Okta

Okta MCP Server for Cloudflare Workers

Available Tools

134 tools available in the Okta MCP server. Each tool can be called by AI assistants to perform specific actions.

okta_list_authenticators

List all authenticators configured in the org.

Returns: Array of authenticators with their status and settings.

{
  "type": "object",
  "properties": {}
}

okta_delete_identity_provider

Delete an identity provider.

Args:

idpId: Identity provider ID

Returns: Confirmation of deletion.

{
  "type": "object",
  "required": [
    "idpId"
  ],
  "properties": {
    "idpId": {
      "type": "string",
      "description": "Identity provider ID"
    }
  }
}

okta_activate_policy

Activate a policy.

Args:

policyId: Policy ID

Returns: Confirmation of activation.

{
  "type": "object",
  "required": [
    "policyId"
  ],
  "properties": {
    "policyId": {
      "type": "string",
      "description": "Policy ID"
    }
  }
}

okta_assign_group_to_app

Assign a group to an application.

Args:

appId: Application ID
groupId: Group ID

Returns: Confirmation of assignment.

{
  "type": "object",
  "required": [
    "appId",
    "groupId"
  ],
  "properties": {
    "appId": {
      "type": "string",
      "description": "Application ID"
    },
    "groupId": {
      "type": "string",
      "description": "Group ID"
    }
  }
}

okta_get_auth_server

Get an authorization server by ID.

Args:

authServerId: Authorization server ID (use 'default' for the default server)

Returns: The authorization server record.

{
  "type": "object",
  "required": [
    "authServerId"
  ],
  "properties": {
    "authServerId": {
      "type": "string",
      "description": "Authorization server ID"
    }
  }
}

okta_remove_group_from_app

Remove a group from an application.

Args:

appId: Application ID
groupId: Group ID

Returns: Confirmation of removal.

{
  "type": "object",
  "required": [
    "appId",
    "groupId"
  ],
  "properties": {
    "appId": {
      "type": "string",
      "description": "Application ID"
    },
    "groupId": {
      "type": "string",
      "description": "Group ID"
    }
  }
}

okta_get_authenticator

Get an authenticator by ID.

Args:

authenticatorId: Authenticator ID

Returns: The authenticator record.

{
  "type": "object",
  "required": [
    "authenticatorId"
  ],
  "properties": {
    "authenticatorId": {
      "type": "string",
      "description": "Authenticator ID"
    }
  }
}

okta_activate_authenticator

Activate an authenticator.

Args:

authenticatorId: Authenticator ID

Returns: The activated authenticator.

{
  "type": "object",
  "required": [
    "authenticatorId"
  ],
  "properties": {
    "authenticatorId": {
      "type": "string",
      "description": "Authenticator ID"
    }
  }
}

okta_deactivate_policy

Deactivate a policy.

Args:

policyId: Policy ID

Returns: Confirmation of deactivation.

{
  "type": "object",
  "required": [
    "policyId"
  ],
  "properties": {
    "policyId": {
      "type": "string",
      "description": "Policy ID"
    }
  }
}

okta_deactivate_authenticator

Deactivate an authenticator.

Args:

authenticatorId: Authenticator ID

Returns: The deactivated authenticator.

{
  "type": "object",
  "required": [
    "authenticatorId"
  ],
  "properties": {
    "authenticatorId": {
      "type": "string",
      "description": "Authenticator ID"
    }
  }
}

okta_list_auth_servers

List authorization servers from Okta.

Args:

limit: Number of servers to return (1-200, default: 20)
after: Pagination cursor
q: Search query
format: Response format

Returns: Paginated list of authorization servers.

{
  "type": "object",
  "properties": {
    "q": {
      "type": "string",
      "description": "Search query"
    },
    "after": {
      "type": "string",
      "description": "Pagination cursor"
    },
    "limit": {
      "type": "integer",
      "default": 20,
      "maximum": 200,
      "minimum": 1,
      "description": "Number to return"
    },
    "format": {
      "enum": [
        "json",
        "markdown"
      ],
      "type": "string"
    }
  }
}

okta_list_applications

List applications from Okta with pagination and filtering.

Args:

limit: Number of apps to return (1-200, default: 20)
after: Pagination cursor
filter: Filter expression (e.g., 'status eq "ACTIVE"')
q: Search query for app name
format: Response format

Returns: Paginated list of applications.

{
  "type": "object",
  "properties": {
    "q": {
      "type": "string",
      "description": "Search query"
    },
    "after": {
      "type": "string",
      "description": "Pagination cursor"
    },
    "limit": {
      "type": "integer",
      "default": 20,
      "maximum": 200,
      "minimum": 1,
      "description": "Number of apps to return"
    },
    "filter": {
      "type": "string",
      "description": "Filter expression"
    },
    "format": {
      "enum": [
        "json",
        "markdown"
      ],
      "type": "string"
    }
  }
}

okta_get_application

Get a single application by ID.

Args:

appId: Application ID

Returns: The application record with settings and credentials.

{
  "type": "object",
  "required": [
    "appId"
  ],
  "properties": {
    "appId": {
      "type": "string",
      "description": "Application ID"
    }
  }
}

okta_activate_application

Activate an inactive application.

Args:

appId: Application ID

Returns: Confirmation of activation.

{
  "type": "object",
  "required": [
    "appId"
  ],
  "properties": {
    "appId": {
      "type": "string",
      "description": "Application ID"
    }
  }
}

okta_deactivate_application

Deactivate an active application.

Args:

appId: Application ID

Returns: Confirmation of deactivation.

{
  "type": "object",
  "required": [
    "appId"
  ],
  "properties": {
    "appId": {
      "type": "string",
      "description": "Application ID"
    }
  }
}

okta_delete_application

Delete an application. Must be deactivated first.

Args:

appId: Application ID

Returns: Confirmation of deletion.

{
  "type": "object",
  "required": [
    "appId"
  ],
  "properties": {
    "appId": {
      "type": "string",
      "description": "Application ID"
    }
  }
}

okta_list_app_users

List users assigned to an application.

Args:

appId: Application ID
limit: Number of users to return
after: Pagination cursor
format: Response format

Returns: Paginated list of app users.

{
  "type": "object",
  "required": [
    "appId"
  ],
  "properties": {
    "after": {
      "type": "string",
      "description": "Pagination cursor"
    },
    "appId": {
      "type": "string",
      "description": "Application ID"
    },
    "limit": {
      "type": "integer",
      "default": 20,
      "maximum": 200,
      "minimum": 1,
      "description": "Number of users to return"
    },
    "format": {
      "enum": [
        "json",
        "markdown"
      ],
      "type": "string"
    }
  }
}

okta_assign_user_to_app

Assign a user to an application.

Args:

appId: Application ID
userId: User ID
profile: Optional app-specific user profile

Returns: The app user assignment.

{
  "type": "object",
  "required": [
    "appId",
    "userId"
  ],
  "properties": {
    "appId": {
      "type": "string",
      "description": "Application ID"
    },
    "userId": {
      "type": "string",
      "description": "User ID"
    },
    "profile": {
      "type": "object",
      "description": "App-specific profile"
    }
  }
}

okta_remove_user_from_app

Remove a user from an application.

Args:

appId: Application ID
userId: User ID

Returns: Confirmation of removal.

{
  "type": "object",
  "required": [
    "appId",
    "userId"
  ],
  "properties": {
    "appId": {
      "type": "string",
      "description": "Application ID"
    },
    "userId": {
      "type": "string",
      "description": "User ID"
    }
  }
}

okta_list_app_groups

List groups assigned to an application.

Args:

appId: Application ID

Returns: Array of groups assigned to the app.

{
  "type": "object",
  "required": [
    "appId"
  ],
  "properties": {
    "appId": {
      "type": "string",
      "description": "Application ID"
    }
  }
}

okta_create_auth_server

Create a new authorization server.

Args:

name: Server name
description: Server description
audiences: Array of audiences (URIs)

Returns: The created authorization server.

{
  "type": "object",
  "required": [
    "name",
    "description",
    "audiences"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "Server name"
    },
    "audiences": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Audience URIs"
    },
    "description": {
      "type": "string",
      "description": "Server description"
    }
  }
}

okta_update_auth_server

Update an authorization server.

Args:

authServerId: Authorization server ID
name: Server name
description: Server description
audiences: Array of audiences (URIs)

Returns: The updated authorization server.

{
  "type": "object",
  "required": [
    "authServerId",
    "name",
    "description",
    "audiences"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "Server name"
    },
    "audiences": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Audience URIs"
    },
    "description": {
      "type": "string",
      "description": "Server description"
    },
    "authServerId": {
      "type": "string",
      "description": "Authorization server ID"
    }
  }
}

okta_delete_auth_server

Delete an authorization server.

Args:

authServerId: Authorization server ID

Returns: Confirmation of deletion.

{
  "type": "object",
  "required": [
    "authServerId"
  ],
  "properties": {
    "authServerId": {
      "type": "string",
      "description": "Authorization server ID"
    }
  }
}

okta_activate_auth_server

Activate an authorization server.

Args:

authServerId: Authorization server ID

Returns: Confirmation of activation.

{
  "type": "object",
  "required": [
    "authServerId"
  ],
  "properties": {
    "authServerId": {
      "type": "string",
      "description": "Authorization server ID"
    }
  }
}

okta_deactivate_auth_server

Deactivate an authorization server.

Args:

authServerId: Authorization server ID

Returns: Confirmation of deactivation.

{
  "type": "object",
  "required": [
    "authServerId"
  ],
  "properties": {
    "authServerId": {
      "type": "string",
      "description": "Authorization server ID"
    }
  }
}

okta_list_auth_server_scopes

List scopes for an authorization server.

Args:

authServerId: Authorization server ID

Returns: Array of scopes.

{
  "type": "object",
  "required": [
    "authServerId"
  ],
  "properties": {
    "authServerId": {
      "type": "string",
      "description": "Authorization server ID"
    }
  }
}

okta_create_auth_server_scope

Create a scope for an authorization server.

Args:

authServerId: Authorization server ID
name: Scope name
description: Scope description
consent: Consent mode (IMPLICIT or REQUIRED)
metadataPublish: Publish to metadata (NO_CLIENTS or ALL_CLIENTS)

Returns: The created scope.

{
  "type": "object",
  "required": [
    "authServerId",
    "name"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "Scope name"
    },
    "consent": {
      "enum": [
        "IMPLICIT",
        "REQUIRED"
      ],
      "type": "string",
      "default": "IMPLICIT",
      "description": "Consent mode"
    },
    "description": {
      "type": "string",
      "description": "Scope description"
    },
    "authServerId": {
      "type": "string",
      "description": "Authorization server ID"
    },
    "metadataPublish": {
      "enum": [
        "NO_CLIENTS",
        "ALL_CLIENTS"
      ],
      "type": "string",
      "default": "NO_CLIENTS",
      "description": "Metadata publish"
    }
  }
}

okta_delete_auth_server_scope

Delete a scope from an authorization server.

Args:

authServerId: Authorization server ID
scopeId: Scope ID

Returns: Confirmation of deletion.

{
  "type": "object",
  "required": [
    "authServerId",
    "scopeId"
  ],
  "properties": {
    "scopeId": {
      "type": "string",
      "description": "Scope ID"
    },
    "authServerId": {
      "type": "string",
      "description": "Authorization server ID"
    }
  }
}

okta_list_auth_server_claims

List claims for an authorization server.

Args:

authServerId: Authorization server ID

Returns: Array of claims.

{
  "type": "object",
  "required": [
    "authServerId"
  ],
  "properties": {
    "authServerId": {
      "type": "string",
      "description": "Authorization server ID"
    }
  }
}

okta_create_auth_server_claim

Create a claim for an authorization server.

Args:

authServerId: Authorization server ID
name: Claim name
claimType: RESOURCE or IDENTITY
valueType: EXPRESSION or GROUPS
value: Claim value expression

Returns: The created claim.

{
  "type": "object",
  "required": [
    "authServerId",
    "name",
    "claimType",
    "valueType",
    "value"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "Claim name"
    },
    "value": {
      "type": "string",
      "description": "Claim value expression"
    },
    "claimType": {
      "enum": [
        "RESOURCE",
        "IDENTITY"
      ],
      "type": "string",
      "description": "Claim type"
    },
    "valueType": {
      "enum": [
        "EXPRESSION",
        "GROUPS"
      ],
      "type": "string",
      "description": "Value type"
    },
    "authServerId": {
      "type": "string",
      "description": "Authorization server ID"
    }
  }
}

okta_delete_auth_server_claim

Delete a claim from an authorization server.

Args:

authServerId: Authorization server ID
claimId: Claim ID

Returns: Confirmation of deletion.

{
  "type": "object",
  "required": [
    "authServerId",
    "claimId"
  ],
  "properties": {
    "claimId": {
      "type": "string",
      "description": "Claim ID"
    },
    "authServerId": {
      "type": "string",
      "description": "Authorization server ID"
    }
  }
}

okta_list_auth_server_policies

List policies for an authorization server.

Args:

authServerId: Authorization server ID

Returns: Array of policies.

{
  "type": "object",
  "required": [
    "authServerId"
  ],
  "properties": {
    "authServerId": {
      "type": "string",
      "description": "Authorization server ID"
    }
  }
}

okta_get_auth_server_policy

Get a policy from an authorization server.

Args:

authServerId: Authorization server ID
policyId: Policy ID

Returns: The policy record.

{
  "type": "object",
  "required": [
    "authServerId",
    "policyId"
  ],
  "properties": {
    "policyId": {
      "type": "string",
      "description": "Policy ID"
    },
    "authServerId": {
      "type": "string",
      "description": "Authorization server ID"
    }
  }
}

okta_deactivate_identity_provider

Deactivate an identity provider.

Args:

idpId: Identity provider ID

Returns: Confirmation of deactivation.

{
  "type": "object",
  "required": [
    "idpId"
  ],
  "properties": {
    "idpId": {
      "type": "string",
      "description": "Identity provider ID"
    }
  }
}

okta_list_user_factors

List all enrolled factors (MFA methods) for a user.

Args:

userId: User ID
format: Response format

Returns: Array of enrolled factors with their status.

{
  "type": "object",
  "required": [
    "userId"
  ],
  "properties": {
    "format": {
      "enum": [
        "json",
        "markdown"
      ],
      "type": "string"
    },
    "userId": {
      "type": "string",
      "description": "User ID"
    }
  }
}

okta_create_auth_server_policy

Create a policy for an authorization server.

Args:

authServerId: Authorization server ID
name: Policy name
description: Policy description
priority: Policy priority (1 is highest)
clientIds: Array of client IDs or ['ALL_CLIENTS']

Returns: The created policy.

{
  "type": "object",
  "required": [
    "authServerId",
    "name",
    "description",
    "priority",
    "clientIds"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "Policy name"
    },
    "priority": {
      "type": "integer",
      "minimum": 1,
      "description": "Policy priority"
    },
    "clientIds": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Client IDs"
    },
    "description": {
      "type": "string",
      "description": "Policy description"
    },
    "authServerId": {
      "type": "string",
      "description": "Authorization server ID"
    }
  }
}

okta_delete_auth_server_policy

Delete a policy from an authorization server.

Args:

authServerId: Authorization server ID
policyId: Policy ID

Returns: Confirmation of deletion.

{
  "type": "object",
  "required": [
    "authServerId",
    "policyId"
  ],
  "properties": {
    "policyId": {
      "type": "string",
      "description": "Policy ID"
    },
    "authServerId": {
      "type": "string",
      "description": "Authorization server ID"
    }
  }
}

okta_list_brands

List all brands configured in the org.

Returns: Array of brands.

{
  "type": "object",
  "properties": {}
}

okta_get_brand

Get a brand by ID.

Args:

brandId: Brand ID

Returns: The brand record.

{
  "type": "object",
  "required": [
    "brandId"
  ],
  "properties": {
    "brandId": {
      "type": "string",
      "description": "Brand ID"
    }
  }
}

okta_update_brand

Update brand settings.

Args:

brandId: Brand ID
customPrivacyPolicyUrl: Custom privacy policy URL
removePoweredByOkta: Remove "Powered by Okta" branding

Returns: The updated brand.

{
  "type": "object",
  "required": [
    "brandId"
  ],
  "properties": {
    "brandId": {
      "type": "string",
      "description": "Brand ID"
    },
    "removePoweredByOkta": {
      "type": "boolean",
      "description": "Remove Okta branding"
    },
    "customPrivacyPolicyUrl": {
      "type": "string",
      "description": "Privacy policy URL"
    }
  }
}

okta_list_domains

List all custom domains configured in the org.

Returns: Array of domains.

{
  "type": "object",
  "properties": {}
}

okta_get_domain

Get a custom domain by ID.

Args:

domainId: Domain ID

Returns: The domain record with DNS and certificate info.

{
  "type": "object",
  "required": [
    "domainId"
  ],
  "properties": {
    "domainId": {
      "type": "string",
      "description": "Domain ID"
    }
  }
}

okta_create_domain

Create a custom domain.

Args:

domain: Domain name (e.g., "login.example.com")
certificateSourceType: MANUAL or OKTA_MANAGED

Returns: The created domain with DNS records to configure.

{
  "type": "object",
  "required": [
    "domain",
    "certificateSourceType"
  ],
  "properties": {
    "domain": {
      "type": "string",
      "description": "Domain name"
    },
    "certificateSourceType": {
      "enum": [
        "MANUAL",
        "OKTA_MANAGED"
      ],
      "type": "string",
      "description": "Certificate source"
    }
  }
}

okta_delete_domain

Delete a custom domain.

Args:

domainId: Domain ID

Returns: Confirmation of deletion.

{
  "type": "object",
  "required": [
    "domainId"
  ],
  "properties": {
    "domainId": {
      "type": "string",
      "description": "Domain ID"
    }
  }
}

okta_verify_domain

Verify a custom domain's DNS configuration.

Args:

domainId: Domain ID

Returns: The domain with updated validation status.

{
  "type": "object",
  "required": [
    "domainId"
  ],
  "properties": {
    "domainId": {
      "type": "string",
      "description": "Domain ID"
    }
  }
}

okta_list_event_hooks

List all event hooks configured in the org.

Returns: Array of event hooks.

{
  "type": "object",
  "properties": {}
}

okta_get_event_hook

Get an event hook by ID.

Args:

eventHookId: Event hook ID

Returns: The event hook record.

{
  "type": "object",
  "required": [
    "eventHookId"
  ],
  "properties": {
    "eventHookId": {
      "type": "string",
      "description": "Event hook ID"
    }
  }
}

okta_create_event_hook

Create an event hook to receive Okta events.

Args:

name: Hook name
url: Webhook URL to receive events
eventTypes: Array of event types to subscribe to (e.g., "user.lifecycle.create")

Returns: The created event hook.

{
  "type": "object",
  "required": [
    "name",
    "url",
    "eventTypes"
  ],
  "properties": {
    "url": {
      "type": "string",
      "description": "Webhook URL"
    },
    "name": {
      "type": "string",
      "description": "Hook name"
    },
    "eventTypes": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Event types to subscribe to"
    }
  }
}

okta_update_event_hook

Update an event hook.

Args:

eventHookId: Event hook ID
name: Hook name
url: Webhook URL
eventTypes: Event types to subscribe to

Returns: The updated event hook.

{
  "type": "object",
  "required": [
    "eventHookId",
    "name",
    "url",
    "eventTypes"
  ],
  "properties": {
    "url": {
      "type": "string",
      "description": "Webhook URL"
    },
    "name": {
      "type": "string",
      "description": "Hook name"
    },
    "eventTypes": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Event types"
    },
    "eventHookId": {
      "type": "string",
      "description": "Event hook ID"
    }
  }
}

okta_delete_event_hook

Delete an event hook.

Args:

eventHookId: Event hook ID

Returns: Confirmation of deletion.

{
  "type": "object",
  "required": [
    "eventHookId"
  ],
  "properties": {
    "eventHookId": {
      "type": "string",
      "description": "Event hook ID"
    }
  }
}

okta_activate_event_hook

Activate an event hook.

Args:

eventHookId: Event hook ID

Returns: Confirmation of activation.

{
  "type": "object",
  "required": [
    "eventHookId"
  ],
  "properties": {
    "eventHookId": {
      "type": "string",
      "description": "Event hook ID"
    }
  }
}

okta_deactivate_event_hook

Deactivate an event hook.

Args:

eventHookId: Event hook ID

Returns: Confirmation of deactivation.

{
  "type": "object",
  "required": [
    "eventHookId"
  ],
  "properties": {
    "eventHookId": {
      "type": "string",
      "description": "Event hook ID"
    }
  }
}

okta_verify_event_hook

Verify an event hook by sending a verification request.

Args:

eventHookId: Event hook ID

Returns: The verified event hook.

{
  "type": "object",
  "required": [
    "eventHookId"
  ],
  "properties": {
    "eventHookId": {
      "type": "string",
      "description": "Event hook ID"
    }
  }
}

okta_get_user_factor

Get details of a specific factor for a user.

Args:

userId: User ID
factorId: Factor ID

Returns: Factor details including type, status, and profile.

{
  "type": "object",
  "required": [
    "userId",
    "factorId"
  ],
  "properties": {
    "userId": {
      "type": "string",
      "description": "User ID"
    },
    "factorId": {
      "type": "string",
      "description": "Factor ID"
    }
  }
}

okta_enroll_factor

Enroll a new factor (MFA method) for a user.

Args:

userId: User ID
factorType: Factor type (sms, call, email, push, token:software:totp, etc.)
provider: Provider (OKTA, GOOGLE, etc.)
profile: Factor-specific profile (e.g., {phoneNumber: "+1-555-415-1337"} for SMS)

Returns: The enrolled factor, may require activation.

{
  "type": "object",
  "required": [
    "userId",
    "factorType",
    "provider"
  ],
  "properties": {
    "userId": {
      "type": "string",
      "description": "User ID"
    },
    "profile": {
      "type": "object",
      "description": "Factor profile"
    },
    "provider": {
      "type": "string",
      "description": "Provider"
    },
    "factorType": {
      "type": "string",
      "description": "Factor type"
    }
  }
}

okta_activate_factor

Activate a pending factor with a verification code.

Args:

userId: User ID
factorId: Factor ID
passCode: Verification code (for factors that require it)

Returns: The activated factor.

{
  "type": "object",
  "required": [
    "userId",
    "factorId"
  ],
  "properties": {
    "userId": {
      "type": "string",
      "description": "User ID"
    },
    "factorId": {
      "type": "string",
      "description": "Factor ID"
    },
    "passCode": {
      "type": "string",
      "description": "Verification code"
    }
  }
}

okta_reset_factors

Reset all factors for a user, requiring them to re-enroll in MFA.

Args:

userId: User ID

Returns: Confirmation of reset.

{
  "type": "object",
  "required": [
    "userId"
  ],
  "properties": {
    "userId": {
      "type": "string",
      "description": "User ID"
    }
  }
}

okta_delete_factor

Delete a specific factor from a user.

Args:

userId: User ID
factorId: Factor ID to delete

Returns: Confirmation of deletion.

{
  "type": "object",
  "required": [
    "userId",
    "factorId"
  ],
  "properties": {
    "userId": {
      "type": "string",
      "description": "User ID"
    },
    "factorId": {
      "type": "string",
      "description": "Factor ID"
    }
  }
}

okta_list_features

List all self-service features and their status.

Returns: Array of features with their status.

{
  "type": "object",
  "properties": {}
}

okta_get_feature

Get a feature by ID.

Args:

featureId: Feature ID

Returns: The feature record.

{
  "type": "object",
  "required": [
    "featureId"
  ],
  "properties": {
    "featureId": {
      "type": "string",
      "description": "Feature ID"
    }
  }
}

okta_enable_feature

Enable a self-service feature.

Args:

featureId: Feature ID

Returns: The enabled feature.

{
  "type": "object",
  "required": [
    "featureId"
  ],
  "properties": {
    "featureId": {
      "type": "string",
      "description": "Feature ID"
    }
  }
}

okta_disable_feature

Disable a self-service feature.

Args:

featureId: Feature ID

Returns: The disabled feature.

{
  "type": "object",
  "required": [
    "featureId"
  ],
  "properties": {
    "featureId": {
      "type": "string",
      "description": "Feature ID"
    }
  }
}

okta_list_linked_object_definitions

List all linked object definitions (user relationships).

Returns: Array of linked object definitions.

{
  "type": "object",
  "properties": {}
}

okta_get_linked_object_definition

Get a linked object definition by name.

Args:

linkedObjectName: Linked object name (primary relationship name)

Returns: The linked object definition.

{
  "type": "object",
  "required": [
    "linkedObjectName"
  ],
  "properties": {
    "linkedObjectName": {
      "type": "string",
      "description": "Linked object name"
    }
  }
}

okta_create_linked_object_definition

Create a linked object definition for user relationships.

Args:

primaryName: Primary relationship name (e.g., "manager")
primaryTitle: Primary display title
primaryDescription: Primary description
associatedName: Associated relationship name (e.g., "directReports")
associatedTitle: Associated display title
associatedDescription: Associated description

Returns: The created linked object definition.

{
  "type": "object",
  "required": [
    "primaryName",
    "primaryTitle",
    "primaryDescription",
    "associatedName",
    "associatedTitle",
    "associatedDescription"
  ],
  "properties": {
    "primaryName": {
      "type": "string",
      "description": "Primary relationship name"
    },
    "primaryTitle": {
      "type": "string",
      "description": "Primary display title"
    },
    "associatedName": {
      "type": "string",
      "description": "Associated relationship name"
    },
    "associatedTitle": {
      "type": "string",
      "description": "Associated display title"
    },
    "primaryDescription": {
      "type": "string",
      "description": "Primary description"
    },
    "associatedDescription": {
      "type": "string",
      "description": "Associated description"
    }
  }
}

okta_delete_linked_object_definition

Delete a linked object definition.

Args:

linkedObjectName: Linked object name

Returns: Confirmation of deletion.

{
  "type": "object",
  "required": [
    "linkedObjectName"
  ],
  "properties": {
    "linkedObjectName": {
      "type": "string",
      "description": "Linked object name"
    }
  }
}

okta_set_linked_object_value

Set a linked object relationship between users.

Args:

primaryUserId: Primary user ID (e.g., manager)
relationshipName: Primary relationship name
associatedUserId: Associated user ID (e.g., direct report)

Returns: Confirmation of relationship set.

{
  "type": "object",
  "required": [
    "primaryUserId",
    "relationshipName",
    "associatedUserId"
  ],
  "properties": {
    "primaryUserId": {
      "type": "string",
      "description": "Primary user ID"
    },
    "associatedUserId": {
      "type": "string",
      "description": "Associated user ID"
    },
    "relationshipName": {
      "type": "string",
      "description": "Primary relationship name"
    }
  }
}

okta_get_linked_object_values

Get linked object values for a user.

Args:

userId: User ID
relationshipName: Relationship name to query

Returns: Array of linked users.

{
  "type": "object",
  "required": [
    "userId",
    "relationshipName"
  ],
  "properties": {
    "userId": {
      "type": "string",
      "description": "User ID"
    },
    "relationshipName": {
      "type": "string",
      "description": "Relationship name"
    }
  }
}

okta_get_user_schema

Get the user schema (profile attributes).

Args:

schemaId: Schema ID (use "default" for the default schema)

Returns: The user schema with all properties.

{
  "type": "object",
  "properties": {
    "schemaId": {
      "type": "string",
      "default": "default",
      "description": "Schema ID"
    }
  }
}

okta_update_user_schema

Add custom properties to the user schema.

Args:

schemaId: Schema ID
customProperties: Object with custom property definitions

Returns: The updated user schema.

{
  "type": "object",
  "required": [
    "schemaId",
    "customProperties"
  ],
  "properties": {
    "schemaId": {
      "type": "string",
      "description": "Schema ID"
    },
    "customProperties": {
      "type": "object",
      "description": "Custom property definitions"
    }
  }
}

okta_list_groups

List groups from Okta with pagination and filtering.

Args:

limit: Number of groups to return (1-200, default: 20)
after: Pagination cursor
search: Search by name (prefix match)
filter: Filter expression (e.g., 'type eq "OKTA_GROUP"')
format: Response format

Returns: Paginated list of groups.

{
  "type": "object",
  "properties": {
    "after": {
      "type": "string",
      "description": "Pagination cursor"
    },
    "limit": {
      "type": "integer",
      "default": 20,
      "maximum": 200,
      "minimum": 1,
      "description": "Number of groups to return"
    },
    "filter": {
      "type": "string",
      "description": "Filter expression"
    },
    "format": {
      "enum": [
        "json",
        "markdown"
      ],
      "type": "string"
    },
    "search": {
      "type": "string",
      "description": "Search by name"
    }
  }
}

okta_get_group

Get a single group by ID.

Args:

groupId: Group ID

Returns: The group record.

{
  "type": "object",
  "required": [
    "groupId"
  ],
  "properties": {
    "groupId": {
      "type": "string",
      "description": "Group ID"
    }
  }
}

okta_create_group

Create a new Okta group.

Args:

name: Group name (required)
description: Group description

Returns: The created group.

{
  "type": "object",
  "required": [
    "name"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "Group name"
    },
    "description": {
      "type": "string",
      "description": "Group description"
    }
  }
}

okta_update_group

Update an existing group's profile.

Args:

groupId: Group ID
name: New group name
description: New description

Returns: The updated group.

{
  "type": "object",
  "required": [
    "groupId",
    "name"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "Group name"
    },
    "groupId": {
      "type": "string",
      "description": "Group ID"
    },
    "description": {
      "type": "string",
      "description": "Group description"
    }
  }
}

okta_delete_group

Delete a group. Note: Only OKTA_GROUP type groups can be deleted.

Args:

groupId: Group ID to delete

Returns: Confirmation of deletion.

{
  "type": "object",
  "required": [
    "groupId"
  ],
  "properties": {
    "groupId": {
      "type": "string",
      "description": "Group ID"
    }
  }
}

okta_list_group_members

List all members of a group.

Args:

groupId: Group ID
limit: Number of members to return
after: Pagination cursor
format: Response format

Returns: Paginated list of group members.

{
  "type": "object",
  "required": [
    "groupId"
  ],
  "properties": {
    "after": {
      "type": "string",
      "description": "Pagination cursor"
    },
    "limit": {
      "type": "integer",
      "default": 20,
      "maximum": 200,
      "minimum": 1,
      "description": "Number of members to return"
    },
    "format": {
      "enum": [
        "json",
        "markdown"
      ],
      "type": "string"
    },
    "groupId": {
      "type": "string",
      "description": "Group ID"
    }
  }
}

okta_add_user_to_group

Add a user to a group.

Args:

groupId: Group ID
userId: User ID to add

Returns: Confirmation of addition.

{
  "type": "object",
  "required": [
    "groupId",
    "userId"
  ],
  "properties": {
    "userId": {
      "type": "string",
      "description": "User ID"
    },
    "groupId": {
      "type": "string",
      "description": "Group ID"
    }
  }
}

okta_remove_user_from_group

Remove a user from a group.

Args:

groupId: Group ID
userId: User ID to remove

Returns: Confirmation of removal.

{
  "type": "object",
  "required": [
    "groupId",
    "userId"
  ],
  "properties": {
    "userId": {
      "type": "string",
      "description": "User ID"
    },
    "groupId": {
      "type": "string",
      "description": "Group ID"
    }
  }
}

okta_list_group_apps

List all applications assigned to a group.

Args:

groupId: Group ID

Returns: Array of applications assigned to the group.

{
  "type": "object",
  "required": [
    "groupId"
  ],
  "properties": {
    "groupId": {
      "type": "string",
      "description": "Group ID"
    }
  }
}

okta_list_group_rules

List all group rules.

Args:

limit: Number of rules to return
after: Pagination cursor

Returns: Paginated list of group rules.

{
  "type": "object",
  "properties": {
    "after": {
      "type": "string",
      "description": "Pagination cursor"
    },
    "limit": {
      "type": "integer",
      "default": 20,
      "maximum": 200,
      "minimum": 1,
      "description": "Number of rules to return"
    }
  }
}

okta_get_group_rule

Get a specific group rule by ID.

Args:

ruleId: Rule ID

Returns: The group rule details.

{
  "type": "object",
  "required": [
    "ruleId"
  ],
  "properties": {
    "ruleId": {
      "type": "string",
      "description": "Rule ID"
    }
  }
}

okta_create_group_rule

Create a group rule to dynamically add users to groups.

Args:

name: Rule name
groupIds: Target group IDs
expression: Okta Expression Language condition (e.g., "user.department == 'Engineering'")

Returns: The created group rule.

{
  "type": "object",
  "required": [
    "name",
    "groupIds",
    "expression"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "Rule name"
    },
    "groupIds": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Target group IDs"
    },
    "expression": {
      "type": "string",
      "description": "Okta Expression condition"
    }
  }
}

okta_delete_group_rule

Delete a group rule.

Args:

ruleId: Rule ID to delete

Returns: Confirmation of deletion.

{
  "type": "object",
  "required": [
    "ruleId"
  ],
  "properties": {
    "ruleId": {
      "type": "string",
      "description": "Rule ID"
    }
  }
}

okta_activate_group_rule

Activate a group rule.

Args:

ruleId: Rule ID

Returns: Confirmation of activation.

{
  "type": "object",
  "required": [
    "ruleId"
  ],
  "properties": {
    "ruleId": {
      "type": "string",
      "description": "Rule ID"
    }
  }
}

okta_deactivate_group_rule

Deactivate a group rule.

Args:

ruleId: Rule ID

Returns: Confirmation of deactivation.

{
  "type": "object",
  "required": [
    "ruleId"
  ],
  "properties": {
    "ruleId": {
      "type": "string",
      "description": "Rule ID"
    }
  }
}

okta_list_policy_rules

List rules for a policy.

Args:

policyId: Policy ID

Returns: Array of policy rules.

{
  "type": "object",
  "required": [
    "policyId"
  ],
  "properties": {
    "policyId": {
      "type": "string",
      "description": "Policy ID"
    }
  }
}

okta_list_identity_providers

List configured identity providers.

Args:

limit: Number to return (1-200, default: 20)
after: Pagination cursor
type: Filter by IdP type (SAML2, OIDC, GOOGLE, FACEBOOK, etc.)
format: Response format

Returns: Paginated list of identity providers.

{
  "type": "object",
  "properties": {
    "type": {
      "type": "string",
      "description": "IdP type filter"
    },
    "after": {
      "type": "string",
      "description": "Pagination cursor"
    },
    "limit": {
      "type": "integer",
      "default": 20,
      "maximum": 200,
      "minimum": 1,
      "description": "Number to return"
    },
    "format": {
      "enum": [
        "json",
        "markdown"
      ],
      "type": "string"
    }
  }
}

okta_get_identity_provider

Get an identity provider by ID.

Args:

idpId: Identity provider ID

Returns: The identity provider record with protocol and policy configuration.

{
  "type": "object",
  "required": [
    "idpId"
  ],
  "properties": {
    "idpId": {
      "type": "string",
      "description": "Identity provider ID"
    }
  }
}

okta_activate_identity_provider

Activate an identity provider.

Args:

idpId: Identity provider ID

Returns: Confirmation of activation.

{
  "type": "object",
  "required": [
    "idpId"
  ],
  "properties": {
    "idpId": {
      "type": "string",
      "description": "Identity provider ID"
    }
  }
}

okta_get_logs

Query the Okta system log for audit and troubleshooting.

Args:

since: Start date (ISO 8601 format, e.g., "2024-01-01T00:00:00Z")
until: End date (ISO 8601 format)
filter: SCIM filter expression (e.g., 'eventType eq "user.session.start"')
q: Keyword search query
limit: Number of events to return (1-1000, default: 100)
after: Pagination cursor
sortOrder: ASCENDING or DESCENDING (default: DESCENDING)
format: Response format

Returns: Paginated list of log events.

{
  "type": "object",
  "properties": {
    "q": {
      "type": "string",
      "description": "Keyword search"
    },
    "after": {
      "type": "string",
      "description": "Pagination cursor"
    },
    "limit": {
      "type": "integer",
      "default": 100,
      "maximum": 1000,
      "minimum": 1,
      "description": "Number of events"
    },
    "since": {
      "type": "string",
      "description": "Start date (ISO 8601)"
    },
    "until": {
      "type": "string",
      "description": "End date (ISO 8601)"
    },
    "filter": {
      "type": "string",
      "description": "SCIM filter expression"
    },
    "format": {
      "enum": [
        "json",
        "markdown"
      ],
      "type": "string"
    },
    "sortOrder": {
      "enum": [
        "ASCENDING",
        "DESCENDING"
      ],
      "type": "string",
      "default": "DESCENDING",
      "description": "Sort order"
    }
  }
}

okta_get_login_events

Get user login/logout events from the system log.

Args:

since: Start date (ISO 8601 format)
until: End date (ISO 8601 format)
userId: Filter by user ID
limit: Number of events to return
format: Response format

Returns: List of login-related events.

{
  "type": "object",
  "properties": {
    "limit": {
      "type": "integer",
      "default": 100,
      "maximum": 1000,
      "minimum": 1,
      "description": "Number of events"
    },
    "since": {
      "type": "string",
      "description": "Start date (ISO 8601)"
    },
    "until": {
      "type": "string",
      "description": "End date (ISO 8601)"
    },
    "format": {
      "enum": [
        "json",
        "markdown"
      ],
      "type": "string"
    },
    "userId": {
      "type": "string",
      "description": "Filter by user ID"
    }
  }
}

okta_get_security_events

Get security-related events from the system log (suspicious activity, policy violations).

Args:

since: Start date (ISO 8601 format)
until: End date (ISO 8601 format)
limit: Number of events to return
format: Response format

Returns: List of security-related events.

{
  "type": "object",
  "properties": {
    "limit": {
      "type": "integer",
      "default": 100,
      "maximum": 1000,
      "minimum": 1,
      "description": "Number of events"
    },
    "since": {
      "type": "string",
      "description": "Start date (ISO 8601)"
    },
    "until": {
      "type": "string",
      "description": "End date (ISO 8601)"
    },
    "format": {
      "enum": [
        "json",
        "markdown"
      ],
      "type": "string"
    }
  }
}

okta_get_admin_events

Get administrative events from the system log (user/group/app changes).

Args:

since: Start date (ISO 8601 format)
until: End date (ISO 8601 format)
limit: Number of events to return
format: Response format

Returns: List of administrative events.

{
  "type": "object",
  "properties": {
    "limit": {
      "type": "integer",
      "default": 100,
      "maximum": 1000,
      "minimum": 1,
      "description": "Number of events"
    },
    "since": {
      "type": "string",
      "description": "Start date (ISO 8601)"
    },
    "until": {
      "type": "string",
      "description": "End date (ISO 8601)"
    },
    "format": {
      "enum": [
        "json",
        "markdown"
      ],
      "type": "string"
    }
  }
}

okta_list_policies

List policies of a specific type.

Args:

type: Policy type (OKTA_SIGN_ON, PASSWORD, MFA_ENROLL, OAUTH_AUTHORIZATION_POLICY, IDP_DISCOVERY, ACCESS_POLICY, PROFILE_ENROLLMENT)
format: Response format

Returns: Array of policies.

{
  "type": "object",
  "properties": {
    "format": {
      "enum": [
        "json",
        "markdown"
      ],
      "type": "string"
    }
  }
}

okta_get_policy

Get a policy by ID.

Args:

policyId: Policy ID

Returns: The policy record.

{
  "type": "object",
  "required": [
    "policyId"
  ],
  "properties": {
    "policyId": {
      "type": "string",
      "description": "Policy ID"
    }
  }
}

okta_create_policy

Create a new policy.

Args:

type: Policy type
name: Policy name
description: Policy description
priority: Policy priority (1 is highest)

Returns: The created policy.

{
  "type": "object",
  "required": [
    "name"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "Policy name"
    },
    "priority": {
      "type": "integer",
      "minimum": 1,
      "description": "Policy priority"
    },
    "description": {
      "type": "string",
      "description": "Policy description"
    }
  }
}

okta_update_policy

Update a policy.

Args:

policyId: Policy ID
name: Policy name
description: Policy description
priority: Policy priority

Returns: The updated policy.

{
  "type": "object",
  "required": [
    "policyId",
    "name"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "Policy name"
    },
    "policyId": {
      "type": "string",
      "description": "Policy ID"
    },
    "priority": {
      "type": "integer",
      "minimum": 1,
      "description": "Policy priority"
    },
    "description": {
      "type": "string",
      "description": "Policy description"
    }
  }
}

okta_delete_policy

Delete a policy.

Args:

policyId: Policy ID

Returns: Confirmation of deletion.

{
  "type": "object",
  "required": [
    "policyId"
  ],
  "properties": {
    "policyId": {
      "type": "string",
      "description": "Policy ID"
    }
  }
}

okta_get_policy_rule

Get a specific policy rule.

Args:

policyId: Policy ID
ruleId: Rule ID

Returns: The policy rule.

{
  "type": "object",
  "required": [
    "policyId",
    "ruleId"
  ],
  "properties": {
    "ruleId": {
      "type": "string",
      "description": "Rule ID"
    },
    "policyId": {
      "type": "string",
      "description": "Policy ID"
    }
  }
}

okta_delete_policy_rule

Delete a policy rule.

Args:

policyId: Policy ID
ruleId: Rule ID

Returns: Confirmation of deletion.

{
  "type": "object",
  "required": [
    "policyId",
    "ruleId"
  ],
  "properties": {
    "ruleId": {
      "type": "string",
      "description": "Rule ID"
    },
    "policyId": {
      "type": "string",
      "description": "Policy ID"
    }
  }
}

okta_activate_policy_rule

Activate a policy rule.

Args:

policyId: Policy ID
ruleId: Rule ID

Returns: Confirmation of activation.

{
  "type": "object",
  "required": [
    "policyId",
    "ruleId"
  ],
  "properties": {
    "ruleId": {
      "type": "string",
      "description": "Rule ID"
    },
    "policyId": {
      "type": "string",
      "description": "Policy ID"
    }
  }
}

okta_deactivate_policy_rule

Deactivate a policy rule.

Args:

policyId: Policy ID
ruleId: Rule ID

Returns: Confirmation of deactivation.

{
  "type": "object",
  "required": [
    "policyId",
    "ruleId"
  ],
  "properties": {
    "ruleId": {
      "type": "string",
      "description": "Rule ID"
    },
    "policyId": {
      "type": "string",
      "description": "Policy ID"
    }
  }
}

okta_get_session

Get a session by ID.

Args:

sessionId: Session ID

Returns: The session record with login, expiration, and MFA status.

{
  "type": "object",
  "required": [
    "sessionId"
  ],
  "properties": {
    "sessionId": {
      "type": "string",
      "description": "Session ID"
    }
  }
}

okta_end_session

End/revoke a user session.

Args:

sessionId: Session ID to end

Returns: Confirmation of session termination.

{
  "type": "object",
  "required": [
    "sessionId"
  ],
  "properties": {
    "sessionId": {
      "type": "string",
      "description": "Session ID"
    }
  }
}

okta_refresh_session

Refresh/extend a session.

Args:

sessionId: Session ID to refresh

Returns: The refreshed session with new expiration.

{
  "type": "object",
  "required": [
    "sessionId"
  ],
  "properties": {
    "sessionId": {
      "type": "string",
      "description": "Session ID"
    }
  }
}

okta_list_trusted_origins

List trusted origins for CORS and redirect.

Args:

limit: Number to return (1-200, default: 20)
after: Pagination cursor
filter: Filter expression
format: Response format

Returns: Paginated list of trusted origins.

{
  "type": "object",
  "properties": {
    "after": {
      "type": "string",
      "description": "Pagination cursor"
    },
    "limit": {
      "type": "integer",
      "default": 20,
      "maximum": 200,
      "minimum": 1,
      "description": "Number to return"
    },
    "filter": {
      "type": "string",
      "description": "Filter expression"
    },
    "format": {
      "enum": [
        "json",
        "markdown"
      ],
      "type": "string"
    }
  }
}

okta_get_trusted_origin

Get a trusted origin by ID.

Args:

trustedOriginId: Trusted origin ID

Returns: The trusted origin record.

{
  "type": "object",
  "required": [
    "trustedOriginId"
  ],
  "properties": {
    "trustedOriginId": {
      "type": "string",
      "description": "Trusted origin ID"
    }
  }
}

okta_create_trusted_origin

Create a trusted origin for CORS/redirect.

Args:

name: Origin name
origin: Origin URL (e.g., "https://example.com")
scopes: Array of scope types - CORS, REDIRECT, or both

Returns: The created trusted origin.

{
  "type": "object",
  "required": [
    "name",
    "origin",
    "scopes"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "Origin name"
    },
    "origin": {
      "type": "string",
      "description": "Origin URL"
    },
    "scopes": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Scope types"
    }
  }
}

okta_update_trusted_origin

Update a trusted origin.

Args:

trustedOriginId: Trusted origin ID
name: Origin name
origin: Origin URL
scopes: Array of scope types

Returns: The updated trusted origin.

{
  "type": "object",
  "required": [
    "trustedOriginId",
    "name",
    "origin",
    "scopes"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "Origin name"
    },
    "origin": {
      "type": "string",
      "description": "Origin URL"
    },
    "scopes": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Scope types"
    },
    "trustedOriginId": {
      "type": "string",
      "description": "Trusted origin ID"
    }
  }
}

okta_delete_trusted_origin

Delete a trusted origin.

Args:

trustedOriginId: Trusted origin ID

Returns: Confirmation of deletion.

{
  "type": "object",
  "required": [
    "trustedOriginId"
  ],
  "properties": {
    "trustedOriginId": {
      "type": "string",
      "description": "Trusted origin ID"
    }
  }
}

okta_activate_trusted_origin

Activate a trusted origin.

Args:

trustedOriginId: Trusted origin ID

Returns: Confirmation of activation.

{
  "type": "object",
  "required": [
    "trustedOriginId"
  ],
  "properties": {
    "trustedOriginId": {
      "type": "string",
      "description": "Trusted origin ID"
    }
  }
}

okta_deactivate_trusted_origin

Deactivate a trusted origin.

Args:

trustedOriginId: Trusted origin ID

Returns: Confirmation of deactivation.

{
  "type": "object",
  "required": [
    "trustedOriginId"
  ],
  "properties": {
    "trustedOriginId": {
      "type": "string",
      "description": "Trusted origin ID"
    }
  }
}

okta_list_users

List users from Okta with pagination and filtering.

Args:

limit: Number of users to return (1-200, default: 20)
after: Pagination cursor from previous response
search: Search expression (e.g., 'profile.email eq "john@example.com"')
filter: Filter expression (e.g., 'status eq "ACTIVE"')
format: Response format ('json' or 'markdown')

Returns: Paginated list of users with their profiles and status.

{
  "type": "object",
  "properties": {
    "after": {
      "type": "string",
      "description": "Pagination cursor"
    },
    "limit": {
      "type": "integer",
      "default": 20,
      "maximum": 200,
      "minimum": 1,
      "description": "Number of users to return"
    },
    "filter": {
      "type": "string",
      "description": "Filter expression"
    },
    "format": {
      "enum": [
        "json",
        "markdown"
      ],
      "type": "string",
      "default": "json",
      "description": "Response format"
    },
    "search": {
      "type": "string",
      "description": "Search expression"
    }
  }
}

okta_get_user

Get a single user by ID or login.

Args:

userId: The user ID or login (email)
format: Response format

Returns: The user record with profile, status, and credentials info.

{
  "type": "object",
  "required": [
    "userId"
  ],
  "properties": {
    "format": {
      "enum": [
        "json",
        "markdown"
      ],
      "type": "string"
    },
    "userId": {
      "type": "string",
      "description": "User ID or login"
    }
  }
}

okta_create_user

Create a new user in Okta.

Args:

firstName: First name (required)
lastName: Last name (required)
email: Email address (required)
login: Login/username (required, usually email)
mobilePhone: Mobile phone number
secondEmail: Secondary email
password: Initial password (optional, if not set user will need to set on first login)
groupIds: Array of group IDs to add user to
activate: Whether to activate the user immediately (default: true)

Returns: The created user record.

{
  "type": "object",
  "required": [
    "firstName",
    "lastName",
    "email",
    "login"
  ],
  "properties": {
    "email": {
      "type": "string",
      "description": "Email address"
    },
    "login": {
      "type": "string",
      "description": "Login (usually email)"
    },
    "activate": {
      "type": "boolean",
      "default": true,
      "description": "Activate user immediately"
    },
    "groupIds": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Group IDs to add user to"
    },
    "lastName": {
      "type": "string",
      "description": "Last name"
    },
    "password": {
      "type": "string",
      "description": "Initial password"
    },
    "firstName": {
      "type": "string",
      "description": "First name"
    },
    "mobilePhone": {
      "type": "string",
      "description": "Mobile phone"
    },
    "secondEmail": {
      "type": "string",
      "description": "Secondary email"
    }
  }
}

okta_update_user

Update an existing user's profile.

Args:

userId: User ID to update
profile: Profile fields to update (firstName, lastName, email, etc.)

Returns: The updated user record.

{
  "type": "object",
  "required": [
    "userId",
    "profile"
  ],
  "properties": {
    "userId": {
      "type": "string",
      "description": "User ID"
    },
    "profile": {
      "type": "object",
      "description": "Profile fields to update"
    }
  }
}

okta_delete_user

Delete a user from Okta. Note: User must be deactivated first.

Args:

userId: User ID to delete
sendEmail: Send email notification

Returns: Confirmation of deletion.

{
  "type": "object",
  "required": [
    "userId"
  ],
  "properties": {
    "userId": {
      "type": "string",
      "description": "User ID"
    },
    "sendEmail": {
      "type": "boolean",
      "default": false,
      "description": "Send email notification"
    }
  }
}

okta_activate_user

Activate a staged or deprovisioned user.

Args:

userId: User ID to activate
sendEmail: Send activation email (default: true)

Returns: The activated user record or activation token.

{
  "type": "object",
  "required": [
    "userId"
  ],
  "properties": {
    "userId": {
      "type": "string",
      "description": "User ID"
    },
    "sendEmail": {
      "type": "boolean",
      "default": true,
      "description": "Send activation email"
    }
  }
}

okta_deactivate_user

Deactivate an active user. Warning: This is destructive - user is deprovisioned from all apps.

Args:

userId: User ID to deactivate
sendEmail: Send notification email

Returns: Confirmation of deactivation.

{
  "type": "object",
  "required": [
    "userId"
  ],
  "properties": {
    "userId": {
      "type": "string",
      "description": "User ID"
    },
    "sendEmail": {
      "type": "boolean",
      "default": false,
      "description": "Send notification email"
    }
  }
}

okta_suspend_user

Suspend an active user. Suspended users cannot sign in but retain group/app assignments.

Args:

userId: User ID to suspend

Returns: Confirmation of suspension.

{
  "type": "object",
  "required": [
    "userId"
  ],
  "properties": {
    "userId": {
      "type": "string",
      "description": "User ID"
    }
  }
}

okta_unsuspend_user

Unsuspend a suspended user, returning them to active status.

Args:

userId: User ID to unsuspend

Returns: Confirmation of unsuspension.

{
  "type": "object",
  "required": [
    "userId"
  ],
  "properties": {
    "userId": {
      "type": "string",
      "description": "User ID"
    }
  }
}

okta_unlock_user

Unlock a locked-out user.

Args:

userId: User ID to unlock

Returns: Confirmation of unlock.

{
  "type": "object",
  "required": [
    "userId"
  ],
  "properties": {
    "userId": {
      "type": "string",
      "description": "User ID"
    }
  }
}

okta_reset_password

Reset a user's password.

Args:

userId: User ID
sendEmail: Send password reset email (default: true)

Returns: Reset password URL (if sendEmail is false).

{
  "type": "object",
  "required": [
    "userId"
  ],
  "properties": {
    "userId": {
      "type": "string",
      "description": "User ID"
    },
    "sendEmail": {
      "type": "boolean",
      "default": true,
      "description": "Send reset email"
    }
  }
}

okta_expire_password

Expire a user's password, forcing them to change it on next login.

Args:

userId: User ID

Returns: The updated user record.

{
  "type": "object",
  "required": [
    "userId"
  ],
  "properties": {
    "userId": {
      "type": "string",
      "description": "User ID"
    }
  }
}

okta_set_user_password

Set a user's password directly.

Args:

userId: User ID
password: New password

Returns: Confirmation of password change.

{
  "type": "object",
  "required": [
    "userId",
    "password"
  ],
  "properties": {
    "userId": {
      "type": "string",
      "description": "User ID"
    },
    "password": {
      "type": "string",
      "description": "New password"
    }
  }
}

okta_list_user_groups

List all groups a user belongs to.

Args:

userId: User ID

Returns: Array of groups.

{
  "type": "object",
  "required": [
    "userId"
  ],
  "properties": {
    "userId": {
      "type": "string",
      "description": "User ID"
    }
  }
}

okta_list_user_apps

List all applications assigned to a user.

Args:

userId: User ID

Returns: Array of app links.

{
  "type": "object",
  "required": [
    "userId"
  ],
  "properties": {
    "userId": {
      "type": "string",
      "description": "User ID"
    }
  }
}

okta_list_network_zones

List network zones configured in the org.

Args:

limit: Number to return (1-200, default: 20)
after: Pagination cursor
filter: Filter expression
format: Response format

Returns: Paginated list of network zones.

{
  "type": "object",
  "properties": {
    "after": {
      "type": "string",
      "description": "Pagination cursor"
    },
    "limit": {
      "type": "integer",
      "default": 20,
      "maximum": 200,
      "minimum": 1,
      "description": "Number to return"
    },
    "filter": {
      "type": "string",
      "description": "Filter expression"
    },
    "format": {
      "enum": [
        "json",
        "markdown"
      ],
      "type": "string"
    }
  }
}

okta_get_network_zone

Get a network zone by ID.

Args:

zoneId: Zone ID

Returns: The network zone record.

{
  "type": "object",
  "required": [
    "zoneId"
  ],
  "properties": {
    "zoneId": {
      "type": "string",
      "description": "Zone ID"
    }
  }
}

okta_create_network_zone

Create a network zone (IP-based).

Args:

name: Zone name
type: Zone type (IP or DYNAMIC)
gateways: Array of gateways (for IP zones) with type (CIDR or RANGE) and value

Returns: The created network zone.

{
  "type": "object",
  "required": [
    "name"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "Zone name"
    },
    "type": {
      "enum": [
        "IP",
        "DYNAMIC"
      ],
      "type": "string",
      "description": "Zone type"
    }
  }
}

okta_update_network_zone

Update a network zone.

Args:

zoneId: Zone ID
name: Zone name
gateways: Array of gateways with type and value

Returns: The updated network zone.

{
  "type": "object",
  "required": [
    "zoneId"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "Zone name"
    },
    "zoneId": {
      "type": "string",
      "description": "Zone ID"
    }
  }
}

okta_delete_network_zone

Delete a network zone.

Args:

zoneId: Zone ID

Returns: Confirmation of deletion.

{
  "type": "object",
  "required": [
    "zoneId"
  ],
  "properties": {
    "zoneId": {
      "type": "string",
      "description": "Zone ID"
    }
  }
}

okta_activate_network_zone

Activate a network zone.

Args:

zoneId: Zone ID

Returns: Confirmation of activation.

{
  "type": "object",
  "required": [
    "zoneId"
  ],
  "properties": {
    "zoneId": {
      "type": "string",
      "description": "Zone ID"
    }
  }
}

okta_deactivate_network_zone

Deactivate a network zone.

Args:

zoneId: Zone ID

Returns: Confirmation of deactivation.

{
  "type": "object",
  "required": [
    "zoneId"
  ],
  "properties": {
    "zoneId": {
      "type": "string",
      "description": "Zone ID"
    }
  }
}