okta-users - Pinkfish - AI Agents & Workflows for Getting Work Done

Server path: /okta-users | Type: Application | PCID required: Yes

Tools

Tool	Description
`okta-users_activate_user`	Activate a user
`okta-users_change_password`	Update password
`okta-users_change_recovery_question`	Update recovery question
`okta-users_create_user`	Create a user
`okta-users_create_user_type`	Create a user type
`okta-users_deactivate_user`	Deactivate a user
`okta-users_delete_user`	Delete a user
`okta-users_delete_user_type`	Delete a user type
`okta-users_expire_password`	Expire the password
`okta-users_expire_password_with_temp_password`	Expire the password with a temporary password
`okta-users_forgot_password`	Start forgot password flow
`okta-users_forgot_password_set_new_password`	Reset password with recovery question
`okta-users_get_user`	Retrieve a user
`okta-users_get_user_type`	Retrieve a user type
`okta-users_list_user_blocks`	List all user blocks
`okta-users_list_user_types`	List all user types
`okta-users_list_users`	List all users
`okta-users_reactivate_user`	Reactivate a user
`okta-users_replace_user`	Replace a user
`okta-users_replace_user_type`	Replace a user type
`okta-users_reset_factors`	Reset the factors
`okta-users_reset_password`	Reset a password
`okta-users_suspend_user`	Suspend a user
`okta-users_unlock_user`	Unlock a user
`okta-users_unsuspend_user`	Unsuspend a user
`okta-users_update_user`	Update a user
`okta-users_update_user_type`	Update a user type

okta-users_activate_user

Activate a user Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user
`sendEmail`	boolean	No	—	Sends an activation email to the user if `true`

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user"
    },
    "sendEmail": {
      "type": "boolean",
      "description": "Sends an activation email to the user if `true`"
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

okta-users_change_password

Update password Parameters:

Parameter	Type	Required	Default	Description
`userId`	string	Yes	—	ID of an existing Okta user
`strict`	boolean	No	—	If true, validates against the password minimum age policy
`newPassword`	object	No	—	Specifies a password for a user. When a user has a valid password, imported hashed password, or password hook, and a response object contains a password credential, then the password object is a bare object without the value property defined (for example, `password: {}`). This indicates that a password value exists. You can modify password policy requirements in the Admin Console by editing the Password authenticator: Security > Authenticators > Password (or for Okta Classic orgs, use Security > Authentication > Password). For information on defaults and configuring your password policies, see Configure the password authenticator in the help documentation.
`oldPassword`	object	No	—	Specifies a password for a user. When a user has a valid password, imported hashed password, or password hook, and a response object contains a password credential, then the password object is a bare object without the value property defined (for example, `password: {}`). This indicates that a password value exists. You can modify password policy requirements in the Admin Console by editing the Password authenticator: Security > Authenticators > Password (or for Okta Classic orgs, use Security > Authentication > Password). For information on defaults and configuring your password policies, see Configure the password authenticator in the help documentation.
`revokeSessions`	boolean	No	—	When set to `true`, revokes all user sessions, except for the current session

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "userId": {
      "type": "string",
      "description": "ID of an existing Okta user"
    },
    "strict": {
      "type": "boolean",
      "description": "If true, validates against the password minimum age policy"
    },
    "newPassword": {
      "type": "object",
      "description": "Specifies a password for a user.  When a user has a valid password, imported hashed password, or password hook, and a response object contains a password credential, then the password object is a bare object without the value property defined (for example, `password: {}`). This indicates that a password value exists. You can modify password policy requirements in the Admin Console by editing the Password authenticator:  **Security** > **Authenticators** > **Password** (or for Okta Classic orgs, use **Security** > **Authentication** > **Password**).  For information on defaults and configuring your password policies, see [Configure the password authenticator](https://help.okta.com/okta_help.htm?type=oie&id=ext-configure-password) in the help documentation.",
      "properties": {
        "hash": {
          "type": "object",
          "description": "Specifies a hashed password to import into Okta. This allows an existing password to be imported into Okta directly from some other store. Okta supports the BCRYPT, SHA-512, SHA-256, SHA-1, MD5, and PBKDF2 hash functions for password import.  A hashed password may be specified in a password object when creating or updating a user, but not for other operations.  See the [Create user with imported hashed password](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#create-user-with-imported-hashed-password) description. When you update a user with a hashed password, the user must be in the `STAGED` status."
        },
        "hook": {
          "type": "object",
          "description": "Specify a [password import inline hook](/openapi/okta-management/management/tags/inlinehook/createpasswordimportinlinehook) to trigger verification of the user's password the first time the user signs in. This allows an existing password to be imported into Okta directly from some other store."
        },
        "value": {
          "type": "string",
          "description": "Specifies the password for a user. The password policy validates this password."
        }
      }
    },
    "oldPassword": {
      "type": "object",
      "description": "Specifies a password for a user.  When a user has a valid password, imported hashed password, or password hook, and a response object contains a password credential, then the password object is a bare object without the value property defined (for example, `password: {}`). This indicates that a password value exists. You can modify password policy requirements in the Admin Console by editing the Password authenticator:  **Security** > **Authenticators** > **Password** (or for Okta Classic orgs, use **Security** > **Authentication** > **Password**).  For information on defaults and configuring your password policies, see [Configure the password authenticator](https://help.okta.com/okta_help.htm?type=oie&id=ext-configure-password) in the help documentation.",
      "properties": {
        "hash": {
          "type": "object",
          "description": "Specifies a hashed password to import into Okta. This allows an existing password to be imported into Okta directly from some other store. Okta supports the BCRYPT, SHA-512, SHA-256, SHA-1, MD5, and PBKDF2 hash functions for password import.  A hashed password may be specified in a password object when creating or updating a user, but not for other operations.  See the [Create user with imported hashed password](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#create-user-with-imported-hashed-password) description. When you update a user with a hashed password, the user must be in the `STAGED` status."
        },
        "hook": {
          "type": "object",
          "description": "Specify a [password import inline hook](/openapi/okta-management/management/tags/inlinehook/createpasswordimportinlinehook) to trigger verification of the user's password the first time the user signs in. This allows an existing password to be imported into Okta directly from some other store."
        },
        "value": {
          "type": "string",
          "description": "Specifies the password for a user. The password policy validates this password."
        }
      }
    },
    "revokeSessions": {
      "type": "boolean",
      "description": "When set to `true`, revokes all user sessions, except for the current session"
    }
  },
  "required": [
    "PCID",
    "userId"
  ]
}

okta-users_change_recovery_question

Update recovery question Parameters:

Parameter	Type	Required	Default	Description
`userId`	string	Yes	—	ID of an existing Okta user
`password`	object	No	—	Specifies a password for a user. When a user has a valid password, imported hashed password, or password hook, and a response object contains a password credential, then the password object is a bare object without the value property defined (for example, `password: {}`). This indicates that a password value exists. You can modify password policy requirements in the Admin Console by editing the Password authenticator: Security > Authenticators > Password (or for Okta Classic orgs, use Security > Authentication > Password). For information on defaults and configuring your password policies, see Configure the password authenticator in the help documentation.
`provider`	object	No	—	Specifies the authentication provider that validates the user’s password credential. The user’s current provider is managed by the Delegated Authentication settings for your org. The provider object is read-only.
`recovery_question`	object	No	—	Specifies a secret question and answer that’s validated (case insensitive) when a user forgets their password or unlocks their account. The answer property is write-only.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "userId": {
      "type": "string",
      "description": "ID of an existing Okta user"
    },
    "password": {
      "type": "object",
      "description": "Specifies a password for a user.  When a user has a valid password, imported hashed password, or password hook, and a response object contains a password credential, then the password object is a bare object without the value property defined (for example, `password: {}`). This indicates that a password value exists. You can modify password policy requirements in the Admin Console by editing the Password authenticator:  **Security** > **Authenticators** > **Password** (or for Okta Classic orgs, use **Security** > **Authentication** > **Password**).  For information on defaults and configuring your password policies, see [Configure the password authenticator](https://help.okta.com/okta_help.htm?type=oie&id=ext-configure-password) in the help documentation.",
      "properties": {
        "hash": {
          "type": "object",
          "description": "Specifies a hashed password to import into Okta. This allows an existing password to be imported into Okta directly from some other store. Okta supports the BCRYPT, SHA-512, SHA-256, SHA-1, MD5, and PBKDF2 hash functions for password import.  A hashed password may be specified in a password object when creating or updating a user, but not for other operations.  See the [Create user with imported hashed password](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#create-user-with-imported-hashed-password) description. When you update a user with a hashed password, the user must be in the `STAGED` status."
        },
        "hook": {
          "type": "object",
          "description": "Specify a [password import inline hook](/openapi/okta-management/management/tags/inlinehook/createpasswordimportinlinehook) to trigger verification of the user's password the first time the user signs in. This allows an existing password to be imported into Okta directly from some other store."
        },
        "value": {
          "type": "string",
          "description": "Specifies the password for a user. The password policy validates this password."
        }
      }
    },
    "provider": {
      "type": "object",
      "description": "Specifies the authentication provider that validates the user's password credential. The user's current provider is managed by the **Delegated Authentication** settings for your org. The provider object is **read-only**.",
      "properties": {
        "name": {
          "type": "string",
          "description": "The name of the authentication provider"
        },
        "type": {
          "type": "string",
          "description": "The type of authentication provider",
          "enum": [
            "ACTIVE_DIRECTORY",
            "FEDERATION",
            "IMPORT",
            "LDAP",
            "OKTA",
            "SOCIAL"
          ]
        }
      }
    },
    "recovery_question": {
      "type": "object",
      "description": "Specifies a secret question and answer that's validated (case insensitive) when a user forgets their password or unlocks their account. The answer property is write-only.",
      "properties": {
        "answer": {
          "type": "string",
          "description": "The answer to the recovery question"
        },
        "question": {
          "type": "string",
          "description": "The recovery question"
        }
      }
    }
  },
  "required": [
    "PCID",
    "userId"
  ]
}

okta-users_create_user

Create a user Parameters:

Parameter	Type	Required	Default	Description
`activate`	boolean	No	—	Executes an activation lifecycle operation when creating the user
`provider`	boolean	No	—	Indicates whether to create a user with a specified authentication provider.
`nextLogin`	string	No	—	With `activate=true`, if `nextLogin=changePassword`, a user is created, activated, and the password is set to `EXPIRED`. The user must change it the next time they sign in.
`credentials`	object	No	—	Specifies primary authentication and recovery credentials for a user. Credential types and requirements vary depending on the provider and security policy of the org.
`groupIds`	string[]	No	—	The list of group IDs of groups that the user is added to at the time of creation
`profile`	object	Yes	—	Specifies the default and custom profile properties for a user. The default user profile is based on the System for Cross-domain Identity Management: Core Schema. The only permitted customizations of the default profile are to update permissions, change whether the `firstName` and `lastName` properties are nullable, and specify a pattern for `login`. You can use the Profile Editor in the Admin Console or the Schemas API to make schema modifications. You can extend user profiles with custom properties. You must first add the custom property to the user profile schema before you reference it. You can use the Profile Editor in the Admin Console or the Schemas API to manage schema extensions. Custom attributes can contain HTML tags. It’s the client’s responsibility to escape or encode this data before displaying it. Use best-practices to prevent cross-site scripting.
`realmId`	string	No	—	The ID of the realm in which the user is residing. See Realms.
`type`	object	No	—	The ID of the user type. Add this value if you want to create a user with a non-default User Type. The user type determines which schema applies to that user. After a user has been created, the user can only be assigned a different user type by an administrator through a full replacement (`PUT`) operation.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "activate": {
      "type": "boolean",
      "description": "Executes an [activation lifecycle](https://developer.okta.com/docs/api/openapi/okta-management/management/userlifecycle/activateuser) operation when creating the user"
    },
    "provider": {
      "type": "boolean",
      "description": "Indicates whether to create a user with a specified authentication provider."
    },
    "nextLogin": {
      "type": "string",
      "description": "With `activate=true`, if `nextLogin=changePassword`, a user is created, activated, and the password is set to `EXPIRED`. The user must change it the next time they sign in.",
      "enum": [
        "changePassword"
      ]
    },
    "credentials": {
      "type": "object",
      "description": "Specifies primary authentication and recovery credentials for a user. Credential types and requirements vary depending on the provider and security policy of the org.",
      "properties": {
        "password": {
          "type": "object",
          "description": "Specifies a password for a user.  When a user has a valid password, imported hashed password, or password hook, and a response object contains a password credential, then the password object is a bare object without the value property defined (for example, `password: {}`). This indicates that a password value exists. You can modify password policy requirements in the Admin Console by editing the Password authenticator:  **Security** > **Authenticators** > **Password** (or for Okta Classic orgs, use **Security** > **Authentication** > **Password**).  For information on defaults and configuring your password policies, see [Configure the password authenticator](https://help.okta.com/okta_help.htm?type=oie&id=ext-configure-password) in the help documentation."
        },
        "provider": {
          "type": "object",
          "description": "Specifies the authentication provider that validates the user password credential. The user's current provider is managed by the **Delegated Authentication** settings in your org. See [Create user with authentication provider](/openapi/okta-management/management/user/create-user-with-password-and-recovery-question#user/Create-user-with-authentication-provider)."
        },
        "recovery_question": {
          "type": "object",
          "description": "Specifies a secret question and answer that's validated (case insensitive) when a user forgets their password or unlocks their account. The answer property is write-only."
        }
      }
    },
    "groupIds": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "The list of group IDs of groups that the user is added to at the time of creation"
    },
    "profile": {
      "type": "object",
      "description": "Specifies the default and custom profile properties for a user.  The default user profile is based on the [System for Cross-domain Identity Management: Core Schema](https://datatracker.ietf.org/doc/html/rfc7643).  The only permitted customizations of the default profile are to update permissions, change whether the `firstName` and `lastName` properties are nullable, and specify a [pattern](https://developer.okta.com/docs/reference/api/schemas/#login-pattern-validation) for `login`. You can use the Profile Editor in the Admin Console or the [Schemas API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UISchema/#tag/UISchema) to make schema modifications.  You can extend user profiles with custom properties. You must first add the custom property to the user profile schema before you reference it. You can use the Profile Editor in the Admin Console or the [Schemas API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UISchema/#tag/UISchema) to manage schema extensions.  Custom attributes can contain HTML tags. It's the client's responsibility to escape or encode this data before displaying it. Use [best-practices](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) to prevent cross-site scripting.",
      "properties": {
        "city": {
          "type": "string",
          "description": "The city or locality of the user's address (`locality`)"
        },
        "costCenter": {
          "type": "string",
          "description": "Name of the cost center assigned to a user"
        },
        "countryCode": {
          "type": "string",
          "description": "The country name component of the user's address (`country`). For validation, see [ISO 3166-1 alpha 2 \"short\" code format](https://datatracker.ietf.org/doc/html/draft-ietf-scim-core-schema-22#ref-ISO3166)."
        },
        "department": {
          "type": "string",
          "description": "Name of the user's department"
        },
        "displayName": {
          "type": "string",
          "description": "Name of the user suitable for display to end users"
        },
        "division": {
          "type": "string",
          "description": "Name of the user's division"
        },
        "email": {
          "type": "string",
          "description": "The primary email address of the user. For validation, see [RFC 5322 Section 3.2.3](https://datatracker.ietf.org/doc/html/rfc5322#section-3.2.3)."
        },
        "employeeNumber": {
          "type": "string",
          "description": "The organization or company assigned unique identifier for the user"
        },
        "firstName": {
          "type": "string",
          "description": "Given name of the user (`givenName`)"
        },
        "honorificPrefix": {
          "type": "string",
          "description": "Honorific prefix(es) of the user, or title in most Western languages"
        },
        "honorificSuffix": {
          "type": "string",
          "description": "Honorific suffix(es) of the user"
        },
        "lastName": {
          "type": "string",
          "description": "The family name of the user (`familyName`)"
        },
        "locale": {
          "type": "string",
          "description": "The user's default location for purposes of localizing items such as currency, date time format, numerical representations, and so on. A locale value is a concatenation of the ISO 639-1 two-letter language code, an underscore, and the ISO 3166-1 two-letter country code. For example, en_US specifies the language English and country US. This value is `en_US` by default."
        },
        "login": {
          "type": "string",
          "description": "The unique identifier for the user (`username`). For validation, see [Login pattern validation](https://developer.okta.com/docs/reference/api/schemas/#login-pattern-validation).  Every user within your Okta org must have a unique identifier for a login. This constraint applies to all users you import from other systems or applications such as Active Directory. Your organization is the top-level namespace to mix and match logins from all your connected applications or directories. Careful consideration of naming conventions for your login identifier will make it easier to onboard new applications in the future.  Logins are not considered unique if they differ only in case and/or diacritical marks. If one of your users has a login of `Isaac.Brock@example.com`, there cannot be another user whose login is `isaac.brock@example.com`, nor `isáàc.bröck@example.com`.  Okta has a default ambiguous name resolution policy for usernames that include @-signs. By default, usernames must be formatted as email addresses and thus always include @-signs. You can remove that restriction using either the Admin Console or the [Schemas API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/). Users can sign in with their non-qualified short name (for example: `isaac.brock` with username `isaac.brock@example.com`) as long as the short name is still unique within the org."
        },
        "manager": {
          "type": "string",
          "description": "The `displayName` of the user's manager"
        },
        "managerId": {
          "type": "string",
          "description": "The `id` of the user's manager"
        },
        "middleName": {
          "type": "string",
          "description": "The middle name of the user"
        },
        "mobilePhone": {
          "type": "string",
          "description": "The mobile phone number of the user"
        },
        "nickName": {
          "type": "string",
          "description": "The casual way to address the user in real life"
        },
        "organization": {
          "type": "string",
          "description": "Name of the the user's organization"
        },
        "postalAddress": {
          "type": "string",
          "description": "Mailing address component of the user's address"
        },
        "preferredLanguage": {
          "type": "string",
          "description": "The user's preferred written or spoken language. For validation, see [RFC 7231 Section 5.3.5](https://datatracker.ietf.org/doc/html/rfc7231#section-5.3.5)."
        },
        "primaryPhone": {
          "type": "string",
          "description": "The primary phone number of the user such as a home number"
        },
        "profileUrl": {
          "type": "string",
          "description": "The URL of the user's online profile. For example, a web page. See [URL](https://datatracker.ietf.org/doc/html/rfc1808)."
        },
        "secondEmail": {
          "type": "string",
          "description": "The secondary email address of the user typically used for account recovery. For validation, see [RFC 5322 Section 3.2.3](https://datatracker.ietf.org/doc/html/rfc5322#section-3.2.3)."
        },
        "state": {
          "type": "string",
          "description": "The state or region component of the user's address (`region`)"
        },
        "streetAddress": {
          "type": "string",
          "description": "The full street address component of the user's address"
        },
        "timezone": {
          "type": "string",
          "description": "The user's time zone"
        },
        "title": {
          "type": "string",
          "description": "The user's title, such as Vice President"
        },
        "userType": {
          "type": "string",
          "description": "The property used to describe the organization-to-user relationship, such as employee or contractor  > **Note:** The `userType` property is a standard string attribute and should be treated as a descriptive label rather than a functional setting. Unlike a user's assigned user [`type`](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#tag/User/operation/createUser!path=type&t=request), this property is purely informational and doesn't influence the behavior of the Okta platform."
        },
        "zipCode": {
          "type": "string",
          "description": "The ZIP code or postal code component of the user's address (`postalCode`)"
        }
      }
    },
    "realmId": {
      "type": "string",
      "description": "The ID of the realm in which the user is residing. See [Realms](/openapi/okta-management/management/tags/realm)."
    },
    "type": {
      "type": "object",
      "description": "The ID of the user type. Add this value if you want to create a user with a non-default [User Type](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/). The user type determines which [schema](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/) applies to that user. After a user has been created, the user can only be assigned a different user type by an administrator through a full replacement (`PUT`) operation.",
      "properties": {
        "id": {
          "type": "string",
          "description": "The ID of the user type"
        }
      }
    }
  },
  "required": [
    "PCID",
    "profile"
  ]
}

okta-users_create_user_type

Create a user type Parameters:

Parameter	Type	Required	Default	Description
`_links`	object	No	—	The links value
`created`	string	No	—	A timestamp from when the user type was created
`createdBy`	string	No	—	The user ID of the account that created the user type
`default`	boolean	No	—	A boolean value to indicate if this is the default user type
`description`	string	No	—	The human-readable description of the user type
`displayName`	string	Yes	—	The human-readable name of the user type
`id`	string	No	—	The unique key for the user type
`lastUpdated`	string	No	—	A timestamp from when the user type was most recently updated
`lastUpdatedBy`	string	No	—	The user ID of the most recent account to edit the user type
`name`	string	Yes	—	The name of the user type. The name must start with A-Z or a-z and contain only A-Z, a-z, 0-9, or underscore (_) characters. This value becomes read-only after creation and can’t be updated.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "_links": {
      "description": "The links value"
    },
    "created": {
      "type": "string",
      "description": "A timestamp from when the user type was created"
    },
    "createdBy": {
      "type": "string",
      "description": "The user ID of the account that created the user type"
    },
    "default": {
      "type": "boolean",
      "description": "A boolean value to indicate if this is the default user type"
    },
    "description": {
      "type": "string",
      "description": "The human-readable description of the user type"
    },
    "displayName": {
      "type": "string",
      "description": "The human-readable name of the user type"
    },
    "id": {
      "type": "string",
      "description": "The unique key for the user type"
    },
    "lastUpdated": {
      "type": "string",
      "description": "A timestamp from when the user type was most recently updated"
    },
    "lastUpdatedBy": {
      "type": "string",
      "description": "The user ID of the most recent account to edit the user type"
    },
    "name": {
      "type": "string",
      "description": "The name of the user type. The name must start with A-Z or a-z and contain only A-Z, a-z, 0-9, or underscore (_) characters. This value becomes read-only after creation and can't be updated."
    }
  },
  "required": [
    "PCID",
    "displayName",
    "name"
  ]
}

okta-users_deactivate_user

Deactivate a user Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user
`sendEmail`	boolean	No	—	Sends a deactivation email to the admin if `true`
`Prefer`	string	No	—	Request asynchronous processing

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user"
    },
    "sendEmail": {
      "type": "boolean",
      "description": "Sends a deactivation email to the admin if `true`"
    },
    "Prefer": {
      "type": "string",
      "description": "Request asynchronous processing",
      "enum": [
        "respond-async"
      ]
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

okta-users_delete_user

Delete a user Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user
`sendEmail`	boolean	No	—	Sends a deactivation email to the admin if `true`
`Prefer`	string	No	—	The prefer value

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user"
    },
    "sendEmail": {
      "type": "boolean",
      "description": "Sends a deactivation email to the admin if `true`"
    },
    "Prefer": {
      "type": "string",
      "description": "The prefer value",
      "enum": [
        "respond-async"
      ]
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

okta-users_delete_user_type

Delete a user type Parameters:

Parameter	Type	Required	Default	Description
`typeId`	string	Yes	—	The unique key for the user type

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "typeId": {
      "type": "string",
      "description": "The unique key for the user type"
    }
  },
  "required": [
    "PCID",
    "typeId"
  ]
}

okta-users_expire_password

Expire the password Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user"
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

okta-users_expire_password_with_temp_password

Expire the password with a temporary password Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user
`revokeSessions`	boolean	No	—	Revokes the user’s existing sessions if `true`

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user"
    },
    "revokeSessions": {
      "type": "boolean",
      "description": "Revokes the user's existing sessions if `true`"
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

okta-users_forgot_password

Start forgot password flow Parameters:

Parameter	Type	Required	Default	Description
`userId`	string	Yes	—	ID of an existing Okta user
`sendEmail`	boolean	No	—	Sends a forgot password email to the user if `true`

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "userId": {
      "type": "string",
      "description": "ID of an existing Okta user"
    },
    "sendEmail": {
      "type": "boolean",
      "description": "Sends a forgot password email to the user if `true`"
    }
  },
  "required": [
    "PCID",
    "userId"
  ]
}

okta-users_forgot_password_set_new_password

Reset password with recovery question Parameters:

Parameter	Type	Required	Default	Description
`userId`	string	Yes	—	ID of an existing Okta user
`sendEmail`	boolean	No	—	Send Email
`password`	object	No	—	Specifies a password for a user. When a user has a valid password, imported hashed password, or password hook, and a response object contains a password credential, then the password object is a bare object without the value property defined (for example, `password: {}`). This indicates that a password value exists. You can modify password policy requirements in the Admin Console by editing the Password authenticator: Security > Authenticators > Password (or for Okta Classic orgs, use Security > Authentication > Password). For information on defaults and configuring your password policies, see Configure the password authenticator in the help documentation.
`provider`	object	No	—	Specifies the authentication provider that validates the user’s password credential. The user’s current provider is managed by the Delegated Authentication settings for your org. The provider object is read-only.
`recovery_question`	object	No	—	Specifies a secret question and answer that’s validated (case insensitive) when a user forgets their password or unlocks their account. The answer property is write-only.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "userId": {
      "type": "string",
      "description": "ID of an existing Okta user"
    },
    "sendEmail": {
      "type": "boolean",
      "description": "Send Email"
    },
    "password": {
      "type": "object",
      "description": "Specifies a password for a user.  When a user has a valid password, imported hashed password, or password hook, and a response object contains a password credential, then the password object is a bare object without the value property defined (for example, `password: {}`). This indicates that a password value exists. You can modify password policy requirements in the Admin Console by editing the Password authenticator:  **Security** > **Authenticators** > **Password** (or for Okta Classic orgs, use **Security** > **Authentication** > **Password**).  For information on defaults and configuring your password policies, see [Configure the password authenticator](https://help.okta.com/okta_help.htm?type=oie&id=ext-configure-password) in the help documentation.",
      "properties": {
        "hash": {
          "type": "object",
          "description": "Specifies a hashed password to import into Okta. This allows an existing password to be imported into Okta directly from some other store. Okta supports the BCRYPT, SHA-512, SHA-256, SHA-1, MD5, and PBKDF2 hash functions for password import.  A hashed password may be specified in a password object when creating or updating a user, but not for other operations.  See the [Create user with imported hashed password](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#create-user-with-imported-hashed-password) description. When you update a user with a hashed password, the user must be in the `STAGED` status."
        },
        "hook": {
          "type": "object",
          "description": "Specify a [password import inline hook](/openapi/okta-management/management/tags/inlinehook/createpasswordimportinlinehook) to trigger verification of the user's password the first time the user signs in. This allows an existing password to be imported into Okta directly from some other store."
        },
        "value": {
          "type": "string",
          "description": "Specifies the password for a user. The password policy validates this password."
        }
      }
    },
    "provider": {
      "type": "object",
      "description": "Specifies the authentication provider that validates the user's password credential. The user's current provider is managed by the **Delegated Authentication** settings for your org. The provider object is **read-only**.",
      "properties": {
        "name": {
          "type": "string",
          "description": "The name of the authentication provider"
        },
        "type": {
          "type": "string",
          "description": "The type of authentication provider",
          "enum": [
            "ACTIVE_DIRECTORY",
            "FEDERATION",
            "IMPORT",
            "LDAP",
            "OKTA",
            "SOCIAL"
          ]
        }
      }
    },
    "recovery_question": {
      "type": "object",
      "description": "Specifies a secret question and answer that's validated (case insensitive) when a user forgets their password or unlocks their account. The answer property is write-only.",
      "properties": {
        "answer": {
          "type": "string",
          "description": "The answer to the recovery question"
        },
        "question": {
          "type": "string",
          "description": "The recovery question"
        }
      }
    }
  },
  "required": [
    "PCID",
    "userId"
  ]
}

okta-users_get_user

Retrieve a user Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user
`Content-Type`	string	No	—	Specifies the media type of the resource. Optional `okta-response` value can be included for performance optimization. Complex DelAuth configurations may degrade performance when fetching specific parts of the response, and passing this parameter can omit these parts, bypassing the bottleneck. Enum values for `okta-response`: * `omitCredentials`: Omits the credentials subobject from the response. * `omitCredentialsLinks`: Omits the following HAL links from the response: Update password, Change recovery question, Start forgot password flow, Reset password, Reset factors, Unlock. * `omitTransitioningToStatus`: Omits the `transitioningToStatus` field from the response.
`expand`	string	No	—	An optional parameter to include metadata in the `_embedded` attribute. Valid values: `blocks` or <x-lifecycle class=“ea”></x-lifecycle> `classification`.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user"
    },
    "Content-Type": {
      "type": "string",
      "description": "Specifies the media type of the resource. Optional `okta-response` value can be included for performance optimization.  Complex DelAuth configurations may degrade performance when fetching specific parts of the response, and passing this parameter can omit these parts, bypassing the bottleneck.  Enum values for `okta-response`:   * `omitCredentials`: Omits the credentials subobject from the response.   * `omitCredentialsLinks`: Omits the following HAL links from the response: Update password, Change recovery question, Start forgot password flow, Reset password, Reset factors, Unlock.   * `omitTransitioningToStatus`: Omits the `transitioningToStatus` field from the response."
    },
    "expand": {
      "type": "string",
      "description": "An optional parameter to include metadata in the `_embedded` attribute. Valid values: `blocks` or <x-lifecycle class=\"ea\"></x-lifecycle> `classification`."
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

okta-users_get_user_type

Retrieve a user type Parameters:

Parameter	Type	Required	Default	Description
`typeId`	string	Yes	—	The unique key for the user type

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "typeId": {
      "type": "string",
      "description": "The unique key for the user type"
    }
  },
  "required": [
    "PCID",
    "typeId"
  ]
}

okta-users_list_user_blocks

List all user blocks Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user"
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

okta-users_list_user_types

List all user types

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    }
  },
  "required": [
    "PCID"
  ]
}

okta-users_list_users

List all users Parameters:

Parameter	Type	Required	Default	Description
`Content-Type`	string	No	—	Specifies the media type of the resource. Optional `okta-response` value can be included for performance optimization. Complex DelAuth configurations may degrade performance when fetching specific parts of the response, and passing this parameter can omit these parts, bypassing the bottleneck. Enum values for `okta-response`: * `omitCredentials`: Omits the credentials subobject from the response. * `omitCredentialsLinks`: Omits the following HAL links from the response: Update password, Change recovery question, Start forgot password flow, Reset password, Reset factors, Unlock. * `omitTransitioningToStatus`: Omits the `transitioningToStatus` field from the response.
`search`	string	No	—	Searches for users with a supported filtering expression for most properties. Okta recommends this query parameter because it provides the largest range of search options and optimal performance. > Note: Using an overly complex or long search query can result in an error. This operation supports pagination. Use an ID lookup for records that you update to ensure your results contain the latest data. Returned users include those with the `DEPROVISIONED` status. Property names in the search parameter are case sensitive, whereas operators (`eq`, `sw`, and so on) and string values are case insensitive. Unlike with user logins, diacritical marks are significant in search string values: a search for `isaac.brock` finds `Isaac.Brock`, but doesn’t find a property whose value is `isáàc.bröck`. This operation requires URL encoding. See Special characters. This operation searches many properties: * Any user profile attribute, including custom-defined attributes * The top-level properties: `id`, `status`, `created`, `activated`, `statusChanged`, and `lastUpdated` * The user type accessed as `type.id` * Properties that have array values > Note: <x-lifecycle class=“ea”></x-lifecycle> The ability to search by user classification is available as an Early Access feature. The `classification.type` property cannot be used in conjunction with other search terms. You can search using `classification.type eq "LITE"` or `classification.type eq "STANDARD"`. You can also use `sortBy` and `sortOrder` parameters. The `ne` (not equal) operator isn’t supported, but you can obtain the same result by using `lt ... or ... gt`. For example, to see all users except those that have a status of `STAGED`, use `(status lt "STAGED" or status gt "STAGED")`. You can search properties that are arrays. If any element matches the search term, the entire array (object) is returned. Okta follows the SCIM Protocol Specification for searching arrays. You can search multiple arrays, multiple values in an array, as well as using the standard logical and filtering operators. See Filter. Searches for users can be filtered by the following operators: `sw`, `eq`, and `co`. You can only use `co` with these select user profile attributes: `profile.firstName`, `profile.lastName`, `profile.email`, and `profile.login`. See Operators.
`filter`	string	No	—	Filters users with a supported expression for a subset of properties. > Note: Returned users include those with the `DEPROVISIONED` status. This requires URL encoding. For example, `filter=lastUpdated gt "2013-06-01T00:00:00.000Z"` is encoded as `filter=lastUpdated%20gt%20%222013-06-01T00:00:00.000Z%22`. Filtering is case-sensitive for property names and query values, while operators are case-insensitive. Filtering supports the following limited number of properties: `status`, `lastUpdated`, `id`, `profile.login`, `profile.email`, `profile.firstName`, and `profile.lastName`. Additionally, filtering supports only the equal `eq` operator from the standard Okta API filtering semantics, except in the case of the `lastUpdated` property. This property can also use the inequality operators (`gt`, `ge`, `lt`, and `le`). For logical operators, only the logical operators `and` and `or` are supported. The `not` operator isn’t supported. See Filter and Operators.
`q`	string	No	—	Finds users who match the specified query. Use the `q` parameter for simple queries, such as a lookup of users by name when creating a people picker. The value of `q` is matched against `firstName`, `lastName`, or `email`. This performs a `startsWith` match, but this is an implementation detail and can change without notice. You don’t need to specify `firstName`, `lastName`, or `email`. > Notes: > * Using the `q` parameter in a request omits users that have a status of `DEPROVISIONED`. To return all users, use a `filter` or `search` query instead. > * This doesn’t support pagination, but you can use `limit`. > * This isn’t designed for large data sets. For optimal performance, use the `search` parameter instead.
`after`	string	No	—	The cursor to use for pagination. It is an opaque string that specifies your current location in the list and is obtained from the `Link` response header. See Pagination and Link header.
`limit`	integer	No	—	Specifies the number of results returned. Defaults to 10 if `q` is provided. You can use `limit` with `after` to define the cursor location in the data set and manage the user records per page.
`sortBy`	string	No	—	Specifies the field to sort by (for search queries only). This can be any single property, for example `sortBy=profile.lastName`. Users with the same value for the `sortBy` property are ordered by `id`. Use with `sortOrder` to control the order of results.
`sortOrder`	string	No	—	Specifies sort order: `asc` or `desc` (for search queries only). This parameter is ignored if `sortBy` isn’t present.
`fields`	string	No	—	Specifies a select set of user properties to query. Any other properties will be filtered out of the returned users. This is often called field projections in APIs, which can reduce payload size, improve performance, and limit unneccessary data exposure. Requested fields should be comma-separated. Comma-separate the fields and place sub-fields in the profile object inside a `profile:()` directive, for example `profile:(firstName, city)`. The `id` field is always included, regardless of whether it’s specified in the `fields` parameter.
`expand`	string	No	—	<x-lifecycle-container><x-lifecycle class=“ea”></x-lifecycle></x-lifecycle-container>A parameter to include metadata in the `_embedded` property. Supported value: `classification`.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "Content-Type": {
      "type": "string",
      "description": "Specifies the media type of the resource. Optional `okta-response` value can be included for performance optimization.  Complex DelAuth configurations may degrade performance when fetching specific parts of the response, and passing this parameter can omit these parts, bypassing the bottleneck.  Enum values for `okta-response`:   * `omitCredentials`: Omits the credentials subobject from the response.   * `omitCredentialsLinks`: Omits the following HAL links from the response: Update password, Change recovery question, Start forgot password flow, Reset password, Reset factors, Unlock.   * `omitTransitioningToStatus`: Omits the `transitioningToStatus` field from the response."
    },
    "search": {
      "type": "string",
      "description": "Searches for users with a supported filtering expression for most properties. Okta recommends this query parameter because it provides the largest range of search options and optimal performance.  > **Note:** Using an overly complex or long search query can result in an error.  This operation supports [pagination](https://developer.okta.com/docs/api/#pagination). Use an ID lookup for records that you update to ensure your results contain the latest data. Returned users include those with the `DEPROVISIONED` status.  Property names in the search parameter are case sensitive, whereas operators (`eq`, `sw`, and so on) and string values are case insensitive. Unlike with user logins, diacritical marks are significant in search string values: a search for `isaac.brock` finds `Isaac.Brock`, but doesn't find a property whose value is `isáàc.bröck`.  This operation requires [URL encoding](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding). See [Special characters](https://developer.okta.com/docs/api/#special-characters).  This operation searches many properties:   * Any user profile attribute, including custom-defined attributes   * The top-level properties: `id`, `status`, `created`, `activated`, `statusChanged`, and `lastUpdated`   * The [user type](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/#tag/UserType/operation/updateUserType) accessed as `type.id`   * Properties that have array values  > **Note:** <x-lifecycle class=\"ea\"></x-lifecycle> The ability to search by user classification is available as an [Early Access](https://developer.okta.com/docs/api/openapi/okta-management/guides/release-lifecycle/#early-access-ea) feature. The `classification.type` property cannot be used in conjunction with other search terms. You can search using `classification.type eq \"LITE\"` or `classification.type eq \"STANDARD\"`.  You can also use `sortBy` and `sortOrder` parameters. The `ne` (not equal) operator isn't supported, but you can obtain the same result by using `lt ... or ... gt`. For example, to see all users except those that have a status of `STAGED`, use `(status lt \"STAGED\" or status gt \"STAGED\")`.  You can search properties that are arrays. If any element matches the search term, the entire array (object) is returned. Okta follows the [SCIM Protocol Specification](https://tools.ietf.org/html/rfc7644#section-3.4.2.2) for searching arrays. You can search multiple arrays, multiple values in an array, as well as using the standard logical and filtering operators. See [Filter](https://developer.okta.com/docs/reference/core-okta-api/#filter).  Searches for users can be filtered by the following operators: `sw`, `eq`, and `co`. You can only use `co` with these select user profile attributes: `profile.firstName`, `profile.lastName`, `profile.email`, and `profile.login`. See [Operators](https://developer.okta.com/docs/api/#operators)."
    },
    "filter": {
      "type": "string",
      "description": "Filters users with a supported expression for a subset of properties.  > **Note:** Returned users include those with the `DEPROVISIONED` status.  This requires [URL encoding](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding). For example, `filter=lastUpdated gt \"2013-06-01T00:00:00.000Z\"` is encoded as `filter=lastUpdated%20gt%20%222013-06-01T00:00:00.000Z%22`. Filtering is case-sensitive for property names and query values, while operators are case-insensitive.  Filtering supports the following limited number of properties: `status`, `lastUpdated`, `id`, `profile.login`, `profile.email`, `profile.firstName`, and `profile.lastName`.  Additionally, filtering supports only the equal `eq` operator from the standard Okta API filtering semantics, except in the case of the `lastUpdated` property. This property can also use the inequality operators (`gt`, `ge`, `lt`, and `le`). For logical operators, only the logical operators `and` and `or` are supported. The `not` operator isn't supported. See [Filter](https://developer.okta.com/docs/api/#filter) and [Operators](https://developer.okta.com/docs/api/#operators)."
    },
    "q": {
      "type": "string",
      "description": "Finds users who match the specified query. Use the `q` parameter for simple queries, such as a lookup of users by name when creating a people picker.  The value of `q` is matched against `firstName`, `lastName`, or `email`. This performs a `startsWith` match, but this is an implementation detail and can change without notice. You don't need to specify `firstName`, `lastName`, or `email`.  > **Notes:** > * Using the `q` parameter in a request omits users that have a status of `DEPROVISIONED`. To return all users, use a `filter` or `search` query instead. > * This doesn't support pagination, but you can use `limit`. > * This isn't designed for large data sets. For optimal performance, use the `search` parameter instead."
    },
    "after": {
      "type": "string",
      "description": "The cursor to use for pagination. It is an opaque string that specifies your current location in the list and is obtained from the `Link` response header. See [Pagination](https://developer.okta.com/docs/api/#pagination) and [Link header](https://developer.okta.com/docs/api/#link-header)."
    },
    "limit": {
      "type": "integer",
      "description": "Specifies the number of results returned. Defaults to 10 if `q` is provided.  You can use `limit` with `after` to define the cursor location in the data set and manage the user records per page."
    },
    "sortBy": {
      "type": "string",
      "description": "Specifies the field to sort by (for search queries only). This can be any single property, for example `sortBy=profile.lastName`. Users with the same value for the `sortBy` property are ordered by `id`. Use with `sortOrder` to control the order of results."
    },
    "sortOrder": {
      "type": "string",
      "description": "Specifies sort order: `asc` or `desc` (for search queries only). This parameter is ignored if `sortBy` isn't present."
    },
    "fields": {
      "type": "string",
      "description": "Specifies a select set of user properties to query. Any other properties will be filtered out of the returned users. This is often called field projections in APIs, which can reduce payload size, improve performance, and limit unneccessary data exposure.  Requested fields should be comma-separated. Comma-separate the fields and place sub-fields in the profile object inside a `profile:()` directive, for example `profile:(firstName, city)`. The `id` field is always included, regardless of whether it's specified in the `fields` parameter."
    },
    "expand": {
      "type": "string",
      "description": "<x-lifecycle-container><x-lifecycle class=\"ea\"></x-lifecycle></x-lifecycle-container>A parameter to include metadata in the `_embedded` property. Supported value: `classification`."
    }
  },
  "required": [
    "PCID"
  ]
}

okta-users_reactivate_user

Reactivate a user Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user
`sendEmail`	boolean	No	—	Sends an activation email to the user if `true`

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user"
    },
    "sendEmail": {
      "type": "boolean",
      "description": "Sends an activation email to the user if `true`"
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

okta-users_replace_user

Replace a user Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user
`strict`	boolean	No	—	If `true`, validates against minimum age and history password policy
`If-Match`	string	No	—	The ETag value of the user’s expected current state. This becomes a conditional request used for concurrency control. See Conditional Requests and Entity Tags.
`credentials`	object	No	—	Specifies primary authentication and recovery credentials for a user. Credential types and requirements vary depending on the provider and security policy of the org.
`profile`	object	No	—	Specifies the default and custom profile properties for a user. The default user profile is based on the System for Cross-domain Identity Management: Core Schema. The only permitted customizations of the default profile are to update permissions, change whether the `firstName` and `lastName` properties are nullable, and specify a pattern for `login`. You can use the Profile Editor in the Admin Console or the Schemas API to make schema modifications. You can extend user profiles with custom properties. You must first add the custom property to the user profile schema before you reference it. You can use the Profile Editor in the Admin Console or the Schemas API to manage schema extensions. Custom attributes can contain HTML tags. It’s the client’s responsibility to escape or encode this data before displaying it. Use best-practices to prevent cross-site scripting.
`realmId`	string	No	—	The ID of the realm in which the user is residing. See Realms.
`type`	object	No	—	The ID of the user type. Add this value if you want to create a user with a non-default User Type. The user type determines which schema applies to that user. After a user has been created, the user can only be assigned a different user type by an admin through a full replacement (`PUT`) operation.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user"
    },
    "strict": {
      "type": "boolean",
      "description": "If `true`, validates against minimum age and history password policy"
    },
    "If-Match": {
      "type": "string",
      "description": "The ETag value of the user's expected current state. This becomes a conditional request used for concurrency control. See [Conditional Requests and Entity Tags](/#conditional-requests-and-entity-tags)."
    },
    "credentials": {
      "type": "object",
      "description": "Specifies primary authentication and recovery credentials for a user. Credential types and requirements vary depending on the provider and security policy of the org.",
      "properties": {
        "password": {
          "type": "object",
          "description": "Specifies a password for a user.  When a user has a valid password, imported hashed password, or password hook, and a response object contains a password credential, then the password object is a bare object without the value property defined (for example, `password: {}`). This indicates that a password value exists. You can modify password policy requirements in the Admin Console by editing the Password authenticator:  **Security** > **Authenticators** > **Password** (or for Okta Classic orgs, use **Security** > **Authentication** > **Password**).  For information on defaults and configuring your password policies, see [Configure the password authenticator](https://help.okta.com/okta_help.htm?type=oie&id=ext-configure-password) in the help documentation."
        },
        "provider": {
          "type": "object",
          "description": "Specifies the authentication provider that validates the user's password credential. The user's current provider is managed by the **Delegated Authentication** settings for your org. The provider object is **read-only**."
        },
        "recovery_question": {
          "type": "object",
          "description": "Specifies a secret question and answer that's validated (case insensitive) when a user forgets their password or unlocks their account. The answer property is write-only."
        }
      }
    },
    "profile": {
      "type": "object",
      "description": "Specifies the default and custom profile properties for a user.  The default user profile is based on the [System for Cross-domain Identity Management: Core Schema](https://datatracker.ietf.org/doc/html/rfc7643).  The only permitted customizations of the default profile are to update permissions, change whether the `firstName` and `lastName` properties are nullable, and specify a [pattern](https://developer.okta.com/docs/reference/api/schemas/#login-pattern-validation) for `login`. You can use the Profile Editor in the Admin Console or the [Schemas API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UISchema/#tag/UISchema) to make schema modifications.  You can extend user profiles with custom properties. You must first add the custom property to the user profile schema before you reference it. You can use the Profile Editor in the Admin Console or the [Schemas API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UISchema/#tag/UISchema) to manage schema extensions.  Custom attributes can contain HTML tags. It's the client's responsibility to escape or encode this data before displaying it. Use [best-practices](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) to prevent cross-site scripting.",
      "properties": {
        "city": {
          "type": "string",
          "description": "The city or locality of the user's address (`locality`)"
        },
        "costCenter": {
          "type": "string",
          "description": "Name of the cost center assigned to a user"
        },
        "countryCode": {
          "type": "string",
          "description": "The country name component of the user's address (`country`). For validation, see [ISO 3166-1 alpha 2 \"short\" code format](https://datatracker.ietf.org/doc/html/draft-ietf-scim-core-schema-22#ref-ISO3166)."
        },
        "department": {
          "type": "string",
          "description": "Name of the user's department"
        },
        "displayName": {
          "type": "string",
          "description": "Name of the user suitable for display to end users"
        },
        "division": {
          "type": "string",
          "description": "Name of the user's division"
        },
        "email": {
          "type": "string",
          "description": "The primary email address of the user. For validation, see [RFC 5322 Section 3.2.3](https://datatracker.ietf.org/doc/html/rfc5322#section-3.2.3)."
        },
        "employeeNumber": {
          "type": "string",
          "description": "The organization or company assigned unique identifier for the user"
        },
        "firstName": {
          "type": "string",
          "description": "Given name of the user (`givenName`)"
        },
        "honorificPrefix": {
          "type": "string",
          "description": "Honorific prefix(es) of the user, or title in most Western languages"
        },
        "honorificSuffix": {
          "type": "string",
          "description": "Honorific suffix(es) of the user"
        },
        "lastName": {
          "type": "string",
          "description": "The family name of the user (`familyName`)"
        },
        "locale": {
          "type": "string",
          "description": "The user's default location for purposes of localizing items such as currency, date time format, numerical representations, and so on. A locale value is a concatenation of the ISO 639-1 two-letter language code, an underscore, and the ISO 3166-1 two-letter country code. For example, en_US specifies the language English and country US. This value is `en_US` by default."
        },
        "login": {
          "type": "string",
          "description": "The unique identifier for the user (`username`). For validation, see [Login pattern validation](https://developer.okta.com/docs/reference/api/schemas/#login-pattern-validation).  Every user within your Okta org must have a unique identifier for a login. This constraint applies to all users you import from other systems or applications such as Active Directory. Your organization is the top-level namespace to mix and match logins from all your connected applications or directories. Careful consideration of naming conventions for your login identifier will make it easier to onboard new applications in the future.  Logins are not considered unique if they differ only in case and/or diacritical marks. If one of your users has a login of `Isaac.Brock@example.com`, there cannot be another user whose login is `isaac.brock@example.com`, nor `isáàc.bröck@example.com`.  Okta has a default ambiguous name resolution policy for usernames that include @-signs. By default, usernames must be formatted as email addresses and thus always include @-signs. You can remove that restriction using either the Admin Console or the [Schemas API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/). Users can sign in with their non-qualified short name (for example: `isaac.brock` with username `isaac.brock@example.com`) as long as the short name is still unique within the org."
        },
        "manager": {
          "type": "string",
          "description": "The `displayName` of the user's manager"
        },
        "managerId": {
          "type": "string",
          "description": "The `id` of the user's manager"
        },
        "middleName": {
          "type": "string",
          "description": "The middle name of the user"
        },
        "mobilePhone": {
          "type": "string",
          "description": "The mobile phone number of the user"
        },
        "nickName": {
          "type": "string",
          "description": "The casual way to address the user in real life"
        },
        "organization": {
          "type": "string",
          "description": "Name of the the user's organization"
        },
        "postalAddress": {
          "type": "string",
          "description": "Mailing address component of the user's address"
        },
        "preferredLanguage": {
          "type": "string",
          "description": "The user's preferred written or spoken language. For validation, see [RFC 7231 Section 5.3.5](https://datatracker.ietf.org/doc/html/rfc7231#section-5.3.5)."
        },
        "primaryPhone": {
          "type": "string",
          "description": "The primary phone number of the user such as a home number"
        },
        "profileUrl": {
          "type": "string",
          "description": "The URL of the user's online profile. For example, a web page. See [URL](https://datatracker.ietf.org/doc/html/rfc1808)."
        },
        "secondEmail": {
          "type": "string",
          "description": "The secondary email address of the user typically used for account recovery. For validation, see [RFC 5322 Section 3.2.3](https://datatracker.ietf.org/doc/html/rfc5322#section-3.2.3)."
        },
        "state": {
          "type": "string",
          "description": "The state or region component of the user's address (`region`)"
        },
        "streetAddress": {
          "type": "string",
          "description": "The full street address component of the user's address"
        },
        "timezone": {
          "type": "string",
          "description": "The user's time zone"
        },
        "title": {
          "type": "string",
          "description": "The user's title, such as Vice President"
        },
        "userType": {
          "type": "string",
          "description": "The property used to describe the organization-to-user relationship, such as employee or contractor  > **Note:** The `userType` property is a standard string attribute and should be treated as a descriptive label rather than a functional setting. Unlike a user's assigned user [`type`](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#tag/User/operation/createUser!path=type&t=request), this property is purely informational and doesn't influence the behavior of the Okta platform."
        },
        "zipCode": {
          "type": "string",
          "description": "The ZIP code or postal code component of the user's address (`postalCode`)"
        }
      }
    },
    "realmId": {
      "type": "string",
      "description": "The ID of the realm in which the user is residing. See [Realms](/openapi/okta-management/management/tags/realm)."
    },
    "type": {
      "type": "object",
      "description": "The ID of the user type. Add this value if you want to create a user with a non-default [User Type](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/). The user type determines which [schema](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/) applies to that user. After a user has been created, the user can only be assigned a different user type by an admin through a full replacement (`PUT`) operation.",
      "properties": {
        "id": {
          "type": "string",
          "description": "The ID of the user type"
        }
      }
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

okta-users_replace_user_type

Replace a user type Parameters:

Parameter	Type	Required	Default	Description
`typeId`	string	Yes	—	The unique key for the user type
`description`	string	Yes	—	The human-readable description of the user type
`displayName`	string	Yes	—	The human-readable name of the user type
`name`	string	Yes	—	The name of the existing type

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "typeId": {
      "type": "string",
      "description": "The unique key for the user type"
    },
    "description": {
      "type": "string",
      "description": "The human-readable description of the user type"
    },
    "displayName": {
      "type": "string",
      "description": "The human-readable name of the user type"
    },
    "name": {
      "type": "string",
      "description": "The name of the existing type"
    }
  },
  "required": [
    "PCID",
    "typeId",
    "description",
    "displayName",
    "name"
  ]
}

okta-users_reset_factors

Reset the factors Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user"
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

okta-users_reset_password

Reset a password Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user
`sendEmail`	boolean	Yes	—	Send Email
`revokeSessions`	boolean	No	—	Revokes all user sessions, except for the current session, if set to `true`

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user"
    },
    "sendEmail": {
      "type": "boolean",
      "description": "Send Email"
    },
    "revokeSessions": {
      "type": "boolean",
      "description": "Revokes all user sessions, except for the current session, if set to `true`"
    }
  },
  "required": [
    "PCID",
    "id",
    "sendEmail"
  ]
}

okta-users_suspend_user

Suspend a user Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user"
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

okta-users_unlock_user

Unlock a user Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user"
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

okta-users_unsuspend_user

Unsuspend a user Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user"
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

okta-users_update_user

Update a user Parameters:

Parameter	Type	Required	Default	Description
`id`	string	Yes	—	An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user
`strict`	boolean	No	—	If true, validates against minimum age and history password policy
`If-Match`	string	No	—	The ETag value of the user’s expected current state. This becomes a conditional request used for concurrency control. See Conditional Requests and Entity Tags.
`credentials`	object	No	—	Specifies primary authentication and recovery credentials for a user. Credential types and requirements vary depending on the provider and security policy of the org.
`profile`	object	No	—	Specifies the default and custom profile properties for a user. The default user profile is based on the System for Cross-domain Identity Management: Core Schema. The only permitted customizations of the default profile are to update permissions, change whether the `firstName` and `lastName` properties are nullable, and specify a pattern for `login`. You can use the Profile Editor in the Admin Console or the Schemas API to make schema modifications. You can extend user profiles with custom properties. You must first add the custom property to the user profile schema before you reference it. You can use the Profile Editor in the Admin Console or the Schemas API to manage schema extensions. Custom attributes can contain HTML tags. It’s the client’s responsibility to escape or encode this data before displaying it. Use best-practices to prevent cross-site scripting.
`realmId`	string	No	—	The ID of the realm in which the user is residing. See Realms.
`type`	object	No	—	The ID of the user type. Add this value if you want to create a user with a non-default User Type. The user type determines which schema applies to that user. After a user has been created, the user can only be assigned a different user type by an admin through a full replacement (`PUT`) operation.

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "id": {
      "type": "string",
      "description": "An ID, login, or login shortname (as long as the shortname is unambiguous) of an existing Okta user"
    },
    "strict": {
      "type": "boolean",
      "description": "If true, validates against minimum age and history password policy"
    },
    "If-Match": {
      "type": "string",
      "description": "The ETag value of the user's expected current state. This becomes a conditional request used for concurrency control. See [Conditional Requests and Entity Tags](/#conditional-requests-and-entity-tags)."
    },
    "credentials": {
      "type": "object",
      "description": "Specifies primary authentication and recovery credentials for a user. Credential types and requirements vary depending on the provider and security policy of the org.",
      "properties": {
        "password": {
          "type": "object",
          "description": "Specifies a password for a user.  When a user has a valid password, imported hashed password, or password hook, and a response object contains a password credential, then the password object is a bare object without the value property defined (for example, `password: {}`). This indicates that a password value exists. You can modify password policy requirements in the Admin Console by editing the Password authenticator:  **Security** > **Authenticators** > **Password** (or for Okta Classic orgs, use **Security** > **Authentication** > **Password**).  For information on defaults and configuring your password policies, see [Configure the password authenticator](https://help.okta.com/okta_help.htm?type=oie&id=ext-configure-password) in the help documentation."
        },
        "provider": {
          "type": "object",
          "description": "Specifies the authentication provider that validates the user's password credential. The user's current provider is managed by the **Delegated Authentication** settings for your org. The provider object is **read-only**."
        },
        "recovery_question": {
          "type": "object",
          "description": "Specifies a secret question and answer that's validated (case insensitive) when a user forgets their password or unlocks their account. The answer property is write-only."
        }
      }
    },
    "profile": {
      "type": "object",
      "description": "Specifies the default and custom profile properties for a user.  The default user profile is based on the [System for Cross-domain Identity Management: Core Schema](https://datatracker.ietf.org/doc/html/rfc7643).  The only permitted customizations of the default profile are to update permissions, change whether the `firstName` and `lastName` properties are nullable, and specify a [pattern](https://developer.okta.com/docs/reference/api/schemas/#login-pattern-validation) for `login`. You can use the Profile Editor in the Admin Console or the [Schemas API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UISchema/#tag/UISchema) to make schema modifications.  You can extend user profiles with custom properties. You must first add the custom property to the user profile schema before you reference it. You can use the Profile Editor in the Admin Console or the [Schemas API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UISchema/#tag/UISchema) to manage schema extensions.  Custom attributes can contain HTML tags. It's the client's responsibility to escape or encode this data before displaying it. Use [best-practices](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) to prevent cross-site scripting.",
      "properties": {
        "city": {
          "type": "string",
          "description": "The city or locality of the user's address (`locality`)"
        },
        "costCenter": {
          "type": "string",
          "description": "Name of the cost center assigned to a user"
        },
        "countryCode": {
          "type": "string",
          "description": "The country name component of the user's address (`country`). For validation, see [ISO 3166-1 alpha 2 \"short\" code format](https://datatracker.ietf.org/doc/html/draft-ietf-scim-core-schema-22#ref-ISO3166)."
        },
        "department": {
          "type": "string",
          "description": "Name of the user's department"
        },
        "displayName": {
          "type": "string",
          "description": "Name of the user suitable for display to end users"
        },
        "division": {
          "type": "string",
          "description": "Name of the user's division"
        },
        "email": {
          "type": "string",
          "description": "The primary email address of the user. For validation, see [RFC 5322 Section 3.2.3](https://datatracker.ietf.org/doc/html/rfc5322#section-3.2.3)."
        },
        "employeeNumber": {
          "type": "string",
          "description": "The organization or company assigned unique identifier for the user"
        },
        "firstName": {
          "type": "string",
          "description": "Given name of the user (`givenName`)"
        },
        "honorificPrefix": {
          "type": "string",
          "description": "Honorific prefix(es) of the user, or title in most Western languages"
        },
        "honorificSuffix": {
          "type": "string",
          "description": "Honorific suffix(es) of the user"
        },
        "lastName": {
          "type": "string",
          "description": "The family name of the user (`familyName`)"
        },
        "locale": {
          "type": "string",
          "description": "The user's default location for purposes of localizing items such as currency, date time format, numerical representations, and so on. A locale value is a concatenation of the ISO 639-1 two-letter language code, an underscore, and the ISO 3166-1 two-letter country code. For example, en_US specifies the language English and country US. This value is `en_US` by default."
        },
        "login": {
          "type": "string",
          "description": "The unique identifier for the user (`username`). For validation, see [Login pattern validation](https://developer.okta.com/docs/reference/api/schemas/#login-pattern-validation).  Every user within your Okta org must have a unique identifier for a login. This constraint applies to all users you import from other systems or applications such as Active Directory. Your organization is the top-level namespace to mix and match logins from all your connected applications or directories. Careful consideration of naming conventions for your login identifier will make it easier to onboard new applications in the future.  Logins are not considered unique if they differ only in case and/or diacritical marks. If one of your users has a login of `Isaac.Brock@example.com`, there cannot be another user whose login is `isaac.brock@example.com`, nor `isáàc.bröck@example.com`.  Okta has a default ambiguous name resolution policy for usernames that include @-signs. By default, usernames must be formatted as email addresses and thus always include @-signs. You can remove that restriction using either the Admin Console or the [Schemas API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/). Users can sign in with their non-qualified short name (for example: `isaac.brock` with username `isaac.brock@example.com`) as long as the short name is still unique within the org."
        },
        "manager": {
          "type": "string",
          "description": "The `displayName` of the user's manager"
        },
        "managerId": {
          "type": "string",
          "description": "The `id` of the user's manager"
        },
        "middleName": {
          "type": "string",
          "description": "The middle name of the user"
        },
        "mobilePhone": {
          "type": "string",
          "description": "The mobile phone number of the user"
        },
        "nickName": {
          "type": "string",
          "description": "The casual way to address the user in real life"
        },
        "organization": {
          "type": "string",
          "description": "Name of the the user's organization"
        },
        "postalAddress": {
          "type": "string",
          "description": "Mailing address component of the user's address"
        },
        "preferredLanguage": {
          "type": "string",
          "description": "The user's preferred written or spoken language. For validation, see [RFC 7231 Section 5.3.5](https://datatracker.ietf.org/doc/html/rfc7231#section-5.3.5)."
        },
        "primaryPhone": {
          "type": "string",
          "description": "The primary phone number of the user such as a home number"
        },
        "profileUrl": {
          "type": "string",
          "description": "The URL of the user's online profile. For example, a web page. See [URL](https://datatracker.ietf.org/doc/html/rfc1808)."
        },
        "secondEmail": {
          "type": "string",
          "description": "The secondary email address of the user typically used for account recovery. For validation, see [RFC 5322 Section 3.2.3](https://datatracker.ietf.org/doc/html/rfc5322#section-3.2.3)."
        },
        "state": {
          "type": "string",
          "description": "The state or region component of the user's address (`region`)"
        },
        "streetAddress": {
          "type": "string",
          "description": "The full street address component of the user's address"
        },
        "timezone": {
          "type": "string",
          "description": "The user's time zone"
        },
        "title": {
          "type": "string",
          "description": "The user's title, such as Vice President"
        },
        "userType": {
          "type": "string",
          "description": "The property used to describe the organization-to-user relationship, such as employee or contractor  > **Note:** The `userType` property is a standard string attribute and should be treated as a descriptive label rather than a functional setting. Unlike a user's assigned user [`type`](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#tag/User/operation/createUser!path=type&t=request), this property is purely informational and doesn't influence the behavior of the Okta platform."
        },
        "zipCode": {
          "type": "string",
          "description": "The ZIP code or postal code component of the user's address (`postalCode`)"
        }
      }
    },
    "realmId": {
      "type": "string",
      "description": "The ID of the realm in which the user is residing. See [Realms](/openapi/okta-management/management/tags/realm)."
    },
    "type": {
      "type": "object",
      "description": "The ID of the user type. Add this value if you want to create a user with a non-default [User Type](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/). The user type determines which [schema](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/) applies to that user. After a user has been created, the user can only be assigned a different user type by an admin through a full replacement (`PUT`) operation.",
      "properties": {
        "id": {
          "type": "string",
          "description": "The ID of the user type"
        }
      }
    }
  },
  "required": [
    "PCID",
    "id"
  ]
}

okta-users_update_user_type

Update a user type Parameters:

Parameter	Type	Required	Default	Description
`typeId`	string	Yes	—	The unique key for the user type
`description`	string	No	—	The updated human-readable description of the user type
`displayName`	string	No	—	The updated human-readable display name for the user type

Show inputSchema

{
  "type": "object",
  "properties": {
    "PCID": {
      "type": "string",
      "description": "Pink Connect ID for the authenticated connection"
    },
    "typeId": {
      "type": "string",
      "description": "The unique key for the user type"
    },
    "description": {
      "type": "string",
      "description": "The updated human-readable description of the user type"
    },
    "displayName": {
      "type": "string",
      "description": "The updated human-readable display name for the user type"
    }
  },
  "required": [
    "PCID",
    "typeId"
  ]
}

​Tools

​okta-users_activate_user

​okta-users_change_password

​okta-users_change_recovery_question

​okta-users_create_user

​okta-users_create_user_type

​okta-users_deactivate_user

​okta-users_delete_user

​okta-users_delete_user_type

​okta-users_expire_password

​okta-users_expire_password_with_temp_password

​okta-users_forgot_password

​okta-users_forgot_password_set_new_password

​okta-users_get_user

​okta-users_get_user_type

​okta-users_list_user_blocks

​okta-users_list_user_types

​okta-users_list_users

​okta-users_reactivate_user

​okta-users_replace_user

​okta-users_replace_user_type

​okta-users_reset_factors

​okta-users_reset_password

​okta-users_suspend_user

​okta-users_unlock_user

​okta-users_unsuspend_user

​okta-users_update_user

​okta-users_update_user_type

Tools

okta-users_activate_user

okta-users_change_password

okta-users_change_recovery_question

okta-users_create_user

okta-users_create_user_type

okta-users_deactivate_user

okta-users_delete_user

okta-users_delete_user_type

okta-users_expire_password

okta-users_expire_password_with_temp_password

okta-users_forgot_password

okta-users_forgot_password_set_new_password

okta-users_get_user

okta-users_get_user_type

okta-users_list_user_blocks

okta-users_list_user_types

okta-users_list_users

okta-users_reactivate_user

okta-users_replace_user

okta-users_replace_user_type

okta-users_reset_factors

okta-users_reset_password

okta-users_suspend_user

okta-users_unlock_user

okta-users_unsuspend_user

okta-users_update_user

okta-users_update_user_type