Okta Admin Management API

What authentication does the Okta Admin Management API use?

The Okta Admin Management API supports two authentication methods: an SSWS API token passed in the Authorization header as 'SSWS {token}', or OAuth 2.0 access tokens using the authorization code flow with granular scopes like okta.users.manage. Through Jentic, credentials are stored in your Jentic One instance and agents receive properly formatted Authorization headers without handling raw tokens.

Can I provision users and assign applications with the Okta Admin Management API?

Yes. POST /api/v1/users creates a user with profile attributes (firstName, lastName, email, login) and optional credentials. Then PUT /api/v1/apps/{appId}/users/{userId} assigns that user to an application with an optional credentials object and profile mapping. Through Jentic, search for 'create okta user' to load the full schema and execute.

What are the rate limits for the Okta Admin Management API?

Okta enforces per-endpoint rate limits. The /api/v1/users endpoint allows 600 requests per minute for list operations and 100 per minute for create/update. /api/v1/logs allows 120 requests per minute. Rate limit headers (X-Rate-Limit-Limit, X-Rate-Limit-Remaining, X-Rate-Limit-Reset) are included in every response. Exceeding limits returns HTTP 429.

How do I query security events through the Okta Admin Management API via Jentic?

Search Jentic for 'query okta system log' to find the GET /api/v1/logs operation. The schema accepts filter parameters using Okta Expression Language (e.g., eventType eq 'user.session.start' and outcome.result eq 'FAILURE'), plus since and until timestamps. Results include actor, target, client, and geographic context for each event.

Can I configure custom authorization servers with the Okta Admin Management API?

Yes. POST /api/v1/authorizationServers creates a custom server with name, audiences, and description. Add scopes via POST /api/v1/authorizationServers/{authServerId}/scopes, define claims via the /claims endpoint, and set access policies via /policies. Each server issues tokens independently with its own signing keys and token lifetimes.

Does the Okta Admin Management API support group-based application assignment?

Yes. PUT /api/v1/apps/{appId}/groups/{groupId} assigns all members of a group to an application in a single call. Group rules at POST /api/v1/groups/rules can automatically add users to groups based on profile attributes, enabling dynamic application access based on department, location, or role.

Can I limit what my agent is allowed to do with the Okta Admin Management API?

Yes. Because you run Jentic One yourself, your own rules decide which of the 700-plus Okta operations and which stored credential the agent may use. Okta puts resource ids in the URL path, such as /api/v1/apps/{appId}/users/{userId}, so you can pin the agent to one application's user assignments or restrict it to read-only calls like listing users (GET /api/v1/users) or querying the system log (GET /api/v1/logs). Write operations such as creating a user (POST /api/v1/users) or an authentication policy (POST /api/v1/policies) are available to the agent only if you add them to its allowed set.