Okta

Manage the people in your Okta org: create and update users, run them through the joiner-mover-leaver lifecycle, organise them into groups, and read the System Log.

Actions

Action	What it does
Activate user	Activate a staged or deactivated user.
Add user to group	Add a user to an Okta group.
Create group	Create an Okta group.
Create user	Create a user in your Okta org.
Deactivate user	Deactivate a user, removing their access to every assigned app.
Delete group	Delete an Okta group.
Delete user	Permanently delete a user.
Get group	Fetch one Okta group's name, description and type.
Get user	Fetch one Okta user's full profile, status and credential metadata.
List a user's groups	List every group a given user is a member of.
List group members	List the users who belong to a given Okta group.
List groups	List groups in your Okta org, optionally narrowed by type or by a search across name and description.
List System Log events	Read your org's audit trail: sign-ins, lifecycle changes, admin actions.
List users	List users in your Okta org, optionally narrowed by status or by a search across name, email and login.
Remove user from group	Remove a user from an Okta group.
Revoke user sessions	Sign a user out of Okta everywhere, forcing them to authenticate again.
Suspend user	Suspend an active user.
Unsuspend user	Return a suspended user to active so they can sign in again.
Update group	Replace an Okta group's name and description.
Update user	Update a user's profile.

Activate user

Activate a staged or deactivated user. With the email off, Okta returns the activation link instead of sending it.

Inputs

Useruser_idtextRequired: The Okta user id (00u...), the user's login, or the Admin Console URL of their profile.
Send activation emailsend_emailtrue/false: Turn on to have Okta email the user. Off returns the activation link to this workflow instead.Default: false.

Outputs

activation_tokentext: The one-time token behind that link, for building your own activation URL.
activation_urltext: The link the user follows to finish activating, returned only when the email was not sent.
asynchronoustrue/false: True when Okta completes this operation in the background, so the user's own status may still say otherwise for a moment.
email_senttrue/false: Whether Okta emailed the user.
operationtext: Always 'activate'.
statustext: The status this operation moves the user to. Read the user again if you need to confirm the transition has landed.
user_idtext: The user that was changed.

Example output

{
  "activation_token": "xEXAMPLEtoken",
  "activation_url": "https://integrator-1234567.okta.com/welcome/xEXAMPLE",
  "asynchronous": true,
  "email_sent": false,
  "operation": "activate",
  "status": "ACTIVE",
  "user_id": "00u1abcdEFGHijklM2n3"
}

Add user to group

Add a user to an Okta group. Safe to re-run, because Okta accepts it whether or not they were already a member.

Inputs

Useruser_idtextRequired: The Okta user id (00u...), the user's login, or the Admin Console URL of their profile.
Groupgroup_idtextRequired: The Okta group id (00g...) or the Admin Console URL of the group.

Outputs

group_idtext: The group they were added to.
membertrue/false: True once the user is in the group.
user_idtext: The user added.

Example output

{
  "group_id": "00g4opqrSTUVwxyzA5b6",
  "member": true,
  "user_id": "00u1abcdEFGHijklM2n3"
}

Create group

Create an Okta group. Groups made this way are Okta groups, the only kind whose membership an API can change.

Inputs

NamenametextRequired: The group's name, which must be unique in the org.
Descriptiondescriptiontext: What the group is for.

Outputs

groupobject: The group Okta created. Use 'id' to add members to it.

Example output

{
  "group": {
    "created": "2026-02-11T11:30:00.000Z",
    "id": "00g4opqrSTUVwxyzA5b6",
    "lastMembershipUpdated": "2026-08-30T16:20:44.000Z",
    "lastUpdated": "2026-02-11T11:30:00.000Z",
    "objectClass": [
      "okta:user_group"
    ],
    "profile": {
      "description": "Everyone on the customer support rota",
      "name": "Support Engineers"
    },
    "type": "OKTA_GROUP"
  }
}

Create user

Create a user in your Okta org. Left unactivated they are staged and cannot sign in; activated without a password Okta emails them an activation link.

Inputs

EmailemailtextRequired: The user's primary email address.
First namefirst_nametextRequired: The user's given name.
Last namelast_nametextRequired: The user's family name.
Loginlogintext: The username they sign in with. Defaults to the email address, which is what most orgs require.
Passwordpasswordtext: An initial password, validated against your org's password policy. Leave blank to have Okta send an activation link instead.
Mobile phonemobile_phonetext: The user's mobile number.
Job titletitletext: The user's job title.
Departmentdepartmenttext: The department the user belongs to.
Add to groupsgroup_idslist: Group ids to add the user to as they are created, up to 20.
Activate nowactivatetrue/false: Turn on to activate the user immediately. Off leaves them staged, and nothing is emailed.Default: false.

Outputs

userobject: The user Okta created. Use 'id' for every later step: a login can change, an id cannot.

Example output

{
  "user": {
    "activated": "2026-01-04T09:12:35.000Z",
    "created": "2026-01-04T09:12:33.000Z",
    "id": "00u1abcdEFGHijklM2n3",
    "lastLogin": "2026-09-01T07:45:10.000Z",
    "lastUpdated": "2026-08-28T14:02:51.000Z",
    "profile": {
      "department": "Customer Success",
      "email": "avery.chen@example.com",
      "firstName": "Avery",
      "lastName": "Chen",
      "login": "avery.chen@example.com",
      "mobilePhone": "+15555550123",
      "title": "Support Engineer"
    },
    "status": "STAGED"
  }
}

Deactivate user

Deactivate a user, removing their access to every assigned app. This is the offboarding step, and it cannot be undone except by reactivating them.

Inputs

Useruser_idtextRequired: The Okta user id (00u...), the user's login, or the Admin Console URL of their profile.
Notify admins by emailsend_emailtrue/false: Turn on to have Okta email your admins.Default: false.

Outputs

asynchronoustrue/false: True when Okta completes this operation in the background, so the user's own status may still say otherwise for a moment.
email_senttrue/false: Whether Okta emailed your admins.
operationtext: Always 'deactivate'.
statustext: The status this operation moves the user to. Read the user again if you need to confirm the transition has landed.
user_idtext: The user that was changed.

Example output

{
  "asynchronous": true,
  "email_sent": false,
  "operation": "deactivate",
  "status": "DEPROVISIONED",
  "user_id": "00u1abcdEFGHijklM2n3"
}

Delete group

Delete an Okta group. Its members keep their accounts; only the group and its assignments go.

Inputs

Groupgroup_idtextRequired: The Okta group id (00g...) or the Admin Console URL of the group.

Outputs

deletedtrue/false: Always true; a failure raises instead.
group_idtext: The group that was deleted.

Example output

{
  "deleted": true,
  "group_id": "00g4opqrSTUVwxyzA5b6"
}

Delete user

Permanently delete a user. Okta only deletes a deactivated user, so an active one is deactivated first, which cannot be recovered.

Inputs

Useruser_idtextRequired: The Okta user id (00u...), the user's login, or the Admin Console URL of their profile.

Outputs

deactivated_firsttrue/false: True when the user still had to be deactivated, which takes a second delete call.
deletedtrue/false: Always true; a failure raises instead.
previous_statustext: The status the user held before deletion.
user_idtext: The user that was deleted.

Example output

{
  "deactivated_first": false,
  "deleted": true,
  "previous_status": "DEPROVISIONED",
  "user_id": "00u1abcdEFGHijklM2n3"
}

Get group

Fetch one Okta group's name, description and type.

Inputs

Groupgroup_idtextRequired: The Okta group id (00g...) or the Admin Console URL of the group.

Outputs

groupobject: The group as Okta returned it. Read it before updating: an update replaces the whole profile.

Example output

{
  "group": {
    "created": "2026-02-11T11:30:00.000Z",
    "id": "00g4opqrSTUVwxyzA5b6",
    "lastMembershipUpdated": "2026-08-30T16:20:44.000Z",
    "lastUpdated": "2026-02-11T11:30:00.000Z",
    "objectClass": [
      "okta:user_group"
    ],
    "profile": {
      "description": "Everyone on the customer support rota",
      "name": "Support Engineers"
    },
    "type": "OKTA_GROUP"
  }
}

Get user

Fetch one Okta user's full profile, status and credential metadata.

Inputs

Useruser_idtextRequired: The Okta user id (00u...), the user's login, or the Admin Console URL of their profile.

Outputs

userobject: The user as Okta returned them. Branch on 'status' before any lifecycle change: Okta refuses a suspend on anyone who is not ACTIVE.

Example output

{
  "user": {
    "activated": "2026-01-04T09:12:35.000Z",
    "created": "2026-01-04T09:12:33.000Z",
    "id": "00u1abcdEFGHijklM2n3",
    "lastLogin": "2026-09-01T07:45:10.000Z",
    "lastUpdated": "2026-08-28T14:02:51.000Z",
    "profile": {
      "department": "Customer Success",
      "email": "avery.chen@example.com",
      "firstName": "Avery",
      "lastName": "Chen",
      "login": "avery.chen@example.com",
      "mobilePhone": "+15555550123",
      "title": "Support Engineer"
    },
    "status": "ACTIVE"
  }
}

List a user's groups

List every group a given user is a member of.

Inputs

Useruser_idtextRequired: The Okta user id (00u...), the user's login, or the Admin Console URL of their profile.

Outputs

countnumber: How many groups are on this page.
groupslist: The groups on this page, as Okta returned them.
has_moretrue/false: True when Okta has another page. Pass next_cursor as the next call's cursor to read it.
next_cursortext: The cursor for the next page, or empty on the last page.

Example output

{
  "count": 1,
  "groups": [
    {
      "created": "2026-02-11T11:30:00.000Z",
      "id": "00g4opqrSTUVwxyzA5b6",
      "lastMembershipUpdated": "2026-08-30T16:20:44.000Z",
      "lastUpdated": "2026-02-11T11:30:00.000Z",
      "objectClass": [
        "okta:user_group"
      ],
      "profile": {
        "description": "Everyone on the customer support rota",
        "name": "Support Engineers"
      },
      "type": "OKTA_GROUP"
    }
  ],
  "has_more": false,
  "next_cursor": null
}

List group members

List the users who belong to a given Okta group.

Inputs

Groupgroup_idtextRequired: The Okta group id (00g...) or the Admin Console URL of the group.
Page sizelimitnumber: How many members to return, 1-200.From 1 to 200. Default: 50.
Next page cursorcursortext: Leave blank for the first page. To read the next one, pass the next_cursor from the previous call.

Outputs

countnumber: How many members are on this page.
has_moretrue/false: True when Okta has another page. Pass next_cursor as the next call's cursor to read it.
memberslist: The members on this page, as Okta returned them.
next_cursortext: The cursor for the next page, or empty on the last page.

Example output

{
  "count": 1,
  "has_more": false,
  "members": [
    {
      "activated": "2026-01-04T09:12:35.000Z",
      "created": "2026-01-04T09:12:33.000Z",
      "id": "00u1abcdEFGHijklM2n3",
      "lastLogin": "2026-09-01T07:45:10.000Z",
      "lastUpdated": "2026-08-28T14:02:51.000Z",
      "profile": {
        "department": "Customer Success",
        "email": "avery.chen@example.com",
        "firstName": "Avery",
        "lastName": "Chen",
        "login": "avery.chen@example.com",
        "mobilePhone": "+15555550123",
        "title": "Support Engineer"
      },
      "status": "ACTIVE"
    }
  ],
  "next_cursor": null
}

List groups

List groups in your Okta org, optionally narrowed by type or by a search across name and description.

Inputs

Typegroup_typetext: Only return groups of this type.One of: OKTA_GROUP (Okta group (created and managed in Okta)), APP_GROUP (App group (imported from a connected app)), BUILT_IN (Built-in (Okta's own Everyone group)).
Searchquerytext: Text to look for in a group's name or description.
Page sizelimitnumber: How many groups to return, 1-200.From 1 to 200. Default: 50.
Next page cursorcursortext: Leave blank for the first page. To read the next one, pass the next_cursor from the previous call.

Outputs

countnumber: How many groups are on this page.
groupslist: The groups on this page, as Okta returned them.
has_moretrue/false: True when Okta has another page. Pass next_cursor as the next call's cursor to read it.
next_cursortext: The cursor for the next page, or empty on the last page.

Example output

{
  "count": 1,
  "groups": [
    {
      "created": "2026-02-11T11:30:00.000Z",
      "id": "00g4opqrSTUVwxyzA5b6",
      "lastMembershipUpdated": "2026-08-30T16:20:44.000Z",
      "lastUpdated": "2026-02-11T11:30:00.000Z",
      "objectClass": [
        "okta:user_group"
      ],
      "profile": {
        "description": "Everyone on the customer support rota",
        "name": "Support Engineers"
      },
      "type": "OKTA_GROUP"
    }
  ],
  "has_more": false,
  "next_cursor": null
}

List System Log events

Read your org's audit trail: sign-ins, lifecycle changes, admin actions. Okta keeps 90 days.

Inputs

Fromsincedate and time: The earliest event to return. Okta keeps 90 days, so anything older returns nothing.
Tountildate and time: The latest event to return.
Event typeevent_typetext: An exact Okta event type, for example user.session.start or user.lifecycle.suspend.
Keywordquerytext: A keyword to match anywhere in the event, for example a user's email or an IP address.
Page sizelimitnumber: How many events to return, 1-1000.From 1 to 1000. Default: 100.
Ordersort_ordertext: Whether to return newest or oldest events first.One of: DESCENDING (Newest first), ASCENDING (Oldest first).
Next page cursorcursortext: Leave blank for the first page. To read the next one, pass the next_cursor from the previous call.

Outputs

countnumber: How many events are on this page.
eventslist: The events on this page, as the System Log returned them.
has_moretrue/false: True when Okta has another page. Pass next_cursor as the next call's cursor to read it.
next_cursortext: The cursor for the next page, or empty on the last page.

Example output

{
  "count": 1,
  "events": [
    {
      "actor": {
        "alternateId": "avery.chen@example.com",
        "displayName": "Avery Chen",
        "id": "00u1abcdEFGHijklM2n3",
        "type": "User"
      },
      "client": {
        "geographicalContext": {
          "city": "Dublin",
          "country": "Ireland"
        },
        "ipAddress": "203.0.113.24",
        "userAgent": {
          "browser": "CHROME",
          "os": "Mac OS X"
        }
      },
      "displayMessage": "User login to Okta",
      "eventType": "user.session.start",
      "outcome": {
        "result": "SUCCESS"
      },
      "published": "2026-09-02T08:15:22.101Z",
      "severity": "INFO",
      "target": [],
      "uuid": "9f1c0f1e-2a3b-4c5d-8e9f-0a1b2c3d4e5f"
    }
  ],
  "has_more": false,
  "next_cursor": null
}

List users

List users in your Okta org, optionally narrowed by status or by a search across name, email and login.

Inputs

Statusstatustext: Only return users with this status.One of: ACTIVE, STAGED (Staged (created, not yet activated)), PROVISIONED (Provisioned (activated, pending first sign-in)), RECOVERY (Recovery (password reset in progress)), PASSWORD_EXPIRED (Password expired), LOCKED_OUT (Locked out), SUSPENDED, DEPROVISIONED (Deactivated).
Searchquerytext: Text to look for in a user's first name, last name, email or login.
Page sizelimitnumber: How many users to return, 1-200.From 1 to 200. Default: 50.
Next page cursorcursortext: Leave blank for the first page. To read the next one, pass the next_cursor from the previous call.

Outputs

countnumber: How many users are on this page.
has_moretrue/false: True when Okta has another page. Pass next_cursor as the next call's cursor to read it.
next_cursortext: The cursor for the next page, or empty on the last page.
userslist: The users on this page, as Okta returned them.

Example output

{
  "count": 1,
  "has_more": false,
  "next_cursor": null,
  "users": [
    {
      "activated": "2026-01-04T09:12:35.000Z",
      "created": "2026-01-04T09:12:33.000Z",
      "id": "00u1abcdEFGHijklM2n3",
      "lastLogin": "2026-09-01T07:45:10.000Z",
      "lastUpdated": "2026-08-28T14:02:51.000Z",
      "profile": {
        "department": "Customer Success",
        "email": "avery.chen@example.com",
        "firstName": "Avery",
        "lastName": "Chen",
        "login": "avery.chen@example.com",
        "mobilePhone": "+15555550123",
        "title": "Support Engineer"
      },
      "status": "ACTIVE"
    }
  ]
}

Remove user from group

Remove a user from an Okta group. Their account is untouched; they lose only what the group granted.

Inputs

Useruser_idtextRequired: The Okta user id (00u...), the user's login, or the Admin Console URL of their profile.
Groupgroup_idtextRequired: The Okta group id (00g...) or the Admin Console URL of the group.

Outputs

group_idtext: The group they were removed from.
membertrue/false: Always false once the removal succeeds.
user_idtext: The user removed.

Example output

{
  "group_id": "00g4opqrSTUVwxyzA5b6",
  "member": false,
  "user_id": "00u1abcdEFGHijklM2n3"
}

Revoke user sessions

Sign a user out of Okta everywhere, forcing them to authenticate again. The first move on a compromised account.

Inputs

Useruser_idtextRequired: The Okta user id (00u...), the user's login, or the Admin Console URL of their profile.
Also revoke app tokensrevoke_oauth_tokenstrue/false: Turn on to revoke the OpenID Connect and OAuth tokens apps hold for this user. Without it an app with a refresh token keeps its access.Default: false.
Forget remembered devicesforget_devicestrue/false: Turn on to clear the devices this user's factors are remembered on, so MFA is required again everywhere.Default: false.

Outputs

devices_forgottentrue/false: Whether remembered devices were cleared.
oauth_tokens_revokedtrue/false: Whether app tokens were revoked too.
operationtext: Always 'revoke_sessions'.
user_idtext: The user whose sessions were revoked.

Example output

{
  "devices_forgotten": false,
  "oauth_tokens_revoked": true,
  "operation": "revoke_sessions",
  "user_id": "00u1abcdEFGHijklM2n3"
}

Suspend user

Suspend an active user. They cannot sign in but keep every group and app assignment, so this is reversible.

Inputs

Useruser_idtextRequired: The Okta user id (00u...), the user's login, or the Admin Console URL of their profile.

Outputs

asynchronoustrue/false: True when Okta completes this operation in the background, so the user's own status may still say otherwise for a moment.
operationtext: Always 'suspend'.
statustext: The status this operation moves the user to. Read the user again if you need to confirm the transition has landed.
user_idtext: The user that was changed.

Example output

{
  "asynchronous": false,
  "operation": "suspend",
  "status": "SUSPENDED",
  "user_id": "00u1abcdEFGHijklM2n3"
}

Unsuspend user

Return a suspended user to active so they can sign in again.

Inputs

Useruser_idtextRequired: The Okta user id (00u...), the user's login, or the Admin Console URL of their profile.

Outputs

asynchronoustrue/false: True when Okta completes this operation in the background, so the user's own status may still say otherwise for a moment.
operationtext: Always 'unsuspend'.
statustext: The status this operation moves the user to. Read the user again if you need to confirm the transition has landed.
user_idtext: The user that was changed.

Example output

{
  "asynchronous": false,
  "operation": "unsuspend",
  "status": "ACTIVE",
  "user_id": "00u1abcdEFGHijklM2n3"
}

Update group

Replace an Okta group's name and description. Okta has no partial update for groups, so a description left blank is cleared; read the group first if you mean to keep it.

Inputs

Groupgroup_idtextRequired: The Okta group id (00g...) or the Admin Console URL of the group.
NamenametextRequired: The group's name. Required even when only the description is changing, because Okta replaces the whole profile.
Descriptiondescriptiontext: What the group is for. Left blank, the existing description is removed.

Outputs

groupobject: The group as Okta stored it after the replacement.

Example output

{
  "group": {
    "created": "2026-02-11T11:30:00.000Z",
    "id": "00g4opqrSTUVwxyzA5b6",
    "lastMembershipUpdated": "2026-08-30T16:20:44.000Z",
    "lastUpdated": "2026-02-11T11:30:00.000Z",
    "objectClass": [
      "okta:user_group"
    ],
    "profile": {
      "description": "Everyone on the customer support rota",
      "name": "Support Engineers"
    },
    "type": "OKTA_GROUP"
  }
}

Update user

Update a user's profile. Only the fields you fill in change; everything else is left as it is.

Inputs

Useruser_idtextRequired: The Okta user id (00u...), the user's login, or the Admin Console URL of their profile.
Emailemailtext: A new primary email address.
Loginlogintext: A new username to sign in with.
First namefirst_nametext: A new given name.
Last namelast_nametext: A new family name.
Mobile phonemobile_phonetext: A new mobile number.
Job titletitletext: A new job title.
Departmentdepartmenttext: A new department.

Outputs

userobject: The user as Okta stored them after the update.

Example output

{
  "user": {
    "activated": "2026-01-04T09:12:35.000Z",
    "created": "2026-01-04T09:12:33.000Z",
    "id": "00u1abcdEFGHijklM2n3",
    "lastLogin": "2026-09-01T07:45:10.000Z",
    "lastUpdated": "2026-08-28T14:02:51.000Z",
    "profile": {
      "department": "Customer Success",
      "email": "avery.chen@example.com",
      "firstName": "Avery",
      "lastName": "Chen",
      "login": "avery.chen@example.com",
      "mobilePhone": "+15555550123",
      "title": "Support Engineer"
    },
    "status": "ACTIVE"
  }
}

ActionsCopy Anchor Link

Activate userCopy Anchor Link

Inputs

Outputs

Add user to groupCopy Anchor Link

Inputs

Outputs

Create groupCopy Anchor Link

Inputs

Outputs

Create userCopy Anchor Link

Inputs

Outputs

Deactivate userCopy Anchor Link

Inputs

Outputs

Delete groupCopy Anchor Link

Inputs

Outputs

Delete userCopy Anchor Link

Inputs

Outputs

Get groupCopy Anchor Link

Inputs

Outputs

Get userCopy Anchor Link

Inputs

Outputs

List a user's groupsCopy Anchor Link

Inputs

Outputs

List group membersCopy Anchor Link

Inputs

Outputs

List groupsCopy Anchor Link

Inputs

Outputs

List System Log eventsCopy Anchor Link

Inputs

Outputs

List usersCopy Anchor Link

Inputs

Outputs

Remove user from groupCopy Anchor Link

Inputs

Outputs

Revoke user sessionsCopy Anchor Link

Inputs

Outputs

Suspend userCopy Anchor Link

Inputs

Outputs

Unsuspend userCopy Anchor Link

Inputs

Outputs

Update groupCopy Anchor Link

Inputs

Outputs

Update userCopy Anchor Link

Inputs

Outputs

On this page

Actions

Activate user

Add user to group

Create group

Create user

Deactivate user

Delete group

Delete user

Get group

Get user

List a user's groups

List group members

List groups

List System Log events

List users

Remove user from group

Revoke user sessions

Suspend user

Unsuspend user

Update group

Update user