: @@ -3871,40 +5286,27 @@ components: - PUT - DELETE deactivate: - href: >- - https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate hints: allow: - POST - name: SSPR Rule + name: Specific routing rule priority: 1 status: ACTIVE conditions: - people: - users: - exclude: [] network: connection: ANYWHERE actions: - passwordChange: - access: ALLOW - selfServicePasswordReset: - access: ALLOW - requirement: - primary: - methods: - - push - - sms - stepUp: - required: true - selfServiceUnlock: - access: ALLOW + idp: + providers: + - type: GOOGLE + id: 0oa5ks3WmHLRh8Ivr0g4 + idpSelectionType: SPECIFIC + shouldFallBackToOkta: false system: false - type: PASSWORD - sspr-enabled-no-step-up-response: - summary: >- - Password policy - Self-service password change, reset, or unlock with no - step up + type: IDP_DISCOVERY + idp-discovery-dynamic-routing-rule-response: + summary: IdP discovery policy - Routing rule with dynamic IdP value: id: ruleId _links: @@ -3916,40 +5318,28 @@ components: - PUT - DELETE deactivate: - href: >- - https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate hints: allow: - POST - name: SSPR Rule + name: Dynamic routing rule priority: 1 status: ACTIVE conditions: - people: - users: - exclude: [] network: connection: ANYWHERE actions: - passwordChange: - access: ALLOW - selfServicePasswordReset: - access: ALLOW - requirement: - primary: - methods: - - sms - - email - stepUp: - required: false - selfServiceUnlock: - access: ALLOW + idp: + providers: [] + idpSelectionType: DYNAMIC + matchCriteria: + - providerExpression: login.identifier.substringAfter('@') + propertyName: name + shouldFallBackToOkta: false system: false - type: PASSWORD - sspr-enabled-OAMP-response: - summary: >- - Password policy - Self-service password change, reset, or unlock - requirements defined by Okta account management policy + type: IDP_DISCOVERY + sspr-enabled-sq-step-up-response: + summary: Password policy - Self-service password change, reset, or unlock with security question as step up value: id: ruleId _links: @@ -3961,8 +5351,7 @@ components: - PUT - DELETE deactivate: - href: >- - https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate hints: allow: - POST @@ -3981,87 +5370,20 @@ components: selfServicePasswordReset: access: ALLOW requirement: - accessControl: AUTH_POLICY primary: methods: + - push - sms - - email stepUp: - required: false + required: true + methods: + - security_question selfServiceUnlock: access: ALLOW - system: false - type: PASSWORD - twofa-enabled-disallow-password-allow-phishing-response: - summary: Authentication policy - 2FA with granular authentication - value: - id: rul7yut96gmsOzKAA1d6 - status: ACTIVE - name: Passwordless 2FA - priority: 0 - created: '2023-05-01T21:13:15.000Z' - lastUpdated: '2023-05-01T21:13:15.000Z' - system: false - conditions: null - actions: - appSignOn: - access: ALLOW - verificationMethod: - factorMode: 2FA - type: ASSURANCE - reauthenticateIn: PT0S - constraints: - knowledge: - excludedAuthenticationMethods: - key: okta_password - required: false - possession: - deviceBound: REQUIRED - phishingREsistant: REQUIRED - required: true - type: ACCESS_POLICY - _links: - self: - href: >- - https://{yourOktaDomain}/api/v1/policies/rst7xus97faIAgmti1d7/rules/rul7yut96gmsOzKAA1d6 - hints: - allow: - - GET - - PUT - idp-discovery-specific-routing-rule-response: - summary: IdP discovery policy - Routing rule with specific IdP - value: - id: ruleId - _links: - self: - href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} - hints: - allow: - - GET - - PUT - - DELETE - deactivate: - href: >- - https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate - hints: - allow: - - POST - name: Specific routing rule - priority: 1 - status: ACTIVE - conditions: - network: - connection: ANYWHERE - actions: - idp: - providers: - - type: GOOGLE - id: 0oa5ks3WmHLRh8Ivr0g4 - idpSelectionType: SPECIFIC - system: false - type: IDP_DISCOVERY - idp-discovery-dynamic-routing-rule-response: - summary: IdP discovery policy - Routing rule with dynamic IdP + system: false + type: PASSWORD + sspr-enabled-sso-step-up-response: + summary: Password policy - SSPR with any SSO authenticator as step up value: id: ruleId _links: @@ -4073,166 +5395,81 @@ components: - PUT - DELETE deactivate: - href: >- - https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate hints: allow: - POST - name: Dynamic routing rule + name: SSPR Rule priority: 1 status: ACTIVE - conditions: - network: - connection: ANYWHERE - actions: - idp: - providers: [] - idpSelectionType: DYNAMIC - matchCriteria: - - providerExpression: login.identifier.substringAfter('@') - propertyName: name - system: false - type: IDP_DISCOVERY - device-signal-collection-rule-response: - x-okta-lifecycle: - lifecycle: EA - isGenerallyAvailable: false - SKUs: [] - summary: >- - Device signal collection policy - collect context for Okta Verify - devices - value: - id: rul7yut96gmsOzKAA1d6 - status: ACTIVE - name: Device signal collection rule - priority: 0 - created: '2023-05-01T21:13:15.000Z' - lastUpdated: '2023-05-01T21:13:15.000Z' - system: false - conditions: null - actions: - deviceSignalCollection: - deviceContextProviders: - - key: OKTA_VERIFY - userIdentification: IGNORE - - key: DEVICE_POSTURE_IDP - id: 0oa159mE9aOSpCwmr0g4 - type: DEVICE_SIGNAL_COLLECTION - _links: - self: - href: >- - https://{yourOktaDomain}/api/v1/policies/rst7xus97faIAgmti1d7/rules/rul7yut96gmsOzKAA1d6 - hints: - allow: - - GET - - PUT - create-auth-policy-rule-condition-response: - summary: Authentication policy - Policy rule with conditions - value: - id: rule8jjozjGMGbHyC1d6 - status: ACTIVE - name: Rule with conditions - priority: 0 - created: '2024-04-25T17:35:02.000Z' - lastUpdated: '2024-04-25T17:35:02.000Z' - system: false conditions: people: users: - exclude: - - 00u7yq5goxNFTiMjW1d7 - groups: - include: - - 00g9i12jictsYdZdi1d7 + exclude: [] network: - connection: ZONE - exclude: - - nzo9o4rctwQCJNE6y1d7 - platform: - include: - - type: MOBILE - os: - type: IOS - - type: MOBILE - os: - type: ANDROID - - type: DESKTOP - os: - type: MACOS - exclude: [] - riskScore: - level: ANY - userType: - include: [] - exclude: - - otyezu4m0xN6w5JEa1d7 - elCondition: - condition: security.risk.level == 'HIGH' + connection: ANYWHERE actions: - appSignOn: + passwordChange: access: ALLOW - verificationMethod: - factorMode: 2FA - type: ASSURANCE - reauthenticateIn: PT2H - constraints: - knowledge: - required: true - types: - - password - reauthenticateIn: PT2H - type: ACCESS_POLICY + selfServicePasswordReset: + access: ALLOW + requirement: + primary: + methods: + - push + - sms + stepUp: + required: true + selfServiceUnlock: + access: ALLOW + system: false + type: PASSWORD + sspr-enabled-no-step-up-response: + summary: Password policy - Self-service password change, reset, or unlock with no step up + value: + id: ruleId _links: self: - href: >- - https://{yourOktaDomain}/api/v1/policies/rst7xus97faIAgmti1d7/rules/rul7yut96gmsOzKAA1d6 + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} hints: allow: - GET - PUT - DELETE deactivate: - href: >- - https://{yourOktaDomain}/api/v1/policies/rst7xus97faIAgmti1d7/rules/rul7yut96gmsOzKAA1d6 + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate hints: allow: - - GET - - PUT - - DELETE - sign-on-policy-rule-response: - summary: Sign-on policy - Rule with factor mode always - value: - type: SIGN_ON - name: Test Sign On - id: 0prh1sd28q5sXGW08697 - priority: 0 - created: '2024-04-25T17:35:02.000Z' - lastUpdated: '2024-04-25T17:35:02.000Z' - system: false + - POST + name: SSPR Rule + priority: 1 status: ACTIVE conditions: - network: - connection: ANYWHERE - riskScore: - level: ANY - identityProvider: - provider: ANY - authContext: - authType: ANY people: users: exclude: [] + network: + connection: ANYWHERE actions: - signon: - requireFactor: false - factorPromptMode: ALWAYS - factorLifetime: 15 + passwordChange: access: ALLOW - session: - maxSessionIdleMinutes: 720 - maxSessionLifetimeMinutes: 0 - usePersistentCookie: false - primaryFactor: PASSWORD_IDP_ANY_FACTOR + selfServicePasswordReset: + access: ALLOW + requirement: + primary: + methods: + - sms + - email + stepUp: + required: false + selfServiceUnlock: + access: ALLOW + system: false + type: PASSWORD + sspr-enabled-OAMP-response: + summary: Password policy - Self-service password change, reset, or unlock requirements defined by Okta account management policy + value: + id: ruleId _links: self: href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} @@ -4242,49 +5479,40 @@ components: - PUT - DELETE deactivate: - href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate hints: allow: - - GET - - PUT - - DELETE - skip-factor-challenge-on-prem-rule-response: - summary: Global session policy - Skip factor challenge for on-prem sign-in use - value: - id: rule8jjozjGMGbHyC1d6 + - POST + name: SSPR Rule + priority: 1 status: ACTIVE - name: Skip Factor Challenge when On-Prem - priority: 0 - created: '2024-04-25T17:35:02.000Z' - lastUpdated: '2024-04-25T17:35:02.000Z' - system: false conditions: - network: - connection: ZONE - include: - - 00u7yq5goxNFTiMjW1d7 - authContext: - authType: ANY people: users: exclude: [] - risk: - behaviors: [] - riskScore: - level: ANY - identityProvider: - provider: ANY + network: + connection: ANYWHERE actions: - signon: + passwordChange: access: ALLOW - requireFactor: false - primaryFactor: PASSWORD_IDP_ANY_FACTOR - rememberDeviceByDefault: false - session: - usePersistentCookie: false - maxSessionIdleMinutes: 720 - maxSessionLifetimeMinutes: 0 - type: SIGN_ON + selfServicePasswordReset: + access: ALLOW + requirement: + accessControl: AUTH_POLICY + primary: + methods: + - sms + - email + stepUp: + required: false + selfServiceUnlock: + access: ALLOW + system: false + type: PASSWORD + sspr-enabled-sso-step-up-with-constraints-response: + summary: Password policy - Enable self-service password change, reset, or unlock with OTP enabled and Google Authenticator constraint + value: + id: ruleId _links: self: href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} @@ -4294,38 +5522,47 @@ components: - PUT - DELETE deactivate: - href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate hints: allow: - - GET - - PUT - - DELETE - radius-rule-response: - summary: Global session policy - Challenge VPN users with Radius - value: - id: rule8jjozjGMGbHyC1d6 + - POST + name: SSPR Rule + priority: 1 status: ACTIVE - type: SIGN_ON - name: Challenge VPN users - priority: 0 - created: '2024-04-25T17:35:02.000Z' - lastUpdated: '2024-04-25T17:35:02.000Z' - system: false conditions: + people: + users: + exclude: [] network: connection: ANYWHERE - authContext: - authType: RADIUS actions: - signon: + passwordChange: + access: ALLOW + selfServicePasswordReset: + access: ALLOW + requirement: + primary: + methods: + - push + - sms + - otp + methodConstraints: + - method: otp + allowedAuthenticators: + - key: google_otp + stepUp: + required: true + selfServiceUnlock: access: ALLOW - requireFactor: true - factorPromptMode: ALWAYS - rememberDeviceByDefault: false - session: - usePersistentCookie: false - maxSessionIdleMinutes: 720 - maxSessionLifetimeMinutes: 0 + system: false + type: PASSWORD + sspr-recovery-email-without-enrollment-response: + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: true + summary: Password policy - Self-service password change, reset, or unlock with recovery email without email enrollment requirement + value: + id: ruleId _links: self: href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} @@ -4335,54 +5572,41 @@ components: - PUT - DELETE deactivate: - href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate hints: allow: - - GET - - PUT - - DELETE - cloud-rule-response: - summary: Global session policy - Challenge cloud users - value: - id: rule8jjozjGMGbHyC1d6 + - POST + name: SSPR Rule + priority: 1 status: ACTIVE - type: SIGN_ON - name: Challenge Cloud Users - priority: 0 - created: '2024-04-25T17:35:02.000Z' - lastUpdated: '2024-04-25T17:35:02.000Z' - system: false conditions: people: users: - include: [] - exclude: [] - groups: - include: [] exclude: [] network: - connection: ZONE - include: - - 00u7yq5goxNFTiMjW1d7 - authContext: - authType: ANY - risk: - behaviors: [] - riskScore: - level: ANY - identityProvider: - provider: ANY + connection: ANYWHERE actions: - signon: + passwordChange: access: ALLOW - requireFactor: true - primaryFactor: PASSWORD_IDP_ANY_FACTOR - factorPromptMode: ALWAYS - rememberDeviceByDefault: false - session: - usePersistentCookie: false - maxSessionIdleMinutes: 720 - maxSessionLifetimeMinutes: 0 + selfServicePasswordReset: + access: ALLOW + settings: + allowRecoveryEmailWithoutEnrollment: true + requirement: + primary: + methods: + - sms + - email + stepUp: + required: false + selfServiceUnlock: + access: ALLOW + system: false + type: PASSWORD + oamp-id-proofing-policy-rule-response: + summary: Okta account management policy - account management policy rule with ID proofing enabled + value: + id: ruleId _links: self: href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} @@ -4392,246 +5616,235 @@ components: - PUT - DELETE deactivate: - href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate hints: allow: - - GET - - PUT - - DELETE - deny-rule-response: - summary: Global session policy - Deny users - value: - id: rule8jjozjGMGbHyC1d6 + - POST + name: Account management policy rule + priority: 1 status: ACTIVE - type: SIGN_ON - name: Deny - priority: 0 - created: '2024-04-25T17:35:02.000Z' - lastUpdated: '2024-04-25T17:35:02.000Z' - system: false conditions: people: users: exclude: [] network: connection: ANYWHERE - authContext: - authType: ANY - risk: - behaviors: [] - riskScore: - level: ANY - identityProvider: - provider: ANY actions: - signon: - access: DENY - requireFactor: false - primaryFactor: PASSWORD_IDP - rememberDeviceByDefault: false - session: - usePersistentCookie: false - maxSessionIdleMinutes: 120 - maxSessionLifetimeMinutes: 0 - _links: - self: - href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} - hints: - allow: - - GET - - PUT - - DELETE - deactivate: - href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} - hints: - allow: - - GET - - PUT - - DELETE - twofa-enabled-post-auth-kmsi-enabled-response: + appSignOn: + access: ALLOW + verificationMethod: + id: entity_id + type: ID_PROOFING + device-condition-with-oamp-response: x-okta-lifecycle: - lifecycle: LIMITED_GA + lifecycle: EA isGenerallyAvailable: false SKUs: - Okta Identity Engine - summary: >- - Authentication policy - 2FA with granular authentication with Keep Me - Signed In (KMSI) enabled + summary: Okta account management policy rule with device conditions value: - id: rul7yut96gmsOzKAA1d6 - status: ACTIVE - name: 2FA with Post Auth KMSI prompt enabled - priority: 0 - created: '2023-05-01T21:13:15.000Z' - lastUpdated: '2023-05-01T21:13:15.000Z' system: false - conditions: null + type: ACCESS_POLICY + id: rul2nf9gMuOPzNITs0g4 + name: OAMP rule with device conditions + priority: 0 + status: ACTIVE + created: '2025-09-07T19:35:36.000Z' + lastUpdated: '2025-10-21T22:40:27.000Z' + conditions: + userType: + include: [] + exclude: [] + network: + connection: ANYWHERE + people: + users: + exclude: [] + include: [] + groups: + include: [] + exclude: [] + device: + registered: true + managed: true + assurance: + include: + - dae1f42iavrXPlAtG0g5 + riskScore: + level: ANY + platform: + include: [] + elCondition: {} actions: appSignOn: access: ALLOW verificationMethod: - factorMode: 2FA - type: ASSURANCE + factorMode: 1FA reauthenticateIn: PT0S constraints: - knowledge: - excludedAuthenticationMethods: - key: okta_password - required: true - keepMeSignedIn: - postAuth: ALLOWED - postAuthPromptFrequency: PT720H - type: ACCESS_POLICY + - possession: + phishingResistant: REQUIRED + userVerification: OPTIONAL + type: ASSURANCE _links: self: - href: >- - https://{yourOktaDomain}/api/v1/policies/rst7xus97faIAgmti1d7/rules/rul7yut96gmsOzKAA1d6 + href: https://{yourOktaDomain}/api/v1/policies/rst159zO35QB45yzK0g4/rules/rul2nf9gMuOPzNITs0g4 hints: allow: - GET - PUT + - DELETE deactivate: - href: >- - https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/policies/rst159zO35QB45yzK0g4/rules/rul2nf9gMuOPzNITs0g4/lifecycle/deactivate hints: allow: - POST - twofa-enabled-post-auth-kmsi-disabled-response: - x-okta-lifecycle: - lifecycle: LIMITED_GA - isGenerallyAvailable: false - SKUs: - - Okta Identity Engine - summary: >- - Authentication policy - 2FA with granular authentication with Keep Me - Signed In (KMSI) disabled + post-auth-session-rule-response: + summary: Session violation enforcement policy - terminate session on violation value: - id: rul7yut96gmsOzKAA1d6 + id: rul0bxv29jpuRnMDD4g9 + name: Terminate Session on Risk status: ACTIVE - name: 2FA with Post Auth KMSI prompt disabled + description: Defines the enforcement actions taken after a session violation is detected. In this example, the session is terminated if the policy re-evaluation fails. priority: 0 - created: '2023-05-01T21:13:15.000Z' - lastUpdated: '2023-05-01T21:13:15.000Z' + created: '2023-10-15T08:00:00.000Z' + lastUpdated: '2023-10-15T08:00:00.000Z' system: false - conditions: null + type: POST_AUTH_SESSION actions: - appSignOn: - access: ALLOW - verificationMethod: - factorMode: 2FA - type: ASSURANCE - reauthenticateIn: PT0S - constraints: - knowledge: - excludedAuthenticationMethods: - key: okta_password - required: true - keepMeSignedIn: - postAuth: NOT_ALLOWED - type: ACCESS_POLICY + postAuthSession: + failureActions: + - action: TERMINATE_SESSION _links: self: - href: >- - https://{yourOktaDomain}/api/v1/policies/rst7xus97faIAgmti1d7/rules/rul7yut96gmsOzKAA1d6 + href: https://{yourOktaDomain}/api/v1/policies/pol123uvw/rules/rul0bxv29jpuRnMDD4g9 hints: allow: - GET - PUT - deactivate: - href: >- - https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate - hints: - allow: - - POST - sspr-enabled-sso-step-up-with-constraints-response: - summary: >- - Password policy - Enable self-service password change, reset, or unlock - with OTP enabled and Google Authenticator constraint + - DELETE + entity-risk-rule-response: + summary: Entity risk policy - remediate identity-based threats value: - id: ruleId + id: rul8zvt07hnsPkLBB2e7 + name: Risk Remediation Rule + status: ACTIVE + description: Monitors the org for entity risk changes (e.g., brute-force attacks, session hijacking). Configured here to automatically sign users out of all Okta and app sessions when specific identity-based threats are detected. + priority: 0 + created: '2023-11-01T10:00:00.000Z' + lastUpdated: '2023-11-05T14:30:00.000Z' + system: false + type: ENTITY_RISK + actions: + entityRisk: + actions: + - action: TERMINATE_ALL_SESSIONS _links: self: - href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} + href: https://{yourOktaDomain}/api/v1/policies/pol456xyz/rules/rul8zvt07hnsPkLBB2e7 hints: allow: - GET - PUT - DELETE - deactivate: - href: >- - https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate - hints: - allow: - - POST - name: SSPR Rule - priority: 1 + session-violation-detection-rule-response: + summary: Session violation detection policy - re-evaluate on High risk + value: + id: rul9awu18iotQlMCC3f8 + name: High Risk Session Detection status: ACTIVE + priority: 1 + created: '2023-11-01T10:00:00.000Z' + lastUpdated: '2023-11-01T10:00:00.000Z' + system: false + type: SESSION_VIOLATION_DETECTION conditions: - people: - users: - exclude: [] - network: - connection: ANYWHERE + riskScore: + minRiskLevel: HIGH actions: - passwordChange: - access: ALLOW - selfServicePasswordReset: - access: ALLOW - requirement: - primary: - methods: - - push - - sms - - otp - methodConstraints: - - method: otp - allowedAuthenticators: - - key: google_otp - stepUp: - required: true - selfServiceUnlock: - access: ALLOW - system: false - type: PASSWORD - oamp-id-proofing-policy-rule-response: - summary: >- - Account Management Policy - Account management policy rule with ID - proofing enabled - value: - id: ruleId + sessionViolationDetection: + policyEvaluation: + enabled: true _links: self: - href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} + href: https://{yourOktaDomain}/api/v1/policies/pol789abc/rules/rul9awu18iotQlMCC3f8 hints: allow: - GET - PUT - DELETE - deactivate: - href: >- - https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate - hints: - allow: - - POST - name: Account Management Policy Rule - priority: 1 + update-auth-policy-rule-condition-response: + summary: App sign-in policy - rule with conditions + value: + id: rulezuo73ySrHndLb1d7 status: ACTIVE + name: Rule with conditions - exclude a group + priority: 0 + created: '2024-04-25T17:35:02.000Z' + lastUpdated: '2024-04-25T17:35:02.000Z' + system: false conditions: people: users: exclude: [] + groups: + exclude: + - 00u7yq5goxNFTiMjW1d7 network: - connection: ANYWHERE + connection: ZONE + exclude: + - nzo9o4rctwQCJNE6y1d7 + platform: + include: + - type: MOBILE + os: + type: IOS + - type: MOBILE + os: + type: ANDROID + - type: DESKTOP + os: + type: MACOS + exclude: [] + riskScore: + level: ANY + userType: + include: [] + exclude: + - otyezu4m0xN6w5JEa1d7 + elCondition: + condition: security.risk.level == 'HIGH' actions: appSignOn: access: ALLOW verificationMethod: - id: entity_id - type: ID_PROOFING + factorMode: 2FA + type: ASSURANCE + reauthenticateIn: PT2H + constraints: + knowledge: + required: true + types: + - password + reauthenticateIn: PT2H + type: ACCESS_POLICY + _links: + self: + href: https://{yourOktaDomain}/api/v1/policies/rst7xus97faIAgmti1d7/rules/rul7yut96gmsOzKAA1d6 + hints: + allow: + - GET + - PUT + - DELETE + deactivate: + href: https://{yourOktaDomain}/api/v1/policies/rst7xus97faIAgmti1d7/rules/rul7yut96gmsOzKAA1d6 + hints: + allow: + - GET + - PUT + - DELETE sspr-enabled-sq-step-up-update: - summary: >- - Password policy - Self-service password change, reset, or unlock with - security question as step up + summary: Password policy - Self-service password change, reset, or unlock with security question as step up value: id: ruleId name: SSPR Rule @@ -4662,9 +5875,7 @@ components: system: false type: PASSWORD sspr-enabled-sso-step-up-update: - summary: >- - Password policy - Self-service password change, reset, or unlock with - any SSO authenticator as step up + summary: Password policy - Self-service password change, reset, or unlock with any SSO authenticator as step up value: id: ruleId name: SSPR Rule @@ -4693,9 +5904,7 @@ components: system: false type: PASSWORD sspr-enabled-no-step-up-update: - summary: >- - Password policy - Self-service password change, reset, or unlock with no - step up + summary: Password policy - Self-service password change, reset, or unlock with no step up value: id: ruleId name: SSPR Rule @@ -4724,9 +5933,7 @@ components: system: false type: PASSWORD sspr-enabled-OAMP-update: - summary: >- - Password policy - Self-service password change, reset, or unlock - requirements defined by Okta account management policy + summary: Password policy - Self-service password change, reset, or unlock requirements defined by Okta account management policy value: id: ruleId name: SSPR Rule @@ -4755,82 +5962,45 @@ components: access: ALLOW system: false type: PASSWORD - update-auth-policy-rule-condition-response: - summary: Authentication policy - Rule with conditions + sspr-enabled-sso-step-up-with-constraints-update: + summary: Password policy - Enable self-service password change, reset, or unlock with OTP enabled and Google Authenticator constraint value: - id: rulezuo73ySrHndLb1d7 + id: ruleId + name: SSPR Rule + priority: 1 status: ACTIVE - name: Rule with conditions - exclude a group - priority: 0 - created: '2024-04-25T17:35:02.000Z' - lastUpdated: '2024-04-25T17:35:02.000Z' - system: false conditions: people: users: exclude: [] - groups: - exclude: - - 00u7yq5goxNFTiMjW1d7 network: - connection: ZONE - exclude: - - nzo9o4rctwQCJNE6y1d7 - platform: - include: - - type: MOBILE - os: - type: IOS - - type: MOBILE - os: - type: ANDROID - - type: DESKTOP - os: - type: MACOS - exclude: [] - riskScore: - level: ANY - userType: - include: [] - exclude: - - otyezu4m0xN6w5JEa1d7 - elCondition: - condition: security.risk.level == 'HIGH' + connection: ANYWHERE actions: - appSignOn: + passwordChange: access: ALLOW - verificationMethod: - factorMode: 2FA - type: ASSURANCE - reauthenticateIn: PT2H - constraints: - knowledge: - required: true - types: - - password - reauthenticateIn: PT2H - type: ACCESS_POLICY - _links: - self: - href: >- - https://{yourOktaDomain}/api/v1/policies/rst7xus97faIAgmti1d7/rules/rul7yut96gmsOzKAA1d6 - hints: - allow: - - GET - - PUT - - DELETE - deactivate: - href: >- - https://{yourOktaDomain}/api/v1/policies/rst7xus97faIAgmti1d7/rules/rul7yut96gmsOzKAA1d6 - hints: - allow: - - GET - - PUT - - DELETE - sspr-enabled-sso-step-up-with-constraints-update: - summary: >- - Password policy - Enable self-service password change, reset, or unlock - with OTP enabled and Google Authenticator constraint + selfServicePasswordReset: + access: ALLOW + requirement: + primary: + methods: + - push + - sms + - otp + methodConstraints: + - method: otp + allowedAuthenticators: + - key: google_otp + stepUp: + required: true + selfServiceUnlock: + access: ALLOW + system: false + type: PASSWORD + sspr-recovery-email-without-enrollment-update: + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: true + summary: Password policy - Self-service password change, reset, or unlock allow recovery email without email enrollment value: id: ruleId name: SSPR Rule @@ -4847,24 +6017,56 @@ components: access: ALLOW selfServicePasswordReset: access: ALLOW + settings: + allowRecoveryEmailWithoutEnrollment: true requirement: primary: methods: - - push - sms - - otp - methodConstraints: - - method: otp - allowedAuthenticators: - - key: google_otp + - email stepUp: - required: true + required: false selfServiceUnlock: access: ALLOW system: false type: PASSWORD + identity-claim-sourcing-rule-response: + x-okta-lifecycle: + lifecycle: EA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + summary: Identity claims sourcing policy rule + value: + id: rulIdentityClaimSourcing + name: Catch-all rule + status: ACTIVE + priority: 99 + created: '2026-02-17T15:12:42.000Z' + lastUpdated: '2026-02-19T20:59:00.000Z' + system: true + type: IDENTITY_CLAIM_SOURCING + conditions: null + actions: + claimSourcing: + redirectType: IDP_DISCOVERY + refresh: + redirectType: FIXED + filter: + include: + - id: idpId1 + name: idpName1 + - id: idpId2 + name: idpName2 + _links: + self: + href: https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId} + hints: + allow: + - GET + - PUT update-auth-policy-rule-condition: - summary: Authentication policy - Rule with conditions + summary: App sign-in policy - rule with conditions value: type: ACCESS_POLICY name: Rule with conditions - exclude a group @@ -4902,6 +6104,22 @@ components: type: MACOS elCondition: condition: security.risk.level == 'HIGH' + update-device-signal-collection-rule: + x-okta-lifecycle: + lifecycle: EA + isGenerallyAvailable: false + SKUs: [] + summary: Device signal collection policy - disallow Okta Verify from identifying users + value: + name: Device signal collection rule + actions: + deviceSignalCollection: + deviceContextProviders: + - key: OKTA_VERIFY + userIdentification: IGNORE + - key: DEVICE_POSTURE_IDP + id: 0oa159mE9aOSpCwmr0g4 + type: DEVICE_SIGNAL_COLLECTION update-identifiers-in-user-profile-policy: summary: User profile policy - Configure multiple identifiers value: @@ -4935,16 +6153,45 @@ components: allowedIdentifiers: - login - customAttribute - update-device-signal-collection-rule: + identity-claim-sourcing-rule-example: + x-okta-lifecycle: + lifecycle: EA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + summary: Identity claims sourcing rule + value: + type: IDENTITY_CLAIM_SOURCING + name: Catch-all rule + status: ACTIVE + priority: 99 + conditions: null + actions: + claimSourcing: + redirectType: IDP_DISCOVERY + refresh: + redirectType: FIXED + filter: + include: + - id: idpId1 + name: idpName1 + - id: idpId2 + name: idpName2 + update-device-signal-collection-rule-response: x-okta-lifecycle: lifecycle: EA isGenerallyAvailable: false SKUs: [] - summary: >- - Device signal collection policy - disallow Okta Verify from identifying - users + summary: Device signal collection policy - collect context for Okta Verify devices value: + id: rul7yut96gmsOzKAA1d6 + status: ACTIVE name: Device signal collection rule + priority: 0 + created: '2023-05-01T21:13:15.000Z' + lastUpdated: '2023-05-01T21:13:15.000Z' + system: false + conditions: null actions: deviceSignalCollection: deviceContextProviders: @@ -4953,6 +6200,13 @@ components: - key: DEVICE_POSTURE_IDP id: 0oa159mE9aOSpCwmr0g4 type: DEVICE_SIGNAL_COLLECTION + _links: + self: + href: https://{yourOktaDomain}/api/v1/policies/rst7xus97faIAgmti1d7/rules/rul7yut96gmsOzKAA1d6 + hints: + allow: + - GET + - PUT update-identifiers-in-user-profile-policy-response: summary: User profile policy - Configure multiple identifiers value: @@ -4993,39 +6247,6 @@ components: allowedIdentifiers: - login - customAttribute - update-device-signal-collection-rule-response: - x-okta-lifecycle: - lifecycle: EA - isGenerallyAvailable: false - SKUs: [] - summary: >- - Device signal collection policy - collect context for Okta Verify - devices - value: - id: rul7yut96gmsOzKAA1d6 - status: ACTIVE - name: Device signal collection rule - priority: 0 - created: '2023-05-01T21:13:15.000Z' - lastUpdated: '2023-05-01T21:13:15.000Z' - system: false - conditions: null - actions: - deviceSignalCollection: - deviceContextProviders: - - key: OKTA_VERIFY - userIdentification: IGNORE - - key: DEVICE_POSTURE_IDP - id: 0oa159mE9aOSpCwmr0g4 - type: DEVICE_SIGNAL_COLLECTION - _links: - self: - href: >- - https://{yourOktaDomain}/api/v1/policies/rst7xus97faIAgmti1d7/rules/rul7yut96gmsOzKAA1d6 - hints: - allow: - - GET - - PUT ErrorAccessDenied: summary: Access Denied value: @@ -5070,18 +6291,42 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.policies + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListPoliciesResponse' + transform: + body: |- + {{- $wrapped := printf "{\"policies\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_policy: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1policies/post' response: mediaType: application/json openAPIDocKey: '200' create_policy_simulation: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1policies~1simulate/post' response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.create_policy_simulation + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/CreatePolicySimulationResponse' + transform: + body: |- + {{- $wrapped := printf "{\"create_policy_simulation\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 get_policy: operation: $ref: '#/paths/~1api~1v1~1policies~1{policyId}/get' @@ -5089,6 +6334,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_policy: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1policies~1{policyId}/put' response: @@ -5098,7 +6346,7 @@ components: operation: $ref: '#/paths/~1api~1v1~1policies~1{policyId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' clone_policy: operation: @@ -5110,19 +6358,18 @@ components: operation: $ref: '#/paths/~1api~1v1~1policies~1{policyId}~1lifecycle~1activate/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' deactivate_policy: operation: - $ref: >- - #/paths/~1api~1v1~1policies~1{policyId}~1lifecycle~1deactivate/post + $ref: '#/paths/~1api~1v1~1policies~1{policyId}~1lifecycle~1deactivate/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: '#/components/x-stackQL-resources/policies/methods/list_policies' - $ref: '#/components/x-stackQL-resources/policies/methods/get_policy' + - $ref: '#/components/x-stackQL-resources/policies/methods/list_policies' insert: - $ref: '#/components/x-stackQL-resources/policies/methods/create_policy' update: [] @@ -5141,10 +6388,18 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.policy_apps + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListPolicyAppsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"policy_apps\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/policy_apps/methods/list_policy_apps + - $ref: '#/components/x-stackQL-resources/policy_apps/methods/list_policy_apps' insert: [] update: [] delete: [] @@ -5160,7 +6415,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.policy_mappings + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListPolicyMappingsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"policy_mappings\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 map_resource_to_policy: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1policies~1{policyId}~1mappings/post' response: @@ -5174,22 +6441,18 @@ components: openAPIDocKey: '200' delete_policy_resource_mapping: operation: - $ref: >- - #/paths/~1api~1v1~1policies~1{policyId}~1mappings~1{mappingId}/delete + $ref: '#/paths/~1api~1v1~1policies~1{policyId}~1mappings~1{mappingId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/policy_mappings/methods/list_policy_mappings - - $ref: >- - #/components/x-stackQL-resources/policy_mappings/methods/get_policy_mapping + - $ref: '#/components/x-stackQL-resources/policy_mappings/methods/get_policy_mapping' + - $ref: '#/components/x-stackQL-resources/policy_mappings/methods/list_policy_mappings' insert: [] update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/policy_mappings/methods/delete_policy_resource_mapping + - $ref: '#/components/x-stackQL-resources/policy_mappings/methods/delete_policy_resource_mapping' replace: [] policy_rules: id: okta.policies.policy_rules @@ -5202,7 +6465,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.policy_rules + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListPolicyRulesResponse' + transform: + body: |- + {{- $wrapped := printf "{\"policy_rules\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_policy_rule: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1policies~1{policyId}~1rules/post' response: @@ -5215,6 +6490,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_policy_rule: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1policies~1{policyId}~1rules~1{ruleId}/put' response: @@ -5224,44 +6502,45 @@ components: operation: $ref: '#/paths/~1api~1v1~1policies~1{policyId}~1rules~1{ruleId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' activate_policy_rule: operation: - $ref: >- - #/paths/~1api~1v1~1policies~1{policyId}~1rules~1{ruleId}~1lifecycle~1activate/post + $ref: '#/paths/~1api~1v1~1policies~1{policyId}~1rules~1{ruleId}~1lifecycle~1activate/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' deactivate_policy_rule: operation: - $ref: >- - #/paths/~1api~1v1~1policies~1{policyId}~1rules~1{ruleId}~1lifecycle~1deactivate/post + $ref: '#/paths/~1api~1v1~1policies~1{policyId}~1rules~1{ruleId}~1lifecycle~1deactivate/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/policy_rules/methods/list_policy_rules - - $ref: >- - #/components/x-stackQL-resources/policy_rules/methods/get_policy_rule + - $ref: '#/components/x-stackQL-resources/policy_rules/methods/get_policy_rule' + - $ref: '#/components/x-stackQL-resources/policy_rules/methods/list_policy_rules' insert: - - $ref: >- - #/components/x-stackQL-resources/policy_rules/methods/create_policy_rule + - $ref: '#/components/x-stackQL-resources/policy_rules/methods/create_policy_rule' update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/policy_rules/methods/delete_policy_rule + - $ref: '#/components/x-stackQL-resources/policy_rules/methods/delete_policy_rule' replace: - - $ref: >- - #/components/x-stackQL-resources/policy_rules/methods/replace_policy_rule + - $ref: '#/components/x-stackQL-resources/policy_rules/methods/replace_policy_rule' servers: - url: https://{subdomain}.okta.com/ variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/principal_rate_limits.yaml b/providers/src/okta/v00.00.00000/services/principal_rate_limits.yaml index 41663890..c7006a92 100644 --- a/providers/src/okta/v00.00.00000/services/principal_rate_limits.yaml +++ b/providers/src/okta/v00.00.00000/services/principal_rate_limits.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: principal_rate_limits API description: okta principal_rate_limits API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/principal-rate-limits: get: @@ -46,9 +46,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/PrincipalRateLimitEntity' + $ref: '#/components/schemas/ListPrincipalRateLimitEntitiesResponse' examples: SSWSListAll: $ref: '#/components/examples/PrincipalRateLimitsSSWSListAllExample' @@ -145,6 +143,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathPrincipalRateLimitId' put: summary: Replace a principal rate limit description: Replaces a principal rate limit entity by `principalRateLimitId` @@ -188,8 +188,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathPrincipalRateLimitId' + parameters: + - $ref: '#/components/parameters/pathPrincipalRateLimitId' components: schemas: PrincipalRateLimitEntity: @@ -283,6 +283,13 @@ components: properties: errorSummary: type: string + ListPrincipalRateLimitEntitiesResponse: + type: object + properties: + principal_rate_limit_entities: + type: array + items: + $ref: '#/components/schemas/PrincipalRateLimitEntity' responses: ErrorApiValidationFailed400: description: Bad Request @@ -470,7 +477,21 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.principal_rate_limit_entities + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListPrincipalRateLimitEntitiesResponse' + transform: + body: >- + {{- $wrapped := printf "{\"principal_rate_limit_entities\":%s}" + . -}} + + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_principal_rate_limit_entity: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1principal-rate-limits/post' response: @@ -484,6 +505,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_principal_rate_limit_entity: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: >- #/paths/~1api~1v1~1principal-rate-limits~1{principalRateLimitId}/put @@ -492,10 +516,10 @@ components: openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/principal_rate_limit_entities/methods/list_principal_rate_limit_entities - $ref: >- #/components/x-stackQL-resources/principal_rate_limit_entities/methods/get_principal_rate_limit_entity + - $ref: >- + #/components/x-stackQL-resources/principal_rate_limit_entities/methods/list_principal_rate_limit_entities insert: - $ref: >- #/components/x-stackQL-resources/principal_rate_limit_entities/methods/create_principal_rate_limit_entity @@ -509,7 +533,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/privileged_access.yaml b/providers/src/okta/v00.00.00000/services/privileged_access.yaml index 83c14cd3..7ea645b4 100644 --- a/providers/src/okta/v00.00.00000/services/privileged_access.yaml +++ b/providers/src/okta/v00.00.00000/services/privileged_access.yaml @@ -2,8 +2,223 @@ openapi: 3.0.3 info: title: privileged_access API description: okta privileged_access API - version: 5.1.0 + version: 2026.07.2 paths: + /privileged-access/api/v1/okta-service-accounts: + get: + x-okta-iam-admin-roles: + - SUPER_ADMIN + summary: List all Okta managed user accounts + description: >- + Lists all Okta managed user accounts in your org. + + + Use the `match` parameter to search for accounts where the account name + (`name`) or username (`username`) contains the specified value. + operationId: listOktaManagedUserAccounts + parameters: + - $ref: '#/components/parameters/queryLimit' + - $ref: '#/components/parameters/queryAfter' + - $ref: '#/components/parameters/oktaManagedUserMatchQueryFilter' + responses: + '200': + description: Success + content: + application/json: + schema: + $ref: '#/components/schemas/ListOktaManagedUserAccountsResponse' + examples: + ListOktaManagedUserAccounts: + $ref: '#/components/examples/ListOktaManagedUserAccounts' + '400': + $ref: '#/components/responses/ErrorApiValidationFailed400' + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: + - apiToken: [] + - oauth2: + - okta.serviceAccounts.okta.read + tags: + - OktaManagedUserAccount + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: [] + post: + x-okta-iam-admin-roles: + - SUPER_ADMIN + summary: Create an Okta managed user account + description: >- + Creates a new Okta managed user account for managing a Universal + Directory user as a service account. + + + You must specify an existing Okta user in your org with the `oktaUserId` + request parameter. + operationId: createOktaManagedUserAccount + x-codegen-request-body-name: body + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/OktaManagedUserAccountRequest' + examples: + CreateOktaManagedUserAccount: + $ref: '#/components/examples/CreateOktaManagedUserAccountRequest' + required: true + responses: + '201': + description: Created + content: + application/json: + schema: + $ref: '#/components/schemas/OktaManagedUserAccountResponse' + examples: + OktaManagedUserAccountResponse: + $ref: '#/components/examples/OktaManagedUserAccountResponse' + '400': + $ref: '#/components/responses/ErrorApiValidationFailed400' + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: + - apiToken: [] + - oauth2: + - okta.serviceAccounts.okta.manage + tags: + - OktaManagedUserAccount + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: [] + /privileged-access/api/v1/okta-service-accounts/{id}: + get: + x-okta-iam-admin-roles: + - SUPER_ADMIN + summary: Retrieve an Okta managed user account + description: Retrieves an Okta managed user account specified by ID + operationId: getOktaManagedUserAccount + responses: + '200': + description: Success + content: + application/json: + schema: + $ref: '#/components/schemas/OktaManagedUserAccountResponse' + examples: + OktaManagedUserAccountResponse: + $ref: '#/components/examples/OktaManagedUserAccountResponse' + '400': + $ref: '#/components/responses/ErrorApiValidationFailed400' + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: + - apiToken: [] + - oauth2: + - okta.serviceAccounts.okta.read + tags: + - OktaManagedUserAccount + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: [] + parameters: + - $ref: '#/components/parameters/oktaManagedUserAccountId' + patch: + x-okta-iam-admin-roles: + - SUPER_ADMIN + summary: Update an Okta managed user account + description: >- + Updates an existing Okta managed user account specified by ID. + + + You can only update the `name`, `description`, `ownerUserIds`, and + `ownerGroupIds` properties. + operationId: updateOktaManagedUserAccount + x-codegen-request-body-name: body + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/OktaManagedUserAccountForUpdate' + examples: + UpdateOktaManagedUserAccount: + $ref: '#/components/examples/UpdateOktaManagedUserAccountRequest' + responses: + '200': + description: Success + content: + application/json: + schema: + $ref: '#/components/schemas/OktaManagedUserAccountResponse' + examples: + OktaManagedUserAccountResponse: + $ref: '#/components/examples/OktaManagedUserAccountResponse' + '400': + $ref: '#/components/responses/ErrorApiValidationFailed400' + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: + - apiToken: [] + - oauth2: + - okta.serviceAccounts.okta.manage + tags: + - OktaManagedUserAccount + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: [] + parameters: + - $ref: '#/components/parameters/oktaManagedUserAccountId' + delete: + x-okta-iam-admin-roles: + - SUPER_ADMIN + summary: Delete an Okta managed user account + description: >- + Deletes an Okta managed user account specified by ID. + + + This operation removes the service account management for the Okta user, + suspends the underlying Okta user account, + + but doesn't delete the user from Universal Directory. + operationId: deleteOktaManagedUserAccount + responses: + '204': + description: No Content + '400': + $ref: '#/components/responses/ErrorApiValidationFailed400' + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + '429': + $ref: '#/components/responses/ErrorTooManyRequests429' + security: + - apiToken: [] + - oauth2: + - okta.serviceAccounts.okta.manage + tags: + - OktaManagedUserAccount + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: [] + parameters: + - $ref: '#/components/parameters/oktaManagedUserAccountId' /privileged-access/api/v1/service-accounts: get: summary: List all app service accounts @@ -22,9 +237,7 @@ paths: ListAppServiceAccounts: $ref: '#/components/examples/ListAppServiceAccounts' schema: - type: array - items: - $ref: '#/components/schemas/AppServiceAccount' + $ref: '#/components/schemas/ListAppServiceAccountsResponse' '400': $ref: '#/components/responses/ErrorApiValidationFailed400' '403': @@ -40,7 +253,7 @@ paths: tags: - ServiceAccount x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] post: @@ -76,7 +289,7 @@ paths: tags: - ServiceAccount x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] /privileged-access/api/v1/service-accounts/{id}: @@ -106,9 +319,11 @@ paths: tags: - ServiceAccount x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] + parameters: + - $ref: '#/components/parameters/serviceAccountId' patch: summary: Update an existing app service account description: Updates an existing app service account specified by ID @@ -141,9 +356,11 @@ paths: tags: - ServiceAccount x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] + parameters: + - $ref: '#/components/parameters/serviceAccountId' delete: summary: Delete an app service account description: Deletes an app service account specified by ID @@ -166,13 +383,204 @@ paths: tags: - ServiceAccount x-okta-lifecycle: - lifecycle: EA + lifecycle: GA isGenerallyAvailable: false SKUs: [] - parameters: - - $ref: '#/components/parameters/serviceAccountId' + parameters: + - $ref: '#/components/parameters/serviceAccountId' components: schemas: + OktaManagedUserAccountResponse: + description: >- + An Okta managed user account representing a Universal Directory user + managed as a service account + type: object + properties: + created: + type: string + format: date-time + description: Timestamp when the Okta managed user account was created + readOnly: true + example: '2023-04-04T15:56:05.000Z' + description: + description: The description of the Okta managed user account + format: regex + maxLength: 255 + minLength: 0 + type: string + example: Shared admin account for managing AD integrations + email: + description: >- + The email address associated with the Okta user. This parameter is + read-only, and it is derived from the Okta user profile. + type: string + example: foo@bar.com + readOnly: true + id: + description: The UUID of the Okta managed user account + format: regex + pattern: >- + (?i)^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$ + readOnly: true + type: string + example: d1b65a78-21ed-429b-8ea3-eec96f2748d6 + lastUpdated: + type: string + format: date-time + description: Timestamp when the Okta managed user account was last updated + readOnly: true + example: '2023-05-05T18:15:44.000Z' + name: + description: The user-defined name for the Okta managed user account + format: regex + maxLength: 50 + minLength: 1 + pattern: ^[\w\-_. ]+$ + type: string + example: AD Integrations Admin + oktaUserId: + description: The ID of the Okta user being managed as a service account + type: string + minLength: 20 + maxLength: 20 + example: 00u11s48P9zGW8yqm0g5 + ownerGroupIds: + description: >- + A list of IDs of the Okta groups who own the Okta managed user + account + type: array + items: + type: string + minItems: 0 + maxItems: 10 + example: + - 00g57qp78yZT2XBA40g7 + ownerUserIds: + description: >- + A list of IDs of the Okta users who own the Okta managed user + account + type: array + items: + type: string + minItems: 0 + maxItems: 10 + example: + - 00u11s48P9zGW8yqm0g5 + status: + $ref: '#/components/schemas/ServiceAccountStatus' + statusDetail: + $ref: '#/components/schemas/ServiceAccountStatusDetail' + username: + description: >- + The username associated with the Okta user. This parameter is + read-only, and it is derived from the Okta user profile. + type: string + readOnly: true + example: shr-ad-admin-01@example.com + required: + - id + - name + - oktaUserId + - username + - email + OktaManagedUserAccountRequest: + description: Request body for creating an Okta managed user account + type: object + properties: + description: + description: The description of the Okta managed user account + format: regex + maxLength: 255 + minLength: 0 + type: string + example: Shared admin account for managing AD integrations + name: + description: The user-defined name for the Okta managed user account + format: regex + maxLength: 50 + minLength: 1 + pattern: ^[\w\-_. ]+$ + type: string + example: AD Integrations Admin + oktaUserId: + description: |- + The ID of the Okta user to manage as a service account. + This must be an existing user in your Okta org. + type: string + minLength: 20 + maxLength: 20 + pattern: ^[a-zA-Z0-9]+$ + example: 00u11s48P9zGW8yqm0g5 + ownerGroupIds: + description: >- + A list of IDs of the Okta groups who own the Okta managed user + account + type: array + items: + type: string + minLength: 20 + maxLength: 20 + minItems: 0 + maxItems: 10 + example: + - 00g57qp78yZT2XBA40g7 + ownerUserIds: + description: >- + A list of IDs of the Okta users who own the Okta managed user + account + type: array + items: + type: string + minLength: 20 + maxLength: 20 + minItems: 0 + maxItems: 10 + example: + - 00u11s48P9zGW8yqm0g5 + required: + - name + - oktaUserId + OktaManagedUserAccountForUpdate: + description: Request body for updating an Okta managed user account + type: object + properties: + description: + description: The description of the Okta managed user account + format: regex + maxLength: 255 + minLength: 0 + type: string + example: Updated description for AD integrations admin account + name: + description: The user-defined name for the Okta managed user account + format: regex + maxLength: 50 + minLength: 1 + pattern: ^[\w\-_. ]+$ + type: string + example: AD Integrations Admin - Updated + ownerGroupIds: + description: >- + A list of IDs of the Okta groups who own the Okta managed user + account + type: array + items: + type: string + minItems: 0 + maxItems: 10 + example: + - 00g57qp78yZT2XBA40g7 + ownerUserIds: + description: >- + A list of IDs of the Okta users who own the Okta managed user + account + type: array + items: + type: string + minItems: 0 + maxItems: 10 + example: + - 00u11s48P9zGW8yqm0g5 AppServiceAccount: type: object properties: @@ -253,10 +661,10 @@ components: password: type: string writeOnly: true - description: >- - The app service account password. Required for apps that don't have - provisioning enabled or don't support password synchronization. + description: The app service account password format: password + minLength: 1 + maxLength: 255 status: $ref: '#/components/schemas/ServiceAccountStatus' statusDetail: @@ -274,6 +682,7 @@ components: - name - containerOrn - username + - password AppServiceAccountForUpdate: type: object properties: @@ -311,7 +720,7 @@ components: example: - 00u11s48P9zGW8yqm0g5 ServiceAccountStatus: - description: Describes the current status of an app service account + description: Describes the current status of a service account example: UNSECURED type: string enum: @@ -332,7 +741,7 @@ components: ERROR: An error is preventing Okta Privileged Access from using the account readOnly: true ServiceAccountStatusDetail: - description: Describes the detailed status of an app service account + description: Describes the detailed status of a service account example: STAGED type: string enum: @@ -343,6 +752,7 @@ components: - ROTATING - ROTATION_FAILED - STAGED + - UNMANAGED - VAULTED x-enumDescriptions: PENDING: The account is being created @@ -365,6 +775,9 @@ components: MISSING_PASSWORD: >- The account is assigned to a project in Okta Privileged Access. A password isn't assigned to the account. + UNMANAGED: >- + The account is assigned to a project in Okta Privileged Access. + Initial password sync hasn't been attempted. readOnly: true Error: title: Error @@ -396,6 +809,20 @@ components: properties: errorSummary: type: string + ListOktaManagedUserAccountsResponse: + type: object + properties: + okta_managed_user_accounts: + type: array + items: + $ref: '#/components/schemas/OktaManagedUserAccountResponse' + ListAppServiceAccountsResponse: + type: object + properties: + app_service_accounts: + type: array + items: + $ref: '#/components/schemas/AppServiceAccount' responses: ErrorApiValidationFailed400: description: Bad Request @@ -415,24 +842,24 @@ components: examples: AccessDenied: $ref: '#/components/examples/ErrorAccessDenied' - ErrorResourceNotFound404: - description: Not Found + ErrorTooManyRequests429: + description: Too Many Requests content: application/json: schema: $ref: '#/components/schemas/Error' examples: - ResourceNotFound: - $ref: '#/components/examples/ErrorResourceNotFound' - ErrorTooManyRequests429: - description: Too Many Requests + TooManyRequests: + $ref: '#/components/examples/ErrorTooManyRequests' + ErrorResourceNotFound404: + description: Not Found content: application/json: schema: $ref: '#/components/schemas/Error' examples: - TooManyRequests: - $ref: '#/components/examples/ErrorTooManyRequests' + ResourceNotFound: + $ref: '#/components/examples/ErrorResourceNotFound' parameters: queryLimit: name: limit @@ -452,7 +879,31 @@ components: The cursor to use for pagination. It is an opaque string that specifies your current location in the list and is obtained from the `Link` response header. See - [Pagination](https://developer.okta.com/docs/api/#pagination). + [Pagination](https://developer.okta.com/docs/api/#pagination) and [Link + header](https://developer.okta.com/docs/api/#link-header). + oktaManagedUserMatchQueryFilter: + name: match + description: >- + Searches for Okta managed user accounts where the account name (`name`) + or username (`username`) contains the given value + in: query + required: false + schema: + type: string + minLength: 3 + maxLength: 255 + example: admin + oktaManagedUserAccountId: + name: id + in: path + description: ID of an existing Okta managed user account + required: true + schema: + type: string + format: regex + pattern: >- + (?i)^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$ + example: a747a818-a4c4-4446-8a87-704216495a08 matchQueryFilter: name: match description: >- @@ -474,7 +925,75 @@ components: schema: type: string examples: + ListOktaManagedUserAccounts: + summary: List Okta managed user accounts + value: + - id: d1b65a78-21ed-429b-8ea3-eec96f2748d6 + name: AD Integrations Admin + description: Shared admin account for managing AD integrations + oktaUserId: 00u11s48P9zGW8yqm0g5 + username: shr-ad-admin-01@example.com + email: shr-ad-admin-01@example.com + ownerUserIds: + - 00u22t59Q0aHbNEXi1h8 + ownerGroupIds: + - 00g57qp78yZT2XBA40g7 + status: NO_ISSUES + statusDetail: UNMANAGED + created: '2023-04-04T15:56:05.000Z' + lastUpdated: '2023-05-05T18:15:44.000Z' + - id: e2c76b89-32fe-530c-9fb4-ffd07f3859e7 + name: SCIM Integration Service Account + description: Service account for SCIM provisioning + oktaUserId: 00u33u60R1bIcOFYj2i9 + username: scim-service@example.com + email: scim-service@example.com + ownerUserIds: + - 00u22t59Q0aHbNEXi1h8 + ownerGroupIds: [] + status: UNSECURED + statusDetail: STAGED + created: '2023-06-15T10:30:00.000Z' + lastUpdated: '2023-06-15T10:30:00.000Z' + CreateOktaManagedUserAccountRequest: + summary: Create an Okta managed user account + value: + name: AD Integrations Admin + description: Shared admin account for managing AD integrations + oktaUserId: 00u11s48P9zGW8yqm0g5 + ownerUserIds: + - 00u22t59Q0aHbNEXi1h8 + ownerGroupIds: + - 00g57qp78yZT2XBA40g7 + OktaManagedUserAccountResponse: + summary: Okta managed user account response + value: + id: d1b65a78-21ed-429b-8ea3-eec96f2748d6 + name: AD Integrations Admin + description: Shared admin account for managing AD integrations + oktaUserId: 00u11s48P9zGW8yqm0g5 + username: shr-ad-admin-01@example.com + email: shr-ad-admin-01@example.com + ownerUserIds: + - 00u22t59Q0aHbNEXi1h8 + ownerGroupIds: + - 00g57qp78yZT2XBA40g7 + status: UNSECURED + statusDetail: STAGED + created: '2023-04-04T15:56:05.000Z' + lastUpdated: '2023-05-05T18:15:44.000Z' + UpdateOktaManagedUserAccountRequest: + summary: Update an Okta managed user account + value: + name: AD Integrations Admin - Production + description: Updated description for production AD integration admin account + ownerUserIds: + - 00u22t59Q0aHbNEXi1h8 + - 00u44v71S2cJdPGZk3j0 + ownerGroupIds: + - 00g57qp78yZT2XBA40g7 ListAppServiceAccounts: + summary: List app service accounts value: - id: a747a818-a4c4-4446-8a87-704216495a08 name: salesforce Prod-1 account @@ -508,7 +1027,6 @@ components: statusDetail: ROTATED created: '2024-04-04T15:56:05.000Z' lastUpdated: '2024-04-05T18:15:44.000Z' - summary: List app service accounts ErrorApiValidationFailed: summary: API Validation Failed value: @@ -525,14 +1043,6 @@ components: errorLink: E0000006 errorId: sampleNUSD_8fdkFd8fs8SDBK errorCauses: [] - ErrorResourceNotFound: - summary: Resource Not Found - value: - errorCode: E0000007 - errorSummary: 'Not found: {0}' - errorLink: E0000007 - errorId: sampleMlLvGUj_YD5v16vkYWY - errorCauses: [] ErrorTooManyRequests: summary: Too Many Requests value: @@ -541,7 +1051,86 @@ components: errorLink: E0000047 errorId: sampleQPivGUj_ND5v78vbYWW errorCauses: [] + ErrorResourceNotFound: + summary: Resource Not Found + value: + errorCode: E0000007 + errorSummary: 'Not found: {0}' + errorLink: E0000007 + errorId: sampleMlLvGUj_YD5v16vkYWY + errorCauses: [] x-stackQL-resources: + okta_service_accounts: + id: okta.privileged_access.okta_service_accounts + name: okta_service_accounts + title: Okta Service Accounts + methods: + list_okta_managed_user_accounts: + operation: + $ref: '#/paths/~1privileged-access~1api~1v1~1okta-service-accounts/get' + response: + mediaType: application/json + openAPIDocKey: '200' + objectKey: $.okta_managed_user_accounts + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListOktaManagedUserAccountsResponse' + transform: + body: >- + {{- $wrapped := printf "{\"okta_managed_user_accounts\":%s}" . + -}} + + {{- $wrapped -}} + type: golang_template_text_v0.3.0 + create_okta_managed_user_account: + config: + requestBodyTranslate: + algorithm: naive + operation: + $ref: '#/paths/~1privileged-access~1api~1v1~1okta-service-accounts/post' + response: + mediaType: application/json + openAPIDocKey: '201' + get_okta_managed_user_account: + operation: + $ref: >- + #/paths/~1privileged-access~1api~1v1~1okta-service-accounts~1{id}/get + response: + mediaType: application/json + openAPIDocKey: '200' + update_okta_managed_user_account: + config: + requestBodyTranslate: + algorithm: naive + operation: + $ref: >- + #/paths/~1privileged-access~1api~1v1~1okta-service-accounts~1{id}/patch + response: + mediaType: application/json + openAPIDocKey: '200' + delete_okta_managed_user_account: + operation: + $ref: >- + #/paths/~1privileged-access~1api~1v1~1okta-service-accounts~1{id}/delete + response: + mediaType: application/json + openAPIDocKey: '204' + sqlVerbs: + select: + - $ref: >- + #/components/x-stackQL-resources/okta_service_accounts/methods/get_okta_managed_user_account + - $ref: >- + #/components/x-stackQL-resources/okta_service_accounts/methods/list_okta_managed_user_accounts + insert: + - $ref: >- + #/components/x-stackQL-resources/okta_service_accounts/methods/create_okta_managed_user_account + update: + - $ref: >- + #/components/x-stackQL-resources/okta_service_accounts/methods/update_okta_managed_user_account + delete: + - $ref: >- + #/components/x-stackQL-resources/okta_service_accounts/methods/delete_okta_managed_user_account + replace: [] service_accounts: id: okta.privileged_access.service_accounts name: service_accounts @@ -553,7 +1142,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.app_service_accounts + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListAppServiceAccountsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"app_service_accounts\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_app_service_account: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1privileged-access~1api~1v1~1service-accounts/post' response: @@ -566,6 +1167,9 @@ components: mediaType: application/json openAPIDocKey: '200' update_app_service_account: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1privileged-access~1api~1v1~1service-accounts~1{id}/patch' response: @@ -576,14 +1180,14 @@ components: $ref: >- #/paths/~1privileged-access~1api~1v1~1service-accounts~1{id}/delete response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/service_accounts/methods/list_app_service_accounts - $ref: >- #/components/x-stackQL-resources/service_accounts/methods/get_app_service_account + - $ref: >- + #/components/x-stackQL-resources/service_accounts/methods/list_app_service_accounts insert: - $ref: >- #/components/x-stackQL-resources/service_accounts/methods/create_app_service_account @@ -599,7 +1203,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/push_providers.yaml b/providers/src/okta/v00.00.00000/services/push_providers.yaml index 2c6400ab..599ca181 100644 --- a/providers/src/okta/v00.00.00000/services/push_providers.yaml +++ b/providers/src/okta/v00.00.00000/services/push_providers.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: push_providers API description: okta push_providers API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/push-providers: get: @@ -56,9 +56,7 @@ paths: - GET - PUT schema: - type: array - items: - $ref: '#/components/schemas/PushProvider' + $ref: '#/components/schemas/ListPushProvidersResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '429': @@ -70,10 +68,9 @@ paths: tags: - PushProvider x-okta-lifecycle: - lifecycle: LIMITED_GA + lifecycle: GA isGenerallyAvailable: false - SKUs: - - Okta Identity Engine + SKUs: [] post: summary: Create a push provider description: >- @@ -117,10 +114,9 @@ paths: tags: - PushProvider x-okta-lifecycle: - lifecycle: LIMITED_GA + lifecycle: GA isGenerallyAvailable: false - SKUs: - - Okta Identity Engine + SKUs: [] /api/v1/push-providers/{pushProviderId}: get: summary: Retrieve a push provider @@ -151,10 +147,11 @@ paths: tags: - PushProvider x-okta-lifecycle: - lifecycle: LIMITED_GA + lifecycle: GA isGenerallyAvailable: false - SKUs: - - Okta Identity Engine + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathPushProviderId' put: summary: Replace a push provider description: Replaces a push provider by `pushProviderId` @@ -198,10 +195,11 @@ paths: tags: - PushProvider x-okta-lifecycle: - lifecycle: LIMITED_GA + lifecycle: GA isGenerallyAvailable: false - SKUs: - - Okta Identity Engine + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathPushProviderId' delete: summary: Delete a push provider description: >- @@ -236,12 +234,11 @@ paths: tags: - PushProvider x-okta-lifecycle: - lifecycle: LIMITED_GA + lifecycle: GA isGenerallyAvailable: false - SKUs: - - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathPushProviderId' + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathPushProviderId' components: schemas: ProviderType: @@ -317,10 +314,38 @@ components: errorSummary: type: string HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object additionalProperties: true type: object @@ -364,6 +389,13 @@ components: - GET - POST - PUT + ListPushProvidersResponse: + type: object + properties: + push_providers: + type: array + items: + $ref: '#/components/schemas/PushProvider' responses: ErrorAccessDenied403: description: Forbidden @@ -531,7 +563,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.push_providers + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListPushProvidersResponse' + transform: + body: |- + {{- $wrapped := printf "{\"push_providers\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_push_provider: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1push-providers/post' response: @@ -544,6 +588,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_push_provider: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1push-providers~1{pushProviderId}/put' response: @@ -553,14 +600,14 @@ components: operation: $ref: '#/paths/~1api~1v1~1push-providers~1{pushProviderId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/push_providers/methods/list_push_providers - $ref: >- #/components/x-stackQL-resources/push_providers/methods/get_push_provider + - $ref: >- + #/components/x-stackQL-resources/push_providers/methods/list_push_providers insert: - $ref: >- #/components/x-stackQL-resources/push_providers/methods/create_push_provider @@ -576,7 +623,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/rate_limit_settings.yaml b/providers/src/okta/v00.00.00000/services/rate_limit_settings.yaml index f160f835..5f82d937 100644 --- a/providers/src/okta/v00.00.00000/services/rate_limit_settings.yaml +++ b/providers/src/okta/v00.00.00000/services/rate_limit_settings.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: rate_limit_settings API description: okta rate_limit_settings API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/rate-limit-settings/admin-notifications: get: @@ -429,6 +429,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_rate_limit_settings_admin_notifications: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1rate-limit-settings~1admin-notifications/put' response: @@ -456,6 +459,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_rate_limit_settings_per_client: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1rate-limit-settings~1per-client/put' response: @@ -483,6 +489,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_rate_limit_settings_warning_threshold: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1rate-limit-settings~1warning-threshold/put' response: @@ -503,7 +512,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/realm_assignments.yaml b/providers/src/okta/v00.00.00000/services/realm_assignments.yaml index d2890f2c..1d965859 100644 --- a/providers/src/okta/v00.00.00000/services/realm_assignments.yaml +++ b/providers/src/okta/v00.00.00000/services/realm_assignments.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: realm_assignments API description: okta realm_assignments API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/realm-assignments: get: @@ -26,9 +26,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/RealmAssignment' + $ref: '#/components/schemas/ListRealmAssignmentsResponse' examples: AssignmentLists: $ref: '#/components/examples/ListRealmAssignmentsResponse' @@ -100,9 +98,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/OperationResponse' + $ref: '#/components/schemas/ListRealmAssignmentOperationsResponse' examples: Executions: value: @@ -189,7 +185,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/OperationResponse' + $ref: '#/components/schemas/RealmAssignmentOperationResponse' examples: Execution: $ref: '#/components/examples/OperationResponse' @@ -238,6 +234,8 @@ paths: - okta.realmAssignments.read tags: - RealmAssignment + parameters: + - $ref: '#/components/parameters/assignmentId' put: x-okta-lifecycle: lifecycle: GA @@ -275,6 +273,8 @@ paths: - okta.realmAssignments.manage tags: - RealmAssignment + parameters: + - $ref: '#/components/parameters/assignmentId' delete: x-okta-lifecycle: lifecycle: GA @@ -311,8 +311,8 @@ paths: - okta.realmAssignments.manage tags: - RealmAssignment - parameters: - - $ref: '#/components/parameters/assignmentId' + parameters: + - $ref: '#/components/parameters/assignmentId' /api/v1/realm-assignments/{assignmentId}/lifecycle/activate: post: x-okta-lifecycle: @@ -338,8 +338,8 @@ paths: - okta.realmAssignments.manage tags: - RealmAssignment - parameters: - - $ref: '#/components/parameters/assignmentId' + parameters: + - $ref: '#/components/parameters/assignmentId' /api/v1/realm-assignments/{assignmentId}/lifecycle/deactivate: post: x-okta-lifecycle: @@ -365,8 +365,8 @@ paths: - okta.realmAssignments.manage tags: - RealmAssignment - parameters: - - $ref: '#/components/parameters/assignmentId' + parameters: + - $ref: '#/components/parameters/assignmentId' components: schemas: RealmAssignment: @@ -383,6 +383,8 @@ components: readOnly: true domains: type: array + items: + type: string description: >- Array of allowed domains. No user in this realm can be created or updated unless they have a username and email from one of these @@ -414,7 +416,7 @@ components: description: >- The priority of the realm assignment. The lower the number, the higher the priority. This helps resolve conflicts between realm - assignments. + assignments. > **Note:** When you create realm assignments in bulk, realm assignment priorities must be unique. @@ -462,13 +464,39 @@ components: description: >- The priority of the realm assignment. The lower the number, the higher the priority. This helps resolve conflicts between realm - assignments. + assignments. > **Note:** When you create realm assignments in bulk, realm assignment priorities must be unique. - OperationResponse: + RealmAssignmentOperationResponse: type: object properties: + completed: + type: string + description: Timestamp of when the operation completed + format: date-time + created: + type: string + description: Timestamp of when the operation was created + format: date-time + id: + type: string + description: ID of the asynchronous operation + started: + type: string + description: Timestamp of when the operation started + format: date-time + status: + type: string + description: The status of the asynchronous operation + enum: + - COMPLETED + - SCHEDULED + - IN_PROGRESS + - FAILED + type: + type: string + description: The operation type assignmentOperation: type: object description: Definition of the realm assignment operation @@ -496,20 +524,6 @@ components: name: type: string description: Name of the realm assignment operation - completed: - description: Timestamp when the realm assignment operation completed - type: string - format: date-time - readOnly: true - created: - description: Timestamp when the realm assignment operation was created - type: string - format: date-time - readOnly: true - id: - description: ID of the realm - type: string - readOnly: true numUserMoved: description: Number of users moved type: number @@ -522,26 +536,13 @@ components: description: Name of the realm type: string readOnly: true - started: - description: Timestamp when the realm assignment operation started - type: string - format: date-time - readOnly: true - status: - description: Current status of the operation - type: string - readOnly: true - enum: - - COMPLETED - - SCHEDULED - - IN_PROGRESS - - FAILED - type: - description: Realm type - type: string - readOnly: true _links: $ref: '#/components/schemas/LinksSelf' + required: + - id + - type + - status + - created OperationRequest: type: object properties: @@ -562,7 +563,7 @@ components: description: >- The priority of the realm assignment. The lower the number, the higher the priority. This helps resolve conflicts between realm - assignments. + assignments. > **Note:** When you create realm assignments in bulk, realm assignment priorities must be unique. @@ -604,6 +605,40 @@ components: properties: errorSummary: type: string + OperationResponse: + type: object + properties: + completed: + type: string + description: Timestamp of when the operation completed + format: date-time + created: + type: string + description: Timestamp of when the operation was created + format: date-time + id: + type: string + description: ID of the asynchronous operation + started: + type: string + description: Timestamp of when the operation started + format: date-time + status: + type: string + description: The status of the asynchronous operation + enum: + - COMPLETED + - SCHEDULED + - IN_PROGRESS + - FAILED + type: + type: string + description: The operation type + required: + - id + - type + - status + - created AssignUserToRealm: description: Action that assigns a user to a realm type: object @@ -619,10 +654,38 @@ components: description: Value of the condition expression type: string HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object additionalProperties: true type: object @@ -666,6 +729,20 @@ components: - GET - POST - PUT + ListRealmAssignmentsResponse: + type: object + properties: + realm_assignments: + type: array + items: + $ref: '#/components/schemas/RealmAssignment' + ListRealmAssignmentOperationsResponse: + type: object + properties: + realm_assignment_operations: + type: array + items: + $ref: '#/components/schemas/RealmAssignmentOperationResponse' responses: ErrorTooManyRequests429: description: Too Many Requests @@ -722,7 +799,8 @@ components: The cursor to use for pagination. It is an opaque string that specifies your current location in the list and is obtained from the `Link` response header. See - [Pagination](https://developer.okta.com/docs/api/#pagination). + [Pagination](https://developer.okta.com/docs/api/#pagination) and [Link + header](https://developer.okta.com/docs/api/#link-header). assignmentId: name: assignmentId description: ID of the realm assignment @@ -910,13 +988,28 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.realm_assignments + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListRealmAssignmentsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"realm_assignments\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_realm_assignment: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1realm-assignments/post' response: mediaType: application/json openAPIDocKey: '201' execute_realm_assignment: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1realm-assignments~1operations/post' response: @@ -929,6 +1022,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_realm_assignment: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1realm-assignments~1{assignmentId}/put' response: @@ -938,28 +1034,28 @@ components: operation: $ref: '#/paths/~1api~1v1~1realm-assignments~1{assignmentId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' activate_realm_assignment: operation: $ref: >- #/paths/~1api~1v1~1realm-assignments~1{assignmentId}~1lifecycle~1activate/post response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' deactivate_realm_assignment: operation: $ref: >- #/paths/~1api~1v1~1realm-assignments~1{assignmentId}~1lifecycle~1deactivate/post response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/realm_assignments/methods/list_realm_assignments - $ref: >- #/components/x-stackQL-resources/realm_assignments/methods/get_realm_assignment + - $ref: >- + #/components/x-stackQL-resources/realm_assignments/methods/list_realm_assignments insert: - $ref: >- #/components/x-stackQL-resources/realm_assignments/methods/create_realm_assignment @@ -981,6 +1077,17 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.realm_assignment_operations + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListRealmAssignmentOperationsResponse' + transform: + body: >- + {{- $wrapped := printf "{\"realm_assignment_operations\":%s}" . + -}} + + {{- $wrapped -}} + type: golang_template_text_v0.3.0 sqlVerbs: select: - $ref: >- @@ -994,7 +1101,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/realms.yaml b/providers/src/okta/v00.00.00000/services/realms.yaml index 6d8edde4..e03ea9be 100644 --- a/providers/src/okta/v00.00.00000/services/realms.yaml +++ b/providers/src/okta/v00.00.00000/services/realms.yaml @@ -2,14 +2,20 @@ openapi: 3.0.3 info: title: realms API description: okta realms API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/realms: get: x-okta-lifecycle: lifecycle: GA summary: List all realms - description: Lists all Realms + description: >- + Lists all realms. + + + > **Note:** The `search` parameter results are sourced from an + eventually consistent datasource and may not reflect the latest + information. operationId: listRealms parameters: - name: limit @@ -42,23 +48,14 @@ paths: schema: type: string example: profile.name - - name: sortOrder - in: query - description: >- - Specifies the sort order: `asc` or `desc` (for search queries only). - This parameter is ignored if `sortBy` isn't present. - schema: - type: string - default: asc + - $ref: '#/components/parameters/querySortOrder' responses: '200': description: OK content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/Realm' + $ref: '#/components/schemas/ListRealmsResponse' examples: Realm Lists: $ref: '#/components/examples/ListRealmsResponse' @@ -147,6 +144,8 @@ paths: - okta.realms.read tags: - Realm + parameters: + - $ref: '#/components/parameters/pathRealmId' put: x-okta-lifecycle: lifecycle: GA @@ -184,6 +183,8 @@ paths: - okta.realms.manage tags: - Realm + parameters: + - $ref: '#/components/parameters/pathRealmId' delete: x-okta-lifecycle: lifecycle: GA @@ -223,8 +224,8 @@ paths: - okta.realms.manage tags: - Realm - parameters: - - $ref: '#/components/parameters/pathRealmId' + parameters: + - $ref: '#/components/parameters/pathRealmId' components: schemas: Realm: @@ -245,7 +246,7 @@ components: Indicates the default realm. Existing users will start out in the default realm and can be moved to other realms individually or through realm assignments. See [Realms Assignments - API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/RealmAssignment/). + API](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/realmassignment/). readOnly: true lastUpdated: type: string @@ -292,10 +293,13 @@ components: profile: $ref: '#/components/schemas/RealmProfile' RealmProfile: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: domains: type: array + items: + type: string description: >- Array of allowed domains. No user in this realm can be created or updated unless they have a username and email from one of these @@ -339,10 +343,38 @@ components: errorSummary: type: string HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object additionalProperties: true type: object @@ -386,6 +418,13 @@ components: - GET - POST - PUT + ListRealmsResponse: + type: object + properties: + realms: + type: array + items: + $ref: '#/components/schemas/Realm' responses: ErrorTooManyRequests429: description: Too Many Requests @@ -433,7 +472,17 @@ components: The cursor to use for pagination. It is an opaque string that specifies your current location in the list and is obtained from the `Link` response header. See - [Pagination](https://developer.okta.com/docs/api/#pagination). + [Pagination](https://developer.okta.com/docs/api/#pagination) and [Link + header](https://developer.okta.com/docs/api/#link-header). + querySortOrder: + name: sortOrder + in: query + description: >- + Specifies sort order: `asc` or `desc` (for search queries only). This + parameter is ignored if `sortBy` isn't present. + schema: + type: string + default: asc pathRealmId: name: realmId description: ID of the realm @@ -542,7 +591,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.realms + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListRealmsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"realms\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_realm: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1realms/post' response: @@ -555,6 +616,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_realm: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1realms~1{realmId}/put' response: @@ -564,12 +628,12 @@ components: operation: $ref: '#/paths/~1api~1v1~1realms~1{realmId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: '#/components/x-stackQL-resources/realms/methods/list_realms' - $ref: '#/components/x-stackQL-resources/realms/methods/get_realm' + - $ref: '#/components/x-stackQL-resources/realms/methods/list_realms' insert: - $ref: '#/components/x-stackQL-resources/realms/methods/create_realm' update: [] @@ -582,7 +646,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/risk.yaml b/providers/src/okta/v00.00.00000/services/risk.yaml deleted file mode 100644 index 0d889ec5..00000000 --- a/providers/src/okta/v00.00.00000/services/risk.yaml +++ /dev/null @@ -1,678 +0,0 @@ -openapi: 3.0.3 -info: - title: risk API - description: okta risk API - version: 5.1.0 -paths: - /api/v1/risk/events/ip: - post: - deprecated: true - summary: Send multiple risk events - description: >- - Sends multiple IP risk events to Okta. - - This request is used by a third-party risk provider to send IP risk - events to Okta. The third-party risk provider needs to be registered - with Okta before they can send events to Okta. See [Risk - Providers](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/RiskProvider/). - - This API has a rate limit of 30 requests per minute. You can include - multiple risk events (up to a maximum of 20 events) in a single payload - to reduce the number of API calls. Prioritize sending high risk signals - if you have a burst of signals to send that would exceed the maximum - request limits. - operationId: sendRiskEvents - x-codegen-request-body-name: instance - requestBody: - content: - application/json: - schema: - type: array - items: - $ref: '#/components/schemas/RiskEvent' - examples: - RiskEventsRequestExample: - $ref: '#/components/examples/RiskEventsRequestExample' - required: true - responses: - '202': - description: Accepted - '400': - $ref: '#/components/responses/ErrorApiValidationFailed400' - '403': - description: Forbidden - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - examples: - Access Denied: - $ref: '#/components/examples/ErrorAccessDenied' - '429': - $ref: '#/components/responses/ErrorTooManyRequests429' - security: - - apiToken: [] - - oauth2: - - okta.riskEvents.manage - tags: - - RiskEvent - x-okta-lifecycle: - lifecycle: GA - isGenerallyAvailable: true - /api/v1/risk/providers: - get: - deprecated: true - summary: List all risk providers - description: Lists all risk provider objects - operationId: listRiskProviders - responses: - '200': - description: OK - content: - application/json: - schema: - type: array - items: - $ref: '#/components/schemas/RiskProvider' - examples: - RiskProviderList: - $ref: '#/components/examples/ListRiskProviderResponse' - '403': - $ref: '#/components/responses/ErrorAccessDenied403' - '429': - $ref: '#/components/responses/ErrorTooManyRequests429' - security: - - apiToken: [] - - oauth2: - - okta.riskProviders.read - tags: - - RiskProvider - x-okta-lifecycle: - lifecycle: GA - isGenerallyAvailable: true - post: - deprecated: true - summary: Create a risk provider - description: >- - Creates a risk provider object. You can create a maximum of three risk - provider objects. - operationId: createRiskProvider - x-codegen-request-body-name: instance - requestBody: - content: - application/json: - schema: - $ref: '#/components/schemas/RiskProvider' - examples: - RiskProviderRequestExample: - $ref: '#/components/examples/RiskProviderRequest' - required: true - responses: - '201': - description: Created - content: - application/json: - schema: - $ref: '#/components/schemas/RiskProvider' - examples: - RiskProviderPostResponseExample: - $ref: '#/components/examples/RiskProviderResponse' - '400': - $ref: '#/components/responses/ErrorApiValidationFailed400' - '403': - description: Forbidden - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - examples: - Access Denied: - $ref: '#/components/examples/ErrorAccessDenied' - '429': - $ref: '#/components/responses/ErrorTooManyRequests429' - security: - - apiToken: [] - - oauth2: - - okta.riskProviders.manage - tags: - - RiskProvider - x-okta-lifecycle: - lifecycle: GA - isGenerallyAvailable: true - /api/v1/risk/providers/{riskProviderId}: - get: - deprecated: true - summary: Retrieve a risk provider - description: Retrieves a risk provider object by ID - operationId: getRiskProvider - responses: - '200': - description: OK - content: - application/json: - schema: - $ref: '#/components/schemas/RiskProvider' - examples: - RiskProviderGetResponseExample: - $ref: '#/components/examples/RiskProviderResponse' - '403': - $ref: '#/components/responses/ErrorAccessDenied403' - '404': - $ref: '#/components/responses/ErrorResourceNotFound404' - '429': - $ref: '#/components/responses/ErrorTooManyRequests429' - security: - - apiToken: [] - - oauth2: - - okta.riskProviders.read - tags: - - RiskProvider - x-okta-lifecycle: - lifecycle: GA - isGenerallyAvailable: true - put: - deprecated: true - summary: Replace a risk provider - description: Replaces the properties for a given risk provider object ID - operationId: replaceRiskProvider - x-codegen-request-body-name: instance - requestBody: - content: - application/json: - schema: - $ref: '#/components/schemas/RiskProvider' - examples: - RiskProviderPutRequestExample: - $ref: '#/components/examples/RiskProviderPutRequest' - required: true - responses: - '200': - description: OK - content: - application/json: - schema: - $ref: '#/components/schemas/RiskProvider' - examples: - RiskProviderPutResponseExample: - $ref: '#/components/examples/RiskProviderPutResponse' - '400': - $ref: '#/components/responses/ErrorApiValidationFailed400' - '403': - $ref: '#/components/responses/ErrorAccessDenied403' - '404': - $ref: '#/components/responses/ErrorResourceNotFound404' - '429': - $ref: '#/components/responses/ErrorTooManyRequests429' - security: - - apiToken: [] - - oauth2: - - okta.riskProviders.manage - tags: - - RiskProvider - x-okta-lifecycle: - lifecycle: GA - isGenerallyAvailable: true - delete: - deprecated: true - summary: Delete a risk provider - description: Deletes a risk provider object by its ID - operationId: deleteRiskProvider - responses: - '204': - description: No Content - '403': - description: Forbidden - headers: {} - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - examples: - Access Denied: - $ref: '#/components/examples/ErrorAccessDenied' - '404': - $ref: '#/components/responses/ErrorResourceNotFound404' - '429': - $ref: '#/components/responses/ErrorTooManyRequests429' - security: - - apiToken: [] - - oauth2: - - okta.riskProviders.manage - tags: - - RiskProvider - x-okta-lifecycle: - lifecycle: GA - isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathRiskProviderId' -components: - schemas: - RiskEvent: - type: object - properties: - expiresAt: - type: string - format: date-time - description: >- - Timestamp at which the event expires (expressed as a UTC time zone - using ISO 8601 format: yyyy-MM-dd`T`HH:mm:ss.SSS`Z`). If this - optional field isn't included, Okta automatically expires the event - 24 hours after the event is consumed. - subjects: - type: array - description: List of risk event subjects - items: - $ref: '#/components/schemas/RiskEventSubject' - timestamp: - type: string - format: date-time - description: >- - Timestamp of when the event is produced (expressed as a UTC time - zone using ISO 8601 format: yyyy-MM-dd`T`HH:mm:ss.SSS`Z`) - required: - - subjects - Error: - title: Error - type: object - properties: - errorCauses: - type: array - items: - $ref: '#/components/schemas/ErrorCause' - errorCode: - type: string - description: An Okta code for this type of error - errorId: - type: string - description: >- - A unique identifier for this error. This can be used by Okta Support - to help with troubleshooting. - errorLink: - type: string - description: An Okta code for this type of error - errorSummary: - type: string - description: >- - A short description of what caused this error. Sometimes this - contains dynamically-generated information about your specific - error. - RiskProvider: - type: object - properties: - action: - $ref: '#/components/schemas/RiskProviderAction' - clientId: - type: string - description: >- - The ID of the [OAuth 2.0 service - app](https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/main/#create-a-service-app-and-grant-scopes) - that's used to send risk events to Okta - example: 00cjkjjkkgjkdkjdkkljjsd - created: - type: string - format: date-time - description: Timestamp when the risk provider object was created - readOnly: true - example: '2021-01-05 22:18:30' - id: - type: string - description: The ID of the risk provider object - readOnly: true - example: 00rp12r4skkjkjgsn - lastUpdated: - type: string - format: date-time - description: Timestamp when the risk provider object was last updated - readOnly: true - example: '2021-01-05 22:18:30' - name: - type: string - description: Name of the risk provider - maxLength: 50 - example: Risk-Partner-X - _links: - $ref: '#/components/schemas/LinksSelf' - required: - - name - - clientId - - action - - id - - _links - RiskEventSubject: - type: object - properties: - ip: - type: string - description: The risk event subject IP address (either an IPv4 or IPv6 address) - message: - type: string - description: Additional reasons for the risk level of the IP - maxLength: 512 - pattern: ^[a-zA-Z0-9 .\-_]*$ - riskLevel: - $ref: '#/components/schemas/RiskEventSubjectRiskLevel' - required: - - ip - - riskLevel - ErrorCause: - type: object - properties: - errorSummary: - type: string - RiskProviderAction: - description: >- - Action taken by Okta during authentication attempts based on the risk - events sent by this provider - default: log_only - type: string - enum: - - enforce_and_log - - log_only - - none - x-enumDescriptions: - log_only: Include risk event information in the System Log - none: No action - enforce_and_log: >- - Use risk event information to evaluate risks during authentication - attempts and include risk event information in the System Log - LinksSelf: - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the - [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. This object is used for dynamic discovery of related - resources and lifecycle operations. - type: object - properties: - self: - $ref: '#/components/schemas/HrefObjectSelfLink' - readOnly: true - RiskEventSubjectRiskLevel: - description: The risk level associated with the IP - type: string - enum: - - HIGH - - LOW - - MEDIUM - HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) - HrefObject: - title: Link Object - additionalProperties: true - type: object - properties: - hints: - $ref: '#/components/schemas/HrefHints' - readOnly: true - href: - type: string - description: Link URI - name: - type: string - description: Link name - readOnly: true - templated: - type: boolean - description: >- - Indicates whether the link object's `href` property is a URI - template. - readOnly: true - type: - type: string - description: >- - The media type of the link. If omitted, it is implicitly - `application/json`. - readOnly: true - required: - - href - HrefHints: - description: Describes allowed HTTP verbs for the `href` - type: object - properties: - allow: - type: array - items: - $ref: '#/components/schemas/HttpMethod' - HttpMethod: - type: string - enum: - - DELETE - - GET - - POST - - PUT - responses: - ErrorApiValidationFailed400: - description: Bad Request - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - examples: - APIValidationFailed: - $ref: '#/components/examples/ErrorApiValidationFailed' - ErrorTooManyRequests429: - description: Too Many Requests - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - examples: - TooManyRequests: - $ref: '#/components/examples/ErrorTooManyRequests' - ErrorAccessDenied403: - description: Forbidden - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - examples: - AccessDenied: - $ref: '#/components/examples/ErrorAccessDenied' - ErrorResourceNotFound404: - description: Not Found - content: - application/json: - schema: - $ref: '#/components/schemas/Error' - examples: - ResourceNotFound: - $ref: '#/components/examples/ErrorResourceNotFound' - parameters: - pathRiskProviderId: - name: riskProviderId - in: path - schema: - type: string - example: 00rp12r4skkjkjgsn - required: true - description: '`id` of the risk provider object' - examples: - RiskEventsRequestExample: - summary: Risk events payload example - value: - - timestamp: '2021-01-20T00:00:00.001Z' - subjects: - - ip: 6.7.6.7 - riskLevel: MEDIUM - - ip: 1.1.1.1 - riskLevel: HIGH - message: Detected Attack tooling and suspicious activity - - timestamp: '2021-01-20T01:00:00.001Z' - subjects: - - ip: 6.7.6.7 - riskLevel: LOW - - ip: 2.2.2.2 - riskLevel: HIGH - ErrorAccessDenied: - summary: Access Denied - value: - errorCode: E0000006 - errorSummary: You do not have permission to perform the requested action - errorLink: E0000006 - errorId: sampleNUSD_8fdkFd8fs8SDBK - errorCauses: [] - ListRiskProviderResponse: - summary: List risk provider response example - value: - - id: 00rp12r4skkjkjgsn - action: log_only - name: Risk-Partner-X - clientId: 00ckjsfgjkdkjdkkljjsd - created: '2021-01-05 22:18:30' - lastUpdated: '2021-01-05 22:18:30' - _links: - self: - href: https://{yourOktaDomain}/api/v1/risk/providers/00rp12r4skkjkjgsn - hints: - allow: - - GET - - PUT - RiskProviderRequest: - summary: Risk provider payload example - value: - name: Risk-Partner-X - action: log_only - clientId: 00ckjsfgjkdkjdkkljjsd - RiskProviderResponse: - summary: Risk provider response example - value: - id: 00rp12r4skkjkjgsn - action: log_only - name: Risk-Partner-X - clientId: 00ckjsfgjkdkjdkkljjsd - created: '2021-01-05 22:18:30' - lastUpdated: '2021-01-05 22:18:30' - _links: - self: - href: https://{yourOktaDomain}/api/v1/risk/providers/00rp12r4skkjkjgsn - hints: - allow: - - GET - - PUT - RiskProviderPutRequest: - summary: Replace risk provider request example - value: - name: Risk-Partner-Y - action: enforce_and_log - clientId: 00ckjsfgjkdkjdkkljjsd - RiskProviderPutResponse: - summary: Replace risk provider response example - value: - id: 00rp12r4skkjkjgsn - action: enforce_and_log - name: Risk-Partner-Y - clientId: 00ckjsfgjkdkjdkkljjsd - created: '2021-01-05 22:18:30' - lastUpdated: '2021-01-05 23:18:30' - _links: - self: - href: https://{yourOktaDomain}/api/v1/risk/providers/00rp12r4skkjkjgsn - hints: - allow: - - GET - - PUT - ErrorApiValidationFailed: - summary: API Validation Failed - value: - errorCode: E0000001 - errorSummary: 'Api validation failed: {0}' - errorLink: E0000001 - errorId: sampleiCF-8D5rLW6myqiPItW - errorCauses: [] - ErrorTooManyRequests: - summary: Too Many Requests - value: - errorCode: E0000047 - errorSummary: API call exceeded rate limit due to too many requests. - errorLink: E0000047 - errorId: sampleQPivGUj_ND5v78vbYWW - errorCauses: [] - ErrorResourceNotFound: - summary: Resource Not Found - value: - errorCode: E0000007 - errorSummary: 'Not found: {0}' - errorLink: E0000007 - errorId: sampleMlLvGUj_YD5v16vkYWY - errorCauses: [] - x-stackQL-resources: - risk_events: - id: okta.risk.risk_events - name: risk_events - title: Risk Events - methods: - send_risk_events: - operation: - $ref: '#/paths/~1api~1v1~1risk~1events~1ip/post' - response: - mediaType: '' - openAPIDocKey: '202' - sqlVerbs: - select: [] - insert: [] - update: [] - delete: [] - replace: [] - risk_providers: - id: okta.risk.risk_providers - name: risk_providers - title: Risk Providers - methods: - list_risk_providers: - operation: - $ref: '#/paths/~1api~1v1~1risk~1providers/get' - response: - mediaType: application/json - openAPIDocKey: '200' - create_risk_provider: - operation: - $ref: '#/paths/~1api~1v1~1risk~1providers/post' - response: - mediaType: application/json - openAPIDocKey: '201' - get_risk_provider: - operation: - $ref: '#/paths/~1api~1v1~1risk~1providers~1{riskProviderId}/get' - response: - mediaType: application/json - openAPIDocKey: '200' - replace_risk_provider: - operation: - $ref: '#/paths/~1api~1v1~1risk~1providers~1{riskProviderId}/put' - response: - mediaType: application/json - openAPIDocKey: '200' - delete_risk_provider: - operation: - $ref: '#/paths/~1api~1v1~1risk~1providers~1{riskProviderId}/delete' - response: - mediaType: '' - openAPIDocKey: '204' - sqlVerbs: - select: - - $ref: >- - #/components/x-stackQL-resources/risk_providers/methods/list_risk_providers - - $ref: >- - #/components/x-stackQL-resources/risk_providers/methods/get_risk_provider - insert: - - $ref: >- - #/components/x-stackQL-resources/risk_providers/methods/create_risk_provider - update: [] - delete: - - $ref: >- - #/components/x-stackQL-resources/risk_providers/methods/delete_risk_provider - replace: - - $ref: >- - #/components/x-stackQL-resources/risk_providers/methods/replace_risk_provider -servers: - - url: https://{subdomain}.okta.com/ - variables: - subdomain: - default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. diff --git a/providers/src/okta/v00.00.00000/services/roles.yaml b/providers/src/okta/v00.00.00000/services/roles.yaml index a445bc07..50db64d1 100644 --- a/providers/src/okta/v00.00.00000/services/roles.yaml +++ b/providers/src/okta/v00.00.00000/services/roles.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: roles API description: okta roles API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/roles/{roleRef}/subscriptions: get: @@ -15,9 +15,7 @@ paths: content: application/json: schema: - items: - $ref: '#/components/schemas/Subscription' - type: array + $ref: '#/components/schemas/ListSubscriptionsRoleResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -33,8 +31,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathRoleRef' + parameters: + - $ref: '#/components/parameters/pathRoleRef' /api/v1/roles/{roleRef}/subscriptions/{notificationType}: get: summary: Retrieve a subscription for a role @@ -62,9 +60,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathRoleRef' - - $ref: '#/components/parameters/pathNotificationType' + parameters: + - $ref: '#/components/parameters/pathRoleRef' + - $ref: '#/components/parameters/pathNotificationType' /api/v1/roles/{roleRef}/subscriptions/{notificationType}/subscribe: post: summary: Subscribe a role to a specific notification type @@ -91,9 +89,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathRoleRef' - - $ref: '#/components/parameters/pathNotificationType' + parameters: + - $ref: '#/components/parameters/pathRoleRef' + - $ref: '#/components/parameters/pathNotificationType' /api/v1/roles/{roleRef}/subscriptions/{notificationType}/unsubscribe: post: summary: Unsubscribe a role from a specific notification type @@ -120,9 +118,9 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathRoleRef' - - $ref: '#/components/parameters/pathNotificationType' + parameters: + - $ref: '#/components/parameters/pathRoleRef' + - $ref: '#/components/parameters/pathNotificationType' components: schemas: Subscription: @@ -147,40 +145,69 @@ components: $ref: '#/components/schemas/HrefObject' readOnly: true RoleType: - description: Standard role type + title: roleType + description: >- + | Role type | + Description | + + |------------------------------|-------------------------------------------------------------| + + | ACCESS_CERTIFICATIONS_ADMIN | Access Certifications Administrator + IAM-based standard role | + + | ACCESS_REQUESTS_ADMIN | Access Requests Administrator IAM-based + standard role | + + | API_ACCESS_MANAGEMENT_ADMIN | Access Management Administrator + standard role | + + | APP_ADMIN | Application Administrator standard + role | + + | CUSTOM | Custom admin + role | + + | GROUP_MEMBERSHIP_ADMIN | Group Membership Administrator standard + role | + + | HELP_DESK_ADMIN | Help Desk Administrator standard + role | + + | ORG_ADMIN | Organizational Administrator standard + role | + + | READ_ONLY_ADMIN | Read-Only Administrator standard + role | + + | REPORT_ADMIN | Report Administrator standard + role | + + | SUPER_ADMIN | Super Administrator standard + role | + + | USER_ADMIN | User Administrator standard + role | + + | WORKFLOWS_ADMIN | Workflows Administrator IAM-based + standard role | type: string enum: - ACCESS_CERTIFICATIONS_ADMIN - ACCESS_REQUESTS_ADMIN - API_ACCESS_MANAGEMENT_ADMIN - - API_ADMIN - APP_ADMIN - CUSTOM - GROUP_MEMBERSHIP_ADMIN - HELP_DESK_ADMIN - - MOBILE_ADMIN - ORG_ADMIN - READ_ONLY_ADMIN - REPORT_ADMIN - SUPER_ADMIN - USER_ADMIN - WORKFLOWS_ADMIN - x-enumDescriptions: - API_ACCESS_MANAGEMENT_ADMIN: Access Management Administrator - API_ADMIN: Access Management Administrator - APP_ADMIN: Application Administrator - CUSTOM: Custom label specified by the client - GROUP_MEMBERSHIP_ADMIN: Group Membership Administrator - HELP_DESK_ADMIN: Help Desk Administrator - MOBILE_ADMIN: Mobile Administrator - ORG_ADMIN: Organizational Administrator - READ_ONLY_ADMIN: Read-Only Administrator - REPORT_ADMIN: Report Administrator - SUPER_ADMIN: Super Administrator - USER_ADMIN: Group Administrator - WORKFLOWS_ADMIN: Workflows Administrator - ACCESS_CERTIFICATIONS_ADMIN: Access Certifications Administrator (predefined resource sets) - ACCESS_REQUESTS_ADMIN: Access Requests Administrator (predefined resource sets) + RoleId: + title: roleId + type: string NotificationType: description: The type of notification type: string @@ -224,6 +251,7 @@ components: - subscribed - unsubscribed HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object additionalProperties: true type: object @@ -297,6 +325,13 @@ components: - GET - POST - PUT + ListSubscriptionsRoleResponse: + type: object + properties: + subscriptions_role: + type: array + items: + $ref: '#/components/schemas/Subscription' responses: ErrorAccessDenied403: description: Forbidden @@ -323,15 +358,13 @@ components: description: >- A reference to an existing role. Standard roles require a `roleType`, while Custom Roles require a `roleId`. See [Standard - Roles](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#standard-roles). + roles](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#standard-roles). required: true schema: + x-okta-ignore-redocly-rules-for-sdk: true oneOf: - - title: roleType - type: string - $ref: '#/components/schemas/RoleType' - - title: roleId - type: string + - $ref: '#/components/schemas/RoleType' + - $ref: '#/components/schemas/RoleId' pathNotificationType: name: notificationType in: path @@ -367,6 +400,15 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.subscriptions_role + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListSubscriptionsRoleResponse' + transform: + body: |- + {{- $wrapped := printf "{\"subscriptions_role\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 get_subscriptions_notification_type_role: operation: $ref: >- @@ -379,21 +421,21 @@ components: $ref: >- #/paths/~1api~1v1~1roles~1{roleRef}~1subscriptions~1{notificationType}~1subscribe/post response: - mediaType: '' + mediaType: application/json openAPIDocKey: '200' unsubscribe_by_notification_type_role: operation: $ref: >- #/paths/~1api~1v1~1roles~1{roleRef}~1subscriptions~1{notificationType}~1unsubscribe/post response: - mediaType: '' + mediaType: application/json openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/subscriptions/methods/list_subscriptions_role - $ref: >- #/components/x-stackQL-resources/subscriptions/methods/get_subscriptions_notification_type_role + - $ref: >- + #/components/x-stackQL-resources/subscriptions/methods/list_subscriptions_role insert: [] update: [] delete: [] @@ -403,7 +445,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/security.yaml b/providers/src/okta/v00.00.00000/services/security.yaml index 46376196..1e39d8c1 100644 --- a/providers/src/okta/v00.00.00000/services/security.yaml +++ b/providers/src/okta/v00.00.00000/services/security.yaml @@ -2,14 +2,14 @@ openapi: 3.0.3 info: title: security API description: okta security API - version: 5.1.0 + version: 2026.07.2 paths: /security/api/v1/security-events: post: summary: Publish a security event token description: >- - Publishes a Security Event Token (SET) sent by a Security Events - Provider. After the token is verified, Okta ingests the event and + Publishes a security event token (SET) sent by a security events + provider. After the token is verified, Okta ingests the event and performs any appropriate action. operationId: publishSecurityEventTokens x-codegen-request-body-name: Security Event Token @@ -22,9 +22,9 @@ paths: For SET JWT header and body descriptions, see [SET JWT - header](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/SSFSecurityEventToken/#tag/SSFSecurityEventToken/schema/SecurityEventTokenRequestJwtHeader) + header](https://developer.okta.com/docs/api/openapi/okta-management/management/ssfsecurityeventtoken/securityeventtokenrequestjwtheader) and [SET JWT body - payload](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/SSFSecurityEventToken/#tag/SSFSecurityEventToken/schema/SecurityEventTokenRequestJwtBody). + payload](https://developer.okta.com/docs/api/openapi/okta-management/management/ssfsecurityeventtoken/securityeventtokenrequestjwtbody). content: application/secevent+jwt: schema: @@ -52,8 +52,8 @@ paths: components: schemas: SecurityEventTokenError: - title: Security Event Token Error - description: Error object thrown when parsing the Security Event Token + title: Security event token error + description: Error object thrown when parsing the security event token type: object properties: description: @@ -85,10 +85,13 @@ components: title: Ssf Security Event Tokens methods: publish_security_event_tokens: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1security~1api~1v1~1security-events/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '202' sqlVerbs: select: [] @@ -101,7 +104,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/security_events_providers.yaml b/providers/src/okta/v00.00.00000/services/security_events_providers.yaml index 1899a033..9a19b021 100644 --- a/providers/src/okta/v00.00.00000/services/security_events_providers.yaml +++ b/providers/src/okta/v00.00.00000/services/security_events_providers.yaml @@ -2,12 +2,12 @@ openapi: 3.0.3 info: title: security_events_providers API description: okta security_events_providers API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/security-events-providers: get: summary: List all security events providers - description: Lists all Security Events Provider instances + description: Lists all security events provider instances operationId: listSecurityEventsProviderInstances responses: '200': @@ -15,9 +15,8 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/SecurityEventsProviderResponse' + $ref: >- + #/components/schemas/ListSecurityEventsProviderInstancesResponse examples: list: $ref: '#/components/examples/ListOfSecurityEventsProviderInstances' @@ -40,7 +39,7 @@ paths: - Okta Identity Engine post: summary: Create a security events provider - description: Creates a Security Events Provider instance + description: Creates a security events provider instance operationId: createSecurityEventsProviderInstance x-codegen-request-body-name: instance requestBody: @@ -92,7 +91,7 @@ paths: /api/v1/security-events-providers/{securityEventProviderId}: get: summary: Retrieve the security events provider - description: Retrieves the Security Events Provider instance specified by `id` + description: Retrieves the security events provider instance specified by `id` operationId: getSecurityEventsProviderInstance responses: '200': @@ -124,9 +123,11 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine + parameters: + - $ref: '#/components/parameters/pathSecurityEventProviderId' put: summary: Replace a security events provider - description: Replaces a Security Events Provider instance specified by `id` + description: Replaces a security events provider instance specified by `id` operationId: replaceSecurityEventsProviderInstance x-codegen-request-body-name: instance requestBody: @@ -177,9 +178,11 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine + parameters: + - $ref: '#/components/parameters/pathSecurityEventProviderId' delete: summary: Delete a security events provider - description: Deletes a Security Events Provider instance specified by `id` + description: Deletes a security events provider instance specified by `id` operationId: deleteSecurityEventsProviderInstance responses: '204': @@ -204,17 +207,17 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathSecurityEventProviderId' + parameters: + - $ref: '#/components/parameters/pathSecurityEventProviderId' /api/v1/security-events-providers/{securityEventProviderId}/lifecycle/activate: post: summary: Activate a security events provider description: >- - Activates a Security Events Provider instance by setting its status to + Activates a security events provider instance by setting its status to `ACTIVE`. - This operation resumes the flow of events from the Security Events - Provider to Okta. + This operation resumes the flow of events from the security events + provider to Okta. operationId: activateSecurityEventsProviderInstance responses: '200': @@ -246,17 +249,17 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathSecurityEventProviderId' + parameters: + - $ref: '#/components/parameters/pathSecurityEventProviderId' /api/v1/security-events-providers/{securityEventProviderId}/lifecycle/deactivate: post: summary: Deactivate a security events provider description: >- - Deactivates a Security Events Provider instance by setting its status to + Deactivates a security events provider instance by setting its status to `INACTIVE`. - This operation stops the flow of events from the Security Events - Provider to Okta. + This operation stops the flow of events from the security events + provider to Okta. operationId: deactivateSecurityEventsProviderInstance responses: '200': @@ -288,13 +291,13 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathSecurityEventProviderId' + parameters: + - $ref: '#/components/parameters/pathSecurityEventProviderId' components: schemas: SecurityEventsProviderResponse: - title: Security Events Provider Response - description: The Security Events Provider response + title: Security events provider response + description: The security events provider response type: object properties: id: @@ -303,48 +306,70 @@ components: readOnly: true example: sse1qg25RpusjUP6m0g5 name: - description: The name of the Security Events Provider instance + description: The name of the security events provider instance type: string maxLength: 100 example: Target SSF Provider settings: - description: Information about the Security Events Provider for signal ingestion + description: Information about the security events provider for signal ingestion $ref: '#/components/schemas/SecurityEventsProviderSettingsResponse' status: - description: Indicates whether the Security Events Provider is active or not + description: Indicates whether the security events provider is active or not type: string enum: - ACTIVE - INACTIVE readOnly: true type: - description: The application type of the Security Events Provider + description: The app type of the security events provider maxLength: 255 type: string example: okta _links: $ref: '#/components/schemas/LinksSelfAndLifecycle' SecurityEventsProviderRequest: - title: Security Events Provider Request + title: Security events provider request description: >- - The request schema for creating or updating a Security Events Provider. + The request schema for creating or updating a security events provider. The `settings` must match one of the schemas. + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: name: - description: The name of the Security Events Provider instance + description: The name of the security events provider instance type: string maxLength: 100 example: Target SSF Provider settings: type: object - description: Information about the Security Events Provider for signal ingestion - oneOf: - - $ref: '#/components/schemas/SecurityEventsProviderSettingsSSFCompliant' - - $ref: >- - #/components/schemas/SecurityEventsProviderSettingsNonSSFCompliant + description: Information about the security events provider for signal ingestion + title: Provider with well-known URL setting + properties: + well_known_url: + type: string + format: url + description: >- + The published well-known URL of the security events provider + (the SSF transmitter) + maxLength: 1000 + example: https://example.okta.com/.well-known/ssf-configuration + issuer: + type: string + description: Issuer URL + maxLength: 700 + example: example.okta.com + jwks_url: + type: string + format: url + description: The public URL where the JWKS public key is uploaded + maxLength: 1000 + example: https://example.okta.com/oauth2/v1/keys + required: + - well_known_url + - jwks_url + - issuer type: - description: The application type of the Security Events Provider + description: The app type of the security events provider maxLength: 255 type: string example: okta @@ -353,8 +378,8 @@ components: - settings - type SecurityEventsProviderSettingsResponse: - title: Security Events Provider settings - description: Security Events Provider settings + title: Security events provider settings + description: Security events provider settings type: object properties: issuer: @@ -372,20 +397,28 @@ components: type: string format: url description: >- - The well-known URL of the Security Events Provider (the SSF + The well-known URL of the security events provider (the SSF transmitter) nullable: true maxLength: 1000 example: https://example.okta.com/.well-known/ssf-configuration LinksSelfAndLifecycle: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - type: object - properties: - activate: - $ref: '#/components/schemas/HrefObjectActivateLink' - deactivate: - $ref: '#/components/schemas/HrefObjectDeactivateLink' + description: >- + Specifies link relations (see [Web + Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the + [JSON Hypertext Application + Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) + specification. This object is used for dynamic discovery of related + resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + activate: + $ref: '#/components/schemas/HrefObjectActivateLink' + deactivate: + $ref: '#/components/schemas/HrefObjectDeactivateLink' + readOnly: true Error: title: Error type: object @@ -413,14 +446,14 @@ components: error. SecurityEventsProviderSettingsSSFCompliant: title: Provider with well-known URL setting - description: Security Events Provider with well-known URL setting + description: Security events provider with well-known URL setting type: object properties: well_known_url: type: string format: url description: >- - The published well-known URL of the Security Events Provider (the + The published well-known URL of the security events provider (the SSF transmitter) maxLength: 1000 example: https://example.okta.com/.well-known/ssf-configuration @@ -429,7 +462,7 @@ components: SecurityEventsProviderSettingsNonSSFCompliant: title: Provider with issuer and JWKS settings description: >- - Security Events Provider with issuer and JWKS settings for signal + Security events provider with issuer and JWKS settings for signal ingestion type: object properties: @@ -461,23 +494,105 @@ components: $ref: '#/components/schemas/HrefObjectSelfLink' readOnly: true HrefObjectActivateLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to activate the resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to activate the resource HrefObjectDeactivateLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to deactivate the resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to deactivate the resource ErrorCause: type: object properties: errorSummary: type: string HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object additionalProperties: true type: object @@ -521,6 +636,13 @@ components: - GET - POST - PUT + ListSecurityEventsProviderInstancesResponse: + type: object + properties: + security_events_provider_instances: + type: array + items: + $ref: '#/components/schemas/SecurityEventsProviderResponse' responses: ErrorInvalidToken401: description: Unauthorized @@ -575,13 +697,13 @@ components: type: string example: sse1qg25RpusjUP6m0g5 required: true - description: '`id` of the Security Events Provider instance' + description: '`id` of the security events provider instance' examples: ListOfSecurityEventsProviderInstances: summary: List of security events providers value: - id: sse1qg25RpusjUP6m0g5 - name: Security Events Provider with well-known URL + name: Security events provider with well-known URL type: okta status: ACTIVE settings: @@ -604,7 +726,7 @@ components: allow: - POST - id: sse1qu4fUtsoD12iF0g5 - name: Security Events Provider with an issuer and a JWKS URL + name: Security events provider with an issuer and a JWKS URL type: okta status: ACTIVE settings: @@ -628,14 +750,14 @@ components: SecurityEventsProviderRequestWellKnownUrl: summary: Provider with well-known URL value: - name: Security Events Provider with well-known URL + name: Security events provider with well-known URL type: okta settings: well_known_url: https://example.okta.com/.well-known/ssf-configuration SecurityEventsProviderRequestIssuerAndJwksUrl: summary: Provider with issuer and JWKS value: - name: Security Events Provider with an issuer and a JWKS URL + name: Security events provider with an issuer and a JWKS URL type: okta settings: issuer: Issuer @@ -644,7 +766,7 @@ components: summary: Provider with well-known URL value: id: sse1qg25RpusjUP6m0g5 - name: Security Events Provider with well-known URL + name: Security events provider with well-known URL type: okta status: ACTIVE settings: @@ -670,7 +792,7 @@ components: summary: Provider with issuer and JWKS value: id: sse1qu4fUtsoD12iF0g5 - name: Security Events Provider with an issuer and a JWKS URL + name: Security events provider with an issuer and a JWKS URL type: okta status: ACTIVE settings: @@ -695,7 +817,7 @@ components: summary: Inactive security events provider value: id: sse1qg25RpusjUP6m0g5 - name: Security Events Provider with well-known URL + name: Security events provider with well-known URL type: okta status: INACTIVE settings: @@ -769,7 +891,21 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.security_events_provider_instances + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListSecurityEventsProviderInstancesResponse' + transform: + body: >- + {{- $wrapped := printf + "{\"security_events_provider_instances\":%s}" . -}} + + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_security_events_provider_instance: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1security-events-providers/post' response: @@ -783,6 +919,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_security_events_provider_instance: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: >- #/paths/~1api~1v1~1security-events-providers~1{securityEventProviderId}/put @@ -794,7 +933,7 @@ components: $ref: >- #/paths/~1api~1v1~1security-events-providers~1{securityEventProviderId}/delete response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' activate_security_events_provider_instance: operation: @@ -812,10 +951,10 @@ components: openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/ssf_receivers/methods/list_security_events_provider_instances - $ref: >- #/components/x-stackQL-resources/ssf_receivers/methods/get_security_events_provider_instance + - $ref: >- + #/components/x-stackQL-resources/ssf_receivers/methods/list_security_events_provider_instances insert: - $ref: >- #/components/x-stackQL-resources/ssf_receivers/methods/create_security_events_provider_instance @@ -831,7 +970,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/sessions.yaml b/providers/src/okta/v00.00.00000/services/sessions.yaml index 848e3362..17557006 100644 --- a/providers/src/okta/v00.00.00000/services/sessions.yaml +++ b/providers/src/okta/v00.00.00000/services/sessions.yaml @@ -2,161 +2,13 @@ openapi: 3.0.3 info: title: sessions API description: okta sessions API - version: 5.1.0 + version: 2026.07.2 paths: - /api/v1/sessions: - post: - summary: Create a session with session token - description: >- - Creates a new Session for a user with a valid session token. Use this - API if, for example, you want to set the session cookie yourself instead - of allowing Okta to set it, or want to hold the session ID to delete a - session through the API instead of visiting the logout URL. - operationId: createSession - x-codegen-request-body-name: createSessionRequest - requestBody: - content: - application/json: - schema: - $ref: '#/components/schemas/CreateSessionRequest' - examples: - SessionsCreate: - $ref: '#/components/examples/CreateSessionBody' - required: true - responses: - '200': - description: Success - content: - application/json: - schema: - $ref: '#/components/schemas/Session' - examples: - SessionsCreate: - summary: Create a new session with a valid session token - $ref: '#/components/examples/CreateSessionResponse' - '400': - description: Bad Request - '403': - $ref: '#/components/responses/ErrorAccessDenied403' - '429': - $ref: '#/components/responses/ErrorTooManyRequests429' - security: - - apiToken: [] - tags: - - Session - x-okta-lifecycle: - lifecycle: GA - isGenerallyAvailable: true - /api/v1/sessions/me: - get: - summary: Retrieve the current session - description: >- - Retrieves Session information for the current user. Use this method in a - browser-based application to determine if the user is signed in. - - - > **Note:** This operation requires a session cookie for the user. An - API token isn't allowed for this operation. - operationId: getCurrentSession - parameters: - - in: header - name: Cookie - schema: - description: Session ID (`sid`) or Identity Engine (`idx`) cookie - type: string - example: sid=abcde-123 or idx=abcde-123 - responses: - '200': - description: Success - content: - application/json: - schema: - $ref: '#/components/schemas/Session' - examples: - CurrentSessionsRetrieve: - summary: Retrieve current session information - $ref: '#/components/examples/RetrieveCurrentSessionResponse' - '404': - description: Not Found - security: [] - tags: - - Session - x-okta-lifecycle: - isCorsEnabled: true - lifecycle: GA - isGenerallyAvailable: true - delete: - summary: Close the current session - description: >- - Closes the Session for the user who is currently signed in. Use this - method in a browser-based application to sign out a user. - - - > **Note:** This operation requires a session cookie for the user. An - API token isn't allowed for this operation. - operationId: closeCurrentSession - parameters: - - in: header - name: Cookie - schema: - description: Session ID (`sid`) or Identity Engine (`idx`) cookie - type: string - example: sid=abcde-123 or idx=abcde-123 - responses: - '204': - description: No Content - content: {} - '404': - $ref: '#/components/responses/ErrorResourceNotFound404' - security: [] - tags: - - Session - x-okta-lifecycle: - isCorsEnabled: true - lifecycle: GA - isGenerallyAvailable: true - /api/v1/sessions/me/lifecycle/refresh: - post: - summary: Refresh the current session - description: >- - Refreshes the Session for the current user - - - > **Note:** This operation requires a session cookie for the user. An - API token isn't allowed for this operation. - operationId: refreshCurrentSession - parameters: - - in: header - name: Cookie - schema: - description: Session ID (`sid`) or Identity Engine (`idx`) cookie - type: string - example: sid=abcde-123 or idx=abcde-123 - responses: - '200': - description: Success - content: - application/json: - schema: - $ref: '#/components/schemas/Session' - examples: - CurrentSessionsRefresh: - summary: Refersh current session - $ref: '#/components/examples/RefreshCurrentSessionResponse' - '404': - description: Not Found - security: [] - tags: - - Session - x-okta-lifecycle: - isCorsEnabled: true - lifecycle: GA - isGenerallyAvailable: true /api/v1/sessions/{sessionId}: get: summary: Retrieve a session description: >- - Retrieves information about the Session specified by the given session + Retrieves information about the session specified by the given session ID operationId: getSession responses: @@ -187,9 +39,11 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathSessionId' delete: summary: Revoke a session - description: Revokes the specified Session + description: Revokes the specified session operationId: revokeSession responses: '204': @@ -210,14 +64,14 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathSessionId' + parameters: + - $ref: '#/components/parameters/pathSessionId' /api/v1/sessions/{sessionId}/lifecycle/refresh: post: summary: Refresh a session description: >- - Refreshes an existing Session using the `id` for that Session. A - successful response contains the refreshed Session with an updated + Refreshes an existing session using the `id` for that session. A + successful response contains the refreshed session with an updated `expiresAt` timestamp. operationId: refreshSession responses: @@ -246,16 +100,10 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathSessionId' + parameters: + - $ref: '#/components/parameters/pathSessionId' components: schemas: - CreateSessionRequest: - type: object - properties: - sessionToken: - type: string - description: The session token obtained during authentication Session: type: object properties: @@ -273,11 +121,11 @@ components: type: string format: date-time readOnly: true - description: A timestamp when the Session expires + description: A timestamp when the session expires id: type: string readOnly: true - description: A unique key for the Session + description: A unique key for the session idp: $ref: '#/components/schemas/SessionIdentityProvider' lastFactorVerification: @@ -298,7 +146,7 @@ components: description: A unique identifier for the user (username) status: $ref: '#/components/schemas/SessionStatus' - description: Current Session status + description: Current session status userId: type: string readOnly: true @@ -323,7 +171,7 @@ components: x-enumDescriptions: pwd: >- Password authentication. **Inline hook value:** `PASSWORD` - **Example:** Standard password-based sign-in + **Example:** Standard password-based sign-in flow swk: >- Proof-of-possession (PoP) of a software key. **Inline hook value:** `POP_SOFTWARE_KEY` **Example:** Okta Verify with Push @@ -331,7 +179,7 @@ components: Proof-of-possession (PoP) of a hardware key. **Inline hook value:** `POP_HARDWARE_KEY` **Example:** Yubikey factor opt: >- - One-time password. **Inline hook value:** `ONE_TIME_PASSWORD`. + One-time passcode. **Inline hook value:** `ONE_TIME_PASSWORD`. **Example:** Okta Verify, Google Authenticator sms: >- SMS text message to the user at a registered number. **Inline hook @@ -356,8 +204,8 @@ components: mca: >- Multiple-channel authentication. **Inline hook value:** `MULTIPLE_CHANNEL_AUTHENTICATION`. **Example:** Authentication - requires communication over more than one channel, such as Internet - and mobile network + requires communication over more than one channel, such as the + Internet and a mobile network sc: >- Smart card authentication. **Inline hook value:** `SMART_CARD. **Example:** User authenticated using a smart card, such as a Personal @@ -380,10 +228,10 @@ components: - MFA_ENROLL - MFA_REQUIRED x-enumDescriptions: - ACTIVE: The Session is established and fully validated. - MFA_REQUIRED: The Session is established, but requires second factor verification. + ACTIVE: The session is established and fully validated. + MFA_REQUIRED: The session is established, but requires second factor verification. MFA_ENROLL: >- - The Session is established, but the user needs to enroll a second + The session is established, but the user needs to enroll a second factor. LinksSelf: description: >- @@ -432,15 +280,43 @@ components: - OKTA - SOCIAL HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) ErrorCause: type: object properties: errorSummary: type: string HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object additionalProperties: true type: object @@ -515,107 +391,13 @@ components: parameters: pathSessionId: name: sessionId - description: '`id` of the Session' + description: '`id` of the session' in: path required: true schema: type: string example: l7FbDVqS8zHSy65uJD85 examples: - CreateSessionBody: - summary: Create a new session with a valid session token - value: - sessionToken: 00HiohZYpJgMSHwmL9TQy7RRzuY-q9soKp1SPmYYow - CreateSessionResponse: - summary: Create a new session with a valid session token - value: - amr: - - pwd - createdAt: '2019-08-24T14:15:22Z' - expiresAt: '2019-08-24T14:15:22Z' - id: l7FbDVqS8zHSy65uJD85 - idp: - id: 01a2bcdef3GHIJKLMNOP - type: ACTIVE_DIRECTORY - lastFactorVerification: '2019-08-24T14:15:22Z' - lastPasswordVerification: '2019-08-24T14:15:22Z' - login: user@example.com - status: ACTIVE - userId: 00u0abcdefGHIJKLMNOP - _links: - self: - hints: - allow: - - DELETE - href: https://{yourOktaDomain}/api/v1/sessions/l7FbDVqS8zHSy65uJD85 - RetrieveCurrentSessionResponse: - summary: Retrieve current session - value: - amr: - - pwd - createdAt: '2019-08-24T14:15:22Z' - expiresAt: '2019-08-24T14:15:22Z' - id: l7FbDVqS8zHSy65uJD85 - idp: - id: 01a2bcdef3GHIJKLMNOP - type: ACTIVE_DIRECTORY - lastFactorVerification: '2019-08-24T14:15:22Z' - lastPasswordVerification: '2019-08-24T14:15:22Z' - login: user@example.com - status: ACTIVE - userId: 00u0abcdefGHIJKLMNOP - _links: - self: - hints: - allow: - - GET - - DELETE - href: https://{yourOktaDomain}/api/v1/sessions/me - refresh: - hints: - allow: - - POST - href: https://{yourOktaDomain}/api/v1/sessions/me/lifecycle/refresh - user: - hints: - allow: - - GET - href: https://{yourOktaDomain}/api/v1/users/me - name: User Name - RefreshCurrentSessionResponse: - summary: Refresh current session - value: - amr: - - pwd - createdAt: '2019-08-24T14:15:22Z' - expiresAt: '2019-08-24T14:15:22Z' - id: l7FbDVqS8zHSy65uJD85 - idp: - id: 01a2bcdef3GHIJKLMNOP - type: ACTIVE_DIRECTORY - lastFactorVerification: '2019-08-24T14:15:22Z' - lastPasswordVerification: '2019-08-24T14:15:22Z' - login: user@example.com - status: ACTIVE - userId: 00u0abcdefGHIJKLMNOP - _links: - self: - hints: - allow: - - GET - - DELETE - href: https://{yourOktaDomain}/api/v1/sessions/me - refresh: - hints: - allow: - - POST - href: https://{yourOktaDomain}/api/v1/sessions/me/lifecycle/refresh - user: - hints: - allow: - - GET - href: https://{yourOktaDomain}/api/v1/users/me - name: User Name RetrieveSessionResponse: summary: Retrieve session information for a single session ID value: @@ -690,30 +472,6 @@ components: name: sessions title: Sessions methods: - create_session: - operation: - $ref: '#/paths/~1api~1v1~1sessions/post' - response: - mediaType: application/json - openAPIDocKey: '200' - get_current_session: - operation: - $ref: '#/paths/~1api~1v1~1sessions~1me/get' - response: - mediaType: application/json - openAPIDocKey: '200' - close_current_session: - operation: - $ref: '#/paths/~1api~1v1~1sessions~1me/delete' - response: - mediaType: '' - openAPIDocKey: '204' - refresh_current_session: - operation: - $ref: '#/paths/~1api~1v1~1sessions~1me~1lifecycle~1refresh/post' - response: - mediaType: application/json - openAPIDocKey: '200' get_session: operation: $ref: '#/paths/~1api~1v1~1sessions~1{sessionId}/get' @@ -724,7 +482,7 @@ components: operation: $ref: '#/paths/~1api~1v1~1sessions~1{sessionId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' refresh_session: operation: @@ -734,15 +492,10 @@ components: openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/sessions/methods/get_current_session - $ref: '#/components/x-stackQL-resources/sessions/methods/get_session' - insert: - - $ref: '#/components/x-stackQL-resources/sessions/methods/create_session' + insert: [] update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/sessions/methods/close_current_session - $ref: '#/components/x-stackQL-resources/sessions/methods/revoke_session' replace: [] servers: @@ -750,7 +503,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/ssf.yaml b/providers/src/okta/v00.00.00000/services/ssf.yaml index 29c05a01..28350df1 100644 --- a/providers/src/okta/v00.00.00000/services/ssf.yaml +++ b/providers/src/okta/v00.00.00000/services/ssf.yaml @@ -2,19 +2,19 @@ openapi: 3.0.3 info: title: ssf API description: okta ssf API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/ssf/stream: get: summary: Retrieve the SSF stream configuration(s) description: >- - Retrieves either a list of all known SSF Stream configurations or the + Retrieves either a list of all known SSF stream configurations or the individual configuration if specified by ID. - As Stream configurations are tied to a Client ID, only the Stream - associated with the Client ID of the request OAuth 2.0 access token can - be viewed. + As stream configurations are tied to a client ID, you can only view the + stream associated with the client ID of the request OAuth 2.0 access + token. operationId: getSsfStreams parameters: - in: query @@ -22,19 +22,123 @@ paths: schema: type: string example: esc1k235GIIztAuGK0g5 - description: The ID of the specified SSF Stream configuration + description: The ID of the specified SSF stream configuration responses: '200': description: OK content: application/json: schema: - oneOf: - - type: array - title: List of Stream Configurations + type: array + title: List of stream configurations + items: + $ref: '#/components/schemas/StreamConfiguration' + properties: + aud: + description: >- + The audience used in the SET. This value is set as `aud` + in the claim. + + + A read-only parameter that is set by the transmitter. If + this parameter is included in the request, the value must + match the expected value from the transmitter. + example: https://example.com + type: string + format: uri items: - $ref: '#/components/schemas/StreamConfiguration' - - $ref: '#/components/schemas/StreamConfiguration' + type: string + format: uri + example: https://example.com + delivery: + $ref: '#/components/schemas/StreamConfigurationDelivery' + events_delivered: + type: array + items: + type: string + format: uri + description: >- + The events (mapped by the array of event type URIs) that + the transmitter actually delivers to the SSF stream. + + + A read-only parameter that is set by the transmitter. If + this parameter is included in the request, the value must + match the expected value from the transmitter. + example: + - >- + https://schemas.openid.net/secevent/caep/event-type/session-revoked + - >- + https://schemas.openid.net/secevent/caep/event-type/credential-change + events_requested: + type: array + maxItems: 50 + items: + type: string + format: uri + maxLength: 256 + description: >- + The events (mapped by the array of event type URIs) that + the receiver wants to receive + example: + - >- + https://schemas.openid.net/secevent/caep/event-type/session-revoked + - >- + https://schemas.openid.net/secevent/caep/event-type/credential-change + events_supported: + type: array + items: + type: string + format: uri + description: >- + An array of event type URIs that the transmitter supports. + + + A read-only parameter that is set by the transmitter. If + this parameter is included in the request, the value must + match the expected value from the transmitter. + example: + - >- + https://schemas.openid.net/secevent/caep/event-type/session-revoked + - >- + https://schemas.openid.net/secevent/caep/event-type/credential-change + format: + type: string + description: >- + The subject identifier format expected for any SET + transmitted. + enum: + - iss_sub + iss: + type: string + description: >- + The issuer used in security event tokens (SETs). This + value is set as `iss` in the claim. + + + A read-only parameter that is set by the transmitter. If + this parameter is included in the request, the value must + match the expected value from the transmitter. + example: https://{yourOktaDomain} + min_verification_interval: + type: integer + nullable: true + example: 60 + description: >- + The minimum amount of time, in seconds, between two + verification requests. + + + A read-only parameter that is set by the transmitter. If + this parameter is included in the request, the value must + match the expected value from the transmitter. + stream_id: + type: string + description: The ID of the SSF stream configuration + example: esc1k235GIIztAuGK0g5 + required: + - events_requested + - delivery examples: listResponse: $ref: '#/components/examples/listStreamConfigurationExample' @@ -61,19 +165,19 @@ paths: post: summary: Create an SSF stream description: >- - Creates an SSF Stream for an event receiver to start receiving security + Creates an SSF stream for an event receiver to start receiving security events in the form of Security Event Tokens (SETs) from Okta. - An SSF Stream is associated with the Client ID of the OAuth 2.0 access - token used to create the stream. The Client ID is provided by Okta for + An SSF stream is associated with the client ID of the OAuth 2.0 access + token used to create the stream. The client ID is provided by Okta for an [OAuth 2.0 app integration](https://help.okta.com/okta_help.htm?id=ext_Apps_App_Integration_Wizard-oidc). - One SSF Stream is allowed for each Client ID, hence, one SSF Stream is + One SSF stream is allowed for each client ID, hence, one SSF stream is allowed for each app integration in Okta. - A maximum of 10 SSF Stream configurations can be created for one org. + You can create a maximum of 10 SSF stream configurations for one org. operationId: createSsfStream x-codegen-request-body-name: instance requestBody: @@ -112,11 +216,11 @@ paths: put: summary: Replace an SSF stream description: >- - Replaces all properties for an existing SSF Stream configuration. + Replaces all properties for an existing SSF stream configuration. If the `stream_id` isn't provided in the request body, the associated - stream with the Client ID (through the request OAuth 2.0 access token) + stream with the client ID (through the request OAuth 2.0 access token) is replaced. operationId: replaceSsfStream x-codegen-request-body-name: instance @@ -156,11 +260,11 @@ paths: patch: summary: Update an SSF stream description: >- - Updates properties for an existing SSF Stream configuration. + Updates properties for an existing SSF stream configuration. If the `stream_id` isn't provided in the request body, the associated - stream with the Client ID (through the request OAuth 2.0 access token) + stream with the client ID (through the request OAuth 2.0 access token) is updated. operationId: updateSsfStream x-codegen-request-body-name: instance @@ -200,12 +304,12 @@ paths: delete: summary: Delete an SSF stream description: >- - Deletes the specified SSF Stream. + Deletes the specified SSF stream. If the `stream_id` is not provided in the query string, the associated - stream with the Client ID (through the request OAuth 2.0 access token) - is deleted. Otherwise, the SSF Stream with the `stream_id` is deleted, + stream with the client ID (through the request OAuth 2.0 access token) + is deleted. Otherwise, the SSF stream with the `stream_id` is deleted, if found. operationId: deleteSsfStream parameters: @@ -241,9 +345,9 @@ paths: - Okta Identity Engine /api/v1/ssf/stream/status: get: - summary: Retrieve the SSF Stream status + summary: Retrieve the SSF stream status description: >- - Retrieves the status of an SSF Stream. The status indicates whether the + Retrieves the status of an SSF stream. The status indicates whether the transmitter is able to transmit events over the stream. operationId: getSsfStreamStatus parameters: @@ -252,7 +356,7 @@ paths: schema: type: string example: esc1k235GIIztAuGK0g5 - description: The ID of the specified SSF Stream configuration + description: The ID of the specified SSF stream configuration required: true responses: '200': @@ -290,14 +394,14 @@ paths: post: summary: Verify an SSF stream description: >- - Verifies an SSF Stream by publishing a Verification Event requested by a - Security Events Provider. + Verifies an SSF stream by publishing a verification event requested by a + security events provider. - > **Note:** A successful response doesn't indicate that the Verification - Event + > **Note:** A successful response doesn't indicate that the verification + event was transmitted successfully, only that Okta has transmitted the event or will - at some point in the future. The SSF Receiver is responsible for validating and acknowledging + at some point in the future. The SSF receiver is responsible for validating and acknowledging successful transmission of the request by responding with HTTP Response Status Code 202. operationId: verifySsfStream x-codegen-request-body-name: instance @@ -334,19 +438,10 @@ paths: components: schemas: StreamConfiguration: - title: Stream Configuration + title: Stream configuration type: object properties: aud: - oneOf: - - type: string - format: uri - example: https://example.com - - type: array - items: - type: string - format: uri - example: https://example.com description: >- The audience used in the SET. This value is set as `aud` in the claim. @@ -356,6 +451,12 @@ components: parameter is included in the request, the value must match the expected value from the transmitter. example: https://example.com + type: string + format: uri + items: + type: string + format: uri + example: https://example.com delivery: $ref: '#/components/schemas/StreamConfigurationDelivery' events_delivered: @@ -365,7 +466,7 @@ components: format: uri description: >- The events (mapped by the array of event type URIs) that the - transmitter actually delivers to the SSF Stream. + transmitter actually delivers to the SSF stream. A read-only parameter that is set by the transmitter. If this @@ -410,13 +511,13 @@ components: https://schemas.openid.net/secevent/caep/event-type/credential-change format: type: string - description: The Subject Identifier format expected for any SET transmitted. + description: The subject identifier format expected for any SET transmitted. enum: - iss_sub iss: type: string description: >- - The issuer used in Security Event Tokens (SETs). This value is set + The issuer used in security event tokens (SETs). This value is set as `iss` in the claim. @@ -438,13 +539,13 @@ components: expected value from the transmitter. stream_id: type: string - description: The ID of the SSF Stream configuration + description: The ID of the SSF stream configuration example: esc1k235GIIztAuGK0g5 required: - events_requested - delivery StreamConfigurationCreateRequest: - title: Stream Configuration Create Request + title: Stream configuration create request type: object properties: delivery: @@ -466,20 +567,20 @@ components: https://schemas.openid.net/secevent/caep/event-type/credential-change format: type: string - description: The Subject Identifier format expected for any SET transmitted. + description: The subject identifier format expected for any SET transmitted. enum: - iss_sub required: - events_requested - delivery StreamStatus: - title: Stream Status - description: Status corresponding to the `stream_id` of the SSF Stream + title: Stream status + description: Status corresponding to the `stream_id` of the SSF stream type: object properties: status: type: string - description: The status of the SSF Stream configuration + description: The status of the SSF stream configuration enum: - enabled - disabled @@ -493,27 +594,28 @@ components: stream_id: type: string description: >- - The ID of the SSF Stream configuration. This corresponds to the + The ID of the SSF stream configuration. This corresponds to the value in the query parameter of the request. example: esc1k235GIIztAuGK0g5 StreamVerificationRequest: - title: Stream Verification Request + title: Stream verification request type: object properties: state: type: string description: >- An arbitrary string that Okta as a transmitter must echo back to the - Event Receiver in the Verification Event's payload + event receiver in the verification event's payload example: VGhpcyBpcyBhbiBleGFtcGxlIHN0YXRlIHZhbHVlLgo= stream_id: type: string - description: The ID of the SSF Stream Configuration + description: The ID of the SSF stream configuration example: esc1k235GIIztAuGK0g5 required: - stream_id StreamConfigurationDelivery: - title: Stream Configuration Delivery + title: Stream configuration delivery + x-okta-ignore-redocly-rules-for-sdk: true description: >- Contains information about the intended SET delivery method by the receiver @@ -522,7 +624,7 @@ components: authorization_header: type: string description: >- - The HTTP Authorization header that is included for each HTTP POST + The HTTP authorization header that's included for each HTTP POST request example: '{authorizationHeaderValue}' nullable: true @@ -680,12 +782,12 @@ components: min_verification_interval: 0 stream_id: esc1k235GIIztAuGK0g5 streamStatusEnabledExample: - summary: SSF Stream enabled status example + summary: SSF stream enabled status example value: stream_id: esc1k235GIIztAuGK0g5 status: enabled streamStatusDisabledExample: - summary: SSF Stream disabled status example + summary: SSF stream disabled status example value: stream_id: esc1k235GIIztAuGK0g5 status: disabled @@ -750,18 +852,27 @@ components: mediaType: application/json openAPIDocKey: '200' create_ssf_stream: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1ssf~1stream/post' response: mediaType: application/json openAPIDocKey: '201' replace_ssf_stream: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1ssf~1stream/put' response: mediaType: application/json openAPIDocKey: '200' update_ssf_stream: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1ssf~1stream/patch' response: @@ -771,13 +882,16 @@ components: operation: $ref: '#/paths/~1api~1v1~1ssf~1stream/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' verify_ssf_stream: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1ssf~1stream~1verification/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: @@ -819,7 +933,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/telephony_providers.yaml b/providers/src/okta/v00.00.00000/services/telephony_providers.yaml new file mode 100644 index 00000000..ef10f9ef --- /dev/null +++ b/providers/src/okta/v00.00.00000/services/telephony_providers.yaml @@ -0,0 +1,1044 @@ +openapi: 3.0.3 +info: + title: telephony_providers API + description: okta telephony_providers API + version: 2026.07.2 +paths: + /api/v1/telephony-providers: + get: + summary: List all custom telephony providers + description: Lists all custom telephony providers that are configured in your org + operationId: listAllCustomTelephonyProviderCredentials + responses: + '200': + description: OK + content: + application/json: + schema: + $ref: >- + #/components/schemas/ListAllCustomTelephonyProviderCredentialsResponse + examples: + CustomTelephonyProviderCredentialsListAllResponseEx: + $ref: >- + #/components/examples/CustomTelephonyProviderCredentialsListAllResponseEx + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + security: + - apiToken: [] + - oauth2: + - okta.customTelephonyProvider.read + tags: + - CustomTelephonyProvider + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + post: + summary: Create a custom telephony provider + description: Creates a custom telephony provider with the provided credentials + operationId: createCustomTelephonyProviderCredentials + requestBody: + required: true + content: + application/json: + schema: + $ref: >- + #/components/schemas/CustomTelephonyProviderCredentialCreateRequest + examples: + CustomTelephonyProviderCredentialCreateRequestExTwilio: + $ref: >- + #/components/examples/CustomTelephonyProviderCredentialCreateRequestTwilioEx + CustomTelephonyProviderCredentialCreateRequestExTelesign: + $ref: >- + #/components/examples/CustomTelephonyProviderCredentialCreateRequestTelesignEx + responses: + '201': + description: Created + content: + application/json: + schema: + $ref: '#/components/schemas/CustomTelephonyProviderCredentialResponse' + examples: + CustomTelephonyProviderCredentialCreateResponseTwilioEx: + $ref: >- + #/components/examples/CustomTelephonyProviderCredentialCreateResponseTwilioEx + CustomTelephonyProviderCredentialCreateResponseTelesignEx: + $ref: >- + #/components/examples/CustomTelephonyProviderCredentialCreateResponseTelesignEx + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + security: + - apiToken: [] + - oauth2: + - okta.customTelephonyProvider.manage + tags: + - CustomTelephonyProvider + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + /api/v1/telephony-providers/{customTelephonyProviderId}: + get: + summary: Retrieve a custom telephony provider + description: Retrieves the details of a custom telephony provider by its ID + operationId: getCustomTelephonyProviderCredential + responses: + '200': + description: OK + content: + application/json: + schema: + $ref: '#/components/schemas/CustomTelephonyProviderCredentialResponse' + examples: + CustomTelephonyProviderCredentialsListOneResponseEx: + $ref: >- + #/components/examples/CustomTelephonyProviderCredentialListOneResponseEx + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + security: + - apiToken: [] + - oauth2: + - okta.customTelephonyProvider.read + tags: + - CustomTelephonyProvider + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + parameters: + - $ref: '#/components/parameters/customTelephonyProviderId' + patch: + summary: Update a custom telephony provider credential + description: Updates the credentials of an existing custom telephony provider + operationId: updateCustomTelephonyProviderCredential + parameters: + - $ref: '#/components/parameters/customTelephonyProviderId' + requestBody: + required: true + content: + application/json: + schema: + $ref: >- + #/components/schemas/CustomTelephonyProviderCredentialUpdateRequest + examples: + CustomTelephonyProviderCredentialUpdateRequestEx: + $ref: >- + #/components/examples/CustomTelephonyProviderCredentialUpdateRequestEx + responses: + '200': + description: OK + content: + application/json: + schema: + $ref: '#/components/schemas/CustomTelephonyProviderCredentialResponse' + examples: + CustomTelephonyProviderCredentialsUpdateResponseEx: + $ref: >- + #/components/examples/CustomTelephonyProviderCredentialsUpdateResponseEx + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + security: + - apiToken: [] + - oauth2: + - okta.customTelephonyProvider.manage + tags: + - CustomTelephonyProvider + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + delete: + summary: Delete a custom telephony provider + description: >- + Deletes a custom telephony provider by its ID. + + + Before you delete a provider, ensure that it is + [deactivated](https://developer.okta.com/docs/api/openapi/okta-management/management/customtelephonyprovider/deactivatecustomtelephonycredential). + Consider setting up another telephony provider if you still plan to use + telephony in your org. See [Set up an external telephony + provider](https://help.okta.com/okta_help.htm?type=oie&id=about-telephony). + operationId: deleteCustomTelephonyProviderCredential + parameters: + - $ref: '#/components/parameters/customTelephonyProviderId' + responses: + '204': + description: No Content + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + security: + - apiToken: [] + - oauth2: + - okta.customTelephonyProvider.manage + tags: + - CustomTelephonyProvider + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + /api/v1/telephony-providers/{customTelephonyProviderId}/lifecycle/activate: + post: + summary: Activate a custom telephony provider + description: >- + Activates a custom telephony provider by its ID. You must activate a + provider before it can be used. + operationId: activateCustomTelephonyCredential + responses: + '200': + description: OK + content: + application/json: + schema: + $ref: '#/components/schemas/CustomTelephonyProviderCredentialResponse' + examples: + CustomTelephonyProviderCredentialListOneResponseEx: + $ref: >- + #/components/examples/CustomTelephonyProviderCredentialListOneResponseEx + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + security: + - apiToken: [] + - oauth2: + - okta.customTelephonyProvider.manage + tags: + - CustomTelephonyProvider + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + parameters: + - $ref: '#/components/parameters/customTelephonyProviderId' + /api/v1/telephony-providers/{customTelephonyProviderId}/lifecycle/deactivate: + post: + summary: Deactivate a custom telephony provider + description: >- + Deactivates a custom telephony provider by its ID. Keep the following + points in mind when you deactivate a provider: + + * You must deactivate a provider before deleting it. + + * If you have two telephony providers configured, and both are active, + you can only deactivate the secondary provider. The second provider is + the one that isn't set as the primary provider. + operationId: deactivateCustomTelephonyCredential + responses: + '200': + description: OK + content: + application/json: + schema: + $ref: '#/components/schemas/CustomTelephonyProviderCredentialResponse' + examples: + CustomTelephonyProviderCredentialDeactivatedResponseEx: + $ref: >- + #/components/examples/CustomTelephonyProviderCredentialDeactivatedResponseEx + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + security: + - apiToken: [] + - oauth2: + - okta.customTelephonyProvider.manage + tags: + - CustomTelephonyProvider + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + parameters: + - $ref: '#/components/parameters/customTelephonyProviderId' + /api/v1/telephony-providers/{customTelephonyProviderId}/setAsPrimary: + post: + summary: Set a custom telephony provider as a primary telephony provider + description: >- + Sets a custom telephony provider as the primary telephony provider for + the org. You can only set one provider as a primary provider at a time. + operationId: setAsPrimaryCustomTelephonyCredential + responses: + '200': + description: OK + content: + application/json: + schema: + $ref: '#/components/schemas/CustomTelephonyProviderCredentialResponse' + examples: + CustomTelephonyProviderCredentialPrimaryResponseEx: + $ref: >- + #/components/examples/CustomTelephonyProviderCredentialPrimaryResponseEx + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + '404': + $ref: '#/components/responses/ErrorResourceNotFound404' + security: + - apiToken: [] + - oauth2: + - okta.customTelephonyProvider.manage + tags: + - CustomTelephonyProvider + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + parameters: + - $ref: '#/components/parameters/customTelephonyProviderId' + /api/v1/telephony-providers/{customTelephonyProviderId}/test: + post: + summary: Send a test message from a custom telephony provider + description: >- + Sends a test message (SMS or call) using the specified custom telephony + provider to verify that the provider is configured correctly. + + + You must provide a valid phone number and country code to send the test + message. Send it to a phone number that you have access to so you can + confirm that the message was received. + operationId: sendTestCustomTelephonyProviderCredential + requestBody: + required: true + content: + application/json: + schema: + $ref: >- + #/components/schemas/CustomTelephonyProviderCredentialSendTestRequest + examples: + CustomTelephonyProviderCredentialSendTestRequestEx: + $ref: >- + #/components/examples/CustomTelephonyProviderCredentialSendTestRequestEx + responses: + '204': + description: No Content + '400': + $ref: '#/components/responses/ErrorApiValidationFailed400' + '403': + $ref: '#/components/responses/ErrorAccessDenied403' + security: + - apiToken: [] + - oauth2: + - okta.customTelephonyProvider.manage + tags: + - CustomTelephonyProvider + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: + - Okta Identity Engine + parameters: + - $ref: '#/components/parameters/customTelephonyProviderId' +components: + schemas: + CustomTelephonyProviderCredentialsResponse: + description: Response for credentials of multiple custom telephony providers + items: + $ref: '#/components/schemas/CustomTelephonyProviderCredentialResponse' + type: array + CustomTelephonyProviderCredentialCreateRequest: + description: Create custom telephony provider credentials + properties: + providerAuthToken: + type: string + description: >- + The authentication token that's used to authenticate requests to the + telephony provider. Your telephony provider gives you this token. + providerCapability: + type: string + description: >- + The types of telephony operations (SMS or Voice) that you use with + your telephony provider. + + + `ALL` is the only valid value. It indicates that your provider can + handle both SMS messages and voice calls. You're not required to use + both types of telephony operations, but your provider can support + both. + enum: + - ALL + providerName: + type: string + description: The name of the telephony provider + enum: + - TWILIO + - TELESIGN + providerSettings: + $ref: '#/components/schemas/CustomTelephonyProviderSettings' + providerSid: + type: string + description: >- + The account string identifier (SID) for your telephony provider + account. Your telephony provider gives you this SID. + type: object + CustomTelephonyProviderCredentialResponse: + type: object + properties: + enabled: + type: boolean + description: Indicates whether the provider is enabled and can be used + id: + type: string + description: ID of the custom telephony provider + isPrimaryProvider: + type: boolean + description: Indicates whether the provider is the primary telephony provider + providerCapability: + type: string + description: >- + The types of telephony operations (SMS or Voice) that you use with + your telephony provider. + + + `ALL` is the only valid value. It indicates that your provider can + handle both SMS messages and voice calls. You're not required to use + both types of telephony operations, but your provider can support + both. + enum: + - ALL + providerName: + type: string + description: Name of the telephony provider + enum: + - TWILIO + - TELESIGN + providerSettings: + $ref: '#/components/schemas/CustomTelephonyProviderSettings' + providerSid: + type: string + description: >- + The account string identifier (SID) for your telephony provider + account. Your telephony provider gives you this SID. + CustomTelephonyProviderCredentialUpdateRequest: + description: Update custom telephony provider credentials + type: object + properties: + id: + type: string + description: ID of the custom telephony provider + providerAuthToken: + type: string + description: >- + The authentication token that's used to authenticate requests to the + telephony provider. Your telephony provider gives you this token. + providerSettings: + $ref: '#/components/schemas/CustomTelephonyProviderSettings' + providerSid: + type: string + description: >- + The account string identifier (SID) for your telephony provider + account. Your telephony provider gives you this SID. + CustomTelephonyProviderCredentialSendTestRequest: + type: object + properties: + countryCodeIso2: + type: string + description: >- + The country code for the phone number. + + Use the [Alpha-2 code from ISO + 3166-1](https://www.iso.org/obp/ui/#search) for country codes. + factor: + type: string + description: The type of test message to send + enum: + - SMS + - CALL + phoneNumber: + type: string + description: The phone number to which the test message or call is sent + Error: + title: Error + type: object + properties: + errorCauses: + type: array + items: + $ref: '#/components/schemas/ErrorCause' + errorCode: + type: string + description: An Okta code for this type of error + errorId: + type: string + description: >- + A unique identifier for this error. This can be used by Okta Support + to help with troubleshooting. + errorLink: + type: string + description: An Okta code for this type of error + errorSummary: + type: string + description: >- + A short description of what caused this error. Sometimes this + contains dynamically-generated information about your specific + error. + CustomTelephonyProviderSettings: + x-okta-ignore-redocly-rules-for-sdk: true + description: >- + Settings for custom telephony provider. + + + These settings vary based on the telephony provider and the type of + telephony operation (SMS or Voice). For `sms` and `call`, you can select + one method per telephony operation (`sms` and `call`) for sending + messages or voice calls. + + + > **Note:** Configure your telephony provider settings before selecting + the methods for sending SMS messages or making voice calls. For example, + if you select Twilio as your telephony provider, and you want to send + SMS messages using Twilio's Verify Service, ensure that you have the + Verify Service set up in your Twilio account. You can then use the + `twilioVerifySid` field under `sms` to provide the necessary SID. + type: object + properties: + call: + description: >- + Method for making voice calls. Choose one method for making voice + calls based on your telephony provider setup. + title: Twilio Verify SID + type: object + properties: + twilioVerifySid: + type: string + description: >- + The Twilio Verify Service SID used for sending verification + messages or calls. You can find this value in your Twilio + console. + + + This method uses Twilio's [Verify + API](https://www.twilio.com/docs/verify/api). + twilioPhoneNumber: + type: string + description: >- + The Twilio phone number that's used for sending SMS messages or + voice calls. You can find this value in your Twilio console. + + + This method uses Twilio's [Programmable Messaging + API](https://www.twilio.com/docs/messaging). + twilioCallerId: + type: string + description: >- + The Twilio caller ID that's used for making calls. You can find + this value in your Twilio console. + + + This method uses Twilio's [Programmable Voice + API](https://www.twilio.com/docs/voice). + telesignService: + type: string + enum: + - telesignVoiceService + - telesignVerifyService + description: >- + The Telesign service identifier used for sending making calls. + You can find this value in your Telesign console. + + + The `telesignVerifyService` method uses Telesign's [Verify + API](https://developer.telesign.com/enterprise/docs/verify-api-overview). + And the `telesignVoiceService` method uses Telesign's [Voice + API](https://developer.telesign.com/enterprise/docs/voice-overview). + sms: + description: >- + Method for sending SMS messages. Choose one method for sending SMS + messages based on your telephony provider setup. + title: Twilio Verify SID + type: object + properties: + twilioVerifySid: + type: string + description: >- + The Twilio Verify Service SID used for sending verification + messages or calls. You can find this value in your Twilio + console. + + + This method uses Twilio's [Verify + API](https://www.twilio.com/docs/verify/api). + twilioPhoneNumber: + type: string + description: >- + The Twilio phone number that's used for sending SMS messages or + voice calls. You can find this value in your Twilio console. + + + This method uses Twilio's [Programmable Messaging + API](https://www.twilio.com/docs/messaging). + twilioMessageSid: + type: string + description: >- + The Twilio Messaging Service SID used for sending SMS messages. + You can find this value in your Twilio console. + + + This method uses Twilio's [Programmable Messaging + API](https://www.twilio.com/docs/messaging). + telesignService: + type: string + enum: + - telesignMessagingService + - telesignVerifyService + description: >- + The Telesign service identifier used for sending SMS messages. + You can find this value in your Telesign console. + + + The `telesignVerifyService` method uses Telesign's [Verify + API](https://developer.telesign.com/enterprise/docs/verify-api-overview). + And the `telesignMessagingService` method uses Telesign's + [SMS](https://developer.telesign.com/enterprise/docs/voice-overview) + and + [Messaging](https://developer.telesign.com/enterprise/docs/messaging-overview) + APIs. + ErrorCause: + type: object + properties: + errorSummary: + type: string + CustomTelephonyProviderSettingsTwilioVerify: + title: Twilio Verify SID + type: object + properties: + twilioVerifySid: + type: string + description: >- + The Twilio Verify Service SID used for sending verification messages + or calls. You can find this value in your Twilio console. + + + This method uses Twilio's [Verify + API](https://www.twilio.com/docs/verify/api). + CustomTelephonyProviderSettingsTwilioPhoneNumber: + title: Twilio Phone Number + type: object + properties: + twilioPhoneNumber: + type: string + description: >- + The Twilio phone number that's used for sending SMS messages or + voice calls. You can find this value in your Twilio console. + + + This method uses Twilio's [Programmable Messaging + API](https://www.twilio.com/docs/messaging). + CustomTelephonyProviderSettingsTwilioCallerId: + title: Twilio Caller ID + type: object + properties: + twilioCallerId: + type: string + description: >- + The Twilio caller ID that's used for making calls. You can find this + value in your Twilio console. + + + This method uses Twilio's [Programmable Voice + API](https://www.twilio.com/docs/voice). + CustomTelephonyProviderSettingsTelesignServiceCall: + title: Telesign Service + type: object + properties: + telesignService: + type: string + enum: + - telesignVoiceService + - telesignVerifyService + description: >- + The Telesign service identifier used for sending making calls. You + can find this value in your Telesign console. + + + The `telesignVerifyService` method uses Telesign's [Verify + API](https://developer.telesign.com/enterprise/docs/verify-api-overview). + And the `telesignVoiceService` method uses Telesign's [Voice + API](https://developer.telesign.com/enterprise/docs/voice-overview). + CustomTelephonyProviderSettingsTwilioMessagingService: + title: Twilio Message SID + type: object + properties: + twilioMessageSid: + type: string + description: >- + The Twilio Messaging Service SID used for sending SMS messages. You + can find this value in your Twilio console. + + + This method uses Twilio's [Programmable Messaging + API](https://www.twilio.com/docs/messaging). + CustomTelephonyProviderSettingsTelesignServiceSms: + title: Telesign Service + type: object + properties: + telesignService: + type: string + enum: + - telesignMessagingService + - telesignVerifyService + description: >- + The Telesign service identifier used for sending SMS messages. You + can find this value in your Telesign console. + + + The `telesignVerifyService` method uses Telesign's [Verify + API](https://developer.telesign.com/enterprise/docs/verify-api-overview). + And the `telesignMessagingService` method uses Telesign's + [SMS](https://developer.telesign.com/enterprise/docs/voice-overview) + and + [Messaging](https://developer.telesign.com/enterprise/docs/messaging-overview) + APIs. + ListAllCustomTelephonyProviderCredentialsResponse: + type: object + properties: + custom_telephony_provider_credentials: + type: array + items: + $ref: '#/components/schemas/CustomTelephonyProviderCredentialResponse' + responses: + ErrorAccessDenied403: + description: Forbidden + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + examples: + AccessDenied: + $ref: '#/components/examples/ErrorAccessDenied' + ErrorResourceNotFound404: + description: Not Found + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + examples: + ResourceNotFound: + $ref: '#/components/examples/ErrorResourceNotFound' + ErrorApiValidationFailed400: + description: Bad Request + content: + application/json: + schema: + $ref: '#/components/schemas/Error' + examples: + APIValidationFailed: + $ref: '#/components/examples/ErrorApiValidationFailed' + parameters: + customTelephonyProviderId: + name: customTelephonyProviderId + description: The ID of the custom telephony provider + in: path + required: true + schema: + type: string + examples: + CustomTelephonyProviderCredentialsListAllResponseEx: + summary: List of custom telephony provider credentials + value: + - id: oct3v00k4iOFlEJmQ806 + isPrimaryProvider: true + enabled: true + providerCapability: ALL + providerName: TWILIO + providerSid: ACb49fb19a09b2f5d2f121fe1c207689dt + providerSettings: + sms: + twilioPhoneNumber: '+1234567890' + call: + twilioVerifySid: example-verify-sid + - id: oct3v00k4iOFlEG3dR45 + isPrimaryProvider: false + enabled: true + providerCapability: ALL + providerName: TELESIGN + providerSid: AC42tfy19a09b2f5d2f121fe1c207fg456r + providerSettings: + sms: + telesignService: telesignMessagingService + call: + telesignService: telesignVerifyService + CustomTelephonyProviderCredentialCreateRequestTwilioEx: + summary: Create a Twilio custom telephony provider + value: + providerAuthToken: 11a9b6c435967abe806f4f0d6ec0f382 + providerCapability: ALL + providerName: TWILIO + providerSid: ACb49fb19a09b2f5d2f121fe1c207689dt + providerSettings: + sms: + twilioPhoneNumber: '+1234567890' + call: + twilioVerifySid: example-verify-sid + CustomTelephonyProviderCredentialCreateRequestTelesignEx: + summary: Create a Telesign custom telephony provider + value: + providerAuthToken: 67bf6c435967abe806f4f0d6eg2p645 + providerCapability: ALL + providerName: TELESIGN + providerSid: CF98EDb19a09b2f5d2f121fe1c207722F7 + providerSettings: + sms: + telesignService: telesignMessagingService + call: + telesignService: telesignVerifyService + CustomTelephonyProviderCredentialCreateResponseTwilioEx: + summary: Response for Twilio custom telephony provider + value: + id: oct3v00k4iOFlEJmQ806 + isPrimaryProvider: true + enabled: true + providerCapability: ALL + providerName: TWILIO + providerSid: ACb49fb19a09b2f5d2f121fe1c207689dt + providerSettings: + sms: + twilioPhoneNumber: '+1234567890' + call: + twilioVerifySid: example-verify-sid + CustomTelephonyProviderCredentialCreateResponseTelesignEx: + summary: Response for Telesign custom telephony provider + value: + id: oct1ko8bzvN4smpBU0g5 + isPrimaryProvider: true + enabled: true + providerCapability: ALL + providerName: TELESIGN + providerSid: ACl82fb19a09b2b422f121fe1c2076ch29 + providerSettings: + sms: + telesignService: telesignMessagingService + call: + telesignService: telesignVoiceService + CustomTelephonyProviderCredentialListOneResponseEx: + summary: Response for credentials of one custom telephony provider + value: + id: oct3v00k4iOFlEJmQ806 + isPrimaryProvider: true + enabled: true + providerCapability: ALL + providerName: TWILIO + providerSid: ACb49fb19a09b2f5d2f121fe1c207689dt + providerSettings: + sms: + twilioPhoneNumber: '+1234567890' + call: + twilioVerifySid: example-verify-sid + CustomTelephonyProviderCredentialUpdateRequestEx: + summary: Update custom telephony provider credentials + value: + id: oct3v00k4iOFlEJmQ806 + providerAuthToken: 11a9b6c435967abe806f4f0d6ec0f382 + providerSid: ACb49fb19a09b2f5d2f121fe1c207689dt + providerSettings: + sms: + twilioPhoneNumber: '+1234567890' + call: + twilioVerifySid: updated-verify-sid + CustomTelephonyProviderCredentialsUpdateResponseEx: + summary: Response for updated custom telephony provider + value: + id: oct3v00k4iOFlEJmQ806 + isPrimaryProvider: true + enabled: true + providerCapability: ALL + providerName: TWILIO + providerSid: 11a9b6c435967abe806f4f0d6ec0f382 + providerSettings: + sms: + twilioPhoneNumber: '+1234567890' + call: + twilioVerifySid: updated-verify-sid + CustomTelephonyProviderCredentialDeactivatedResponseEx: + summary: Response for deactivated custom telephony provider + value: + id: oct3v00k4iOFlEJmQ806 + isPrimaryProvider: false + enabled: false + providerCapability: ALL + providerName: TWILIO + providerSid: ACb49fb19a09b2f5d2f121fe1c207689dt + providerSettings: + sms: + twilioPhoneNumber: '+1234567890' + call: + twilioVerifySid: example-verify-sid + CustomTelephonyProviderCredentialPrimaryResponseEx: + summary: Response for setting primary custom telephony provider + value: + id: oct3v00k4iOFlEJmQ806 + isPrimaryProvider: true + enabled: true + providerCapability: ALL + providerName: TWILIO + providerSid: ACb49fb19a09b2f5d2f121fe1c207689dt + providerSettings: + sms: + twilioPhoneNumber: '+1234567890' + call: + twilioVerifySid: example-verify-sid + CustomTelephonyProviderCredentialSendTestRequestEx: + summary: Send test SMS message + value: + factor: SMS + phoneNumber: '+1234567890' + countryCodeIso2: US + ErrorAccessDenied: + summary: Access Denied + value: + errorCode: E0000006 + errorSummary: You do not have permission to perform the requested action + errorLink: E0000006 + errorId: sampleNUSD_8fdkFd8fs8SDBK + errorCauses: [] + ErrorResourceNotFound: + summary: Resource Not Found + value: + errorCode: E0000007 + errorSummary: 'Not found: {0}' + errorLink: E0000007 + errorId: sampleMlLvGUj_YD5v16vkYWY + errorCauses: [] + ErrorApiValidationFailed: + summary: API Validation Failed + value: + errorCode: E0000001 + errorSummary: 'Api validation failed: {0}' + errorLink: E0000001 + errorId: sampleiCF-8D5rLW6myqiPItW + errorCauses: [] + x-stackQL-resources: + telephony_providers: + id: okta.telephony_providers.telephony_providers + name: telephony_providers + title: Telephony Providers + methods: + list_all_custom_telephony_provider_credentials: + operation: + $ref: '#/paths/~1api~1v1~1telephony-providers/get' + response: + mediaType: application/json + openAPIDocKey: '200' + objectKey: $.custom_telephony_provider_credentials + overrideMediaType: application/json + schema_override: + $ref: >- + #/components/schemas/ListAllCustomTelephonyProviderCredentialsResponse + transform: + body: >- + {{- $wrapped := printf + "{\"custom_telephony_provider_credentials\":%s}" . -}} + + {{- $wrapped -}} + type: golang_template_text_v0.3.0 + create_custom_telephony_provider_credentials: + config: + requestBodyTranslate: + algorithm: naive + operation: + $ref: '#/paths/~1api~1v1~1telephony-providers/post' + response: + mediaType: application/json + openAPIDocKey: '201' + get_custom_telephony_provider_credential: + operation: + $ref: >- + #/paths/~1api~1v1~1telephony-providers~1{customTelephonyProviderId}/get + response: + mediaType: application/json + openAPIDocKey: '200' + update_custom_telephony_provider_credential: + config: + requestBodyTranslate: + algorithm: naive + operation: + $ref: >- + #/paths/~1api~1v1~1telephony-providers~1{customTelephonyProviderId}/patch + response: + mediaType: application/json + openAPIDocKey: '200' + delete_custom_telephony_provider_credential: + operation: + $ref: >- + #/paths/~1api~1v1~1telephony-providers~1{customTelephonyProviderId}/delete + response: + mediaType: application/json + openAPIDocKey: '204' + activate_custom_telephony_credential: + operation: + $ref: >- + #/paths/~1api~1v1~1telephony-providers~1{customTelephonyProviderId}~1lifecycle~1activate/post + response: + mediaType: application/json + openAPIDocKey: '200' + deactivate_custom_telephony_credential: + operation: + $ref: >- + #/paths/~1api~1v1~1telephony-providers~1{customTelephonyProviderId}~1lifecycle~1deactivate/post + response: + mediaType: application/json + openAPIDocKey: '200' + set_as_primary_custom_telephony_credential: + operation: + $ref: >- + #/paths/~1api~1v1~1telephony-providers~1{customTelephonyProviderId}~1setAsPrimary/post + response: + mediaType: application/json + openAPIDocKey: '200' + send_test_custom_telephony_provider_credential: + config: + requestBodyTranslate: + algorithm: naive + operation: + $ref: >- + #/paths/~1api~1v1~1telephony-providers~1{customTelephonyProviderId}~1test/post + response: + mediaType: application/json + openAPIDocKey: '204' + sqlVerbs: + select: + - $ref: >- + #/components/x-stackQL-resources/telephony_providers/methods/get_custom_telephony_provider_credential + - $ref: >- + #/components/x-stackQL-resources/telephony_providers/methods/list_all_custom_telephony_provider_credentials + insert: + - $ref: >- + #/components/x-stackQL-resources/telephony_providers/methods/create_custom_telephony_provider_credentials + update: + - $ref: >- + #/components/x-stackQL-resources/telephony_providers/methods/update_custom_telephony_provider_credential + delete: + - $ref: >- + #/components/x-stackQL-resources/telephony_providers/methods/delete_custom_telephony_provider_credential + replace: [] +servers: + - url: https://{subdomain}.okta.com/ + variables: + subdomain: + default: my-org +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/templates.yaml b/providers/src/okta/v00.00.00000/services/templates.yaml index 4e188007..7db6b604 100644 --- a/providers/src/okta/v00.00.00000/services/templates.yaml +++ b/providers/src/okta/v00.00.00000/services/templates.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: templates API description: okta templates API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/templates/sms: get: @@ -22,9 +22,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/SmsTemplate' + $ref: '#/components/schemas/ListSmsTemplatesResponse' examples: SMS Template List response: $ref: '#/components/examples/SMSTemplateListResponse' @@ -110,6 +108,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathTemplateId' post: summary: Update an SMS template description: | @@ -156,6 +156,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathTemplateId' put: summary: Replace an SMS template description: | @@ -199,6 +201,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathTemplateId' delete: summary: Delete an SMS template description: Deletes an SMS template @@ -222,8 +226,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathTemplateId' + parameters: + - $ref: '#/components/parameters/pathTemplateId' components: schemas: SmsTemplateType: @@ -256,7 +260,7 @@ components: type: string description: >- Text of the Template, including any - [macros](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/Template/) + [macros](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Template/) maxLength: 161 minLength: 1 translations: @@ -264,7 +268,8 @@ components: type: $ref: '#/components/schemas/SmsTemplateType' SmsTemplateTranslations: - description: > + x-okta-ignore-redocly-rules-for-sdk: true + description: >- - Template translations are optionally provided when you want to localize the SMS messages. Translations are provided as an object that contains `key:value` pairs: the language and the translated Template @@ -274,7 +279,8 @@ components: - Just like with regular SMS Templates, the length of the SMS message can't exceed 160 characters. - type: object + (opaque JSON object) + type: string x-okta-extensible: true Error: title: Error @@ -306,6 +312,13 @@ components: properties: errorSummary: type: string + ListSmsTemplatesResponse: + type: object + properties: + sms_templates: + type: array + items: + $ref: '#/components/schemas/SmsTemplate' responses: ErrorAccessDenied403: description: Forbidden @@ -447,7 +460,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.sms_templates + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListSmsTemplatesResponse' + transform: + body: |- + {{- $wrapped := printf "{\"sms_templates\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_sms_template: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1templates~1sms/post' response: @@ -460,12 +485,18 @@ components: mediaType: application/json openAPIDocKey: '200' update_sms_template: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1templates~1sms~1{templateId}/post' response: mediaType: application/json openAPIDocKey: '200' replace_sms_template: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1templates~1sms~1{templateId}/put' response: @@ -475,14 +506,14 @@ components: operation: $ref: '#/paths/~1api~1v1~1templates~1sms~1{templateId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/sms_templates/methods/list_sms_templates - $ref: >- #/components/x-stackQL-resources/sms_templates/methods/get_sms_template + - $ref: >- + #/components/x-stackQL-resources/sms_templates/methods/list_sms_templates insert: - $ref: >- #/components/x-stackQL-resources/sms_templates/methods/create_sms_template @@ -500,7 +531,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/threats.yaml b/providers/src/okta/v00.00.00000/services/threats.yaml index bde27d49..5fa11112 100644 --- a/providers/src/okta/v00.00.00000/services/threats.yaml +++ b/providers/src/okta/v00.00.00000/services/threats.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: threats API description: okta threats API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/threats/configuration: get: @@ -102,7 +102,7 @@ components: type: array description: >- Accepts a list of [Network - Zone](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/NetworkZone/) IDs. + Zone](https://developer.okta.com/docs/api/openapi/okta-management/management/networkzone/) IDs. IPs in the excluded network zones aren't logged or blocked. @@ -162,15 +162,43 @@ components: contains dynamically-generated information about your specific error. HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) ErrorCause: type: object properties: errorSummary: type: string HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object additionalProperties: true type: object @@ -317,6 +345,9 @@ components: mediaType: application/json openAPIDocKey: '200' update_configuration: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1threats~1configuration/post' response: @@ -337,7 +368,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/trustedorigins.yaml b/providers/src/okta/v00.00.00000/services/trustedorigins.yaml index ac1f1812..8c300826 100644 --- a/providers/src/okta/v00.00.00000/services/trustedorigins.yaml +++ b/providers/src/okta/v00.00.00000/services/trustedorigins.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: trustedorigins API description: okta trustedorigins API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/trustedOrigins: get: @@ -46,9 +46,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/TrustedOrigin' + $ref: '#/components/schemas/ListTrustedOriginsResponse' examples: TrustedOriginsResponse: $ref: '#/components/examples/TrustedOriginsResponse' @@ -151,6 +149,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathTrustedOriginId' put: summary: Replace a trusted origin description: Replaces a trusted origin @@ -197,6 +197,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathTrustedOriginId' delete: summary: Delete a trusted origin description: Deletes a trusted origin @@ -220,8 +222,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathTrustedOriginId' + parameters: + - $ref: '#/components/parameters/pathTrustedOriginId' /api/v1/trustedOrigins/{trustedOriginId}/lifecycle/activate: post: summary: Activate a trusted origin @@ -252,8 +254,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathTrustedOriginId' + parameters: + - $ref: '#/components/parameters/pathTrustedOriginId' /api/v1/trustedOrigins/{trustedOriginId}/lifecycle/deactivate: post: summary: Deactivate a trusted origin @@ -284,8 +286,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathTrustedOriginId' + parameters: + - $ref: '#/components/parameters/pathTrustedOriginId' components: schemas: TrustedOrigin: @@ -352,14 +354,22 @@ components: - ACTIVE - INACTIVE LinksSelfAndLifecycle: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - type: object - properties: - activate: - $ref: '#/components/schemas/HrefObjectActivateLink' - deactivate: - $ref: '#/components/schemas/HrefObjectDeactivateLink' + description: >- + Specifies link relations (see [Web + Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the + [JSON Hypertext Application + Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) + specification. This object is used for dynamic discovery of related + resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + activate: + $ref: '#/components/schemas/HrefObjectActivateLink' + deactivate: + $ref: '#/components/schemas/HrefObjectDeactivateLink' + readOnly: true Error: title: Error type: object @@ -409,13 +419,67 @@ components: $ref: '#/components/schemas/HrefObjectSelfLink' readOnly: true HrefObjectActivateLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to activate the resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to activate the resource HrefObjectDeactivateLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to deactivate the resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to deactivate the resource ErrorCause: type: object properties: @@ -438,10 +502,38 @@ components: - IFRAME_EMBED - REDIRECT HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object additionalProperties: true type: object @@ -485,6 +577,13 @@ components: - GET - POST - PUT + ListTrustedOriginsResponse: + type: object + properties: + trusted_origins: + type: array + items: + $ref: '#/components/schemas/TrustedOrigin' responses: ErrorAccessDenied403: description: Forbidden @@ -881,7 +980,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.trusted_origins + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListTrustedOriginsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"trusted_origins\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_trusted_origin: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1trustedOrigins/post' response: @@ -894,6 +1005,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_trusted_origin: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1trustedOrigins~1{trustedOriginId}/put' response: @@ -903,7 +1017,7 @@ components: operation: $ref: '#/paths/~1api~1v1~1trustedOrigins~1{trustedOriginId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' activate_trusted_origin: operation: @@ -921,10 +1035,10 @@ components: openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/trusted_origins/methods/list_trusted_origins - $ref: >- #/components/x-stackQL-resources/trusted_origins/methods/get_trusted_origin + - $ref: >- + #/components/x-stackQL-resources/trusted_origins/methods/list_trusted_origins insert: - $ref: >- #/components/x-stackQL-resources/trusted_origins/methods/create_trusted_origin @@ -940,7 +1054,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/users.yaml b/providers/src/okta/v00.00.00000/services/users.yaml index 3750f1bd..af7a132d 100644 --- a/providers/src/okta/v00.00.00000/services/users.yaml +++ b/providers/src/okta/v00.00.00000/services/users.yaml @@ -2,255 +2,152 @@ openapi: 3.0.3 info: title: users API description: okta users API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/users: get: summary: List all users - description: >- + description: |- Lists users in your org, with pagination in most cases. + A subset of users can be returned that match a supported filter expression or search criteria. Different results are returned depending on specified queries in the request. - A subset of users can be returned that match a supported filter - expression or search criteria. Different results are returned depending - on specified queries in the request. - - - > **Note:** This operation omits users that have a status of - `DEPROVISIONED` in the response. To return all users, use a filter or - search query instead. + > **Notes:** + > * This operation omits users that have a status of `DEPROVISIONED` in the response. To return all users, use a filter or search query instead. + > * The `search` parameter results are sourced from an eventually consistent datasource and may not reflect the latest information. operationId: listUsers parameters: - $ref: '#/components/parameters/OktaResponse' - name: search in: query - description: >- - Searches for users with a supported filtering expression for most - properties. Okta recommends using this parameter for optimal search - performance. - + description: |- + Searches for users with a supported filtering expression for most properties. Okta recommends this query parameter because it provides the largest range of search options and optimal performance. - > **Note:** Using an overly complex or long search query can result - in an error. + > **Note:** Using an overly complex or long search query can result in an error. + This operation supports [pagination](https://developer.okta.com/docs/api/#pagination). Use an ID lookup for records that you update to ensure your results contain the latest data. Returned users include those with the `DEPROVISIONED` status. - This operation supports - [pagination](https://developer.okta.com/docs/api/#pagination). Use - an ID lookup for records that you update to ensure your results - contain the latest data. Returned users include those with the - `DEPROVISIONED` status. + Property names in the search parameter are case sensitive, whereas operators (`eq`, `sw`, and so on) and string values are case insensitive. Unlike with user logins, diacritical marks are significant in search string values: a search for `isaac.brock` finds `Isaac.Brock`, but doesn't find a property whose value is `isáàc.bröck`. + This operation requires [URL encoding](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding). See [Special characters](https://developer.okta.com/docs/api/#special-characters). - Property names in the search parameter are case sensitive, whereas - operators (`eq`, `sw`, and so on) and string values are case - insensitive. Unlike with user logins, diacritical marks are - significant in search string values: a search for `isaac.brock` - finds `Isaac.Brock`, but doesn't find a property whose value is - `isáàc.bröck`. + This operation searches many properties: + * Any user profile attribute, including custom-defined attributes + * The top-level properties: `id`, `status`, `created`, `activated`, `statusChanged`, and `lastUpdated` + * The [user type](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/#tag/UserType/operation/updateUserType) accessed as `type.id` + * Properties that have array values + > **Note:** The ability to search by user classification is available as an [Early Access](https://developer.okta.com/docs/api/openapi/okta-management/guides/release-lifecycle/#early-access-ea) feature. The `classification.type` property cannot be used in conjunction with other search terms. You can search using `classification.type eq "LITE"` or `classification.type eq "STANDARD"`. - This operation requires [URL - encoding](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding). - For example, `search=profile.department eq "Engineering"` is encoded - as `search=profile.department%20eq%20%22Engineering%22`. If you use - the special character `"` within a quoted string, it must also be - escaped `\` and encoded. For example, `search=profile.lastName eq - "bob"smith"` is encoded as - `search=profile.lastName%20eq%20%22bob%5C%22smith%22`. See [Special - Characters](https://developer.okta.com/docs/api/#special-characters). + You can also use `sortBy` and `sortOrder` parameters. The `ne` (not equal) operator isn't supported, but you can obtain the same result by using `lt ... or ... gt`. For example, to see all users except those that have a status of `STAGED`, use `(status lt "STAGED" or status gt "STAGED")`. + You can search properties that are arrays. If any element matches the search term, the entire array (object) is returned. Okta follows the [SCIM Protocol Specification](https://tools.ietf.org/html/rfc7644#section-3.4.2.2) for searching arrays. You can search multiple arrays, multiple values in an array, as well as using the standard logical and filtering operators. See [Filter](https://developer.okta.com/docs/reference/core-okta-api/#filter). - This operation searches many properties: - * Any user profile attribute, including custom-defined attributes - * The top-level properties: `id`, `status`, `created`, `activated`, `statusChanged`, and `lastUpdated` - * The [user type](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/#tag/UserType/operation/updateUserType) accessed as `type.id` - - > **Note:** The ability to - search by user classification is available as an [Early - Access](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/guides/release-lifecycle/#early-access-ea) - feature. The `classification.type` property cannot be used in - conjunction with other search terms. You can search using - `classification.type eq "LITE"` or `classification.type eq - "STANDARD"`. - - - You can also use `sortBy` and `sortOrder` parameters. The `ne` (not - equal) operator isn't supported, but you can obtain the same result - by using `lt ... or ... gt`. For example, to see all users except - those that have a status of `STAGED`, use `(status lt "STAGED" or - status gt "STAGED")`. - - - You can search properties that are arrays. If any element matches - the search term, the entire array (object) is returned. Okta follows - the [SCIM Protocol - Specification](https://tools.ietf.org/html/rfc7644#section-3.4.2.2) - for searching arrays. You can search multiple arrays, multiple - values in an array, as well as using the standard logical and - filtering operators. See - [Filter](https://developer.okta.com/docs/reference/core-okta-api/#filter). - - - Searches for users can be filtered by the following operators: `sw`, - `eq`, and `co`. You can only use `co` with these select user profile - attributes: `profile.firstName`, `profile.lastName`, - `profile.email`, and `profile.login`. See - [Operators](https://developer.okta.com/docs/api/#operators). + Searches for users can be filtered by the following operators: `sw`, `eq`, and `co`. You can only use `co` with these select user profile attributes: `profile.firstName`, `profile.lastName`, `profile.email`, and `profile.login`. See [Operators](https://developer.okta.com/docs/api/#operators). schema: type: string examples: searchByStatus: - value: status%20eq%20%22STAGED%22 + value: status eq "STAGED" summary: Search for a specific status description: Search for users that have a status of STAGED searchByLastUpdatedAfterDate: - value: lastUpdated%20gt%20%222014-01-01T00%3A00%3A00.000Z%22 + value: lastUpdated gt "2014-01-01T00:00:00.000Z" summary: Search after a specific time - description: >- - Search for users that were last updated after a specific - timestamp + description: Search for users that were last updated after a specific timestamp searchById: - value: id%20eq%20%2200u1ero7vZFVEIYLWPBN%22 + value: id eq "00u1ero7vZFVEIYLWPBN" summary: Search for a specific ID - description: Search for users with the specified ID (00gak46y5hydV6NdM0g4) + description: Search for users with the specified ID (00u1ero7vZFVEIYLWPBN) searchByProfileDepartmentCreatedAndStatus: - value: >- - profile.department%20eq%20%22Engineering%22%20and%20%28created%20lt%20%222014-01-01T00%3A00%3A00.000Z%22%20or%20status%20eq%20%22ACTIVE%22%29 + value: profile.department eq "Engineering" and (created lt "2014-01-01T00:00:00.000Z" or status eq "ACTIVE") summary: Search with multiple criteria - description: >- - Search for users in the department of Engineering who were - created before 01/01/2014 or have a status of ACTIVE + description: Search for users in the department of Engineering who were created before 01/01/2014 or have a status of ACTIVE searchArrayAttributes: - value: profile.arrayAttr%20eq%20%22arrayAttrVal1%22 + value: profile.arrayAttr eq "arrayAttrVal1" summary: Search for property arrays - description: >- - Searches for properties that are arrays. In this example, if a - user has a custom user profile attribute "arrayAttr" that - contains values ["arrayAttrVal1", "arrayAttrVal2"...], then this - user is returned. + description: Searches for properties that are arrays. In this example, if a user has a custom user profile attribute "arrayAttr" that contains values ["arrayAttrVal1", "arrayAttrVal2"...], then this user is returned. searchArrayAttributesLiteUser: value: classification.type eq "LITE" summary: Search by classification - description: >- - Searches for users with the classification type LITE. Supported - values: STANDARD or LITE. + description: 'Searches for users with the classification type LITE. Supported values: STANDARD or LITE.' - name: filter in: query - description: >- - Filters users with a supported expression for a subset of - properties. - - - > **Note:** Returned users include those with the `DEPROVISIONED` - status. - - - This requires [URL - encoding](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding). - For example, `filter=lastUpdated gt "2013-06-01T00:00:00.000Z"` is - encoded as - `filter=lastUpdated%20gt%20%222013-06-01T00:00:00.000Z%22`. - Filtering is case-sensitive for property names and query values, - while operators are case-insensitive. + description: |- + Filters users with a supported expression for a subset of properties. + > **Note:** Returned users include those with the `DEPROVISIONED` status. - Filtering supports the following limited number of properties: - `status`, `lastUpdated`, `id`, `profile.login`, `profile.email`, - `profile.firstName`, and `profile.lastName`. + This requires [URL encoding](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding). For example, `filter=lastUpdated gt "2013-06-01T00:00:00.000Z"` is encoded as `filter=lastUpdated%20gt%20%222013-06-01T00:00:00.000Z%22`. Filtering is case-sensitive for property names and query values, while operators are case-insensitive. + Filtering supports the following limited number of properties: `status`, `lastUpdated`, `id`, `profile.login`, `profile.email`, `profile.firstName`, and `profile.lastName`. - Additionally, filtering supports only the equal `eq` operator from - the standard Okta API filtering semantics, except in the case of the - `lastUpdated` property. This property can also use the inequality - operators (`gt`, `ge`, `lt`, and `le`). For logical operators, only - the logical operators `and` and `or` are supported. The `not` - operator isn't supported. See - [Filter](https://developer.okta.com/docs/api/#filter) and - [Operators](https://developer.okta.com/docs/api/#operators). + Additionally, filtering supports only the equal `eq` operator from the standard Okta API filtering semantics, except in the case of the `lastUpdated` property. This property can also use the inequality operators (`gt`, `ge`, `lt`, and `le`). For logical operators, only the logical operators `and` and `or` are supported. The `not` operator isn't supported. See [Filter](https://developer.okta.com/docs/api/#filter) and [Operators](https://developer.okta.com/docs/api/#operators). schema: type: string examples: filterByStatus: - value: status%20eq%20%22LOCKED_OUT%22 + value: status eq "LOCKED_OUT" summary: Filter by status description: Filter users with a status of LOCKED_OUT filterByLogin: - value: profile.login%20eq%20%22login%40example.com%22 + value: profile.login eq "login@example.com" summary: Filter by login description: Filter users with a specified login filterByDateRange: - value: >- - lastUpdated%20gt%20%222013-06-01T00%3A00%3A00.000Z%22%20and%20lastUpdated%20lt%20%222014-01-01T00%3A00%3A00.000Z%22 + value: lastUpdated gt "2013-06-01T00:00:00.000Z" and lastUpdated lt "2014-01-01T00:00:00.000Z" summary: Filter by date range description: Filter users updated after 06/01/2013 but before 01/01/2014 filterByTypeAndProfileLastUpdatedAfterDate: - value: >- - lastUpdated%20gt%20%222013-06-01T00%3A00%3A00.000Z%22%20and%20%28status%20eq%20%22LOCKED_OUT%22%20or%20status%20eq%20%22RECOVERY%22%29 + value: lastUpdated gt "2013-06-01T00:00:00.000Z" and (status eq "LOCKED_OUT" or status eq "RECOVERY") summary: Filter by multiple criteria - description: >- - Filter users updated after 06/01/2013 but with a status of - LOCKED_OUT or RECOVERY + description: Filter users updated after 06/01/2013 but with a status of LOCKED_OUT or RECOVERY - name: q in: query - description: >- - Finds users who match the specified query. This doesn't support - pagination. - - - > **Note:** For optimal performance, use the `search` parameter - instead. - - - Use the `q` parameter for simple queries, such as a lookup of users - by name when creating a people picker. - - - The value of `q` is matched against `firstName`, `lastName`, or - `email`. This performs a `startsWith` match, but this is an - implementation detail and can change without notice. You don't need - to specify `firstName`, `lastName`, or `email`. + description: |- + Finds users who match the specified query. Use the `q` parameter for simple queries, such as a lookup of users by name when creating a people picker. + The value of `q` is matched against `firstName`, `lastName`, or `email`. This performs a `startsWith` match, but this is an implementation detail and can change without notice. You don't need to specify `firstName`, `lastName`, or `email`. - > **Note:** Using the `q` parameter in a request omits users that - have a status of `DEPROVISIONED`. To return all users, use a filter - or search query instead. + > **Notes:** + > * Using the `q` parameter in a request omits users that have a status of `DEPROVISIONED`. To return all users, use a `filter` or `search` query instead. + > * This doesn't support pagination, but you can use `limit`. + > * This isn't designed for large data sets. For optimal performance, use the `search` parameter instead. schema: type: string - $ref: '#/components/parameters/queryAfter' - name: limit in: query - description: >- - Specifies the number of results returned. Defaults to 10 if `q` is - provided. + description: |- + Specifies the number of results returned. Defaults to 10 if `q` is provided. + + You can use `limit` with `after` to define the cursor location in the data set and manage the user records per page. schema: type: integer format: int32 default: 200 - name: sortBy in: query - description: >- - Specifies field to sort by (for search queries only). This can be - any single property, for example `sortBy=profile.lastName`. Users - with the same value for the `sortBy` property will be ordered by - `id`. + description: Specifies the field to sort by (for search queries only). This can be any single property, for example `sortBy=profile.lastName`. Users with the same value for the `sortBy` property are ordered by `id`. Use with `sortOrder` to control the order of results. schema: type: string - - name: sortOrder + - $ref: '#/components/parameters/querySortOrder' + - name: fields in: query - description: >- - Specifies the sort order: `asc` or `desc` (for search queries only). - Sorting is done in ASCII sort order (that is, by ASCII character - value), but isn't case sensitive. `sortOrder` is ignored if `sortBy` - isn't present. + description: |- + Specifies a select set of user properties to query. Any other properties will be filtered out of the returned users. This is often called field projections in APIs, which can reduce payload size, improve performance, and limit unneccessary data exposure. + + Requested fields should be comma-separated. Comma-separate the fields and place sub-fields in the profile object inside a `profile:()` directive, for example `profile:(firstName, city)`. The `id` field is always included, regardless of whether it's specified in the `fields` parameter. schema: type: string + examples: + filterByProperties: + value: id,status,profile:(firstName,lastName,city) + summary: Request a subset of user fields + description: 'Returned users should only show the following properties: id, status, profile.firstName, profile.lastName, profile.city' - name: expand in: query - description: >- - A parameter to - include metadata in the `_embedded` property. Supported value: - `classification`. + description: 'A parameter to include metadata in the `_embedded` property. Supported value: `classification`.' required: false schema: type: string @@ -265,12 +162,18 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/User' + $ref: '#/components/schemas/ListUsersResponse' examples: - UserList: - $ref: '#/components/examples/ListRealmAwareUsersResponse' + ListUsers: + $ref: '#/components/examples/ListUsersResponse' + UsersProjections: + $ref: '#/components/examples/ListUsersFieldsResponse' + UsersSearch: + $ref: '#/components/examples/ListUsersSearchResponse' + UsersQ: + $ref: '#/components/examples/ListUsersQResponse' + UsersFilter: + $ref: '#/components/examples/ListUsersFilterResponse' '403': description: Forbidden content: @@ -291,83 +194,43 @@ paths: isGenerallyAvailable: true post: summary: Create a user - description: >- + description: |- Creates a new user in your Okta org with or without credentials.
- > **Legal Disclaimer** - > + > After a user is added to the Okta directory, they receive an activation email. As part of signing up for this service, + > you agreed not to use Okta's service/product to spam and/or send unsolicited messages. + > Please refrain from adding unrelated accounts to the directory as Okta is not responsible for, and disclaims any and all + > liability associated with, the activation email's content. You, and you alone, bear responsibility for the emails sent to any recipients. - > After a user is added to the Okta directory, they receive an - activation email. As part of signing up for this service, + All responses return the created user. Activation of a user is an asynchronous operation. The system performs group reconciliation during activation and assigns the user to all apps via direct or indirect relationships (group memberships). + * The user's `transitioningToStatus` property is `ACTIVE` during activation to indicate that the user hasn't completed the asynchronous operation. + * The user's `status` is `ACTIVE` when the activation process is complete. - > you agreed not to use Okta's service/product to spam and/or send - unsolicited messages. + The user is emailed a one-time activation token if activated without a password. - > Please refrain from adding unrelated accounts to the directory as Okta - is not responsible for, and disclaims any and all + > **Note:** If the user is assigned to an app that is configured for provisioning, the activation process triggers downstream provisioning to the app. It is possible for a user to sign in before these apps have been successfully provisioned for the user. - > liability associated with, the activation email's content. You, and - you alone, bear responsibility for the emails sent to any recipients. + > **Important:** Do not generate or send a one-time activation token when activating users with an assigned password. Users should sign in with their assigned password. - - All responses return the created user. Activation of a user is an - asynchronous operation. The system performs group reconciliation during - activation and assigns the user to all apps via direct or indirect - relationships (group memberships). - - * The user's `transitioningToStatus` property is `ACTIVE` during - activation to indicate that the user hasn't completed the asynchronous - operation. - - * The user's `status` is `ACTIVE` when the activation process is - complete. - - - The user is emailed a one-time activation token if activated without a - password. - - - > **Note:** If the user is assigned to an app that is configured for - provisioning, the activation process triggers downstream provisioning to - the app. It is possible for a user to sign in before these apps have - been successfully provisioned for the user. - - - > **Important:** Do not generate or send a one-time activation token - when activating users with an assigned password. Users should sign in - with their assigned password. - - - For more information about the various scenarios of creating a user - listed in the examples, see the [User creation - scenarios](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#user-creation-scenarios) - section. + For more information about the various scenarios of creating a user listed in the examples, see the [User creation scenarios](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/user/section/user-status#section/User-creation-scenarios) section. operationId: createUser parameters: - name: activate in: query - description: >- - Executes an [activation - lifecycle](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserLifecycle/#tag/UserLifecycle/operation/activateUser) - operation when creating the user + description: Executes an [activation lifecycle](https://developer.okta.com/docs/api/openapi/okta-management/management/userlifecycle/activateuser) operation when creating the user schema: - type: boolean - default: true + type: string + default: 'true' - name: provider in: query - description: >- - Indicates whether to create a user with a specified authentication - provider + description: Indicates whether to create a user with a specified authentication provider. schema: - type: boolean - default: false + type: string + default: 'false' - name: nextLogin in: query - description: >- - With `activate=true`, if `nextLogin=changePassword`, a user is - created, activated, and the password is set to `EXPIRED`. The user - must change it the next time they sign in. + description: With `activate=true`, if `nextLogin=changePassword`, a user is created, activated, and the password is set to `EXPIRED`. The user must change it the next time they sign in. schema: $ref: '#/components/schemas/UserNextLogin' x-okta-added-version: 0.14.0 @@ -381,27 +244,21 @@ paths: Create user without credentials: $ref: '#/components/examples/create-user-without-credentials-request' Create user with recovery question: - $ref: >- - #/components/examples/create-user-with-recovery-question-request + $ref: '#/components/examples/create-user-with-recovery-question-request' Create user with password: $ref: '#/components/examples/create-user-with-password-request' Create user with imported hashed password: - $ref: >- - #/components/examples/create-user-with-imported-hashed-password-request + $ref: '#/components/examples/create-user-with-imported-hashed-password-request' Create user with password import inline hook: - $ref: >- - #/components/examples/create-user-with-password-import-inline-hook-request + $ref: '#/components/examples/create-user-with-password-import-inline-hook-request' Create user with password and recovery question: - $ref: >- - #/components/examples/create-user-with-password-and-recovery-question-request + $ref: '#/components/examples/create-user-with-password-and-recovery-question-request' Create user with authentication provider: - $ref: >- - #/components/examples/create-user-with-authentication-provider-request + $ref: '#/components/examples/create-user-with-authentication-provider-request' Create user in group: $ref: '#/components/examples/create-user-in-group-request' Create user with non-default user type: - $ref: >- - #/components/examples/create-user-with-non-default-user-type-request + $ref: '#/components/examples/create-user-with-non-default-user-type-request' required: true responses: '200': @@ -412,30 +269,23 @@ paths: $ref: '#/components/schemas/User' examples: Create user without credentials: - $ref: >- - #/components/examples/create-user-without-credentials-response + $ref: '#/components/examples/create-user-without-credentials-response' Create user with recovery question: - $ref: >- - #/components/examples/create-user-with-recovery-question-response + $ref: '#/components/examples/create-user-with-recovery-question-response' Create user with password: $ref: '#/components/examples/create-user-with-password-response' Create user with imported hashed password: - $ref: >- - #/components/examples/create-user-with-imported-hashed-password-response + $ref: '#/components/examples/create-user-with-imported-hashed-password-response' Create user with password import inline hook: - $ref: >- - #/components/examples/create-user-with-password-import-inline-hook-response + $ref: '#/components/examples/create-user-with-password-import-inline-hook-response' Create user with password and recovery question: - $ref: >- - #/components/examples/create-user-with-password-and-recovery-question-response + $ref: '#/components/examples/create-user-with-password-and-recovery-question-response' Create user with authentication provider: - $ref: >- - #/components/examples/create-user-with-authentication-provider-response + $ref: '#/components/examples/create-user-with-authentication-provider-response' Create user in group: $ref: '#/components/examples/create-user-in-group-response' Create user with non-default user type: - $ref: >- - #/components/examples/create-user-with-non-default-user-type-response + $ref: '#/components/examples/create-user-with-non-default-user-type-response' '400': description: Bad Request content: @@ -444,14 +294,11 @@ paths: $ref: '#/components/schemas/Error' examples: Create user with too many groups specified: - $ref: >- - #/components/examples/ErrorCreateUserWithTooManyManyGroupsResponse + $ref: '#/components/examples/ErrorCreateUserWithTooManyManyGroupsResponse' Create user with expired password and activate set to `false`: - $ref: >- - #/components/examples/ErrorCreateUserWithExpiredPasswordWithoutActivation + $ref: '#/components/examples/ErrorCreateUserWithExpiredPasswordWithoutActivation' Create user with expired password and `null` password: - $ref: >- - #/components/examples/ErrorCreateUserWithExpiredPasswordWithNullPassword + $ref: '#/components/examples/ErrorCreateUserWithExpiredPasswordWithNullPassword' '403': description: Forbidden content: @@ -470,79 +317,30 @@ paths: isCorsEnabled: true lifecycle: GA isGenerallyAvailable: true - /api/v1/users/me/lifecycle/delete_sessions: - post: - summary: End a current user session - description: >- - Ends Okta sessions for the currently signed in user. By default, the - current session remains active. Use this method in a browser-based app. - - > **Note:** This operation requires a session cookie for the user. The - API token isn't allowed for this operation. - operationId: endUserSessions - requestBody: - content: - application/json: - schema: - $ref: '#/components/schemas/KeepCurrent' - responses: - '200': - description: OK - content: {} - '403': - $ref: '#/components/responses/ErrorAccessDenied403' - '404': - $ref: '#/components/responses/ErrorResourceNotFound404' - '429': - $ref: '#/components/responses/ErrorTooManyRequests429' - security: - - apiToken: [] - - oauth2: [] - tags: - - UserSessions - x-okta-lifecycle: - isCorsEnabled: true - lifecycle: GA - isGenerallyAvailable: true /api/v1/users/{id}: get: summary: Retrieve a user - description: >- + description: |- Retrieves a user from your Okta org. - - You can substitute `me` for the `id` to fetch the current user linked to - an API token or session cookie. + You can substitute `me` for the `id` to fetch the current user linked to an API token or session cookie. * The request returns the user linked to the API token that is specified in the Authorization header, not the user linked to the active session. Details of the admin user who granted the API token is returned. * When the end user has an active Okta session, it is typically a CORS request from the browser. Therefore, it's possible to retrieve the current user without the Authorization header. - When fetching a user by `login` or `login shortname`, [URL - encode](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding) - the request parameter to ensure that special characters are escaped - properly. Logins with a `/` character can only be fetched by `id` due to - URL issues with escaping the `/` character. If you don't know a user's - ID, you can use the [List all - users](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#tag/User/operation/listUsers) - endpoint to find it. + When fetching a user by `login` or `login shortname`, [URL encode](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding) the request parameter to ensure that special characters are escaped properly. Logins with a `/` character can only be fetched by `id` due to URL issues with escaping the `/` character. If you don't know a user's ID, you can use the [List all users](https://developer.okta.com/docs/api/openapi/okta-management/management/user/listusers) endpoint to find it. - - > **Note:** Some browsers block third-party cookies by default, which - disrupts Okta functionality in certain flows. See [Mitigate the impact - of third-party cookie - deprecation](https://help.okta.com/okta_help.htm?type=oie&id=ext-third-party-cookies). + > **Note:** Some browsers block third-party cookies by default, which disrupts Okta functionality in certain flows. See [Mitigate the impact of third-party cookie deprecation](https://help.okta.com/okta_help.htm?type=oie&id=ext-third-party-cookies). operationId: getUser parameters: - $ref: '#/components/parameters/OktaResponse' - $ref: '#/components/parameters/queryUserExpand' + - $ref: '#/components/parameters/pathId' responses: '200': description: Success headers: Etag: - description: >- - An HTTP entity tag (`ETag`) is an identifier for a specific - version of a resource. See [Conditional Requests and Entity - Tags]https://developer.okta.com/docs/api#conditional-requests-and-entity-tags. + description: An HTTP entity tag (`ETag`) is an identifier for a specific version of a resource. See [Conditional Requests and Entity Tags]https://developer.okta.com/docs/api#conditional-requests-and-entity-tags. schema: type: string example: W/"1234567890abcdef" @@ -579,63 +377,37 @@ paths: isGenerallyAvailable: true post: summary: Update a user - description: >- + description: |- Updates a user's profile or credentials with partial update semantics. + > **Important:** Use the `POST` method for partial updates. Unspecified properties are set to null with `PUT`. - > **Important:** Use the `POST` method for partial updates. Unspecified - properties are set to null with `PUT`. - - - `profile` and `credentials` can be updated independently or together - with a single request. - - > **Note**: Currently, the user type of a user can only be changed via a - full replacement PUT operation. If the request parameters of a partial - update include the type element from the user object, - - the value must match the existing type of the user. Only admins are - permitted to change the user type of a user; end users are not allowed - to change their own user type. - - - > **Note**: To update a current user's profile with partial semantics, - the `/api/v1/users/me` endpoint can be invoked. + `profile` and `credentials` can be updated independently or together with a single request. + > **Notes:** + > * Currently, the user type of a user can only be changed using a full replacement `PUT` operation. If the request parameters of a partial update include the `type` element from the user object, + the value must match the existing type of the user. Only admins are permitted to change the user type of a user; end users are not allowed to change their own user type. + > + > * To update a current user's profile with partial semantics, you can use the `/api/v1/users/me` endpoint. But, a user can only update profile properties that they have write access for. Within the profile, if the user tries to update the primary or the secondary email IDs, verification emails are sent to those email IDs, and the fields are updated only upon verification. > + > * You can update user profiles of users in the `DEPROVISIONED` status if you have the **Edit Deactivated User Profile Updates** option turned on in the Admin Console. See [deactivated user profiles](https://help.okta.com/okta_help.htm?type=oie&id=edit-deactivated-users). - > A user can only update profile properties for which the user has write - access. Within the profile, if the user tries to update the primary or - the secondary email IDs, verification emails are sent to those email - IDs, and the fields are updated only upon verification. - - - If you are using this endpoint to set a password, it sets a password - without validating existing user credentials. This is an administrative - operation. For operations that validate credentials, refer to the [Reset - password](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserCred/#tag/UserCred/operation/resetPassword), - [Start forgot password - flow](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserCred/#tag/UserCred/operation/forgotPassword), - and [Update - password](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserCred/#tag/UserCred/operation/changePassword) - endpoints. + If you are using this endpoint to set a password, it sets a password without validating existing user credentials. This is an administrative operation. For operations that validate credentials, refer to the [Reset password](https://developer.okta.com/docs/api/openapi/okta-management/management/usercred/resetpassword), [Start forgot password flow](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserCred/#tag/UserCred/operation/forgotPassword), and [Update password](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserCred/#tag/UserCred/operation/changePassword) endpoints. operationId: updateUser parameters: - name: strict in: query schema: - type: boolean + type: string description: If true, validates against minimum age and history password policy - name: If-Match in: header required: false - description: >- - The ETag value of the user's expected current state. This becomes a - conditional request used for concurrency control. See [Conditional - Requests and Entity Tags]https://developer.okta.com/docs/api#conditional-requests-and-entity-tags. + description: The ETag value of the user's expected current state. This becomes a conditional request used for concurrency control. See [Conditional Requests and Entity Tags]https://developer.okta.com/docs/api#conditional-requests-and-entity-tags. schema: type: string example: W/"1234567890abcdef" + - $ref: '#/components/parameters/pathId' x-codegen-request-body-name: user requestBody: content: @@ -648,8 +420,7 @@ paths: Update user password: $ref: '#/components/examples/update-user-set-password-request' Set recovery question and answer: - $ref: >- - #/components/examples/update-user-set-recovery-question-and-answer + $ref: '#/components/examples/update-user-set-recovery-question-and-answer' required: true responses: '200': @@ -693,15 +464,10 @@ paths: isGenerallyAvailable: true put: summary: Replace a user - description: >- - Replaces a user's profile, credentials, or both using strict-update - semantics. - - - All profile properties must be specified when updating a user's profile - with a `PUT` method. Any property not specified in the request is - deleted. + description: |- + Replaces a user's profile, credentials, or both using strict-update semantics. + All profile properties must be specified when updating a user's profile with a `PUT` method. Any property not specified in the request is deleted. > **Important:** Don't use a `PUT` method for partial updates. operationId: replaceUser parameters: @@ -709,18 +475,16 @@ paths: in: query description: If `true`, validates against minimum age and history password policy schema: - type: boolean + type: string x-okta-added-version: 1.10.0 - name: If-Match in: header required: false - description: >- - The ETag value of the user's expected current state. This becomes a - conditional request used for concurrency control. See [Conditional - Requests and Entity Tags]https://developer.okta.com/docs/api#conditional-requests-and-entity-tags. + description: The ETag value of the user's expected current state. This becomes a conditional request used for concurrency control. See [Conditional Requests and Entity Tags]https://developer.okta.com/docs/api#conditional-requests-and-entity-tags. schema: type: string example: W/"1234567890abcdef" + - $ref: '#/components/parameters/pathId' x-codegen-request-body-name: user requestBody: content: @@ -773,35 +537,24 @@ paths: isGenerallyAvailable: true delete: summary: Delete a user - description: >- - Deletes a user permanently. This operation can only be performed on - users that have a `DEPROVISIONED` status. - + description: |- + Deletes a user permanently. This operation can only be performed on users that have a `DEPROVISIONED` status. > **Warning:** This action can't be recovered! + This operation on a user that hasn't been deactivated causes that user to be deactivated. A second delete operation is required to delete the user. - This operation on a user that hasn't been deactivated causes that user - to be deactivated. A second delete operation is required to delete the - user. - + > **Note:** You can also perform user deletion asynchronously. To invoke asynchronous user deletion, pass an HTTP header `Prefer: respond-async` with the request. - > **Note:** You can also perform user deletion asynchronously. To invoke - asynchronous user deletion, pass an HTTP header `Prefer: respond-async` - with the request. - - - This header is also supported by user deactivation, which is performed - if the delete endpoint is invoked on a user that hasn't been - deactivated. + This header is also supported by user deactivation, which is performed if the delete endpoint is invoked on a user that hasn't been deactivated. operationId: deleteUser parameters: - name: sendEmail in: query description: Sends a deactivation email to the admin if `true` schema: - type: boolean - default: false + type: string + default: 'false' x-okta-added-version: 1.5.0 - name: Prefer in: header @@ -810,6 +563,7 @@ paths: type: string enum: - respond-async + - $ref: '#/components/parameters/pathId' responses: '204': description: No Content @@ -844,19 +598,13 @@ paths: isCorsEnabled: true lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathId' /api/v1/users/{id}/appLinks: get: summary: List all assigned app links - description: >- - Lists all app links for all direct or indirect (through group - membership) assigned apps. - + description: |- + Lists all app links for all direct or indirect (through group membership) assigned apps - > **Note:** To list all apps in an org, use the [List all applications - endpoint in the Applications - API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Application/#tag/Application/operation/listApplications). + > **Note:** To list all apps in an org, use the [List all applications endpoint in the Applications API](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/application/other/listapplications). operationId: listAppLinks responses: '200': @@ -864,9 +612,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/AssignedAppLink' + $ref: '#/components/schemas/ListAppLinksResponse' examples: List App Links: $ref: '#/components/examples/ListAppLinks' @@ -886,14 +632,12 @@ paths: isCorsEnabled: true lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathId' + parameters: + - $ref: '#/components/parameters/pathId' /api/v1/users/{id}/blocks: get: summary: List all user blocks - description: >- - Lists information about how the user is blocked from accessing their - account + description: Lists information about how the user is blocked from accessing their account operationId: listUserBlocks responses: '200': @@ -901,9 +645,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/UserBlock' + $ref: '#/components/schemas/ListUserBlocksResponse' examples: BlocksUnknownDevices: $ref: '#/components/examples/ListUserBlocksUnknownDevicesResponse' @@ -925,17 +667,14 @@ paths: isCorsEnabled: true lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathId' + parameters: + - $ref: '#/components/parameters/pathId' /api/v1/users/{id}/groups: get: summary: List all groups - description: >- - Lists all groups of which the user is a member. - - > **Note:** To list all groups in your org, use the [List all groups - endpoints in the Groups - API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Group/#tag/Group/operation/listGroups). + description: |- + Lists all groups of which the user is a member + > **Note:** To list all groups in your org, use the [List all groups endpoints in the Groups API](https://developer.okta.com/docs/api/openapi/okta-management/management/group/listgroups). operationId: listUserGroups responses: '200': @@ -943,9 +682,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/Group' + $ref: '#/components/schemas/ListUserGroupsResponse' examples: List user groups: $ref: '#/components/examples/ListUserGroups' @@ -965,8 +702,8 @@ paths: isCorsEnabled: true lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathId' + parameters: + - $ref: '#/components/parameters/pathId' /api/v1/users/{id}/idps: get: summary: List all IdPs for user @@ -978,9 +715,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/IdentityProvider' + $ref: '#/components/schemas/ListUserIdentityProvidersResponse' examples: MultipleIdPsResponse: $ref: '#/components/examples/MultipleIdPsResponse' @@ -999,60 +734,31 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathId' + parameters: + - $ref: '#/components/parameters/pathId' /api/v1/users/{id}/lifecycle/activate: post: summary: Activate a user - description: >- + description: |- Activates a user. - - Perform this operation only on users with a `STAGED` or `DEPROVISIONED` - status. Activation of a user is an asynchronous operation. - - * The user has the `transitioningToStatus` property with an `ACTIVE` - value during activation. This indicates that the user hasn't completed - the asynchronous operation. - + Perform this operation only on users with a `STAGED` or `DEPROVISIONED` status. Activation of a user is an asynchronous operation. + * The user has the `transitioningToStatus` property with an `ACTIVE` value during activation. This indicates that the user hasn't completed the asynchronous operation. * The user has an `ACTIVE` status when the activation process completes. + Users who don't have a password must complete the welcome flow by visiting the activation link to complete the transition to `ACTIVE` status. - Users who don't have a password must complete the welcome flow by - visiting the activation link to complete the transition to `ACTIVE` - status. - - - > **Note:** If you want to send a branded user activation email, change - the subdomain of your request to the custom domain that's associated - with the brand. - - > For example, change `subdomain.okta.com` to `custom.domain.one`. See - [Multibrand and custom - domains](https://developer.okta.com/docs/concepts/brands/#multibrand-and-custom-domains). - - - > **Note:** If you have optional password enabled, visiting the - activation link is optional for users who aren't required to enroll a - password. - - > See [Create user with optional - password](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#create-user-with-optional-password). + > **Note:** If you want to send a branded user activation email, change the subdomain of your request to the custom domain that's associated with the brand. + > For example, change `subdomain.okta.com` to `custom.domain.one`. See [Multibrand and custom domains](https://developer.okta.com/docs/concepts/brands/#multibrand-and-custom-domains). + > **Note:** If you have optional password enabled, visiting the activation link is optional for users who aren't required to enroll a password. + > See [Create user with optional password](https://developer.okta.com/docs/api/openapi/okta-management/management/user/create-user-with-optional-password#user/Create-user-with-optional-password). > **Legal disclaimer** - - > After a user is added to the Okta directory, they receive an - activation email. As part of signing up for this service, - - > you agreed not to use Okta's service/product to spam and/or send - unsolicited messages. - - > Please refrain from adding unrelated accounts to the directory as Okta - is not responsible for, and disclaims any and all - - > liability associated with, the activation email's content. You, and - you alone, bear responsibility for the emails sent to any recipients. + > After a user is added to the Okta directory, they receive an activation email. As part of signing up for this service, + > you agreed not to use Okta's service/product to spam and/or send unsolicited messages. + > Please refrain from adding unrelated accounts to the directory as Okta is not responsible for, and disclaims any and all + > liability associated with, the activation email's content. You, and you alone, bear responsibility for the emails sent to any recipients. operationId: activateUser parameters: - name: sendEmail @@ -1060,15 +766,12 @@ paths: description: Sends an activation email to the user if `true` required: false schema: - type: boolean - default: true + type: string + default: 'true' + - $ref: '#/components/parameters/pathId' responses: '200': description: Success - content: - application/json: - schema: - $ref: '#/components/schemas/UserActivationToken' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -1085,44 +788,30 @@ paths: isCorsEnabled: true lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathId' /api/v1/users/{id}/lifecycle/deactivate: post: summary: Deactivate a user - description: >- + description: |- Deactivates a user. + Perform this operation only on users that do not have a `DEPROVISIONED` status. + * The user's `transitioningToStatus` property is `DEPROVISIONED` during deactivation to indicate that the user hasn't completed the asynchronous operation. + * The user's status is `DEPROVISIONED` when the deactivation process is complete. - Perform this operation only on users that do not have a `DEPROVISIONED` - status. - - * The user's `transitioningToStatus` property is `DEPROVISIONED` during - deactivation to indicate that the user hasn't completed the asynchronous - operation. - - * The user's status is `DEPROVISIONED` when the deactivation process is - complete. - - - > **Important:** Deactivating a user is a **destructive** operation. The - user is deprovisioned from all assigned apps, which might destroy their - data such as email or files. - + > **Important:** Deactivating a user is a **destructive** operation. The user is deprovisioned from all assigned apps, which might destroy their data such as email or files. **This action cannot be recovered!** + You can also perform user deactivation asynchronously. To invoke asynchronous user deactivation, pass an HTTP header `Prefer: respond-async` with the request. - You can also perform user deactivation asynchronously. To invoke - asynchronous user deactivation, pass an HTTP header `Prefer: - respond-async` with the request. + > **Note:** Users with the `DEPROVISIONED` status won't have their profiles updated when running the [Update a user](https://developer.okta.com/docs/api/openapi/okta-management/management/user/updateuser) endpoint unless you have the **Edit Deactived User Profile Updates** option turned on in the Admin Console. See [Edit deactivated user profiles](https://help.okta.com/okta_help.htm?type=oie&id=edit-deactivated-users). operationId: deactivateUser parameters: - name: sendEmail in: query description: Sends a deactivation email to the admin if `true` schema: - type: boolean - default: false + type: string + default: 'false' x-okta-added-version: 1.5.0 - name: Prefer in: header @@ -1132,6 +821,7 @@ paths: enum: - respond-async description: Request asynchronous processing + - $ref: '#/components/parameters/pathId' responses: '200': description: OK @@ -1152,33 +842,17 @@ paths: isCorsEnabled: true lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathId' /api/v1/users/{id}/lifecycle/expire_password: post: summary: Expire the password - description: >- - Expires the password. This operation transitions the user status to - `PASSWORD_EXPIRED` so that the user must change their password the next - time that they sign in. - + description: |- + Expires the password. This operation transitions the user status to `PASSWORD_EXPIRED` so that the user must change their password the next time that they sign in.
+ If you have integrated Okta with your on-premises Active Directory (AD), then setting a user's password as expired in Okta also expires the password in AD. + When the user tries to sign in to Okta, delegated authentication finds the password-expired status in AD, + and the user is presented with the password-expired page where they can change their password. - If you have integrated Okta with your on-premises Active Directory (AD), - then setting a user's password as expired in Okta also expires the - password in AD. - - When the user tries to sign in to Okta, delegated authentication finds - the password-expired status in AD, - - and the user is presented with the password-expired page where they can - change their password. - - - > **Note:** The Okta account management policy doesn't support the - `/users/{id}/lifecycle/expire_password` endpoint. See [Configure an Okta - account management - policy](https://developer.okta.com/docs/guides/okta-account-management-policy/main/). + > **Note:** The Okta account management policy doesn't support the `/users/{id}/lifecycle/expire_password` endpoint. See [Configure an Okta account management policy](https://developer.okta.com/docs/guides/okta-account-management-policy/main/). operationId: expirePassword responses: '200': @@ -1206,35 +880,18 @@ paths: isCorsEnabled: true lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathId' + parameters: + - $ref: '#/components/parameters/pathId' /api/v1/users/{id}/lifecycle/expire_password_with_temp_password: post: summary: Expire the password with a temporary password - description: >- - Expires the password and resets the user's password to a temporary - password. This operation transitions the user status to - `PASSWORD_EXPIRED` so that the user must change their password the next - time that they sign in. - - The user's password is reset to a temporary password that's returned, - and then the user's password is expired. - - If `revokeSessions` is included in the request with a value of `true`, - the user's current outstanding sessions are revoked and require - re-authentication. - -
- - If you have integrated Okta with your on-premises Active Directory (AD), - then setting a user's password as expired in Okta also expires the - password in AD. - - When the user tries to sign in to Okta, delegated authentication finds - the password-expired status in AD, + description: |- + Expires the password and resets the user's password to a temporary password. This operation transitions the user status to `PASSWORD_EXPIRED` so that the user must change their password the next time that they sign in. + The user's password is reset to a temporary password that's returned, and then the user's password is expired. + If `revokeSessions` is included in the request with a value of `true`, the user's current outstanding sessions are revoked and require re-authentication. - and the user is presented with the password-expired page where they can - change their password. + If you have integrated Okta with your on-premises Active Directory (AD), then setting a user's password as expired in Okta also expires the password in AD. + When the user tries to sign in to Okta, delegated authentication finds the password-expired status in AD, and the user is presented with the password-expired page where they can change their password. operationId: expirePasswordWithTempPassword parameters: - name: revokeSessions @@ -1242,18 +899,12 @@ paths: description: Revokes the user's existing sessions if `true` required: false schema: - type: boolean - default: false + type: string + default: 'false' + - $ref: '#/components/parameters/pathId' responses: '200': description: Success - content: - application/json: - schema: - $ref: '#/components/schemas/User' - examples: - Expire password with temp password response: - $ref: '#/components/examples/ExpirePwdWithTempPwdResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -1270,48 +921,30 @@ paths: isCorsEnabled: true lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathId' /api/v1/users/{id}/lifecycle/reactivate: post: summary: Reactivate a user - description: >- + description: |- Reactivates a user. + Perform this operation only on users with a `PROVISIONED` or `RECOVERY` [status](https://developer.okta.com/docs/api/openapi/okta-management/management/user/listusers#user/listusers/t=response&c=200&path=status). + This operation restarts the activation workflow if for some reason the user activation wasn't completed when using the `activationToken` from [Activate User](https://developer.okta.com/docs/api/openapi/okta-management/management/userlifecycle/activateuser). - Perform this operation only on users with a `PROVISIONED` or `RECOVERY` - [status](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#tag/User/operation/listUsers!c=200&path=status&t=response). - - This operation restarts the activation workflow if for some reason the - user activation wasn't completed when using the `activationToken` from - [Activate - User](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserLifecycle/#tag/UserLifecycle/operation/activateUser). - - - Users that don't have a password must complete the flow by completing - the [Reset - password](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserCred/#tag/UserCred/operation/resetPassword) - flow and MFA enrollment steps to transition the user to `ACTIVE` status. + Users that don't have a password must complete the flow by completing the [Reset password](https://developer.okta.com/docs/api/openapi/okta-management/management/usercred/resetpassword) flow and MFA enrollment steps to transition the user to `ACTIVE` status. - - If `sendEmail` is `false`, returns an activation link for the user to - set up their account. The activation token can be used to create a - custom activation link. + If `sendEmail` is `false`, returns an activation link for the user to set up their account. The activation token can be used to create a custom activation link. operationId: reactivateUser parameters: - name: sendEmail in: query description: Sends an activation email to the user if `true` schema: - type: boolean - default: false + type: string + default: 'false' + - $ref: '#/components/parameters/pathId' responses: '200': description: Success - content: - application/json: - schema: - $ref: '#/components/schemas/UserActivationToken' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -1328,16 +961,10 @@ paths: isCorsEnabled: true lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathId' /api/v1/users/{id}/lifecycle/reset_factors: post: summary: Reset the factors - description: >- - Resets all factors for the specified user. All MFA factor enrollments - return to the unenrolled state. The user's status remains `ACTIVE`. This - link is present only if the user is currently enrolled in one or more - MFA factors. + description: Resets all factors for the specified user. All MFA factor enrollments return to the unenrolled state. The user's status remains `ACTIVE`. This link is present only if the user is currently enrolled in one or more MFA factors. operationId: resetFactors responses: '200': @@ -1359,37 +986,21 @@ paths: isCorsEnabled: true lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathId' + parameters: + - $ref: '#/components/parameters/pathId' /api/v1/users/{id}/lifecycle/reset_password: post: summary: Reset a password - description: >- - Resets a password. Generates a one-time token (OTT) that you can use to - reset a user's password. You can automatically email the OTT link to the - user or return the OTT to the API caller and distribute using a custom - flow. - - - This operation transitions the user to the `RECOVERY` status. The user - is then not able to sign in or initiate a forgot password flow until - they complete the reset flow. - - - This operation provides an option to delete all the user's sessions. - However, if the request is made in the context of a session owned by the - specified user, that session isn't cleared. - - > **Note:** You can also use this API to convert a user with the Okta - credential provider to use a federated provider. After this conversion, - the user can't directly sign in with a password. + description: |- + Resets a password. Generates a one-time token (OTT) that you can use to reset a user's password. You can automatically email the OTT link to the user or return the OTT to the API caller and distribute using a custom flow. - > To convert a federated user back to an Okta user, use the default API - call. + This operation transitions the user to the `RECOVERY` status. The user is then not able to sign in or initiate a forgot password flow until they complete the reset flow. + This operation provides an option to delete all the user's sessions. However, if the request is made in the context of a session owned by the specified user, that session isn't cleared. + > **Note:** You can also use this API to convert a user with the Okta credential provider to use a federated provider. After this conversion, the user can't directly sign in with a password. + > To convert a federated user back to an Okta user, use the default API call. - If an email address is associated with multiple users, keep in mind the - following to ensure a successful password recovery lookup: + If an email address is associated with multiple users, keep in mind the following to ensure a successful password recovery lookup: * Okta no longer includes deactivated users in the lookup. * The lookup searches sign-in IDs first, then primary email addresses, and then secondary email addresses. If `sendEmail` is `false`, returns a link for the user to reset their password. @@ -1399,26 +1010,18 @@ paths: in: query required: true schema: - type: boolean + type: string - name: revokeSessions - description: >- - Revokes all user sessions, except for the current session, if set to - `true` + description: Revokes all user sessions, except for the current session, if set to `true` in: query required: false schema: - type: boolean - default: false + type: string + default: 'false' + - $ref: '#/components/parameters/pathId' responses: '200': description: Success - content: - application/json: - schema: - $ref: '#/components/schemas/ResetPasswordToken' - examples: - Reset password without sending email response: - $ref: '#/components/examples/ResetPwdWithoutSendingEmailResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -1435,18 +1038,13 @@ paths: isCorsEnabled: true lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathId' /api/v1/users/{id}/lifecycle/suspend: post: summary: Suspend a user - description: >- - Suspends a user. Perform this operation only on users with an `ACTIVE` - status. The user has a `SUSPENDED` status when the process completes. - + description: |- + Suspends a user. Perform this operation only on users with an `ACTIVE` status. The user has a `SUSPENDED` status when the process completes. - Suspended users can't sign in to Okta. They can only be unsuspended or - deactivated. Their group and app assignments are retained. + Suspended users can't sign in to Okta. They can only be unsuspended or deactivated. Their group and app assignments are retained. operationId: suspendUser responses: '200': @@ -1470,18 +1068,14 @@ paths: isCorsEnabled: true lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathId' + parameters: + - $ref: '#/components/parameters/pathId' /api/v1/users/{id}/lifecycle/unlock: post: summary: Unlock a user - description: >- - Unlocks a user with a `LOCKED_OUT` status or unlocks a user with an - `ACTIVE` status that's blocked from unknown devices. Unlocked users have - an `ACTIVE` status and can sign in with their current password. - - > **Note:** This operation works with Okta-sourced users. It doesn't - support directory-sourced accounts such as Active Directory. + description: |- + Unlocks a user with a `LOCKED_OUT` status or unlocks a user with an `ACTIVE` status that's blocked from unknown devices. Unlocked users have an `ACTIVE` status and can sign in with their current password. + > **Note:** This operation works with Okta-sourced users. It doesn't support directory-sourced accounts such as Active Directory. operationId: unlockUser responses: '200': @@ -1503,14 +1097,12 @@ paths: isCorsEnabled: true lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathId' + parameters: + - $ref: '#/components/parameters/pathId' /api/v1/users/{id}/lifecycle/unsuspend: post: summary: Unsuspend a user - description: >- - Unsuspends a user and returns them to the `ACTIVE` state. This operation - can only be performed on users that have a `SUSPENDED` status. + description: Unsuspends a user and returns them to the `ACTIVE` state. This operation can only be performed on users that have a `SUSPENDED` status. operationId: unsuspendUser responses: '200': @@ -1534,19 +1126,15 @@ paths: isCorsEnabled: true lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathId' + parameters: + - $ref: '#/components/parameters/pathId' /api/v1/users/{userIdOrLogin}/linkedObjects/{primaryRelationshipName}/{primaryUserId}: put: summary: Assign a linked object value for primary - description: >- - Assigns the first user as the `associated` and the second user as the - `primary` for the specified relationship. - + description: |- + Assigns the first user as the `associated` and the second user as the `primary` for the specified relationship. - If the first user is already associated with a different `primary` for - this relationship, the previous link is removed. A linked object - relationship can specify only one primary user for an associated user. + If the first user is already associated with a different `primary` for this relationship, the previous link is removed. A linked object relationship can specify only one primary user for an associated user. operationId: assignLinkedObjectValueForPrimary responses: '204': @@ -1567,19 +1155,15 @@ paths: isCorsEnabled: true lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathUserIdOrLogin' - - $ref: '#/components/parameters/pathPrimaryRelationshipName' - - $ref: '#/components/parameters/pathPrimaryUserId' + parameters: + - $ref: '#/components/parameters/pathUserIdOrLogin' + - $ref: '#/components/parameters/pathPrimaryRelationshipName' + - $ref: '#/components/parameters/pathPrimaryUserId' /api/v1/users/{userIdOrLogin}/linkedObjects/{relationshipName}: get: summary: List the primary or all of the associated linked object values - description: >- - Lists either the `self` link for the primary user or all associated - users in the relationship specified by `relationshipName`. If the - specified user isn't associated in any relationship, an empty array is - returned. - + description: |- + Lists either the `self` link for the primary user or all associated users in the relationship specified by `relationshipName`. If the specified user isn't associated in any relationship, an empty array is returned. Use `me` instead of `id` to specify the current session user. operationId: listLinkedObjectsForUser @@ -1589,9 +1173,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/ResponseLinks' + $ref: '#/components/schemas/ListLinkedObjectsForUserResponse' examples: GetPrimaryLinkedObjectResponse: $ref: '#/components/examples/GetPrimaryLinkedObjectResponse' @@ -1613,18 +1195,15 @@ paths: isCorsEnabled: true lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathUserIdOrLogin' + - $ref: '#/components/parameters/pathRelationshipName' delete: summary: Delete a linked object value - description: >- - Deletes any existing relationship between the `associated` and `primary` - user. For the `associated` user, this is specified by the ID. The - `primary` name specifies the relationship. - + description: |- + Deletes any existing relationship between the `associated` and `primary` user. For the `associated` user, this is specified by the ID. The `primary` name specifies the relationship. - The operation is successful if the relationship is deleted. The - operation is also successful if the specified user isn't in the - `associated` relationship for any instance of the specified `primary` - and thus, no relationship is found. + The operation is successful if the relationship is deleted. The operation is also successful if the specified user isn't in the `associated` relationship for any instance of the specified `primary` and thus, no relationship is found. operationId: deleteLinkedObjectForUser responses: '204': @@ -1646,9 +1225,9 @@ paths: isCorsEnabled: true lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathUserIdOrLogin' - - $ref: '#/components/parameters/pathRelationshipName' + parameters: + - $ref: '#/components/parameters/pathUserIdOrLogin' + - $ref: '#/components/parameters/pathRelationshipName' /api/v1/users/{userId}/authenticator-enrollments: get: summary: List all authenticator enrollments @@ -1681,8 +1260,9 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathUserId' + parameters: + - $ref: '#/components/parameters/pathUserId' + - $ref: '#/components/parameters/queryDiscloseIdentifiers' /api/v1/users/{userId}/authenticator-enrollments/phone: post: x-okta-lifecycle: @@ -1713,20 +1293,16 @@ paths: - okta.users.manage tags: - UserAuthenticatorEnrollments - parameters: - - $ref: '#/components/parameters/pathUserId' /api/v1/users/{userId}/authenticator-enrollments/tac: post: x-okta-lifecycle: - lifecycle: EA + lifecycle: LIMITED_GA isGenerallyAvailable: false SKUs: [] x-okta-iam-permissions: - okta.users.credentials.manageTemporaryAccessCode summary: Create an auto-activated TAC authenticator enrollment - description: >- - Creates an auto-activated Temporary access code (TAC) authenticator - enrollment + description: Creates an auto-activated Temporary access code (TAC) authenticator enrollment operationId: createTacAuthenticatorEnrollment parameters: - $ref: '#/components/parameters/pathUserId' @@ -1748,13 +1324,15 @@ paths: - okta.users.manage tags: - UserAuthenticatorEnrollments - parameters: - - $ref: '#/components/parameters/pathUserId' /api/v1/users/{userId}/authenticator-enrollments/{enrollmentId}: get: summary: Retrieve an authenticator enrollment description: Retrieves a user's authenticator enrollment by `enrollmentId` operationId: getAuthenticatorEnrollment + parameters: + - $ref: '#/components/parameters/queryDiscloseIdentifiers' + - $ref: '#/components/parameters/pathUserId' + - $ref: '#/components/parameters/pathEnrollmentId' responses: '200': $ref: '#/components/responses/AuthenticatorEnrollmentResponse' @@ -1777,9 +1355,7 @@ paths: - Okta Identity Engine delete: summary: Delete an authenticator enrollment - description: >- - Deletes an existing enrollment for the specified user. The user can - enroll the authenticator again. + description: Deletes an existing enrollment for the specified user. The user can enroll the authenticator again. operationId: deleteAuthenticatorEnrollment responses: '204': @@ -1802,9 +1378,9 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathUserId' - - $ref: '#/components/parameters/pathEnrollmentId' + parameters: + - $ref: '#/components/parameters/pathUserId' + - $ref: '#/components/parameters/pathEnrollmentId' /api/v1/users/{userId}/classification: get: summary: Retrieve a user's classification @@ -1837,6 +1413,8 @@ paths: lifecycle: EA isGenerallyAvailable: false SKUs: [] + parameters: + - $ref: '#/components/parameters/pathUserId' put: summary: Replace the user's classification description: Replaces the user's classification @@ -1877,20 +1455,15 @@ paths: lifecycle: EA isGenerallyAvailable: false SKUs: [] - parameters: - - $ref: '#/components/parameters/pathUserId' + parameters: + - $ref: '#/components/parameters/pathUserId' /api/v1/users/{userId}/clients: get: summary: List all clients - description: >- - Lists all client resources for which the specified user has grants or - tokens. - + description: |- + Lists all client resources for which the specified user has grants or tokens - > **Note:** To list all client resources for which a specified - authorization server has tokens, use the [List all client resources for - an authorization server in the Authorization Servers - API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/AuthorizationServerClients/#tag/AuthorizationServerClients/operation/listOAuth2ClientsForAuthorizationServer). + > **Note:** To list all client resources for which a specified authorization server has tokens, use the [List all client resources for an authorization server in the Authorization Servers API](https://developer.okta.com/docs/api/openapi/okta-management/management/authorizationserverclients/listoauth2clientsforauthorizationserver). operationId: listUserClients responses: '200': @@ -1898,9 +1471,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/OAuth2Client' + $ref: '#/components/schemas/ListUserClientsResponse' examples: List user clients: $ref: '#/components/examples/ListUserClients' @@ -1920,8 +1491,8 @@ paths: isCorsEnabled: true lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathUserId' + parameters: + - $ref: '#/components/parameters/pathUserId' /api/v1/users/{userId}/clients/{clientId}/grants: get: summary: List all grants for a client @@ -1930,18 +1501,12 @@ paths: parameters: - name: expand in: query - description: >- - Valid value: `scope`. If specified, scope details are included in - the `_embedded` attribute. + description: 'Valid value: `scope`. If specified, scope details are included in the `_embedded` attribute.' schema: type: string - name: after in: query - description: >- - The cursor to use for pagination. It is an opaque string that - specifies your current location in the list and is obtained from the - `Link` response header. See - [Pagination](https://developer.okta.com/docs/api/#pagination). + description: The cursor to use for pagination. It is an opaque string that specifies your current location in the list and is obtained from the `Link` response header. See [Pagination](https://developer.okta.com/docs/api/#pagination). schema: type: string - name: limit @@ -1953,15 +1518,15 @@ paths: minimum: 1 maximum: 200 default: 20 + - $ref: '#/components/parameters/pathUserId' + - $ref: '#/components/parameters/pathClientId' responses: '200': description: Success content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/OAuth2ScopeConsentGrant' + $ref: '#/components/schemas/ListGrantsForUserAndClientResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -2002,9 +1567,9 @@ paths: isCorsEnabled: true lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathUserId' - - $ref: '#/components/parameters/pathClientId' + parameters: + - $ref: '#/components/parameters/pathUserId' + - $ref: '#/components/parameters/pathClientId' /api/v1/users/{userId}/clients/{clientId}/tokens: get: summary: List all refresh tokens for a client @@ -2013,19 +1578,13 @@ paths: parameters: - name: expand in: query - description: >- - Valid value: `scope`. If specified, scope details are included in - the `_embedded` attribute. + description: 'Valid value: `scope`. If specified, scope details are included in the `_embedded` attribute.' schema: type: string example: scope - name: after in: query - description: >- - The cursor to use for pagination. It is an opaque string that - specifies your current location in the list and is obtained from the - `Link` response header. See - [Pagination](https://developer.okta.com/docs/api/#pagination). + description: The cursor to use for pagination. It is an opaque string that specifies your current location in the list and is obtained from the `Link` response header. See [Pagination](https://developer.okta.com/docs/api/#pagination). schema: type: string - name: limit @@ -2037,15 +1596,15 @@ paths: minimum: 1 maximum: 200 default: 20 + - $ref: '#/components/parameters/pathUserId' + - $ref: '#/components/parameters/pathClientId' responses: '200': description: Success content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/OAuth2RefreshToken' + $ref: '#/components/schemas/ListRefreshTokensForUserAndClientResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -2086,9 +1645,9 @@ paths: isCorsEnabled: true lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathUserId' - - $ref: '#/components/parameters/pathClientId' + parameters: + - $ref: '#/components/parameters/pathUserId' + - $ref: '#/components/parameters/pathClientId' /api/v1/users/{userId}/clients/{clientId}/tokens/{tokenId}: get: summary: Retrieve a refresh token for a client @@ -2097,12 +1656,13 @@ paths: parameters: - name: expand in: query - description: >- - Valid value: `scope`. If specified, scope details are included in - the `_embedded` attribute. + description: 'Valid value: `scope`. If specified, scope details are included in the `_embedded` attribute.' schema: type: string example: scope + - $ref: '#/components/parameters/pathUserId' + - $ref: '#/components/parameters/pathClientId' + - $ref: '#/components/parameters/pathTokenId' responses: '200': description: Success @@ -2150,44 +1710,33 @@ paths: isCorsEnabled: true lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathUserId' - - $ref: '#/components/parameters/pathClientId' - - $ref: '#/components/parameters/pathTokenId' + parameters: + - $ref: '#/components/parameters/pathUserId' + - $ref: '#/components/parameters/pathClientId' + - $ref: '#/components/parameters/pathTokenId' /api/v1/users/{userId}/credentials/change_password: post: summary: Update password - description: >- + description: |- Updates a user's password by validating the user's current password. + This operation provides an option to delete all the sessions of the specified user. However, if the request is made in the context of a session owned by the specified user, that session isn't cleared. - This operation provides an option to delete all the sessions of the - specified user. However, if the request is made in the context of a - session owned by the specified user, that session isn't cleared. + You can only perform this operation on users in `STAGED`, `ACTIVE`, `PASSWORD_EXPIRED`, or `RECOVERY` status that have a valid [password credential](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#tag/User/operation/createUser!path=credentials/password&t=request). + The user transitions to `ACTIVE` status when successfully invoked in `RECOVERY` status. - You can only perform this operation on users in `STAGED`, `ACTIVE`, - `PASSWORD_EXPIRED`, or `RECOVERY` status that have a valid [password - credential](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#tag/User/operation/createUser!path=credentials/password&t=request). - - - The user transitions to `ACTIVE` status when successfully invoked in - `RECOVERY` status. - - - > **Note:** The Okta account management policy doesn't support the - `/users/{userId}/credentials/change_password` endpoint. See [Configure - an Okta account management - policy](https://developer.okta.com/docs/guides/okta-account-management-policy/main/). + > **Note:** The Okta account management policy doesn't support the `/users/{userId}/credentials/change_password` endpoint. See [Configure an Okta account management policy](https://developer.okta.com/docs/guides/okta-account-management-policy/main/). operationId: changePassword parameters: - name: strict in: query description: If true, validates against the password minimum age policy schema: - type: boolean - default: false + type: string + default: 'false' x-okta-added-version: 1.10.0 + - $ref: '#/components/parameters/pathUserId' x-codegen-request-body-name: changePasswordRequest requestBody: content: @@ -2201,13 +1750,6 @@ paths: responses: '200': description: Success - content: - application/json: - schema: - $ref: '#/components/schemas/UserCredentials' - examples: - Change password response: - $ref: '#/components/examples/ChangePwdResponse' '400': $ref: '#/components/responses/ErrorApiValidationFailed400' '403': @@ -2226,18 +1768,12 @@ paths: isCorsEnabled: true lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathUserId' /api/v1/users/{userId}/credentials/change_recovery_question: post: summary: Update recovery question - description: >- - Updates a user's recovery question and answer credential by validating - the user's current password. - - You can only perform this operation on users in `STAGED`, `ACTIVE`, or - `RECOVERY` status that have a valid [password - credential](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#tag/User/operation/createUser!path=credentials/password&t=request). + description: |- + Updates a user's recovery question and answer credential by validating the user's current password. + You can only perform this operation on users in `STAGED`, `ACTIVE`, or `RECOVERY` status that have a valid [password credential](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#tag/User/operation/createUser!path=credentials/password&t=request). operationId: changeRecoveryQuestion x-codegen-request-body-name: userCredentials requestBody: @@ -2252,13 +1788,6 @@ paths: responses: '200': description: Success - content: - application/json: - schema: - $ref: '#/components/schemas/UserCredentials' - examples: - Update recovery question response: - $ref: '#/components/examples/UpdateRecQuestionResponse' '400': $ref: '#/components/responses/ErrorApiValidationFailed400' '403': @@ -2277,40 +1806,26 @@ paths: isCorsEnabled: true lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathUserId' + parameters: + - $ref: '#/components/parameters/pathUserId' /api/v1/users/{userId}/credentials/forgot_password: post: summary: Start forgot password flow - description: >- + description: |- Starts the forgot password flow. + Generates a one-time token (OTT) that you can use to reset a user's password. - Generates a one-time token (OTT) that you can use to reset a user's - password. - - - The user must validate their security question's answer when visiting - the reset link. Perform this operation only on users with an `ACTIVE` - status and - - a valid [recovery question - credential](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#tag/User/operation/createUser!path=credentials/recovery_question&t=request). - - - > **Note:** If you have migrated to Identity Engine, you can allow users - to recover passwords with any enrolled MFA authenticator. See - [Self-service account - recovery](https://help.okta.com/oie/en-us/content/topics/identity-engine/authenticators/configure-sspr.htm?cshid=ext-config-sspr). + The user must validate their security question's answer when visiting the reset link. Perform this operation only on users with an `ACTIVE` status and + a valid [recovery question credential](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#tag/User/operation/createUser!path=credentials/recovery_question&t=request). + > **Note:** If you have migrated to Identity Engine, you can allow users to recover passwords with any enrolled MFA authenticator. See [Self-service account recovery](https://help.okta.com/oie/en-us/content/topics/identity-engine/authenticators/configure-sspr.htm?cshid=ext-config-sspr). - If an email address is associated with multiple users, keep in mind the - following to ensure a successful password recovery lookup: + If an email address is associated with multiple users, keep in mind the following to ensure a successful password recovery lookup: * Okta no longer includes deactivated users in the lookup. * The lookup searches sign-in IDs first, then primary email addresses, and then secondary email addresses. - If `sendEmail` is `false`, returns a link for the user to reset their - password. This operation doesn't affect the status of the user. + If `sendEmail` is `false`, returns a link for the user to reset their password. This operation doesn't affect the status of the user. operationId: forgotPassword parameters: - name: sendEmail @@ -2318,18 +1833,12 @@ paths: description: Sends a forgot password email to the user if `true` required: false schema: - type: boolean - default: true + type: string + default: 'true' + - $ref: '#/components/parameters/pathUserId' responses: '200': description: Reset URL - content: - application/json: - schema: - $ref: '#/components/schemas/ForgotPasswordResponse' - examples: - Forgot password response: - $ref: '#/components/examples/ForgotPwdResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -2346,15 +1855,11 @@ paths: isCorsEnabled: true lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathUserId' /api/v1/users/{userId}/credentials/forgot_password_recovery_question: post: summary: Reset password with recovery question - description: >- - Resets the user's password to the specified password if the provided - answer to the recovery question is correct. - + description: |- + Resets the user's password to the specified password if the provided answer to the recovery question is correct. You must include the recovery question answer with the submission. operationId: forgotPasswordSetNewPassword parameters: @@ -2362,8 +1867,9 @@ paths: in: query required: false schema: - type: boolean - default: true + type: string + default: 'true' + - $ref: '#/components/parameters/pathUserId' x-codegen-request-body-name: userCredentials requestBody: content: @@ -2377,13 +1883,6 @@ paths: responses: '200': description: Credentials - content: - application/json: - schema: - $ref: '#/components/schemas/UserCredentials' - examples: - Forgot password recovery question response: - $ref: '#/components/examples/ForgotPwdRecoveryQuestionResponse' '400': $ref: '#/components/responses/ErrorApiValidationFailed400' '403': @@ -2402,18 +1901,13 @@ paths: isCorsEnabled: true lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathUserId' /api/v1/users/{userId}/devices: get: - summary: List all devices - description: >- - Lists all devices enrolled by a user. - + summary: List all devices for an enrolled user + description: |- + Lists all devices enrolled by a user - > **Note:** To list all devices registered to an org, use the [List all - devices endpoint in the Devices - API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Device/#tag/Device/operation/listDevices). + > **Note:** To list all devices registered to an org, use the [List all devices endpoint in the Devices API](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/device/other/listdevices). operationId: listUserDevices responses: '200': @@ -2421,9 +1915,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/UserDevice' + $ref: '#/components/schemas/ListUserDevicesResponse' examples: APIUsersListDevicesResponseExample: summary: List all devices for a specific user @@ -2445,37 +1937,19 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathUserId' + parameters: + - $ref: '#/components/parameters/pathUserId' /api/v1/users/{userId}/factors: get: summary: List all enrolled factors - description: >- - Lists all enrolled factors for the specified user that are included in - the highest priority [authenticator enrollment - policy](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/Policy/) - that applies to the user. - - - Only enrolled factors that are `REQUIRED` or `OPTIONAL` in the highest - priority authenticator enrollment policy can be returned. - + description: |- + Lists all enrolled factors for the specified user that are included in the highest priority [authenticator enrollment policy](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/policy/) that applies to the user. - > **Note:** When admins use this endpoint for other users, the - authenticator enrollment policy that's evaluated can vary depending on - how client-specific conditions are configured in the rules of an - authenticator enrollment policy. The client-specific conditions of the - admin's client are used during policy evaluation instead of the - client-specific conditions of the user. This can affect which - authenticator enrollment policy is evaluated and which factors are - returned. + Only enrolled factors that are `REQUIRED` or `OPTIONAL` in the highest priority authenticator enrollment policy can be returned. + > **Note:** When admins use this endpoint for other users, the authenticator enrollment policy that's evaluated can vary depending on how client-specific conditions are configured in the rules of an authenticator enrollment policy. The client-specific conditions of the admin's client are used during policy evaluation instead of the client-specific conditions of the user. This can affect which authenticator enrollment policy is evaluated and which factors are returned. > - - > For example, an admin in Europe lists all enrolled factors for a user - in North America. The network zone of the admin's client (in Europe) is - used during policy evaluation instead of the network zone of the user - (in North America). + > For example, an admin in Europe lists all enrolled factors for a user in North America. The network zone of the admin's client (in Europe) is used during policy evaluation instead of the network zone of the user (in North America). operationId: listFactors responses: '200': @@ -2483,9 +1957,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/UserFactor' + $ref: '#/components/schemas/ListFactorsResponse' examples: ListFactorsResponse: $ref: '#/components/examples/ListFactorsResults' @@ -2504,93 +1976,51 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - post: + parameters: + - $ref: '#/components/parameters/pathUserId' + post: summary: Enroll a factor - description: >- + description: |- Enrolls a supported factor for the specified user - - > **Notes:** - - > * All responses return the enrolled factor with a status of either - `PENDING_ACTIVATION` or `ACTIVE`. - - > * You can't use the Factors API to enroll Okta Fastpass - (`signed_nonce`) for a user. See [Configure Okta - Fastpass](https://help.okta.com/okta_help.htm?type=oie&id=ext-fp-configure). - + > **Notes:** + > * All responses return the enrolled factor with a status of either `PENDING_ACTIVATION` or `ACTIVE`. + > * You can't use the Factors API to enroll Okta FastPass (`signed_nonce`) for a user. See [Configure Okta FastPass](https://help.okta.com/okta_help.htm?type=oie&id=ext-fp-configure). #### Additional SMS/Call factor information + * **Rate limits**: Okta may return a `429 Too Many Requests` status code if you attempt to resend an SMS or a voice call challenge (OTP) within the same time window. The current [rate limit](https://developer.okta.com/docs/reference/rate-limits/) is one SMS/CALL challenge per phone number every 30 seconds. - * **Rate limits**: Okta may return a `429 Too Many Requests` status code - if you attempt to resend an SMS or a voice call challenge (OTP) within - the same time window. The current [rate - limit](https://developer.okta.com/docs/reference/rate-limits/) is one - SMS/CALL challenge per phone number every 30 seconds. - - - * **Existing phone numbers**: Okta may return a `400 Bad Request` status - code if a user attempts to enroll with a different phone number when the - user has an existing mobile phone or has an existing phone with voice - call capability. A user can enroll only one mobile phone for `sms` and - enroll only one voice call capable phone for `call` factor. - + * **Existing phone numbers**: Okta may return a `400 Bad Request` status code if a user attempts to enroll with a different phone number when the user has an existing mobile phone or has an existing phone with voice call capability. A user can enroll only one mobile phone for `sms` and enroll only one voice call capable phone for `call` factor. #### Additional WebAuthn factor information + * For detailed information on the WebAuthn standard, including an up-to-date list of supported browsers, see [webauthn.me](https://a0.to/webauthnme-okta-docs). - * For detailed information on the WebAuthn standard, including an - up-to-date list of supported browsers, see - [webauthn.me](https://a0.to/webauthnme-okta-docs). + * When you enroll a WebAuthn factor, the `activation` object in `_embedded` contains properties used to help the client to create a new WebAuthn credential for use with Okta. See the [WebAuthn spec for PublicKeyCredentialCreationOptions](https://www.w3.org/TR/webauthn/#dictionary-makecredentialoptions). - - * When you enroll a WebAuthn factor, the `activation` object in - `_embedded` contains properties used to help the client to create a new - WebAuthn credential for use with Okta. See the [WebAuthn spec for - PublicKeyCredentialCreationOptions](https://www.w3.org/TR/webauthn/#dictionary-makecredentialoptions). + * As of the `2026.04.0` release, the FIDO2 (WebAuthn) authenticator is now called Passkey (FIDO2 WebAuthn) and there are new settings and updates to the authenticator page layout. There have been no changes to any existing parameter names, values, or endpoint paths. For example, the `factorType` for the Passkey (FIDO2 WebAuthn) authenticator is still `webauthn`. See [Passkeys and WebAuthn](https://developer.okta.com/docs/guides/authenticators-web-authn/aspnet/main/#passkeys-and-webauthn). #### Additional Custom TOTP factor information + * The enrollment process involves passing both the `factorProfileId` and `sharedSecret` properties for a token. - * The enrollment process involves passing both the `factorProfileId` and - `sharedSecret` properties for a token. - - - * A factor profile represents a particular configuration of the Custom - TOTP factor. It includes certain properties that match the hardware - token that end users possess, such as the HMAC algorithm, passcode - length, and time interval. There can be multiple Custom TOTP factor - profiles per org, but users can only enroll in one Custom TOTP factor. - Admins can [create Custom TOTP factor - profiles](https://help.okta.com/okta_help.htm?id=ext-mfa-totp) in the - Admin Console. Then, copy the `factorProfileId` from the Admin Console - into the API request. - + * A factor profile represents a particular configuration of the Custom TOTP factor. It includes certain properties that match the hardware token that end users possess, such as the HMAC algorithm, passcode length, and time interval. There can be multiple Custom TOTP factor profiles per org, but users can only enroll in one Custom TOTP factor. Admins can [create Custom TOTP factor profiles](https://help.okta.com/okta_help.htm?id=ext-mfa-totp) in the Admin Console. Then, copy the `factorProfileId` from the Admin Console into the API request. * - - For Custom TOTP enrollment, Okta automaticaly enrolls a user with a - `token:software:totp` factor and the `push` factor if the user isn't - currently enrolled with these factors. + For Custom TOTP enrollment, Okta automaticaly enrolls a user with a `token:software:totp` factor and the `push` factor if the user isn't currently enrolled with these factors. operationId: enrollFactor parameters: - name: updatePhone - description: >- - If `true`, indicates that you are replacing the currently registered - phone number for the specified user. This parameter is ignored if - the existing phone number is used by an activated factor. + description: If `true`, indicates that you are replacing the currently registered phone number for the specified user. This parameter is ignored if the existing phone number is used by an activated factor. in: query schema: - type: boolean - default: false + type: string + default: 'false' - name: templateId in: query - description: >- - ID of an existing custom SMS template. See the [SMS Templates - API]https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Template/. This parameter is only used by `sms` factors. If - the provided ID doesn't exist, the default template is used instead. + description: ID of an existing custom SMS template. See the [SMS Templates API]https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Template/. This parameter is only used by `sms` factors. If the provided ID doesn't exist, the default template is used instead. schema: type: string example: cstk2flOtuCMDJK4b0g3 @@ -2605,26 +2035,19 @@ paths: default: 300 x-okta-added-version: 1.3.0 - name: activate - description: >- - If `true`, the factor is immediately activated as part of the - enrollment. An activation process isn't required. Currently - auto-activation is supported by `sms`, `call`, `email` and - `token:hotp` (Custom TOTP) factors. + description: If `true`, the factor is immediately activated as part of the enrollment. An activation process isn't required. Currently auto-activation is supported by `sms`, `call`, `email` and `token:hotp` (Custom TOTP) factors. in: query schema: - type: boolean - default: false + type: string + default: 'false' x-okta-added-version: 1.3.0 - name: Accept-Language - description: >- - An ISO 639-1 two-letter language code that defines a localized - message to send. This parameter is only used by `sms` factors. If a - localized message doesn't exist or the `templateId` is incorrect, - the default template is used instead. + description: An ISO 639-1 two-letter language code that defines a localized message to send. This parameter is only used by `sms` factors. If a localized message doesn't exist or the `templateId` is incorrect, the default template is used instead. in: header schema: type: string example: fr + - $ref: '#/components/parameters/pathUserId' x-codegen-request-body-name: body requestBody: description: Factor @@ -2711,37 +2134,17 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathUserId' /api/v1/users/{userId}/factors/catalog: get: summary: List all supported factors - description: >- - Lists all the supported factors that can be enrolled for the specified - user that are included in the highest priority [authenticator enrollment - policy](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/Policy/) - that applies to the user. - - - Only factors that are `REQUIRED` or `OPTIONAL` in the highest priority - authenticator enrollment policy can be returned. - + description: |- + Lists all the supported factors that can be enrolled for the specified user that are included in the highest priority [authenticator enrollment policy](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/policy/) that applies to the user. - > **Note:** When admins use this endpoint for other users, the - authenticator enrollment policy that's evaluated can vary depending on - how client-specific conditions are configured in the rules of an - authenticator enrollment policy. The client-specific conditions of the - admin's client are used during policy evaluation instead of the - client-specific conditions of the user. This can affect which - authenticator enrollment policy is evaluated and which factors are - returned. + Only factors that are `REQUIRED` or `OPTIONAL` in the highest priority authenticator enrollment policy can be returned. + > **Note:** When admins use this endpoint for other users, the authenticator enrollment policy that's evaluated can vary depending on how client-specific conditions are configured in the rules of an authenticator enrollment policy. The client-specific conditions of the admin's client are used during policy evaluation instead of the client-specific conditions of the user. This can affect which authenticator enrollment policy is evaluated and which factors are returned. > - - > For example, an admin in Europe lists all supported factors for a user - in North America. The network zone of the admin's client (in Europe) is - used during policy evaluation instead of the network zone of the user - (in North America). + > For example, an admin in Europe lists all supported factors for a user in North America. The network zone of the admin's client (in Europe) is used during policy evaluation instead of the network zone of the user (in North America). operationId: listSupportedFactors responses: '200': @@ -2749,9 +2152,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/UserFactorSupported' + $ref: '#/components/schemas/ListSupportedFactorsResponse' examples: List of supported factors: $ref: '#/components/examples/SupportedFactorResults' @@ -2770,8 +2171,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathUserId' + parameters: + - $ref: '#/components/parameters/pathUserId' /api/v1/users/{userId}/factors/questions: get: x-okta-no-scope-required: true @@ -2791,9 +2192,7 @@ paths: - question: first_award questionText: What did you earn your first medal or award for? schema: - type: array - items: - $ref: '#/components/schemas/UserFactorSecurityQuestionProfile' + $ref: '#/components/schemas/ListSupportedSecurityQuestionsResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -2808,8 +2207,8 @@ paths: isCorsEnabled: true lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathUserId' + parameters: + - $ref: '#/components/parameters/pathUserId' /api/v1/users/{userId}/factors/{factorId}: get: summary: Retrieve a factor @@ -2833,28 +2232,25 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathUserId' + - $ref: '#/components/parameters/pathFactorId' delete: summary: Unenroll a factor - description: >- - Unenrolls an existing factor for the specified user. You can't unenroll - a factor from a deactivated user. Unenrolling a factor allows the user - to enroll a new factor. - + description: |- + Unenrolls an existing factor for the specified user. You can't unenroll a factor from a deactivated user. Unenrolling a factor allows the user to enroll a new factor. - > **Note:** If you unenroll the `push` or the `signed_nonce` factors, - Okta also unenrolls any other `totp`, `signed_nonce`, or Okta Verify - `push` factors associated with the user. + > **Note:** If you unenroll the `push` or the `signed_nonce` factors, Okta also unenrolls any other `totp`, `signed_nonce`, or Okta Verify `push` factors associated with the user. operationId: unenrollFactor parameters: - name: removeRecoveryEnrollment - description: >- - If `true`, removes the phone number as both a recovery method and a - factor. This parameter is only used for the `sms` and `call` - factors. + description: If `true`, removes the phone number as both a recovery method and a factor. This parameter is only used for the `sms` and `call` factors. in: query schema: - type: boolean - default: false + type: string + default: 'false' + - $ref: '#/components/parameters/pathUserId' + - $ref: '#/components/parameters/pathFactorId' responses: '204': description: No Content @@ -2874,33 +2270,17 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathUserId' - - $ref: '#/components/parameters/pathFactorId' /api/v1/users/{userId}/factors/{factorId}/lifecycle/activate: post: summary: Activate a factor - description: >- - Activates a factor. Some factors (`call`, `email`, `push`, `sms`, - `token:software:totp`, `u2f`, and `webauthn`) require activation to - complete the enrollment process. - - - Okta enforces a rate limit of five activation attempts within five - minutes. After a user exceeds the rate limit, Okta returns an error - message. - - - > **Notes:** + description: |- + Activates a factor. Some factors (`call`, `email`, `push`, `sms`, `token:software:totp`, `u2f`, and `webauthn`) require activation to complete the enrollment process. - > * If the user exceeds their SMS, call, or email factor activation rate - limit, then an [OTP resend - request]https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserFactor/ isn't allowed - for the same factor. + Okta enforces a rate limit of five activation attempts within five minutes. After a user exceeds the rate limit, Okta returns an error message. - > * You can't use the Factors API to activate Okta Fastpass - (`signed_nonce`) for a user. See [Configure Okta - Fastpass](https://help.okta.com/okta_help.htm?type=oie&id=ext-fp-configure). + > **Notes:** + > * If the user exceeds their SMS, call, or email factor activation rate limit, then an [OTP resend request]https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserFactor/ isn't allowed for the same factor. + > * You can't use the Factors API to activate Okta FastPass (`signed_nonce`) for a user. See [Configure Okta FastPass](https://help.okta.com/okta_help.htm?type=oie&id=ext-fp-configure). operationId: activateFactor x-codegen-request-body-name: body requestBody: @@ -2925,25 +2305,6 @@ paths: responses: '200': description: Success - content: - application/json: - schema: - $ref: '#/components/schemas/UserFactorActivateResponse' - examples: - token:software:totp: - $ref: '#/components/examples/ActivateFactorTotpResponse' - sms: - $ref: '#/components/examples/ActivateFactorSmsResponse' - call: - $ref: '#/components/examples/ActivateFactorCallResponse' - push: - $ref: '#/components/examples/ActivateFactorPushResponse' - email: - $ref: '#/components/examples/ActivateFactorEmailResponse' - u2f: - $ref: '#/components/examples/ActivateFactorU2fResponse' - webauthn: - $ref: '#/components/examples/ActivateFactorWebauthnResponse' '400': $ref: '#/components/responses/ErrorApiValidationFailed400' '403': @@ -2961,39 +2322,28 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathUserId' - - $ref: '#/components/parameters/pathFactorId' + parameters: + - $ref: '#/components/parameters/pathUserId' + - $ref: '#/components/parameters/pathFactorId' /api/v1/users/{userId}/factors/{factorId}/resend: post: summary: Resend a factor enrollment - description: >- - Resends an `sms`, `call`, or `email` factor challenge as part of an - enrollment flow. - - - For `call` and `sms` factors, Okta enforces a rate limit of one OTP - challenge per device every 30 seconds. You can configure your `sms` and - `call` factors to use a third-party telephony provider. See the - [Telephony inline hook - reference](https://developer.okta.com/docs/reference/telephony-hook/). - Okta alternates between SMS providers with every resend request to - ensure delivery of SMS and Call OTPs across different carriers. + description: |- + Resends an `sms`, `call`, or `email` factor challenge as part of an enrollment flow. + For `call` and `sms` factors, Okta enforces a rate limit of one OTP challenge per device every 30 seconds. You can configure your `sms` and `call` factors to use a third-party telephony provider. See the [Telephony inline hook reference](https://developer.okta.com/docs/reference/telephony-hook/). Okta alternates between SMS providers with every resend request to ensure delivery of SMS and Call OTPs across different carriers. - > **Note:** Resend operations aren't allowed after a factor exceeds the - activation rate limit. See [Activate a - factor]https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserFactor/. + > **Note:** Resend operations aren't allowed after a factor exceeds the activation rate limit. See [Activate a factor]https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserFactor/. operationId: resendEnrollFactor parameters: - name: templateId in: query - description: >- - ID of an existing custom SMS template. See the [SMS Templates - API]https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Template/. This parameter is only used by `sms` factors. + description: ID of an existing custom SMS template. See the [SMS Templates API]https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Template/. This parameter is only used by `sms` factors. schema: example: cstk2flOtuCMDJK4b0g3 type: string + - $ref: '#/components/parameters/pathUserId' + - $ref: '#/components/parameters/pathFactorId' requestBody: content: application/json: @@ -3010,13 +2360,6 @@ paths: responses: '200': description: Success - content: - application/json: - schema: - $ref: '#/components/schemas/ResendUserFactor' - examples: - sms: - $ref: '#/components/examples/EnrollFactorSmsResponse' '400': $ref: '#/components/responses/ErrorApiValidationFailed400' '403': @@ -3034,9 +2377,6 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathUserId' - - $ref: '#/components/parameters/pathFactorId' /api/v1/users/{userId}/factors/{factorId}/transactions/{transactionId}: get: summary: Retrieve a factor transaction status @@ -3044,9 +2384,9 @@ paths: Retrieves the status of a `push` factor verification transaction > **Note:** - > The response body for a number matching push challenge to an Okta Verify `push` factor enrollment is different from the response body of a standard push challenge. - > The number matching push challenge [response body](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/getFactorTransactionStatus!c=200&path=1/_embedded&t=response) contains the correct answer for the challenge. - > Use [Verify a factor](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/verifyFactor) to configure which challenge is sent. + > The response body for a number matching push challenge to an Okta Verify `push` factor enrollment is different from the response body of a standard push challenge. + > The number matching push challenge [response body](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/userfactor/other/getfactortransactionstatus!c=200&path=1/_embedded&t=response) contains the correct answer for the challenge. + > Use [Verify a factor](https://developer.okta.com/docs/api/openapi/okta-management/management/userfactor/verifyfactor) to configure which challenge is sent. operationId: getFactorTransactionStatus responses: '200': @@ -3057,16 +2397,13 @@ paths: $ref: '#/components/schemas/UserFactorPushTransaction' examples: WAITING (with number matching challenge): - $ref: >- - #/components/examples/UserFactorVerifyPushTransactionWaitingNMC + $ref: '#/components/examples/UserFactorVerifyPushTransactionWaitingNMC' WAITING: $ref: '#/components/examples/UserFactorVerifyPushTransactionWaiting' SUCCESS: - $ref: >- - #/components/examples/UserFactorVerifyPushTransactionApproved + $ref: '#/components/examples/UserFactorVerifyPushTransactionApproved' REJECTED: - $ref: >- - #/components/examples/UserFactorVerifyPushTransactionRejected + $ref: '#/components/examples/UserFactorVerifyPushTransactionRejected' TIMEOUT: $ref: '#/components/examples/UserFactorVerifyPushTransactionTimeout' '403': @@ -3084,36 +2421,23 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathUserId' - - $ref: '#/components/parameters/pathFactorId' - - $ref: '#/components/parameters/pathTransactionId' + parameters: + - $ref: '#/components/parameters/pathUserId' + - $ref: '#/components/parameters/pathFactorId' + - $ref: '#/components/parameters/pathTransactionId' /api/v1/users/{userId}/factors/{factorId}/verify: post: summary: Verify a factor - description: >- - Verifies an OTP for a factor. Some factors (`call`, `email`, `push`, - `sms`, `u2f`, and `webauthn`) must first issue a challenge before you - can verify the factor. Do this by making a request without a body. After - a challenge is issued, make another request to verify the factor. - + description: |- + Verifies an OTP for a factor. Some factors (`call`, `email`, `push`, `sms`, `u2f`, and `webauthn`) must first issue a challenge before you can verify the factor. Do this by making a request without a body. After a challenge is issued, make another request to verify the factor. > **Notes:** - - > - You can send standard push challenges or number matching push - challenges to Okta Verify `push` factor enrollments. Use a [request - body](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/verifyFactor!path=2/useNumberMatchingChallenge&t=request) - for number matching push challenges. - - > - To verify a `push` factor, use the **poll** link returned when you - issue the challenge. See [Retrieve a factor transaction - status](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/getFactorTransactionStatus). + > - You can send standard push challenges or number matching push challenges to Okta Verify `push` factor enrollments. Use a [request body](https://developer.okta.com/docs/api/openapi/okta-management/management/userfactor/verifyfactor!path=2/useNumberMatchingChallenge&t=request) for number matching push challenges. + > - To verify a `push` factor, use the **poll** link returned when you issue the challenge. See [Retrieve a factor transaction status](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/userfactor/other/getfactortransactionstatus). operationId: verifyFactor parameters: - name: templateId - description: >- - ID of an existing custom SMS template. See the [SMS Templates - API]https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Template/. This parameter is only used by `sms` factors. + description: ID of an existing custom SMS template. See the [SMS Templates API]https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Template/. This parameter is only used by `sms` factors. in: query schema: type: string @@ -3135,46 +2459,27 @@ paths: type: string x-okta-added-version: 1.11.0 - name: User-Agent - description: >- - Type of user agent detected when the request is made. Required to - verify `push` factors. + description: Type of user agent detected when the request is made. Required to verify `push` factors. in: header schema: type: string x-okta-added-version: 1.11.0 - name: Accept-Language - description: >- - An ISO 639-1 two-letter language code that defines a localized - message to send. This parameter is only used by `sms` factors. If a - localized message doesn't exist or the `templateId` is incorrect, - the default template is used instead. + description: An ISO 639-1 two-letter language code that defines a localized message to send. This parameter is only used by `sms` factors. If a localized message doesn't exist or the `templateId` is incorrect, the default template is used instead. in: header schema: type: string example: fr + - $ref: '#/components/parameters/pathUserId' + - $ref: '#/components/parameters/pathFactorId' x-codegen-request-body-name: body requestBody: - description: >- - Verifies an OTP for a factor. Some factors (`call`, `email`, `push`, - `sms`, `u2f`, and `webauthn`) must first issue a challenge before you - can verify the factor. Do this by making a request without a body. - After a challenge is issued, make another request to verify the - factor. - + description: |- + Verifies an OTP for a factor. Some factors (`call`, `email`, `push`, `sms`, `u2f`, and `webauthn`) must first issue a challenge before you can verify the factor. Do this by making a request without a body. After a challenge is issued, make another request to verify the factor. > **Note:** - - > Unlike standard push challenges that don't require a request body, a - number matching - [`push`](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/verifyFactor!path=2/useNumberMatchingChallenge&t=request) - challenge requires a request body. `useNumberMatchingChallenge` must - be set to `true`. - - > When a number matching challenge is issued for an Okta Verify `push` - factor enrollment, a `correctAnswer` challenge object is returned in - the - [`_embedded`](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/verifyFactor!c=200&path=_embedded&t=response) - object. + > Unlike standard push challenges that don't require a request body, a number matching [`push`](https://developer.okta.com/docs/api/openapi/okta-management/management/userfactor/verifyfactor!path=2/useNumberMatchingChallenge&t=request) challenge requires a request body. `useNumberMatchingChallenge` must be set to `true`. + > When a number matching challenge is issued for an Okta Verify `push` factor enrollment, a `correctAnswer` challenge object is returned in the [`_embedded`](https://developer.okta.com/docs/api/openapi/okta-management/management/userfactor/verifyfactor!c=200&path=_embedded&t=response) object. content: application/json: schema: @@ -3204,39 +2509,6 @@ paths: responses: '200': description: Success - content: - application/json: - schema: - $ref: '#/components/schemas/UserFactorVerifyResponse' - examples: - sms challenge: - $ref: '#/components/examples/UserFactorChallengeSmsResponse' - sms verify: - $ref: '#/components/examples/UserFactorVerifySuccessSmsResponse' - call challenge: - $ref: '#/components/examples/UserFactorChallengeCallResponse' - call verify: - $ref: '#/components/examples/UserFactorVerifyCallSuccessResponse' - email challenge: - $ref: '#/components/examples/UserFactorChallengeEmailResponse' - email verify: - $ref: '#/components/examples/UserFactorVerifyEmailSuccessResponse' - u2f challenge: - $ref: '#/components/examples/UserFactorChallengeU2fResponse' - u2f verify: - $ref: '#/components/examples/UserFactorVerifyU2fResponse' - webAuthn challenge: - $ref: '#/components/examples/UserFactorChallengeWebauthnResponse' - webAuthn verify: - $ref: '#/components/examples/UserFactorVerifyWebauthnResponse' - security question verify: - $ref: '#/components/examples/UserFactorVerifySuccessSqResponse' - totp verify: - $ref: '#/components/examples/UserFactorVerifySuccessTotpResponse' - token verify: - $ref: '#/components/examples/UserFactorVerifySuccessTokenResponse' - yubikey verify: - $ref: '#/components/examples/UserFactorVerifySuccessYubikeyResponse' '201': description: Created content: @@ -3245,8 +2517,7 @@ paths: $ref: '#/components/schemas/UserFactorVerifyResponseWaiting' examples: push challenge with number matching: - $ref: >- - #/components/examples/UserFactorChallengePushResponseWithNumberMatchingChallenge + $ref: '#/components/examples/UserFactorChallengePushResponseWithNumberMatchingChallenge' push challenge: $ref: '#/components/examples/UserFactorChallengePushResponse' '400': @@ -3266,9 +2537,6 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathUserId' - - $ref: '#/components/parameters/pathFactorId' /api/v1/users/{userId}/grants: get: summary: List all user grants @@ -3282,19 +2550,13 @@ paths: type: string - name: expand in: query - description: >- - Valid value: `scope`. If specified, scope details are included in - the `_embedded` attribute. + description: 'Valid value: `scope`. If specified, scope details are included in the `_embedded` attribute.' schema: type: string example: scope - name: after in: query - description: >- - The cursor to use for pagination. It is an opaque string that - specifies your current location in the list and is obtained from the - `Link` response header. See - [Pagination](https://developer.okta.com/docs/api/#pagination). + description: The cursor to use for pagination. It is an opaque string that specifies your current location in the list and is obtained from the `Link` response header. See [Pagination](https://developer.okta.com/docs/api/#pagination). schema: type: string - name: limit @@ -3306,15 +2568,14 @@ paths: minimum: 1 maximum: 200 default: 20 + - $ref: '#/components/parameters/pathUserId' responses: '200': description: Success content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/OAuth2ScopeConsentGrant' + $ref: '#/components/schemas/ListUserGrantsResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -3355,8 +2616,8 @@ paths: isCorsEnabled: true lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathUserId' + parameters: + - $ref: '#/components/parameters/pathUserId' /api/v1/users/{userId}/grants/{grantId}: get: summary: Retrieve a user grant @@ -3365,12 +2626,12 @@ paths: parameters: - name: expand in: query - description: >- - Valid value: `scope`. If specified, scope details are included in - the `_embedded` attribute. + description: 'Valid value: `scope`. If specified, scope details are included in the `_embedded` attribute.' schema: type: string example: scope + - $ref: '#/components/parameters/pathUserId' + - $ref: '#/components/parameters/pathGrantId' responses: '200': description: Success @@ -3418,9 +2679,9 @@ paths: isCorsEnabled: true lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathUserId' - - $ref: '#/components/parameters/pathGrantId' + parameters: + - $ref: '#/components/parameters/pathUserId' + - $ref: '#/components/parameters/pathGrantId' /api/v1/users/{userId}/risk: get: summary: Retrieve the user's risk @@ -3436,6 +2697,8 @@ paths: examples: UserRiskResponseExample: $ref: '#/components/examples/UserRiskResponse' + UserRiskMediumResponseExample: + $ref: '#/components/examples/UserRiskMediumResponse' UserRiskNoneResponseExample: $ref: '#/components/examples/UserRiskNoneResponse' '403': @@ -3451,13 +2714,14 @@ paths: tags: - UserRisk x-okta-lifecycle: - lifecycle: LIMITED_GA + lifecycle: GA isGenerallyAvailable: false - SKUs: - - Okta Identity Engine + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathUserId' put: summary: Upsert the user's risk - description: Upserts (creates or updates) the user risk object for a user ID + description: Upserts (creates or updates) the user risk object for a user ID. You can optionally provide a `riskReason` to describe why the risk level is being changed. If `riskReason` isn't provided, the reason defaults to `override.by.admin`. operationId: upsertUserRisk requestBody: content: @@ -3467,6 +2731,12 @@ paths: examples: RiskProviderRequestExample: $ref: '#/components/examples/UserRiskRequest' + RiskProviderRequestWithReasonExample: + $ref: '#/components/examples/UserRiskRequestWithReason' + RiskProviderRequestMediumExample: + $ref: '#/components/examples/UserRiskRequestMediumExample' + RiskProviderRequestMediumWithReasonExample: + $ref: '#/components/examples/UserRiskRequestMediumWithReasonExample' required: true responses: '200': @@ -3478,6 +2748,12 @@ paths: examples: UserRiskResponseExample: $ref: '#/components/examples/UserRiskResponse' + UserRiskResponseWithReasonExample: + $ref: '#/components/examples/UserRiskResponseWithReason' + UserRiskMediumResponseExample: + $ref: '#/components/examples/UserRiskMediumResponse' + UserRiskMediumResponseWithReasonExample: + $ref: '#/components/examples/UserRiskMediumResponseWithReason' '201': description: Created the user's risk content: @@ -3487,6 +2763,12 @@ paths: examples: UserRiskResponseExample: $ref: '#/components/examples/UserRiskResponse' + UserRiskResponseWithReasonExample: + $ref: '#/components/examples/UserRiskResponseWithReason' + UserRiskMediumResponseExample: + $ref: '#/components/examples/UserRiskMediumResponse' + UserRiskMediumResponseWithReasonExample: + $ref: '#/components/examples/UserRiskMediumResponseWithReason' '400': $ref: '#/components/responses/ErrorApiValidationFailed400' '403': @@ -3502,12 +2784,11 @@ paths: tags: - UserRisk x-okta-lifecycle: - lifecycle: LIMITED_GA + lifecycle: GA isGenerallyAvailable: false - SKUs: - - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathUserId' + SKUs: [] + parameters: + - $ref: '#/components/parameters/pathUserId' /api/v1/users/{userId}/roles: get: summary: List all user role assignments @@ -3515,23 +2796,20 @@ paths: operationId: listAssignedRolesForUser parameters: - $ref: '#/components/parameters/pathQueryRoleExpand' + - $ref: '#/components/parameters/pathUserId' responses: '200': description: Success content: application/json: schema: - type: array - items: - oneOf: - - $ref: '#/components/schemas/StandardRole' - - $ref: '#/components/schemas/CustomRole' + $ref: '#/components/schemas/ListAssignedRolesForUserResponse' examples: - Standard Roles: + Standard roles: $ref: '#/components/examples/StandardRolesListResponse' - Custom Roles: + Custom roles: $ref: '#/components/examples/StandardAndCustomRolesListResponse' - IAM-based Standard Roles: + IAM-based standard roles: $ref: '#/components/examples/IAMStandardRolesListResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' @@ -3550,42 +2828,74 @@ paths: isGenerallyAvailable: true post: summary: Assign a user role - description: >- - Assigns a [standard - role](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#standard-roles) to a user. - - - You can also assign a custom role to a user, but the preferred method to - assign a custom role to a user is to create a binding between the custom - role, the resource set, and the user. See [Create a role resource set - binding](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/RoleDResourceSetBinding/#tag/RoleDResourceSetBinding/operation/createResourceSetBinding). + description: |- + Assigns a [standard role](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#standard-roles) to a user. + You can also assign a custom role to a user, but the preferred method to assign a custom role to a user is to create a binding between the custom role, the resource set, and the user. See [Create a role resource set binding](https://developer.okta.com/docs/api/openapi/okta-management/management/roledresourcesetbinding/createresourcesetbinding). > **Notes:** - - > * The request payload is different for standard and custom role - assignments. - - > * For IAM-based standard role assignments, use the request payload for - standard roles. However, the response payload for IAM-based role - assignments is similar to the custom role's assignment response. + > * The request payload is different for standard and custom role assignments. + > * For IAM-based standard role assignments, use the request payload for standard roles. However, the response payload for IAM-based role assignments is similar to the custom role's assignment response. operationId: assignRoleToUser parameters: - name: disableNotifications description: Setting this to `true` grants the user third-party admin status in: query schema: - type: boolean - default: false + type: string + default: 'false' + - $ref: '#/components/parameters/pathUserId' x-codegen-request-body-name: assignRoleRequest requestBody: content: application/json: schema: type: object - oneOf: - - $ref: '#/components/schemas/StandardRoleAssignmentSchema' - - $ref: '#/components/schemas/CustomRoleAssignmentSchema' + x-okta-ignore-redocly-rules-for-sdk: true + discriminator: + propertyName: type + mapping: + API_ACCESS_MANAGEMENT_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + APP_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + GROUP_MEMBERSHIP_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + HELP_DESK_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + ORG_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + READ_ONLY_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + REPORT_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + SUPER_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + USER_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + WORKFLOWS_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + ACCESS_CERTIFICATIONS_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + ACCESS_REQUESTS_ADMIN: '#/components/schemas/StandardRoleAssignmentSchema' + CUSTOM: '#/components/schemas/CustomRoleAssignmentSchema' + title: Standard role + properties: + type: + type: string + description: 'Specify a [standard admin role](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#standard-roles), an [IAM-based standard role](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#iam-based-standard-roles), or `CUSTOM` for a custom role type:' + enum: + - ACCESS_CERTIFICATIONS_ADMIN + - ACCESS_REQUESTS_ADMIN + - API_ACCESS_MANAGEMENT_ADMIN + - APP_ADMIN + - GROUP_MEMBERSHIP_ADMIN + - HELP_DESK_ADMIN + - ORG_ADMIN + - READ_ONLY_ADMIN + - REPORT_ADMIN + - SUPER_ADMIN + - USER_ADMIN + - WORKFLOWS_ADMIN + resource-set: + type: string + description: Resource set ID + role: + type: string + description: Custom role ID + required: + - type + - role + - resource-set required: true responses: '201': @@ -3594,15 +2904,92 @@ paths: application/json: schema: type: object - oneOf: - - $ref: '#/components/schemas/StandardRole' - - $ref: '#/components/schemas/CustomRole' + x-okta-ignore-redocly-rules-for-sdk: true + discriminator: + propertyName: type + mapping: + API_ACCESS_MANAGEMENT_ADMIN: '#/components/schemas/StandardRole' + APP_ADMIN: '#/components/schemas/StandardRole' + GROUP_MEMBERSHIP_ADMIN: '#/components/schemas/StandardRole' + HELP_DESK_ADMIN: '#/components/schemas/StandardRole' + ORG_ADMIN: '#/components/schemas/StandardRole' + READ_ONLY_ADMIN: '#/components/schemas/StandardRole' + REPORT_ADMIN: '#/components/schemas/StandardRole' + SUPER_ADMIN: '#/components/schemas/StandardRole' + USER_ADMIN: '#/components/schemas/StandardRole' + WORKFLOWS_ADMIN: '#/components/schemas/CustomRole' + ACCESS_CERTIFICATIONS_ADMIN: '#/components/schemas/CustomRole' + ACCESS_REQUESTS_ADMIN: '#/components/schemas/CustomRole' + CUSTOM: '#/components/schemas/CustomRole' + title: Standard role assignment + properties: + assignmentType: + $ref: '#/components/schemas/RoleAssignmentType' + created: + type: string + description: Timestamp when the object was created + format: date-time + readOnly: true + id: + type: string + description: Role assignment ID + readOnly: true + label: + type: string + description: Label for the role assignment + readOnly: true + lastUpdated: + type: string + description: Timestamp when the object was last updated + format: date-time + readOnly: true + status: + type: string + enum: + - ACTIVE + - INACTIVE + description: Status of the role assignment + type: + $ref: '#/components/schemas/RoleType' + _embedded: + type: object + description: Optional embedded resources for the role assignment + properties: + targets: + type: object + description: Targets configured for the role assignment + properties: + groups: + type: array + description: Group targets + items: + $ref: '#/components/schemas/Group' + catalog: + description: App targets + properties: + apps: + type: array + items: + $ref: '#/components/schemas/CatalogApplication' + type: object + _links: + $ref: '#/components/schemas/LinksAssignee' + resource-set: + type: string + description: Resource set ID + readOnly: true + role: + type: string + description: Role ID + readOnly: true + required: + - type examples: - Standard Roles: + Standard roles: $ref: '#/components/examples/StandardRoleResponseUser' - Custom Roles: + Custom roles: $ref: '#/components/examples/CustomRoleResponseUser' - IAM-based Standard Roles: + IAM-based standard roles: $ref: '#/components/examples/IAMStandardRoleResponseUser' '400': $ref: '#/components/responses/ErrorApiValidationFailed400' @@ -3621,16 +3008,10 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathUserId' /api/v1/users/{userId}/roles/{roleAssignmentId}: get: summary: Retrieve a user role assignment - description: >- - Retrieves a role assigned to a user (identified by `userId`). The - `roleAssignmentId` parameter is the unique identifier for either a - standard role assignment object or a custom role resource set binding - object. + description: Retrieves a role assigned to a user (identified by `userId`). The `roleAssignmentId` parameter is the unique identifier for either a standard role assignment object or a custom role resource set binding object. operationId: getUserAssignedRole responses: '200': @@ -3638,15 +3019,93 @@ paths: content: application/json: schema: - oneOf: - - $ref: '#/components/schemas/StandardRole' - - $ref: '#/components/schemas/CustomRole' + discriminator: + propertyName: type + mapping: + API_ACCESS_MANAGEMENT_ADMIN: '#/components/schemas/StandardRole' + APP_ADMIN: '#/components/schemas/StandardRole' + GROUP_MEMBERSHIP_ADMIN: '#/components/schemas/StandardRole' + HELP_DESK_ADMIN: '#/components/schemas/StandardRole' + ORG_ADMIN: '#/components/schemas/StandardRole' + READ_ONLY_ADMIN: '#/components/schemas/StandardRole' + REPORT_ADMIN: '#/components/schemas/StandardRole' + SUPER_ADMIN: '#/components/schemas/StandardRole' + USER_ADMIN: '#/components/schemas/StandardRole' + WORKFLOWS_ADMIN: '#/components/schemas/CustomRole' + ACCESS_CERTIFICATIONS_ADMIN: '#/components/schemas/CustomRole' + ACCESS_REQUESTS_ADMIN: '#/components/schemas/CustomRole' + CUSTOM: '#/components/schemas/CustomRole' + title: Standard role assignment + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + assignmentType: + $ref: '#/components/schemas/RoleAssignmentType' + created: + type: string + description: Timestamp when the object was created + format: date-time + readOnly: true + id: + type: string + description: Role assignment ID + readOnly: true + label: + type: string + description: Label for the role assignment + readOnly: true + lastUpdated: + type: string + description: Timestamp when the object was last updated + format: date-time + readOnly: true + status: + type: string + enum: + - ACTIVE + - INACTIVE + description: Status of the role assignment + type: + $ref: '#/components/schemas/RoleType' + _embedded: + type: object + description: Optional embedded resources for the role assignment + properties: + targets: + type: object + description: Targets configured for the role assignment + properties: + groups: + type: array + description: Group targets + items: + $ref: '#/components/schemas/Group' + catalog: + description: App targets + properties: + apps: + type: array + items: + $ref: '#/components/schemas/CatalogApplication' + type: object + _links: + $ref: '#/components/schemas/LinksAssignee' + resource-set: + type: string + description: Resource set ID + readOnly: true + role: + type: string + description: Role ID + readOnly: true + required: + - type examples: - Standard Roles: + Standard roles: $ref: '#/components/examples/StandardRoleResponseUser' - Custom Roles: + Custom roles: $ref: '#/components/examples/CustomRoleResponseUser' - IAM-based Standard Roles: + IAM-based standard roles: $ref: '#/components/examples/IAMStandardRoleResponseUser' '403': $ref: '#/components/responses/ErrorAccessDenied403' @@ -3663,11 +3122,12 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathUserId' + - $ref: '#/components/parameters/pathRoleAssignmentId' delete: summary: Unassign a user role - description: >- - Unassigns a role assignment (identified by `roleAssignmentId`) from a - user (identified by `userId`) + description: Unassigns a role assignment (identified by `roleAssignmentId`) from a user (identified by `userId`) operationId: unassignRoleFromUser responses: '204': @@ -3688,15 +3148,13 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathUserId' - - $ref: '#/components/parameters/pathRoleAssignmentId' + parameters: + - $ref: '#/components/parameters/pathUserId' + - $ref: '#/components/parameters/pathRoleAssignmentId' /api/v1/users/{userId}/roles/{roleAssignmentId}/governance: get: summary: Retrieve all user role governance sources - description: >- - Retrieves the governance sources of a role (identified by - `roleAssignmentId`) that's assigned to a user (identified by `userId`) + description: Retrieves the governance sources of a role (identified by `roleAssignmentId`) that's assigned to a user (identified by `userId`) operationId: getUserAssignedRoleGovernance responses: '200': @@ -3724,16 +3182,13 @@ paths: lifecycle: GA isGenerallyAvailable: false SKUs: [] - parameters: - - $ref: '#/components/parameters/pathUserId' - - $ref: '#/components/parameters/pathRoleAssignmentId' + parameters: + - $ref: '#/components/parameters/pathUserId' + - $ref: '#/components/parameters/pathRoleAssignmentId' /api/v1/users/{userId}/roles/{roleAssignmentId}/governance/{grantId}: get: summary: Retrieve a user role governance source - description: >- - Retrieves a governance source (identified by `grantId`) for a role - (identified by `roleAssignmentId`) that's assigned to a user (identified - by `userId`) + description: Retrieves a governance source (identified by `grantId`) for a role (identified by `roleAssignmentId`) that's assigned to a user (identified by `userId`) operationId: getRoleAssignmentGovernanceGrant responses: '200': @@ -3744,8 +3199,7 @@ paths: $ref: '#/components/schemas/RoleGovernanceSource' examples: Example Response: - $ref: >- - #/components/examples/GetRoleAssignmentGovernanceGrantResponse + $ref: '#/components/examples/GetRoleAssignmentGovernanceGrantResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -3762,17 +3216,14 @@ paths: lifecycle: GA isGenerallyAvailable: false SKUs: [] - parameters: - - $ref: '#/components/parameters/pathUserId' - - $ref: '#/components/parameters/pathRoleAssignmentId' - - $ref: '#/components/parameters/pathGrantId' + parameters: + - $ref: '#/components/parameters/pathUserId' + - $ref: '#/components/parameters/pathRoleAssignmentId' + - $ref: '#/components/parameters/pathGrantId' /api/v1/users/{userId}/roles/{roleAssignmentId}/governance/{grantId}/resources: get: summary: Retrieve the user role governance source resources - description: >- - Retrieves the resources of a governance source (identified by `grantId`) - for a role (identified by `roleAssignmentId`) that's assigned to a user - (identified by `userId`) + description: Retrieves the resources of a governance source (identified by `grantId`) for a role (identified by `roleAssignmentId`) that's assigned to a user (identified by `userId`) operationId: getRoleAssignmentGovernanceGrantResources responses: '200': @@ -3783,8 +3234,7 @@ paths: $ref: '#/components/schemas/RoleGovernanceResources' examples: Example Response: - $ref: >- - #/components/examples/GetRoleAssignmentGovernanceGrantResources + $ref: '#/components/examples/GetRoleAssignmentGovernanceGrantResources' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -3801,31 +3251,27 @@ paths: lifecycle: GA isGenerallyAvailable: false SKUs: [] - parameters: - - $ref: '#/components/parameters/pathUserId' - - $ref: '#/components/parameters/pathRoleAssignmentId' - - $ref: '#/components/parameters/pathGrantId' + parameters: + - $ref: '#/components/parameters/pathUserId' + - $ref: '#/components/parameters/pathRoleAssignmentId' + - $ref: '#/components/parameters/pathGrantId' /api/v1/users/{userId}/roles/{roleAssignmentId}/targets/catalog/apps: get: summary: List all admin role app targets - description: >- - Lists all app targets for an `APP_ADMIN` role assigned to a user. The - response is a list that includes OIN-cataloged apps or app instances. - The response payload for an app instance contains the `id` property, but - an OIN-cataloged app payload doesn't. + description: Lists all app targets for an `APP_ADMIN` role assigned to a user. The response is a list that includes OIN-cataloged apps or app instances. The response payload for an app instance contains the `id` property, but an OIN-cataloged app payload doesn't. operationId: listApplicationTargetsForApplicationAdministratorRoleForUser parameters: - $ref: '#/components/parameters/queryAfter' - $ref: '#/components/parameters/queryLimit' + - $ref: '#/components/parameters/pathUserId' + - $ref: '#/components/parameters/pathRoleAssignmentId' responses: '200': description: Success content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/CatalogApplication' + $ref: '#/components/schemas/ListApplicationTargetsForApplicationAdministratorRoleForUserResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -3864,27 +3310,18 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathUserId' - - $ref: '#/components/parameters/pathRoleAssignmentId' + parameters: + - $ref: '#/components/parameters/pathUserId' + - $ref: '#/components/parameters/pathRoleAssignmentId' /api/v1/users/{userId}/roles/{roleAssignmentId}/targets/catalog/apps/{appName}: put: summary: Assign an admin role app target - description: > - Assigns an OIN app target for an `APP_ADMIN` role assignment to an admin - user. When you assign the first app target, you reduce the scope of the - role assignment. - - The role no longer applies to all app targets, but applies only to the - specified target. + description: | + Assigns an OIN app target for an `APP_ADMIN` role assignment to an admin user. When you assign the first app target, you reduce the scope of the role assignment. + The role no longer applies to all app targets, but applies only to the specified target. - - Assigning an OIN app target overrides any existing app instance targets - of the OIN app. - - For example, if a user was assigned to administer a specific Facebook - instance, a successful request to add an OIN app target with `facebook` - for `appName` makes that user the admin for all Facebook instances. + Assigning an OIN app target overrides any existing app instance targets of the OIN app. + For example, if a user was assigned to administer a specific Facebook instance, a successful request to add an OIN app target with `facebook` for `appName` makes that user the admin for all Facebook instances. operationId: assignAppTargetToAdminRoleForUser responses: '204': @@ -3905,18 +3342,17 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathUserId' + - $ref: '#/components/parameters/pathRoleAssignmentId' + - $ref: '#/components/parameters/pathAppName' delete: summary: Unassign an admin role app target - description: > - Unassigns an OIN app target from an `APP_ADMIN` role assignment to an - admin user. + description: | + Unassigns an OIN app target from an `APP_ADMIN` role assignment to an admin user. - - > **Note:** You can't remove the last OIN app target from a role - assignment since this causes an exception. - - > If you need a role assignment that applies to all apps, delete the - `APP_ADMIN` role assignment to the user and recreate a new one. + > **Note:** You can't remove the last OIN app target from a role assignment since this causes an exception. + > If you need a role assignment that applies to all apps, delete the `APP_ADMIN` role assignment to the user and recreate a new one. operationId: unassignAppTargetFromAppAdminRoleForUser responses: '204': @@ -3937,29 +3373,19 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathUserId' - - $ref: '#/components/parameters/pathRoleAssignmentId' - - $ref: '#/components/parameters/pathAppName' + parameters: + - $ref: '#/components/parameters/pathUserId' + - $ref: '#/components/parameters/pathRoleAssignmentId' + - $ref: '#/components/parameters/pathAppName' /api/v1/users/{userId}/roles/{roleAssignmentId}/targets/catalog/apps/{appName}/{appId}: put: summary: Assign an admin role app instance target - description: > - Assigns an app instance target to an `APP_ADMIN` role assignment to an - admin user. When you assign the first OIN app or app instance target, - you reduce the scope of the role assignment. + description: | + Assigns an app instance target to an `APP_ADMIN` role assignment to an admin user. When you assign the first OIN app or app instance target, you reduce the scope of the role assignment. + The role no longer applies to all app targets, but applies only to the specified target. - The role no longer applies to all app targets, but applies only to the - specified target. - - - > **Note:** You can target a mixture of both OIN app and app instance - targets, but can't assign permissions to manage all instances of an OIN - app and then assign a subset of permission to the same OIN app. - - > For example, you can't specify that an admin has access to manage all - instances of the Salesforce app and then also manage specific - configurations of the Salesforce app. + > **Note:** You can target a mixture of both OIN app and app instance targets, but can't assign permissions to manage all instances of an OIN app and then assign a subset of permission to the same OIN app. + > For example, you can't specify that an admin has access to manage all instances of the Salesforce app and then also manage specific configurations of the Salesforce app. operationId: assignAppInstanceTargetToAppAdminRoleForUser responses: '204': @@ -3980,18 +3406,18 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathUserId' + - $ref: '#/components/parameters/pathRoleAssignmentId' + - $ref: '#/components/parameters/pathAppName' + - $ref: '#/components/parameters/pathAppId' delete: summary: Unassign an admin role app instance target - description: >- - Unassigns an app instance target from an `APP_ADMIN` role assignment to - an admin user. - - - > **Note:** You can't remove the last app instance target from a role - assignment since this causes an exception. + description: |- + Unassigns an app instance target from an `APP_ADMIN` role assignment to an admin user. - > If you need a role assignment that applies to all apps, delete the - `APP_ADMIN` role assignment and recreate a new one. + > **Note:** You can't remove the last app instance target from a role assignment since this causes an exception. + > If you need a role assignment that applies to all apps, delete the `APP_ADMIN` role assignment and recreate a new one. operationId: unassignAppInstanceTargetFromAdminRoleForUser responses: '204': @@ -4012,33 +3438,30 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathUserId' - - $ref: '#/components/parameters/pathRoleAssignmentId' - - $ref: '#/components/parameters/pathAppName' - - $ref: '#/components/parameters/pathAppId' + parameters: + - $ref: '#/components/parameters/pathUserId' + - $ref: '#/components/parameters/pathRoleAssignmentId' + - $ref: '#/components/parameters/pathAppName' + - $ref: '#/components/parameters/pathAppId' /api/v1/users/{userId}/roles/{roleAssignmentId}/targets/groups: get: summary: List all admin role group targets - description: > - Lists all group targets for a `USER_ADMIN`, `HELP_DESK_ADMIN`, or - `GROUP_MEMBERSHIP_ADMIN` role assignment to an admin user. - - If the role isn't scoped to specific group targets, an empty array `[]` - is returned. + description: | + Lists all group targets for a `USER_ADMIN`, `HELP_DESK_ADMIN`, or `GROUP_MEMBERSHIP_ADMIN` role assignment to an admin user. + If the role isn't scoped to specific group targets, an empty array `[]` is returned. operationId: listGroupTargetsForRole parameters: - $ref: '#/components/parameters/queryAfter' - $ref: '#/components/parameters/queryLimit' + - $ref: '#/components/parameters/pathUserId' + - $ref: '#/components/parameters/pathRoleAssignmentId' responses: '200': description: Success content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/Group' + $ref: '#/components/schemas/ListGroupTargetsForRoleResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -4054,19 +3477,12 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathUserId' - - $ref: '#/components/parameters/pathRoleAssignmentId' /api/v1/users/{userId}/roles/{roleAssignmentId}/targets/groups/{groupId}: put: summary: Assign an admin role group target - description: > - Assigns a group target for a `USER_ADMIN`, `HELP_DESK_ADMIN`, or - `GROUP_MEMBERSHIP_ADMIN` role assignment to an admin user. - - When you assign the first group target, you reduce the scope of the role - assignment. The role no longer applies to all targets but applies only - to the specified target. + description: | + Assigns a group target for a `USER_ADMIN`, `HELP_DESK_ADMIN`, or `GROUP_MEMBERSHIP_ADMIN` role assignment to an admin user. + When you assign the first group target, you reduce the scope of the role assignment. The role no longer applies to all targets but applies only to the specified target. operationId: assignGroupTargetToUserRole responses: '204': @@ -4087,18 +3503,17 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathUserId' + - $ref: '#/components/parameters/pathRoleAssignmentId' + - $ref: '#/components/parameters/pathGroupId' delete: summary: Unassign an admin role group target - description: > - Unassigns a group target from a `USER_ADMIN`, `HELP_DESK_ADMIN`, or - `GROUP_MEMBERSHIP_ADMIN` role assignment to an admin user. - + description: | + Unassigns a group target from a `USER_ADMIN`, `HELP_DESK_ADMIN`, or `GROUP_MEMBERSHIP_ADMIN` role assignment to an admin user. - > **Note:** You can't remove the last group target from a role - assignment since this causes an exception. - - > If you need a role assignment that applies to all groups, delete the - role assignment to the user and recreate a new one. + > **Note:** You can't remove the last group target from a role assignment since this causes an exception. + > If you need a role assignment that applies to all groups, delete the role assignment to the user and recreate a new one. operationId: unassignGroupTargetFromUserAdminRole responses: '204': @@ -4119,34 +3534,30 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathUserId' - - $ref: '#/components/parameters/pathRoleAssignmentId' - - $ref: '#/components/parameters/pathGroupId' + parameters: + - $ref: '#/components/parameters/pathUserId' + - $ref: '#/components/parameters/pathRoleAssignmentId' + - $ref: '#/components/parameters/pathGroupId' /api/v1/users/{userId}/roles/{roleIdOrEncodedRoleId}/targets: get: summary: Retrieve a role target by assignment type - description: > - Retrieves all role targets for an `APP_ADMIN`, `USER_ADMIN`, - `HELP_DESK_ADMIN`, or `GROUP_MEMBERSHIP_ADMIN` role assignment to an - admin user by user or group assignment type. - - If the role isn't scoped to specific group targets or any app targets, - an empty array `[]` is returned. + description: | + Retrieves all role targets for an `APP_ADMIN`, `USER_ADMIN`, `HELP_DESK_ADMIN`, or `GROUP_MEMBERSHIP_ADMIN` role assignment to an admin user by user or group assignment type. + If the role isn't scoped to specific group targets or any app targets, an empty array `[]` is returned. operationId: getRoleTargetsByUserIdAndRoleId parameters: - $ref: '#/components/parameters/assignmentType' - $ref: '#/components/parameters/queryAfter' - $ref: '#/components/parameters/queryLimit' + - $ref: '#/components/parameters/pathUserId' + - $ref: '#/components/parameters/pathRoleIdOrEncodedRoleId' responses: '200': description: Success content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/RoleTarget' + $ref: '#/components/schemas/GetRoleTargetsByUserIdAndRoleIdResponse' examples: Group Target: $ref: '#/components/examples/RoleTargetGroupResponse' @@ -4169,40 +3580,31 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathUserId' - - $ref: '#/components/parameters/pathRoleIdOrEncodedRoleId' /api/v1/users/{userId}/sessions: delete: summary: Revoke all user sessions - description: >- - Revokes all active identity provider sessions of the user. This forces - the user to authenticate on the next operation. Optionally revokes - OpenID Connect and OAuth refresh and access tokens issued to the user. - - - You can also clear the user's remembered factors for all devices using - the `forgetDevices` parameter. See - [forgetDevices](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserSessions/#tag/UserSessions/operation/revokeUserSessions!in=query&path=forgetDevices&t=request). + description: |- + Revokes all active identity provider sessions of the user. This forces the user to authenticate on the next operation. Optionally revokes OpenID Connect and OAuth refresh and access tokens issued to the user. - > **Note:** This operation doesn't clear the sessions created for web or - native apps. + You can also clear the user's remembered factors for all devices using the `forgetDevices` parameter. See [forgetDevices](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserSessions/#tag/UserSessions/operation/revokeUserSessions!in=query&path=forgetDevices&t=request). + > **Note:** This operation doesn't clear the sessions created for web or native apps. operationId: revokeUserSessions parameters: - name: oauthTokens in: query description: Revokes issued OpenID Connect and OAuth refresh and access tokens schema: - type: boolean - default: false + type: string + default: 'false' - name: forgetDevices in: query description: |- Clears the user's remembered factors for all devices. > **Note:** This parameter defaults to false in Classic Engine. schema: - type: boolean - default: true + type: string + default: 'true' + - $ref: '#/components/parameters/pathUserId' responses: '204': description: No Content @@ -4223,14 +3625,10 @@ paths: isCorsEnabled: true lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathUserId' /api/v1/users/{userId}/subscriptions: get: summary: List all subscriptions for a user - description: >- - Lists all subscriptions available to a specified user. Returns an - `AccessDeniedException` message if requests are made for another user. + description: Lists all subscriptions available to a specified user. Returns an `AccessDeniedException` message if requests are made for another user. operationId: listSubscriptionsUser parameters: - in: path @@ -4245,9 +3643,7 @@ paths: content: application/json: schema: - items: - $ref: '#/components/schemas/Subscription' - type: array + $ref: '#/components/schemas/ListSubscriptionsUserResponse' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -4263,15 +3659,10 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathUserId' /api/v1/users/{userId}/subscriptions/{notificationType}: get: summary: Retrieve a subscription for a user - description: >- - Retrieves a subscription by `notificationType` for a specified user. - Returns an `AccessDeniedException` message if requests are made for - another user. + description: Retrieves a subscription by `notificationType` for a specified user. Returns an `AccessDeniedException` message if requests are made for another user. operationId: getSubscriptionsNotificationTypeUser parameters: - in: path @@ -4303,15 +3694,10 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathUserId' - - $ref: '#/components/parameters/pathNotificationType' /api/v1/users/{userId}/subscriptions/{notificationType}/subscribe: post: summary: Subscribe a user to a specific notification type - description: >- - Subscribes the current user to a specified notification type. Returns an - `AccessDeniedException` message if requests are made for another user. + description: Subscribes the current user to a specified notification type. Returns an `AccessDeniedException` message if requests are made for another user. operationId: subscribeByNotificationTypeUser parameters: - in: path @@ -4339,16 +3725,10 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathUserId' - - $ref: '#/components/parameters/pathNotificationType' /api/v1/users/{userId}/subscriptions/{notificationType}/unsubscribe: post: summary: Unsubscribe a user from a specific notification type - description: >- - Unsubscribes the current user from a specified notification type. - Returns an `AccessDeniedException` message if requests are made for - another user. + description: Unsubscribes the current user from a specified notification type. Returns an `AccessDeniedException` message if requests are made for another user. operationId: unsubscribeByNotificationTypeUser parameters: - in: path @@ -4376,12 +3756,10 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathUserId' - - $ref: '#/components/parameters/pathNotificationType' components: schemas: User: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: activated: @@ -4422,9 +3800,7 @@ components: $ref: '#/components/schemas/UserProfile' realmId: type: string - description: >- - The ID of the realm in which the user is residing. See - [Realms](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Realm/). + description: The ID of the realm in which the user is residing. See [Realms](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/realm). example: guo1bfiNtSnZYILxO0g4 readOnly: true status: @@ -4437,9 +3813,7 @@ components: nullable: true transitioningToStatus: type: string - description: >- - The target status of an in-progress asynchronous status transition. - This property is only returned if the user's state is transitioning. + description: The target status of an in-progress asynchronous status transition. This property is only returned if the user's state is transitioning. readOnly: true nullable: true enum: @@ -4448,245 +3822,979 @@ components: - PROVISIONED type: type: object - description: >- - The user type that determines the schema for the user's profile. The - `type` property is a map that identifies the [User - Types](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/#tag/UserType). - + description: |- + The user type that determines the schema for the user's profile. The `type` property is a map that identifies the [User Types](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/#tag/UserType). - Currently it contains a single element, `id`. It can be specified - when creating a new user, and ca be updated by an admin on a full - replace of an existing user (but not a partial update). + Currently it contains a single element, `id`. It can be specified when creating a new user, and can be updated by an admin on a full replace of an existing user (but not a partial update). properties: id: type: string description: The ID of the user type _embedded: type: object - description: >- - Embedded resources related to the user using the [JSON Hypertext - Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification + description: Embedded resources related to the user using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification additionalProperties: type: object properties: {} readOnly: true _links: - description: >- - Specifies link relations (see [Web - Linking](https://datatracker.ietf.org/doc/html/rfc8288) available - for the current status of a user. - - The links object is used for dynamic discovery of related resources, - lifecycle operations, and credential operations. The links object is - read-only. - - - For an individual user result, the links object contains a full set - of link relations available for that user as determined by your - policies. - - For a collection of users, the links object contains only the `self` - link. Operations that return a collection of users include [List all - users](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#tag/User/operation/listUsers) - and [List all group member - users](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/Group/#tag/Group/operation/listGroupUsers). - allOf: - - $ref: '#/components/schemas/LinksSelf' - - type: object - properties: - self: - description: URL to the individual user - allOf: - - $ref: '#/components/schemas/HrefObject' - activate: - description: URL to activate the user - allOf: - - $ref: '#/components/schemas/HrefObject' - resetPassword: - description: URL to reset the user's password - allOf: - - $ref: '#/components/schemas/HrefObject' - resetFactors: - description: URL to reset the user's factors - allOf: - - $ref: '#/components/schemas/HrefObject' - expirePassword: - description: URL to expire the user's password - allOf: - - $ref: '#/components/schemas/HrefObject' - forgotPassword: - description: URL to initiate a forgot password operation - allOf: - - $ref: '#/components/schemas/HrefObject' - changeRecoveryQuestion: - description: URL to change the user's recovery question - allOf: - - $ref: '#/components/schemas/HrefObject' - deactivate: - description: URL to deactivate a user - allOf: - - $ref: '#/components/schemas/HrefObject' - reactivate: - description: URL to reactivate the user - allOf: - - $ref: '#/components/schemas/HrefObject' - changePassword: - description: URL to change the user's password - allOf: - - $ref: '#/components/schemas/HrefObject' - schema: - description: URL to the user's profile schema - allOf: - - $ref: '#/components/schemas/HrefObject' - suspend: - description: URL to suspend the user - allOf: - - $ref: '#/components/schemas/HrefObject' - unsuspend: - description: URL to unsuspend the user - allOf: - - $ref: '#/components/schemas/HrefObject' - unlock: - description: URL to unlock the locked-out user - allOf: - - $ref: '#/components/schemas/HrefObject' - type: - description: URL to the user type - allOf: - - $ref: '#/components/schemas/HrefObject' - - readOnly: true - Error: - title: Error - type: object - properties: - errorCauses: - type: array - items: - $ref: '#/components/schemas/ErrorCause' - errorCode: - type: string - description: An Okta code for this type of error - errorId: - type: string - description: >- - A unique identifier for this error. This can be used by Okta Support - to help with troubleshooting. - errorLink: - type: string - description: An Okta code for this type of error - errorSummary: - type: string - description: >- - A short description of what caused this error. Sometimes this - contains dynamically-generated information about your specific - error. - UserNextLogin: - type: string - enum: - - changePassword - CreateUserRequest: - type: object - properties: - credentials: - $ref: '#/components/schemas/UserCredentialsWritable' - groupIds: - type: array - description: >- - The list of group IDs of groups that the user is added to at the - time of creation - items: - type: string - profile: - $ref: '#/components/schemas/UserProfile' - realmId: - type: string - description: >- - The ID of the realm in which the user is residing. See - [Realms](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Realm/). - example: guo1bfiNtSnZYILxO0g4 - type: - type: object - description: >- - The ID of the user type. Add this value if you want to create a user - with a non-default [User - Type](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/). - - The user type determines which - [schema](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/) - applies to that user. After a user has been created, the user can + description: |- + Specifies link relations (see [Web Linking](https://datatracker.ietf.org/doc/html/rfc8288) available for the current status of a user. + The links object is used for dynamic discovery of related resources, lifecycle operations, and credential operations. The links object is read-only. - only be assigned a different user type by an administrator through a - full replacement (`PUT`) operation. - properties: - id: - type: string - description: The ID of the user type - required: - - profile - KeepCurrent: - type: object - properties: - keepCurrent: - description: Skip deleting the user's current session when set to `true` - type: boolean - default: true - UserGetSingleton: - allOf: - - $ref: '#/components/schemas/User' - - type: object + For an individual user result, the links object contains a full set of link relations available for that user as determined by your policies. + For a collection of users, the links object contains only the `self` link. Operations that return a collection of users include [List all users](https://developer.okta.com/docs/api/openapi/okta-management/management/user/listusers) and [List all group member users](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Group/#tag/Group/operation/listGroupUsers). + type: object properties: - _embedded: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + activate: + description: URL to activate the user + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true type: object - description: >- - The embedded resources related to the object if the `expand` - query parameter is specified properties: - blocks: - type: array - description: A list of access block details for the user account - items: - $ref: '#/components/schemas/UserBlock' - UpdateUserRequest: - type: object - properties: - credentials: - $ref: '#/components/schemas/UserCredentials' - profile: - $ref: '#/components/schemas/UserProfile' - realmId: - type: string - description: >- - The ID of the realm in which the user is residing. See - [Realms](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Realm/). - example: guo1bfiNtSnZYILxO0g4 - AssignedAppLink: - type: object - properties: - appAssignmentId: - type: string - readOnly: true - appInstanceId: - type: string - readOnly: true - appName: - type: string - readOnly: true - credentialsSetup: - type: boolean - readOnly: true - hidden: - type: boolean - readOnly: true - id: - type: string - readOnly: true - label: - type: string - readOnly: true - linkUrl: - type: string + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + resetPassword: + description: URL to reset the user's password + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + resetFactors: + description: URL to reset the user's factors + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + expirePassword: + description: URL to expire the user's password + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + forgotPassword: + description: URL to initiate a forgot password operation + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + changeRecoveryQuestion: + description: URL to change the user's recovery question + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + deactivate: + description: URL to deactivate a user + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + reactivate: + description: URL to reactivate the user + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + changePassword: + description: URL to change the user's password + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + schema: + description: URL to the user's profile schema + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + suspend: + description: URL to suspend the user + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + unsuspend: + description: URL to unsuspend the user + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + unlock: + description: URL to unlock the locked-out user + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + type: + description: URL to the user type + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + readOnly: true + Error: + title: Error + type: object + properties: + errorCauses: + type: array + items: + $ref: '#/components/schemas/ErrorCause' + errorCode: + type: string + description: An Okta code for this type of error + errorId: + type: string + description: A unique identifier for this error. This can be used by Okta Support to help with troubleshooting. + errorLink: + type: string + description: An Okta code for this type of error + errorSummary: + type: string + description: A short description of what caused this error. Sometimes this contains dynamically-generated information about your specific error. + UserNextLogin: + type: string + enum: + - changePassword + CreateUserRequest: + type: object + properties: + credentials: + $ref: '#/components/schemas/UserCredentialsWritable' + groupIds: + type: array + description: The list of group IDs of groups that the user is added to at the time of creation + items: + type: string + profile: + $ref: '#/components/schemas/UserProfile' + realmId: + type: string + description: The ID of the realm in which the user is residing. See [Realms](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/realm). + example: guo1bfiNtSnZYILxO0g4 + type: + type: object + description: |- + The ID of the user type. Add this value if you want to create a user with a non-default [User Type](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/). + The user type determines which [schema](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/) applies to that user. After a user has been created, the user can + only be assigned a different user type by an administrator through a full replacement (`PUT`) operation. + properties: + id: + type: string + description: The ID of the user type + required: + - profile + UserGetSingleton: + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + activated: + type: string + description: The timestamp when the user status transitioned to `ACTIVE` + format: date-time + readOnly: true + nullable: true + created: + type: string + description: The timestamp when the user was created + format: date-time + readOnly: true + credentials: + $ref: '#/components/schemas/UserCredentials' + id: + type: string + description: The unique key for the user + readOnly: true + lastLogin: + type: string + description: The timestamp of the last login + format: date-time + readOnly: true + nullable: true + lastUpdated: + type: string + description: The timestamp when the user was last updated + format: date-time + readOnly: true + passwordChanged: + type: string + description: The timestamp when the user's password was last updated + format: date-time + readOnly: true + nullable: true + profile: + $ref: '#/components/schemas/UserProfile' + realmId: + type: string + description: The ID of the realm in which the user is residing. See [Realms](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/realm). + example: guo1bfiNtSnZYILxO0g4 + readOnly: true + status: + $ref: '#/components/schemas/UserStatus' + statusChanged: + type: string + description: The timestamp when the status of the user last changed + format: date-time + readOnly: true + nullable: true + transitioningToStatus: + type: string + description: The target status of an in-progress asynchronous status transition. This property is only returned if the user's state is transitioning. + readOnly: true + nullable: true + enum: + - ACTIVE + - DEPROVISIONED + - PROVISIONED + type: + type: object + description: |- + The user type that determines the schema for the user's profile. The `type` property is a map that identifies the [User Types](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/#tag/UserType). + + Currently it contains a single element, `id`. It can be specified when creating a new user, and can be updated by an admin on a full replace of an existing user (but not a partial update). + properties: + id: + type: string + description: The ID of the user type + _embedded: + type: object + description: Embedded resources related to the user using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification + additionalProperties: + type: object + properties: {} + readOnly: true + _links: + description: |- + Specifies link relations (see [Web Linking](https://datatracker.ietf.org/doc/html/rfc8288) available for the current status of a user. + The links object is used for dynamic discovery of related resources, lifecycle operations, and credential operations. The links object is read-only. + + For an individual user result, the links object contains a full set of link relations available for that user as determined by your policies. + For a collection of users, the links object contains only the `self` link. Operations that return a collection of users include [List all users](https://developer.okta.com/docs/api/openapi/okta-management/management/user/listusers) and [List all group member users](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Group/#tag/Group/operation/listGroupUsers). + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + activate: + description: URL to activate the user + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + resetPassword: + description: URL to reset the user's password + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + resetFactors: + description: URL to reset the user's factors + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + expirePassword: + description: URL to expire the user's password + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + forgotPassword: + description: URL to initiate a forgot password operation + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + changeRecoveryQuestion: + description: URL to change the user's recovery question + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + deactivate: + description: URL to deactivate a user + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + reactivate: + description: URL to reactivate the user + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + changePassword: + description: URL to change the user's password + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + schema: + description: URL to the user's profile schema + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + suspend: + description: URL to suspend the user + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + unsuspend: + description: URL to unsuspend the user + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + unlock: + description: URL to unlock the locked-out user + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + type: + description: URL to the user type + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + readOnly: true + UpdateUserRequest: + type: object + properties: + credentials: + $ref: '#/components/schemas/UserCredentials' + profile: + $ref: '#/components/schemas/UserProfile' + realmId: + type: string + description: The ID of the realm in which the user is residing. See [Realms](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/realm). + example: guo1bfiNtSnZYILxO0g4 + type: + type: object + description: |- + The ID of the user type. Add this value if you want to create a user with a non-default [User Type](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/). + The user type determines which [schema](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/) applies to that user. After a user has been created, the user can + only be assigned a different user type by an admin through a full replacement (`PUT`) operation. + properties: + id: + type: string + description: The ID of the user type + AssignedAppLink: + type: object + properties: + appAssignmentId: + type: string + readOnly: true + appInstanceId: + type: string + readOnly: true + appName: + type: string + readOnly: true + credentialsSetup: + type: boolean + readOnly: true + hidden: + type: boolean + readOnly: true + id: + type: string + readOnly: true + label: + type: string + readOnly: true + linkUrl: + type: string readOnly: true logoUrl: type: string @@ -4695,11 +4803,7 @@ components: type: integer readOnly: true UserBlock: - description: >- - Describes how the account is blocked from access. If `appliesTo` is - `ANY_DEVICES`, then the account is blocked for all devices. If - `appliesTo` is `UNKNOWN_DEVICES`, then the account is only blocked for - unknown devices. + description: Describes how the account is blocked from access. If `appliesTo` is `ANY_DEVICES`, then the account is blocked for all devices. If `appliesTo` is `UNKNOWN_DEVICES`, then the account is only blocked for unknown devices. type: object properties: appliesTo: @@ -4719,6 +4823,7 @@ components: enum: - DEVICE_BASED Group: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: created: @@ -4754,30 +4859,63 @@ components: _embedded: type: object description: Embedded resources related to the group - additionalProperties: - type: object - properties: {} readOnly: true - _links: - description: >- - [Discoverable - resources](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Group/#tag/Group/operation/listGroups!c=200&path=_links&t=response) - related to the group - allOf: - - $ref: '#/components/schemas/LinksSelf' - - properties: - apps: - $ref: '#/components/schemas/HrefObject' - logo: - type: array - items: - $ref: '#/components/schemas/HrefObject' - source: - $ref: '#/components/schemas/HrefObject' - users: - $ref: '#/components/schemas/HrefObject' + properties: + stats: + description: Statistics about the group type: object + properties: + usersCount: + type: integer + format: int32 + description: Number of users in the group + appsCount: + type: integer + format: int32 + description: Number of apps associated with the group + groupPushMappingsCount: + type: integer + format: int32 + description: Number of group push mappings associated with the group + hasAdminPrivlege: + type: boolean + description: Indicates if the group has admin privileges via a group-level role assignment + app: + description: If the group is sourced from an app, this object contains information about that app + type: object + properties: + id: + type: string + description: The ID of the `AppInstance` + name: + type: string + description: The name of the `AppInstance` + label: + type: string + description: The user-facing display name of the `AppInstance` + signOnMode: + type: string + description: The configured sign-on mode for the `AppInstance` + example: SAML_1_1 + _links: + description: '[Discoverable resources](https://developer.okta.com/docs/api/openapi/okta-management/management/group/listgroups#group/listgroups/t=response&c=200&path=_links/source) related to the group' + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + apps: + $ref: '#/components/schemas/HrefObject' + logo: + type: array + items: + $ref: '#/components/schemas/HrefObject' + source: + $ref: '#/components/schemas/HrefObject' + users: + $ref: '#/components/schemas/HrefObject' + readOnly: true IdentityProvider: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: created: @@ -4801,15 +4939,41 @@ components: properties: $ref: '#/components/schemas/IdentityProviderProperties' protocol: - description: >- - IdP-specific protocol settings for endpoints, bindings, and - algorithms used to connect with the IdP and validate messages - oneOf: - - $ref: '#/components/schemas/ProtocolSaml' - - $ref: '#/components/schemas/ProtocolOAuth' - - $ref: '#/components/schemas/ProtocolOidc' - - $ref: '#/components/schemas/ProtocolMtls' - - $ref: '#/components/schemas/ProtocolIdVerification' + description: IdP-specific protocol settings for endpoints, bindings, and algorithms used to connect with the IdP and validate messages + discriminator: + propertyName: type + mapping: + SAML2: '#/components/schemas/ProtocolSaml' + OAUTH2: '#/components/schemas/ProtocolOAuth' + OIDC: '#/components/schemas/ProtocolOidc' + MTLS: '#/components/schemas/ProtocolMtls' + ID_PROOFING: '#/components/schemas/ProtocolIdVerification' + title: SAML 2.0 Protocol + type: object + properties: + algorithms: + $ref: '#/components/schemas/SamlAlgorithms' + credentials: + $ref: '#/components/schemas/SamlCredentials' + endpoints: + $ref: '#/components/schemas/SamlEndpoints' + relayState: + $ref: '#/components/schemas/SamlRelayState' + settings: + $ref: '#/components/schemas/SamlSettings' + type: + type: string + description: SAML 2.0 protocol + enum: + - SAML2 + scopes: + $ref: '#/components/schemas/OAuthScopes' + issuer: + $ref: '#/components/schemas/OidcIssuer' + oktaIdpOrgUrl: + type: string + description: URL of the IdP org + example: https://idp.example.com status: $ref: '#/components/schemas/LifecycleStatus' type: @@ -4817,69 +4981,254 @@ components: _links: type: object additionalProperties: true - allOf: - - $ref: '#/components/schemas/LinksSelf' - - properties: - acs: - description: SAML 2.0 Assertion Consumer Service URL for the Okta SP - allOf: - - $ref: '#/components/schemas/HrefObject' - authorize: - description: >- - OAuth 2.0 authorization endpoint for the IdP OAuth 2.0 - Authorization Code flow - allOf: - - $ref: '#/components/schemas/HrefObject' - clientRedirectUri: - description: Redirect URI for the OAuth 2.0 Authorization Code flow - allOf: - - $ref: '#/components/schemas/HrefObject' - metadata: - description: >- - Federation metadata document for the IdP (for example: SAML - 2.0 Metadata) - allOf: - - $ref: '#/components/schemas/HrefObject' - users: - description: IdP users - allOf: - - $ref: '#/components/schemas/HrefObject' - deactivate: - description: Deactivate IdP - allOf: - - $ref: '#/components/schemas/HrefObject' - activate: - description: Activate IdP - allOf: - - $ref: '#/components/schemas/HrefObject' - keys: - description: IdP keys - allOf: - - $ref: '#/components/schemas/HrefObject' + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + acs: + description: SAML 2.0 Assertion Consumer Service URL for the Okta SP + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + authorize: + description: OAuth 2.0 authorization endpoint for the IdP OAuth 2.0 Authorization Code flow + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + clientRedirectUri: + description: Redirect URI for the OAuth 2.0 Authorization Code flow + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + metadata: + description: 'Federation metadata document for the IdP (for example: SAML 2.0 Metadata)' + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + users: + description: IdP users + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + deactivate: + description: Deactivate IdP + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + activate: + description: Activate IdP + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + keys: + description: IdP keys + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + readOnly: true UserActivationToken: type: object properties: - activationToken: - type: string - readOnly: true - example: XE6wE17zmphl3KqAPFxO - description: >- - Token received as part of an activation user request. If a password - was set before the user was activated, then user must sign in with - their password or the `activationToken` and not the activation link. - More information about using the `activationToken` - - to login can be found in the [Authentication - API](https://developer.okta.com/docs/reference/api/authn/#primary-authentication-with-activation-token). - activationUrl: + activationToken: + type: string + readOnly: true + example: XE6wE17zmphl3KqAPFxO + description: |- + Token received as part of an activation user request. If a password was set before the user was activated, then user must sign in with their password or the `activationToken` and not the activation link. More information about using the `activationToken` + to login can be found in the [Authentication API](https://developer.okta.com/docs/reference/api/authn/#primary-authentication-with-activation-token). + activationUrl: + type: string + readOnly: true + example: https://{yourOktaDomain}/tokens/XE6wE17zmphl3KqAPFxO/verify + description: |- + If `sendEmail` is `false`, returns an activation link for the user to set up their account. You can use the activation token to create a custom activation link. + + > **Note:** The `activationUrl` varies depending on if you are on a Classic or Identity Engine org. + > - For Identity Engine orgs, the activation link is in this format: `https://{yourOktaDomain}/tokens/{activationToken}/verify` + > - For Classic orgs, the activation link is in this format: `https://{yourOktaDomain}/welcome/{activationToken}` + tempPassword: + type: object + properties: + tempPassword: type: string + description: A temporary password that the user can sign in with. This is only returned when expiring a password with a temporary password. readOnly: true - example: https://{yourOktaDomain}/welcome/XE6wE17zmphl3KqAPFxO - description: >- - If `sendEmail` is `false`, returns an activation link for the user - to set up their account. The activation token can be used to create - a custom activation link. ResetPasswordToken: type: object properties: @@ -4938,6 +5287,7 @@ components: type: $ref: '#/components/schemas/ClassificationType' OAuth2Client: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: client_id: @@ -4955,26 +5305,35 @@ components: readOnly: true example: https://www.example.com logo_uri: - description: >- - URL string that references a logo for the client consent dialog (not - the sign-in dialog) + description: URL string that references a logo for the client consent dialog (not the sign-in dialog) type: string readOnly: true example: https://www.example.com/logo.png _links: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - type: object + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + grants: + description: Link to the grant resources + type: object + properties: + href: + type: string + description: Link URI + example: https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7/clients/0oabskvc6442nkvQO0h7/grants + tokens: + description: Link to the token resources + type: object properties: - grants: - description: Link to the grant resources - allOf: - - $ref: '#/components/schemas/GrantResourcesHrefObject' - tokens: - description: Link to the token resources - allOf: - - $ref: '#/components/schemas/TokenResourcesHrefObject' + href: + type: string + description: Link URI + example: https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7/clients/0oabskvc6442nkvQO0h7/tokens + readOnly: true OAuth2ScopeConsentGrant: + x-okta-ignore-redocly-rules-for-sdk: true description: Grant object that represents an app consent scope grant type: object properties: @@ -4994,18 +5353,13 @@ components: example: oag3ih1zrm1cBFOiq0h6 issuer: type: string - description: >- - The issuer of your org authorization server. This is typically your - Okta domain. + description: The issuer of your org authorization server. This is typically your Okta domain. example: https://my_test_okta_org.oktapreview.com lastUpdated: $ref: '#/components/schemas/lastUpdatedProperty' scopeId: type: string - description: >- - The name of the [Okta - scope](https://developer.okta.com/docs/api/oauth2/#oauth-20-scopes) - for which consent is granted + description: The name of the [Okta scope](https://developer.okta.com/docs/api/oauth2/#oauth-20-scopes) for which consent is granted example: okta.users.read source: $ref: '#/components/schemas/OAuth2ScopeConsentGrantSource' @@ -5029,36 +5383,77 @@ components: example: okta.users.read readOnly: true _links: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - type: object + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + app: + description: Link to the app resource + type: object + properties: + href: + type: string + description: Link URI + example: https://{yourOktaDomain}/api/v1/apps/0oabskvc6442nkvQO0h7 + title: + type: string + description: Link name + example: My App + client: + description: Link to the client resource + type: object + properties: + href: + type: string + description: Link URI + example: https://{yourOktaDomain}/api/v1/apps/0oabskvc6442nkvQO0h7 + title: + type: string + description: Link name + example: My App + scope: + description: Link to the scope resource + type: object + properties: + href: + type: string + description: Link URI + example: https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7/scopes/scpCmCCV1DpxVkCaye2X + title: + type: string + description: Link name + example: My phone + user: + description: Link to the user resource + type: object + properties: + href: + type: string + description: Link URI + example: https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7 + title: + type: string + description: Link name + example: SAML Jackson + authorizationServer: + description: Link to the authorization server resource + type: object properties: - app: - description: Link to the app resource - allOf: - - $ref: '#/components/schemas/AppResourceHrefObject' - client: - description: Link to the client resource - allOf: - - $ref: '#/components/schemas/AppResourceHrefObject' - scope: - description: Link to the scope resource - allOf: - - $ref: '#/components/schemas/ScopeResourceHrefObject' - user: - description: Link to the user resource - allOf: - - $ref: '#/components/schemas/UserResourceHrefObject' - authorizationServer: - description: Link to the authorization server resource - allOf: - - $ref: >- - #/components/schemas/AuthorizationServerResourceHrefObject - - readOnly: true + href: + type: string + description: Link URI + example: https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7 + title: + type: string + description: Link name + example: Example Authorization Server + readOnly: true required: - issuer - scopeId OAuth2RefreshToken: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: clientId: @@ -5096,9 +5491,7 @@ components: example: 00u5t60iloOHN9pBi0h7 _embedded: type: object - description: >- - The embedded resources related to the object if the `expand` query - parameter is specified + description: The embedded resources related to the object if the `expand` query parameter is specified properties: scopes: type: array @@ -5107,41 +5500,76 @@ components: $ref: '#/components/schemas/OAuth2RefreshTokenScope' readOnly: true _links: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - type: object + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + app: + description: Link to the app resource + type: object + properties: + href: + type: string + description: Link URI + example: https://{yourOktaDomain}/api/v1/apps/0oabskvc6442nkvQO0h7 + title: + type: string + description: Link name + example: My App + revoke: + description: Link to revoke the refresh Token + type: object + properties: + href: + type: string + description: Link URI + example: https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7/clients/0oabskvc6442nkvQO0h7/tokens/oar579Mcp7OUsNTlo0g3 + hints: + properties: + allow: + items: + enum: + - DELETE + default: DELETE + type: object + client: + description: Link to the client resource + type: object + properties: + href: + type: string + description: Link URI + example: https://{yourOktaDomain}/api/v1/apps/0oabskvc6442nkvQO0h7 + title: + type: string + description: Link name + example: My App + user: + description: Link to the user resource + type: object + properties: + href: + type: string + description: Link URI + example: https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7 + title: + type: string + description: Link name + example: SAML Jackson + authorizationServer: + description: Link to the Token authorization server resource + type: object properties: - app: - description: Link to the app resource - allOf: - - $ref: '#/components/schemas/AppResourceHrefObject' - revoke: - description: Link to revoke the refresh Token - allOf: - - $ref: '#/components/schemas/RevokeRefreshTokenHrefObject' - - properties: - hints: - properties: - allow: - items: - enum: - - DELETE - default: DELETE - type: object - type: object - client: - description: Link to the client resource - allOf: - - $ref: '#/components/schemas/AppResourceHrefObject' - user: - description: Link to the user resource - allOf: - - $ref: '#/components/schemas/UserResourceHrefObject' - authorizationServer: - description: Link to the Token authorization server resource - allOf: - - $ref: >- - #/components/schemas/AuthorizationServerResourceHrefObject + href: + type: string + description: Link URI + example: https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7 + title: + type: string + description: Link name + example: Example Authorization Server + readOnly: true ChangePasswordRequest: type: object properties: @@ -5151,15 +5579,10 @@ components: $ref: '#/components/schemas/PasswordCredential' revokeSessions: type: boolean - description: >- - When set to `true`, revokes all user sessions, except for the - current session + description: When set to `true`, revokes all user sessions, except for the current session default: false UserCredentials: - description: >- - Specifies primary authentication and recovery credentials for a user. - Credential types and requirements vary depending on the provider and - security policy of the org. + description: Specifies primary authentication and recovery credentials for a user. Credential types and requirements vary depending on the provider and security policy of the org. type: object properties: password: @@ -5189,6 +5612,7 @@ components: type: string description: Unique key for the user device link UserFactor: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: created: @@ -5211,19 +5635,16 @@ components: example: '2022-08-25T00:31:00.000Z' readOnly: true profile: - type: object - description: Specific attributes related to the factor + type: string + x-okta-ignore-redocly-rules-for-sdk: true + description: Specific attributes related to the factor (opaque JSON object) provider: - description: >- - Provider for the factor. Each provider can support a subset of - factor types. + description: Provider for the factor. Each provider can support a subset of factor types. type: string status: $ref: '#/components/schemas/UserFactorStatus' vendorName: - description: >- - Name of the factor vendor. This is usually the same as the provider - except for On-Prem MFA, which depends on admin settings. + description: Name of the factor vendor. This is usually the same as the provider except for On-Prem MFA, which depends on admin settings. type: string example: OKTA readOnly: true @@ -5251,6 +5672,7 @@ components: web: '#/components/schemas/UserFactorWeb' webauthn: '#/components/schemas/UserFactorWebAuthn' UserFactorSupported: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: enrollment: @@ -5267,9 +5689,7 @@ components: status: $ref: '#/components/schemas/UserFactorStatus' vendorName: - description: >- - Name of the factor vendor. This is usually the same as the provider - except for On-Prem MFA, which depends on admin settings. + description: Name of the factor vendor. This is usually the same as the provider except for On-Prem MFA, which depends on admin settings. type: string example: OKTA readOnly: true @@ -5321,83 +5741,28 @@ components: type: string readOnly: true UserFactorActivateRequest: - oneOf: - - title: call - description: Attempts to activate a `call` factor with the specified passcode - properties: - passCode: - $ref: '#/components/schemas/UserFactorPassCode' - type: object - - title: email - description: Attempts to activate an `email` factor with the specified passcode - properties: - passCode: - $ref: '#/components/schemas/UserFactorPassCode' - type: object - - title: push - type: object - nullable: true - description: >- - Sends an asynchronous push notification to the device for approval - by the user. You must poll the transaction to determine the state of - the verification. See [Retrieve a factor transaction - status](./#tag/UserFactor/operation/getFactorTransactionStatus). - - - Activations have a short lifetime of several minutes and return a - `TIMEOUT` if not completed before the timestamp specified in the - `expiresAt` param. Use the published activate link to restart the - activation process if the activation expires. - properties: - useNumberMatchingChallenge: - $ref: '#/components/schemas/useNumberMatchingChallenge' - - title: sms - description: Attempts to activate an `sms` factor with the specified passcode - properties: - passCode: - $ref: '#/components/schemas/UserFactorPassCode' - type: object - - title: token:software:totp - description: >- - Attempts to activate a `token:software:totp` factor with the - specified passcode - properties: - passCode: - $ref: '#/components/schemas/UserFactorPassCode' - type: object - - title: u2f - description: >- - Activates a `u2f` factor with the specified client and registration - information from the U2F token - properties: - clientData: - type: string - description: Base64-encoded client data from the U2F token - example: >- - eyJ0eXAiOiJuYXZpZ2F0b3IuaWQuZmluaXNoRW5yb2xsbWVudCIsImNoYWxsZW5nZSI6IlhxR0h0RTBoUkxuVEoxYUF5U1oyIiwib3JpZ2luIjoiaHR0cHM6Ly9sb2NhbGhvc3Q6MzAwMCIsImNpZF9wdWJrZXkiOiJ1bnVzZWQifQ - registrationData: - type: string - description: Base64-encoded registration data from the U2F token - example: >- - BQTEMUyOM8h1TiZG4DL-RdMr-tYgTYSf62Y52AmwEFTiSYWIRVO5L-MwWdRJOthmV3J3JrqpmGfmFb820-awx1YIQFlTvkMhxItHlpkzahEqicpw7SIH9yMfTn2kaDcC6JaLKPfV5ds0vzuxF1JJj3gCM01bRC-HWI4nCVgc-zaaoRgwggEcMIHDoAMCAQICCwD52fCSMoNczORdMAoGCCqGSM49BAMCMBUxEzARBgNVBAMTClUyRiBJc3N1ZXIwGhcLMDAwMTAxMDAwMFoXCzAwMDEwMTAwMDBaMBUxEzARBgNVBAMTClUyRiBEZXZpY2UwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQFKJupuUgPQcRHUphaW5JPfLvkkwlEwlHKk_ntSp7MS4aTHJyGnpziqncrjiTC_oUVtb-wN-y_t_IMIjueGkhxMAoGCCqGSM49BAMCA0gAMEUCIQDBo6aOLxanIUYnBX9iu3KMngPnobpi0EZSTkVtLC8_cwIgC1945RGqGBKfbyNtkhMifZK05n7fU-gW37Bdnci5D94wRQIhAJv3VvclbRkHAQhaUR8rr8qFTg9iF-GtHoXU95vWaQdyAiAbEr-440U4dQAZF-Sj8G2fxgh5DkgkkWpyUHZhz7N9ew - type: object - - title: webauthn - description: >- - Activates a `webauthn` factor with the specified attestation and - registration information from the WebAuthn authenticator - properties: - attestation: - type: string - description: Base64-encoded attestation from the WebAuthn authenticator - example: >- - o2NmbXRmcGFja2VkZ2F0dFN0bXSiY2FsZyZjc2lnWEgwRgIhAMvf2+dzXlHZN1um38Y8aFzrKvX0k5dt/hnDu9lahbR4AiEAuwtMg3IoaElWMp00QrP/+3Po/6LwXfmYQVfsnsQ+da1oYXV0aERhdGFYxkgb9OHGifjS2dG03qLRqvXrDIRyfGAuc+GzF1z20/eVRV2wvl6tzgACNbzGCmSLCyXx8FUDAEIBvWNHOcE3QDUkDP/HB1kRbrIOoZ1dR874ZaGbMuvaSVHVWN2kfNiO4D+HlAzUEFaqlNi5FPqKw+mF8f0XwdpEBlClAQIDJiABIVgg0a6oo3W0JdYPu6+eBrbr0WyB3uJLI3ODVgDfQnpgafgiWCB4fFo/5iiVrFhB8pNH2tbBtKewyAHuDkRolcCnVaCcmQ== - clientData: - type: string - description: Base64-encoded client data from the WebAuthn authenticator - example: >- - eyJjaGFsbGVuZ2UiOiJVSk5wYW9sVWt0dF9vcEZPNXJMYyIsIm9yaWdpbiI6Imh0dHBzOi8vcmFpbi5va3RhMS5jb20iLCJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIn0 - type: object + x-okta-ignore-redocly-rules-for-sdk: true type: object + title: call + description: Attempts to activate a `call` factor with the specified passcode + properties: + passCode: + $ref: '#/components/schemas/UserFactorPassCode' + useNumberMatchingChallenge: + $ref: '#/components/schemas/useNumberMatchingChallenge' + clientData: + type: string + description: Base64-encoded client data from the U2F token + example: eyJ0eXAiOiJuYXZpZ2F0b3IuaWQuZmluaXNoRW5yb2xsbWVudCIsImNoYWxsZW5nZSI6IlhxR0h0RTBoUkxuVEoxYUF5U1oyIiwib3JpZ2luIjoiaHR0cHM6Ly9sb2NhbGhvc3Q6MzAwMCIsImNpZF9wdWJrZXkiOiJ1bnVzZWQifQ + registrationData: + type: string + description: Base64-encoded registration data from the U2F token + example: BQTEMUyOM8h1TiZG4DL-RdMr-tYgTYSf62Y52AmwEFTiSYWIRVO5L-MwWdRJOthmV3J3JrqpmGfmFb820-awx1YIQFlTvkMhxItHlpkzahEqicpw7SIH9yMfTn2kaDcC6JaLKPfV5ds0vzuxF1JJj3gCM01bRC-HWI4nCVgc-zaaoRgwggEcMIHDoAMCAQICCwD52fCSMoNczORdMAoGCCqGSM49BAMCMBUxEzARBgNVBAMTClUyRiBJc3N1ZXIwGhcLMDAwMTAxMDAwMFoXCzAwMDEwMTAwMDBaMBUxEzARBgNVBAMTClUyRiBEZXZpY2UwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQFKJupuUgPQcRHUphaW5JPfLvkkwlEwlHKk_ntSp7MS4aTHJyGnpziqncrjiTC_oUVtb-wN-y_t_IMIjueGkhxMAoGCCqGSM49BAMCA0gAMEUCIQDBo6aOLxanIUYnBX9iu3KMngPnobpi0EZSTkVtLC8_cwIgC1945RGqGBKfbyNtkhMifZK05n7fU-gW37Bdnci5D94wRQIhAJv3VvclbRkHAQhaUR8rr8qFTg9iF-GtHoXU95vWaQdyAiAbEr-440U4dQAZF-Sj8G2fxgh5DkgkkWpyUHZhz7N9ew + attestation: + type: string + description: Base64-encoded attestation from the Passkey (FIDO2 WebAuthn) authenticator + example: o2NmbXRmcGFja2VkZ2F0dFN0bXSiY2FsZyZjc2lnWEgwRgIhAMvf2+dzXlHZN1um38Y8aFzrKvX0k5dt/hnDu9lahbR4AiEAuwtMg3IoaElWMp00QrP/+3Po/6LwXfmYQVfsnsQ+da1oYXV0aERhdGFYxkgb9OHGifjS2dG03qLRqvXrDIRyfGAuc+GzF1z20/eVRV2wvl6tzgACNbzGCmSLCyXx8FUDAEIBvWNHOcE3QDUkDP/HB1kRbrIOoZ1dR874ZaGbMuvaSVHVWN2kfNiO4D+HlAzUEFaqlNi5FPqKw+mF8f0XwdpEBlClAQIDJiABIVgg0a6oo3W0JdYPu6+eBrbr0WyB3uJLI3ODVgDfQnpgafgiWCB4fFo/5iiVrFhB8pNH2tbBtKewyAHuDkRolcCnVaCcmQ== + nullable: true UserFactorActivateResponse: type: object properties: @@ -5413,10 +5778,67 @@ components: - u2f - webauthn _links: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - $ref: '#/components/schemas/LinksUser' - - $ref: '#/components/schemas/LinksVerify' + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + user: + description: Returns information on the specified user + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + verify: + description: Verifies the factor resource. See [Verify a factor](https://developer.okta.com/docs/api/openapi/okta-management/management/userfactor/verifyfactor). + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + readOnly: true + x-okta-ignore-redocly-rules-for-sdk: true discriminator: propertyName: factorType mapping: @@ -5444,6 +5866,7 @@ components: email: '#/components/schemas/UserFactorEmail' sms: '#/components/schemas/UserFactorSMS' UserFactorPushTransaction: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: factorResult: @@ -5464,109 +5887,32 @@ components: REJECTED: '#/components/schemas/UserFactorPushTransactionRejected' TIMEOUT: '#/components/schemas/UserFactorPushTransactionTimeout' UserFactorVerifyRequest: - oneOf: - - title: call - description: >- - Verifies an OTP sent by a `call` factor challenge. If you omit - `passCode` in the request, a new OTP is sent to the phone. - properties: - passCode: - $ref: '#/components/schemas/UserFactorPassCode' - type: object - - title: sms - description: >- - Verifies an OTP sent by an `sms` factor challenge. If you omit - `passCode` in the request, a new OTP is sent to the phone. - properties: - passCode: - $ref: '#/components/schemas/UserFactorPassCode' - type: object - - title: push - type: object - nullable: true - description: >- - Sends an asynchronous push notification to the device for approval - by the user. A successful request returns an HTTP 201 response, - unlike other factors. You must poll the transaction to determine the - state of the verification. See [Retrieve a factor transaction - status](./#tag/UserFactor/operation/getFactorTransactionStatus). - properties: - useNumberMatchingChallenge: - $ref: '#/components/schemas/useNumberMatchingChallenge' - - title: email - description: >- - Verifies an OTP sent by an `email` factor challenge. If you omit - `passCode` in the request, a new OTP is sent to the phone. - properties: - passCode: - $ref: '#/components/schemas/UserFactorPassCode' - type: object - - title: question - description: Verifies an answer to a `question` factor - properties: - answer: - description: Answer to the question - minLength: 4 - type: string - writeOnly: true - type: object - - title: token:software:totp - description: Verifies an OTP for a `token:software:totp` factor - properties: - passCode: - $ref: '#/components/schemas/UserFactorPassCode' - type: object - - title: token:hotp - description: Verifies an OTP for a `token:hotp` factor - properties: - passCode: - $ref: '#/components/schemas/UserFactorPassCode' - type: object - - title: token:hardware - description: Verifies an OTP for a `token:hardware` factor - properties: - passCode: - $ref: '#/components/schemas/UserFactorPassCode' - type: object - - title: token - description: Verifies an OTP for a `token` factor - properties: - passCode: - $ref: '#/components/schemas/UserFactorPassCode' - type: object - - title: u2f - description: >- - Verifies a `u2f` factor challenge by posting a signed assertion - using the challenge `nonce` - properties: - clientData: - type: string - description: Base64-encoded client data from the U2F token - example: >- - eyJ0eXAiOiJuYXZpZ2F0b3IuaWQuZmluaXNoRW5yb2xsbWVudCIsImNoYWxsZW5nZSI6IlhxR0h0RTBoUkxuVEoxYUF5U1oyIiwib3JpZ2luIjoiaHR0cHM6Ly9sb2NhbGhvc3Q6MzAwMCIsImNpZF9wdWJrZXkiOiJ1bnVzZWQifQ - signatureData: - description: Base64-encoded signature data from the U2F token - type: object - - title: webauthn - description: >- - Verifies a `webauthn` factor challenge by posting a signed assertion - using the challenge `nonce` - properties: - authenticatorData: - description: >- - Base64-encoded authenticator data from the WebAuthn - authenticator - type: string - clientData: - type: string - description: Base64-encoded client data from the WebAuthn authenticator - example: >- - eyJjaGFsbGVuZ2UiOiJVSk5wYW9sVWt0dF9vcEZPNXJMYyIsIm9yaWdpbiI6Imh0dHBzOi8vcmFpbi5va3RhMS5jb20iLCJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIn0 - signatureData: - type: string - description: Base64-encoded signature data from the WebAuthn authenticator - type: object + x-okta-ignore-redocly-rules-for-sdk: true + title: call + description: Verifies an OTP sent by a `call` factor challenge. If you omit `passCode` in the request, a new OTP is sent to the phone. + properties: + passCode: + $ref: '#/components/schemas/UserFactorPassCode' + useNumberMatchingChallenge: + $ref: '#/components/schemas/useNumberMatchingChallenge' + answer: + description: Answer to the question + minLength: 4 + type: string + writeOnly: true + clientData: + type: string + description: Base64-encoded client data from the U2F token + example: eyJ0eXAiOiJuYXZpZ2F0b3IuaWQuZmluaXNoRW5yb2xsbWVudCIsImNoYWxsZW5nZSI6IlhxR0h0RTBoUkxuVEoxYUF5U1oyIiwib3JpZ2luIjoiaHR0cHM6Ly9sb2NhbGhvc3Q6MzAwMCIsImNpZF9wdWJrZXkiOiJ1bnVzZWQifQ + signatureData: + description: Base64-encoded signature data from the U2F token + authenticatorData: + description: Base64-encoded authenticator data from the Passkey (FIDO2 WebAuthn) authenticator + type: string + type: object + nullable: true UserFactorVerifyResponse: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: expiresAt: @@ -5590,14 +5936,15 @@ components: properties: {} readOnly: true _embedded: - allOf: - - additionalProperties: - type: object - nullable: true - readOnly: true + additionalProperties: + type: string + nullable: true + readOnly: true + description: (opaque JSON object) _links: $ref: '#/components/schemas/UserFactorLinks' UserFactorVerifyResponseWaiting: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: expiresAt: @@ -5621,12 +5968,27 @@ components: properties: {} readOnly: true _embedded: - allOf: - - $ref: '#/components/schemas/NumberFactorChallengeEmbeddedLinks' - - additionalProperties: - type: object - nullable: true - readOnly: true + description: Contains the `challenge` and `correctAnswer` objects for `push` factors that use a number matching challenge + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: false + SKUs: [] + type: object + properties: + challenge: + type: object + description: Number matching challenge for a `push` factor + properties: + correctAnswer: + description: The correct answer for a `push` factor that uses a number matching challenge + type: integer + example: 72 + nullable: true + additionalProperties: + type: string + nullable: true + readOnly: true + description: (opaque JSON object) _links: $ref: '#/components/schemas/UserFactorLinks' UserRiskGetResponse: @@ -5635,9 +5997,14 @@ components: riskLevel: $ref: '#/components/schemas/UserRiskLevelAll' _links: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - $ref: '#/components/schemas/LinksUserRef' + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + user: + $ref: '#/components/schemas/HrefObjectUserLink' + readOnly: true discriminator: propertyName: riskLevel mapping: @@ -5653,7 +6020,15 @@ components: description: The risk level associated with the user enum: - HIGH + - MEDIUM - LOW + riskReason: + type: string + description: The reason for the risk change. If not provided, the reason defaults to `override.by.admin`. Only alphanumeric characters, spaces, hyphens, commas, and periods are allowed. + maxLength: 500 + pattern: ^[a-zA-Z0-9\s\-,.]*$ + required: + - riskLevel UserRiskPutResponse: type: object properties: @@ -5662,11 +6037,17 @@ components: riskLevel: $ref: '#/components/schemas/UserRiskLevelPut' _links: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - $ref: '#/components/schemas/LinksUserRef' + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + user: + $ref: '#/components/schemas/HrefObjectUserLink' + readOnly: true StandardRole: - title: Standard Role Assignment + title: Standard role assignment + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: assignmentType: @@ -5690,9 +6071,11 @@ components: format: date-time readOnly: true status: - allOf: - - $ref: '#/components/schemas/LifecycleStatus' - - description: Status of the role assignment + type: string + enum: + - ACTIVE + - INACTIVE + description: Status of the role assignment type: $ref: '#/components/schemas/RoleType' _embedded: @@ -5718,8 +6101,11 @@ components: type: object _links: $ref: '#/components/schemas/LinksAssignee' + required: + - type CustomRole: title: Custom role assignment + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: assignmentType: @@ -5735,7 +6121,7 @@ components: readOnly: true label: type: string - description: Label for the custom role assignment + description: Label for the role assignment readOnly: true lastUpdated: type: string @@ -5748,28 +6134,42 @@ components: readOnly: true role: type: string - description: Custom role ID + description: Role ID readOnly: true status: - allOf: - - $ref: '#/components/schemas/LifecycleStatus' - - description: Status of the custom role assignment - type: type: string - description: CUSTOM for a custom role enum: - - CUSTOM + - ACTIVE + - INACTIVE + description: Status of the role assignment + type: + $ref: '#/components/schemas/RoleType' _links: $ref: '#/components/schemas/LinksCustomRoleResponse' + required: + - type StandardRoleAssignmentSchema: - title: Standard Role + title: Standard role type: object properties: type: type: string - description: >- - Specify the standard or IAM-based role type. See [standard - roles](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#standard-roles). + description: 'Specify a [standard admin role](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#standard-roles), an [IAM-based standard role](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#iam-based-standard-roles), or `CUSTOM` for a custom role type:' + enum: + - ACCESS_CERTIFICATIONS_ADMIN + - ACCESS_REQUESTS_ADMIN + - API_ACCESS_MANAGEMENT_ADMIN + - APP_ADMIN + - GROUP_MEMBERSHIP_ADMIN + - HELP_DESK_ADMIN + - ORG_ADMIN + - READ_ONLY_ADMIN + - REPORT_ADMIN + - SUPER_ADMIN + - USER_ADMIN + - WORKFLOWS_ADMIN + required: + - type CustomRoleAssignmentSchema: title: Custom Role type: object @@ -5782,9 +6182,13 @@ components: description: Custom role ID type: type: string - description: The type of role. Specify `CUSTOM` for a custom role. + description: 'Specify a [standard admin role](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#standard-roles), an [IAM-based standard role](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#iam-based-standard-roles), or `CUSTOM` for a custom role type:' enum: - CUSTOM + required: + - type + - role + - resource-set RoleGovernance: description: List of all user role governance sources type: object @@ -5815,13 +6219,17 @@ components: type: $ref: '#/components/schemas/GovernanceSourceType' _links: - allOf: - - $ref: '#/components/schemas/LinksGovernanceResources' - - $ref: '#/components/schemas/LinksSelf' + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the resources using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. + type: object + properties: + resources: + $ref: '#/components/schemas/HrefObjectGovernanceResourcesLink' + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + readOnly: true required: - type - grantId - - resources RoleGovernanceResources: description: The resources of a grant type: object @@ -5831,9 +6239,14 @@ components: items: $ref: '#/components/schemas/RoleGovernanceResource' _links: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - $ref: '#/components/schemas/LinksNext' + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + next: + $ref: '#/components/schemas/HrefObjectNextLink' + readOnly: true CatalogApplication: description: An app in the OIN catalog type: object @@ -5854,17 +6267,13 @@ components: features: type: array readOnly: true - description: >- - Features supported by the app. See app - [features](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Application/#tag/Application/operation/listApplications!c=200&path=0/features&t=response). + description: Features supported by the app. See app [features](https://developer.okta.com/docs/api/openapi/okta-management/management/application/listapplications#application/listapplications/t=response&c=200&path=&d=0/features). items: type: string id: type: string readOnly: true - description: >- - ID of the app instance. Okta returns this property only for apps not - in the OIN catalog. + description: ID of the app instance. Okta returns this property only for apps not in the OIN catalog. lastUpdated: type: string description: Timestamp when the object was last updated @@ -5873,14 +6282,10 @@ components: example: '2024-09-19T23:37:37.000Z' name: type: string - description: >- - App key name. For OIN catalog apps, this is a unique key for the app - definition. + description: App key name. For OIN catalog apps, this is a unique key for the app definition. signOnModes: type: array - description: >- - Authentication mode for the app. See app - [signOnMode](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Application/#tag/Application/operation/listApplications!c=200&path=0/signOnMode&t=response). + description: Authentication mode for the app. See app [signOnMode](https://developer.okta.com/docs/api/openapi/okta-management/management/application/listapplications#application/listapplications/t=response&c=200&path=&d=0/signonmode). items: type: string status: @@ -5894,12 +6299,7 @@ components: description: Website of the OIN catalog app _links: type: object - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using - the [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification readOnly: true properties: logo: @@ -5922,17 +6322,12 @@ components: format: date-time example: '2023-08-25T12:00:00.000Z' readOnly: true - description: >- - The expiry time stamp of the associated target. It's only included - in the response if the associated target will expire. + description: The expiry time stamp of the associated target. It's only included in the response if the associated target will expire. orn: type: string readOnly: true example: orn:okta:directory:00o5v1t2W4OSF9r4N0g4:groups:00g5vhi3rEJMOog1S0g4 - description: >- - The [Okta Resource Name - (ORN)](https://support.okta.com/help/s/article/understanding-okta-resource-name-orn) - of the app target or group target + description: The [Okta Resource Name (ORN)](https://support.okta.com/help/s/article/understanding-okta-resource-name-orn) of the app target or group target _links: $ref: '#/components/schemas/LinksSelf' Subscription: @@ -5958,37 +6353,17 @@ components: readOnly: true UserProfile: additionalProperties: true - description: >- + description: |- Specifies the default and custom profile properties for a user. + The default user profile is based on the [System for Cross-domain Identity Management: Core Schema](https://datatracker.ietf.org/doc/html/rfc7643). - The default user profile is based on the [System for Cross-domain - Identity Management: Core - Schema](https://datatracker.ietf.org/doc/html/rfc7643). + The only permitted customizations of the default profile are to update permissions, change whether the `firstName` and `lastName` properties are nullable, and specify a [pattern](https://developer.okta.com/docs/reference/api/schemas/#login-pattern-validation) for `login`. You can use the Profile Editor in the Admin Console or the [Schemas API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UISchema/#tag/UISchema) to make schema modifications. + You can extend user profiles with custom properties. You must first add the custom property to the user profile schema before you reference it. + You can use the Profile Editor in the Admin Console or the [Schemas API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UISchema/#tag/UISchema) to manage schema extensions. - The only permitted customizations of the default profile are to update - permissions, change whether the `firstName` and `lastName` properties - are nullable, and specify a - [pattern](https://developer.okta.com/docs/reference/api/schemas/#login-pattern-validation) - for `login`. You can use the Profile Editor in the Admin Console or the - [Schemas - API](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/UISchema/#tag/UISchema) - to make schema modifications. - - - You can extend user profiles with custom properties. You must first add - the custom property to the user profile schema before you reference it. - - You can use the Profile Editor in the Admin Console or the [Schemas - API](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/UISchema/#tag/UISchema) - to manage schema extensions. - - - Custom attributes can contain HTML tags. It's the client's - responsibility to escape or encode this data before displaying it. Use - [best-practices](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) - to prevent cross-site scripting. + Custom attributes can contain HTML tags. It's the client's responsibility to escape or encode this data before displaying it. Use [best-practices](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) to prevent cross-site scripting. type: object properties: city: @@ -6001,10 +6376,7 @@ components: description: Name of the cost center assigned to a user nullable: true countryCode: - description: >- - The country name component of the user's address (`country`). For - validation, see [ISO 3166-1 alpha 2 "short" code - format](https://datatracker.ietf.org/doc/html/draft-ietf-scim-core-schema-22#ref-ISO3166). + description: The country name component of the user's address (`country`). For validation, see [ISO 3166-1 alpha 2 "short" code format](https://datatracker.ietf.org/doc/html/draft-ietf-scim-core-schema-22#ref-ISO3166). type: string maxLength: 2 nullable: true @@ -6021,10 +6393,7 @@ components: nullable: true email: type: string - description: >- - The primary email address of the user. For validation, see [RFC 5322 - Section - 3.2.3](https://datatracker.ietf.org/doc/html/rfc5322#section-3.2.3). + description: The primary email address of the user. For validation, see [RFC 5322 Section 3.2.3](https://datatracker.ietf.org/doc/html/rfc5322#section-3.2.3). format: email minLength: 5 maxLength: 100 @@ -6053,47 +6422,20 @@ components: nullable: true locale: type: string - description: >- - The user's default location for purposes of localizing items such as - currency, date time format, numerical representations, and so on. - - A locale value is a concatenation of the ISO 639-1 two-letter - language code, an underscore, and the ISO 3166-1 two-letter country - code. For example, en_US specifies the language English and country - US. This value is `en_US` by default. + description: |- + The user's default location for purposes of localizing items such as currency, date time format, numerical representations, and so on. + A locale value is a concatenation of the ISO 639-1 two-letter language code, an underscore, and the ISO 3166-1 two-letter country code. For example, en_US specifies the language English and country US. This value is `en_US` by default. login: type: string - description: >- - The unique identifier for the user (`username`). For validation, see - [Login pattern - validation](https://developer.okta.com/docs/reference/api/schemas/#login-pattern-validation). - - - Every user within your Okta org must have a unique identifier for a - login. This constraint applies to all users you import from other - systems or applications such as Active Directory. Your organization - is the top-level namespace to mix and match logins from all your - connected applications or directories. Careful consideration of - naming conventions for your login identifier will make it easier to - onboard new applications in the future. - - - Logins are not considered unique if they differ only in case and/or - diacritical marks. If one of your users has a login of - Isaac.Brock@example.com, there cannot be another user whose login is - isaac.brock@example.com, nor isáàc.bröck@example.com. + description: |- + The unique identifier for the user (`username`). For validation, see [Login pattern validation](https://developer.okta.com/docs/reference/api/schemas/#login-pattern-validation). + Every user within your Okta org must have a unique identifier for a login. This constraint applies to all users you import from other systems or applications such as Active Directory. Your organization is the top-level namespace to mix and match logins from all your connected applications or directories. Careful consideration of naming conventions for your login identifier will make it easier to onboard new applications in the future. - Okta has a default ambiguous name resolution policy for usernames - that include @-signs. (By default, usernames must be formatted as - email addresses and thus always include @-signs. You can remove that - restriction using either the Admin Console or the [Schemas - API](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/). - Users can sign in with their non-qualified short name (for example: - isaac.brock with username isaac.brock@example.com) as long as the - short name is still unique within the organization. + Logins are not considered unique if they differ only in case and/or diacritical marks. If one of your users has a login of `Isaac.Brock@example.com`, there cannot be another user whose login is `isaac.brock@example.com`, nor `isáàc.bröck@example.com`. - maxLength: 100 + Okta has a default ambiguous name resolution policy for usernames that include @-signs. By default, usernames must be formatted as email addresses and thus always include @-signs. You can remove that restriction using either the Admin Console or the [Schemas API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/). Users can sign in with their non-qualified short name (for example: `isaac.brock` with username `isaac.brock@example.com`) as long as the short name is still unique within the org. + maxLength: 100 minLength: 5 manager: type: string @@ -6128,10 +6470,7 @@ components: nullable: true preferredLanguage: type: string - description: >- - The user's preferred written or spoken language. For validation, see - [RFC 7231 Section - 5.3.5](https://datatracker.ietf.org/doc/html/rfc7231#section-5.3.5). + description: The user's preferred written or spoken language. For validation, see [RFC 7231 Section 5.3.5](https://datatracker.ietf.org/doc/html/rfc7231#section-5.3.5). nullable: true primaryPhone: type: string @@ -6141,18 +6480,12 @@ components: nullable: true profileUrl: type: string - description: >- - The URL of the user's online profile. For example, a web page. See - [URL](https://datatracker.ietf.org/doc/html/rfc1808). + description: The URL of the user's online profile. For example, a web page. See [URL](https://datatracker.ietf.org/doc/html/rfc1808). nullable: true secondEmail: type: string format: email - description: >- - The secondary email address of the user typically used for account - recovery. For validation, see [RFC 5322 Section - 3.2.3](https://datatracker.ietf.org/doc/html/rfc5322#section-3.2.3). - minLength: 5 + description: The secondary email address of the user typically used for account recovery. For validation, see [RFC 5322 Section 3.2.3](https://datatracker.ietf.org/doc/html/rfc5322#section-3.2.3). maxLength: 100 nullable: true state: @@ -6175,29 +6508,23 @@ components: nullable: true userType: type: string - description: >- - The property used to describe the organization-to-user relationship, - such as employee or contractor + description: |- + The property used to describe the organization-to-user relationship, such as employee or contractor + + > **Note:** The `userType` property is a standard string attribute and should be treated as a descriptive label rather than a functional setting. Unlike a user's assigned user [`type`](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#tag/User/operation/createUser!path=type&t=request), this property is purely informational and doesn't influence the behavior of the Okta platform. nullable: true zipCode: type: string - description: >- - The ZIP code or postal code component of the user's address - (`postalCode`) + description: The ZIP code or postal code component of the user's address (`postalCode`) maxLength: 50 nullable: true UserStatus: - description: >- + description: |- The current status of the user. + The status of a user changes in response to explicit events, such as admin-driven lifecycle changes, user login, or self-service password recovery. Okta doesn't asynchronously sweep through users and update their password expiry state, for example. Instead, Okta evaluates password policy at login time, notices the password has expired, and moves the user to the expired state. When running reports, remember that the data is valid as of the last login or lifecycle event for that user. - The status of a user changes in response to explicit events, such as - admin-driven lifecycle changes, user login, or self-service password - recovery. Okta doesn't asynchronously sweep through users and update - their password expiry state, for example. Instead, Okta evaluates - password policy at login time, notices the password has expired, and - moves the user to the expired state. When running reports, remember that - the data is valid as of the last login or lifecycle event for that user. + > **Note:** The `ACTIVATING` status is a transitional status that occurs when a user is being activated but hasn't completed the activation process. This status isn't directly settable through the API, nor should you use it for any of your user management workflows. type: string enum: - ACTIVE @@ -6210,19 +6537,14 @@ components: - SUSPENDED readOnly: true LinksSelf: - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the - [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. This object is used for dynamic discovery of related - resources and lifecycle operations. + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. type: object properties: self: $ref: '#/components/schemas/HrefObjectSelfLink' readOnly: true HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object additionalProperties: true type: object @@ -6239,15 +6561,11 @@ components: readOnly: true templated: type: boolean - description: >- - Indicates whether the link object's `href` property is a URI - template. + description: Indicates whether the link object's `href` property is a URI template. readOnly: true type: type: string - description: >- - The media type of the link. If omitted, it is implicitly - `application/json`. + description: The media type of the link. If omitted, it is implicitly `application/json`. readOnly: true required: - href @@ -6257,10 +6575,7 @@ components: errorSummary: type: string UserCredentialsWritable: - description: >- - Specifies primary authentication and recovery credentials for a user. - Credential types and requirements vary depending on the provider and - security policy of the org. + description: Specifies primary authentication and recovery credentials for a user. Credential types and requirements vary depending on the provider and security policy of the org. type: object properties: password: @@ -6270,26 +6585,42 @@ components: recovery_question: $ref: '#/components/schemas/RecoveryQuestionCredential' GroupProfile: - description: >- - Specifies required and optional properties for a group. The - `objectClass` of a group determines which additional properties are - available. - - - You can extend group profiles with custom properties, but you must first - add the properties to the group profile schema before you can reference - them. Use the Profile Editor in the Admin Console or the [Schemas - API](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/)to - manage schema extensions. - - - Custom properties can contain HTML tags. It is the client's - responsibility to escape or encode this data before displaying it. Use - [best-practices](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) - to prevent cross-site scripting. - anyOf: - - $ref: '#/components/schemas/OktaUserGroupProfile' - - $ref: '#/components/schemas/OktaActiveDirectoryGroupProfile' + description: |- + Profile for any group that is not imported from Active Directory. Specifies the standard + and custom profile properties for a group. + + The `objectClass` for these groups is `okta:user_group`. + + You can extend group profiles with custom properties, but you must first add the properties to the group profile schema before you can reference them. Use the Profile Editor in the Admin Console or the [Schemas API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/) to manage schema extensions. + + Custom properties can contain HTML tags. It is the client's responsibility to escape or encode this data before displaying it. Use [best-practices](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) to prevent cross-site scripting. + type: object + properties: + description: + type: string + example: All users West of The Rockies + description: Description of the group + name: + type: string + example: West Coast users + description: Name of the group + dn: + type: string + example: CN=West Coast users,OU=West Coast,DC=example,DC=com + description: The distinguished name of the Windows group + externalId: + type: string + example: VKzYZ1C+IkSZxIWlrW5ITg== + description: Base-64 encoded GUID (`objectGUID`) of the Windows group + samAccountName: + type: string + example: West Coast users + description: Pre-Windows 2000 name of the Windows group + windowsDomainQualifiedName: + type: string + example: EXAMPLE\\West Coast users + description: Fully qualified name of the Windows group + x-okta-extensible: true GroupType: description: Determines how a group's profile and memberships are managed type: string @@ -6298,15 +6629,9 @@ components: - BUILT_IN - OKTA_GROUP x-enumDescriptions: - APP_GROUP: >- - Group profile and memberships are imported and must be managed within - the app (such as Active Directory or LDAP) that imported the group - BUILT_IN: >- - Group profile and memberships are managed by Okta and can't be - modified - OKTA_GROUP: >- - Group profile and memberships are directly managed in Okta via static - assignments or indirectly through group rules + APP_GROUP: Group profile and memberships are imported and must be managed within the app (such as Active Directory or LDAP) that imported the group + BUILT_IN: Group profile and memberships are managed by Okta and can't be modified + OKTA_GROUP: Group profile and memberships are directly managed in Okta via static assignments or indirectly through group rules Created: format: date-time description: Timestamp when the object was created @@ -6314,9 +6639,7 @@ components: type: string readOnly: true IdentityProviderIssuerMode: - description: >- - Indicates whether Okta uses the original Okta org domain URL or a custom - domain URL in the request to the social IdP + description: Indicates whether Okta uses the original Okta org domain URL or a custom domain URL in the request to the social IdP default: DYNAMIC type: string enum: @@ -6324,20 +6647,9 @@ components: - DYNAMIC - ORG_URL x-enumDescriptions: - ORG_URL: >- - In the authorize request to the social IdP, Okta uses the Okta org's - original domain URL (`https://${yourOktaDomain}`) as the domain in the - `redirect_uri`. - CUSTOM_URL: >- - In the authorize request to the social IdP, Okta uses the custom - domain URL as the domain in the `redirect_uri`. You can set - `issuerMode` to `CUSTOM_URL` only if you have a custom URL domain - configured. - DYNAMIC: >- - In the authorize request to the social IdP, Okta uses the custom - domain URL as the domain in the `redirect_uri` if the request was made - from the custom domain URL. Otherwise, Okta uses the Okta org's - original domain URL if the request was made from the Okta org domain. + ORG_URL: In the authorize request to the social IdP, Okta uses the Okta org's original domain URL (`https://${yourOktaDomain}`) as the domain in the `redirect_uri`. + CUSTOM_URL: In the authorize request to the social IdP, Okta uses the custom domain URL as the domain in the `redirect_uri`. You can set `issuerMode` to `CUSTOM_URL` only if you have a custom URL domain configured. + DYNAMIC: In the authorize request to the social IdP, Okta uses the custom domain URL as the domain in the `redirect_uri` if the request was made from the custom domain URL. Otherwise, Okta uses the Okta org's original domain URL if the request was made from the Okta org domain. LastUpdated: format: date-time description: Timestamp when the object was last updated @@ -6345,69 +6657,45 @@ components: type: string readOnly: true IdentityProviderPolicy: - description: >- + x-okta-ignore-redocly-rules-for-sdk: true + description: |- Policy settings for the IdP. - - The following provisioning and account linking actions are supported by - each IdP provider: - - | IdP type | - User provisioning actions | Group provisioning actions | - Account link actions | Account link filters | - - | ----------------------------------------------------------------- | - ------------------------- | ------------------------------------- | - -------------------- | -------------------- | - - | `SAML2` | - `AUTO` or `DISABLED` | `NONE`, `ASSIGN`, `APPEND`, or `SYNC` | - `AUTO`, `DISABLED` | `groups`, `users` | - - | `X509`, `IDV_PERSONA`, `IDV_INCODE`, and `IDV_CLEAR` | - `DISABLED` | No support for JIT provisioning - | | | - - | All other IdP types | - `AUTO`, `DISABLED` | `NONE` or `ASSIGN` | - `AUTO`, `DISABLED` | `groups`, `users` | - allOf: - - type: object - properties: - accountLink: - $ref: '#/components/schemas/PolicyAccountLink' - maxClockSkew: - type: integer - description: >- - Maximum allowable clock skew when processing messages from the - IdP - example: 120000 - provisioning: - $ref: '#/components/schemas/Provisioning' - subject: - $ref: '#/components/schemas/PolicySubject' + The following provisioning and account linking actions are supported by each IdP provider: + | IdP type | User provisioning actions | Group provisioning actions | Account link actions | Account link filters | + | ----------------------------------------------------------------- | ------------------------- | ------------------------------------- | -------------------- | -------------------- | + | `SAML2` | `AUTO` or `DISABLED` | `NONE`, `ASSIGN`, `APPEND`, or `SYNC` | `AUTO`, `DISABLED` | `groups`, `users` | + | `X509`, `IDV_PERSONA`, `IDV_INCODE`, `IDV_CLEAR` and `IDV_STANDARD`| `DISABLED` | No support for JIT provisioning | | | + | All other IdP types | `AUTO`, `DISABLED` | `NONE` or `ASSIGN` | `AUTO`, `DISABLED` | `groups`, `users` | + type: object + properties: + accountLink: + $ref: '#/components/schemas/PolicyAccountLink' + maxClockSkew: + type: integer + description: Maximum allowable clock skew when processing messages from the IdP + example: 120000 + trustClaims: + type: boolean + description: Indicates whether to trust authentication claims from the IdP + default: false + provisioning: + $ref: '#/components/schemas/Provisioning' + subject: + $ref: '#/components/schemas/PolicySubject' IdentityProviderProperties: nullable: true - description: >- - The properties in the IdP `properties` object vary depending on the IdP - type + description: The properties in the IdP `properties` object vary depending on the IdP type type: object properties: aalValue: type: string nullable: true - description: >- - The [authentication assurance - level](https://developers.login.gov/oidc/#aal-values) (AAL) value - for the Login.gov IdP. - - See [Add a Login.gov - IdP](https://developer.okta.com/docs/guides/add-logingov-idp/). - Applies to `LOGINGOV` and `LOGINGOV_SANDBOX` IdP types. + description: |- + The [authentication assurance level](https://developers.login.gov/oidc/#aal-values) (AAL) value for the Login.gov IdP. + See [Add a Login.gov IdP](https://developer.okta.com/docs/guides/add-logingov-idp/). Applies to `LOGINGOV` and `LOGINGOV_SANDBOX` IdP types. additionalAmr: type: array - description: >- - The additional Assurance Methods References (AMR) values for Smart - Card IdPs. Applies to `X509` IdP type. + description: The additional Assurance Methods References (AMR) values for Smart Card IdPs. Applies to `X509` IdP type. nullable: true items: type: string @@ -6421,31 +6709,48 @@ components: hwk: Hardware-secured key pin: Personal identification number mfa: Multifactor authentication + allowDynamicUserMatching: + type: boolean + description: |- + Enables authenticated users to enroll a Smart Card if the users can't be identified using the configured `matchAttribute`. Applies to `X509` IdP type. + + > **Note:** Enrollment requires a PIN if the Smart Card is PIN-protected. And enrollment is also blocked if the X.509 certificate contains restricted attributes (`login`, `email`, `secondEmail`, and configured attributes that are used in multiple identifiers). + default: false + allowUserUpdates: + type: boolean + description: |- + Enables attribute synchronization from the X.509 certificate to the user's Okta profile. If it's set to `true`, Okta overwrites user profile attributes with values found in the X.509 certificate. Applies to `X509` IdP type. + + > **Note:** Some attributes are restricted and won't be updated, including `login`, `email`, `secondEmail`, and configured attributes that are used in multiple identifiers. + default: false ialValue: type: string nullable: true - description: >- - The [type of identity - verification](https://developers.login.gov/oidc/#ial-values) (IAL) - value for the Login.gov IdP. - - See [Add a Login.gov - IdP](https://developer.okta.com/docs/guides/add-logingov-idp/). - Applies to `LOGINGOV` and `LOGINGOV_SANDBOX` IdP types. + description: |- + The [type of identity verification](https://developers.login.gov/oidc/#ial-values) (IAL) value for the Login.gov IdP. + See [Add a Login.gov IdP](https://developer.okta.com/docs/guides/add-logingov-idp/). Applies to `LOGINGOV` and `LOGINGOV_SANDBOX` IdP types. + idvMetadata: + type: object + description: Metadata about the IDV vendor. Available only for `IDV_STANDARD` IdPs. + properties: + vendorDisplayName: + type: string + description: The display name of the IDV vendor + termsOfUse: + type: string + description: A URL that links to the terms of use for the IDV vendor + privacyPolicy: + type: string + description: A URL that links to the privacy policy for the IDV vendor inquiryTemplateId: type: string - description: >- - The ID of the inquiry template from your Persona dashboard. The - inquiry template always starts with `itmpl`. Applies to the - `IDV_PERSONA` IdP type. + description: The ID of the inquiry template from your Persona dashboard. The inquiry template always starts with `itmpl`. Applies to the `IDV_PERSONA` IdP type. example: itmpl_HSctx8fNvXoHtrQfz2hxUVH8RBjG required: - inquiryTemplateId ProtocolSaml: title: SAML 2.0 Protocol - description: >- - Protocol settings for the [SAML 2.0 Authentication Request - Protocol](http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf) + description: Protocol settings for the [SAML 2.0 Authentication Request Protocol](http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf) type: object properties: algorithms: @@ -6465,9 +6770,7 @@ components: - SAML2 ProtocolOAuth: title: OAuth 2.0 Protocol - description: >- - Protocol settings for authentication using the [OAuth 2.0 Authorization - Code flow](https://tools.ietf.org/html/rfc6749#section-4.1) + description: Protocol settings for authentication using the [OAuth 2.0 Authorization Code flow](https://tools.ietf.org/html/rfc6749#section-4.1) type: object properties: credentials: @@ -6483,9 +6786,7 @@ components: - OAUTH2 ProtocolOidc: title: OpenID Connect Protocol - description: >- - Protocol settings for authentication using the [OpenID Connect - Protocol](http://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth) + description: Protocol settings for authentication using the [OpenID Connect Protocol](http://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth) type: object properties: algorithms: @@ -6494,19 +6795,17 @@ components: $ref: '#/components/schemas/OAuthCredentials' endpoints: $ref: '#/components/schemas/OAuthEndpoints' + issuer: + $ref: '#/components/schemas/OidcIssuer' oktaIdpOrgUrl: type: string description: URL of the IdP org example: https://idp.example.com scopes: type: array - description: >- - OpenID Connect and IdP-defined permission bundles to request - delegated access from the user - - > **Note:** The [IdP - type](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=type&t=request) - table lists the scopes that are supported for each IdP. + description: |- + OpenID Connect and IdP-defined permission bundles to request delegated access from the user + > **Note:** The [IdP type](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=type&t=request) table lists the scopes that are supported for each IdP. items: type: string example: openid @@ -6519,9 +6818,7 @@ components: - OIDC ProtocolMtls: title: Mutual TLS Protocol - description: >- - Protocol settings for the [MTLS - Protocol](https://tools.ietf.org/html/rfc5246#section-7.4.4) + description: Protocol settings for the [MTLS Protocol](https://tools.ietf.org/html/rfc5246#section-7.4.4) type: object properties: credentials: @@ -6535,7 +6832,7 @@ components: - MTLS ProtocolIdVerification: title: ID Verification - description: Protocol settings for the IDV + description: Protocol settings for the IDV vendor type: object properties: credentials: @@ -6555,177 +6852,40 @@ components: - ACTIVE - INACTIVE IdentityProviderType: - description: >- - The IdP object's `type` property identifies the social or enterprise IdP - used for authentication. - - Each IdP uses a specific protocol, therefore the `protocol` object must - correspond with the IdP `type`. - - If the protocol is OAuth 2.0-based, the `protocol` object's `scopes` - property must also correspond with the scopes supported by the IdP - `type`. - - For policy actions supported by each IdP type, see [IdP type policy - actions](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=policy&t=request). - - - | Type | - Description - | Corresponding protocol | Corresponding protocol - scopes | - - | ------------------ | - ----------------------------------------------------------------------------------------------------------------------------------------------------- - | ---------------------- | - -------------------------------------------------------------------- | - - | `AMAZON` | - [Amazon](https://developer.amazon.com/settings/console/registration?return_to=/) as - the IdP | OpenID Connect - | `profile`, `profile:user_id` - | - - | `APPLE` | - [Apple](https://developer.apple.com/sign-in-with-apple/) as the - IdP | - OpenID Connect | `names`, `email`, - `openid` | - - | `DISCORD` | [Discord](https://discord.com/login) as the - IdP - | OAuth 2.0 | `identify`, - `email` | - - | `FACEBOOK` | - [Facebook](https://developers.facebook.com) as the - IdP - | OAuth 2.0 | `public_profile`, - `email` | - - | `GITHUB` | [GitHub](https://github.com/join) as the - IdP - | OAuth 2.0 | - `user` | - - | `GITLAB` | - [GitLab](https://gitlab.com/users/sign_in) as the - IdP - | OpenID Connect | `openid`, `read_user`, `profile`, - `email` | - - | `GOOGLE` | - [Google](https://accounts.google.com/signup) as the - IdP - | OpenID Connect | `openid`, `email`, - `profile` | - - | `IDV_PERSONA` | - [Persona](https://app.withpersona.com/dashboard/login) as the IDV - IdP | ID - verification - | - | - - | `IDV_CLEAR` | [CLEAR - Verified](https://www.clearme.com/) as the IDV - IdP - | ID verification | `openid`, `profile`, - `identity_assurance` | - - | `IDV_INCODE` | [Incode](https://incode.com/) as the IDV - IdP - | ID verification | `openid`, `profile`, - `identity_assurance` | - - | `LINKEDIN` | - [LinkedIn](https://developer.linkedin.com/) as the - IdP - | OAuth 2.0 | `r_emailaddress`, - `r_liteprofile` | - - | `LOGINGOV` | - [Login.gov](https://developers.login.gov/) as the - IdP - | OpenID Connect | `email`, `profile`, - `profile:name` | - - | `LOGINGOV_SANDBOX` | [Login.gov's identity - sandbox](https://developers.login.gov/testing/) as the - IdP | OpenID - Connect | `email`, `profile`, - `profile:name` | - - | `MICROSOFT` | [Microsoft Enterprise - SSO](https://azure.microsoft.com/) as the - IdP | - OpenID Connect | `openid`, `email`, `profile`, - `https://graph.microsoft.com/User.Read` | - - | `OIDC` | IdP that supports [OpenID - Connect](https://openid.net/specs/openid-connect-core-1_0.html) - | OpenID Connect | `openid`, `email`, - `profile` | - - | `PAYPAL` | [Paypal](https://www.paypal.com/signin) as - the - IdP - | OpenID Connect | `openid`, `email`, - `profile` | - - | `PAYPAL_SANDBOX` | [Paypal - Sandbox](https://developer.paypal.com/tools/sandbox/) as the - IdP | OpenID - Connect | `openid`, `email`, - `profile` | - - | `SALESFORCE` | - [SalesForce](https://login.salesforce.com/) as the - IdP - | OAuth 2.0 | `id`, `email`, - `profile` | - - | `SAML2` | Enterprise IdP that supports the [SAML 2.0 Web - Browser SSO - Profile](https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf)| - SAML 2.0 - | - | - - | `SPOTIFY` | [Spotify](https://developer.spotify.com/) as - the - IdP - | OpenID Connect | `user-read-email`, - `user-read-private` | - - | `X509` | [Smart Card - IdP](https://tools.ietf.org/html/rfc5280) - | Mutual TLS - | - | - - | `XERO` | - [Xero](https://www.xero.com/us/signup/api/) as the - IdP - | OpenID Connect | `openid`, `profile`, - `email` | - - | `YAHOO` | [Yahoo](https://login.yahoo.com/) as the - IdP - | OpenID Connect | `openid`, `profile`, - `email` | - - | `YAHOOJP` | [Yahoo - Japan](https://login.yahoo.co.jp/config/login) as the - IdP | - OpenID Connect | `openid`, `profile`, - `email` | - - | `OKTA_INTEGRATION` | IdP that supports the [OpenID - Connect](https://openid.net/specs/openid-connect-core-1_0.html) Org2Org - IdP | OpenID - Connect | `openid`, `email`, - `profile` | + description: |- + The IdP object's `type` property identifies the social or enterprise IdP used for authentication. + Each IdP uses a specific protocol, therefore the `protocol` object must correspond with the IdP `type`. + If the protocol is OAuth 2.0-based, the `protocol` object's `scopes` property must also correspond with the scopes supported by the IdP `type`. + For policy actions supported by each IdP type, see [IdP type policy actions](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=policy&t=request). + + | Type | Description | Corresponding protocol | Corresponding protocol scopes | + | ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------- | -------------------------------------------------------------------- | + | `AMAZON` | [Amazon](https://developer.amazon.com/settings/console/registration?return_to=/) as the IdP | OpenID Connect | `profile`, `profile:user_id` | + | `APPLE` | [Apple](https://developer.apple.com/sign-in-with-apple/) as the IdP | OpenID Connect | `names`, `email`, `openid` | + | `DISCORD` | [Discord](https://discord.com/login) as the IdP | OAuth 2.0 | `identify`, `email` | + | `FACEBOOK` | [Facebook](https://developers.facebook.com) as the IdP | OAuth 2.0 | `public_profile`, `email` | + | `GITHUB` | [GitHub](https://github.com/join) as the IdP | OAuth 2.0 | `user` | + | `GITLAB` | [GitLab](https://gitlab.com/users/sign_in) as the IdP | OpenID Connect | `openid`, `read_user`, `profile`, `email` | + | `GOOGLE` | [Google](https://accounts.google.com/signup) as the IdP | OpenID Connect | `openid`, `email`, `profile` | + | `IDV_PERSONA` | [Persona](https://app.withpersona.com/dashboard/login) as the IDV IdP | ID verification | | + | `IDV_CLEAR` | [CLEAR Verified](https://www.clearme.com/) as the IDV IdP | ID verification | `openid`, `profile`, `identity_assurance` | + | `IDV_INCODE` | [Incode](https://incode.com/) as the IDV IdP | ID verification | `openid`, `profile`, `identity_assurance` | + | `IDV_STANDARD` | Custom IDV as the IDV IdP | ID verification | `openid`, `profile`, `identity_assurance` | + | `LINKEDIN` | [LinkedIn](https://developer.linkedin.com/) as the IdP | OAuth 2.0 | `r_emailaddress`, `r_liteprofile` | + | `LOGINGOV` | [Login.gov](https://developers.login.gov/) as the IdP | OpenID Connect | `email`, `profile`, `profile:name` | + | `LOGINGOV_SANDBOX` | [Login.gov's identity sandbox](https://developers.login.gov/testing/) as the IdP | OpenID Connect | `email`, `profile`, `profile:name` | + | `MICROSOFT` | [Microsoft Enterprise SSO](https://azure.microsoft.com/) as the IdP | OpenID Connect | `openid`, `email`, `profile`, `https://graph.microsoft.com/User.Read` | + | `OIDC` | IdP that supports [OpenID Connect](https://openid.net/specs/openid-connect-core-1_0.html) | OpenID Connect | `openid`, `email`, `profile` | + | `PAYPAL` | [Paypal](https://www.paypal.com/signin) as the IdP | OpenID Connect | `openid`, `email`, `profile` | + | `PAYPAL_SANDBOX` | [Paypal Sandbox](https://developer.paypal.com/tools/sandbox/) as the IdP | OpenID Connect | `openid`, `email`, `profile` | + | `SALESFORCE` | [SalesForce](https://login.salesforce.com/) as the IdP | OAuth 2.0 | `id`, `email`, `profile` | + | `SAML2` | Enterprise IdP that supports the [SAML 2.0 Web Browser SSO Profile](https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf)| SAML 2.0 | | + | `SPOTIFY` | [Spotify](https://developer.spotify.com/) as the IdP | OpenID Connect | `user-read-email`, `user-read-private` | + | `X509` | [Smart Card IdP](https://tools.ietf.org/html/rfc5280) | Mutual TLS | | + | `XERO` | [Xero](https://www.xero.com/us/signup/api/) as the IdP | OpenID Connect | `openid`, `profile`, `email` | + | `YAHOO` | [Yahoo](https://login.yahoo.com/) as the IdP | OpenID Connect | `openid`, `profile`, `email` | + | `YAHOOJP` | [Yahoo Japan](https://login.yahoo.co.jp/config/login) as the IdP | OpenID Connect | `openid`, `profile`, `email` | + | `OKTA_INTEGRATION` | IdP that supports the [OpenID Connect](https://openid.net/specs/openid-connect-core-1_0.html) Org2Org IdP | OpenID Connect | `openid`, `email`, `profile` | type: string enum: - AMAZON @@ -6738,6 +6898,7 @@ components: - IDV_CLEAR - IDV_INCODE - IDV_PERSONA + - IDV_STANDARD - LINKEDIN - LOGINGOV - LOGINGOV_SANDBOX @@ -6775,11 +6936,67 @@ components: - security_question - tac AuthenticatorEnrollmentLinks: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - $ref: '#/components/schemas/LinksUser' - - $ref: '#/components/schemas/LinksAuthenticator' readOnly: true + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + user: + description: Returns information about the specified user + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + authenticator: + description: Returns information about a specific authenticator. See [Retrieve an authenticator](https://developer.okta.com/docs/api/openapi/okta-management/management/authenticator/getauthenticator). + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + x-okta-ignore-redocly-rules-for-sdk: true AuthenticatorEnrollmentCreateRequest: type: object properties: @@ -6848,16 +7065,14 @@ components: href: type: string description: Link URI - example: >- - https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7/clients/0oabskvc6442nkvQO0h7/grants + example: https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7/clients/0oabskvc6442nkvQO0h7/grants TokenResourcesHrefObject: type: object properties: href: type: string description: Link URI - example: >- - https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7/clients/0oabskvc6442nkvQO0h7/tokens + example: https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7/clients/0oabskvc6442nkvQO0h7/tokens createdProperty: description: Timestamp when the object was created format: date-time @@ -6916,8 +7131,7 @@ components: href: type: string description: Link URI - example: >- - https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7/scopes/scpCmCCV1DpxVkCaye2X + example: https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7/scopes/scpCmCCV1DpxVkCaye2X title: type: string description: Link name @@ -6939,21 +7153,19 @@ components: href: type: string description: Link URI - example: >- - https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7 + example: https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7 title: type: string description: Link name example: Example Authorization Server OAuth2RefreshTokenScope: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: description: type: string description: Description of the Scope - example: >- - Requests a refresh token by default, used to obtain more access - tokens without re-prompting the user for authentication + example: Requests a refresh token by default, used to obtain more access tokens without re-prompting the user for authentication displayName: type: string description: Name of the end user displayed in a consent dialog @@ -6967,49 +7179,36 @@ components: description: Scope name example: offline_access _links: - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the - current status of an application using the [JSON Hypertext - Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. This object is used for dynamic discovery of related - resources and lifecycle operations. + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status of an application using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. type: object properties: scope: description: Link to Scope resource - allOf: - - $ref: '#/components/schemas/OfflineAccessScopeResourceHrefObject' + type: object + properties: + href: + type: string + description: Link URI + example: https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7/scopes/scppb56cIl4GvGxy70g3 + title: + type: string + description: Link name + example: offline_access RevokeRefreshTokenHrefObject: type: object properties: href: type: string description: Link URI - example: >- - https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7/clients/0oabskvc6442nkvQO0h7/tokens/oar579Mcp7OUsNTlo0g3 + example: https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7/clients/0oabskvc6442nkvQO0h7/tokens/oar579Mcp7OUsNTlo0g3 PasswordCredential: - description: >- + description: |- Specifies a password for a user. + When a user has a valid password, imported hashed password, or password hook, and a response object contains + a password credential, then the password object is a bare object without the value property defined (for example, `password: {}`). This indicates that a password value exists. You can modify password policy requirements in the Admin Console by editing the Password authenticator: **Security** > **Authenticators** > **Password** (or for Okta Classic orgs, use **Security** > **Authentication** > **Password**). - When a user has a valid password, imported hashed password, or password - hook, and a response object contains - - a password credential, then the password object is a bare object without - the value property defined (for example, `password: {}`). This indicates - that a password value exists. You can modify password policy - requirements in the Admin Console by editing the Password - authenticator: **Security** > **Authenticators** > **Password** (or for - Okta Classic orgs, use **Security** > **Authentication** > - **Password**). - - - For information on defaults and configuring your password policies, see - [Configure the password - authenticator](https://help.okta.com/okta_help.htm?type=oie&id=ext-configure-password) - in the help documentation. + For information on defaults and configuring your password policies, see [Configure the password authenticator](https://help.okta.com/okta_help.htm?type=oie&id=ext-configure-password) in the help documentation. type: object properties: hash: @@ -7019,17 +7218,11 @@ components: value: type: string writeOnly: true - description: >- - Specifies the password for a user. The password policy validates - this password. + description: Specifies the password for a user. The password policy validates this password. format: password example: pa$$word AuthenticationProvider: - description: >- - Specifies the authentication provider that validates the user's password - credential. The user's current provider is managed by the **Delegated - Authentication** settings for your org. The provider object is - **read-only**. + description: Specifies the authentication provider that validates the user's password credential. The user's current provider is managed by the **Delegated Authentication** settings for your org. The provider object is **read-only**. type: object properties: name: @@ -7041,10 +7234,8 @@ components: $ref: '#/components/schemas/AuthenticationProviderType' readOnly: true RecoveryQuestionCredential: - description: >- - Specifies a secret question and answer that's validated (case - insensitive) when a user forgets their - + description: |- + Specifies a secret question and answer that's validated (case insensitive) when a user forgets their password or unlocks their account. The answer property is write-only. type: object properties: @@ -7076,10 +7267,7 @@ components: lastUpdated: type: string format: date-time - description: >- - Timestamp when the device record was last updated. Updates occur - when Okta collects and saves device signals during authentication, - and when the lifecycle state of the device changes. + description: Timestamp when the device record was last updated. Updates occur when Okta collects and saves device signals during authentication, and when the lifecycle state of the device changes. readOnly: true profile: $ref: '#/components/schemas/DeviceProfile' @@ -7131,21 +7319,337 @@ components: - PENDING_ACTIVATION readOnly: true UserFactorLinks: - allOf: - - $ref: '#/components/schemas/LinksActivate' - - $ref: '#/components/schemas/LinksCancel' - - $ref: '#/components/schemas/LinksDeactivate' - - $ref: '#/components/schemas/LinksEnroll' - - $ref: '#/components/schemas/LinksFactor' - - $ref: '#/components/schemas/LinksPoll' - - $ref: '#/components/schemas/LinksQrcode' - - $ref: '#/components/schemas/LinksQuestions' - - $ref: '#/components/schemas/LinksResend' - - $ref: '#/components/schemas/LinksSend' - - $ref: '#/components/schemas/LinksSelf' - - $ref: '#/components/schemas/LinksUser' - - $ref: '#/components/schemas/LinksVerify' readOnly: true + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + activate: + description: Activates an enrolled factor. See [Activate a factor](https://developer.okta.com/docs/api/openapi/okta-management/management/userfactor/activatefactor). + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + cancel: + description: Cancels a `push` factor challenge with a `WAITING` status + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + deactivate: + description: Deactivates the factor. See [Unenroll a factor](https://developer.okta.com/docs/api/openapi/okta-management/management/userfactor/unenrollfactor). + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + enroll: + description: Enrolls a supported factor. See [Enroll a factor](https://developer.okta.com/docs/api/openapi/okta-management/management/userfactor/enrollfactor). + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + factor: + description: Link to the factor resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + poll: + description: Polls the factor resource for status information. Always use the `poll` link instead of manually constructing your own URL. + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + qrcode: + description: QR code that encodes the push activation code needed for enrollment on the device + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + question: + description: Lists all supported security questions. See [List all supported security questions](https://developer.okta.com/docs/api/openapi/okta-management/management/userfactor/listsupportedsecurityquestions). + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + resend: + description: Resends the factor enrollment challenge. See [Resend a factor enrollment](https://developer.okta.com/docs/api/openapi/okta-management/management/userfactor/resendenrollfactor). + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + send: + description: Sends an activation link through email or sms for users who can't scan the QR code + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + user: + description: Returns information on the specified user + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + verify: + description: Verifies the factor resource. See [Verify a factor](https://developer.okta.com/docs/api/openapi/okta-management/management/userfactor/verifyfactor). + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. UserFactorProvider: type: string enum: @@ -7162,35 +7666,79 @@ components: example: 1234567890 type: string useNumberMatchingChallenge: - description: >- + description: |- Select whether to use a number matching challenge for a `push` factor. - - > **Note:** Sending a request with a body is required when you verify a - `push` factor with a number matching challenge. + > **Note:** Sending a request with a body is required when you verify a `push` factor with a number matching challenge. example: true x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false SKUs: [] type: boolean - LinksUser: + LinksUserFactors: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: user: - allOf: - - description: Returns information on the specified user - - $ref: '#/components/schemas/HrefObject' + description: Returns information on the specified user + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href readOnly: true LinksVerify: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: verify: - allOf: - - description: >- - Verifies the factor resource. See [Verify a - factor](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/verifyFactor). - - $ref: '#/components/schemas/HrefObject' + description: Verifies the factor resource. See [Verify a factor](https://developer.okta.com/docs/api/openapi/okta-management/management/userfactor/verifyfactor). + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href readOnly: true UserFactorVerifyResult: description: Result of a factor verification @@ -7211,15 +7759,11 @@ components: ERROR: Verification encountered an unexpected server error EXPIRED: User didn't complete the verification within the allowed time window FAILED: Verification failed - PASSCODE_REPLAYED: >- - User previously verified the factor within the same time window. - Another verification is required during another time window. + PASSCODE_REPLAYED: User previously verified the factor within the same time window. Another verification is required during another time window. REJECTED: User rejected the verification SUCCESS: User completed the verification TIMEOUT: Okta didn't complete the verification within the allowed time window - TIME_WINDOW_EXCEEDED: >- - User completed the verification outside of the allowed time window. - Another verification is required. + TIME_WINDOW_EXCEEDED: User completed the verification outside of the allowed time window. Another verification is required. UserFactorVerifyResultWaiting: description: Result of a factor verification type: string @@ -7228,9 +7772,7 @@ components: x-enumDescriptions: WAITING: Verification is in progress NumberFactorChallengeEmbeddedLinks: - description: >- - Contains the `challenge` and `correctAnswer` objects for `push` factors - that use a number matching challenge + description: Contains the `challenge` and `correctAnswer` objects for `push` factors that use a number matching challenge x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: false @@ -7242,9 +7784,7 @@ components: description: Number matching challenge for a `push` factor properties: correctAnswer: - description: >- - The correct answer for a `push` factor that uses a number - matching challenge + description: The correct answer for a `push` factor that uses a number matching challenge type: integer example: 72 nullable: true @@ -7262,8 +7802,8 @@ components: user: $ref: '#/components/schemas/HrefObjectUserLink' UserRiskReason: - description: Describes the risk level for the user - example: Admin override risk + description: The reason for the user's current risk level. Defaults to `override.by.admin` when set by an admin without a custom reason. + example: override.by.admin type: string UserRiskLevelPut: description: The risk level associated with the user @@ -7271,6 +7811,7 @@ components: enum: - HIGH - LOW + - MEDIUM RoleAssignmentType: description: Role assignment type type: string @@ -7283,59 +7824,46 @@ components: GROUP: The role is assigned to a group CLIENT: The role is assigned to a client app RoleType: - description: Standard role type + title: roleType + description: |- + | Role type | Description | + |------------------------------|-------------------------------------------------------------| + | ACCESS_CERTIFICATIONS_ADMIN | Access Certifications Administrator IAM-based standard role | + | ACCESS_REQUESTS_ADMIN | Access Requests Administrator IAM-based standard role | + | API_ACCESS_MANAGEMENT_ADMIN | Access Management Administrator standard role | + | APP_ADMIN | Application Administrator standard role | + | CUSTOM | Custom admin role | + | GROUP_MEMBERSHIP_ADMIN | Group Membership Administrator standard role | + | HELP_DESK_ADMIN | Help Desk Administrator standard role | + | ORG_ADMIN | Organizational Administrator standard role | + | READ_ONLY_ADMIN | Read-Only Administrator standard role | + | REPORT_ADMIN | Report Administrator standard role | + | SUPER_ADMIN | Super Administrator standard role | + | USER_ADMIN | User Administrator standard role | + | WORKFLOWS_ADMIN | Workflows Administrator IAM-based standard role | type: string enum: - ACCESS_CERTIFICATIONS_ADMIN - ACCESS_REQUESTS_ADMIN - API_ACCESS_MANAGEMENT_ADMIN - - API_ADMIN - APP_ADMIN - CUSTOM - GROUP_MEMBERSHIP_ADMIN - HELP_DESK_ADMIN - - MOBILE_ADMIN - ORG_ADMIN - READ_ONLY_ADMIN - REPORT_ADMIN - SUPER_ADMIN - USER_ADMIN - WORKFLOWS_ADMIN - x-enumDescriptions: - API_ACCESS_MANAGEMENT_ADMIN: Access Management Administrator - API_ADMIN: Access Management Administrator - APP_ADMIN: Application Administrator - CUSTOM: Custom label specified by the client - GROUP_MEMBERSHIP_ADMIN: Group Membership Administrator - HELP_DESK_ADMIN: Help Desk Administrator - MOBILE_ADMIN: Mobile Administrator - ORG_ADMIN: Organizational Administrator - READ_ONLY_ADMIN: Read-Only Administrator - REPORT_ADMIN: Report Administrator - SUPER_ADMIN: Super Administrator - USER_ADMIN: Group Administrator - WORKFLOWS_ADMIN: Workflows Administrator - ACCESS_CERTIFICATIONS_ADMIN: Access Certifications Administrator (predefined resource sets) - ACCESS_REQUESTS_ADMIN: Access Requests Administrator (predefined resource sets) LinksAssignee: - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the - [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. type: object properties: assignee: $ref: '#/components/schemas/HrefObjectAssigneeLink' LinksCustomRoleResponse: - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the - [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. This object is used for dynamic discovery of related - resources. + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources. type: object properties: assignee: @@ -7349,12 +7877,7 @@ components: role: $ref: '#/components/schemas/HrefObjectRoleLink' LinksGovernanceSources: - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the - sources using the [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the sources using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. type: object properties: assignee: @@ -7369,12 +7892,7 @@ components: - CUSTOM - ENTITLEMENT-BUNDLE LinksGovernanceResources: - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the - resources using the [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the resources using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. type: object properties: resources: @@ -7391,17 +7909,11 @@ components: type: string description: The resources id LinksNext: - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the - current status of an application using the [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. Use the `LinksNext` object for dynamic discovery of - related resources and lifecycle operations. + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status of an application using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. Use the `LinksNext` object for dynamic discovery of related resources and lifecycle operations. type: object properties: next: - $ref: '#/components/schemas/HrefObject' + $ref: '#/components/schemas/HrefObjectNextLink' readOnly: true CatalogApplicationStatus: description: App status @@ -7410,13 +7922,59 @@ components: - ACTIVE - INACTIVE HrefObjectLogoLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the logo resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the logo resource HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) NotificationType: description: The type of notification type: string @@ -7438,21 +7996,15 @@ components: AD_AGENT: System notification sent when an AD agent disconnects or reconnects AGENT_AUTO_UPDATE_NOTIFICATION: System notification sent when an agent automatically updates APP_IMPORT: System notification sent with the status of an app user import - CONNECTOR_AGENT: >- - System notification sent when an on-premises provisioning or Okta - on-prem MFA agent disconnects or reconnects + CONNECTOR_AGENT: System notification sent when an on-premises provisioning or Okta on-prem MFA agent disconnects or reconnects IWA_AGENT: System notification sent when an IGA agent disconnects or reconnects LDAP_AGENT: System notification sent when an LDAP agent disconnects or reconnects OKTA_ANNOUNCEMENT: Okta communication sent for announcements and release notes OKTA_UPDATE: Okta communication sent for scheduled system updates - RATELIMIT_NOTIFICATION: >- - System notification sent when an org reaches rate limit warning or - violation thresholds + RATELIMIT_NOTIFICATION: System notification sent when an org reaches rate limit warning or violation thresholds REPORT_SUSPICIOUS_ACTIVITY: System notification sent when a user reports suspicious activity USER_DEPROVISION: System notification sent when a user is deprovisioned from apps - USER_LOCKED_OUT: >- - System notification sent when a user is locked out from logging in to - Okta + USER_LOCKED_OUT: System notification sent when a user is locked out from logging in to Okta SubscriptionStatus: description: The status of the subscription type: string @@ -7468,12 +8020,7 @@ components: items: $ref: '#/components/schemas/HttpMethod' AuthenticationProviderWritable: - description: >- - Specifies the authentication provider that validates the user password - credential. The user's current provider is managed by the **Delegated - Authentication** settings in your org. See [Create user with - authentication - provider](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#create-user-with-authentication-provider). + description: Specifies the authentication provider that validates the user password credential. The user's current provider is managed by the **Delegated Authentication** settings in your org. See [Create user with authentication provider](https://developer.okta.com/docs/api/openapi/okta-management/management/user/create-user-with-password-and-recovery-question#user/Create-user-with-authentication-provider). type: object properties: name: @@ -7483,14 +8030,15 @@ components: type: $ref: '#/components/schemas/AuthenticationProviderTypeWritable' OktaUserGroupProfile: - description: >- - Profile for any group that is not imported from Active Directory. - Specifies the standard - + description: |- + Profile for any group that is not imported from Active Directory. Specifies the standard and custom profile properties for a group. - The `objectClass` for these groups is `okta:user_group`. + + You can extend group profiles with custom properties, but you must first add the properties to the group profile schema before you can reference them. Use the Profile Editor in the Admin Console or the [Schemas API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/) to manage schema extensions. + + Custom properties can contain HTML tags. It is the client's responsibility to escape or encode this data before displaying it. Use [best-practices](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) to prevent cross-site scripting. type: object properties: description: @@ -7507,6 +8055,10 @@ components: Profile for a group that is imported from Active Directory. The `objectClass` for such groups is `okta:windows_security_principal`. + + You can extend group profiles with custom properties, but you must first add the properties to the group profile schema before you can reference them. Use the Profile Editor in the Admin Console or the [Schemas API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/) to manage schema extensions. + + Custom properties can contain HTML tags. It is the client's responsibility to escape or encode this data before displaying it. Use [best-practices](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) to prevent cross-site scripting. type: object properties: description: @@ -7542,9 +8094,7 @@ components: filter: $ref: '#/components/schemas/PolicyAccountLinkFilter' Provisioning: - description: >- - Specifies the behavior for just-in-time (JIT) provisioning of an IdP - user as a new Okta user and their group memberships + description: Specifies the behavior for just-in-time (JIT) provisioning of an IdP user as a new Okta user and their group memberships type: object properties: action: @@ -7555,50 +8105,27 @@ components: $ref: '#/components/schemas/ProvisioningGroups' profileMaster: type: boolean - description: >- - Determines if the IdP should act as a source of truth for user - profile attributes + description: Determines if the IdP should act as a source of truth for user profile attributes PolicySubject: - description: >- - Specifies the behavior for establishing, validating, and matching a - username for an IdP user + description: Specifies the behavior for establishing, validating, and matching a username for an IdP user type: object properties: filter: type: string - description: >- - Optional [regular expression - pattern](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Regular_expressions) - used to filter untrusted IdP usernames. - - * As a best security practice, you should define a regular - expression pattern to filter untrusted IdP usernames. This is - especially important if multiple IdPs are connected to your org. The - filter prevents an IdP from issuing an assertion for any user, - including partners or directory users in your Okta org. - - * For example, the filter pattern `(\S+@example\.com)` allows only - Users that have an `@example.com` username suffix. It rejects - assertions that have any other suffix such as `@corp.example.com` or - `@partner.com`. - - * Only `SAML2` and `OIDC` IdP providers support the `filter` - property. + description: |- + Optional [regular expression pattern](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Regular_expressions) used to filter untrusted IdP usernames. + * As a best security practice, you should define a regular expression pattern to filter untrusted IdP usernames. This is especially important if multiple IdPs are connected to your org. The filter prevents an IdP from issuing an assertion for any user, including partners or directory users in your Okta org. + * For example, the filter pattern `(\S+@example\.com)` allows only Users that have an `@example.com` username suffix. It rejects assertions that have any other suffix such as `@corp.example.com` or `@partner.com`. + * Only `SAML2` and `OIDC` IdP providers support the `filter` property. maxLength: 1024 example: (\S+@example\.com) matchAttribute: type: string - description: >- - Okta user profile attribute for matching a transformed IdP username. - Only for matchType `CUSTOM_ATTRIBUTE`. - - The `matchAttribute` must be a valid Okta user profile attribute of - one of the following types: - + description: |- + Okta user profile attribute for matching a transformed IdP username. Only for matchType `CUSTOM_ATTRIBUTE`. + The `matchAttribute` must be a valid Okta user profile attribute of one of the following types: * String (with no format or 'email' format only) - * Integer - * Number example: login matchType: @@ -7614,9 +8141,7 @@ components: response: $ref: '#/components/schemas/SamlResponseAlgorithm' SamlCredentials: - description: >- - Federation Trust Credentials for verifying assertions from the IdP and - signing requests to the IdP + description: Federation Trust Credentials for verifying assertions from the IdP and signing requests to the IdP type: object properties: signing: @@ -7645,29 +8170,19 @@ components: properties: honorPersistentNameId: type: boolean - description: >- - Determines if the IdP should persist account linking when the - incoming assertion NameID format is - `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent` + description: Determines if the IdP should persist account linking when the incoming assertion NameID format is `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent` default: true nameFormat: $ref: '#/components/schemas/SamlNameIdFormat' participateSlo: type: boolean - description: >- - Set to `true` to have Okta send a logout request to the upstream IdP - when a user signs out of Okta or a downstream app. + description: Set to `true` to have Okta send a logout request to the upstream IdP when a user signs out of Okta or a downstream app. sendApplicationContext: type: boolean - description: >- - Determines if the IdP should send the application context as - `` and `` in the - `` element of the `` message + description: Determines if the IdP should send the application context as `` and `` in the `` element of the `` message default: false OAuthCredentials: - description: >- - Client authentication credentials for an [OAuth 2.0 Authorization - Server](https://tools.ietf.org/html/rfc6749#section-2.3) + description: Client authentication credentials for an [OAuth 2.0 Authorization Server](https://tools.ietf.org/html/rfc6749#section-2.3) type: object properties: client: @@ -7675,16 +8190,10 @@ components: signing: $ref: '#/components/schemas/AppleClientSigning' OAuthEndpoints: - description: >- - The `OAUTH2` and `OIDC` protocols support the `authorization` and - `token` endpoints. Also, the `OIDC` protocol supports the `userInfo` and - `jwks` endpoints. - + description: |- + The `OAUTH2` and `OIDC` protocols support the `authorization` and `token` endpoints. Also, the `OIDC` protocol supports the `userInfo` and `jwks` endpoints. - The IdP Authorization Server (AS) endpoints are currently defined as - part of the [IdP - provider]((https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=type&t=request)) - and are read-only. + The IdP Authorization Server (AS) endpoints are currently defined as part of the [IdP provider]((https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=type&t=request)) and are read-only. type: object properties: authorization: @@ -7698,13 +8207,9 @@ components: userInfo: $ref: '#/components/schemas/OidcUserInfoEndpoint' OAuthScopes: - description: >- - IdP-defined permission bundles to request delegated access from the - user. - - > **Note:** The [identity provider - type](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=type&t=request) - table lists the scopes that are supported for each IdP. + description: |- + IdP-defined permission bundles to request delegated access from the user. + > **Note:** The [identity provider type](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=type&t=request) table lists the scopes that are supported for each IdP. items: type: string example: public_profile @@ -7714,25 +8219,27 @@ components: properties: request: $ref: '#/components/schemas/OidcRequestAlgorithm' + OidcIssuer: + description: OIDC issuer identifier (issuer URL / expected `iss` value) for the external IdP + type: object + properties: + url: + type: string + description: Issuer URL identifying the external IdP (the expected `iss` value in OIDC tokens) + example: https://idp.example.com OidcSettings: description: Advanced settings for the OpenID Connect protocol type: object properties: participateSlo: type: boolean - description: >- - Set to `true` to have Okta send a logout request to the upstream IdP - when a user signs out of Okta or a downstream app. + description: Set to `true` to have Okta send a logout request to the upstream IdP when a user signs out of Okta or a downstream app. sendApplicationContext: type: boolean - description: >- - Determines if the IdP should send the application context as - `OktaAppInstanceId` and `OktaAppName` params in the request + description: Determines if the IdP should send the application context as `OktaAppInstanceId` and `OktaAppName` params in the request default: false MtlsCredentials: - description: >- - Certificate chain description for verifying assertions from the Smart - Card + description: Certificate chain description for verifying assertions from the Smart Card type: object properties: trust: @@ -7743,7 +8250,7 @@ components: sso: $ref: '#/components/schemas/MtlsSsoEndpoint' IDVCredentials: - description: Credentials for verifying requests to the IDV + description: Credentials for verifying requests to the IDV vendor type: object properties: bearer: @@ -7757,17 +8264,14 @@ components: - apiKey client: type: object - description: >- - Client credentials - for `IDV_CLEAR` and `IDV_INCODE` IdP types + description: Client credentials for `IDV_CLEAR` and `IDV_INCODE` IdP types properties: client_id: type: string - description: The client ID that you generate in your IDV + description: The client ID that you generate in your IDV vendor client_secret: type: string - description: The client secret that you generate in your IDV + description: The client secret that you generate in your IDV vendor required: - client_id - client_secret @@ -7776,26 +8280,84 @@ components: isGenerallyAvailable: false SKUs: [] IDVEndpoints: - description: Contains the endpoints for the IDV + description: Contains endpoints for the IDV vendor. When you create an `IDV_STANDARD` IdP, you must include the `par`, `authorization`, `token`, and `jwks` endpoints in the request body. type: object properties: authorization: $ref: '#/components/schemas/IDVAuthorizationEndpoint' + jwks: + $ref: '#/components/schemas/OidcJwksEndpoint' par: $ref: '#/components/schemas/IDVParEndpoint' token: $ref: '#/components/schemas/IDVTokenEndpoint' - readOnly: true + required: + - par + - authorization + - token + - jwks + LinksUserAuthenticators: + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + user: + description: Returns information about the specified user + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href LinksAuthenticator: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: authenticator: - allOf: - - description: >- - Returns information about a specific authenticator. See - [Retrieve an - authenticator](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Authenticator/#tag/Authenticator/operation/getAuthenticator). - - $ref: '#/components/schemas/HrefObject' + description: Returns information about a specific authenticator. See [Retrieve an authenticator](https://developer.okta.com/docs/api/openapi/okta-management/management/authenticator/getauthenticator). + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href readOnly: true AuthenticatorProfileTacRequest: description: Defines the authenticator specific parameters @@ -7803,25 +8365,16 @@ components: properties: multiUse: type: boolean - description: >- - Determines whether the enrollment can be used more than once. To - enable multi-use, the org-level authenticator’s configuration must - allow multi-use. + description: Determines whether the enrollment can be used more than once. To enable multi-use, the org-level authenticator’s configuration must allow multi-use. writeOnly: true ttl: type: string - description: >- + description: |- Time-to-live (TTL) in minutes. - - Specifies how long the TAC enrollment is valid after it's created - and activated. - - The configured value must be between 10 minutes (`10`) and 10 days - (`14400`), inclusive. - - The actual allowed range depends on the org-level authenticator - configuration. + Specifies how long the TAC enrollment is valid after it's created and activated. + The configured value must be between 10 minutes (`10`) and 10 days (`14400`), inclusive. + The actual allowed range depends on the org-level authenticator configuration. writeOnly: true AuthenticatorProfileTacResponsePost: description: Defines the authenticator specific parameters @@ -7836,14 +8389,9 @@ components: description: Determines whether an enrollment can be used more than once tac: type: string - description: >- - A temporary access code used for authentication. It can be used one - or more times and is valid for a defined period specified by the - `ttl` property. - - The `tac` is returned in the response when the enrollment is - created. It is not returned when the enrollment is retrieved. - + description: |- + A temporary access code used for authentication. It can be used one or more times and is valid for a defined period specified by the `ttl` property. + The `tac` is returned in the response when the enrollment is created. It is not returned when the enrollment is retrieved. Issuing a new TAC invalidates any existing TAC for this user. OfflineAccessScopeResourceHrefObject: type: object @@ -7851,21 +8399,17 @@ components: href: type: string description: Link URI - example: >- - https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7/scopes/scppb56cIl4GvGxy70g3 + example: https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7/scopes/scppb56cIl4GvGxy70g3 title: type: string description: Link name example: offline_access PasswordCredentialHash: - description: >- - Specifies a hashed password to import into Okta. This allows an existing - password to be imported into Okta directly - - from some other store. Okta supports the BCRYPT, SHA-512, SHA-256, - SHA-1, MD5, and PBKDF2 hash functions for password import. + description: |- + Specifies a hashed password to import into Okta. This allows an existing password to be imported into Okta directly + from some other store. Okta supports the BCRYPT, SHA-512, SHA-256, SHA-1, MD5, and PBKDF2 hash functions for password import. A hashed password may be specified in a password object when creating or updating a user, but not for other operations. - See the [Create user with imported hashed password](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#create-user-with-imported-hashed-password) description. When you update a user with a hashed password, the user must be in the `STAGED` status. + See the [Create user with imported hashed password](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#create-user-with-imported-hashed-password) description. When you update a user with a hashed password, the user must be in the `STAGED` status. type: object properties: algorithm: @@ -7874,59 +8418,33 @@ components: $ref: '#/components/schemas/DigestAlgorithm' iterationCount: type: integer - description: >- - The number of iterations used when hashing passwords using PBKDF2. - Must be >= 4096. Only required for PBKDF2 algorithm. + description: The number of iterations used when hashing passwords using PBKDF2. Must be >= 4096. Only required for PBKDF2 algorithm. keySize: type: integer - description: >- - Size of the derived key in bytes. Only required for PBKDF2 - algorithm. + description: Size of the derived key in bytes. Only required for PBKDF2 algorithm. salt: - description: >- - Only required for salted hashes. For BCRYPT, this specifies Radix-64 - as the encoded salt used to generate the hash, - - which must be 22 characters long. For other salted hashes, this - specifies the Base64-encoded salt used to - + description: |- + Only required for salted hashes. For BCRYPT, this specifies Radix-64 as the encoded salt used to generate the hash, + which must be 22 characters long. For other salted hashes, this specifies the Base64-encoded salt used to generate the hash. type: string saltOrder: type: string - description: >- - Specifies whether salt was pre- or postfixed to the password before - hashing. Only required for salted algorithms. + description: Specifies whether salt was pre- or postfixed to the password before hashing. Only required for salted algorithms. value: - description: >- - For SHA-512, SHA-256, SHA-1, MD5, and PBKDF2, this is the actual - base64-encoded hash of the password (and salt, if used). - - This is the Base64-encoded `value` of the - SHA-512/SHA-256/SHA-1/MD5/PBKDF2 digest that was computed by either - pre-fixing or post-fixing - - the `salt` to the `password`, depending on the `saltOrder`. If a - `salt` was not used in the `source` system, then this should just be - - the Base64-encoded `value` of the password's - SHA-512/SHA-256/SHA-1/MD5/PBKDF2 digest. For BCRYPT, this is the - actual Radix-64 encoded hashed password. + description: |- + For SHA-512, SHA-256, SHA-1, MD5, and PBKDF2, this is the actual base64-encoded hash of the password (and salt, if used). + This is the Base64-encoded `value` of the SHA-512/SHA-256/SHA-1/MD5/PBKDF2 digest that was computed by either pre-fixing or post-fixing + the `salt` to the `password`, depending on the `saltOrder`. If a `salt` was not used in the `source` system, then this should just be + the Base64-encoded `value` of the password's SHA-512/SHA-256/SHA-1/MD5/PBKDF2 digest. For BCRYPT, this is the actual Radix-64 encoded hashed password. type: string workFactor: type: integer - description: >- - Governs the strength of the hash and the time required to compute - it. Only required for BCRYPT algorithm. + description: Governs the strength of the hash and the time required to compute it. Only required for BCRYPT algorithm. minimum: 1 maximum: 20 PasswordCredentialHook: - description: >- - Specify a [password import inline - hook](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/InlineHook/#tag/InlineHook/operation/createPasswordImportInlineHook) - to trigger verification of the user's password the first time the user - signs in. This allows an existing password to be imported into Okta - directly from some other store. + description: Specify a [password import inline hook](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/inlinehook/createpasswordimportinlinehook) to trigger verification of the user's password the first time the user signs in. This allows an existing password to be imported into Okta directly from some other store. type: object properties: type: @@ -7943,21 +8461,12 @@ components: - OKTA - SOCIAL x-enumDescriptions: - ACTIVE_DIRECTORY: >- - Specifies the Microsoft Active Directory instance name as the `name` - property - FEDERATION: >- - Specifies a federated identity provider (such as an SAML IdP) that - validates the user's password credentials. Doesn't support a - `password` or `recovery question` credential. The user must - authenticate through a trusted identity provider. + ACTIVE_DIRECTORY: Specifies the Microsoft Active Directory instance name as the `name` property + FEDERATION: Specifies a federated identity provider (such as an SAML IdP) that validates the user's password credentials. Doesn't support a `password` or `recovery question` credential. The user must authenticate through a trusted identity provider. IMPORT: Specifies a hashed password that was imported from an external source LDAP: Specifies the LDAP directory instance name as the `name` property OKTA: Specifies the Okta identity provider - SOCIAL: >- - Specifies an OIDC or third-party social identity provider. Doesn't - support a `password` or `recovery question` credential. The user must - authenticate through a trusted identity provider. + SOCIAL: Specifies an OIDC or third-party social identity provider. Doesn't support a `password` or `recovery question` credential. The user must authenticate through a trusted identity provider. readOnly: true DeviceProfile: type: object @@ -7976,14 +8485,10 @@ components: maxLength: 17 integrityJailbreak: type: boolean - description: >- - Indicates if the device is jailbroken or rooted. Only applicable to - `IOS` and `ANDROID` platforms + description: Indicates if the device is jailbroken or rooted. Only applicable to `IOS` and `ANDROID` platforms managed: type: boolean - description: >- - Indicates if the device is managed by mobile device management (MDM) - software + description: Indicates if the device is managed by mobile device management (MDM) software manufacturer: type: string description: Name of the manufacturer of the device @@ -8033,9 +8538,7 @@ components: properties: sensitive: type: boolean - description: >- - Indicates whether the associated value is Personal Identifiable - Information (PII) and requires masking + description: Indicates whether the associated value is Personal Identifiable Information (PII) and requires masking default: false value: type: string @@ -8050,151 +8553,588 @@ components: - UNSUSPENDED x-enumDescriptions: ACTIVE: Use activated devices to create and delete device user links - DEACTIVATED: >- - Deactivation causes a device to lose all device user links. Set the - device status to `DEACTIVATED` before deleting it. - SUSPENDED: >- - Use suspended devices to create and delete device user links. You can - only unsuspend or deactivate suspended devices. + DEACTIVATED: Deactivation causes a device to lose all device user links. Set the device status to `DEACTIVATED` before deleting it. + SUSPENDED: Use suspended devices to create and delete device user links. You can only unsuspend or deactivate suspended devices. UNSUSPENDED: Returns a suspended device to `ACTIVE`. LinksSelfAndFullUsersLifecycle: - allOf: - - $ref: '#/components/schemas/LinksSelfAndLifecycle' - - type: object + x-okta-ignore-redocly-rules-for-sdk: true + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + activate: + $ref: '#/components/schemas/HrefObjectActivateLink' + deactivate: + $ref: '#/components/schemas/HrefObjectDeactivateLink' + suspend: + $ref: '#/components/schemas/HrefObjectSuspendLink' + unsuspend: + $ref: '#/components/schemas/HrefObjectUnsuspendLink' + users: + description: Link to device users + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object properties: - suspend: - $ref: '#/components/schemas/HrefObjectSuspendLink' - unsuspend: - $ref: '#/components/schemas/HrefObjectUnsuspendLink' - users: - description: Link to device users - allOf: - - $ref: '#/components/schemas/HrefObject' + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + readOnly: true LinksActivate: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: activate: - allOf: - - description: >- - Activates an enrolled factor. See [Activate a - factor](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/activateFactor). - - $ref: '#/components/schemas/HrefObject' + description: Activates an enrolled factor. See [Activate a factor](https://developer.okta.com/docs/api/openapi/okta-management/management/userfactor/activatefactor). + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href readOnly: true LinksCancel: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: cancel: - allOf: - - description: Cancels a `push` factor challenge with a `WAITING` status - - $ref: '#/components/schemas/HrefObject' + description: Cancels a `push` factor challenge with a `WAITING` status + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href readOnly: true LinksDeactivate: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: deactivate: - allOf: - - description: >- - Deactivates the factor. See [Unenroll a - factor](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/unenrollFactor). - - $ref: '#/components/schemas/HrefObject' + description: Deactivates the factor. See [Unenroll a factor](https://developer.okta.com/docs/api/openapi/okta-management/management/userfactor/unenrollfactor). + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href readOnly: true LinksEnroll: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: enroll: - allOf: - - description: >- - Enrolls a supported factor. See [Enroll a - factor](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/enrollFactor). - - $ref: '#/components/schemas/HrefObject' + description: Enrolls a supported factor. See [Enroll a factor](https://developer.okta.com/docs/api/openapi/okta-management/management/userfactor/enrollfactor). + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href readOnly: true LinksFactor: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: factor: - allOf: - - description: Link to the factor resource - - $ref: '#/components/schemas/HrefObject' + description: Link to the factor resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href readOnly: true LinksPoll: + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: poll: - allOf: - - description: >- - Polls the factor resource for status information. Always use the - `poll` link instead of manually constructing your own URL. - - $ref: '#/components/schemas/HrefObject' + description: Polls the factor resource for status information. Always use the `poll` link instead of manually constructing your own URL. + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href readOnly: true LinksQrcode: + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + qrcode: + description: QR code that encodes the push activation code needed for enrollment on the device + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + readOnly: true + LinksQuestions: + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + question: + description: Lists all supported security questions. See [List all supported security questions](https://developer.okta.com/docs/api/openapi/okta-management/management/userfactor/listsupportedsecurityquestions). + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + readOnly: true + LinksResend: + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + resend: + description: Resends the factor enrollment challenge. See [Resend a factor enrollment](https://developer.okta.com/docs/api/openapi/okta-management/management/userfactor/resendenrollfactor). + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + readOnly: true + LinksSend: + x-okta-ignore-redocly-rules-for-sdk: true + type: object + properties: + send: + description: Sends an activation link through email or sms for users who can't scan the QR code + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + readOnly: true + HrefObjectUserLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the user resource + HrefObjectAssigneeLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the assignee resource + HrefObjectMemberLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the member resource + HrefObjectPermissionsLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the permissions resource + HrefObjectResourceSetLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true type: object properties: - qrcode: - allOf: - - description: >- - QR code that encodes the push activation code needed for - enrollment on the device - - $ref: '#/components/schemas/HrefObject' - readOnly: true - LinksQuestions: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the resource set resource + HrefObjectRoleLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true type: object properties: - question: - allOf: - - description: >- - Lists all supported security questions. See [List all supported - security - questions](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/listSupportedSecurityQuestions). - - $ref: '#/components/schemas/HrefObject' - readOnly: true - LinksResend: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the role resource + HrefObjectGovernanceResourcesLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true type: object properties: - resend: - allOf: - - description: >- - Resends the factor enrollment challenge. See [Resend a factor - enrollment](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/resendEnrollFactor). - - $ref: '#/components/schemas/HrefObject' - readOnly: true - LinksSend: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the resources + HrefObjectNextLink: + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true type: object properties: - send: - allOf: - - description: >- - Sends an activation link through email or sms for users who - can't scan the QR code - - $ref: '#/components/schemas/HrefObject' - readOnly: true - HrefObjectUserLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the user resource - HrefObjectAssigneeLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the assignee resource - HrefObjectMemberLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the member resource - HrefObjectPermissionsLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the permissions resource - HrefObjectResourceSetLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource set resource - HrefObjectRoleLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the role resource - HrefObjectGovernanceResourcesLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resources + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the next resource HttpMethod: type: string enum: @@ -8213,21 +9153,12 @@ components: - OKTA - SOCIAL x-enumDescriptions: - ACTIVE_DIRECTORY: >- - Specifies a Microsoft Active Directory instance name as the `name` - property - FEDERATION: >- - Specifies a federated identity provider (such as a SAML IdP) that - validates the user's password credentials. Doesn't support a - `password` or `recovery question` credential. The user must - authenticate through a trusted identity provider. + ACTIVE_DIRECTORY: Specifies a Microsoft Active Directory instance name as the `name` property + FEDERATION: Specifies a federated identity provider (such as a SAML IdP) that validates the user's password credentials. Doesn't support a `password` or `recovery question` credential. The user must authenticate through a trusted identity provider. IMPORT: Specifies a hashed password that was imported from an external source LDAP: Specifies the LDAP directory instance name as the `name` property OKTA: Specifies the Okta identity provider - SOCIAL: >- - Specifies an OIDC or third-party social identity provider. Doesn't - support a `password` or `recovery question` credential. The user must - authenticate through a trusted identity provider. + SOCIAL: Specifies an OIDC or third-party social identity provider. Doesn't support a `password` or `recovery question` credential. The user must authenticate through a trusted identity provider. PolicyAccountLinkAction: description: Specifies the account linking action for an IdP user type: string @@ -8235,20 +9166,10 @@ components: - AUTO - DISABLED x-enumDescriptions: - AUTO: >- - The IdP user is automatically linked to an Okta user when the - transformed IdP user matches an existing Okta user according to - [subject match - rules](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=policy/subject&t=request). - DISABLED: >- - Okta never attempts to link the IdP user to an existing Okta user, but - may still attempt to provision a new Okta user according to the - [provisioning action - type](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=policy/provisioning/action&t=request). + AUTO: The IdP user is automatically linked to an Okta user when the transformed IdP user matches an existing Okta user according to [subject match rules](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=policy/subject&t=request). + DISABLED: Okta never attempts to link the IdP user to an existing Okta user, but may still attempt to provision a new Okta user according to the [provisioning action type](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=policy/provisioning/action&t=request). PolicyAccountLinkFilter: - description: >- - Specifies filters on which users are available for account linking by an - IdP + description: Specifies filters on which users are available for account linking by an IdP type: object properties: groups: @@ -8256,30 +9177,18 @@ components: users: $ref: '#/components/schemas/PolicyAccountLinkFilterUsers' ProvisioningAction: - description: >- - Specifies the user provisioning action during authentication when an IdP - user isn't linked to an existing Okta user. - - * To successfully provision a new Okta user, you must enable - just-in-time (JIT) provisioning in your org security settings. - - * If the target username isn't unique or the resulting Okta user profile - is missing a required profile attribute, JIT provisioning may fail. - - * New Okta users are provisioned with either a `FEDERATION` or `SOCIAL` - authentication provider depending on the IdP type. + description: |- + Specifies the user provisioning action during authentication when an IdP user isn't linked to an existing Okta user. + * To successfully provision a new Okta user, you must enable just-in-time (JIT) provisioning in your org security settings. + * If the target username isn't unique or the resulting Okta user profile is missing a required profile attribute, JIT provisioning may fail. + * New Okta users are provisioned with either a `FEDERATION` or `SOCIAL` authentication provider depending on the IdP type. type: string enum: - AUTO - DISABLED x-enumDescriptions: - AUTO: >- - The IdP user profile is transformed through defined universal - directory profile mappings to an Okta user profile and automatically - provisioned as an Okta user. - DISABLED: >- - Okta rejects the authentication request and skips provisioning of a - new Okta user if the IdP user isn't linked to an existing Okta user. + AUTO: The IdP user profile is transformed through defined universal directory profile mappings to an Okta user profile and automatically provisioned as an Okta user. + DISABLED: Okta rejects the authentication request and skips provisioning of a new Okta user if the IdP user isn't linked to an existing Okta user. ProvisioningConditions: description: Conditional behaviors for an IdP user during authentication type: object @@ -8296,31 +9205,23 @@ components: $ref: '#/components/schemas/ProvisioningGroupsAction' assignments: type: array - description: >- - List of `OKTA_GROUP` group identifiers to add an IdP user as a - member with the `ASSIGN` action + description: List of `OKTA_GROUP` group identifiers to add an IdP user as a member with the `ASSIGN` action items: type: string example: 00gak46y5hydV6NdM0g4 filter: type: array - description: >- - Allowlist of `OKTA_GROUP` group identifiers for the `APPEND` or - `SYNC` provisioning action + description: Allowlist of `OKTA_GROUP` group identifiers for the `APPEND` or `SYNC` provisioning action items: type: string example: 00gak46y5hydV6NdM0g4 sourceAttributeName: type: string - description: >- - IdP user profile attribute name (case-insensitive) for an array - value that contains group memberships + description: IdP user profile attribute name (case-insensitive) for an array value that contains group memberships maxLength: 1024 example: Groups PolicySubjectMatchType: - description: >- - Determines the Okta user profile attribute match conditions for account - linking and authentication of the transformed IdP username + description: Determines the Okta user profile attribute match conditions for account linking and authentication of the transformed IdP username type: string enum: - CUSTOM_ATTRIBUTE @@ -8328,20 +9229,10 @@ components: - USERNAME - USERNAME_OR_EMAIL PolicyUserNameTemplate: - description: >- - [Okta Expression Language (EL) - expression](https://developer.okta.com/docs/reference/okta-expression-language/) - to generate or transform a unique username for the IdP user. - - * IdP user profile attributes can be referenced with the `idpuser` - prefix such as `idpuser.subjectNameId`. - - * You must define an IdP user profile attribute before it can be - referenced in an Okta EL expression. To define an IdP user attribute - policy, you may need to create a new IdP instance without a base profile - property. Then edit the IdP user profile to update the IdP instance with - an expression that references the IdP user profile attribute that you - just created. + description: |- + [Okta Expression Language (EL) expression](https://developer.okta.com/docs/reference/okta-expression-language/) to generate or transform a unique username for the IdP user. + * IdP user profile attributes can be referenced with the `idpuser` prefix such as `idpuser.subjectNameId`. + * You must define an IdP user profile attribute before it can be referenced in an Okta EL expression. To define an IdP user attribute policy, you may need to create a new IdP instance without a base profile property. Then edit the IdP user profile to update the IdP instance with an expression that references the IdP user profile attribute that you just created. type: object properties: template: @@ -8353,12 +9244,12 @@ components: description: Algorithm settings used to secure an `` message type: object properties: + digest: + $ref: '#/components/schemas/SamlRequestDigestAlgorithm' signature: $ref: '#/components/schemas/SamlRequestSignatureAlgorithm' SamlResponseAlgorithm: - description: >- - Algorithm settings for verifying `` messages and - `` elements from the IdP + description: Algorithm settings for verifying `` messages and `` elements from the IdP type: object properties: signature: @@ -8374,33 +9265,25 @@ components: type: object properties: additionalKids: - description: >- - Additional IdP key credential reference to the Okta X.509 signature - certificate + description: Additional IdP key credential reference to the Okta X.509 signature certificate type: array maxItems: 1 items: $ref: '#/components/schemas/ProtocolCredentialsKeyId' audience: type: string - description: >- - URI that identifies the target Okta IdP instance (SP) for an - `` + description: URI that identifies the target Okta IdP instance (SP) for an `` maxLength: 1024 example: https://www.okta.com/saml2/service-provider/spgv32vOnpdyeGSaiUpL issuer: type: string - description: >- - URI that identifies the issuer (IdP) of a `` message - `` element + description: URI that identifies the issuer (IdP) of a `` message `` element maxLength: 1024 example: urn:example:idp kid: $ref: '#/components/schemas/ProtocolCredentialsKeyId' SamlAcsEndpoint: - description: >- - Okta's `SPSSODescriptor` endpoint where the IdP sends a `` - message + description: Okta's `SPSSODescriptor` endpoint where the IdP sends a `` message type: object properties: binding: @@ -8408,56 +9291,39 @@ components: type: $ref: '#/components/schemas/SamlEndpointType' SamlSloEndpoint: - description: >- - IdP's `SingleLogoutService` endpoint where Okta sends a - `` message + description: IdP's `SingleLogoutService` endpoint where Okta sends a `` message type: object properties: binding: $ref: '#/components/schemas/ProtocolEndpointBinding' url: type: string - description: >- - URL of the binding-specific IdP endpoint where Okta sends a - `` + description: URL of the binding-specific IdP endpoint where Okta sends a `` maxLength: 1014 example: https://idp.example.com/saml2/slo SamlSsoEndpoint: - description: >- - IdP's `SingleSignOnService` endpoint where Okta sends an - `` message + description: IdP's `SingleSignOnService` endpoint where Okta sends an `` message type: object properties: binding: $ref: '#/components/schemas/ProtocolEndpointBinding' destination: type: string - description: >- - URI reference that indicates the address to which the - `` message is sent. - - The `destination` property is required if request signatures are - specified. See [SAML 2.0 Request Algorithm - object](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=protocol/0/algorithms/request&t=request). + description: |- + URI reference that indicates the address to which the `` message is sent. + The `destination` property is required if request signatures are specified. See [SAML 2.0 Request Algorithm object](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=protocol/0/algorithms/request&t=request). maxLength: 512 example: https://idp.example.com/saml2/sso url: type: string - description: >- - URL of the binding-specific endpoint to send an `` - message to the IdP. - - The value of `url` defaults to the same value as the `sso` endpoint - if omitted during creation of a new IdP instance. - - The `url` should be the same value as the `Location` attribute for a - published binding in the IdP's SAML Metadata `IDPSSODescriptor`. + description: |- + URL of the binding-specific endpoint to send an `` message to the IdP. + The value of `url` defaults to the same value as the `sso` endpoint if omitted during creation of a new IdP instance. + The `url` should be the same value as the `Location` attribute for a published binding in the IdP's SAML Metadata `IDPSSODescriptor`. maxLength: 1014 example: https://idp.example.com/saml2/sso SamlRelayStateFormat: - description: >- - The format used to generate the `relayState` in the SAML request. The - `FROM_URL` format is used if this value is null. + description: The format used to generate the `relayState` in the SAML request. The `FROM_URL` format is used if this value is null. type: string enum: - FROM_URL @@ -8472,63 +9338,43 @@ components: - urn:oasis:names:tc:SAML:2.0:nameid-format:persistent - urn:oasis:names:tc:SAML:2.0:nameid-format:transient OAuthCredentialsClient: - description: >- + description: |- OAuth 2.0 and OpenID Connect Client object - - > **Note:** You must complete client registration with the IdP - Authorization Server for your Okta IdP instance to obtain client - credentials. + > **Note:** You must complete client registration with the IdP Authorization Server for your Okta IdP instance to obtain client credentials. type: object properties: client_id: type: string - description: >- - The [Unique - identifier](https://tools.ietf.org/html/rfc6749#section-2.2) issued - by the AS for the Okta IdP instance + description: The [Unique identifier](https://tools.ietf.org/html/rfc6749#section-2.2) issued by the AS for the Okta IdP instance maxLength: 1024 example: your-client-id client_secret: type: string - description: >- - The [Client - secret](https://tools.ietf.org/html/rfc6749#section-2.3.1) issued by - the AS for the Okta IdP instance + description: The [Client secret](https://tools.ietf.org/html/rfc6749#section-2.3.1) issued by the AS for the Okta IdP instance maxLength: 1024 example: your-client-secret pkce_required: type: boolean - description: >- - Require Proof Key for Code Exchange (PKCE) for additional - verification + description: Require Proof Key for Code Exchange (PKCE) for additional verification token_endpoint_auth_method: type: string description: Client authentication methods supported by the token endpoint enum: - private_key_jwt AppleClientSigning: - description: >- - Information used to generate the secret JSON Web Token for the token - requests to Apple IdP - - > **Note:** The `privateKey` property is required for a CREATE request. - For an UPDATE request, it can be null and keeps the existing value if - it's null. The `privateKey` property isn't returned for LIST and GET - requests or UPDATE requests if it's null. + description: |- + Information used to generate the secret JSON Web Token for the token requests to Apple IdP + > **Note:** The `privateKey` property is required for a CREATE request. For an UPDATE request, it can be null and keeps the existing value if it's null. The `privateKey` property isn't returned for LIST and GET requests or UPDATE requests if it's null. type: object properties: kid: type: string - description: >- - The key ID that you obtained from Apple when you created the private - key for the client + description: The key ID that you obtained from Apple when you created the private key for the client maxLength: 1024 example: test key id privateKey: type: string - description: >- - The PKCS \#8 encoded private key that you created for the client and - downloaded from Apple + description: The PKCS \#8 encoded private key that you created for the client and downloaded from Apple maxLength: 1024 example: MIGTAgEAMBM........Cb9PnybCnzDv+3cWSGWqpAIsQQZ teamId: @@ -8537,9 +9383,7 @@ components: maxLength: 1024 example: test team id OAuthAuthorizationEndpoint: - description: >- - Endpoint for an [OAuth 2.0 Authorization Server - (AS)](https://tools.ietf.org/html/rfc6749#page-18) + description: Endpoint for an [OAuth 2.0 Authorization Server (AS)](https://tools.ietf.org/html/rfc6749#page-18) type: object properties: binding: @@ -8549,11 +9393,7 @@ components: description: URL of the IdP Authorization Server (AS) authorization endpoint example: https://idp.example.com/authorize OidcJwksEndpoint: - description: >- - Endpoint for the JSON Web Key Set (JWKS) document. This document - contains signing keys that are used to validate the signatures from the - provider. For more information on JWKS, see [JSON Web - Key](https://tools.ietf.org/html/rfc7517). + description: Endpoint for the JSON Web Key Set (JWKS) document. This document contains signing keys that are used to validate the signatures from the provider. For more information on JWKS, see [JSON Web Key](https://tools.ietf.org/html/rfc7517). type: object properties: binding: @@ -8572,9 +9412,7 @@ components: maxLength: 1014 example: https://idp.example.com/saml2/slo OAuthTokenEndpoint: - description: >- - Endpoint for an [OAuth 2.0 Authorization Server - (AS)](https://tools.ietf.org/html/rfc6749#page-18) + description: Endpoint for an [OAuth 2.0 Authorization Server (AS)](https://tools.ietf.org/html/rfc6749#page-18) type: object properties: binding: @@ -8584,10 +9422,7 @@ components: description: URL of the IdP Authorization Server (AS) token endpoint example: https://idp.example.com/token OidcUserInfoEndpoint: - description: >- - Endpoint for getting identity information about the user. For more - information on the `/userinfo` endpoint, see [OpenID - Connect](https://openid.net/specs/openid-connect-core-1_0.html#UserInfo). + description: Endpoint for getting identity information about the user. For more information on the `/userinfo` endpoint, see [OpenID Connect](https://openid.net/specs/openid-connect-core-1_0.html#UserInfo). type: object properties: binding: @@ -8620,13 +9455,17 @@ components: $ref: '#/components/schemas/MtlsTrustCredentialsRevocation' revocationCacheLifetime: type: number - description: Time in minutes to cache the certificate revocation information + description: |- + Time in minutes to cache the certificate revocation information + + > **Note:** This property isn't supported. Okta now handles CRL caching automatically. As of October 8, 2025, in Preview orgs, and October 13, 2025, in Production orgs, this property is ignored if it's specified in any API requests. Specifying this property in your API requests doesn't cause errors since the property has no effect. + > + > See [Deprecation Notice - Smart Card IdP Legacy CRL Cache Setting](https://support.okta.com/help/s/article/deprecation-notice-smart-card-idp-legacy-crl-cache-setting?language=en_US). + deprecated: true maximum: 4320 example: 2880 MtlsSsoEndpoint: - description: >- - The Single Sign-On (SSO) endpoint is the IdP's `SingleSignOnService` - endpoint + description: The Single Sign-On (SSO) endpoint is the IdP's `SingleSignOnService` endpoint type: object properties: url: @@ -8643,8 +9482,7 @@ components: - HTTP-REDIRECT url: type: string - description: URL of the IDV `authorization` endpoint - readOnly: true + description: URL of the `authorization` endpoint of the IDV vendor IDVParEndpoint: description: IDV [PAR](https://datatracker.ietf.org/doc/html/rfc9126) endpoint type: object @@ -8655,10 +9493,9 @@ components: - HTTP-POST url: type: string - description: URL of the IDV `par` endpoint - readOnly: true + description: URL of the `par` endpoint of the IDV vendor IDVTokenEndpoint: - description: IDV token endpoint + description: Token endpoint of the IDV vendor type: object properties: binding: @@ -8667,12 +9504,9 @@ components: - HTTP-POST url: type: string - description: URL of the IDV `token` endpoint - readOnly: true + description: URL of the `token` endpoint of the IDV vendor PasswordCredentialHashAlgorithm: - description: >- - The algorithm used to generate the hash using the password (and salt, - when applicable). + description: The algorithm used to generate the hash using the password (and salt, when applicable). type: string enum: - BCRYPT @@ -8682,20 +9516,15 @@ components: - SHA-256 - SHA-512 DigestAlgorithm: - description: >- - Algorithm used to generate the key. Only required for the PBKDF2 - algorithm. + description: Algorithm used to generate the key. Only required for the PBKDF2 algorithm. type: string enum: - SHA256_HMAC - SHA512_HMAC DiskEncryptionTypeDef: - description: >- + description: |- Type of encryption used on the device - - > **Note:** The following values map to Disk Encryption ON: `FULL`, - `USER`, `ALL_INTERNAL_VOLUMES`. All other values map to Disk Encryption - OFF. + > **Note:** The following values map to Disk Encryption ON: `FULL`, `USER`, `ALL_INTERNAL_VOLUMES`. All other values map to Disk Encryption OFF. type: string enum: - ALL_INTERNAL_VOLUMES @@ -8705,18 +9534,10 @@ components: - USER x-enumDescriptions: NONE: No encryption has been set. - FULL: >- - Disk is fully encrypted. Only applicable to `IOS` and `ANDROID` - platforms. - USER: >- - Encryption key is tied to the user or profile. Only applicable to - `ANDROID` platform. - ALL_INTERNAL_VOLUMES: >- - All internal disks are encrypted. Only applicable to `WINDOWS` and - `MACOS` platforms. - SYSTEM_VOLUME: >- - Only the system volume is encrypted. Only applicable to `WINDOWS` and - `MACOS` platforms. + FULL: Disk is fully encrypted. Only applicable to `IOS` and `ANDROID` platforms. + USER: Encryption key is tied to the user or profile. Only applicable to `ANDROID` platform. + ALL_INTERNAL_VOLUMES: All internal disks are encrypted. Only applicable to `WINDOWS` and `MACOS` platforms. + SYSTEM_VOLUME: Only the system volume is encrypted. Only applicable to `WINDOWS` and `MACOS` platforms. DevicePlatform: description: OS platform of the device type: string @@ -8726,31 +9547,77 @@ components: - MACOS - WINDOWS LinksSelfAndLifecycle: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - type: object - properties: - activate: - $ref: '#/components/schemas/HrefObjectActivateLink' - deactivate: - $ref: '#/components/schemas/HrefObjectDeactivateLink' + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + activate: + $ref: '#/components/schemas/HrefObjectActivateLink' + deactivate: + $ref: '#/components/schemas/HrefObjectDeactivateLink' + readOnly: true HrefObjectSuspendLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to suspend the resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to suspend the resource HrefObjectUnsuspendLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to unsuspend the resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to unsuspend the resource PolicyAccountLinkFilterGroups: description: Group memberships used to determine link candidates type: object properties: include: type: array - description: >- - Specifies the allowlist of Group identifiers to match against. Group - memberships are restricted to type `OKTA_GROUP`. + description: Specifies the allowlist of Group identifiers to match against. Group memberships are restricted to type `OKTA_GROUP`. items: type: string example: 00gjg5lzfBpn62wuF0g3 @@ -8763,92 +9630,60 @@ components: properties: exclude: type: array - description: >- - Specifies the blocklist of user identifiers to exclude from account - linking + description: Specifies the blocklist of user identifiers to exclude from account linking items: type: string example: 00u2c0nz7wj4UBs8V0g5 excludeAdmins: type: boolean - description: >- - Specifies whether admin users should be excluded from account - linking + description: Specifies whether admin users should be excluded from account linking default: false ProvisioningDeprovisionedCondition: - description: >- - Behavior for a previously deprovisioned IdP user during authentication. - Not supported with OIDC IdPs. + description: Behavior for a previously deprovisioned IdP user during authentication type: object properties: action: $ref: '#/components/schemas/ProvisioningDeprovisionedAction' ProvisioningSuspendedCondition: - description: >- - Behavior for a previously suspended IdP user during authentication. Not - supported with OIDC IdPs. + description: Behavior for a previously suspended IdP user during authentication type: object properties: action: $ref: '#/components/schemas/ProvisioningSuspendedAction' ProvisioningGroupsAction: - description: >- + description: |- Provisioning action for the IdP user's group memberships + | Enum | Description | Existing OKTA_GROUP Memberships | Existing APP_GROUP Memberships | Existing BUILT_IN Memberships | + | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | ------------------------------ | ----------------------------- | + | `APPEND` | Adds a user to any group defined by the IdP as a value of the `sourceAttributeName` array that matches the name of the allow listed group defined in the `filter` | Unchanged | Unchanged | Unchanged | + | `ASSIGN` | Assigns a user to groups defined in the `assignments` array | Unchanged | Unchanged | Unchanged | + | `NONE` | Skips processing of group memberships | Unchanged | Unchanged | Unchanged | + | `SYNC` | Group memberships are sourced by the IdP as a value of the `sourceAttributeName` array that matches the name of the group defined in the `filter` | Removed if not defined by the IdP in `sourceAttributeName` and matching name of the group in `filter` | Unchanged | Unchanged | - | Enum | - Description - | Existing OKTA_GROUP - Memberships - | Existing APP_GROUP Memberships | Existing BUILT_IN Memberships | - - | -------- | - ----------------------------------------------------------------------------------------------------------------------------------------------------------------- - | - ----------------------------------------------------------------------------------------------------- - | ------------------------------ | ----------------------------- | - - | `APPEND` | Adds a user to any group defined by the IdP as a value of - the `sourceAttributeName` array that matches the name of the allow - listed group defined in the `filter` | - Unchanged - | Unchanged | Unchanged | - - | `ASSIGN` | Assigns a user to groups defined in the `assignments` - array - | - Unchanged - | Unchanged | Unchanged | - - | `NONE` | Skips processing of group - memberships - | - Unchanged - | Unchanged | Unchanged | - - | `SYNC` | Group memberships are sourced by the IdP as a value of the - `sourceAttributeName` array that matches the name of the group defined - in the `filter` | Removed if not defined by the IdP in - `sourceAttributeName` and matching name of the group in `filter` | - Unchanged | Unchanged | - - - > **Note:** Group provisioning action is processed independently from - profile sourcing. You can sync group memberships through SAML with - profile sourcing disabled. + > **Note:** Group provisioning action is processed independently from profile sourcing. You can sync group memberships through SAML with profile sourcing disabled. type: string enum: - APPEND - ASSIGN - NONE - SYNC + SamlRequestDigestAlgorithm: + description: |- + XML Digest Algorithm setting for cryptographically hashing `` messages sent to the IdP + > **Note:** This property is ignored when you disable request signatures (`scope` set as `NONE`). + example: SHA-256 + x-okta-lifecycle: + lifecycle: GA + isGenerallyAvailable: true + type: string + enum: + - SHA-1 + - SHA-256 SamlRequestSignatureAlgorithm: - description: >- - XML digital Signature Algorithm settings for signing `` - messages sent to the IdP - - > **Note:** The `algorithm` property is ignored when you disable - request signatures (`scope` set as `NONE`). + description: |- + XML digital Signature Algorithm settings for signing `` messages sent to the IdP + > **Note:** The `algorithm` property is ignored when you disable request signatures (`scope` set as `NONE`). type: object properties: algorithm: @@ -8856,9 +9691,7 @@ components: scope: $ref: '#/components/schemas/ProtocolAlgorithmRequestScope' SamlResponseSignatureAlgorithm: - description: >- - XML digital Signature Algorithm settings for verifying `` - messages and `` elements from the IdP + description: XML digital Signature Algorithm settings for verifying `` messages and `` elements from the IdP type: object properties: algorithm: @@ -8875,21 +9708,16 @@ components: - HTTP-POST - HTTP-REDIRECT SamlEndpointType: - description: >- - Determines whether to publish an instance-specific (trust) or - organization (shared) ACS endpoint in the SAML metadata + description: Determines whether to publish an instance-specific (trust) or organization (shared) ACS endpoint in the SAML metadata default: INSTANCE type: string enum: - INSTANCE - ORG OidcRequestSignatureAlgorithm: - description: >- - Signature Algorithm settings for signing authorization requests sent to - the IdP - - > **Note:** The `algorithm` property is ignored when you disable - request signatures (`scope` set as `NONE`). + description: |- + Signature Algorithm settings for signing authorization requests sent to the IdP + > **Note:** The `algorithm` property is ignored when you disable request signatures (`scope` set as `NONE`). type: object properties: algorithm: @@ -8897,7 +9725,13 @@ components: scope: $ref: '#/components/schemas/ProtocolAlgorithmRequestScope' MtlsTrustCredentialsRevocation: - description: Mechanism to validate the certificate + description: |- + Mechanism to validate the certificate + + > **Note:** This property isn't supported. Okta now handles CRL caching automatically. As of October 8, 2025, in Preview orgs, and October 13, 2025, in Production orgs, this property is ignored if it's specified in any API requests. Specifying the property in your API requests doesn't cause any errors since the property has no effect. + > + > See [Deprecation Notice - Smart Card IdP Legacy CRL Cache Setting](https://support.okta.com/help/s/article/deprecation-notice-smart-card-idp-legacy-crl-cache-setting?language=en_US). + deprecated: true example: CRL type: string enum: @@ -8905,45 +9739,77 @@ components: - DELTA_CRL - OCSP HrefObjectActivateLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to activate the resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to activate the resource HrefObjectDeactivateLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to deactivate the resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to deactivate the resource ProvisioningDeprovisionedAction: - description: >- - Specifies the action during authentication when an IdP user is linked to - a previously deprovisioned Okta user + description: Specifies the action during authentication when an IdP user is linked to a previously deprovisioned Okta user type: string enum: - NONE - REACTIVATE x-enumDescriptions: - NONE: >- - Take no action. If an IdP user that matches a previously deprovisioned - Okta user attempts to authenticate, authentication fails. - REACTIVATE: >- - If an IdP user that matches a previously deprovisioned Okta user - attempts to authenticate, reactivate the matching user in Okta and - allow the authentication attempt to proceed. + NONE: Take no action. If an IdP user that matches a previously deprovisioned Okta user attempts to authenticate, authentication fails. + REACTIVATE: If an IdP user that matches a previously deprovisioned Okta user attempts to authenticate, reactivate the matching user in Okta and allow the authentication attempt to proceed. ProvisioningSuspendedAction: - description: >- - Specifies the action during authentication when an IdP user is linked to - a previously suspended Okta user + description: Specifies the action during authentication when an IdP user is linked to a previously suspended Okta user type: string enum: - NONE - UNSUSPEND x-enumDescriptions: - NONE: >- - Take no action. If an IdP user that matches a previously suspended - Okta user attempts to authenticate, authentication fails. - UNSUSPEND: >- - If an IdP user that matches a previously suspended Okta user attempts - to authenticate, unsuspend the matching user in Okta and allow the - authentication attempt to proceed. + NONE: Take no action. If an IdP user that matches a previously suspended Okta user attempts to authenticate, authentication fails. + UNSUSPEND: If an IdP user that matches a previously suspended Okta user attempts to authenticate, unsuspend the matching user in Okta and allow the authentication attempt to proceed. SamlSigningAlgorithm: example: SHA-256 type: string @@ -8974,6 +9840,158 @@ components: - RS256 - RS384 - RS512 + ListUsersResponse: + type: object + properties: + users: + type: array + items: + $ref: '#/components/schemas/User' + ListAppLinksResponse: + type: object + properties: + app_links: + type: array + items: + $ref: '#/components/schemas/AssignedAppLink' + ListUserBlocksResponse: + type: object + properties: + user_blocks: + type: array + items: + $ref: '#/components/schemas/UserBlock' + ListUserGroupsResponse: + type: object + properties: + user_groups: + type: array + items: + $ref: '#/components/schemas/Group' + ListUserIdentityProvidersResponse: + type: object + properties: + user_identity_providers: + type: array + items: + $ref: '#/components/schemas/IdentityProvider' + ListLinkedObjectsForUserResponse: + type: object + properties: + linked_objects_for_user: + type: array + items: + $ref: '#/components/schemas/ResponseLinks' + ListUserClientsResponse: + type: object + properties: + user_clients: + type: array + items: + $ref: '#/components/schemas/OAuth2Client' + ListGrantsForUserAndClientResponse: + type: object + properties: + grants_for_user_and_client: + type: array + items: + $ref: '#/components/schemas/OAuth2ScopeConsentGrant' + ListRefreshTokensForUserAndClientResponse: + type: object + properties: + refresh_tokens_for_user_and_client: + type: array + items: + $ref: '#/components/schemas/OAuth2RefreshToken' + ListUserDevicesResponse: + type: object + properties: + user_devices: + type: array + items: + $ref: '#/components/schemas/UserDevice' + ListFactorsResponse: + type: object + properties: + factors: + type: array + items: + $ref: '#/components/schemas/UserFactor' + ListSupportedFactorsResponse: + type: object + properties: + supported_factors: + type: array + items: + $ref: '#/components/schemas/UserFactorSupported' + ListSupportedSecurityQuestionsResponse: + type: object + properties: + supported_security_questions: + type: array + items: + $ref: '#/components/schemas/UserFactorSecurityQuestionProfile' + ListUserGrantsResponse: + type: object + properties: + user_grants: + type: array + items: + $ref: '#/components/schemas/OAuth2ScopeConsentGrant' + ListAssignedRolesForUserResponse: + type: object + properties: + assigned_roles_for_user: + type: array + items: + oneOf: + - $ref: '#/components/schemas/StandardRole' + - $ref: '#/components/schemas/CustomRole' + discriminator: + propertyName: type + mapping: + API_ACCESS_MANAGEMENT_ADMIN: '#/components/schemas/StandardRole' + APP_ADMIN: '#/components/schemas/StandardRole' + GROUP_MEMBERSHIP_ADMIN: '#/components/schemas/StandardRole' + HELP_DESK_ADMIN: '#/components/schemas/StandardRole' + MOBILE_ADMIN: '#/components/schemas/StandardRole' + ORG_ADMIN: '#/components/schemas/StandardRole' + READ_ONLY_ADMIN: '#/components/schemas/StandardRole' + REPORT_ADMIN: '#/components/schemas/StandardRole' + SUPER_ADMIN: '#/components/schemas/StandardRole' + USER_ADMIN: '#/components/schemas/StandardRole' + WORKFLOWS_ADMIN: '#/components/schemas/CustomRole' + ACCESS_CERTIFICATIONS_ADMIN: '#/components/schemas/CustomRole' + ACCESS_REQUESTS_ADMIN: '#/components/schemas/CustomRole' + CUSTOM: '#/components/schemas/CustomRole' + ListApplicationTargetsForApplicationAdministratorRoleForUserResponse: + type: object + properties: + application_targets_for_application_administrator_role_for_user: + type: array + items: + $ref: '#/components/schemas/CatalogApplication' + ListGroupTargetsForRoleResponse: + type: object + properties: + group_targets_for_role: + type: array + items: + $ref: '#/components/schemas/Group' + GetRoleTargetsByUserIdAndRoleIdResponse: + type: object + properties: + role_targets_by_user_id_and_role_id: + type: array + items: + $ref: '#/components/schemas/RoleTarget' + ListSubscriptionsUserResponse: + type: object + properties: + subscriptions_user: + type: array + items: + $ref: '#/components/schemas/Subscription' responses: ErrorTooManyRequests429: description: Too Many Requests @@ -9051,6 +10069,8 @@ components: $ref: '#/components/examples/AuthenticatorEnrollmentResponsePhoneSms' PhoneCallEx: $ref: '#/components/examples/AuthenticatorEnrollmentResponsePhoneVoice' + PhoneDisclosedEx: + $ref: '#/components/examples/AuthenticatorEnrollmentResponsePhoneDisclosed' GetFactorResponse: description: Success content: @@ -9066,15 +10086,10 @@ components: OktaResponse: name: Content-Type in: header - description: >- - Specifies the media type of the resource. Optional `okta-response` value - can be included for performance optimization. - - - Complex DelAuth configurations may degrade performance when fetching - specific parts of the response, and passing this parameter can omit - these parts, bypassing the bottleneck. + description: |- + Specifies the media type of the resource. Optional `okta-response` value can be included for performance optimization. + Complex DelAuth configurations may degrade performance when fetching specific parts of the response, and passing this parameter can omit these parts, bypassing the bottleneck. Enum values for `okta-response`: * `omitCredentials`: Omits the credentials subobject from the response. @@ -9086,33 +10101,26 @@ components: examples: Omit credentials subobject and credentials links: value: application/json; okta-response=omitCredentials,omitCredentialsLinks - summary: >- - Omits the credentials subobject and credentials links from the - response. Doesn't apply performance optimization. + summary: Omits the credentials subobject and credentials links from the response. Doesn't apply performance optimization. Omit credentials, credentials links, and `transitioningToStatus` field: - value: >- - application/json; - okta-response="omitCredentials,omitCredentialsLinks, - omitTransitioningToStatus" - summary: >- - Omits the credentials, credentials links, and - `transitioningToStatus` field from the response. Applies performance - optimization. + value: application/json; okta-response="omitCredentials,omitCredentialsLinks, omitTransitioningToStatus" + summary: Omits the credentials, credentials links, and `transitioningToStatus` field from the response. Applies performance optimization. queryAfter: name: after in: query schema: type: string - description: >- - The cursor to use for pagination. It is an opaque string that specifies - your current location in the list and is obtained from the `Link` - response header. See - [Pagination](https://developer.okta.com/docs/api/#pagination). + description: The cursor to use for pagination. It is an opaque string that specifies your current location in the list and is obtained from the `Link` response header. See [Pagination](https://developer.okta.com/docs/api/#pagination) and [Link header](https://developer.okta.com/docs/api/#link-header). + querySortOrder: + name: sortOrder + in: query + description: 'Specifies sort order: `asc` or `desc` (for search queries only). This parameter is ignored if `sortBy` isn''t present.' + schema: + type: string + default: asc pathId: name: id - description: >- - An ID, login, or login shortname (as long as the shortname is - unambiguous) of an existing Okta user + description: An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user in: path required: true schema: @@ -9120,21 +10128,15 @@ components: queryUserExpand: name: expand in: query - description: >- - An optional parameter to include metadata in the `_embedded` attribute. - Valid values: `blocks` or - `classification`. + description: 'An optional parameter to include metadata in the `_embedded` attribute. Valid values: `blocks` or `classification`.' required: false schema: type: string example: blocks pathUserIdOrLogin: name: userIdOrLogin - description: >- - If for the `self` link, this is the ID of the user for whom you want to - get the primary user ID. If for the `associated` relation, this is the - user ID or login value of the user assigned the associated relationship. - + description: |- + If for the `self` link, this is the ID of the user for whom you want to get the primary user ID. If for the `associated` relation, this is the user ID or login value of the user assigned the associated relationship. This can be `me` to represent the current session user. in: path @@ -9158,9 +10160,7 @@ components: example: manager pathPrimaryUserId: name: primaryUserId - description: >- - User ID to be assigned to the `primary` relationship for the - `associated` user + description: User ID to be assigned to the `primary` relationship for the `associated` user in: path required: true schema: @@ -9187,6 +10187,16 @@ components: schema: type: string example: 00ub0oNGTSWTBKOLGLNR + queryDiscloseIdentifiers: + name: discloseIdentifiers + description: Indicates whether or not the identifier of an authenticator enrollment is disclosed or anonymized. If it's included in the operation query, then the identifier of the authenticator enrollment (the actual phone number, for example) is included in the response. + in: query + schema: + type: array + items: + type: string + enum: + - phone pathEnrollmentId: name: enrollmentId description: Unique identifier of an enrollment @@ -9197,7 +10207,7 @@ components: example: sms8lqwuzSpWT4kVs0g4 pathClientId: name: clientId - description: Client app ID + description: '`client_id` of the app' in: path required: true schema: @@ -9237,10 +10247,7 @@ components: example: iJoqkwx50mrgX4T9LcaH pathQueryRoleExpand: name: expand - description: >- - An optional parameter used to return targets configured for the standard - role assignment in the `embedded` property. Supported values: - `targets/groups` or `targets/catalog/apps` + description: 'An optional parameter used to return targets configured for the standard role assignment in the `embedded` property. Supported values: `targets/groups` or `targets/catalog/apps`' in: query required: false schema: @@ -9319,10 +10326,10 @@ components: schema: $ref: '#/components/schemas/NotificationType' examples: - ListRealmAwareUsersResponse: + ListUsersResponse: summary: List all users value: - - id: 00u118oQYT4TBGuay0g4 + - id: 00u118oQYT4TBTemp0g4 status: ACTIVE created: '2022-04-04T15:56:05.000Z' activated: null @@ -9339,7 +10346,6 @@ components: secondEmail: null login: alice.smith@example.com email: alice.smith@example.com - realmId: guo1afiNtSnZYILxO0g4 credentials: password: {} provider: @@ -9348,10 +10354,187 @@ components: _links: self: href: http://your-subdomain.okta.com/api/v1/users/00u118oQYT4TBGuay0g4 + ListUsersFieldsResponse: + summary: List all users with API projections + description: Response for query fields=status,profile:(firstName,city) + value: + - id: 00u1xke1apZnmHgpB1d7 + status: ACTIVE + profile: + firstName: Alice + city: Chicago + - id: 00u269cmneNMFHCH51d7 + status: ACTIVE + profile: + firstName: Bob + city: New York + ListUsersResponse: null + ListUsersSearchResponse: + summary: List all users with search + description: Response for search=profile.department%20eq%20%22Engineering%22 + value: + - id: 00u1xke1apZnmHgpB1d7 + status: STAGED + created: '2021-11-17T16:11:16.000Z' + activated: null + statusChanged: null + lastLogin: null + lastUpdated: '2022-05-24T15:39:09.000Z' + passwordChanged: null + type: + id: oty2di92xFgQTiKEJ1d6 + profile: + firstName: Ben + lastName: Richler + mobilePhone: null + secondEmail: '' + department: Engineering + login: ben.richler@example.com + email: ben.richler@example.com + - id: 00u269cmneNMFHCH51d7 + status: PROVISIONED + created: '2021-12-17T15:16:55.000Z' + activated: null + statusChanged: null + lastLogin: null + lastUpdated: '2022-05-24T15:38:04.000Z' + passwordChanged: '2021-12-17T15:16:56.000Z' + type: + id: oty2di92xFgQTiKEJ1d6 + profile: + firstName: Janice + lastName: Benson + mobilePhone: null + secondEmail: null + department: Engineering + login: janice.benson@gmail.com + email: janice.benson@gmail.com + ListUsersQResponse: + summary: Find a user (q) + description: Response for query q=john + value: + - id: 00u3ojhmm3cCa3a221d7 + status: ACTIVE + created: '2022-05-13T20:05:39.000Z' + activated: '2022-05-13T20:05:41.000Z' + statusChanged: '2022-05-13T20:05:41.000Z' + lastLogin: null + lastUpdated: '2022-05-13T20:05:41.000Z' + passwordChanged: '2022-05-13T20:05:41.000Z' + type: + id: oty2di92xFgQTiKEJ1d6 + profile: + firstName: Tony + lastName: Johnson + mobilePhone: null + secondEmail: null + login: tony.johnson@example.com + email: tony.johnson@example.com + credentials: + password: {} + emails: + - value: tony.johnson@example.com + status: VERIFIED + type: PRIMARY + provider: + type: OKTA + name: OKTA + _links: + self: + href: https://{yourOktaDomain}/api/v1/users/00u3ojhmm3cCa3a221d7 + - id: 00u3m5wrdPjJYUFb81d6 + status: LOCKED_OUT + created: '2020-10-22T15:15:30.000Z' + activated: '2020-10-22T15:15:30.000Z' + statusChanged: '2020-10-22T16:09:13.000Z' + lastLogin: null + lastUpdated: '2020-10-22T16:09:13.000Z' + passwordChanged: '2020-10-22T15:15:30.000Z' + type: + id: oty2di92xFgQTiKEJ1d6 + profile: + firstName: John + lastName: Mclean + mobilePhone: null + secondEmail: null + login: johnmclean@example.com + email: johnmclean@example.com + credentials: + password: {} + emails: + - value: johnmclean@example.com + status: VERIFIED + type: PRIMARY + provider: + type: IMPORT + name: IMPORT + _links: + self: + href: https://{yourOktaDomain}/api/v1/users/00u3m5wrdPjJYUFb81d6 + - id: 00u3ojdzgjrAhuYGg1d7 + status: ACTIVE + created: '2022-05-13T20:06:20.000Z' + activated: '2022-05-13T20:06:22.000Z' + statusChanged: '2022-05-13T20:06:22.000Z' + lastLogin: null + lastUpdated: '2022-05-13T20:06:22.000Z' + passwordChanged: '2022-05-13T20:06:21.000Z' + type: + id: oty2di92xFgQTiKEJ1d6 + profile: + firstName: Jack + lastName: Phillips + mobilePhone: null + secondEmail: null + login: john.j.phillips@example.com + email: john.j.phillips@example.com + credentials: + password: {} + emails: + - value: john.j.phillips@example.com + status: VERIFIED + type: PRIMARY + provider: + type: OKTA + name: OKTA + _links: + self: + href: https://{yourOktaDomain}/api/v1/users/00u3ojdzgjrAhuYGg1d7 + ListUsersFilterResponse: + summary: List all users with a filter + description: Filtered response with filter=status+eq%22LOCKED_OUT%22 + value: + - id: 00u3m5wrdPjJYUFb81d6 + status: LOCKED_OUT + created: '2020-10-22T15:15:30.000Z' + activated: '2020-10-22T15:15:30.000Z' + statusChanged: '2020-10-22T16:09:13.000Z' + lastLogin: null + lastUpdated: '2020-10-22T16:09:13.000Z' + passwordChanged: '2020-10-22T15:15:30.000Z' + type: + id: oty2di92xFgQTiKEJ1d6 + profile: + firstName: John + lastName: Richards + mobilePhone: null + secondEmail: null + login: johnrichards@example.com + email: johnrichards@example.com + credentials: + password: {} + emails: + - value: johntest@example.com + status: VERIFIED + type: PRIMARY + provider: + type: IMPORT + name: IMPORT + _links: + self: + href: https://{yourOktaDomain}/api/v1/users/00u3m5wrdPjJYUFb81d6 create-user-without-credentials-request: - description: >- - See [Create user without - credentials](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#create-user-without-credentials) + description: See [Create user without credentials](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#create-user-without-credentials) value: profile: firstName: Isaac @@ -9360,9 +10543,7 @@ components: login: isaac.brock@example.com mobilePhone: 555-415-1337 create-user-with-recovery-question-request: - description: >- - See [Create user with recovery - question](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#create-user-with-recovery-question) + description: See [Create user with recovery question](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#create-user-with-recovery-question) value: profile: firstName: Isaac @@ -9375,9 +10556,7 @@ components: question: Who is a major player in the cowboy scene? answer: Annie Oakley create-user-with-password-request: - description: >- - Set `activate` parameter to `true`. See [Create user with - password](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#create-user-with-password). + description: Set `activate` parameter to `true`. See [Create user with password](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#create-user-with-password). value: profile: firstName: Isaac @@ -9389,10 +10568,7 @@ components: password: value: tlpWENT2m create-user-with-imported-hashed-password-request: - description: >- - Set `activate` parameter to `true`. See [Create user with imported - hashed - password](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#create-user-with-imported-hashed-password). + description: Set `activate` parameter to `true`. See [Create user with imported hashed password](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#create-user-with-imported-hashed-password). value: profile: firstName: Isaac @@ -9408,10 +10584,7 @@ components: salt: rwh3vH166HCH/NT9XV5FYu value: qaMqvAPULkbiQzkTCWo5XDcvzpk8Tna create-user-with-password-import-inline-hook-request: - description: >- - Set `activate` parameter to `true`. See [Create user with password - import inline - hook](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#create-user-with-password-import-inline-hook). + description: Set `activate` parameter to `true`. See [Create user with password import inline hook](https://developer.okta.com/docs/api/openapi/okta-management/management/user/create-user-with-imported-hashed-password#user/Create-user-with-password-import-inline-hook). value: profile: firstName: Isaac @@ -9424,9 +10597,7 @@ components: hook: type: default create-user-with-password-and-recovery-question-request: - description: >- - See [Create user with password and recovery - question](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#create-user-with-password-and-recovery-question) + description: See [Create user with password and recovery question](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#create-user-with-password-and-recovery-question) value: profile: firstName: Isaac @@ -9441,9 +10612,7 @@ components: question: Who is a major player in the cowboy scene? answer: Annie Oakley create-user-with-authentication-provider-request: - description: >- - Set `activate` parameter to `true`. See [Create user with authentication - provider](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#create-user-with-authentication-provider). + description: Set `activate` parameter to `true`. See [Create user with authentication provider](https://developer.okta.com/docs/api/openapi/okta-management/management/user/create-user-with-password-and-recovery-question#user/Create-user-with-authentication-provider). value: profile: firstName: Isaac @@ -9456,9 +10625,7 @@ components: type: FEDERATION name: FEDERATION create-user-in-group-request: - description: >- - See [Create user in - group](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#create-user-in-group) + description: See [Create user in group](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#create-user-in-group) value: profile: firstName: Isaac @@ -9470,9 +10637,7 @@ components: - 00g1emaKYZTWRYYRRTSK - 00garwpuyxHaWOkdV0g4 create-user-with-non-default-user-type-request: - description: >- - See [Create user with non-default user - type](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#create-user-with-non-default-user-type) + description: See [Create user with non-default user type](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#create-user-with-non-default-user-type) value: profile: firstName: Isaac @@ -9504,8 +10669,7 @@ components: name: OKTA _links: activate: - href: >- - https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/lifecycle/activate + href: https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/lifecycle/activate self: href: https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR create-user-with-recovery-question-response: @@ -9532,8 +10696,7 @@ components: name: OKTA _links: activate: - href: >- - https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/lifecycle/activate + href: https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/lifecycle/activate self: href: https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR create-user-with-password-response: @@ -9559,8 +10722,7 @@ components: name: OKTA _links: activate: - href: >- - https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/lifecycle/activate + href: https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/lifecycle/activate self: href: https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR create-user-with-imported-hashed-password-response: @@ -9586,8 +10748,7 @@ components: name: IMPORT _links: activate: - href: >- - https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/lifecycle/activate + href: https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/lifecycle/activate self: href: https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR create-user-with-password-import-inline-hook-response: @@ -9639,8 +10800,7 @@ components: name: OKTA _links: activate: - href: >- - https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/lifecycle/activate + href: https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/lifecycle/activate self: href: https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR create-user-with-authentication-provider-response: @@ -9666,16 +10826,13 @@ components: name: FEDERATION _links: resetPassword: - href: >- - https://{yourOktaDomain}/api/v1/users/00uijntSwJjSHtDY70g3/lifecycle/reset_password + href: https://{yourOktaDomain}/api/v1/users/00uijntSwJjSHtDY70g3/lifecycle/reset_password method: POST changeRecoveryQuestion: - href: >- - https://{yourOktaDomain}/api/v1/users/00uijntSwJjSHtDY70g3/credentials/change_recovery_question + href: https://{yourOktaDomain}/api/v1/users/00uijntSwJjSHtDY70g3/credentials/change_recovery_question method: POST deactivate: - href: >- - https://{yourOktaDomain}/api/v1/users/00uijntSwJjSHtDY70g3/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/users/00uijntSwJjSHtDY70g3/lifecycle/deactivate method: POST self: href: https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR @@ -9701,8 +10858,7 @@ components: name: OKTA _links: activate: - href: >- - https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/lifecycle/activate + href: https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/lifecycle/activate self: href: https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR create-user-with-non-default-user-type-response: @@ -9729,16 +10885,13 @@ components: name: OKTA _links: schema: - href: >- - https://{yourOktaDomain}/api/v1/meta/schemas/user/oscfnjfba4ye7pgjB0g4 + href: https://{yourOktaDomain}/api/v1/meta/schemas/user/oscfnjfba4ye7pgjB0g4 activate: - href: >- - https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/lifecycle/activate + href: https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/lifecycle/activate self: href: https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR type: - href: >- - https://{yourOktaDomain}/api/v1/meta/types/user/otyfnjfba4ye7pgjB0g4 + href: https://{yourOktaDomain}/api/v1/meta/types/user/otyfnjfba4ye7pgjB0g4 ErrorCreateUserWithTooManyManyGroupsResponse: value: errorCode: E0000093 @@ -9750,27 +10903,19 @@ components: ErrorCreateUserWithExpiredPasswordWithoutActivation: value: errorCode: E0000125 - errorSummary: >- - Could not create user. To create a user and expire their password - immediately, `activate` must be true. + errorSummary: Could not create user. To create a user and expire their password immediately, `activate` must be true. errorLink: E0000125 errorId: oaeDd77L9R-TJaD7j_rXsQ31w errorCauses: - - errorSummary: >- - Could not create user. To create a user and expire their password - immediately, `activate` must be true. + - errorSummary: Could not create user. To create a user and expire their password immediately, `activate` must be true. ErrorCreateUserWithExpiredPasswordWithNullPassword: value: errorCode: E0000124 - errorSummary: >- - Could not create user. To create a user and expire their password - immediately, a password must be specified. + errorSummary: Could not create user. To create a user and expire their password immediately, a password must be specified. errorLink: E0000124 errorId: oaeXxuZgXBySvqi1FvtkwoYCA errorCauses: - - errorSummary: >- - Could not create user. To create a user and expire their password - immediately, a password must be specified. + - errorSummary: Could not create user. To create a user and expire their password immediately, a password must be specified. user-example: summary: User example value: @@ -9955,11 +11100,11 @@ components: filter: null matchType: USERNAME mapAMRClaims: false + trustClaims: false maxClockSkew: 0 _links: authorize: - href: >- - https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oa62b57p7c8PaGpU0h7&client_id={clientId}&response_type={responseType}&response_mode={responseMode}&scope={scopes}&redirect_uri={redirectUri}&state={state} + href: https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oa62b57p7c8PaGpU0h7&client_id={clientId}&response_type={responseType}&response_mode={responseMode}&scope={scopes}&redirect_uri={redirectUri}&state={state} templated: true hints: allow: @@ -10001,6 +11146,8 @@ components: issuer: https://idp.example.com audience: http://www.okta.com/123 kid: your-key-id + additionalKids: + - additional-key-id policy: provisioning: action: AUTO @@ -10021,11 +11168,11 @@ components: filter: (\S+@example\.com) matchType: USERNAME mapAMRClaims: false + trustClaims: false maxClockSkew: 0 _links: metadata: - href: >- - https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/metadata.xml + href: https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/metadata.xml type: application/xml hints: allow: @@ -10042,8 +11189,7 @@ components: allow: - GET deactivate: - href: >- - https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/lifecycle/deactivate hints: allow: - POST @@ -10090,11 +11236,11 @@ components: filter: null matchType: USERNAME mapAMRClaims: false + trustClaims: false maxClockSkew: 0 _links: authorize: - href: >- - https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oa62bfdiumsUndnZ0h7&client_id={clientId}&response_type={responseType}&response_mode={responseMode}&scope={scopes}&redirect_uri={redirectUri}&state={state} + href: https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oa62bfdiumsUndnZ0h7&client_id={clientId}&response_type={responseType}&response_mode={responseMode}&scope={scopes}&redirect_uri={redirectUri}&state={state} templated: true hints: allow: @@ -10146,11 +11292,11 @@ components: filter: null matchType: USERNAME mapAMRClaims: false + trustClaims: false maxClockSkew: 0 _links: authorize: - href: >- - https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oa62bfdjnK55Z5x80h7&client_id={clientId}&response_type={responseType}&response_mode={responseMode}&scope={scopes}&redirect_uri={redirectUri}&state={state} + href: https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oa62bfdjnK55Z5x80h7&client_id={clientId}&response_type={responseType}&response_mode={responseMode}&scope={scopes}&redirect_uri={redirectUri}&state={state} templated: true hints: allow: @@ -10204,11 +11350,11 @@ components: filter: null matchType: USERNAME mapAMRClaims: false + trustClaims: false maxClockSkew: 0 _links: authorize: - href: >- - https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oajmvdFawBih4gey0g3&client_id={clientId}&response_type={responseType}&response_mode={responseMode}&scope={scopes}&redirect_uri={redirectUri}&state={state} + href: https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oajmvdFawBih4gey0g3&client_id={clientId}&response_type={responseType}&response_mode={responseMode}&scope={scopes}&redirect_uri={redirectUri}&state={state} templated: true hints: allow: @@ -10268,11 +11414,11 @@ components: matchType: USERNAME matchAttribute: null mapAMRClaims: false + trustClaims: false maxClockSkew: 0 _links: authorize: - href: >- - https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oaulob4BFVa4zQvt0g3&client_id={clientId}&response_type={responseType}&response_mode={responseMode}&scope={scopes}&redirect_uri={redirectUri}&state={state}&nonce={nonce} + href: https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oaulob4BFVa4zQvt0g3&client_id={clientId}&response_type={responseType}&response_mode={responseMode}&scope={scopes}&redirect_uri={redirectUri}&state={state}&nonce={nonce} templated: true hints: allow: @@ -10318,23 +11464,21 @@ components: matchType: EMAIL matchAttribute: null mapAMRClaims: false + trustClaims: false maxClockSkew: 0 _links: deactivate: - href: >- - https://{yourOktaDomain}.okta.com/api/v1/idps/0oa6jxasyhwM2ZHJh0g4/lifecycle/deactivate + href: https://{yourOktaDomain}.okta.com/api/v1/idps/0oa6jxasyhwM2ZHJh0g4/lifecycle/deactivate hints: allow: - POST users: - href: >- - https://{yourOktaDomain}.okta.com/api/v1/idps/0oa6jxasyhwM2ZHJh0g4/users + href: https://{yourOktaDomain}.okta.com/api/v1/idps/0oa6jxasyhwM2ZHJh0g4/users hints: allow: - GET keys: - href: >- - https://{yourOktaDomain}.okta.com/api/v1/idps/credentials/keys/45dec5ff-8cdc-48c0-85fe-a4869f1753dc + href: https://{yourOktaDomain}.okta.com/api/v1/idps/credentials/keys/45dec5ff-8cdc-48c0-85fe-a4869f1753dc hints: allow: - GET @@ -10363,26 +11507,19 @@ components: name: OKTA _links: resetPassword: - href: >- - https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/lifecycle/reset_password + href: https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/lifecycle/reset_password resetFactors: - href: >- - https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/lifecycle/reset_factors + href: https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/lifecycle/reset_factors expirePassword: - href: >- - https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/lifecycle/expire_password + href: https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/lifecycle/expire_password forgotPassword: - href: >- - https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/credentials/forgot_password + href: https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/credentials/forgot_password changeRecoveryQuestion: - href: >- - https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/credentials/change_recovery_question + href: https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/credentials/change_recovery_question deactivate: - href: >- - https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/lifecycle/deactivate changePassword: - href: >- - https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/credentials/change_password + href: https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/credentials/change_password ExpirePwdWithTempPwdResponse: value: tempPassword: F46gy7X4 @@ -10420,8 +11557,7 @@ components: lastUpdated: '2020-07-28T21:45:52.000Z' _links: self: - href: >- - https://{yourOktaDomain}/api/v1/users/00u4za57vqNsQAN8S0g7/authenticator-enrollments/eae4za57woixzodEK0g7 + href: https://{yourOktaDomain}/api/v1/users/00u4za57vqNsQAN8S0g7/authenticator-enrollments/eae4za57woixzodEK0g7 hints: allow: - GET @@ -10432,8 +11568,7 @@ components: allow: - GET authenticator: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/auth60xfl7VbebsFr0g6 + href: https://{yourOktaDomain}/api/v1/authenticators/auth60xfl7VbebsFr0g6 hints: allow: - GET @@ -10447,8 +11582,7 @@ components: lastUpdated: '2020-07-26T21:05:23.000Z' _links: self: - href: >- - https://{yourOktaDomain}/api/v1/users/00u4za57vqNsQAN8S0g7/authenticator-enrollments/laeh60xfl7VbebsFr0g6 + href: https://{yourOktaDomain}/api/v1/users/00u4za57vqNsQAN8S0g7/authenticator-enrollments/laeh60xfl7VbebsFr0g6 hints: allow: - GET @@ -10459,8 +11593,7 @@ components: allow: - GET authenticator: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/auth60xfl7VbebsFr0g6 + href: https://{yourOktaDomain}/api/v1/authenticators/auth60xfl7VbebsFr0g6 hints: allow: - GET @@ -10476,8 +11609,7 @@ components: nickname: Joe's Work Phone _links: self: - href: >- - https://{yourOktaDomain}/api/v1/users/00u4za57vqNsQAN8S0g7/authenticator-enrollments/laeh60xfl7VbebsFr0g6 + href: https://{yourOktaDomain}/api/v1/users/00u4za57vqNsQAN8S0g7/authenticator-enrollments/laeh60xfl7VbebsFr0g6 hints: allow: - GET @@ -10488,8 +11620,7 @@ components: allow: - GET authenticator: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/auth60xfl7VbebsFr0g6 + href: https://{yourOktaDomain}/api/v1/authenticators/auth60xfl7VbebsFr0g6 hints: allow: - GET @@ -10508,11 +11639,9 @@ components: logo_uri: null _links: grants: - href: >- - https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7/clients/0oabskvc6442nkvQO0h7/grants + href: https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7/clients/0oabskvc6442nkvQO0h7/grants tokens: - href: >- - https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7/clients/0oabskvc6442nkvQO0h7/tokens + href: https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7/clients/0oabskvc6442nkvQO0h7/tokens ChangePwdRequest: value: oldPassword: @@ -10589,8 +11718,7 @@ components: resourceAlternateId: null _links: suspend: - href: >- - https://{yourOktaDomain}/api/v1/devices/guo8jx5vVoxfvJeLb0w4/lifecycle/suspend + href: https://{yourOktaDomain}/api/v1/devices/guo8jx5vVoxfvJeLb0w4/lifecycle/suspend hints: allow: - POST @@ -10602,14 +11730,12 @@ components: - PATCH - PUT users: - href: >- - https://{yourOktaDomain}/api/v1/devices/guo8jx5vVoxfvJeLb0w4/users + href: https://{yourOktaDomain}/api/v1/devices/guo8jx5vVoxfvJeLb0w4/users hints: allow: - GET deactivate: - href: >- - https://{yourOktaDomain}/api/v1/devices/guo8jx5vVoxfvJeLb0w4/lifecycle/deactivate + href: https://{yourOktaDomain}/api/v1/devices/guo8jx5vVoxfvJeLb0w4/lifecycle/deactivate hints: allow: - POST @@ -10628,14 +11754,12 @@ components: questionText: What is your favorite piece of art? _links: questions: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/questions + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/questions hints: allow: - GET self: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ufs2bysphxKODSZKWVCT + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ufs2bysphxKODSZKWVCT hints: allow: - GET @@ -10656,14 +11780,12 @@ components: _links: next: name: activate - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ostf2gsyictRQDSGTDZE/lifecycle/activate + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ostf2gsyictRQDSGTDZE/lifecycle/activate hints: allow: - POST self: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ostf2gsyictRQDSGTDZE + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ostf2gsyictRQDSGTDZE hints: allow: - GET @@ -10688,14 +11810,12 @@ components: phoneNumber: +1-555-415-1337 _links: verify: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/sms2gt8gzgEBPUWBIFHN/verify + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/sms2gt8gzgEBPUWBIFHN/verify hints: allow: - POST self: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/sms2gt8gzgEBPUWBIFHN + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/sms2gt8gzgEBPUWBIFHN hints: allow: - GET @@ -10812,14 +11932,12 @@ components: questionText: What is the food you least liked as a child? _links: questions: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/questions + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/questions hints: allow: - GET self: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ufs1o01OTMGHLAJPVHDZ + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ufs1o01OTMGHLAJPVHDZ hints: allow: - GET @@ -10843,21 +11961,18 @@ components: phoneNumber: +1-555-415-1337 _links: activate: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/mbl1nz9JHJGHWRKMTLHP/lifecycle/activate + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/mbl1nz9JHJGHWRKMTLHP/lifecycle/activate hints: allow: - POST resend: - name: sms - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/mbl1nz9JHJGHWRKMTLHP/resend + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/mbl1nz9JHJGHWRKMTLHP/resend hints: allow: - POST self: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/mbl1nz9JHJGHWRKMTLHP + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/mbl1nz9JHJGHWRKMTLHP hints: allow: - GET @@ -10881,21 +11996,18 @@ components: phoneExtension: '1234' _links: activate: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/clf1nz9JHJGHWRKMTLHP/lifecycle/activate + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/clf1nz9JHJGHWRKMTLHP/lifecycle/activate hints: allow: - POST resend: - name: call - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/clf1nz9JHJGHWRKMTLHP/resend + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/clf1nz9JHJGHWRKMTLHP/resend hints: allow: - POST self: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/clf1nz9JHJGHWRKMTLHP + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/clf1nz9JHJGHWRKMTLHP hints: allow: - GET @@ -10918,14 +12030,12 @@ components: credentialId: dade.murphy@example.com _links: activate: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ostf1fmaMGJLMNGNLIVG/lifecycle/activate + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ostf1fmaMGJLMNGNLIVG/lifecycle/activate hints: allow: - POST self: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ostf1fmaMGJLMNGNLIVG + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ostf1fmaMGJLMNGNLIVG hints: allow: - GET @@ -10942,8 +12052,7 @@ components: keyLength: 6 _links: qrcode: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ostf1fmaMGJLMNGNLIVG/qr/00fukNElRS_Tz6k-CFhg3pH4KO2dj2guhmaapXWbc4 + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ostf1fmaMGJLMNGNLIVG/qr/00fukNElRS_Tz6k-CFhg3pH4KO2dj2guhmaapXWbc4 type: image/png EnrollFactorOVPushResponse: summary: token:software:totp @@ -10957,14 +12066,12 @@ components: lastUpdated: '2015-11-13T07:34:22.000Z' _links: poll: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfbtzzrjgwauUsxO0g4/lifecycle/activate/poll + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfbtzzrjgwauUsxO0g4/lifecycle/activate/poll hints: allow: - POST self: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfbtzzrjgwauUsxO0g4 + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfbtzzrjgwauUsxO0g4 hints: allow: - GET @@ -10980,20 +12087,17 @@ components: _links: send: - name: email - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfbtzzrjgwauUsxO0g4/lifecycle/activate/email + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfbtzzrjgwauUsxO0g4/lifecycle/activate/email hints: allow: - POST - name: sms - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfbtzzrjgwauUsxO0g4/lifecycle/activate/sms + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfbtzzrjgwauUsxO0g4/lifecycle/activate/sms hints: allow: - POST qrcode: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfbtzzrjgwauUsxO0g4/qr/00Ji8qVBNJD4LmjYy1WZO2VbNqvvPdaCVua-1qjypa + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfbtzzrjgwauUsxO0g4/qr/00Ji8qVBNJD4LmjYy1WZO2VbNqvvPdaCVua-1qjypa type: image/png EnrollFactorGoogleResponse: value: @@ -11008,14 +12112,12 @@ components: credentialId: dade.murphy@example.com _links: activate: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ostf1fmaMGJLMNGNLIVG/lifecycle/activate + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ostf1fmaMGJLMNGNLIVG/lifecycle/activate hints: allow: - POST self: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ostf1fmaMGJLMNGNLIVG + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ostf1fmaMGJLMNGNLIVG hints: allow: - GET @@ -11032,8 +12134,7 @@ components: keyLength: 16 _links: qrcode: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ostf1fmaMGJLMNGNLIVG/qr/00fukNElRS_Tz6k-CFhg3pH4KO2dj2guhmaapXWbc4 + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ostf1fmaMGJLMNGNLIVG/qr/00fukNElRS_Tz6k-CFhg3pH4KO2dj2guhmaapXWbc4 type: image/png EnrollFactorRsaSecurIdResponse: summary: RSA SecurID @@ -11049,14 +12150,12 @@ components: credentialId: dade.murphy@example.com _links: verify: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/rsabtznMn6cp94ez20g4/verify + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/rsabtznMn6cp94ez20g4/verify hints: allow: - POST self: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/rsabtznMn6cp94ez20g4 + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/rsabtznMn6cp94ez20g4 hints: allow: - GET @@ -11080,14 +12179,12 @@ components: credentialId: VSMT14393584 _links: verify: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ufvbtzgkYaA7zTKdQ0g4/verify + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ufvbtzgkYaA7zTKdQ0g4/verify hints: allow: - POST self: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ufvbtzgkYaA7zTKdQ0g4 + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ufvbtzgkYaA7zTKdQ0g4 hints: allow: - GET @@ -11110,14 +12207,12 @@ components: credentialId: '000004102994' _links: verify: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ykfbty3BJeBgUi3750g4/verify + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ykfbty3BJeBgUi3750g4/verify hints: allow: - POST self: - href: >- - hhttps://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ykfbty3BJeBgUi3750g4 + href: hhttps://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ykfbty3BJeBgUi3750g4 hints: allow: - GET @@ -11137,21 +12232,18 @@ components: status: PENDING_ACTIVATION _links: activate: - href: >- - https://{yourOktaDomain}/api/v1/users/00umvfJKwXOQ1mEL50g3/factors/emfnf3gSScB8xXoXK0g3/lifecycle/activate + href: https://{yourOktaDomain}/api/v1/users/00umvfJKwXOQ1mEL50g3/factors/emfnf3gSScB8xXoXK0g3/lifecycle/activate hints: allow: - POST resend: - name: email - href: >- - https://{yourOktaDomain}/api/v1/users/00umvfJKwXOQ1mEL50g3/factors/emfnf3gSScB8xXoXK0g3/resend + href: https://{yourOktaDomain}/api/v1/users/00umvfJKwXOQ1mEL50g3/factors/emfnf3gSScB8xXoXK0g3/resend hints: allow: - POST self: - href: >- - https://{yourOktaDomain}/api/v1/users/00umvfJKwXOQ1mEL50g3/factors/emfnf3gSScB8xXoXK0g3 + href: https://{yourOktaDomain}/api/v1/users/00umvfJKwXOQ1mEL50g3/factors/emfnf3gSScB8xXoXK0g3 hints: allow: - GET @@ -11172,14 +12264,12 @@ components: lastUpdated: '2018-05-24T20:43:19.000Z' _links: activate: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/fuf2rovRxogXJ0nDy0g4/lifecycle/activate + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/fuf2rovRxogXJ0nDy0g4/lifecycle/activate hints: allow: - POST self: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/fuf2rovRxogXJ0nDy0g4 + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/fuf2rovRxogXJ0nDy0g4 hints: allow: - GET @@ -11205,14 +12295,12 @@ components: lastUpdated: '2018-05-24T20:43:19.000Z' _links: activate: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/fwf2rovRxogXJ0nDy0g4/lifecycle/activate + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/fwf2rovRxogXJ0nDy0g4/lifecycle/activate hints: allow: - POST self: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/fwf2rovRxogXJ0nDy0g4 + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/fwf2rovRxogXJ0nDy0g4 hints: allow: - GET @@ -11252,15 +12340,13 @@ components: lastUpdated: '2019-07-22T23:22:36.000Z' _links: self: - href: >- - https://{yourOktaDomain}/api/v1/users/00utf43LCCmTJVcsK0g3/factors/chf20l33Ks8U2Zjba0g4 + href: https://{yourOktaDomain}/api/v1/users/00utf43LCCmTJVcsK0g3/factors/chf20l33Ks8U2Zjba0g4 hints: allow: - GET - DELETE verify: - href: >- - https://{yourOktaDomain}/api/v1/users/00utf43LCCmTJVcsK0g3/factors/chf20l33Ks8U2Zjba0g4/verify + href: https://{yourOktaDomain}/api/v1/users/00utf43LCCmTJVcsK0g3/factors/chf20l33Ks8U2Zjba0g4/verify hints: allow: - POST @@ -11276,14 +12362,12 @@ components: vendorName: OKTA _links: questions: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/questions + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/questions hints: allow: - GET enroll: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors hints: allow: - POST @@ -11291,8 +12375,7 @@ components: provider: OKTA _links: enroll: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors hints: allow: - POST @@ -11300,8 +12383,7 @@ components: provider: GOOGLE _links: enroll: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors hints: allow: - POST @@ -11310,8 +12392,7 @@ components: vendorName: OKTA _links: enroll: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors hints: allow: - POST @@ -11325,8 +12406,7 @@ components: provider: OKTA _links: enroll: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors hints: allow: - POST @@ -11334,8 +12414,7 @@ components: provider: RSA _links: enroll: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors hints: allow: - POST @@ -11343,8 +12422,7 @@ components: provider: SYMANTEC _links: enroll: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors hints: allow: - POST @@ -11354,17 +12432,13 @@ components: ActivateFactorU2fRequest: summary: u2f value: - registrationData: >- - BQTEMUyOM8h1TiZG4DL-RdMr-tYgTYSf62Y52AmwEFTiSYWIRVO5L-MwWdRJOthmV3J3JrqpmGfmFb820-awx1YIQFlTvkMhxItHlpkzahEqicpw7SIH9yMfTn2kaDcC6JaLKPfV5ds0vzuxF1JJj3gCM01bRC-HWI4nCVgc-zaaoRgwggEcMIHDoAMCAQICCwD52fCSMoNczORdMAoGCCqGSM49BAMCMBUxEzARBgNVBAMTClUyRiBJc3N1ZXIwGhcLMDAwMTAxMDAwMFoXCzAwMDEwMTAwMDBaMBUxEzARBgNVBAMTClUyRiBEZXZpY2UwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQFKJupuUgPQcRHUphaW5JPfLvkkwlEwlHKk_ntSp7MS4aTHJyGnpziqncrjiTC_oUVtb-wN-y_t_IMIjueGkhxMAoGCCqGSM49BAMCA0gAMEUCIQDBo6aOLxanIUYnBX9iu3KMngPnobpi0EZSTkVtLC8_cwIgC1945RGqGBKfbyNtkhMifZK05n7fU-gW37Bdnci5D94wRQIhAJv3VvclbRkHAQhaUR8rr8qFTg9iF-GtHoXU95vWaQdyAiAbEr-440U4dQAZF-Sj8G2fxgh5DkgkkWpyUHZhz7N9ew - clientData: >- - eyJ0eXAiOiJuYXZpZ2F0b3IuaWQuZmluaXNoRW5yb2xsbWVudCIsImNoYWxsZW5nZSI6IlhxR0h0RTBoUkxuVEoxYUF5U1oyIiwib3JpZ2luIjoiaHR0cHM6Ly9sb2NhbGhvc3Q6MzAwMCIsImNpZF9wdWJrZXkiOiJ1bnVzZWQifQ + registrationData: BQTEMUyOM8h1TiZG4DL-RdMr-tYgTYSf62Y52AmwEFTiSYWIRVO5L-MwWdRJOthmV3J3JrqpmGfmFb820-awx1YIQFlTvkMhxItHlpkzahEqicpw7SIH9yMfTn2kaDcC6JaLKPfV5ds0vzuxF1JJj3gCM01bRC-HWI4nCVgc-zaaoRgwggEcMIHDoAMCAQICCwD52fCSMoNczORdMAoGCCqGSM49BAMCMBUxEzARBgNVBAMTClUyRiBJc3N1ZXIwGhcLMDAwMTAxMDAwMFoXCzAwMDEwMTAwMDBaMBUxEzARBgNVBAMTClUyRiBEZXZpY2UwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQFKJupuUgPQcRHUphaW5JPfLvkkwlEwlHKk_ntSp7MS4aTHJyGnpziqncrjiTC_oUVtb-wN-y_t_IMIjueGkhxMAoGCCqGSM49BAMCA0gAMEUCIQDBo6aOLxanIUYnBX9iu3KMngPnobpi0EZSTkVtLC8_cwIgC1945RGqGBKfbyNtkhMifZK05n7fU-gW37Bdnci5D94wRQIhAJv3VvclbRkHAQhaUR8rr8qFTg9iF-GtHoXU95vWaQdyAiAbEr-440U4dQAZF-Sj8G2fxgh5DkgkkWpyUHZhz7N9ew + clientData: eyJ0eXAiOiJuYXZpZ2F0b3IuaWQuZmluaXNoRW5yb2xsbWVudCIsImNoYWxsZW5nZSI6IlhxR0h0RTBoUkxuVEoxYUF5U1oyIiwib3JpZ2luIjoiaHR0cHM6Ly9sb2NhbGhvc3Q6MzAwMCIsImNpZF9wdWJrZXkiOiJ1bnVzZWQifQ ActivateFactorWebauthnRequest: summary: webAuthn value: - attestation: >- - o2NmbXRmcGFja2VkZ2F0dFN0bXSiY2FsZyZjc2lnWEgwRgIhAMvf2+dzXlHZN1um38Y8aFzrKvX0k5dt/hnDu9lahbR4AiEAuwtMg3IoaElWMp00QrP/+3Po/6LwXfmYQVfsnsQ+da1oYXV0aERhdGFYxkgb9OHGifjS2dG03qLRqvXrDIRyfGAuc+GzF1z20/eVRV2wvl6tzgACNbzGCmSLCyXx8FUDAEIBvWNHOcE3QDUkDP/HB1kRbrIOoZ1dR874ZaGbMuvaSVHVWN2kfNiO4D+HlAzUEFaqlNi5FPqKw+mF8f0XwdpEBlClAQIDJiABIVgg0a6oo3W0JdYPu6+eBrbr0WyB3uJLI3ODVgDfQnpgafgiWCB4fFo/5iiVrFhB8pNH2tbBtKewyAHuDkRolcCnVaCcmQ== - clientData: >- - eyJjaGFsbGVuZ2UiOiJVSk5wYW9sVWt0dF9vcEZPNXJMYyIsIm9yaWdpbiI6Imh0dHBzOi8vcmFpbi5va3RhMS5jb20iLCJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIn0= + attestation: o2NmbXRmcGFja2VkZ2F0dFN0bXSiY2FsZyZjc2lnWEgwRgIhAMvf2+dzXlHZN1um38Y8aFzrKvX0k5dt/hnDu9lahbR4AiEAuwtMg3IoaElWMp00QrP/+3Po/6LwXfmYQVfsnsQ+da1oYXV0aERhdGFYxkgb9OHGifjS2dG03qLRqvXrDIRyfGAuc+GzF1z20/eVRV2wvl6tzgACNbzGCmSLCyXx8FUDAEIBvWNHOcE3QDUkDP/HB1kRbrIOoZ1dR874ZaGbMuvaSVHVWN2kfNiO4D+HlAzUEFaqlNi5FPqKw+mF8f0XwdpEBlClAQIDJiABIVgg0a6oo3W0JdYPu6+eBrbr0WyB3uJLI3ODVgDfQnpgafgiWCB4fFo/5iiVrFhB8pNH2tbBtKewyAHuDkRolcCnVaCcmQ== + clientData: eyJjaGFsbGVuZ2UiOiJVSk5wYW9sVWt0dF9vcEZPNXJMYyIsIm9yaWdpbiI6Imh0dHBzOi8vcmFpbi5va3RhMS5jb20iLCJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIn0= ActivateFactorTotpResponse: summary: token:software:totp value: @@ -11379,14 +12453,12 @@ components: credentialId: dade.murphy@example.com _links: verify: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ostf1fmaMGJLMNGNLIVG/verify + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ostf1fmaMGJLMNGNLIVG/verify hints: allow: - POST self: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ostf1fmaMGJLMNGNLIVG + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ostf1fmaMGJLMNGNLIVG hints: allow: - GET @@ -11410,14 +12482,12 @@ components: phoneNumber: +1-555-415-1337 _links: verify: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/sms1o51EADOTFXHHBXBP/verify + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/sms1o51EADOTFXHHBXBP/verify hints: allow: - POST self: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/sms1o51EADOTFXHHBXBP + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/sms1o51EADOTFXHHBXBP hints: allow: - GET @@ -11442,14 +12512,12 @@ components: phoneExtension: '1234' _links: verify: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/clf1o51EADOTFXHHBXBP/verify + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/clf1o51EADOTFXHHBXBP/verify hints: allow: - POST self: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/clf1o51EADOTFXHHBXBP + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/clf1o51EADOTFXHHBXBP hints: allow: - GET @@ -11477,14 +12545,12 @@ components: version: '9.0' _links: verify: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opf3hkfocI4JTLAju0g4/verify + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opf3hkfocI4JTLAju0g4/verify hints: allow: - POST self: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opf3hkfocI4JTLAju0g4 + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opf3hkfocI4JTLAju0g4 hints: allow: - GET @@ -11506,14 +12572,12 @@ components: email: changed@clouditude.net _links: verify: - href: >- - https://{yourOktaDomain}/api/v1/users/00umvfJKwXOQ1mEL50g3/factors/emfnf3gSScB8xXoXK0g3/verify + href: https://{yourOktaDomain}/api/v1/users/00umvfJKwXOQ1mEL50g3/factors/emfnf3gSScB8xXoXK0g3/verify hints: allow: - POST self: - href: >- - https://{yourOktaDomain}/api/v1/users/00umvfJKwXOQ1mEL50g3/factors/emfnf3gSScB8xXoXK0g3 + href: https://{yourOktaDomain}/api/v1/users/00umvfJKwXOQ1mEL50g3/factors/emfnf3gSScB8xXoXK0g3 hints: allow: - GET @@ -11534,20 +12598,17 @@ components: created: '2018-05-24T20:43:19.000Z' lastUpdated: '2018-05-24T21:43:32.000Z' profile: - credentialId: >- - WVO-QyHEi0eWmTNqESqJynDtIgf3Ix9OfaRoNwLoloso99Xl2zS_O7EXUkmPeAIzTVtEL4dYjicJWBz7NpqhGA + credentialId: WVO-QyHEi0eWmTNqESqJynDtIgf3Ix9OfaRoNwLoloso99Xl2zS_O7EXUkmPeAIzTVtEL4dYjicJWBz7NpqhGA version: U2F_V2 _links: self: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/fuf2rovRxogXJ0nDy0g4 + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/fuf2rovRxogXJ0nDy0g4 hints: allow: - GET - DELETE verify: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/fuf2rovRxogXJ0nDy0g4/verify + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/fuf2rovRxogXJ0nDy0g4/verify hints: allow: - POST @@ -11567,20 +12628,17 @@ components: created: '2018-05-24T20:43:19.000Z' lastUpdated: '2018-05-24T21:43:32.000Z' profile: - credentialId: >- - l3Br0n-7H3g047NqESqJynFtIgf3Ix9OfaRoNwLoloso99Xl2zS_O7EXUkmPeAIzTVtEL4dYjicJWBz7NpqhGA + credentialId: l3Br0n-7H3g047NqESqJynFtIgf3Ix9OfaRoNwLoloso99Xl2zS_O7EXUkmPeAIzTVtEL4dYjicJWBz7NpqhGA authenticatorName: MacBook Touch ID _links: self: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/fwf2rovRxogXJ0nDy0g4 + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/fwf2rovRxogXJ0nDy0g4 hints: allow: - GET - DELETE verify: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/fwf2rovRxogXJ0nDy0g4/verify + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/fwf2rovRxogXJ0nDy0g4/verify hints: allow: - POST @@ -11598,14 +12656,12 @@ components: credentialId: jane.doe@example.com _links: poll: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfh52xcuft3J4uZc0g3/transactions/v2mst.GldKV5VxTrifyeZmWSQguA + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfh52xcuft3J4uZc0g3/transactions/v2mst.GldKV5VxTrifyeZmWSQguA hints: allow: - GET cancel: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfh52xcuft3J4uZc0g3/transactions/v2mst.GldKV5VxTrifyeZmWSQguA + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfh52xcuft3J4uZc0g3/transactions/v2mst.GldKV5VxTrifyeZmWSQguA hints: allow: - DELETE @@ -11625,14 +12681,12 @@ components: credentialId: jane.doe@example.com _links: poll: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfh52xcuft3J4uZc0g3/transactions/v2mst.GldKV5VxTrifyeZmWSQguA + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfh52xcuft3J4uZc0g3/transactions/v2mst.GldKV5VxTrifyeZmWSQguA hints: allow: - GET cancel: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfh52xcuft3J4uZc0g3/transactions/v2mst.GldKV5VxTrifyeZmWSQguA + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfh52xcuft3J4uZc0g3/transactions/v2mst.GldKV5VxTrifyeZmWSQguA hints: allow: - DELETE @@ -11648,14 +12702,12 @@ components: credentialId: jane.doe@example.com _links: verify: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfh52xcuft3J4uZc0g3/verify + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfh52xcuft3J4uZc0g3/verify hints: allow: - POST factor: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfh52xcuft3J4uZc0g3 + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfh52xcuft3J4uZc0g3 hints: allow: - GET @@ -11668,14 +12720,12 @@ components: credentialId: jane.doe@example.com _links: verify: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfh52xcuft3J4uZc0g3/verify + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfh52xcuft3J4uZc0g3/verify hints: allow: - POST factor: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfh52xcuft3J4uZc0g3 + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfh52xcuft3J4uZc0g3 hints: allow: - GET @@ -11690,18 +12740,14 @@ components: UserFactorVerifyU2fRequest: summary: u2f verify value: - clientData: >- - eyJ0eXAiOiJuYXZpZ2F0b3IuaWQuZ2V0QXNzZXJ0aW9uIiwiY2hhbGxlbmdlIjoiS2NCLXRqUFU0NDY0ZThuVFBudXIiLCJvcmlnaW4iOiJodHRwczovL2xvY2FsaG9zdDozMDAwIiwiY2lkX3B1YmtleSI6InVudXNlZCJ9 - signatureData: >- - AQAAACYwRgIhAKPktdpH0T5mlPSm_9uGW5w-VaUy-LhI9tIacexpgItkAiEAncRVZURVPOq7zDwIw-OM5LtSkdAxOkfv0ZDVUx3UFHc + clientData: eyJ0eXAiOiJuYXZpZ2F0b3IuaWQuZ2V0QXNzZXJ0aW9uIiwiY2hhbGxlbmdlIjoiS2NCLXRqUFU0NDY0ZThuVFBudXIiLCJvcmlnaW4iOiJodHRwczovL2xvY2FsaG9zdDozMDAwIiwiY2lkX3B1YmtleSI6InVudXNlZCJ9 + signatureData: AQAAACYwRgIhAKPktdpH0T5mlPSm_9uGW5w-VaUy-LhI9tIacexpgItkAiEAncRVZURVPOq7zDwIw-OM5LtSkdAxOkfv0ZDVUx3UFHc UserFactorVerifyWebauthnRequest: summary: WebAuthn verify challenge value: - clientData: >- - eyJ0eXAiOiJuYXZpZ2F0b3IuaWQuZ2V0QXNzZXJ0aW9uIiwiY2hhbGxlbmdlIjoiS2NCLXRqUFU0NDY0ZThuVFBudXIiLCJvcmlnaW4iOiJodHRwczovL2xvY2FsaG9zdDozMDAwIiwiY2lkX3B1YmtleSI6InVudXNlZCJ9 + clientData: eyJ0eXAiOiJuYXZpZ2F0b3IuaWQuZ2V0QXNzZXJ0aW9uIiwiY2hhbGxlbmdlIjoiS2NCLXRqUFU0NDY0ZThuVFBudXIiLCJvcmlnaW4iOiJodHRwczovL2xvY2FsaG9zdDozMDAwIiwiY2lkX3B1YmtleSI6InVudXNlZCJ9 authenticatorData: SBv04caJ+NLZ0bTeotGq9esMhHJ8YC5z4bMXXPbT95UFXbDsOg== - signatureData: >- - AQAAACYwRgIhAKPktdpH0T5mlPSm_9uGW5w-VaUy-LhI9tIacexpgItkAiEAncRVZURVPOq7zDwIw-OM5LtSkdAxOkfv0ZDVUx3UFHc + signatureData: AQAAACYwRgIhAKPktdpH0T5mlPSm_9uGW5w-VaUy-LhI9tIacexpgItkAiEAncRVZURVPOq7zDwIw-OM5LtSkdAxOkfv0ZDVUx3UFHc UserFactorVerifySecurityQuestionRequest: summary: security question verify value: @@ -11714,14 +12760,12 @@ components: phoneNumber: '+12532236986' _links: verify: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/smsszf1YNUtGWTx4j0g3/verify + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/smsszf1YNUtGWTx4j0g3/verify hints: allow: - POST factor: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/smsszf1YNUtGWTx4j0g3 + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/smsszf1YNUtGWTx4j0g3 hints: allow: - GET @@ -11739,14 +12783,12 @@ components: phoneExtension: '1234' _links: verify: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/clff17zuKEUMYQAQGCOV/verify + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/clff17zuKEUMYQAQGCOV/verify hints: allow: - POST factor: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/clff17zuKEUMYQAQGCOV + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/clff17zuKEUMYQAQGCOV hints: allow: - GET @@ -11761,14 +12803,12 @@ components: factorResult: CHALLENGE _links: verify: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/emfnf3gSScB8xXoXK0g3/verify + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/emfnf3gSScB8xXoXK0g3/verify hints: allow: - POST factor: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/emfnf3gSScB8xXoXK0g3 + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/emfnf3gSScB8xXoXK0g3 hints: allow: - GET @@ -11782,19 +12822,16 @@ components: value: factorResult: CHALLENGE profile: - credentialId: >- - GAiiLsVab2m3-zL1Fi3bVtNrM9G6_MntUITHKjxkV24ktGKjLSCRnz72wCEdHCe18IvC69Aia0sE4UpsO0HpFQ + credentialId: GAiiLsVab2m3-zL1Fi3bVtNrM9G6_MntUITHKjxkV24ktGKjLSCRnz72wCEdHCe18IvC69Aia0sE4UpsO0HpFQ version: U2F_V2 _links: verify: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/fuf2rovRxogXJ0nDy0g4/verify + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/fuf2rovRxogXJ0nDy0g4/verify hints: allow: - POST factor: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/fuf2rovRxogXJ0nDy0g4 + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/fuf2rovRxogXJ0nDy0g4 hints: allow: - GET @@ -11808,27 +12845,23 @@ components: value: factorResult: SUCCESS profile: - credentialId: >- - h1bFwJFU9wnelYkexJuQfoUHZ5lX3CgQMTZk4H3I8kM9Nn6XALiQ-BIab4P5EE0GQrA7VD-kAwgnG950aXkhBw + credentialId: h1bFwJFU9wnelYkexJuQfoUHZ5lX3CgQMTZk4H3I8kM9Nn6XALiQ-BIab4P5EE0GQrA7VD-kAwgnG950aXkhBw version: U2F_V2 UserFactorChallengeWebauthnResponse: summary: webAuthn challenge value: factorResult: CHALLENGE profile: - credentialId: >- - l3Br0n-7H3g047NqESqJynFtIgf3Ix9OfaRoNwLoloso99Xl2zS_O7EXUkmPeAIzTVtEL4dYjicJWBz7NpqhGA + credentialId: l3Br0n-7H3g047NqESqJynFtIgf3Ix9OfaRoNwLoloso99Xl2zS_O7EXUkmPeAIzTVtEL4dYjicJWBz7NpqhGA authenticatorName: MacBook Touch ID _links: verify: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/fwf2rovRxogXJ0nDy0g4/verify + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/fwf2rovRxogXJ0nDy0g4/verify hints: allow: - POST factor: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/fwf2rovRxogXJ0nDy0g4 + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/fwf2rovRxogXJ0nDy0g4 hints: allow: - GET @@ -11842,8 +12875,7 @@ components: value: factorResult: SUCCESS profile: - credentialId: >- - l3Br0n-7H3g047NqESqJynFtIgf3Ix9OfaRoNwLoloso99Xl2zS_O7EXUkmPeAIzTVtEL4dYjicJWBz7NpqhGA + credentialId: l3Br0n-7H3g047NqESqJynFtIgf3Ix9OfaRoNwLoloso99Xl2zS_O7EXUkmPeAIzTVtEL4dYjicJWBz7NpqhGA authenticatorName: MacBook Touch ID UserFactorVerifySuccessSqResponse: summary: security question verify @@ -11868,14 +12900,12 @@ components: factorResult: WAITING _links: poll: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfh52xcuft3J4uZc0g3/transactions/mst1eiHghhPxf0yhp0g + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfh52xcuft3J4uZc0g3/transactions/mst1eiHghhPxf0yhp0g hints: allow: - GET cancel: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfh52xcuft3J4uZc0g3/transactions/mst1eiHghhPxf0yhp0g + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfh52xcuft3J4uZc0g3/transactions/mst1eiHghhPxf0yhp0g hints: allow: - DELETE @@ -11893,14 +12923,12 @@ components: factorResult: WAITING _links: poll: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfh52xcuft3J4uZc0g3/transactions/mst1eiHghhPxf0yhp0g + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfh52xcuft3J4uZc0g3/transactions/mst1eiHghhPxf0yhp0g hints: allow: - GET cancel: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfh52xcuft3J4uZc0g3/transactions/mst1eiHghhPxf0yhp0g + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfh52xcuft3J4uZc0g3/transactions/mst1eiHghhPxf0yhp0g hints: allow: - DELETE @@ -11908,7 +12936,24 @@ components: summary: Example user risk response value: riskLevel: HIGH - reason: Admin override risk + reason: override.by.admin + _links: + self: + href: https://{yourOktaDomain}/api/v1/users/{userId}/risk + hints: + allow: + - GET + - PUT + user: + href: https://{yourOktaDomain}/api/v1/users/{userId} + hints: + allow: + - GET + UserRiskMediumResponse: + summary: Example user risk with MEDIUM level response + value: + riskLevel: MEDIUM + reason: override.by.admin _links: self: href: https://{yourOktaDomain}/api/v1/users/{userId}/risk @@ -11941,6 +12986,54 @@ components: summary: Example upsert the risk for a user request value: riskLevel: HIGH + UserRiskRequestWithReason: + summary: Example upsert the risk for a user request with a custom risk reason + value: + riskLevel: HIGH + riskReason: Risk level changed due to external risk signal + UserRiskRequestMediumExample: + summary: Example upsert with MEDIUM risk level + value: + riskLevel: MEDIUM + UserRiskRequestMediumWithReasonExample: + summary: Example upsert with MEDIUM risk level and custom reason + value: + riskLevel: MEDIUM + riskReason: Elevated risk detected from recent authentication patterns + UserRiskResponseWithReason: + summary: Example user risk response with custom reason + value: + riskLevel: HIGH + reason: Risk level changed due to external risk signal + _links: + self: + href: https://{yourOktaDomain}/api/v1/users/{userId}/risk + hints: + allow: + - GET + - PUT + user: + href: https://{yourOktaDomain}/api/v1/users/{userId} + hints: + allow: + - GET + UserRiskMediumResponseWithReason: + summary: Example user risk with MEDIUM level and custom reason response + value: + riskLevel: MEDIUM + reason: Elevated risk detected from recent authentication patterns + _links: + self: + href: https://{yourOktaDomain}/api/v1/users/{userId}/risk + hints: + allow: + - GET + - PUT + user: + href: https://{yourOktaDomain}/api/v1/users/{userId} + hints: + allow: + - GET StandardRolesListResponse: value: - id: IFIFAX2BIRGUSTQ @@ -12038,16 +13131,13 @@ components: assignee: href": https://{yourOktaDomain}/api/v1/users/00u1gytb3XCr9Dkr18r2 resource-set: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g member: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings/cr0Yq6IJxGIr0ouum0g3/members/irb1qe6PGuMc7Oh8N0g4 + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings/cr0Yq6IJxGIr0ouum0g3/members/irb1qe6PGuMc7Oh8N0g4 role: href: https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3 permissions: - href: >- - https://{yourOktaDomain}/api/v1/iam/permission-sets/cr0Yq6IJxGIr0ouum0g3/permissions + href: https://{yourOktaDomain}/api/v1/iam/permission-sets/cr0Yq6IJxGIr0ouum0g3/permissions - id: irb5e92YgBazyyQ3x1q5 role: cr0Yq6IJxGIr0ouum0g3 label: UserCreatorRole @@ -12061,19 +13151,13 @@ components: assignee: href: https://{ yourOktaDomain }/api/v1/groups/00g1ousb3XCr9Dkr20g4 resource-set: - href: >- - https://{ yourOktaDomain - }/api/v1/iam/resource-sets/iamoakjsdQaJxGIr03int1o + href: https://{ yourOktaDomain }/api/v1/iam/resource-sets/iamoakjsdQaJxGIr03int1o member: - href: >- - https://{ yourOktaDomain - }/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings/cr0Yq6IJxGIr0ouum0g3/members/irb1qe6PGuMc7Oh8N0g4 + href: https://{ yourOktaDomain }/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings/cr0Yq6IJxGIr0ouum0g3/members/irb1qe6PGuMc7Oh8N0g4 role: href: https://{ yourOktaDomain }/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3 permissions: - href: >- - https://{ yourOktaDomain - }/api/v1/iam/permission-sets/cr0Yq6IJxGIr0ouum0g3/permissions + href: https://{ yourOktaDomain }/api/v1/iam/permission-sets/cr0Yq6IJxGIr0ouum0g3/permissions IAMStandardRolesListResponse: value: - id: IFIFAX2BIRGUSTQ @@ -12099,16 +13183,13 @@ components: assignee: href: https://{yourOktaDomain}/api/v1/users/00u1gytb3XCr9Dkr18r2 resource-set: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g member: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings/cr0Yq6IJxGIr0ouum0g3/members/irb1qe6PGuMc7Oh8N0g4 + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings/cr0Yq6IJxGIr0ouum0g3/members/irb1qe6PGuMc7Oh8N0g4 role: href: https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3 permissions: - href: >- - https://{yourOktaDomain}/api/v1/iam/permission-sets/cr0Yq6IJxGIr0ouum0g3/permissions + href: https://{yourOktaDomain}/api/v1/iam/permission-sets/cr0Yq6IJxGIr0ouum0g3/permissions - id: irb5e92YgBazyyQ3x1q5 role: ACCESS_CERTIFICATIONS_ADMIN label: Access Certifications administrator @@ -12122,17 +13203,13 @@ components: assignee: href: https://{yourOktaDomain}/api/v1/users/00u1gytb3XCr9Dkr18r2 resource-set: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/ACCESS_CERTIFICATIONS_IAM_POLICY + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/ACCESS_CERTIFICATIONS_IAM_POLICY member: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/ACCESS_CERTIFICATIONS_IAM_POLICY/bindings/ACCESS_CERTIFICATIONS_ADMIN/members/irb1qe6PGuMc7Oh8N0g4 + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/ACCESS_CERTIFICATIONS_IAM_POLICY/bindings/ACCESS_CERTIFICATIONS_ADMIN/members/irb1qe6PGuMc7Oh8N0g4 role: - href: >- - https://{yourOktaDomain}/api/v1/iam/roles/ACCESS_CERTIFICATIONS_ADMIN + href: https://{yourOktaDomain}/api/v1/iam/roles/ACCESS_CERTIFICATIONS_ADMIN permissions: - href: >- - https://{yourOktaDomain}/api/v1/iam/permission-sets/OKTA_IAM_TEST_DELIVERED_ROLE/permissions + href: https://{yourOktaDomain}/api/v1/iam/permission-sets/OKTA_IAM_TEST_DELIVERED_ROLE/permissions StandardRoleResponseUser: value: id: ra1b8anIk7rx7em7L0g4 @@ -12160,13 +13237,11 @@ components: assignee: href": https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR resource-set: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g role: href: https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3 permissions: - href: >- - https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3/permissions + href: https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3/permissions IAMStandardRoleResponseUser: value: id: irb1q92TFAHzySt3x0g4 @@ -12182,16 +13257,13 @@ components: assignee: href: https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR resource-set: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/ACCESS_CERTIFICATIONS_IAM_POLICY + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/ACCESS_CERTIFICATIONS_IAM_POLICY role: href: https://{yourOktaDomain}/api/v1/iam/roles/ACCESS_REQUESTS_ADMIN permissions: - href: >- - https://{yourOktaDomain}/api/v1/iam/roles/ACCESS_REQUESTS_ADMIN/permissions + href: https://{yourOktaDomain}/api/v1/iam/roles/ACCESS_REQUESTS_ADMIN/permissions member: - href: >- - https://{yourOktaDomain}/api/v1/iam/resource-sets/ACCESS_CERTIFICATIONS_IAM_POLICY/bindings/ACCESS_REQUESTS_ADMIN/members/irb1q92TFAHzySt3x0g4 + href: https://{yourOktaDomain}/api/v1/iam/resource-sets/ACCESS_CERTIFICATIONS_IAM_POLICY/bindings/ACCESS_REQUESTS_ADMIN/members/irb1q92TFAHzySt3x0g4 GetUseRoleGovernanceResponse: value: grants: @@ -12199,20 +13271,17 @@ components: grantId: grai24zWTjnDazeOI0g4 _links: resources: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15r0i2hC4jeTne0g5/roles/KVJUKUS7IFCE2SKO/governance/grai24zWTjnDazeOI0g4/resources + href: https://{yourOktaDomain}/api/v1/users/00u15r0i2hC4jeTne0g5/roles/KVJUKUS7IFCE2SKO/governance/grai24zWTjnDazeOI0g4/resources - type: ENTITLEMENT-BUNDLE grantId: grai2556vZgWesWf10g4 bundleId: enbhz2pAwtts9UBes0g4 expirationDate: '2024-12-09 14:17:22.0' _links: resources: - href: >- - https://{yourOktaDomain}//api/v1/users/00u15r0i2hC4jeTne0g5/roles/KVJUKUS7IFCE2SKO/governance/grai2556vZgWesWf10g4/resources + href: https://{yourOktaDomain}//api/v1/users/00u15r0i2hC4jeTne0g5/roles/KVJUKUS7IFCE2SKO/governance/grai2556vZgWesWf10g4/resources _links: self: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15r0i2hC4jeTne0g5/roles/KVJUKUS7IFCE2SKO/governance + href: https://{yourOktaDomain}/api/v1/users/00u15r0i2hC4jeTne0g5/roles/KVJUKUS7IFCE2SKO/governance assignee: href: https://{yourOktaDomain}/api/v1/users/00u15r0i2hC4jeTne0g5" GetRoleAssignmentGovernanceGrantResponse: @@ -12223,27 +13292,21 @@ components: expirationDate: '2024-12-09 14:17:22.0' _links: resources: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15r0i2hC4jeTne0g5/roles/KVJUKUS7IFCE2SKO/governance/grai2556vZgWesWf10g4/resources + href: https://{yourOktaDomain}/api/v1/users/00u15r0i2hC4jeTne0g5/roles/KVJUKUS7IFCE2SKO/governance/grai2556vZgWesWf10g4/resources self: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15r0i2hC4jeTne0g5/roles/KVJUKUS7IFCE2SKO/governance/grai2556vZgWesWf10g4 + href: https://{yourOktaDomain}/api/v1/users/00u15r0i2hC4jeTne0g5/roles/KVJUKUS7IFCE2SKO/governance/grai2556vZgWesWf10g4 GetRoleAssignmentGovernanceGrantResources: value: resources: - - resource: >- - orn:okta:directory:00ozmkUsqWxsUxhGO0g3:groups:00g114290ar1oCC5A0g5 + - resource: orn:okta:directory:00ozmkUsqWxsUxhGO0g3:groups:00g114290ar1oCC5A0g5 label: test-group-1 - - resource: >- - orn:okta:directory:00ozmkUsqWxsUxhGO0g3:groups:00g118990hl1oCC5B0g5 + - resource: orn:okta:directory:00ozmkUsqWxsUxhGO0g3:groups:00g118990hl1oCC5B0g5 label: test-group-2 _links: next: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15r0i2hC4jeTne0g5/roles/KVJUKUS7IFCE2SKO/governance/grai2556vZgWesWf10g4/resources?after=orn:okta:directory:00ozmkUsqWxsUxhGO0g3:groups:00g118990hl1oCC5A0g5 + href: https://{yourOktaDomain}/api/v1/users/00u15r0i2hC4jeTne0g5/roles/KVJUKUS7IFCE2SKO/governance/grai2556vZgWesWf10g4/resources?after=orn:okta:directory:00ozmkUsqWxsUxhGO0g3:groups:00g118990hl1oCC5A0g5 self: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15r0i2hC4jeTne0g5/roles/KVJUKUS7IFCE2SKO/governance/grai2556vZgWesWf10g4/resources + href: https://{yourOktaDomain}/api/v1/users/00u15r0i2hC4jeTne0g5/roles/KVJUKUS7IFCE2SKO/governance/grai2556vZgWesWf10g4/resources RoleTargetGroupResponse: value: - orn: orn:okta:directory:00o5v1t2W4OSF9r4N0g4:groups:00g5vhi3rEJMOog1S0g4 @@ -12259,8 +13322,7 @@ components: expiration: '2025-05-10T20:21:11.000Z' _links: self: - href: >- - https://{yourOktaDomain}/api/v1/apps%3Ffilter%3Dname%2Beq%2B%22gooddata%22 + href: https://{yourOktaDomain}/api/v1/apps%3Ffilter%3Dname%2Beq%2B%22gooddata%22 RoleTargetAppInstanceResponse: value: - orn: orn:okta:idp:00o5yd9J0satsK2Rp0g4:apps:myownapp:0oa5yriAxuR12wfQ30g4 @@ -12322,8 +13384,7 @@ components: nickname: Joe's Work Phone _links: self: - href: >- - https://{yourOktaDomain}/api/v1/users/00u4za57vqNsQAN8S0g7/authenticator-enrollments/sms8evhwh0Ne35iPR0g7 + href: https://{yourOktaDomain}/api/v1/users/00u4za57vqNsQAN8S0g7/authenticator-enrollments/sms8evhwh0Ne35iPR0g7 hints: allow: - GET @@ -12334,8 +13395,7 @@ components: allow: - GET authenticator: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/auth60xfl7VbebsFr0g6 + href: https://{yourOktaDomain}/api/v1/authenticators/auth60xfl7VbebsFr0g6 hints: allow: - GET @@ -12354,8 +13414,7 @@ components: nickname: Joe's Work Phone _links: self: - href: >- - https://{yourOktaDomain}/api/v1/users/00u4za57vqNsQAN8S0g7/authenticator-enrollments/clf8evhwh0Ne35iPR0g7 + href: https://{yourOktaDomain}/api/v1/users/00u4za57vqNsQAN8S0g7/authenticator-enrollments/clf8evhwh0Ne35iPR0g7 hints: allow: - GET @@ -12366,8 +13425,7 @@ components: allow: - GET authenticator: - href: >- - https://{yourOktaDomain}/api/v1/authenticators/auth60xfl7VbebsFr0g6 + href: https://{yourOktaDomain}/api/v1/authenticators/auth60xfl7VbebsFr0g6 hints: allow: - GET @@ -12402,8 +13460,32 @@ components: expiresAt: '2025-05-28T19:21:14' _links: self: - href: >- - https://{yourOktaDomain}/api/v1/users/00u4za57vqNsQAN8S0g7/authenticator-enrollments/clf8evhwh0Ne35iPR0g7 + href: https://{yourOktaDomain}/api/v1/users/00u4za57vqNsQAN8S0g7/authenticator-enrollments/clf8evhwh0Ne35iPR0g7 + hints: + allow: + - GET + - DELETE + user: + href: https://{yourOktaDomain}/api/v1/users/00u4za57vqNsQAN8S0g7 + hints: + allow: + - GET + AuthenticatorEnrollmentResponsePhoneDisclosed: + summary: Phone number disclosed - SMS authenticator enrollment response + value: + type: phone + id: sms8evhwh0Ne35iPR0g7 + key: phone_number + status: ACTIVE + name: Phone + created: '2020-07-26T21:05:23.000Z' + lastUpdated: '2020-07-29T00:21:29.000Z' + profile: + phoneNumber: 14085551235 + nickname: Ann's Home Phone + _links: + self: + href: https://{yourOktaDomain}/api/v1/users/00u4za57vqNsQAN8S0g7/authenticator-enrollments/sms8evhwh0Ne35iPR0g7 hints: allow: - GET @@ -12413,6 +13495,11 @@ components: hints: allow: - GET + authenticator: + href: https://{yourOktaDomain}/api/v1/authenticators/auth60xfl7VbebsFr0g6 + hints: + allow: + - GET FactorResponseSms: value: id: sms2gt8gzgEBPUWBIFHN @@ -12426,14 +13513,12 @@ components: phoneNumber: +1-555-415-1337 _links: verify: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/sms2gt8gzgEBPUWBIFHN/verify + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/sms2gt8gzgEBPUWBIFHN/verify hints: allow: - POST self: - href: >- - https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/sms2gt8gzgEBPUWBIFHN + href: https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/sms2gt8gzgEBPUWBIFHN hints: allow: - GET @@ -12454,14 +13539,12 @@ components: email: changed@clouditude.net _links: verify: - href: >- - https://{yourOktaDomain}/api/v1/users/00umvfJKwXOQ1mEL50g3/factors/emfnf3gSScB8xXoXK0g3/verify + href: https://{yourOktaDomain}/api/v1/users/00umvfJKwXOQ1mEL50g3/factors/emfnf3gSScB8xXoXK0g3/verify hints: allow: - POST self: - href: >- - https://{yourOktaDomain}/api/v1/users/00umvfJKwXOQ1mEL50g3/factors/emfnf3gSScB8xXoXK0g3 + href: https://{yourOktaDomain}/api/v1/users/00umvfJKwXOQ1mEL50g3/factors/emfnf3gSScB8xXoXK0g3 hints: allow: - GET @@ -12502,18 +13585,24 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.users + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListUsersResponse' + transform: + body: |- + {{- $wrapped := printf "{\"users\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_user: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1users/post' response: mediaType: application/json openAPIDocKey: '200' - end_user_sessions: - operation: - $ref: '#/paths/~1api~1v1~1users~1me~1lifecycle~1delete_sessions/post' - response: - mediaType: '' - openAPIDocKey: '200' get_user: operation: $ref: '#/paths/~1api~1v1~1users~1{id}/get' @@ -12521,12 +13610,18 @@ components: mediaType: application/json openAPIDocKey: '200' update_user: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1users~1{id}/post' response: mediaType: application/json openAPIDocKey: '200' replace_user: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1users~1{id}/put' response: @@ -12536,7 +13631,7 @@ components: operation: $ref: '#/paths/~1api~1v1~1users~1{id}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' activate_user: operation: @@ -12548,7 +13643,7 @@ components: operation: $ref: '#/paths/~1api~1v1~1users~1{id}~1lifecycle~1deactivate/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '200' expire_password: operation: @@ -12558,8 +13653,7 @@ components: openAPIDocKey: '200' expire_password_with_temp_password: operation: - $ref: >- - #/paths/~1api~1v1~1users~1{id}~1lifecycle~1expire_password_with_temp_password/post + $ref: '#/paths/~1api~1v1~1users~1{id}~1lifecycle~1expire_password_with_temp_password/post' response: mediaType: application/json openAPIDocKey: '200' @@ -12573,7 +13667,7 @@ components: operation: $ref: '#/paths/~1api~1v1~1users~1{id}~1lifecycle~1reset_factors/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '200' reset_password: operation: @@ -12585,45 +13679,50 @@ components: operation: $ref: '#/paths/~1api~1v1~1users~1{id}~1lifecycle~1suspend/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '200' unlock_user: operation: $ref: '#/paths/~1api~1v1~1users~1{id}~1lifecycle~1unlock/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '200' unsuspend_user: operation: $ref: '#/paths/~1api~1v1~1users~1{id}~1lifecycle~1unsuspend/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '200' change_password: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1credentials~1change_password/post + $ref: '#/paths/~1api~1v1~1users~1{userId}~1credentials~1change_password/post' response: mediaType: application/json openAPIDocKey: '200' change_recovery_question: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1credentials~1change_recovery_question/post + $ref: '#/paths/~1api~1v1~1users~1{userId}~1credentials~1change_recovery_question/post' response: mediaType: application/json openAPIDocKey: '200' forgot_password: operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1credentials~1forgot_password/post + $ref: '#/paths/~1api~1v1~1users~1{userId}~1credentials~1forgot_password/post' response: mediaType: application/json openAPIDocKey: '200' forgot_password_set_new_password: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1credentials~1forgot_password_recovery_question/post + $ref: '#/paths/~1api~1v1~1users~1{userId}~1credentials~1forgot_password_recovery_question/post' response: mediaType: application/json openAPIDocKey: '200' @@ -12631,12 +13730,12 @@ components: operation: $ref: '#/paths/~1api~1v1~1users~1{userId}~1sessions/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: '#/components/x-stackQL-resources/users/methods/list_users' - $ref: '#/components/x-stackQL-resources/users/methods/get_user' + - $ref: '#/components/x-stackQL-resources/users/methods/list_users' insert: - $ref: '#/components/x-stackQL-resources/users/methods/create_user' update: @@ -12656,6 +13755,15 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.app_links + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListAppLinksResponse' + transform: + body: |- + {{- $wrapped := printf "{\"app_links\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 sqlVerbs: select: - $ref: '#/components/x-stackQL-resources/app_links/methods/list_app_links' @@ -12674,10 +13782,18 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.user_blocks + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListUserBlocksResponse' + transform: + body: |- + {{- $wrapped := printf "{\"user_blocks\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/user_blocks/methods/list_user_blocks + - $ref: '#/components/x-stackQL-resources/user_blocks/methods/list_user_blocks' insert: [] update: [] delete: [] @@ -12693,10 +13809,18 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.user_groups + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListUserGroupsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"user_groups\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/user_groups/methods/list_user_groups + - $ref: '#/components/x-stackQL-resources/user_groups/methods/list_user_groups' insert: [] update: [] delete: [] @@ -12712,10 +13836,18 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.user_identity_providers + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListUserIdentityProvidersResponse' + transform: + body: |- + {{- $wrapped := printf "{\"user_identity_providers\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/identity_providers/methods/list_user_identity_providers + - $ref: '#/components/x-stackQL-resources/identity_providers/methods/list_user_identity_providers' insert: [] update: [] delete: [] @@ -12727,37 +13859,40 @@ components: methods: assign_linked_object_value_for_primary: operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userIdOrLogin}~1linkedObjects~1{primaryRelationshipName}~1{primaryUserId}/put + $ref: '#/paths/~1api~1v1~1users~1{userIdOrLogin}~1linkedObjects~1{primaryRelationshipName}~1{primaryUserId}/put' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' list_linked_objects_for_user: operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userIdOrLogin}~1linkedObjects~1{relationshipName}/get + $ref: '#/paths/~1api~1v1~1users~1{userIdOrLogin}~1linkedObjects~1{relationshipName}/get' response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.linked_objects_for_user + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListLinkedObjectsForUserResponse' + transform: + body: |- + {{- $wrapped := printf "{\"linked_objects_for_user\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 delete_linked_object_for_user: operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userIdOrLogin}~1linkedObjects~1{relationshipName}/delete + $ref: '#/paths/~1api~1v1~1users~1{userIdOrLogin}~1linkedObjects~1{relationshipName}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/linked_objects/methods/list_linked_objects_for_user + - $ref: '#/components/x-stackQL-resources/linked_objects/methods/list_linked_objects_for_user' insert: [] update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/linked_objects/methods/delete_linked_object_for_user + - $ref: '#/components/x-stackQL-resources/linked_objects/methods/delete_linked_object_for_user' replace: - - $ref: >- - #/components/x-stackQL-resources/linked_objects/methods/assign_linked_object_value_for_primary + - $ref: '#/components/x-stackQL-resources/linked_objects/methods/assign_linked_object_value_for_primary' authenticator_enrollments: id: okta.users.authenticator_enrollments name: authenticator_enrollments @@ -12770,48 +13905,45 @@ components: mediaType: application/json openAPIDocKey: '200' create_authenticator_enrollment: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1authenticator-enrollments~1phone/post + $ref: '#/paths/~1api~1v1~1users~1{userId}~1authenticator-enrollments~1phone/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '200' create_tac_authenticator_enrollment: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1authenticator-enrollments~1tac/post + $ref: '#/paths/~1api~1v1~1users~1{userId}~1authenticator-enrollments~1tac/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '200' get_authenticator_enrollment: operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1authenticator-enrollments~1{enrollmentId}/get + $ref: '#/paths/~1api~1v1~1users~1{userId}~1authenticator-enrollments~1{enrollmentId}/get' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '200' delete_authenticator_enrollment: operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1authenticator-enrollments~1{enrollmentId}/delete + $ref: '#/paths/~1api~1v1~1users~1{userId}~1authenticator-enrollments~1{enrollmentId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/authenticator_enrollments/methods/list_authenticator_enrollments - - $ref: >- - #/components/x-stackQL-resources/authenticator_enrollments/methods/get_authenticator_enrollment + - $ref: '#/components/x-stackQL-resources/authenticator_enrollments/methods/get_authenticator_enrollment' + - $ref: '#/components/x-stackQL-resources/authenticator_enrollments/methods/list_authenticator_enrollments' insert: - - $ref: >- - #/components/x-stackQL-resources/authenticator_enrollments/methods/create_authenticator_enrollment - - $ref: >- - #/components/x-stackQL-resources/authenticator_enrollments/methods/create_tac_authenticator_enrollment + - $ref: '#/components/x-stackQL-resources/authenticator_enrollments/methods/create_authenticator_enrollment' + - $ref: '#/components/x-stackQL-resources/authenticator_enrollments/methods/create_tac_authenticator_enrollment' update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/authenticator_enrollments/methods/delete_authenticator_enrollment + - $ref: '#/components/x-stackQL-resources/authenticator_enrollments/methods/delete_authenticator_enrollment' replace: [] classifications: id: okta.users.classifications @@ -12825,6 +13957,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_user_classification: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1users~1{userId}~1classification/put' response: @@ -12832,14 +13967,12 @@ components: openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/classifications/methods/get_user_classification + - $ref: '#/components/x-stackQL-resources/classifications/methods/get_user_classification' insert: [] update: [] delete: [] replace: - - $ref: >- - #/components/x-stackQL-resources/classifications/methods/replace_user_classification + - $ref: '#/components/x-stackQL-resources/classifications/methods/replace_user_classification' user_clients: id: okta.users.user_clients name: user_clients @@ -12851,10 +13984,18 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.user_clients + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListUserClientsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"user_clients\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/user_clients/methods/list_user_clients + - $ref: '#/components/x-stackQL-resources/user_clients/methods/list_user_clients' insert: [] update: [] delete: [] @@ -12866,17 +14007,24 @@ components: methods: list_grants_for_user_and_client: operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1clients~1{clientId}~1grants/get + $ref: '#/paths/~1api~1v1~1users~1{userId}~1clients~1{clientId}~1grants/get' response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.grants_for_user_and_client + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListGrantsForUserAndClientResponse' + transform: + body: |- + {{- $wrapped := printf "{\"grants_for_user_and_client\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 revoke_grants_for_user_and_client: operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1clients~1{clientId}~1grants/delete + $ref: '#/paths/~1api~1v1~1users~1{userId}~1clients~1{clientId}~1grants/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' list_user_grants: operation: @@ -12884,11 +14032,20 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.user_grants + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListUserGrantsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"user_grants\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 revoke_user_grants: operation: $ref: '#/paths/~1api~1v1~1users~1{userId}~1grants/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' get_user_grant: operation: @@ -12900,21 +14057,19 @@ components: operation: $ref: '#/paths/~1api~1v1~1users~1{userId}~1grants~1{grantId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/grants/methods/list_grants_for_user_and_client - - $ref: '#/components/x-stackQL-resources/grants/methods/list_user_grants' + - $ref: '#/components/x-stackQL-resources/grants/methods/list_grants_for_user_and_client' - $ref: '#/components/x-stackQL-resources/grants/methods/get_user_grant' + - $ref: '#/components/x-stackQL-resources/grants/methods/list_user_grants' insert: [] update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/grants/methods/revoke_grants_for_user_and_client - - $ref: '#/components/x-stackQL-resources/grants/methods/revoke_user_grants' + - $ref: '#/components/x-stackQL-resources/grants/methods/revoke_grants_for_user_and_client' - $ref: '#/components/x-stackQL-resources/grants/methods/revoke_user_grant' + - $ref: '#/components/x-stackQL-resources/grants/methods/revoke_user_grants' replace: [] oauth_tokens: id: okta.users.oauth_tokens @@ -12923,45 +14078,46 @@ components: methods: list_refresh_tokens_for_user_and_client: operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1clients~1{clientId}~1tokens/get + $ref: '#/paths/~1api~1v1~1users~1{userId}~1clients~1{clientId}~1tokens/get' response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.refresh_tokens_for_user_and_client + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListRefreshTokensForUserAndClientResponse' + transform: + body: |- + {{- $wrapped := printf "{\"refresh_tokens_for_user_and_client\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 revoke_tokens_for_user_and_client: operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1clients~1{clientId}~1tokens/delete + $ref: '#/paths/~1api~1v1~1users~1{userId}~1clients~1{clientId}~1tokens/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' get_refresh_token_for_user_and_client: operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1clients~1{clientId}~1tokens~1{tokenId}/get + $ref: '#/paths/~1api~1v1~1users~1{userId}~1clients~1{clientId}~1tokens~1{tokenId}/get' response: mediaType: application/json openAPIDocKey: '200' revoke_token_for_user_and_client: operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1clients~1{clientId}~1tokens~1{tokenId}/delete + $ref: '#/paths/~1api~1v1~1users~1{userId}~1clients~1{clientId}~1tokens~1{tokenId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/oauth_tokens/methods/list_refresh_tokens_for_user_and_client - - $ref: >- - #/components/x-stackQL-resources/oauth_tokens/methods/get_refresh_token_for_user_and_client + - $ref: '#/components/x-stackQL-resources/oauth_tokens/methods/get_refresh_token_for_user_and_client' + - $ref: '#/components/x-stackQL-resources/oauth_tokens/methods/list_refresh_tokens_for_user_and_client' insert: [] update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/oauth_tokens/methods/revoke_tokens_for_user_and_client - - $ref: >- - #/components/x-stackQL-resources/oauth_tokens/methods/revoke_token_for_user_and_client + - $ref: '#/components/x-stackQL-resources/oauth_tokens/methods/revoke_token_for_user_and_client' + - $ref: '#/components/x-stackQL-resources/oauth_tokens/methods/revoke_tokens_for_user_and_client' replace: [] user_devices: id: okta.users.user_devices @@ -12974,10 +14130,18 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.user_devices + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListUserDevicesResponse' + transform: + body: |- + {{- $wrapped := printf "{\"user_devices\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/user_devices/methods/list_user_devices + - $ref: '#/components/x-stackQL-resources/user_devices/methods/list_user_devices' insert: [] update: [] delete: [] @@ -12993,7 +14157,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.factors + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListFactorsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"factors\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 enroll_factor: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1users~1{userId}~1factors/post' response: @@ -13003,48 +14179,52 @@ components: operation: $ref: '#/paths/~1api~1v1~1users~1{userId}~1factors~1{factorId}/get' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '200' unenroll_factor: operation: $ref: '#/paths/~1api~1v1~1users~1{userId}~1factors~1{factorId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' activate_factor: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1factors~1{factorId}~1lifecycle~1activate/post + $ref: '#/paths/~1api~1v1~1users~1{userId}~1factors~1{factorId}~1lifecycle~1activate/post' response: mediaType: application/json openAPIDocKey: '200' resend_enroll_factor: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1factors~1{factorId}~1resend/post + $ref: '#/paths/~1api~1v1~1users~1{userId}~1factors~1{factorId}~1resend/post' response: mediaType: application/json openAPIDocKey: '200' get_factor_transaction_status: operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1factors~1{factorId}~1transactions~1{transactionId}/get + $ref: '#/paths/~1api~1v1~1users~1{userId}~1factors~1{factorId}~1transactions~1{transactionId}/get' response: mediaType: application/json openAPIDocKey: '200' verify_factor: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1factors~1{factorId}~1verify/post + $ref: '#/paths/~1api~1v1~1users~1{userId}~1factors~1{factorId}~1verify/post' response: mediaType: application/json openAPIDocKey: '200' sqlVerbs: select: - - $ref: '#/components/x-stackQL-resources/factors/methods/list_factors' + - $ref: '#/components/x-stackQL-resources/factors/methods/get_factor_transaction_status' - $ref: '#/components/x-stackQL-resources/factors/methods/get_factor' - - $ref: >- - #/components/x-stackQL-resources/factors/methods/get_factor_transaction_status + - $ref: '#/components/x-stackQL-resources/factors/methods/list_factors' insert: - $ref: '#/components/x-stackQL-resources/factors/methods/enroll_factor' update: [] @@ -13062,10 +14242,18 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.supported_factors + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListSupportedFactorsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"supported_factors\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/supported_factors/methods/list_supported_factors + - $ref: '#/components/x-stackQL-resources/supported_factors/methods/list_supported_factors' insert: [] update: [] delete: [] @@ -13081,10 +14269,18 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.supported_security_questions + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListSupportedSecurityQuestionsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"supported_security_questions\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/supported_security_questions/methods/list_supported_security_questions + - $ref: '#/components/x-stackQL-resources/supported_security_questions/methods/list_supported_security_questions' insert: [] update: [] delete: [] @@ -13101,6 +14297,9 @@ components: mediaType: application/json openAPIDocKey: '200' upsert_user_risk: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1users~1{userId}~1risk/put' response: @@ -13113,8 +14312,7 @@ components: update: [] delete: [] replace: - - $ref: >- - #/components/x-stackQL-resources/user_risk/methods/upsert_user_risk + - $ref: '#/components/x-stackQL-resources/user_risk/methods/upsert_user_risk' role_assignment_users: id: okta.users.role_assignment_users name: role_assignment_users @@ -13126,7 +14324,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.assigned_roles_for_user + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListAssignedRolesForUserResponse' + transform: + body: |- + {{- $wrapped := printf "{\"assigned_roles_for_user\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 assign_role_to_user: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1users~1{userId}~1roles/post' response: @@ -13140,45 +14350,37 @@ components: openAPIDocKey: '200' unassign_role_from_user: operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1roles~1{roleAssignmentId}/delete + $ref: '#/paths/~1api~1v1~1users~1{userId}~1roles~1{roleAssignmentId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' assign_all_apps_as_target_to_role_for_user: operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1roles~1{roleAssignmentId}~1targets~1catalog~1apps/put + $ref: '#/paths/~1api~1v1~1users~1{userId}~1roles~1{roleAssignmentId}~1targets~1catalog~1apps/put' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '200' assign_app_target_to_admin_role_for_user: operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1roles~1{roleAssignmentId}~1targets~1catalog~1apps~1{appName}/put + $ref: '#/paths/~1api~1v1~1users~1{userId}~1roles~1{roleAssignmentId}~1targets~1catalog~1apps~1{appName}/put' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' assign_app_instance_target_to_app_admin_role_for_user: operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1roles~1{roleAssignmentId}~1targets~1catalog~1apps~1{appName}~1{appId}/put + $ref: '#/paths/~1api~1v1~1users~1{userId}~1roles~1{roleAssignmentId}~1targets~1catalog~1apps~1{appName}~1{appId}/put' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/role_assignment_users/methods/list_assigned_roles_for_user - - $ref: >- - #/components/x-stackQL-resources/role_assignment_users/methods/get_user_assigned_role + - $ref: '#/components/x-stackQL-resources/role_assignment_users/methods/get_user_assigned_role' + - $ref: '#/components/x-stackQL-resources/role_assignment_users/methods/list_assigned_roles_for_user' insert: - - $ref: >- - #/components/x-stackQL-resources/role_assignment_users/methods/assign_role_to_user + - $ref: '#/components/x-stackQL-resources/role_assignment_users/methods/assign_role_to_user' update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/role_assignment_users/methods/unassign_role_from_user + - $ref: '#/components/x-stackQL-resources/role_assignment_users/methods/unassign_role_from_user' replace: [] user_assigned_role_governance: id: okta.users.user_assigned_role_governance @@ -13187,15 +14389,13 @@ components: methods: get_user_assigned_role_governance: operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1roles~1{roleAssignmentId}~1governance/get + $ref: '#/paths/~1api~1v1~1users~1{userId}~1roles~1{roleAssignmentId}~1governance/get' response: mediaType: application/json openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/user_assigned_role_governance/methods/get_user_assigned_role_governance + - $ref: '#/components/x-stackQL-resources/user_assigned_role_governance/methods/get_user_assigned_role_governance' insert: [] update: [] delete: [] @@ -13207,15 +14407,13 @@ components: methods: get_role_assignment_governance_grant: operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1roles~1{roleAssignmentId}~1governance~1{grantId}/get + $ref: '#/paths/~1api~1v1~1users~1{userId}~1roles~1{roleAssignmentId}~1governance~1{grantId}/get' response: mediaType: application/json openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/role_assignment_governance_grant/methods/get_role_assignment_governance_grant + - $ref: '#/components/x-stackQL-resources/role_assignment_governance_grant/methods/get_role_assignment_governance_grant' insert: [] update: [] delete: [] @@ -13227,15 +14425,13 @@ components: methods: get_role_assignment_governance_grant_resources: operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1roles~1{roleAssignmentId}~1governance~1{grantId}~1resources/get + $ref: '#/paths/~1api~1v1~1users~1{userId}~1roles~1{roleAssignmentId}~1governance~1{grantId}~1resources/get' response: mediaType: application/json openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/role_assignment_governance_grant_resources/methods/get_role_assignment_governance_grant_resources + - $ref: '#/components/x-stackQL-resources/role_assignment_governance_grant_resources/methods/get_role_assignment_governance_grant_resources' insert: [] update: [] delete: [] @@ -13247,36 +14443,39 @@ components: methods: list_application_targets_for_application_administrator_role_for_user: operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1roles~1{roleAssignmentId}~1targets~1catalog~1apps/get + $ref: '#/paths/~1api~1v1~1users~1{userId}~1roles~1{roleAssignmentId}~1targets~1catalog~1apps/get' response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.application_targets_for_application_administrator_role_for_user + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListApplicationTargetsForApplicationAdministratorRoleForUserResponse' + transform: + body: |- + {{- $wrapped := printf "{\"application_targets_for_application_administrator_role_for_user\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 unassign_app_target_from_app_admin_role_for_user: operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1roles~1{roleAssignmentId}~1targets~1catalog~1apps~1{appName}/delete + $ref: '#/paths/~1api~1v1~1users~1{userId}~1roles~1{roleAssignmentId}~1targets~1catalog~1apps~1{appName}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' unassign_app_instance_target_from_admin_role_for_user: operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1roles~1{roleAssignmentId}~1targets~1catalog~1apps~1{appName}~1{appId}/delete + $ref: '#/paths/~1api~1v1~1users~1{userId}~1roles~1{roleAssignmentId}~1targets~1catalog~1apps~1{appName}~1{appId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/admin_app_targets/methods/list_application_targets_for_application_administrator_role_for_user + - $ref: '#/components/x-stackQL-resources/admin_app_targets/methods/list_application_targets_for_application_administrator_role_for_user' insert: [] update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/admin_app_targets/methods/unassign_app_target_from_app_admin_role_for_user - - $ref: >- - #/components/x-stackQL-resources/admin_app_targets/methods/unassign_app_instance_target_from_admin_role_for_user + - $ref: '#/components/x-stackQL-resources/admin_app_targets/methods/unassign_app_instance_target_from_admin_role_for_user' + - $ref: '#/components/x-stackQL-resources/admin_app_targets/methods/unassign_app_target_from_app_admin_role_for_user' replace: [] role_group_targets: id: okta.users.role_group_targets @@ -13285,37 +14484,40 @@ components: methods: list_group_targets_for_role: operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1roles~1{roleAssignmentId}~1targets~1groups/get + $ref: '#/paths/~1api~1v1~1users~1{userId}~1roles~1{roleAssignmentId}~1targets~1groups/get' response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.group_targets_for_role + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListGroupTargetsForRoleResponse' + transform: + body: |- + {{- $wrapped := printf "{\"group_targets_for_role\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 assign_group_target_to_user_role: operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1roles~1{roleAssignmentId}~1targets~1groups~1{groupId}/put + $ref: '#/paths/~1api~1v1~1users~1{userId}~1roles~1{roleAssignmentId}~1targets~1groups~1{groupId}/put' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' unassign_group_target_from_user_admin_role: operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1roles~1{roleAssignmentId}~1targets~1groups~1{groupId}/delete + $ref: '#/paths/~1api~1v1~1users~1{userId}~1roles~1{roleAssignmentId}~1targets~1groups~1{groupId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/role_group_targets/methods/list_group_targets_for_role + - $ref: '#/components/x-stackQL-resources/role_group_targets/methods/list_group_targets_for_role' insert: [] update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/role_group_targets/methods/unassign_group_target_from_user_admin_role + - $ref: '#/components/x-stackQL-resources/role_group_targets/methods/unassign_group_target_from_user_admin_role' replace: - - $ref: >- - #/components/x-stackQL-resources/role_group_targets/methods/assign_group_target_to_user_role + - $ref: '#/components/x-stackQL-resources/role_group_targets/methods/assign_group_target_to_user_role' role_targets: id: okta.users.role_targets name: role_targets @@ -13323,15 +14525,22 @@ components: methods: get_role_targets_by_user_id_and_role_id: operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1roles~1{roleIdOrEncodedRoleId}~1targets/get + $ref: '#/paths/~1api~1v1~1users~1{userId}~1roles~1{roleIdOrEncodedRoleId}~1targets/get' response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.role_targets_by_user_id_and_role_id + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/GetRoleTargetsByUserIdAndRoleIdResponse' + transform: + body: |- + {{- $wrapped := printf "{\"role_targets_by_user_id_and_role_id\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/role_targets/methods/get_role_targets_by_user_id_and_role_id + - $ref: '#/components/x-stackQL-resources/role_targets/methods/get_role_targets_by_user_id_and_role_id' insert: [] update: [] delete: [] @@ -13347,33 +14556,37 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.subscriptions_user + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListSubscriptionsUserResponse' + transform: + body: |- + {{- $wrapped := printf "{\"subscriptions_user\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 get_subscriptions_notification_type_user: operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1subscriptions~1{notificationType}/get + $ref: '#/paths/~1api~1v1~1users~1{userId}~1subscriptions~1{notificationType}/get' response: mediaType: application/json openAPIDocKey: '200' subscribe_by_notification_type_user: operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1subscriptions~1{notificationType}~1subscribe/post + $ref: '#/paths/~1api~1v1~1users~1{userId}~1subscriptions~1{notificationType}~1subscribe/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '200' unsubscribe_by_notification_type_user: operation: - $ref: >- - #/paths/~1api~1v1~1users~1{userId}~1subscriptions~1{notificationType}~1unsubscribe/post + $ref: '#/paths/~1api~1v1~1users~1{userId}~1subscriptions~1{notificationType}~1unsubscribe/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/subscriptions/methods/list_subscriptions_user - - $ref: >- - #/components/x-stackQL-resources/subscriptions/methods/get_subscriptions_notification_type_user + - $ref: '#/components/x-stackQL-resources/subscriptions/methods/get_subscriptions_notification_type_user' + - $ref: '#/components/x-stackQL-resources/subscriptions/methods/list_subscriptions_user' insert: [] update: [] delete: [] @@ -13383,7 +14596,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/webauthn_registration.yaml b/providers/src/okta/v00.00.00000/services/webauthn_registration.yaml index 8e499e55..2116185e 100644 --- a/providers/src/okta/v00.00.00000/services/webauthn_registration.yaml +++ b/providers/src/okta/v00.00.00000/services/webauthn_registration.yaml @@ -2,15 +2,12 @@ openapi: 3.0.3 info: title: webauthn_registration API description: okta webauthn_registration API - version: 5.1.0 + version: 2026.07.2 paths: /webauthn-registration/api/v1/activate: post: summary: Activate a preregistered WebAuthn factor - description: >- - Activates a preregistered WebAuthn factor. As part of this operation, - Okta first decrypts and verifies the factor PIN and enrollment data sent - by the fulfillment provider. + description: Activates a preregistered WebAuthn factor. As part of this operation, Okta first decrypts and verifies the factor PIN and enrollment data sent by the fulfillment provider. operationId: activatePreregistrationEnrollment x-codegen-request-body-name: body requestBody: @@ -25,13 +22,6 @@ paths: responses: '200': description: Success - content: - application/json: - schema: - $ref: '#/components/schemas/EnrollmentActivationResponse' - examples: - Activate Preregistration Enrollment Response: - $ref: '#/components/examples/EnrollmentActivationResponseExample' '400': description: PIN or cred requests generation failed content: @@ -40,8 +30,7 @@ paths: $ref: '#/components/schemas/Error' examples: NoDisable: - $ref: >- - #/components/examples/ErrorPinOrCredResponsesProcessingFailure + $ref: '#/components/examples/ErrorPinOrCredResponsesProcessingFailure' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -62,12 +51,7 @@ paths: /webauthn-registration/api/v1/enroll: post: summary: Enroll a preregistered WebAuthn factor - description: >- - Enrolls a preregistered WebAuthn factor. This WebAuthn factor has a - longer challenge timeout period to accommodate the fulfillment request - process. As part of this operation, Okta generates elliptic curve (EC) - key-pairs used to encrypt the factor PIN and enrollment data sent by the - fulfillment provider. + description: Enrolls a preregistered WebAuthn factor. This WebAuthn factor has a longer challenge timeout period to accommodate the fulfillment request process. As part of this operation, Okta generates elliptic curve (EC) key-pairs used to encrypt the factor PIN and enrollment data sent by the fulfillment provider. operationId: enrollPreregistrationEnrollment x-codegen-request-body-name: body requestBody: @@ -82,14 +66,6 @@ paths: responses: '200': description: Success - content: - application/json: - schema: - $ref: '#/components/schemas/EnrollmentInitializationResponse' - examples: - Initialize Preregistration Enrollment Response: - $ref: >- - #/components/examples/EnrollmentInitializationResponseExample '400': description: PIN or cred requests generation failed content: @@ -98,8 +74,7 @@ paths: $ref: '#/components/schemas/Error' examples: NoDisable: - $ref: >- - #/components/examples/ErrorPinOrCredRequestsGenerationFailure + $ref: '#/components/examples/ErrorPinOrCredRequestsGenerationFailure' '403': $ref: '#/components/responses/ErrorAccessDenied403' '404': @@ -120,11 +95,7 @@ paths: /webauthn-registration/api/v1/initiate-fulfillment-request: post: summary: Generate a fulfillment request - description: >- - Generates a fulfillment request by sending a WebAuthn preregistration - event to start the flow. The WebAuthn preregistration integration for - Okta Workflows uses a preregistration event to populate the fulfillment - request. + description: Generates a fulfillment request by sending a WebAuthn preregistration event to start the flow. The WebAuthn preregistration integration for Okta Workflows uses a preregistration event to populate the fulfillment request. operationId: generateFulfillmentRequest x-codegen-request-body-name: body requestBody: @@ -159,10 +130,7 @@ paths: /webauthn-registration/api/v1/send-pin: post: summary: Send a PIN to user - description: >- - Sends the decoded PIN for the specified WebAuthn preregistration - enrollment. PINs are sent to the user's email. To resend the PIN, call - this operation again. + description: Sends the decoded PIN for the specified WebAuthn preregistration enrollment. PINs are sent to the user's email. To resend the PIN, call this operation again. operationId: sendPin x-codegen-request-body-name: body requestBody: @@ -205,9 +173,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/WebAuthnPreregistrationFactor' + $ref: '#/components/schemas/ListWebAuthnPreregistrationFactorsResponse' example: - id: fwf23789dfs9asdf782 factorType: webauthn @@ -218,14 +184,12 @@ paths: created: '2018-05-24T20:43:19.000Z' lastUpdated: '2018-05-24T21:43:32.000Z' profile: - credentialId: >- - l3Br0n-7H3g047NqESqJynFtIgf3Ix9OfaRoNwLoloso99Xl2zS_O7EXUkmPeAIzTVtEL4dYjicJWBz7NpqhGA + credentialId: l3Br0n-7H3g047NqESqJynFtIgf3Ix9OfaRoNwLoloso99Xl2zS_O7EXUkmPeAIzTVtEL4dYjicJWBz7NpqhGA authenticatorName: YubiKey 5C presetPinAvailable: true _links: self: - href: >- - https://example.okta.com/webauthn-registration/api/v1/users/00u15s1KDETTQMQYABRL/enrollments/fwf23789dfs9asdf782 + href: https://example.okta.com/webauthn-registration/api/v1/users/00u15s1KDETTQMQYABRL/enrollments/fwf23789dfs9asdf782 hints: allow: - DELETE @@ -246,8 +210,8 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathUserId' + parameters: + - $ref: '#/components/parameters/pathUserId' /webauthn-registration/api/v1/users/{userId}/enrollments/{authenticatorEnrollmentId}: delete: summary: Delete a WebAuthn preregistration factor @@ -273,16 +237,13 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathUserId' - - $ref: '#/components/parameters/authenticatorEnrollmentId' + parameters: + - $ref: '#/components/parameters/pathUserId' + - $ref: '#/components/parameters/authenticatorEnrollmentId' /webauthn-registration/api/v1/users/{userId}/enrollments/{authenticatorEnrollmentId}/mark-error: post: summary: Assign the fulfillment error status to a WebAuthn preregistration factor - description: >- - Assigns the fulfillment error status to a WebAuthn preregistration - factor for a user. The `/mark-error` path indicates that the specific - `FULFILLMENT_ERRORED` AuthFactor status is set on the enrollment. + description: Assigns the fulfillment error status to a WebAuthn preregistration factor for a user. The `/mark-error` path indicates that the specific `FULFILLMENT_ERRORED` AuthFactor status is set on the enrollment. operationId: assignFulfillmentErrorWebAuthnPreregistrationFactor responses: '204': @@ -304,9 +265,9 @@ paths: isGenerallyAvailable: false SKUs: - Okta Identity Engine - parameters: - - $ref: '#/components/parameters/pathUserId' - - $ref: '#/components/parameters/authenticatorEnrollmentId' + parameters: + - $ref: '#/components/parameters/pathUserId' + - $ref: '#/components/parameters/authenticatorEnrollmentId' components: schemas: EnrollmentActivationRequest: @@ -319,9 +280,7 @@ components: items: $ref: '#/components/schemas/WebAuthnCredResponse' fulfillmentProvider: - description: >- - Name of the fulfillment provider for the WebAuthn preregistration - factor + description: Name of the fulfillment provider for the WebAuthn preregistration factor type: string enum: - yubico @@ -338,10 +297,7 @@ components: description: Firmware version of the YubiKey type: string yubicoSigningJwks: - description: >- - List of usable signing keys from Yubico (in JSON Web Key Sets (JWKS) - format). The signing keys are used to verify the JSON Web Signature - (JWS) inside the JWE. + description: List of usable signing keys from Yubico (in JSON Web Key Sets (JWKS) format). The signing keys are used to verify the JSON Web Signature (JWS) inside the JWE. type: array items: $ref: '#/components/schemas/ECKeyJWK' @@ -355,9 +311,7 @@ components: items: type: string fulfillmentProvider: - description: >- - Name of the fulfillment provider for the WebAuthn preregistration - factor + description: Name of the fulfillment provider for the WebAuthn preregistration factor type: string enum: - yubico @@ -377,18 +331,13 @@ components: description: An Okta code for this type of error errorId: type: string - description: >- - A unique identifier for this error. This can be used by Okta Support - to help with troubleshooting. + description: A unique identifier for this error. This can be used by Okta Support to help with troubleshooting. errorLink: type: string description: An Okta code for this type of error errorSummary: type: string - description: >- - A short description of what caused this error. Sometimes this - contains dynamically-generated information about your specific - error. + description: A short description of what caused this error. Sometimes this contains dynamically-generated information about your specific error. EnrollmentInitializationRequest: description: Enrollment initialization request type: object @@ -399,9 +348,7 @@ components: items: type: string fulfillmentProvider: - description: >- - Name of the fulfillment provider for the WebAuthn preregistration - factor + description: Name of the fulfillment provider for the WebAuthn preregistration factor type: string enum: - yubico @@ -409,15 +356,10 @@ components: description: ID of an existing Okta user type: string yubicoTransportKeyJWK: - description: >- - Transport public key in JWK (JSON Web Key) format used to encrypt - fulfillment requests to Yubico + description: Transport public key in JWK (JSON Web Key) format used to encrypt fulfillment requests to Yubico $ref: '#/components/schemas/ECKeyJWK' EnrollmentInitializationResponse: - description: >- - Yubico transport key in the form of a JSON Web Token (JWK), used to - encrypt our fulfillment request to Yubico. The currently agreed protocol - uses P-384. + description: Yubico transport key in the form of a JSON Web Token (JWK), used to encrypt our fulfillment request to Yubico. The currently agreed protocol uses P-384. type: object properties: credRequests: @@ -426,9 +368,7 @@ components: items: $ref: '#/components/schemas/WebAuthnCredRequest' fulfillmentProvider: - description: >- - Name of the fulfillment provider for the WebAuthn preregistration - factor + description: Name of the fulfillment provider for the WebAuthn preregistration factor type: string enum: - yubico @@ -445,9 +385,7 @@ components: fulfillmentData: $ref: '#/components/schemas/FulfillmentData' fulfillmentProvider: - description: >- - Name of the fulfillment provider for the WebAuthn preregistration - factor + description: Name of the fulfillment provider for the WebAuthn preregistration factor type: string enum: - yubico @@ -462,9 +400,7 @@ components: description: ID for a WebAuthn preregistration factor in Okta type: string fulfillmentProvider: - description: >- - Name of the fulfillment provider for the WebAuthn preregistration - factor + description: Name of the fulfillment provider for the WebAuthn preregistration factor type: string enum: - yubico @@ -473,6 +409,7 @@ components: type: string WebAuthnPreregistrationFactor: description: User factor variant used for WebAuthn preregistration factors + x-okta-ignore-redocly-rules-for-sdk: true type: object properties: created: @@ -492,8 +429,8 @@ components: format: date-time readOnly: true profile: - type: object - description: Specific attributes related to the factor + type: string + description: Specific attributes related to the factor (opaque JSON object) provider: $ref: '#/components/schemas/UserFactorProvider' status: @@ -506,25 +443,17 @@ components: _links: $ref: '#/components/schemas/LinksSelf' WebAuthnCredResponse: - description: >- - Credential response object for enrolled credential details, along with - enrollment and key identifiers to associate the credential + description: Credential response object for enrolled credential details, along with enrollment and key identifiers to associate the credential type: object properties: authenticatorEnrollmentId: description: ID for a WebAuthn preregistration factor in Okta type: string credResponseJwe: - description: >- - Encrypted JSON Web Encryption (JWE) of the credential response from - the fulfillment provider + description: Encrypted JSON Web Encryption (JWE) of the credential response from the fulfillment provider type: string ECKeyJWK: - description: >- - Elliptic curve key in JSON Web Key (JWK) format. It's used during - enrollment to encrypt fulfillment requests to Yubico, or during - activation to verify Yubico's JWS (JSON Web Signature) objects in - fulfillment responses. The currently agreed protocol uses P-384. + description: Elliptic curve key in JSON Web Key (JWK) format. It's used during enrollment to encrypt fulfillment requests to Yubico, or during activation to verify Yubico's JWS (JSON Web Signature) objects in fulfillment responses. The currently agreed protocol uses P-384. type: object properties: crv: @@ -542,12 +471,7 @@ components: description: The type of public key use: type: string - description: >- - The intended use for the key. This value is either `enc` - (encryption) during enrollment, when Okta uses the ECKeyJWK to - encrypt requests to Yubico. Or it's `sig` (signature) during - activation, when Okta uses the ECKeyJWK to verify the responses from - Yubico. + description: The intended use for the key. This value is either `enc` (encryption) during enrollment, when Okta uses the ECKeyJWK to encrypt requests to Yubico. Or it's `sig` (signature) during activation, when Okta uses the ECKeyJWK to verify the responses from Yubico. enum: - enc - sig @@ -570,9 +494,7 @@ components: errorSummary: type: string WebAuthnCredRequest: - description: >- - Credential request object for the initialized credential, along with the - enrollment and key identifiers to associate with the credential + description: Credential request object for the initialized credential, along with the enrollment and key identifiers to associate with the credential type: object properties: authenticatorEnrollmentId: @@ -582,9 +504,7 @@ components: description: Encrypted JWE of credential request for the fulfillment provider type: string keyId: - description: >- - ID for the Okta response key-pair used to encrypt and decrypt - credential requests and responses + description: ID for the Okta response key-pair used to encrypt and decrypt credential requests and responses type: string FulfillmentData: description: List of fulfillment order details @@ -633,23 +553,14 @@ components: - PENDING_ACTIVATION readOnly: true LinksSelf: - description: >- - Specifies link relations (see [Web - Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the - [JSON Hypertext Application - Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) - specification. This object is used for dynamic discovery of related - resources and lifecycle operations. + description: Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification. This object is used for dynamic discovery of related resources and lifecycle operations. type: object properties: self: $ref: '#/components/schemas/HrefObjectSelfLink' readOnly: true FulfillmentDataOrderDetails: - description: >- - Information about the fulfillment order that includes the factor’s make - and model, the custom configuration of the factor, and inventory - details. + description: Information about the fulfillment order that includes the factor’s make and model, the custom configuration of the factor, and inventory details. type: object properties: customizationId: @@ -662,10 +573,34 @@ components: description: ID for the make and model of the requested factor type: string HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: Indicates whether the link object's `href` property is a URI template. + readOnly: true + type: + type: string + description: The media type of the link. If omitted, it is implicitly `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object additionalProperties: true type: object @@ -682,15 +617,11 @@ components: readOnly: true templated: type: boolean - description: >- - Indicates whether the link object's `href` property is a URI - template. + description: Indicates whether the link object's `href` property is a URI template. readOnly: true type: type: string - description: >- - The media type of the link. If omitted, it is implicitly - `application/json`. + description: The media type of the link. If omitted, it is implicitly `application/json`. readOnly: true required: - href @@ -709,6 +640,13 @@ components: - GET - POST - PUT + ListWebAuthnPreregistrationFactorsResponse: + type: object + properties: + web_authn_preregistration_factors: + type: array + items: + $ref: '#/components/schemas/WebAuthnPreregistrationFactor' responses: ErrorAccessDenied403: description: Forbidden @@ -816,9 +754,7 @@ components: summary: PIN or cred requests generation failed value: errorCode: E0000001 - errorSummary: >- - Api validation failed: - webAuthnPreregistrationPinRequest|webAuthnPreregistrationCredentialRequest + errorSummary: 'Api validation failed: webAuthnPreregistrationPinRequest|webAuthnPreregistrationCredentialRequest' errorLink: E0000001 errorId: oaehk3rssXQmOWDRsaFfxe8A errorCauses: @@ -869,67 +805,90 @@ components: title: Enrollments methods: activate_preregistration_enrollment: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1webauthn-registration~1api~1v1~1activate/post' response: mediaType: application/json openAPIDocKey: '200' enroll_preregistration_enrollment: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1webauthn-registration~1api~1v1~1enroll/post' response: mediaType: application/json openAPIDocKey: '200' generate_fulfillment_request: + config: + requestBodyTranslate: + algorithm: naive operation: - $ref: >- - #/paths/~1webauthn-registration~1api~1v1~1initiate-fulfillment-request/post + $ref: '#/paths/~1webauthn-registration~1api~1v1~1initiate-fulfillment-request/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' send_pin: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1webauthn-registration~1api~1v1~1send-pin/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' list_web_authn_preregistration_factors: operation: - $ref: >- - #/paths/~1webauthn-registration~1api~1v1~1users~1{userId}~1enrollments/get + $ref: '#/paths/~1webauthn-registration~1api~1v1~1users~1{userId}~1enrollments/get' response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.web_authn_preregistration_factors + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListWebAuthnPreregistrationFactorsResponse' + transform: + body: |- + {{- $wrapped := printf "{\"web_authn_preregistration_factors\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 delete_web_authn_preregistration_factor: operation: - $ref: >- - #/paths/~1webauthn-registration~1api~1v1~1users~1{userId}~1enrollments~1{authenticatorEnrollmentId}/delete + $ref: '#/paths/~1webauthn-registration~1api~1v1~1users~1{userId}~1enrollments~1{authenticatorEnrollmentId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' assign_fulfillment_error_web_authn_preregistration_factor: operation: - $ref: >- - #/paths/~1webauthn-registration~1api~1v1~1users~1{userId}~1enrollments~1{authenticatorEnrollmentId}~1mark-error/post + $ref: '#/paths/~1webauthn-registration~1api~1v1~1users~1{userId}~1enrollments~1{authenticatorEnrollmentId}~1mark-error/post' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/enrollments/methods/list_web_authn_preregistration_factors + - $ref: '#/components/x-stackQL-resources/enrollments/methods/list_web_authn_preregistration_factors' insert: [] update: [] delete: - - $ref: >- - #/components/x-stackQL-resources/enrollments/methods/delete_web_authn_preregistration_factor + - $ref: '#/components/x-stackQL-resources/enrollments/methods/delete_web_authn_preregistration_factor' replace: [] servers: - url: https://{subdomain}.okta.com/ variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200 diff --git a/providers/src/okta/v00.00.00000/services/zones.yaml b/providers/src/okta/v00.00.00000/services/zones.yaml index b7859808..0b9d834a 100644 --- a/providers/src/okta/v00.00.00000/services/zones.yaml +++ b/providers/src/okta/v00.00.00000/services/zones.yaml @@ -2,7 +2,7 @@ openapi: 3.0.3 info: title: zones API description: okta zones API - version: 5.1.0 + version: 2026.07.2 paths: /api/v1/zones: get: @@ -48,9 +48,7 @@ paths: content: application/json: schema: - type: array - items: - $ref: '#/components/schemas/NetworkZone' + $ref: '#/components/schemas/ListNetworkZonesResponse' examples: RetrieveAllZonesWithFilter: $ref: '#/components/examples/RetrieveAllZonesWithFilter' @@ -82,6 +80,9 @@ paths: * For an Enhanced Dynamic Network Zone, you must define at least one of the following: `asns`, `locations`, or `ipServiceCategories`. + + > **Note:** To view all properties for an Enhanced Dynamic Network Zone, + select `DYNAMIC_V2` from the `type` dropdown list. operationId: createNetworkZone x-codegen-request-body-name: zone requestBody: @@ -161,6 +162,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathZoneId' put: summary: Replace a network zone description: >- @@ -230,6 +233,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true + parameters: + - $ref: '#/components/parameters/pathZoneId' delete: summary: Delete a network zone description: >- @@ -238,9 +243,9 @@ paths: > **Notes:** > * You can't delete a Network Zone that's used by a - [Policy](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/Policy/) + [Policy](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/policy/) or - [Rule](https://developer.okta.com/docs/apihttps://developer.okta.com/docs/api/openapi/okta-management/management/tag/Policy/#tag/Policy/operation/listPolicyRules). + [Rule](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/policy/#tag/Policy/operation/listPolicyRules). > * For Okta Identity Engine orgs, you can't delete a Network Zone with an ACTIVE `status`. @@ -264,8 +269,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathZoneId' + parameters: + - $ref: '#/components/parameters/pathZoneId' /api/v1/zones/{zoneId}/lifecycle/activate: post: summary: Activate a network zone @@ -296,8 +301,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathZoneId' + parameters: + - $ref: '#/components/parameters/pathZoneId' /api/v1/zones/{zoneId}/lifecycle/deactivate: post: summary: Deactivate a network zone @@ -328,8 +333,8 @@ paths: x-okta-lifecycle: lifecycle: GA isGenerallyAvailable: true - parameters: - - $ref: '#/components/parameters/pathZoneId' + parameters: + - $ref: '#/components/parameters/pathZoneId' components: schemas: NetworkZone: @@ -414,14 +419,22 @@ components: - BLOCKLIST - POLICY LinksSelfAndLifecycle: - allOf: - - $ref: '#/components/schemas/LinksSelf' - - type: object - properties: - activate: - $ref: '#/components/schemas/HrefObjectActivateLink' - deactivate: - $ref: '#/components/schemas/HrefObjectDeactivateLink' + description: >- + Specifies link relations (see [Web + Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the + [JSON Hypertext Application + Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) + specification. This object is used for dynamic discovery of related + resources and lifecycle operations. + type: object + properties: + self: + $ref: '#/components/schemas/HrefObjectSelfLink' + activate: + $ref: '#/components/schemas/HrefObjectActivateLink' + deactivate: + $ref: '#/components/schemas/HrefObjectDeactivateLink' + readOnly: true Error: title: Error type: object @@ -461,23 +474,105 @@ components: $ref: '#/components/schemas/HrefObjectSelfLink' readOnly: true HrefObjectActivateLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to activate the resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to activate the resource HrefObjectDeactivateLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to deactivate the resource + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to deactivate the resource ErrorCause: type: object properties: errorSummary: type: string HrefObjectSelfLink: - allOf: - - $ref: '#/components/schemas/HrefObject' - - description: Link to the resource (self) + x-okta-ignore-redocly-rules-for-sdk: true + title: Link Object + additionalProperties: true + type: object + properties: + hints: + $ref: '#/components/schemas/HrefHints' + readOnly: true + href: + type: string + description: Link URI + name: + type: string + description: Link name + readOnly: true + templated: + type: boolean + description: >- + Indicates whether the link object's `href` property is a URI + template. + readOnly: true + type: + type: string + description: >- + The media type of the link. If omitted, it is implicitly + `application/json`. + readOnly: true + required: + - href + description: Link to the resource (self) HrefObject: + x-okta-ignore-redocly-rules-for-sdk: true title: Link Object additionalProperties: true type: object @@ -521,6 +616,13 @@ components: - GET - POST - PUT + ListNetworkZonesResponse: + type: object + properties: + network_zones: + type: array + items: + $ref: '#/components/schemas/NetworkZone' responses: ErrorAccessDenied403: description: Forbidden @@ -1235,7 +1337,19 @@ components: response: mediaType: application/json openAPIDocKey: '200' + objectKey: $.network_zones + overrideMediaType: application/json + schema_override: + $ref: '#/components/schemas/ListNetworkZonesResponse' + transform: + body: |- + {{- $wrapped := printf "{\"network_zones\":%s}" . -}} + {{- $wrapped -}} + type: golang_template_text_v0.3.0 create_network_zone: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1zones/post' response: @@ -1248,6 +1362,9 @@ components: mediaType: application/json openAPIDocKey: '200' replace_network_zone: + config: + requestBodyTranslate: + algorithm: naive operation: $ref: '#/paths/~1api~1v1~1zones~1{zoneId}/put' response: @@ -1257,7 +1374,7 @@ components: operation: $ref: '#/paths/~1api~1v1~1zones~1{zoneId}/delete' response: - mediaType: '' + mediaType: application/json openAPIDocKey: '204' activate_network_zone: operation: @@ -1273,10 +1390,10 @@ components: openAPIDocKey: '200' sqlVerbs: select: - - $ref: >- - #/components/x-stackQL-resources/network_zones/methods/list_network_zones - $ref: >- #/components/x-stackQL-resources/network_zones/methods/get_network_zone + - $ref: >- + #/components/x-stackQL-resources/network_zones/methods/list_network_zones insert: - $ref: >- #/components/x-stackQL-resources/network_zones/methods/create_network_zone @@ -1292,7 +1409,15 @@ servers: variables: subdomain: default: my-org - description: >- - The domain of your organization. This can be a provided subdomain of - an official okta domain (okta.com, oktapreview.com, etc) or one of - your configured custom domains. +x-stackQL-config: + pagination: + requestToken: + key: '' + location: request + responseToken: + key: Link + location: header + queryParamPushdown: + top: + paramName: limit + maxValue: 200