/okta-users | Type: Application | PCID required: Yes
Tools
okta-users_activate_user
Activate a user Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
id | string | Yes | — | An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user |
sendEmail | boolean | No | — | Sends an activation email to the user if true |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"id": {
"type": "string",
"description": "An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user"
},
"sendEmail": {
"type": "boolean",
"description": "Sends an activation email to the user if `true`"
}
},
"required": [
"PCID",
"id"
]
}
okta-users_change_password
Update password Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
userId | string | Yes | — | ID of an existing Okta user |
strict | boolean | No | — | If true, validates against the password minimum age policy |
newPassword | object | No | — | Specifies a password for a user. When a user has a valid password, imported hashed password, or password hook, and a response object contains a password credential, then the password object is a bare object without the value property defined (for example, password: {}). This indicates that a password value exists. You can modify password policy requirements in the Admin Console by editing the Password authenticator: Security > Authenticators > Password (or for Okta Classic orgs, use Security > Authentication > Password). For information on defaults and configuring your password policies, see Configure the password authenticator in the help documentation. |
oldPassword | object | No | — | Specifies a password for a user. When a user has a valid password, imported hashed password, or password hook, and a response object contains a password credential, then the password object is a bare object without the value property defined (for example, password: {}). This indicates that a password value exists. You can modify password policy requirements in the Admin Console by editing the Password authenticator: Security > Authenticators > Password (or for Okta Classic orgs, use Security > Authentication > Password). For information on defaults and configuring your password policies, see Configure the password authenticator in the help documentation. |
revokeSessions | boolean | No | — | When set to true, revokes all user sessions, except for the current session |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"userId": {
"type": "string",
"description": "ID of an existing Okta user"
},
"strict": {
"type": "boolean",
"description": "If true, validates against the password minimum age policy"
},
"newPassword": {
"type": "object",
"description": "Specifies a password for a user. When a user has a valid password, imported hashed password, or password hook, and a response object contains a password credential, then the password object is a bare object without the value property defined (for example, `password: {}`). This indicates that a password value exists. You can modify password policy requirements in the Admin Console by editing the Password authenticator: **Security** > **Authenticators** > **Password** (or for Okta Classic orgs, use **Security** > **Authentication** > **Password**). For information on defaults and configuring your password policies, see [Configure the password authenticator](https://help.okta.com/okta_help.htm?type=oie&id=ext-configure-password) in the help documentation.",
"properties": {
"hash": {
"type": "object",
"description": "Specifies a hashed password to import into Okta. This allows an existing password to be imported into Okta directly from some other store. Okta supports the BCRYPT, SHA-512, SHA-256, SHA-1, MD5, and PBKDF2 hash functions for password import. A hashed password may be specified in a password object when creating or updating a user, but not for other operations. See the [Create user with imported hashed password](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#create-user-with-imported-hashed-password) description. When you update a user with a hashed password, the user must be in the `STAGED` status."
},
"hook": {
"type": "object",
"description": "Specify a [password import inline hook](/openapi/okta-management/management/tags/inlinehook/createpasswordimportinlinehook) to trigger verification of the user's password the first time the user signs in. This allows an existing password to be imported into Okta directly from some other store."
},
"value": {
"type": "string",
"description": "Specifies the password for a user. The password policy validates this password."
}
}
},
"oldPassword": {
"type": "object",
"description": "Specifies a password for a user. When a user has a valid password, imported hashed password, or password hook, and a response object contains a password credential, then the password object is a bare object without the value property defined (for example, `password: {}`). This indicates that a password value exists. You can modify password policy requirements in the Admin Console by editing the Password authenticator: **Security** > **Authenticators** > **Password** (or for Okta Classic orgs, use **Security** > **Authentication** > **Password**). For information on defaults and configuring your password policies, see [Configure the password authenticator](https://help.okta.com/okta_help.htm?type=oie&id=ext-configure-password) in the help documentation.",
"properties": {
"hash": {
"type": "object",
"description": "Specifies a hashed password to import into Okta. This allows an existing password to be imported into Okta directly from some other store. Okta supports the BCRYPT, SHA-512, SHA-256, SHA-1, MD5, and PBKDF2 hash functions for password import. A hashed password may be specified in a password object when creating or updating a user, but not for other operations. See the [Create user with imported hashed password](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#create-user-with-imported-hashed-password) description. When you update a user with a hashed password, the user must be in the `STAGED` status."
},
"hook": {
"type": "object",
"description": "Specify a [password import inline hook](/openapi/okta-management/management/tags/inlinehook/createpasswordimportinlinehook) to trigger verification of the user's password the first time the user signs in. This allows an existing password to be imported into Okta directly from some other store."
},
"value": {
"type": "string",
"description": "Specifies the password for a user. The password policy validates this password."
}
}
},
"revokeSessions": {
"type": "boolean",
"description": "When set to `true`, revokes all user sessions, except for the current session"
}
},
"required": [
"PCID",
"userId"
]
}
okta-users_change_recovery_question
Update recovery question Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
userId | string | Yes | — | ID of an existing Okta user |
password | object | No | — | Specifies a password for a user. When a user has a valid password, imported hashed password, or password hook, and a response object contains a password credential, then the password object is a bare object without the value property defined (for example, password: {}). This indicates that a password value exists. You can modify password policy requirements in the Admin Console by editing the Password authenticator: Security > Authenticators > Password (or for Okta Classic orgs, use Security > Authentication > Password). For information on defaults and configuring your password policies, see Configure the password authenticator in the help documentation. |
provider | object | No | — | Specifies the authentication provider that validates the user’s password credential. The user’s current provider is managed by the Delegated Authentication settings for your org. The provider object is read-only. |
recovery_question | object | No | — | Specifies a secret question and answer that’s validated (case insensitive) when a user forgets their password or unlocks their account. The answer property is write-only. |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"userId": {
"type": "string",
"description": "ID of an existing Okta user"
},
"password": {
"type": "object",
"description": "Specifies a password for a user. When a user has a valid password, imported hashed password, or password hook, and a response object contains a password credential, then the password object is a bare object without the value property defined (for example, `password: {}`). This indicates that a password value exists. You can modify password policy requirements in the Admin Console by editing the Password authenticator: **Security** > **Authenticators** > **Password** (or for Okta Classic orgs, use **Security** > **Authentication** > **Password**). For information on defaults and configuring your password policies, see [Configure the password authenticator](https://help.okta.com/okta_help.htm?type=oie&id=ext-configure-password) in the help documentation.",
"properties": {
"hash": {
"type": "object",
"description": "Specifies a hashed password to import into Okta. This allows an existing password to be imported into Okta directly from some other store. Okta supports the BCRYPT, SHA-512, SHA-256, SHA-1, MD5, and PBKDF2 hash functions for password import. A hashed password may be specified in a password object when creating or updating a user, but not for other operations. See the [Create user with imported hashed password](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#create-user-with-imported-hashed-password) description. When you update a user with a hashed password, the user must be in the `STAGED` status."
},
"hook": {
"type": "object",
"description": "Specify a [password import inline hook](/openapi/okta-management/management/tags/inlinehook/createpasswordimportinlinehook) to trigger verification of the user's password the first time the user signs in. This allows an existing password to be imported into Okta directly from some other store."
},
"value": {
"type": "string",
"description": "Specifies the password for a user. The password policy validates this password."
}
}
},
"provider": {
"type": "object",
"description": "Specifies the authentication provider that validates the user's password credential. The user's current provider is managed by the **Delegated Authentication** settings for your org. The provider object is **read-only**.",
"properties": {
"name": {
"type": "string",
"description": "The name of the authentication provider"
},
"type": {
"type": "string",
"description": "The type of authentication provider",
"enum": [
"ACTIVE_DIRECTORY",
"FEDERATION",
"IMPORT",
"LDAP",
"OKTA",
"SOCIAL"
]
}
}
},
"recovery_question": {
"type": "object",
"description": "Specifies a secret question and answer that's validated (case insensitive) when a user forgets their password or unlocks their account. The answer property is write-only.",
"properties": {
"answer": {
"type": "string",
"description": "The answer to the recovery question"
},
"question": {
"type": "string",
"description": "The recovery question"
}
}
}
},
"required": [
"PCID",
"userId"
]
}
okta-users_create_user
Create a user Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
activate | boolean | No | — | Executes an activation lifecycle operation when creating the user |
provider | boolean | No | — | Indicates whether to create a user with a specified authentication provider. |
nextLogin | string | No | — | With activate=true, if nextLogin=changePassword, a user is created, activated, and the password is set to EXPIRED. The user must change it the next time they sign in. |
credentials | object | No | — | Specifies primary authentication and recovery credentials for a user. Credential types and requirements vary depending on the provider and security policy of the org. |
groupIds | string[] | No | — | The list of group IDs of groups that the user is added to at the time of creation |
profile | object | Yes | — | Specifies the default and custom profile properties for a user. The default user profile is based on the System for Cross-domain Identity Management: Core Schema. The only permitted customizations of the default profile are to update permissions, change whether the firstName and lastName properties are nullable, and specify a pattern for login. You can use the Profile Editor in the Admin Console or the Schemas API to make schema modifications. You can extend user profiles with custom properties. You must first add the custom property to the user profile schema before you reference it. You can use the Profile Editor in the Admin Console or the Schemas API to manage schema extensions. Custom attributes can contain HTML tags. It’s the client’s responsibility to escape or encode this data before displaying it. Use best-practices to prevent cross-site scripting. |
realmId | string | No | — | The ID of the realm in which the user is residing. See Realms. |
type | object | No | — | The ID of the user type. Add this value if you want to create a user with a non-default User Type. The user type determines which schema applies to that user. After a user has been created, the user can only be assigned a different user type by an administrator through a full replacement (PUT) operation. |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"activate": {
"type": "boolean",
"description": "Executes an [activation lifecycle](https://developer.okta.com/docs/api/openapi/okta-management/management/userlifecycle/activateuser) operation when creating the user"
},
"provider": {
"type": "boolean",
"description": "Indicates whether to create a user with a specified authentication provider."
},
"nextLogin": {
"type": "string",
"description": "With `activate=true`, if `nextLogin=changePassword`, a user is created, activated, and the password is set to `EXPIRED`. The user must change it the next time they sign in.",
"enum": [
"changePassword"
]
},
"credentials": {
"type": "object",
"description": "Specifies primary authentication and recovery credentials for a user. Credential types and requirements vary depending on the provider and security policy of the org.",
"properties": {
"password": {
"type": "object",
"description": "Specifies a password for a user. When a user has a valid password, imported hashed password, or password hook, and a response object contains a password credential, then the password object is a bare object without the value property defined (for example, `password: {}`). This indicates that a password value exists. You can modify password policy requirements in the Admin Console by editing the Password authenticator: **Security** > **Authenticators** > **Password** (or for Okta Classic orgs, use **Security** > **Authentication** > **Password**). For information on defaults and configuring your password policies, see [Configure the password authenticator](https://help.okta.com/okta_help.htm?type=oie&id=ext-configure-password) in the help documentation."
},
"provider": {
"type": "object",
"description": "Specifies the authentication provider that validates the user password credential. The user's current provider is managed by the **Delegated Authentication** settings in your org. See [Create user with authentication provider](/openapi/okta-management/management/user/create-user-with-password-and-recovery-question#user/Create-user-with-authentication-provider)."
},
"recovery_question": {
"type": "object",
"description": "Specifies a secret question and answer that's validated (case insensitive) when a user forgets their password or unlocks their account. The answer property is write-only."
}
}
},
"groupIds": {
"type": "array",
"items": {
"type": "string"
},
"description": "The list of group IDs of groups that the user is added to at the time of creation"
},
"profile": {
"type": "object",
"description": "Specifies the default and custom profile properties for a user. The default user profile is based on the [System for Cross-domain Identity Management: Core Schema](https://datatracker.ietf.org/doc/html/rfc7643). The only permitted customizations of the default profile are to update permissions, change whether the `firstName` and `lastName` properties are nullable, and specify a [pattern](https://developer.okta.com/docs/reference/api/schemas/#login-pattern-validation) for `login`. You can use the Profile Editor in the Admin Console or the [Schemas API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UISchema/#tag/UISchema) to make schema modifications. You can extend user profiles with custom properties. You must first add the custom property to the user profile schema before you reference it. You can use the Profile Editor in the Admin Console or the [Schemas API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UISchema/#tag/UISchema) to manage schema extensions. Custom attributes can contain HTML tags. It's the client's responsibility to escape or encode this data before displaying it. Use [best-practices](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) to prevent cross-site scripting.",
"properties": {
"city": {
"type": "string",
"description": "The city or locality of the user's address (`locality`)"
},
"costCenter": {
"type": "string",
"description": "Name of the cost center assigned to a user"
},
"countryCode": {
"type": "string",
"description": "The country name component of the user's address (`country`). For validation, see [ISO 3166-1 alpha 2 \"short\" code format](https://datatracker.ietf.org/doc/html/draft-ietf-scim-core-schema-22#ref-ISO3166)."
},
"department": {
"type": "string",
"description": "Name of the user's department"
},
"displayName": {
"type": "string",
"description": "Name of the user suitable for display to end users"
},
"division": {
"type": "string",
"description": "Name of the user's division"
},
"email": {
"type": "string",
"description": "The primary email address of the user. For validation, see [RFC 5322 Section 3.2.3](https://datatracker.ietf.org/doc/html/rfc5322#section-3.2.3)."
},
"employeeNumber": {
"type": "string",
"description": "The organization or company assigned unique identifier for the user"
},
"firstName": {
"type": "string",
"description": "Given name of the user (`givenName`)"
},
"honorificPrefix": {
"type": "string",
"description": "Honorific prefix(es) of the user, or title in most Western languages"
},
"honorificSuffix": {
"type": "string",
"description": "Honorific suffix(es) of the user"
},
"lastName": {
"type": "string",
"description": "The family name of the user (`familyName`)"
},
"locale": {
"type": "string",
"description": "The user's default location for purposes of localizing items such as currency, date time format, numerical representations, and so on. A locale value is a concatenation of the ISO 639-1 two-letter language code, an underscore, and the ISO 3166-1 two-letter country code. For example, en_US specifies the language English and country US. This value is `en_US` by default."
},
"login": {
"type": "string",
"description": "The unique identifier for the user (`username`). For validation, see [Login pattern validation](https://developer.okta.com/docs/reference/api/schemas/#login-pattern-validation). Every user within your Okta org must have a unique identifier for a login. This constraint applies to all users you import from other systems or applications such as Active Directory. Your organization is the top-level namespace to mix and match logins from all your connected applications or directories. Careful consideration of naming conventions for your login identifier will make it easier to onboard new applications in the future. Logins are not considered unique if they differ only in case and/or diacritical marks. If one of your users has a login of `Isaac.Brock@example.com`, there cannot be another user whose login is `isaac.brock@example.com`, nor `isáàc.bröck@example.com`. Okta has a default ambiguous name resolution policy for usernames that include @-signs. By default, usernames must be formatted as email addresses and thus always include @-signs. You can remove that restriction using either the Admin Console or the [Schemas API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/). Users can sign in with their non-qualified short name (for example: `isaac.brock` with username `isaac.brock@example.com`) as long as the short name is still unique within the org."
},
"manager": {
"type": "string",
"description": "The `displayName` of the user's manager"
},
"managerId": {
"type": "string",
"description": "The `id` of the user's manager"
},
"middleName": {
"type": "string",
"description": "The middle name of the user"
},
"mobilePhone": {
"type": "string",
"description": "The mobile phone number of the user"
},
"nickName": {
"type": "string",
"description": "The casual way to address the user in real life"
},
"organization": {
"type": "string",
"description": "Name of the the user's organization"
},
"postalAddress": {
"type": "string",
"description": "Mailing address component of the user's address"
},
"preferredLanguage": {
"type": "string",
"description": "The user's preferred written or spoken language. For validation, see [RFC 7231 Section 5.3.5](https://datatracker.ietf.org/doc/html/rfc7231#section-5.3.5)."
},
"primaryPhone": {
"type": "string",
"description": "The primary phone number of the user such as a home number"
},
"profileUrl": {
"type": "string",
"description": "The URL of the user's online profile. For example, a web page. See [URL](https://datatracker.ietf.org/doc/html/rfc1808)."
},
"secondEmail": {
"type": "string",
"description": "The secondary email address of the user typically used for account recovery. For validation, see [RFC 5322 Section 3.2.3](https://datatracker.ietf.org/doc/html/rfc5322#section-3.2.3)."
},
"state": {
"type": "string",
"description": "The state or region component of the user's address (`region`)"
},
"streetAddress": {
"type": "string",
"description": "The full street address component of the user's address"
},
"timezone": {
"type": "string",
"description": "The user's time zone"
},
"title": {
"type": "string",
"description": "The user's title, such as Vice President"
},
"userType": {
"type": "string",
"description": "The property used to describe the organization-to-user relationship, such as employee or contractor > **Note:** The `userType` property is a standard string attribute and should be treated as a descriptive label rather than a functional setting. Unlike a user's assigned user [`type`](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#tag/User/operation/createUser!path=type&t=request), this property is purely informational and doesn't influence the behavior of the Okta platform."
},
"zipCode": {
"type": "string",
"description": "The ZIP code or postal code component of the user's address (`postalCode`)"
}
}
},
"realmId": {
"type": "string",
"description": "The ID of the realm in which the user is residing. See [Realms](/openapi/okta-management/management/tags/realm)."
},
"type": {
"type": "object",
"description": "The ID of the user type. Add this value if you want to create a user with a non-default [User Type](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/). The user type determines which [schema](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/) applies to that user. After a user has been created, the user can only be assigned a different user type by an administrator through a full replacement (`PUT`) operation.",
"properties": {
"id": {
"type": "string",
"description": "The ID of the user type"
}
}
}
},
"required": [
"PCID",
"profile"
]
}
okta-users_create_user_type
Create a user type Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
_links | object | No | — | The links value |
created | string | No | — | A timestamp from when the user type was created |
createdBy | string | No | — | The user ID of the account that created the user type |
default | boolean | No | — | A boolean value to indicate if this is the default user type |
description | string | No | — | The human-readable description of the user type |
displayName | string | Yes | — | The human-readable name of the user type |
id | string | No | — | The unique key for the user type |
lastUpdated | string | No | — | A timestamp from when the user type was most recently updated |
lastUpdatedBy | string | No | — | The user ID of the most recent account to edit the user type |
name | string | Yes | — | The name of the user type. The name must start with A-Z or a-z and contain only A-Z, a-z, 0-9, or underscore (_) characters. This value becomes read-only after creation and can’t be updated. |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"_links": {
"description": "The links value"
},
"created": {
"type": "string",
"description": "A timestamp from when the user type was created"
},
"createdBy": {
"type": "string",
"description": "The user ID of the account that created the user type"
},
"default": {
"type": "boolean",
"description": "A boolean value to indicate if this is the default user type"
},
"description": {
"type": "string",
"description": "The human-readable description of the user type"
},
"displayName": {
"type": "string",
"description": "The human-readable name of the user type"
},
"id": {
"type": "string",
"description": "The unique key for the user type"
},
"lastUpdated": {
"type": "string",
"description": "A timestamp from when the user type was most recently updated"
},
"lastUpdatedBy": {
"type": "string",
"description": "The user ID of the most recent account to edit the user type"
},
"name": {
"type": "string",
"description": "The name of the user type. The name must start with A-Z or a-z and contain only A-Z, a-z, 0-9, or underscore (_) characters. This value becomes read-only after creation and can't be updated."
}
},
"required": [
"PCID",
"displayName",
"name"
]
}
okta-users_deactivate_user
Deactivate a user Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
id | string | Yes | — | An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user |
sendEmail | boolean | No | — | Sends a deactivation email to the admin if true |
Prefer | string | No | — | Request asynchronous processing |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"id": {
"type": "string",
"description": "An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user"
},
"sendEmail": {
"type": "boolean",
"description": "Sends a deactivation email to the admin if `true`"
},
"Prefer": {
"type": "string",
"description": "Request asynchronous processing",
"enum": [
"respond-async"
]
}
},
"required": [
"PCID",
"id"
]
}
okta-users_delete_user
Delete a user Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
id | string | Yes | — | An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user |
sendEmail | boolean | No | — | Sends a deactivation email to the admin if true |
Prefer | string | No | — | The prefer value |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"id": {
"type": "string",
"description": "An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user"
},
"sendEmail": {
"type": "boolean",
"description": "Sends a deactivation email to the admin if `true`"
},
"Prefer": {
"type": "string",
"description": "The prefer value",
"enum": [
"respond-async"
]
}
},
"required": [
"PCID",
"id"
]
}
okta-users_delete_user_type
Delete a user type Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
typeId | string | Yes | — | The unique key for the user type |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"typeId": {
"type": "string",
"description": "The unique key for the user type"
}
},
"required": [
"PCID",
"typeId"
]
}
okta-users_expire_password
Expire the password Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
id | string | Yes | — | An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"id": {
"type": "string",
"description": "An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user"
}
},
"required": [
"PCID",
"id"
]
}
okta-users_expire_password_with_temp_password
Expire the password with a temporary password Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
id | string | Yes | — | An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user |
revokeSessions | boolean | No | — | Revokes the user’s existing sessions if true |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"id": {
"type": "string",
"description": "An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user"
},
"revokeSessions": {
"type": "boolean",
"description": "Revokes the user's existing sessions if `true`"
}
},
"required": [
"PCID",
"id"
]
}
okta-users_forgot_password
Start forgot password flow Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
userId | string | Yes | — | ID of an existing Okta user |
sendEmail | boolean | No | — | Sends a forgot password email to the user if true |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"userId": {
"type": "string",
"description": "ID of an existing Okta user"
},
"sendEmail": {
"type": "boolean",
"description": "Sends a forgot password email to the user if `true`"
}
},
"required": [
"PCID",
"userId"
]
}
okta-users_forgot_password_set_new_password
Reset password with recovery question Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
userId | string | Yes | — | ID of an existing Okta user |
sendEmail | boolean | No | — | Send Email |
password | object | No | — | Specifies a password for a user. When a user has a valid password, imported hashed password, or password hook, and a response object contains a password credential, then the password object is a bare object without the value property defined (for example, password: {}). This indicates that a password value exists. You can modify password policy requirements in the Admin Console by editing the Password authenticator: Security > Authenticators > Password (or for Okta Classic orgs, use Security > Authentication > Password). For information on defaults and configuring your password policies, see Configure the password authenticator in the help documentation. |
provider | object | No | — | Specifies the authentication provider that validates the user’s password credential. The user’s current provider is managed by the Delegated Authentication settings for your org. The provider object is read-only. |
recovery_question | object | No | — | Specifies a secret question and answer that’s validated (case insensitive) when a user forgets their password or unlocks their account. The answer property is write-only. |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"userId": {
"type": "string",
"description": "ID of an existing Okta user"
},
"sendEmail": {
"type": "boolean",
"description": "Send Email"
},
"password": {
"type": "object",
"description": "Specifies a password for a user. When a user has a valid password, imported hashed password, or password hook, and a response object contains a password credential, then the password object is a bare object without the value property defined (for example, `password: {}`). This indicates that a password value exists. You can modify password policy requirements in the Admin Console by editing the Password authenticator: **Security** > **Authenticators** > **Password** (or for Okta Classic orgs, use **Security** > **Authentication** > **Password**). For information on defaults and configuring your password policies, see [Configure the password authenticator](https://help.okta.com/okta_help.htm?type=oie&id=ext-configure-password) in the help documentation.",
"properties": {
"hash": {
"type": "object",
"description": "Specifies a hashed password to import into Okta. This allows an existing password to be imported into Okta directly from some other store. Okta supports the BCRYPT, SHA-512, SHA-256, SHA-1, MD5, and PBKDF2 hash functions for password import. A hashed password may be specified in a password object when creating or updating a user, but not for other operations. See the [Create user with imported hashed password](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#create-user-with-imported-hashed-password) description. When you update a user with a hashed password, the user must be in the `STAGED` status."
},
"hook": {
"type": "object",
"description": "Specify a [password import inline hook](/openapi/okta-management/management/tags/inlinehook/createpasswordimportinlinehook) to trigger verification of the user's password the first time the user signs in. This allows an existing password to be imported into Okta directly from some other store."
},
"value": {
"type": "string",
"description": "Specifies the password for a user. The password policy validates this password."
}
}
},
"provider": {
"type": "object",
"description": "Specifies the authentication provider that validates the user's password credential. The user's current provider is managed by the **Delegated Authentication** settings for your org. The provider object is **read-only**.",
"properties": {
"name": {
"type": "string",
"description": "The name of the authentication provider"
},
"type": {
"type": "string",
"description": "The type of authentication provider",
"enum": [
"ACTIVE_DIRECTORY",
"FEDERATION",
"IMPORT",
"LDAP",
"OKTA",
"SOCIAL"
]
}
}
},
"recovery_question": {
"type": "object",
"description": "Specifies a secret question and answer that's validated (case insensitive) when a user forgets their password or unlocks their account. The answer property is write-only.",
"properties": {
"answer": {
"type": "string",
"description": "The answer to the recovery question"
},
"question": {
"type": "string",
"description": "The recovery question"
}
}
}
},
"required": [
"PCID",
"userId"
]
}
okta-users_get_user
Retrieve a user Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
id | string | Yes | — | An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user |
Content-Type | string | No | — | Specifies the media type of the resource. Optional okta-response value can be included for performance optimization. Complex DelAuth configurations may degrade performance when fetching specific parts of the response, and passing this parameter can omit these parts, bypassing the bottleneck. Enum values for okta-response: * omitCredentials: Omits the credentials subobject from the response. * omitCredentialsLinks: Omits the following HAL links from the response: Update password, Change recovery question, Start forgot password flow, Reset password, Reset factors, Unlock. * omitTransitioningToStatus: Omits the transitioningToStatus field from the response. |
expand | string | No | — | An optional parameter to include metadata in the _embedded attribute. Valid values: blocks or <x-lifecycle class=“ea”></x-lifecycle> classification. |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"id": {
"type": "string",
"description": "An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user"
},
"Content-Type": {
"type": "string",
"description": "Specifies the media type of the resource. Optional `okta-response` value can be included for performance optimization. Complex DelAuth configurations may degrade performance when fetching specific parts of the response, and passing this parameter can omit these parts, bypassing the bottleneck. Enum values for `okta-response`: * `omitCredentials`: Omits the credentials subobject from the response. * `omitCredentialsLinks`: Omits the following HAL links from the response: Update password, Change recovery question, Start forgot password flow, Reset password, Reset factors, Unlock. * `omitTransitioningToStatus`: Omits the `transitioningToStatus` field from the response."
},
"expand": {
"type": "string",
"description": "An optional parameter to include metadata in the `_embedded` attribute. Valid values: `blocks` or <x-lifecycle class=\"ea\"></x-lifecycle> `classification`."
}
},
"required": [
"PCID",
"id"
]
}
okta-users_get_user_type
Retrieve a user type Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
typeId | string | Yes | — | The unique key for the user type |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"typeId": {
"type": "string",
"description": "The unique key for the user type"
}
},
"required": [
"PCID",
"typeId"
]
}
okta-users_list_user_blocks
List all user blocks Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
id | string | Yes | — | An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"id": {
"type": "string",
"description": "An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user"
}
},
"required": [
"PCID",
"id"
]
}
okta-users_list_user_types
List all user typesShow inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
}
},
"required": [
"PCID"
]
}
okta-users_list_users
List all users Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
Content-Type | string | No | — | Specifies the media type of the resource. Optional okta-response value can be included for performance optimization. Complex DelAuth configurations may degrade performance when fetching specific parts of the response, and passing this parameter can omit these parts, bypassing the bottleneck. Enum values for okta-response: * omitCredentials: Omits the credentials subobject from the response. * omitCredentialsLinks: Omits the following HAL links from the response: Update password, Change recovery question, Start forgot password flow, Reset password, Reset factors, Unlock. * omitTransitioningToStatus: Omits the transitioningToStatus field from the response. |
search | string | No | — | Searches for users with a supported filtering expression for most properties. Okta recommends this query parameter because it provides the largest range of search options and optimal performance. > Note: Using an overly complex or long search query can result in an error. This operation supports pagination. Use an ID lookup for records that you update to ensure your results contain the latest data. Returned users include those with the DEPROVISIONED status. Property names in the search parameter are case sensitive, whereas operators (eq, sw, and so on) and string values are case insensitive. Unlike with user logins, diacritical marks are significant in search string values: a search for isaac.brock finds Isaac.Brock, but doesn’t find a property whose value is isáàc.bröck. This operation requires URL encoding. See Special characters. This operation searches many properties: * Any user profile attribute, including custom-defined attributes * The top-level properties: id, status, created, activated, statusChanged, and lastUpdated * The user type accessed as type.id * Properties that have array values > Note: <x-lifecycle class=“ea”></x-lifecycle> The ability to search by user classification is available as an Early Access feature. The classification.type property cannot be used in conjunction with other search terms. You can search using classification.type eq "LITE" or classification.type eq "STANDARD". You can also use sortBy and sortOrder parameters. The ne (not equal) operator isn’t supported, but you can obtain the same result by using lt ... or ... gt. For example, to see all users except those that have a status of STAGED, use (status lt "STAGED" or status gt "STAGED"). You can search properties that are arrays. If any element matches the search term, the entire array (object) is returned. Okta follows the SCIM Protocol Specification for searching arrays. You can search multiple arrays, multiple values in an array, as well as using the standard logical and filtering operators. See Filter. Searches for users can be filtered by the following operators: sw, eq, and co. You can only use co with these select user profile attributes: profile.firstName, profile.lastName, profile.email, and profile.login. See Operators. |
filter | string | No | — | Filters users with a supported expression for a subset of properties. > Note: Returned users include those with the DEPROVISIONED status. This requires URL encoding. For example, filter=lastUpdated gt "2013-06-01T00:00:00.000Z" is encoded as filter=lastUpdated%20gt%20%222013-06-01T00:00:00.000Z%22. Filtering is case-sensitive for property names and query values, while operators are case-insensitive. Filtering supports the following limited number of properties: status, lastUpdated, id, profile.login, profile.email, profile.firstName, and profile.lastName. Additionally, filtering supports only the equal eq operator from the standard Okta API filtering semantics, except in the case of the lastUpdated property. This property can also use the inequality operators (gt, ge, lt, and le). For logical operators, only the logical operators and and or are supported. The not operator isn’t supported. See Filter and Operators. |
q | string | No | — | Finds users who match the specified query. Use the q parameter for simple queries, such as a lookup of users by name when creating a people picker. The value of q is matched against firstName, lastName, or email. This performs a startsWith match, but this is an implementation detail and can change without notice. You don’t need to specify firstName, lastName, or email. > Notes: > * Using the q parameter in a request omits users that have a status of DEPROVISIONED. To return all users, use a filter or search query instead. > * This doesn’t support pagination, but you can use limit. > * This isn’t designed for large data sets. For optimal performance, use the search parameter instead. |
after | string | No | — | The cursor to use for pagination. It is an opaque string that specifies your current location in the list and is obtained from the Link response header. See Pagination and Link header. |
limit | integer | No | — | Specifies the number of results returned. Defaults to 10 if q is provided. You can use limit with after to define the cursor location in the data set and manage the user records per page. |
sortBy | string | No | — | Specifies the field to sort by (for search queries only). This can be any single property, for example sortBy=profile.lastName. Users with the same value for the sortBy property are ordered by id. Use with sortOrder to control the order of results. |
sortOrder | string | No | — | Specifies sort order: asc or desc (for search queries only). This parameter is ignored if sortBy isn’t present. |
fields | string | No | — | Specifies a select set of user properties to query. Any other properties will be filtered out of the returned users. This is often called field projections in APIs, which can reduce payload size, improve performance, and limit unneccessary data exposure. Requested fields should be comma-separated. Comma-separate the fields and place sub-fields in the profile object inside a profile:() directive, for example profile:(firstName, city). The id field is always included, regardless of whether it’s specified in the fields parameter. |
expand | string | No | — | <x-lifecycle-container><x-lifecycle class=“ea”></x-lifecycle></x-lifecycle-container>A parameter to include metadata in the _embedded property. Supported value: classification. |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"Content-Type": {
"type": "string",
"description": "Specifies the media type of the resource. Optional `okta-response` value can be included for performance optimization. Complex DelAuth configurations may degrade performance when fetching specific parts of the response, and passing this parameter can omit these parts, bypassing the bottleneck. Enum values for `okta-response`: * `omitCredentials`: Omits the credentials subobject from the response. * `omitCredentialsLinks`: Omits the following HAL links from the response: Update password, Change recovery question, Start forgot password flow, Reset password, Reset factors, Unlock. * `omitTransitioningToStatus`: Omits the `transitioningToStatus` field from the response."
},
"search": {
"type": "string",
"description": "Searches for users with a supported filtering expression for most properties. Okta recommends this query parameter because it provides the largest range of search options and optimal performance. > **Note:** Using an overly complex or long search query can result in an error. This operation supports [pagination](https://developer.okta.com/docs/api/#pagination). Use an ID lookup for records that you update to ensure your results contain the latest data. Returned users include those with the `DEPROVISIONED` status. Property names in the search parameter are case sensitive, whereas operators (`eq`, `sw`, and so on) and string values are case insensitive. Unlike with user logins, diacritical marks are significant in search string values: a search for `isaac.brock` finds `Isaac.Brock`, but doesn't find a property whose value is `isáàc.bröck`. This operation requires [URL encoding](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding). See [Special characters](https://developer.okta.com/docs/api/#special-characters). This operation searches many properties: * Any user profile attribute, including custom-defined attributes * The top-level properties: `id`, `status`, `created`, `activated`, `statusChanged`, and `lastUpdated` * The [user type](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/#tag/UserType/operation/updateUserType) accessed as `type.id` * Properties that have array values > **Note:** <x-lifecycle class=\"ea\"></x-lifecycle> The ability to search by user classification is available as an [Early Access](https://developer.okta.com/docs/api/openapi/okta-management/guides/release-lifecycle/#early-access-ea) feature. The `classification.type` property cannot be used in conjunction with other search terms. You can search using `classification.type eq \"LITE\"` or `classification.type eq \"STANDARD\"`. You can also use `sortBy` and `sortOrder` parameters. The `ne` (not equal) operator isn't supported, but you can obtain the same result by using `lt ... or ... gt`. For example, to see all users except those that have a status of `STAGED`, use `(status lt \"STAGED\" or status gt \"STAGED\")`. You can search properties that are arrays. If any element matches the search term, the entire array (object) is returned. Okta follows the [SCIM Protocol Specification](https://tools.ietf.org/html/rfc7644#section-3.4.2.2) for searching arrays. You can search multiple arrays, multiple values in an array, as well as using the standard logical and filtering operators. See [Filter](https://developer.okta.com/docs/reference/core-okta-api/#filter). Searches for users can be filtered by the following operators: `sw`, `eq`, and `co`. You can only use `co` with these select user profile attributes: `profile.firstName`, `profile.lastName`, `profile.email`, and `profile.login`. See [Operators](https://developer.okta.com/docs/api/#operators)."
},
"filter": {
"type": "string",
"description": "Filters users with a supported expression for a subset of properties. > **Note:** Returned users include those with the `DEPROVISIONED` status. This requires [URL encoding](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding). For example, `filter=lastUpdated gt \"2013-06-01T00:00:00.000Z\"` is encoded as `filter=lastUpdated%20gt%20%222013-06-01T00:00:00.000Z%22`. Filtering is case-sensitive for property names and query values, while operators are case-insensitive. Filtering supports the following limited number of properties: `status`, `lastUpdated`, `id`, `profile.login`, `profile.email`, `profile.firstName`, and `profile.lastName`. Additionally, filtering supports only the equal `eq` operator from the standard Okta API filtering semantics, except in the case of the `lastUpdated` property. This property can also use the inequality operators (`gt`, `ge`, `lt`, and `le`). For logical operators, only the logical operators `and` and `or` are supported. The `not` operator isn't supported. See [Filter](https://developer.okta.com/docs/api/#filter) and [Operators](https://developer.okta.com/docs/api/#operators)."
},
"q": {
"type": "string",
"description": "Finds users who match the specified query. Use the `q` parameter for simple queries, such as a lookup of users by name when creating a people picker. The value of `q` is matched against `firstName`, `lastName`, or `email`. This performs a `startsWith` match, but this is an implementation detail and can change without notice. You don't need to specify `firstName`, `lastName`, or `email`. > **Notes:** > * Using the `q` parameter in a request omits users that have a status of `DEPROVISIONED`. To return all users, use a `filter` or `search` query instead. > * This doesn't support pagination, but you can use `limit`. > * This isn't designed for large data sets. For optimal performance, use the `search` parameter instead."
},
"after": {
"type": "string",
"description": "The cursor to use for pagination. It is an opaque string that specifies your current location in the list and is obtained from the `Link` response header. See [Pagination](https://developer.okta.com/docs/api/#pagination) and [Link header](https://developer.okta.com/docs/api/#link-header)."
},
"limit": {
"type": "integer",
"description": "Specifies the number of results returned. Defaults to 10 if `q` is provided. You can use `limit` with `after` to define the cursor location in the data set and manage the user records per page."
},
"sortBy": {
"type": "string",
"description": "Specifies the field to sort by (for search queries only). This can be any single property, for example `sortBy=profile.lastName`. Users with the same value for the `sortBy` property are ordered by `id`. Use with `sortOrder` to control the order of results."
},
"sortOrder": {
"type": "string",
"description": "Specifies sort order: `asc` or `desc` (for search queries only). This parameter is ignored if `sortBy` isn't present."
},
"fields": {
"type": "string",
"description": "Specifies a select set of user properties to query. Any other properties will be filtered out of the returned users. This is often called field projections in APIs, which can reduce payload size, improve performance, and limit unneccessary data exposure. Requested fields should be comma-separated. Comma-separate the fields and place sub-fields in the profile object inside a `profile:()` directive, for example `profile:(firstName, city)`. The `id` field is always included, regardless of whether it's specified in the `fields` parameter."
},
"expand": {
"type": "string",
"description": "<x-lifecycle-container><x-lifecycle class=\"ea\"></x-lifecycle></x-lifecycle-container>A parameter to include metadata in the `_embedded` property. Supported value: `classification`."
}
},
"required": [
"PCID"
]
}
okta-users_reactivate_user
Reactivate a user Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
id | string | Yes | — | An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user |
sendEmail | boolean | No | — | Sends an activation email to the user if true |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"id": {
"type": "string",
"description": "An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user"
},
"sendEmail": {
"type": "boolean",
"description": "Sends an activation email to the user if `true`"
}
},
"required": [
"PCID",
"id"
]
}
okta-users_replace_user
Replace a user Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
id | string | Yes | — | An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user |
strict | boolean | No | — | If true, validates against minimum age and history password policy |
If-Match | string | No | — | The ETag value of the user’s expected current state. This becomes a conditional request used for concurrency control. See Conditional Requests and Entity Tags. |
credentials | object | No | — | Specifies primary authentication and recovery credentials for a user. Credential types and requirements vary depending on the provider and security policy of the org. |
profile | object | No | — | Specifies the default and custom profile properties for a user. The default user profile is based on the System for Cross-domain Identity Management: Core Schema. The only permitted customizations of the default profile are to update permissions, change whether the firstName and lastName properties are nullable, and specify a pattern for login. You can use the Profile Editor in the Admin Console or the Schemas API to make schema modifications. You can extend user profiles with custom properties. You must first add the custom property to the user profile schema before you reference it. You can use the Profile Editor in the Admin Console or the Schemas API to manage schema extensions. Custom attributes can contain HTML tags. It’s the client’s responsibility to escape or encode this data before displaying it. Use best-practices to prevent cross-site scripting. |
realmId | string | No | — | The ID of the realm in which the user is residing. See Realms. |
type | object | No | — | The ID of the user type. Add this value if you want to create a user with a non-default User Type. The user type determines which schema applies to that user. After a user has been created, the user can only be assigned a different user type by an admin through a full replacement (PUT) operation. |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"id": {
"type": "string",
"description": "An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user"
},
"strict": {
"type": "boolean",
"description": "If `true`, validates against minimum age and history password policy"
},
"If-Match": {
"type": "string",
"description": "The ETag value of the user's expected current state. This becomes a conditional request used for concurrency control. See [Conditional Requests and Entity Tags](/#conditional-requests-and-entity-tags)."
},
"credentials": {
"type": "object",
"description": "Specifies primary authentication and recovery credentials for a user. Credential types and requirements vary depending on the provider and security policy of the org.",
"properties": {
"password": {
"type": "object",
"description": "Specifies a password for a user. When a user has a valid password, imported hashed password, or password hook, and a response object contains a password credential, then the password object is a bare object without the value property defined (for example, `password: {}`). This indicates that a password value exists. You can modify password policy requirements in the Admin Console by editing the Password authenticator: **Security** > **Authenticators** > **Password** (or for Okta Classic orgs, use **Security** > **Authentication** > **Password**). For information on defaults and configuring your password policies, see [Configure the password authenticator](https://help.okta.com/okta_help.htm?type=oie&id=ext-configure-password) in the help documentation."
},
"provider": {
"type": "object",
"description": "Specifies the authentication provider that validates the user's password credential. The user's current provider is managed by the **Delegated Authentication** settings for your org. The provider object is **read-only**."
},
"recovery_question": {
"type": "object",
"description": "Specifies a secret question and answer that's validated (case insensitive) when a user forgets their password or unlocks their account. The answer property is write-only."
}
}
},
"profile": {
"type": "object",
"description": "Specifies the default and custom profile properties for a user. The default user profile is based on the [System for Cross-domain Identity Management: Core Schema](https://datatracker.ietf.org/doc/html/rfc7643). The only permitted customizations of the default profile are to update permissions, change whether the `firstName` and `lastName` properties are nullable, and specify a [pattern](https://developer.okta.com/docs/reference/api/schemas/#login-pattern-validation) for `login`. You can use the Profile Editor in the Admin Console or the [Schemas API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UISchema/#tag/UISchema) to make schema modifications. You can extend user profiles with custom properties. You must first add the custom property to the user profile schema before you reference it. You can use the Profile Editor in the Admin Console or the [Schemas API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UISchema/#tag/UISchema) to manage schema extensions. Custom attributes can contain HTML tags. It's the client's responsibility to escape or encode this data before displaying it. Use [best-practices](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) to prevent cross-site scripting.",
"properties": {
"city": {
"type": "string",
"description": "The city or locality of the user's address (`locality`)"
},
"costCenter": {
"type": "string",
"description": "Name of the cost center assigned to a user"
},
"countryCode": {
"type": "string",
"description": "The country name component of the user's address (`country`). For validation, see [ISO 3166-1 alpha 2 \"short\" code format](https://datatracker.ietf.org/doc/html/draft-ietf-scim-core-schema-22#ref-ISO3166)."
},
"department": {
"type": "string",
"description": "Name of the user's department"
},
"displayName": {
"type": "string",
"description": "Name of the user suitable for display to end users"
},
"division": {
"type": "string",
"description": "Name of the user's division"
},
"email": {
"type": "string",
"description": "The primary email address of the user. For validation, see [RFC 5322 Section 3.2.3](https://datatracker.ietf.org/doc/html/rfc5322#section-3.2.3)."
},
"employeeNumber": {
"type": "string",
"description": "The organization or company assigned unique identifier for the user"
},
"firstName": {
"type": "string",
"description": "Given name of the user (`givenName`)"
},
"honorificPrefix": {
"type": "string",
"description": "Honorific prefix(es) of the user, or title in most Western languages"
},
"honorificSuffix": {
"type": "string",
"description": "Honorific suffix(es) of the user"
},
"lastName": {
"type": "string",
"description": "The family name of the user (`familyName`)"
},
"locale": {
"type": "string",
"description": "The user's default location for purposes of localizing items such as currency, date time format, numerical representations, and so on. A locale value is a concatenation of the ISO 639-1 two-letter language code, an underscore, and the ISO 3166-1 two-letter country code. For example, en_US specifies the language English and country US. This value is `en_US` by default."
},
"login": {
"type": "string",
"description": "The unique identifier for the user (`username`). For validation, see [Login pattern validation](https://developer.okta.com/docs/reference/api/schemas/#login-pattern-validation). Every user within your Okta org must have a unique identifier for a login. This constraint applies to all users you import from other systems or applications such as Active Directory. Your organization is the top-level namespace to mix and match logins from all your connected applications or directories. Careful consideration of naming conventions for your login identifier will make it easier to onboard new applications in the future. Logins are not considered unique if they differ only in case and/or diacritical marks. If one of your users has a login of `Isaac.Brock@example.com`, there cannot be another user whose login is `isaac.brock@example.com`, nor `isáàc.bröck@example.com`. Okta has a default ambiguous name resolution policy for usernames that include @-signs. By default, usernames must be formatted as email addresses and thus always include @-signs. You can remove that restriction using either the Admin Console or the [Schemas API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/). Users can sign in with their non-qualified short name (for example: `isaac.brock` with username `isaac.brock@example.com`) as long as the short name is still unique within the org."
},
"manager": {
"type": "string",
"description": "The `displayName` of the user's manager"
},
"managerId": {
"type": "string",
"description": "The `id` of the user's manager"
},
"middleName": {
"type": "string",
"description": "The middle name of the user"
},
"mobilePhone": {
"type": "string",
"description": "The mobile phone number of the user"
},
"nickName": {
"type": "string",
"description": "The casual way to address the user in real life"
},
"organization": {
"type": "string",
"description": "Name of the the user's organization"
},
"postalAddress": {
"type": "string",
"description": "Mailing address component of the user's address"
},
"preferredLanguage": {
"type": "string",
"description": "The user's preferred written or spoken language. For validation, see [RFC 7231 Section 5.3.5](https://datatracker.ietf.org/doc/html/rfc7231#section-5.3.5)."
},
"primaryPhone": {
"type": "string",
"description": "The primary phone number of the user such as a home number"
},
"profileUrl": {
"type": "string",
"description": "The URL of the user's online profile. For example, a web page. See [URL](https://datatracker.ietf.org/doc/html/rfc1808)."
},
"secondEmail": {
"type": "string",
"description": "The secondary email address of the user typically used for account recovery. For validation, see [RFC 5322 Section 3.2.3](https://datatracker.ietf.org/doc/html/rfc5322#section-3.2.3)."
},
"state": {
"type": "string",
"description": "The state or region component of the user's address (`region`)"
},
"streetAddress": {
"type": "string",
"description": "The full street address component of the user's address"
},
"timezone": {
"type": "string",
"description": "The user's time zone"
},
"title": {
"type": "string",
"description": "The user's title, such as Vice President"
},
"userType": {
"type": "string",
"description": "The property used to describe the organization-to-user relationship, such as employee or contractor > **Note:** The `userType` property is a standard string attribute and should be treated as a descriptive label rather than a functional setting. Unlike a user's assigned user [`type`](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#tag/User/operation/createUser!path=type&t=request), this property is purely informational and doesn't influence the behavior of the Okta platform."
},
"zipCode": {
"type": "string",
"description": "The ZIP code or postal code component of the user's address (`postalCode`)"
}
}
},
"realmId": {
"type": "string",
"description": "The ID of the realm in which the user is residing. See [Realms](/openapi/okta-management/management/tags/realm)."
},
"type": {
"type": "object",
"description": "The ID of the user type. Add this value if you want to create a user with a non-default [User Type](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/). The user type determines which [schema](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/) applies to that user. After a user has been created, the user can only be assigned a different user type by an admin through a full replacement (`PUT`) operation.",
"properties": {
"id": {
"type": "string",
"description": "The ID of the user type"
}
}
}
},
"required": [
"PCID",
"id"
]
}
okta-users_replace_user_type
Replace a user type Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
typeId | string | Yes | — | The unique key for the user type |
description | string | Yes | — | The human-readable description of the user type |
displayName | string | Yes | — | The human-readable name of the user type |
name | string | Yes | — | The name of the existing type |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"typeId": {
"type": "string",
"description": "The unique key for the user type"
},
"description": {
"type": "string",
"description": "The human-readable description of the user type"
},
"displayName": {
"type": "string",
"description": "The human-readable name of the user type"
},
"name": {
"type": "string",
"description": "The name of the existing type"
}
},
"required": [
"PCID",
"typeId",
"description",
"displayName",
"name"
]
}
okta-users_reset_factors
Reset the factors Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
id | string | Yes | — | An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"id": {
"type": "string",
"description": "An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user"
}
},
"required": [
"PCID",
"id"
]
}
okta-users_reset_password
Reset a password Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
id | string | Yes | — | An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user |
sendEmail | boolean | Yes | — | Send Email |
revokeSessions | boolean | No | — | Revokes all user sessions, except for the current session, if set to true |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"id": {
"type": "string",
"description": "An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user"
},
"sendEmail": {
"type": "boolean",
"description": "Send Email"
},
"revokeSessions": {
"type": "boolean",
"description": "Revokes all user sessions, except for the current session, if set to `true`"
}
},
"required": [
"PCID",
"id",
"sendEmail"
]
}
okta-users_suspend_user
Suspend a user Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
id | string | Yes | — | An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"id": {
"type": "string",
"description": "An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user"
}
},
"required": [
"PCID",
"id"
]
}
okta-users_unlock_user
Unlock a user Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
id | string | Yes | — | An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"id": {
"type": "string",
"description": "An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user"
}
},
"required": [
"PCID",
"id"
]
}
okta-users_unsuspend_user
Unsuspend a user Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
id | string | Yes | — | An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"id": {
"type": "string",
"description": "An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user"
}
},
"required": [
"PCID",
"id"
]
}
okta-users_update_user
Update a user Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
id | string | Yes | — | An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user |
strict | boolean | No | — | If true, validates against minimum age and history password policy |
If-Match | string | No | — | The ETag value of the user’s expected current state. This becomes a conditional request used for concurrency control. See Conditional Requests and Entity Tags. |
credentials | object | No | — | Specifies primary authentication and recovery credentials for a user. Credential types and requirements vary depending on the provider and security policy of the org. |
profile | object | No | — | Specifies the default and custom profile properties for a user. The default user profile is based on the System for Cross-domain Identity Management: Core Schema. The only permitted customizations of the default profile are to update permissions, change whether the firstName and lastName properties are nullable, and specify a pattern for login. You can use the Profile Editor in the Admin Console or the Schemas API to make schema modifications. You can extend user profiles with custom properties. You must first add the custom property to the user profile schema before you reference it. You can use the Profile Editor in the Admin Console or the Schemas API to manage schema extensions. Custom attributes can contain HTML tags. It’s the client’s responsibility to escape or encode this data before displaying it. Use best-practices to prevent cross-site scripting. |
realmId | string | No | — | The ID of the realm in which the user is residing. See Realms. |
type | object | No | — | The ID of the user type. Add this value if you want to create a user with a non-default User Type. The user type determines which schema applies to that user. After a user has been created, the user can only be assigned a different user type by an admin through a full replacement (PUT) operation. |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"id": {
"type": "string",
"description": "An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user"
},
"strict": {
"type": "boolean",
"description": "If true, validates against minimum age and history password policy"
},
"If-Match": {
"type": "string",
"description": "The ETag value of the user's expected current state. This becomes a conditional request used for concurrency control. See [Conditional Requests and Entity Tags](/#conditional-requests-and-entity-tags)."
},
"credentials": {
"type": "object",
"description": "Specifies primary authentication and recovery credentials for a user. Credential types and requirements vary depending on the provider and security policy of the org.",
"properties": {
"password": {
"type": "object",
"description": "Specifies a password for a user. When a user has a valid password, imported hashed password, or password hook, and a response object contains a password credential, then the password object is a bare object without the value property defined (for example, `password: {}`). This indicates that a password value exists. You can modify password policy requirements in the Admin Console by editing the Password authenticator: **Security** > **Authenticators** > **Password** (or for Okta Classic orgs, use **Security** > **Authentication** > **Password**). For information on defaults and configuring your password policies, see [Configure the password authenticator](https://help.okta.com/okta_help.htm?type=oie&id=ext-configure-password) in the help documentation."
},
"provider": {
"type": "object",
"description": "Specifies the authentication provider that validates the user's password credential. The user's current provider is managed by the **Delegated Authentication** settings for your org. The provider object is **read-only**."
},
"recovery_question": {
"type": "object",
"description": "Specifies a secret question and answer that's validated (case insensitive) when a user forgets their password or unlocks their account. The answer property is write-only."
}
}
},
"profile": {
"type": "object",
"description": "Specifies the default and custom profile properties for a user. The default user profile is based on the [System for Cross-domain Identity Management: Core Schema](https://datatracker.ietf.org/doc/html/rfc7643). The only permitted customizations of the default profile are to update permissions, change whether the `firstName` and `lastName` properties are nullable, and specify a [pattern](https://developer.okta.com/docs/reference/api/schemas/#login-pattern-validation) for `login`. You can use the Profile Editor in the Admin Console or the [Schemas API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UISchema/#tag/UISchema) to make schema modifications. You can extend user profiles with custom properties. You must first add the custom property to the user profile schema before you reference it. You can use the Profile Editor in the Admin Console or the [Schemas API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UISchema/#tag/UISchema) to manage schema extensions. Custom attributes can contain HTML tags. It's the client's responsibility to escape or encode this data before displaying it. Use [best-practices](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) to prevent cross-site scripting.",
"properties": {
"city": {
"type": "string",
"description": "The city or locality of the user's address (`locality`)"
},
"costCenter": {
"type": "string",
"description": "Name of the cost center assigned to a user"
},
"countryCode": {
"type": "string",
"description": "The country name component of the user's address (`country`). For validation, see [ISO 3166-1 alpha 2 \"short\" code format](https://datatracker.ietf.org/doc/html/draft-ietf-scim-core-schema-22#ref-ISO3166)."
},
"department": {
"type": "string",
"description": "Name of the user's department"
},
"displayName": {
"type": "string",
"description": "Name of the user suitable for display to end users"
},
"division": {
"type": "string",
"description": "Name of the user's division"
},
"email": {
"type": "string",
"description": "The primary email address of the user. For validation, see [RFC 5322 Section 3.2.3](https://datatracker.ietf.org/doc/html/rfc5322#section-3.2.3)."
},
"employeeNumber": {
"type": "string",
"description": "The organization or company assigned unique identifier for the user"
},
"firstName": {
"type": "string",
"description": "Given name of the user (`givenName`)"
},
"honorificPrefix": {
"type": "string",
"description": "Honorific prefix(es) of the user, or title in most Western languages"
},
"honorificSuffix": {
"type": "string",
"description": "Honorific suffix(es) of the user"
},
"lastName": {
"type": "string",
"description": "The family name of the user (`familyName`)"
},
"locale": {
"type": "string",
"description": "The user's default location for purposes of localizing items such as currency, date time format, numerical representations, and so on. A locale value is a concatenation of the ISO 639-1 two-letter language code, an underscore, and the ISO 3166-1 two-letter country code. For example, en_US specifies the language English and country US. This value is `en_US` by default."
},
"login": {
"type": "string",
"description": "The unique identifier for the user (`username`). For validation, see [Login pattern validation](https://developer.okta.com/docs/reference/api/schemas/#login-pattern-validation). Every user within your Okta org must have a unique identifier for a login. This constraint applies to all users you import from other systems or applications such as Active Directory. Your organization is the top-level namespace to mix and match logins from all your connected applications or directories. Careful consideration of naming conventions for your login identifier will make it easier to onboard new applications in the future. Logins are not considered unique if they differ only in case and/or diacritical marks. If one of your users has a login of `Isaac.Brock@example.com`, there cannot be another user whose login is `isaac.brock@example.com`, nor `isáàc.bröck@example.com`. Okta has a default ambiguous name resolution policy for usernames that include @-signs. By default, usernames must be formatted as email addresses and thus always include @-signs. You can remove that restriction using either the Admin Console or the [Schemas API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/). Users can sign in with their non-qualified short name (for example: `isaac.brock` with username `isaac.brock@example.com`) as long as the short name is still unique within the org."
},
"manager": {
"type": "string",
"description": "The `displayName` of the user's manager"
},
"managerId": {
"type": "string",
"description": "The `id` of the user's manager"
},
"middleName": {
"type": "string",
"description": "The middle name of the user"
},
"mobilePhone": {
"type": "string",
"description": "The mobile phone number of the user"
},
"nickName": {
"type": "string",
"description": "The casual way to address the user in real life"
},
"organization": {
"type": "string",
"description": "Name of the the user's organization"
},
"postalAddress": {
"type": "string",
"description": "Mailing address component of the user's address"
},
"preferredLanguage": {
"type": "string",
"description": "The user's preferred written or spoken language. For validation, see [RFC 7231 Section 5.3.5](https://datatracker.ietf.org/doc/html/rfc7231#section-5.3.5)."
},
"primaryPhone": {
"type": "string",
"description": "The primary phone number of the user such as a home number"
},
"profileUrl": {
"type": "string",
"description": "The URL of the user's online profile. For example, a web page. See [URL](https://datatracker.ietf.org/doc/html/rfc1808)."
},
"secondEmail": {
"type": "string",
"description": "The secondary email address of the user typically used for account recovery. For validation, see [RFC 5322 Section 3.2.3](https://datatracker.ietf.org/doc/html/rfc5322#section-3.2.3)."
},
"state": {
"type": "string",
"description": "The state or region component of the user's address (`region`)"
},
"streetAddress": {
"type": "string",
"description": "The full street address component of the user's address"
},
"timezone": {
"type": "string",
"description": "The user's time zone"
},
"title": {
"type": "string",
"description": "The user's title, such as Vice President"
},
"userType": {
"type": "string",
"description": "The property used to describe the organization-to-user relationship, such as employee or contractor > **Note:** The `userType` property is a standard string attribute and should be treated as a descriptive label rather than a functional setting. Unlike a user's assigned user [`type`](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#tag/User/operation/createUser!path=type&t=request), this property is purely informational and doesn't influence the behavior of the Okta platform."
},
"zipCode": {
"type": "string",
"description": "The ZIP code or postal code component of the user's address (`postalCode`)"
}
}
},
"realmId": {
"type": "string",
"description": "The ID of the realm in which the user is residing. See [Realms](/openapi/okta-management/management/tags/realm)."
},
"type": {
"type": "object",
"description": "The ID of the user type. Add this value if you want to create a user with a non-default [User Type](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/). The user type determines which [schema](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/) applies to that user. After a user has been created, the user can only be assigned a different user type by an admin through a full replacement (`PUT`) operation.",
"properties": {
"id": {
"type": "string",
"description": "The ID of the user type"
}
}
}
},
"required": [
"PCID",
"id"
]
}
okta-users_update_user_type
Update a user type Parameters:| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
typeId | string | Yes | — | The unique key for the user type |
description | string | No | — | The updated human-readable description of the user type |
displayName | string | No | — | The updated human-readable display name for the user type |
Show inputSchema
Show inputSchema
{
"type": "object",
"properties": {
"PCID": {
"type": "string",
"description": "Pink Connect ID for the authenticated connection"
},
"typeId": {
"type": "string",
"description": "The unique key for the user type"
},
"description": {
"type": "string",
"description": "The updated human-readable description of the user type"
},
"displayName": {
"type": "string",
"description": "The updated human-readable display name for the user type"
}
},
"required": [
"PCID",
"typeId"
]
}