Okta

Category: IT / Identity
Connect by: Paste an API key
Official API docs: https://developer.okta.com/docs/api/openapi/okta-management/guides/overview/

What the agent can see

Capability	API call	Risk	Needs approval
List users in the org, optionally filtered by a search expression. (docs)	GET /api/v1/users	🟢 low	— no
Retrieve a single user by id, login, or login shortname. (docs)	GET /api/v1/users/{id}	🟢 low	— no
List groups in the org, optionally filtered by a search expression. (docs)	GET /api/v1/groups	🟢 low	— no

What the agent can do

Capability	API call	Risk	Needs approval
Provision a new user (profile.firstName/lastName/email/login) and activate them (?activate=true). (docs)	POST /api/v1/users?activate=true	🔴 high	✅ yes
Deactivate a user — destructive lifecycle transition that removes their access (terminal DEPROVISIONED state). (docs)	POST /api/v1/users/{id}/lifecycle/deactivate	🔴 high	✅ yes
Suspend an ACTIVE user — reversible lifecycle transition that blocks sign-in (SUSPENDED state). (docs)	POST /api/v1/users/{id}/lifecycle/suspend	🟡 medium	✅ yes
Add an existing user to a group, granting that group's access. (docs)	PUT /api/v1/groups/{groupId}/users/{userId}	🟡 medium	✅ yes

Connecting it

• You provide: API token (SSWS) + Okta org URL
• Where to get it: In the Okta Admin Console: Security → API → Tokens → Create Token. Copy the token value (shown once). The token inherits the permissions of the admin who created it, so create it as an admin with the least-privilege role needed (e.g. read-only admin for sync, user-admin for provisioning). Connect with your Okta org URL (https://<org>.okta.com) + the token. Auth header is 'SSWS {token}' — Okta's proprietary scheme, not Bearer.
• Permissions/scopes: none / not scope-based

Account setup

• Account needed: An Okta org (Workforce Identity). The API token is minted by an admin; provisioning/lifecycle ops require the token's admin to hold a user-administration role.
• App registration: No app registration — Security → API → Tokens → Create Token. (Okta recommends OAuth 2.0 + scoped service apps for production; this connector uses the SSWS API-token scheme.)
• Verification required: No marketplace review — access is governed by the API token creator's admin role.
• Testing: Use a free Okta Integrator/Developer Edition org (developer.okta.com).

Limits

Okta enforces per-org, per-endpoint rate limits that vary by org type/plan. Every response carries X-Rate-Limit-Limit / X-Rate-Limit-Remaining / X-Rate-Limit-Reset (reset is UTC epoch seconds). On exceed Okta returns HTTP 429 — back off until X-Rate-Limit-Reset (there is no Retry-After header).