# Okta

> Manage the people in your Okta org: create and update users, run them through the joiner-mover-leaver lifecycle, organise them into groups, and read the System Log.

App · Compliance & Security · 20 actions. Web page: https://docs.lodol.com/docs/integrations/okta

## Actions

### Activate user

Activate a staged or deactivated user. With the email off, Okta returns the activation link instead of sending it.

**Inputs**

- User (`user_id`, text, required): The Okta user id (00u...), the user's login, or the Admin Console URL of their profile.
- Send activation email (`send_email`, true/false): Turn on to have Okta email the user. Off returns the activation link to this workflow instead. Default: `false`.

**Outputs**

- `activation_token` (text): The one-time token behind that link, for building your own activation URL.
- `activation_url` (text): The link the user follows to finish activating, returned only when the email was not sent.
- `asynchronous` (true/false): True when Okta completes this operation in the background, so the user's own status may still say otherwise for a moment.
- `email_sent` (true/false): Whether Okta emailed the user.
- `operation` (text): Always 'activate'.
- `status` (text): The status this operation moves the user to. Read the user again if you need to confirm the transition has landed.
- `user_id` (text): The user that was changed.

**Example output**

```json
{
  "activation_token": "xEXAMPLEtoken",
  "activation_url": "https://integrator-1234567.okta.com/welcome/xEXAMPLE",
  "asynchronous": true,
  "email_sent": false,
  "operation": "activate",
  "status": "ACTIVE",
  "user_id": "00u1abcdEFGHijklM2n3"
}
```

### Add user to group

Add a user to an Okta group. Safe to re-run, because Okta accepts it whether or not they were already a member.

**Inputs**

- User (`user_id`, text, required): The Okta user id (00u...), the user's login, or the Admin Console URL of their profile.
- Group (`group_id`, text, required): The Okta group id (00g...) or the Admin Console URL of the group.

**Outputs**

- `group_id` (text): The group they were added to.
- `member` (true/false): True once the user is in the group.
- `user_id` (text): The user added.

**Example output**

```json
{
  "group_id": "00g4opqrSTUVwxyzA5b6",
  "member": true,
  "user_id": "00u1abcdEFGHijklM2n3"
}
```

### Create group

Create an Okta group. Groups made this way are Okta groups, the only kind whose membership an API can change.

**Inputs**

- Name (`name`, text, required): The group's name, which must be unique in the org.
- Description (`description`, text): What the group is for.

**Outputs**

- `group` (object): The group Okta created. Use 'id' to add members to it.

**Example output**

```json
{
  "group": {
    "created": "2026-02-11T11:30:00.000Z",
    "id": "00g4opqrSTUVwxyzA5b6",
    "lastMembershipUpdated": "2026-08-30T16:20:44.000Z",
    "lastUpdated": "2026-02-11T11:30:00.000Z",
    "objectClass": [
      "okta:user_group"
    ],
    "profile": {
      "description": "Everyone on the customer support rota",
      "name": "Support Engineers"
    },
    "type": "OKTA_GROUP"
  }
}
```

### Create user

Create a user in your Okta org. Left unactivated they are staged and cannot sign in; activated without a password Okta emails them an activation link.

**Inputs**

- Email (`email`, text, required): The user's primary email address.
- First name (`first_name`, text, required): The user's given name.
- Last name (`last_name`, text, required): The user's family name.
- Login (`login`, text): The username they sign in with. Defaults to the email address, which is what most orgs require.
- Password (`password`, text): An initial password, validated against your org's password policy. Leave blank to have Okta send an activation link instead.
- Mobile phone (`mobile_phone`, text): The user's mobile number.
- Job title (`title`, text): The user's job title.
- Department (`department`, text): The department the user belongs to.
- Add to groups (`group_ids`, list): Group ids to add the user to as they are created, up to 20.
- Activate now (`activate`, true/false): Turn on to activate the user immediately. Off leaves them staged, and nothing is emailed. Default: `false`.

**Outputs**

- `user` (object): The user Okta created. Use 'id' for every later step: a login can change, an id cannot.

**Example output**

```json
{
  "user": {
    "activated": "2026-01-04T09:12:35.000Z",
    "created": "2026-01-04T09:12:33.000Z",
    "id": "00u1abcdEFGHijklM2n3",
    "lastLogin": "2026-09-01T07:45:10.000Z",
    "lastUpdated": "2026-08-28T14:02:51.000Z",
    "profile": {
      "department": "Customer Success",
      "email": "avery.chen@example.com",
      "firstName": "Avery",
      "lastName": "Chen",
      "login": "avery.chen@example.com",
      "mobilePhone": "+15555550123",
      "title": "Support Engineer"
    },
    "status": "STAGED"
  }
}
```

### Deactivate user

Deactivate a user, removing their access to every assigned app. This is the offboarding step, and it cannot be undone except by reactivating them.

**Inputs**

- User (`user_id`, text, required): The Okta user id (00u...), the user's login, or the Admin Console URL of their profile.
- Notify admins by email (`send_email`, true/false): Turn on to have Okta email your admins. Default: `false`.

**Outputs**

- `asynchronous` (true/false): True when Okta completes this operation in the background, so the user's own status may still say otherwise for a moment.
- `email_sent` (true/false): Whether Okta emailed your admins.
- `operation` (text): Always 'deactivate'.
- `status` (text): The status this operation moves the user to. Read the user again if you need to confirm the transition has landed.
- `user_id` (text): The user that was changed.

**Example output**

```json
{
  "asynchronous": true,
  "email_sent": false,
  "operation": "deactivate",
  "status": "DEPROVISIONED",
  "user_id": "00u1abcdEFGHijklM2n3"
}
```

### Delete group

Delete an Okta group. Its members keep their accounts; only the group and its assignments go.

**Inputs**

- Group (`group_id`, text, required): The Okta group id (00g...) or the Admin Console URL of the group.

**Outputs**

- `deleted` (true/false): Always true; a failure raises instead.
- `group_id` (text): The group that was deleted.

**Example output**

```json
{
  "deleted": true,
  "group_id": "00g4opqrSTUVwxyzA5b6"
}
```

### Delete user

Permanently delete a user. Okta only deletes a deactivated user, so an active one is deactivated first, which cannot be recovered.

**Inputs**

- User (`user_id`, text, required): The Okta user id (00u...), the user's login, or the Admin Console URL of their profile.

**Outputs**

- `deactivated_first` (true/false): True when the user still had to be deactivated, which takes a second delete call.
- `deleted` (true/false): Always true; a failure raises instead.
- `previous_status` (text): The status the user held before deletion.
- `user_id` (text): The user that was deleted.

**Example output**

```json
{
  "deactivated_first": false,
  "deleted": true,
  "previous_status": "DEPROVISIONED",
  "user_id": "00u1abcdEFGHijklM2n3"
}
```

### Get group

Fetch one Okta group's name, description and type.

**Inputs**

- Group (`group_id`, text, required): The Okta group id (00g...) or the Admin Console URL of the group.

**Outputs**

- `group` (object): The group as Okta returned it. Read it before updating: an update replaces the whole profile.

**Example output**

```json
{
  "group": {
    "created": "2026-02-11T11:30:00.000Z",
    "id": "00g4opqrSTUVwxyzA5b6",
    "lastMembershipUpdated": "2026-08-30T16:20:44.000Z",
    "lastUpdated": "2026-02-11T11:30:00.000Z",
    "objectClass": [
      "okta:user_group"
    ],
    "profile": {
      "description": "Everyone on the customer support rota",
      "name": "Support Engineers"
    },
    "type": "OKTA_GROUP"
  }
}
```

### Get user

Fetch one Okta user's full profile, status and credential metadata.

**Inputs**

- User (`user_id`, text, required): The Okta user id (00u...), the user's login, or the Admin Console URL of their profile.

**Outputs**

- `user` (object): The user as Okta returned them. Branch on 'status' before any lifecycle change: Okta refuses a suspend on anyone who is not ACTIVE.

**Example output**

```json
{
  "user": {
    "activated": "2026-01-04T09:12:35.000Z",
    "created": "2026-01-04T09:12:33.000Z",
    "id": "00u1abcdEFGHijklM2n3",
    "lastLogin": "2026-09-01T07:45:10.000Z",
    "lastUpdated": "2026-08-28T14:02:51.000Z",
    "profile": {
      "department": "Customer Success",
      "email": "avery.chen@example.com",
      "firstName": "Avery",
      "lastName": "Chen",
      "login": "avery.chen@example.com",
      "mobilePhone": "+15555550123",
      "title": "Support Engineer"
    },
    "status": "ACTIVE"
  }
}
```

### List a user's groups

List every group a given user is a member of.

**Inputs**

- User (`user_id`, text, required): The Okta user id (00u...), the user's login, or the Admin Console URL of their profile.

**Outputs**

- `count` (number): How many groups are on this page.
- `groups` (list): The groups on this page, as Okta returned them.
- `has_more` (true/false): True when Okta has another page. Pass next_cursor as the next call's cursor to read it.
- `next_cursor` (text): The cursor for the next page, or empty on the last page.

**Example output**

```json
{
  "count": 1,
  "groups": [
    {
      "created": "2026-02-11T11:30:00.000Z",
      "id": "00g4opqrSTUVwxyzA5b6",
      "lastMembershipUpdated": "2026-08-30T16:20:44.000Z",
      "lastUpdated": "2026-02-11T11:30:00.000Z",
      "objectClass": [
        "okta:user_group"
      ],
      "profile": {
        "description": "Everyone on the customer support rota",
        "name": "Support Engineers"
      },
      "type": "OKTA_GROUP"
    }
  ],
  "has_more": false,
  "next_cursor": null
}
```

### List group members

List the users who belong to a given Okta group.

**Inputs**

- Group (`group_id`, text, required): The Okta group id (00g...) or the Admin Console URL of the group.
- Page size (`limit`, number): How many members to return, 1-200. From 1 to 200. Default: `50`.
- Next page cursor (`cursor`, text): Leave blank for the first page. To read the next one, pass the next_cursor from the previous call.

**Outputs**

- `count` (number): How many members are on this page.
- `has_more` (true/false): True when Okta has another page. Pass next_cursor as the next call's cursor to read it.
- `members` (list): The members on this page, as Okta returned them.
- `next_cursor` (text): The cursor for the next page, or empty on the last page.

**Example output**

```json
{
  "count": 1,
  "has_more": false,
  "members": [
    {
      "activated": "2026-01-04T09:12:35.000Z",
      "created": "2026-01-04T09:12:33.000Z",
      "id": "00u1abcdEFGHijklM2n3",
      "lastLogin": "2026-09-01T07:45:10.000Z",
      "lastUpdated": "2026-08-28T14:02:51.000Z",
      "profile": {
        "department": "Customer Success",
        "email": "avery.chen@example.com",
        "firstName": "Avery",
        "lastName": "Chen",
        "login": "avery.chen@example.com",
        "mobilePhone": "+15555550123",
        "title": "Support Engineer"
      },
      "status": "ACTIVE"
    }
  ],
  "next_cursor": null
}
```

### List groups

List groups in your Okta org, optionally narrowed by type or by a search across name and description.

**Inputs**

- Type (`group_type`, text): Only return groups of this type. One of: `OKTA_GROUP` (Okta group (created and managed in Okta)), `APP_GROUP` (App group (imported from a connected app)), `BUILT_IN` (Built-in (Okta's own Everyone group)).
- Search (`query`, text): Text to look for in a group's name or description.
- Page size (`limit`, number): How many groups to return, 1-200. From 1 to 200. Default: `50`.
- Next page cursor (`cursor`, text): Leave blank for the first page. To read the next one, pass the next_cursor from the previous call.

**Outputs**

- `count` (number): How many groups are on this page.
- `groups` (list): The groups on this page, as Okta returned them.
- `has_more` (true/false): True when Okta has another page. Pass next_cursor as the next call's cursor to read it.
- `next_cursor` (text): The cursor for the next page, or empty on the last page.

**Example output**

```json
{
  "count": 1,
  "groups": [
    {
      "created": "2026-02-11T11:30:00.000Z",
      "id": "00g4opqrSTUVwxyzA5b6",
      "lastMembershipUpdated": "2026-08-30T16:20:44.000Z",
      "lastUpdated": "2026-02-11T11:30:00.000Z",
      "objectClass": [
        "okta:user_group"
      ],
      "profile": {
        "description": "Everyone on the customer support rota",
        "name": "Support Engineers"
      },
      "type": "OKTA_GROUP"
    }
  ],
  "has_more": false,
  "next_cursor": null
}
```

### List System Log events

Read your org's audit trail: sign-ins, lifecycle changes, admin actions. Okta keeps 90 days.

**Inputs**

- From (`since`, date and time): The earliest event to return. Okta keeps 90 days, so anything older returns nothing.
- To (`until`, date and time): The latest event to return.
- Event type (`event_type`, text): An exact Okta event type, for example user.session.start or user.lifecycle.suspend.
- Keyword (`query`, text): A keyword to match anywhere in the event, for example a user's email or an IP address.
- Page size (`limit`, number): How many events to return, 1-1000. From 1 to 1000. Default: `100`.
- Order (`sort_order`, text): Whether to return newest or oldest events first. One of: `DESCENDING` (Newest first), `ASCENDING` (Oldest first).
- Next page cursor (`cursor`, text): Leave blank for the first page. To read the next one, pass the next_cursor from the previous call.

**Outputs**

- `count` (number): How many events are on this page.
- `events` (list): The events on this page, as the System Log returned them.
- `has_more` (true/false): True when Okta has another page. Pass next_cursor as the next call's cursor to read it.
- `next_cursor` (text): The cursor for the next page, or empty on the last page.

**Example output**

```json
{
  "count": 1,
  "events": [
    {
      "actor": {
        "alternateId": "avery.chen@example.com",
        "displayName": "Avery Chen",
        "id": "00u1abcdEFGHijklM2n3",
        "type": "User"
      },
      "client": {
        "geographicalContext": {
          "city": "Dublin",
          "country": "Ireland"
        },
        "ipAddress": "203.0.113.24",
        "userAgent": {
          "browser": "CHROME",
          "os": "Mac OS X"
        }
      },
      "displayMessage": "User login to Okta",
      "eventType": "user.session.start",
      "outcome": {
        "result": "SUCCESS"
      },
      "published": "2026-09-02T08:15:22.101Z",
      "severity": "INFO",
      "target": [],
      "uuid": "9f1c0f1e-2a3b-4c5d-8e9f-0a1b2c3d4e5f"
    }
  ],
  "has_more": false,
  "next_cursor": null
}
```

### List users

List users in your Okta org, optionally narrowed by status or by a search across name, email and login.

**Inputs**

- Status (`status`, text): Only return users with this status. One of: `ACTIVE`, `STAGED` (Staged (created, not yet activated)), `PROVISIONED` (Provisioned (activated, pending first sign-in)), `RECOVERY` (Recovery (password reset in progress)), `PASSWORD_EXPIRED` (Password expired), `LOCKED_OUT` (Locked out), `SUSPENDED`, `DEPROVISIONED` (Deactivated).
- Search (`query`, text): Text to look for in a user's first name, last name, email or login.
- Page size (`limit`, number): How many users to return, 1-200. From 1 to 200. Default: `50`.
- Next page cursor (`cursor`, text): Leave blank for the first page. To read the next one, pass the next_cursor from the previous call.

**Outputs**

- `count` (number): How many users are on this page.
- `has_more` (true/false): True when Okta has another page. Pass next_cursor as the next call's cursor to read it.
- `next_cursor` (text): The cursor for the next page, or empty on the last page.
- `users` (list): The users on this page, as Okta returned them.

**Example output**

```json
{
  "count": 1,
  "has_more": false,
  "next_cursor": null,
  "users": [
    {
      "activated": "2026-01-04T09:12:35.000Z",
      "created": "2026-01-04T09:12:33.000Z",
      "id": "00u1abcdEFGHijklM2n3",
      "lastLogin": "2026-09-01T07:45:10.000Z",
      "lastUpdated": "2026-08-28T14:02:51.000Z",
      "profile": {
        "department": "Customer Success",
        "email": "avery.chen@example.com",
        "firstName": "Avery",
        "lastName": "Chen",
        "login": "avery.chen@example.com",
        "mobilePhone": "+15555550123",
        "title": "Support Engineer"
      },
      "status": "ACTIVE"
    }
  ]
}
```

### Remove user from group

Remove a user from an Okta group. Their account is untouched; they lose only what the group granted.

**Inputs**

- User (`user_id`, text, required): The Okta user id (00u...), the user's login, or the Admin Console URL of their profile.
- Group (`group_id`, text, required): The Okta group id (00g...) or the Admin Console URL of the group.

**Outputs**

- `group_id` (text): The group they were removed from.
- `member` (true/false): Always false once the removal succeeds.
- `user_id` (text): The user removed.

**Example output**

```json
{
  "group_id": "00g4opqrSTUVwxyzA5b6",
  "member": false,
  "user_id": "00u1abcdEFGHijklM2n3"
}
```

### Revoke user sessions

Sign a user out of Okta everywhere, forcing them to authenticate again. The first move on a compromised account.

**Inputs**

- User (`user_id`, text, required): The Okta user id (00u...), the user's login, or the Admin Console URL of their profile.
- Also revoke app tokens (`revoke_oauth_tokens`, true/false): Turn on to revoke the OpenID Connect and OAuth tokens apps hold for this user. Without it an app with a refresh token keeps its access. Default: `false`.
- Forget remembered devices (`forget_devices`, true/false): Turn on to clear the devices this user's factors are remembered on, so MFA is required again everywhere. Default: `false`.

**Outputs**

- `devices_forgotten` (true/false): Whether remembered devices were cleared.
- `oauth_tokens_revoked` (true/false): Whether app tokens were revoked too.
- `operation` (text): Always 'revoke_sessions'.
- `user_id` (text): The user whose sessions were revoked.

**Example output**

```json
{
  "devices_forgotten": false,
  "oauth_tokens_revoked": true,
  "operation": "revoke_sessions",
  "user_id": "00u1abcdEFGHijklM2n3"
}
```

### Suspend user

Suspend an active user. They cannot sign in but keep every group and app assignment, so this is reversible.

**Inputs**

- User (`user_id`, text, required): The Okta user id (00u...), the user's login, or the Admin Console URL of their profile.

**Outputs**

- `asynchronous` (true/false): True when Okta completes this operation in the background, so the user's own status may still say otherwise for a moment.
- `operation` (text): Always 'suspend'.
- `status` (text): The status this operation moves the user to. Read the user again if you need to confirm the transition has landed.
- `user_id` (text): The user that was changed.

**Example output**

```json
{
  "asynchronous": false,
  "operation": "suspend",
  "status": "SUSPENDED",
  "user_id": "00u1abcdEFGHijklM2n3"
}
```

### Unsuspend user

Return a suspended user to active so they can sign in again.

**Inputs**

- User (`user_id`, text, required): The Okta user id (00u...), the user's login, or the Admin Console URL of their profile.

**Outputs**

- `asynchronous` (true/false): True when Okta completes this operation in the background, so the user's own status may still say otherwise for a moment.
- `operation` (text): Always 'unsuspend'.
- `status` (text): The status this operation moves the user to. Read the user again if you need to confirm the transition has landed.
- `user_id` (text): The user that was changed.

**Example output**

```json
{
  "asynchronous": false,
  "operation": "unsuspend",
  "status": "ACTIVE",
  "user_id": "00u1abcdEFGHijklM2n3"
}
```

### Update group

Replace an Okta group's name and description. Okta has no partial update for groups, so a description left blank is cleared; read the group first if you mean to keep it.

**Inputs**

- Group (`group_id`, text, required): The Okta group id (00g...) or the Admin Console URL of the group.
- Name (`name`, text, required): The group's name. Required even when only the description is changing, because Okta replaces the whole profile.
- Description (`description`, text): What the group is for. Left blank, the existing description is removed.

**Outputs**

- `group` (object): The group as Okta stored it after the replacement.

**Example output**

```json
{
  "group": {
    "created": "2026-02-11T11:30:00.000Z",
    "id": "00g4opqrSTUVwxyzA5b6",
    "lastMembershipUpdated": "2026-08-30T16:20:44.000Z",
    "lastUpdated": "2026-02-11T11:30:00.000Z",
    "objectClass": [
      "okta:user_group"
    ],
    "profile": {
      "description": "Everyone on the customer support rota",
      "name": "Support Engineers"
    },
    "type": "OKTA_GROUP"
  }
}
```

### Update user

Update a user's profile. Only the fields you fill in change; everything else is left as it is.

**Inputs**

- User (`user_id`, text, required): The Okta user id (00u...), the user's login, or the Admin Console URL of their profile.
- Email (`email`, text): A new primary email address.
- Login (`login`, text): A new username to sign in with.
- First name (`first_name`, text): A new given name.
- Last name (`last_name`, text): A new family name.
- Mobile phone (`mobile_phone`, text): A new mobile number.
- Job title (`title`, text): A new job title.
- Department (`department`, text): A new department.

**Outputs**

- `user` (object): The user as Okta stored them after the update.

**Example output**

```json
{
  "user": {
    "activated": "2026-01-04T09:12:35.000Z",
    "created": "2026-01-04T09:12:33.000Z",
    "id": "00u1abcdEFGHijklM2n3",
    "lastLogin": "2026-09-01T07:45:10.000Z",
    "lastUpdated": "2026-08-28T14:02:51.000Z",
    "profile": {
      "department": "Customer Success",
      "email": "avery.chen@example.com",
      "firstName": "Avery",
      "lastName": "Chen",
      "login": "avery.chen@example.com",
      "mobilePhone": "+15555550123",
      "title": "Support Engineer"
    },
    "status": "ACTIVE"
  }
}
```