Okta

List all authenticators configured in the org. Returns: Array of authenticators with their status and settings.

Delete an identity provider. Args: - idpId: Identity provider ID Returns: Confirmation of deletion.

Activate a policy. Args: - policyId: Policy ID Returns: Confirmation of activation.

Assign a group to an application. Args: - appId: Application ID - groupId: Group ID Returns: Confirmation of assignment.

Get an authorization server by ID. Args: - authServerId: Authorization server ID (use 'default' for the default server) Returns: The authorization server record.

Remove a group from an application. Args: - appId: Application ID - groupId: Group ID Returns: Confirmation of removal.

Get an authenticator by ID. Args: - authenticatorId: Authenticator ID Returns: The authenticator record.

Activate an authenticator. Args: - authenticatorId: Authenticator ID Returns: The activated authenticator.

Deactivate a policy. Args: - policyId: Policy ID Returns: Confirmation of deactivation.

Deactivate an authenticator. Args: - authenticatorId: Authenticator ID Returns: The deactivated authenticator.

List authorization servers from Okta. Args: - limit: Number of servers to return (1-200, default: 20) - after: Pagination cursor - q: Search query - format: Response format Returns: Paginated list of authorization servers.

List applications from Okta with pagination and filtering. Args: - limit: Number of apps to return (1-200, default: 20) - after: Pagination cursor - filter: Filter expression (e.g., 'status eq "ACTIVE"') - q: Search query for app name - format: Response format Returns: Paginated list of applications.

Get a single application by ID. Args: - appId: Application ID Returns: The application record with settings and credentials.

Activate an inactive application. Args: - appId: Application ID Returns: Confirmation of activation.

Deactivate an active application. Args: - appId: Application ID Returns: Confirmation of deactivation.

Delete an application. Must be deactivated first. Args: - appId: Application ID Returns: Confirmation of deletion.

List users assigned to an application. Args: - appId: Application ID - limit: Number of users to return - after: Pagination cursor - format: Response format Returns: Paginated list of app users.

Assign a user to an application. Args: - appId: Application ID - userId: User ID - profile: Optional app-specific user profile Returns: The app user assignment.

Remove a user from an application. Args: - appId: Application ID - userId: User ID Returns: Confirmation of removal.

List groups assigned to an application. Args: - appId: Application ID Returns: Array of groups assigned to the app.

Create a new authorization server. Args: - name: Server name - description: Server description - audiences: Array of audiences (URIs) Returns: The created authorization server.

Update an authorization server. Args: - authServerId: Authorization server ID - name: Server name - description: Server description - audiences: Array of audiences (URIs) Returns: The updated authorization server.

Delete an authorization server. Args: - authServerId: Authorization server ID Returns: Confirmation of deletion.

Activate an authorization server. Args: - authServerId: Authorization server ID Returns: Confirmation of activation.

Deactivate an authorization server. Args: - authServerId: Authorization server ID Returns: Confirmation of deactivation.

List scopes for an authorization server. Args: - authServerId: Authorization server ID Returns: Array of scopes.

Create a scope for an authorization server. Args: - authServerId: Authorization server ID - name: Scope name - description: Scope description - consent: Consent mode (IMPLICIT or REQUIRED) - metadataPublish: Publish to metadata (NO_CLIENTS or ALL_CLIENTS) Returns: The created scope.

Delete a scope from an authorization server. Args: - authServerId: Authorization server ID - scopeId: Scope ID Returns: Confirmation of deletion.

List claims for an authorization server. Args: - authServerId: Authorization server ID Returns: Array of claims.

Create a claim for an authorization server. Args: - authServerId: Authorization server ID - name: Claim name - claimType: RESOURCE or IDENTITY - valueType: EXPRESSION or GROUPS - value: Claim value expression Returns: The created claim.

Delete a claim from an authorization server. Args: - authServerId: Authorization server ID - claimId: Claim ID Returns: Confirmation of deletion.

List policies for an authorization server. Args: - authServerId: Authorization server ID Returns: Array of policies.

Get a policy from an authorization server. Args: - authServerId: Authorization server ID - policyId: Policy ID Returns: The policy record.

Deactivate an identity provider. Args: - idpId: Identity provider ID Returns: Confirmation of deactivation.

List all enrolled factors (MFA methods) for a user. Args: - userId: User ID - format: Response format Returns: Array of enrolled factors with their status.

Create a policy for an authorization server. Args: - authServerId: Authorization server ID - name: Policy name - description: Policy description - priority: Policy priority (1 is highest) - clientIds: Array of client IDs or ['ALL_CLIENTS'] Returns: The created policy.

Delete a policy from an authorization server. Args: - authServerId: Authorization server ID - policyId: Policy ID Returns: Confirmation of deletion.

List all brands configured in the org. Returns: Array of brands.

Get a brand by ID. Args: - brandId: Brand ID Returns: The brand record.

Update brand settings. Args: - brandId: Brand ID - customPrivacyPolicyUrl: Custom privacy policy URL - removePoweredByOkta: Remove "Powered by Okta" branding Returns: The updated brand.

List all custom domains configured in the org. Returns: Array of domains.

Get a custom domain by ID. Args: - domainId: Domain ID Returns: The domain record with DNS and certificate info.

Create a custom domain. Args: - domain: Domain name (e.g., "login.example.com") - certificateSourceType: MANUAL or OKTA_MANAGED Returns: The created domain with DNS records to configure.

Delete a custom domain. Args: - domainId: Domain ID Returns: Confirmation of deletion.

Verify a custom domain's DNS configuration. Args: - domainId: Domain ID Returns: The domain with updated validation status.

List all event hooks configured in the org. Returns: Array of event hooks.

Get an event hook by ID. Args: - eventHookId: Event hook ID Returns: The event hook record.

Create an event hook to receive Okta events. Args: - name: Hook name - url: Webhook URL to receive events - eventTypes: Array of event types to subscribe to (e.g., "user.lifecycle.create") Returns: The created event hook.

Update an event hook. Args: - eventHookId: Event hook ID - name: Hook name - url: Webhook URL - eventTypes: Event types to subscribe to Returns: The updated event hook.

Delete an event hook. Args: - eventHookId: Event hook ID Returns: Confirmation of deletion.

Activate an event hook. Args: - eventHookId: Event hook ID Returns: Confirmation of activation.

Deactivate an event hook. Args: - eventHookId: Event hook ID Returns: Confirmation of deactivation.

Verify an event hook by sending a verification request. Args: - eventHookId: Event hook ID Returns: The verified event hook.

Get details of a specific factor for a user. Args: - userId: User ID - factorId: Factor ID Returns: Factor details including type, status, and profile.

Enroll a new factor (MFA method) for a user. Args: - userId: User ID - factorType: Factor type (sms, call, email, push, token:software:totp, etc.) - provider: Provider (OKTA, GOOGLE, etc.) - profile: Factor-specific profile (e.g., {phoneNumber: "+1-555-415-1337"} for SMS) Returns: The enrolled factor, may require activation.

Activate a pending factor with a verification code. Args: - userId: User ID - factorId: Factor ID - passCode: Verification code (for factors that require it) Returns: The activated factor.

Reset all factors for a user, requiring them to re-enroll in MFA. Args: - userId: User ID Returns: Confirmation of reset.

Delete a specific factor from a user. Args: - userId: User ID - factorId: Factor ID to delete Returns: Confirmation of deletion.

List all self-service features and their status. Returns: Array of features with their status.

Get a feature by ID. Args: - featureId: Feature ID Returns: The feature record.

Enable a self-service feature. Args: - featureId: Feature ID Returns: The enabled feature.

Disable a self-service feature. Args: - featureId: Feature ID Returns: The disabled feature.

List all linked object definitions (user relationships). Returns: Array of linked object definitions.

Get a linked object definition by name. Args: - linkedObjectName: Linked object name (primary relationship name) Returns: The linked object definition.

Create a linked object definition for user relationships. Args: - primaryName: Primary relationship name (e.g., "manager") - primaryTitle: Primary display title - primaryDescription: Primary description - associatedName: Associated relationship name (e.g., "directReports") - associatedTitle: Associated display title - associatedDescription: Associated description Returns: The created linked object definition.

Delete a linked object definition. Args: - linkedObjectName: Linked object name Returns: Confirmation of deletion.

Set a linked object relationship between users. Args: - primaryUserId: Primary user ID (e.g., manager) - relationshipName: Primary relationship name - associatedUserId: Associated user ID (e.g., direct report) Returns: Confirmation of relationship set.

Get linked object values for a user. Args: - userId: User ID - relationshipName: Relationship name to query Returns: Array of linked users.

Get the user schema (profile attributes). Args: - schemaId: Schema ID (use "default" for the default schema) Returns: The user schema with all properties.

Add custom properties to the user schema. Args: - schemaId: Schema ID - customProperties: Object with custom property definitions Returns: The updated user schema.

List groups from Okta with pagination and filtering. Args: - limit: Number of groups to return (1-200, default: 20) - after: Pagination cursor - search: Search by name (prefix match) - filter: Filter expression (e.g., 'type eq "OKTA_GROUP"') - format: Response format Returns: Paginated list of groups.

Get a single group by ID. Args: - groupId: Group ID Returns: The group record.

Create a new Okta group. Args: - name: Group name (required) - description: Group description Returns: The created group.

Update an existing group's profile. Args: - groupId: Group ID - name: New group name - description: New description Returns: The updated group.

Delete a group. Note: Only OKTA_GROUP type groups can be deleted. Args: - groupId: Group ID to delete Returns: Confirmation of deletion.

List all members of a group. Args: - groupId: Group ID - limit: Number of members to return - after: Pagination cursor - format: Response format Returns: Paginated list of group members.

Add a user to a group. Args: - groupId: Group ID - userId: User ID to add Returns: Confirmation of addition.

Remove a user from a group. Args: - groupId: Group ID - userId: User ID to remove Returns: Confirmation of removal.

List all applications assigned to a group. Args: - groupId: Group ID Returns: Array of applications assigned to the group.

List all group rules. Args: - limit: Number of rules to return - after: Pagination cursor Returns: Paginated list of group rules.

Get a specific group rule by ID. Args: - ruleId: Rule ID Returns: The group rule details.

Create a group rule to dynamically add users to groups. Args: - name: Rule name - groupIds: Target group IDs - expression: Okta Expression Language condition (e.g., "user.department == 'Engineering'") Returns: The created group rule.

Delete a group rule. Args: - ruleId: Rule ID to delete Returns: Confirmation of deletion.

Activate a group rule. Args: - ruleId: Rule ID Returns: Confirmation of activation.

Deactivate a group rule. Args: - ruleId: Rule ID Returns: Confirmation of deactivation.

List rules for a policy. Args: - policyId: Policy ID Returns: Array of policy rules.

List configured identity providers. Args: - limit: Number to return (1-200, default: 20) - after: Pagination cursor - type: Filter by IdP type (SAML2, OIDC, GOOGLE, FACEBOOK, etc.) - format: Response format Returns: Paginated list of identity providers.

Get an identity provider by ID. Args: - idpId: Identity provider ID Returns: The identity provider record with protocol and policy configuration.

Activate an identity provider. Args: - idpId: Identity provider ID Returns: Confirmation of activation.

Query the Okta system log for audit and troubleshooting. Args: - since: Start date (ISO 8601 format, e.g., "2024-01-01T00:00:00Z") - until: End date (ISO 8601 format) - filter: SCIM filter expression (e.g., 'eventType eq "user.session.start"') - q: Keyword search query - limit: Number of events to return (1-1000, default: 100) - after: Pagination cursor - sortOrder: ASCENDING or DESCENDING (default: DESCENDING) - format: Response format Returns: Paginated list of log events.

Get user login/logout events from the system log. Args: - since: Start date (ISO 8601 format) - until: End date (ISO 8601 format) - userId: Filter by user ID - limit: Number of events to return - format: Response format Returns: List of login-related events.

Get security-related events from the system log (suspicious activity, policy violations). Args: - since: Start date (ISO 8601 format) - until: End date (ISO 8601 format) - limit: Number of events to return - format: Response format Returns: List of security-related events.

Get administrative events from the system log (user/group/app changes). Args: - since: Start date (ISO 8601 format) - until: End date (ISO 8601 format) - limit: Number of events to return - format: Response format Returns: List of administrative events.

List policies of a specific type. Args: - type: Policy type (OKTA_SIGN_ON, PASSWORD, MFA_ENROLL, OAUTH_AUTHORIZATION_POLICY, IDP_DISCOVERY, ACCESS_POLICY, PROFILE_ENROLLMENT) - format: Response format Returns: Array of policies.

Get a policy by ID. Args: - policyId: Policy ID Returns: The policy record.

Create a new policy. Args: - type: Policy type - name: Policy name - description: Policy description - priority: Policy priority (1 is highest) Returns: The created policy.

Update a policy. Args: - policyId: Policy ID - name: Policy name - description: Policy description - priority: Policy priority Returns: The updated policy.

Delete a policy. Args: - policyId: Policy ID Returns: Confirmation of deletion.

Get a specific policy rule. Args: - policyId: Policy ID - ruleId: Rule ID Returns: The policy rule.

Delete a policy rule. Args: - policyId: Policy ID - ruleId: Rule ID Returns: Confirmation of deletion.

Activate a policy rule. Args: - policyId: Policy ID - ruleId: Rule ID Returns: Confirmation of activation.

Deactivate a policy rule. Args: - policyId: Policy ID - ruleId: Rule ID Returns: Confirmation of deactivation.

Get a session by ID. Args: - sessionId: Session ID Returns: The session record with login, expiration, and MFA status.

End/revoke a user session. Args: - sessionId: Session ID to end Returns: Confirmation of session termination.

Refresh/extend a session. Args: - sessionId: Session ID to refresh Returns: The refreshed session with new expiration.

List trusted origins for CORS and redirect. Args: - limit: Number to return (1-200, default: 20) - after: Pagination cursor - filter: Filter expression - format: Response format Returns: Paginated list of trusted origins.

Get a trusted origin by ID. Args: - trustedOriginId: Trusted origin ID Returns: The trusted origin record.

Create a trusted origin for CORS/redirect. Args: - name: Origin name - origin: Origin URL (e.g., "https://example.com") - scopes: Array of scope types - CORS, REDIRECT, or both Returns: The created trusted origin.

Update a trusted origin. Args: - trustedOriginId: Trusted origin ID - name: Origin name - origin: Origin URL - scopes: Array of scope types Returns: The updated trusted origin.

Delete a trusted origin. Args: - trustedOriginId: Trusted origin ID Returns: Confirmation of deletion.

Activate a trusted origin. Args: - trustedOriginId: Trusted origin ID Returns: Confirmation of activation.

Deactivate a trusted origin. Args: - trustedOriginId: Trusted origin ID Returns: Confirmation of deactivation.

List users from Okta with pagination and filtering. Args: - limit: Number of users to return (1-200, default: 20) - after: Pagination cursor from previous response - search: Search expression (e.g., 'profile.email eq "john@example.com"') - filter: Filter expression (e.g., 'status eq "ACTIVE"') - format: Response format ('json' or 'markdown') Returns: Paginated list of users with their profiles and status.

Get a single user by ID or login. Args: - userId: The user ID or login (email) - format: Response format Returns: The user record with profile, status, and credentials info.

Create a new user in Okta. Args: - firstName: First name (required) - lastName: Last name (required) - email: Email address (required) - login: Login/username (required, usually email) - mobilePhone: Mobile phone number - secondEmail: Secondary email - password: Initial password (optional, if not set user will need to set on first login) - groupIds: Array of group IDs to add user to - activate: Whether to activate the user immediately (default: true) Returns: The created user record.

Update an existing user's profile. Args: - userId: User ID to update - profile: Profile fields to update (firstName, lastName, email, etc.) Returns: The updated user record.

Delete a user from Okta. Note: User must be deactivated first. Args: - userId: User ID to delete - sendEmail: Send email notification Returns: Confirmation of deletion.

Activate a staged or deprovisioned user. Args: - userId: User ID to activate - sendEmail: Send activation email (default: true) Returns: The activated user record or activation token.

Deactivate an active user. Warning: This is destructive - user is deprovisioned from all apps. Args: - userId: User ID to deactivate - sendEmail: Send notification email Returns: Confirmation of deactivation.

Suspend an active user. Suspended users cannot sign in but retain group/app assignments. Args: - userId: User ID to suspend Returns: Confirmation of suspension.

Unsuspend a suspended user, returning them to active status. Args: - userId: User ID to unsuspend Returns: Confirmation of unsuspension.

Unlock a locked-out user. Args: - userId: User ID to unlock Returns: Confirmation of unlock.

Reset a user's password. Args: - userId: User ID - sendEmail: Send password reset email (default: true) Returns: Reset password URL (if sendEmail is false).

Expire a user's password, forcing them to change it on next login. Args: - userId: User ID Returns: The updated user record.

Set a user's password directly. Args: - userId: User ID - password: New password Returns: Confirmation of password change.

List all groups a user belongs to. Args: - userId: User ID Returns: Array of groups.

List all applications assigned to a user. Args: - userId: User ID Returns: Array of app links.

List network zones configured in the org. Args: - limit: Number to return (1-200, default: 20) - after: Pagination cursor - filter: Filter expression - format: Response format Returns: Paginated list of network zones.

Get a network zone by ID. Args: - zoneId: Zone ID Returns: The network zone record.

Create a network zone (IP-based). Args: - name: Zone name - type: Zone type (IP or DYNAMIC) - gateways: Array of gateways (for IP zones) with type (CIDR or RANGE) and value Returns: The created network zone.

Update a network zone. Args: - zoneId: Zone ID - name: Zone name - gateways: Array of gateways with type and value Returns: The updated network zone.

Delete a network zone. Args: - zoneId: Zone ID Returns: Confirmation of deletion.

Activate a network zone. Args: - zoneId: Zone ID Returns: Confirmation of activation.

Deactivate a network zone. Args: - zoneId: Zone ID Returns: Confirmation of deactivation.