# Okta Admin Management API API

> Okta Admin Management API API on Apizie: 400 endpoints (Retrieve the well-known app authenticator configuration, Retrieve the customized apple-app-site-association URI content, Retrieve the customized assetlinks.json URI content, Retrieve the Org metadata, …) returned as clean JSON through one API key. Send your own provider key in the x-upstream-key header. Call it over REST at https://apizie.tech/v1/security:okta/{endpoint} or from Claude, ChatGPT and Cursor through the Apizie MCP server. Free plan: 1,000 requests a month.

- Project key: `security:okta`
- Category: Security
- Status: byok
- Source: https://developer.okta.com/
- Page: https://apizie.tech/api/security/okta
- OpenAPI: https://apizie.tech/api/security/okta/openapi.json

Allows customers to easily access the Okta Management APIs

## Endpoints

### Retrieve the well-known app authenticator configuration
`GET https://apizie.tech/v1/security:okta/get-well-known-app-authenticator-configuration` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| oauthClientId | string | yes | Filters app authenticator configurations by `oauthClientId` |

### Retrieve the customized apple-app-site-association URI content
`GET https://apizie.tech/v1/security:okta/get-apple-app-site-association-well-known-uri` (byok)

### Retrieve the customized assetlinks.json URI content
`GET https://apizie.tech/v1/security:okta/get-asset-links-well-known-uri` (byok)

### Retrieve the Org metadata
`GET https://apizie.tech/v1/security:okta/get-wellknown-org-metadata` (byok)

### Retrieve the SSF transmitter metadata
`GET https://apizie.tech/v1/security:okta/get-wellknown-ssf-metadata` (byok)

### Retrieve the customized webauthn URI content
`GET https://apizie.tech/v1/security:okta/get-web-authn-well-known-uri` (byok)

### List all agent pools
`GET https://apizie.tech/v1/security:okta/list-agent-pools` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| limitPerPoolType | integer | no | Maximum number of agent pools returned |
| poolType | string | no | Agent type to search for |
| after | string | no | The cursor to use for pagination. It is an opaque string that specifies your current location in the list and is obtained from the `Link`… |

### List all agent pool updates
`GET https://apizie.tech/v1/security:okta/list-agent-pools-updates` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| poolId | string | yes | ID of the agent pool for which the settings apply to |
| scheduled | boolean | no | Return only scheduled or ad-hoc updates. If this parameter isn't provided, Okta returns the entire list of updates. |

### Create an agent pool update
`POST https://apizie.tech/v1/security:okta/create-agent-pools-update` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| poolId | string | yes | ID of the agent pool for which the settings apply to |
| body | object | yes | JSON request body |

### Retrieve an agent pool update's settings
`GET https://apizie.tech/v1/security:okta/get-agent-pools-update-settings` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| poolId | string | yes | ID of the agent pool for which the settings apply to |

### Update an agent pool update settings
`POST https://apizie.tech/v1/security:okta/update-agent-pools-update-settings` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| poolId | string | yes | ID of the agent pool for which the settings apply to |
| body | object | yes | JSON request body |

### Retrieve an agent pool update by ID
`GET https://apizie.tech/v1/security:okta/get-agent-pools-update-instance` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| poolId | string | yes | ID of the agent pool for which the settings apply to |
| updateId | string | yes | ID of the update |

### Update an agent pool update by ID
`POST https://apizie.tech/v1/security:okta/update-agent-pools-update` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| poolId | string | yes | ID of the agent pool for which the settings apply to |
| updateId | string | yes | ID of the update |
| body | object | yes | JSON request body |

### Delete an agent pool update
`POST https://apizie.tech/v1/security:okta/delete-agent-pools-update` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| poolId | string | yes | ID of the agent pool for which the settings apply to |
| updateId | string | yes | ID of the update |

### Activate an agent pool update
`POST https://apizie.tech/v1/security:okta/activate-agent-pools-update` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| poolId | string | yes | ID of the agent pool for which the settings apply to |
| updateId | string | yes | ID of the update |

### Deactivate an agent pool update
`POST https://apizie.tech/v1/security:okta/deactivate-agent-pools-update` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| poolId | string | yes | ID of the agent pool for which the settings apply to |
| updateId | string | yes | ID of the update |

### Pause an agent pool update
`POST https://apizie.tech/v1/security:okta/pause-agent-pools-update` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| poolId | string | yes | ID of the agent pool for which the settings apply to |
| updateId | string | yes | ID of the update |

### Resume an agent pool update
`POST https://apizie.tech/v1/security:okta/resume-agent-pools-update` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| poolId | string | yes | ID of the agent pool for which the settings apply to |
| updateId | string | yes | ID of the update |

### Retry an agent pool update
`POST https://apizie.tech/v1/security:okta/retry-agent-pools-update` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| poolId | string | yes | ID of the agent pool for which the settings apply to |
| updateId | string | yes | ID of the update |

### Stop an agent pool update
`POST https://apizie.tech/v1/security:okta/stop-agent-pools-update` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| poolId | string | yes | ID of the agent pool for which the settings apply to |
| updateId | string | yes | ID of the update |

### List all API token metadata
`GET https://apizie.tech/v1/security:okta/list-api-tokens` (byok)

### Revoke the current API token
`POST https://apizie.tech/v1/security:okta/revoke-current-api-token` (byok)

### Retrieve an API token's metadata
`GET https://apizie.tech/v1/security:okta/get-api-token` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| apiTokenId | string | yes | id of the API Token |

### Upsert an API token network condition
`POST https://apizie.tech/v1/security:okta/upsert-api-token` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| apiTokenId | string | yes | id of the API Token |
| body | object | yes | JSON request body |

### Revoke an API token
`POST https://apizie.tech/v1/security:okta/revoke-api-token` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| apiTokenId | string | yes | id of the API Token |

### List all applications
`GET https://apizie.tech/v1/security:okta/list-applications` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| q | string | no | Searches for apps with `name` or `label` properties that starts with the `q` value using the `startsWith` operation |
| after | string | no | Specifies the [pagination](/#pagination) cursor for the next page of results. Treat this as an opaque value obtained through the `next`… |
| useOptimization | boolean | no | Specifies whether to use query optimization. If you specify `useOptimization=true` in the request query, the response contains a subset of… |
| alwaysIncludeVpnSettings | boolean | no | Specifies whether to include the VPN configuration for existing notifications in the result, regardless of whether VPN notifications are… |
| limit | integer | no | Specifies the number of results per page |
| filter | string | no | Filters apps with a supported expression for a subset of properties. Filtering supports the following limited number of properties: `id`,… |
| expand | string | no | An optional parameter used for link expansion to embed more resources in the response. Only supports `expand=user/{userId}` and must be… |
| includeNonDeleted | boolean | no | Specifies whether to include non-active, but not deleted apps in the results |

### Create an application
`POST https://apizie.tech/v1/security:okta/create-application` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| activate | boolean | no | Executes activation lifecycle operation when creating the app |
| OktaAccessGateway-Agent | string | no |  |
| body | object | yes | JSON request body |

### Retrieve an application
`GET https://apizie.tech/v1/security:okta/get-application` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| expand | string | no | An optional query parameter to return the specified [Application User](/openapi/okta-management/management/tags/applicationusers) in the… |

### Replace an application
`POST https://apizie.tech/v1/security:okta/replace-application` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| body | object | yes | JSON request body |

### Delete an application
`POST https://apizie.tech/v1/security:okta/delete-application` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |

### Retrieve the default provisioning connection
`GET https://apizie.tech/v1/security:okta/get-default-provisioning-connection-for-application` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |

### Update the default provisioning connection
`POST https://apizie.tech/v1/security:okta/update-default-provisioning-connection-for-application` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| activate | boolean | no | Activates the provisioning connection |
| body | object | yes | JSON request body |

### Retrieve a JSON Web Key Set (JWKS) for the default provisioning connection
`GET https://apizie.tech/v1/security:okta/get-user-provisioning-connection-jwks` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |

### Activate the default provisioning connection
`POST https://apizie.tech/v1/security:okta/activate-default-provisioning-connection-for-application` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |

### Deactivate the default provisioning connection
`POST https://apizie.tech/v1/security:okta/deactivate-default-provisioning-connection-for-application` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |

### List all certificate signing requests
`GET https://apizie.tech/v1/security:okta/list-csrs-for-application` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |

### Generate a certificate signing request
`POST https://apizie.tech/v1/security:okta/generate-csr-for-application` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| body | object | yes | JSON request body |

### Retrieve a certificate signing request
`GET https://apizie.tech/v1/security:okta/get-csr-for-application` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| csrId | string | yes | `id` of the CSR |

### Revoke a certificate signing request
`POST https://apizie.tech/v1/security:okta/revoke-csr-from-application` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| csrId | string | yes | `id` of the CSR |

### Publish a certificate signing request
`POST https://apizie.tech/v1/security:okta/publish-csr-from-application` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| csrId | string | yes | `id` of the CSR |

### List all the OAuth 2.0 client JSON Web Keys
`GET https://apizie.tech/v1/security:okta/list-jwk` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |

### Add a JSON Web Key
`POST https://apizie.tech/v1/security:okta/add-jwk` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| body | object | yes | JSON request body |

### Retrieve an OAuth 2.0 client JSON Web Key
`GET https://apizie.tech/v1/security:okta/get-jwk` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| keyId | string | yes | Unique `id` of the OAuth 2.0 client JSON Web Key |

### Delete an OAuth 2.0 client JSON Web Key
`POST https://apizie.tech/v1/security:okta/deletejwk` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| keyId | string | yes | Unique `id` of the OAuth 2.0 client JSON Web Key |

### Activate an OAuth 2.0 client JSON Web Key
`POST https://apizie.tech/v1/security:okta/activate-oauth2-client-json-web-key` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| keyId | string | yes | Unique `id` of the OAuth 2.0 client JSON Web Key |

### Deactivate an OAuth 2.0 client JSON Web Key
`POST https://apizie.tech/v1/security:okta/deactivate-oauth2-client-json-web-key` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| keyId | string | yes | Unique `id` of the OAuth 2.0 client JSON Web Key |

### List all key credentials
`GET https://apizie.tech/v1/security:okta/list-application-keys` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |

### Generate a key credential
`POST https://apizie.tech/v1/security:okta/generate-application-key` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| validityYears | integer | yes | Expiry years of the application key credential |

### Retrieve a key credential
`GET https://apizie.tech/v1/security:okta/get-application-key` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| keyId | string | yes | ID of the Key Credential for the application |

### Clone a key credential
`POST https://apizie.tech/v1/security:okta/clone-application-key` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| keyId | string | yes | ID of the Key Credential for the application |
| targetAid | string | yes | Unique key of the target app |

### List all OAuth 2.0 client secrets
`GET https://apizie.tech/v1/security:okta/list-oauth2-client-secrets` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |

### Create an OAuth 2.0 client secret
`POST https://apizie.tech/v1/security:okta/create-oauth2-client-secret` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| body | object | no | JSON request body |

### Retrieve an OAuth 2.0 client secret
`GET https://apizie.tech/v1/security:okta/get-oauth2-client-secret` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| secretId | string | yes | Unique `id` of the OAuth 2.0 client secret |

### Delete an OAuth 2.0 client secret
`POST https://apizie.tech/v1/security:okta/delete-oauth2-client-secret` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| secretId | string | yes | Unique `id` of the OAuth 2.0 client secret |

### Activate an OAuth 2.0 client secret
`POST https://apizie.tech/v1/security:okta/activate-oauth2-client-secret` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| secretId | string | yes | Unique `id` of the OAuth 2.0 client secret |

### Deactivate an OAuth 2.0 client secret
`POST https://apizie.tech/v1/security:okta/deactivate-oauth2-client-secret` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| secretId | string | yes | Unique `id` of the OAuth 2.0 client secret |

### Retrieve all Cross App Access connections
`GET https://apizie.tech/v1/security:okta/get-all-cross-app-access-connections` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| after | string | no | Specifies the pagination cursor for the next page of connection results |
| limit | integer | no | Specifies the number of results to return per page. The values: * -1: Return all results (up to system maximum) * 0: Return an empty… |
| status | string | no | Filters connections by their lifecycle status. When specified, only connections that match the specified status are returned. |
| requestingAppId | string | no | Filters only connections where the app with the specified ID is the requesting app |
| resourceAppId | string | no | Filters only connections where the app with the specified ID is the requesting app |
| activeAppsOnly | boolean | no | When set to true, filters the result to include only connections where both the requesting and resource app have a status of ACTIVE |
| requestingAppName | string | no | Filters connections where the requesting app's name matches the provided search string |
| resourceAppName | string | no | Filters connections where the resource app's name matches the provided search string |

### Create a Cross App Access connection
`POST https://apizie.tech/v1/security:okta/create-cross-app-access-connection` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| body | object | yes | JSON request body |

### Retrieve a Cross App Access connection
`GET https://apizie.tech/v1/security:okta/get-cross-app-access-connection` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| connectionId | string | yes | Connection ID |

### Update a Cross App Access connection
`POST https://apizie.tech/v1/security:okta/update-cross-app-access-connection` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| connectionId | string | yes | Connection ID |
| body | object | yes | JSON request body |

### Delete a Cross App Access connection
`POST https://apizie.tech/v1/security:okta/delete-cross-app-access-connection` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| connectionId | string | yes | Connection ID |

### List all features
`GET https://apizie.tech/v1/security:okta/list-features-for-application` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |

### Retrieve a feature
`GET https://apizie.tech/v1/security:okta/get-feature-for-application` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| featureName | string | yes | Name of the Feature |

### Update a feature
`POST https://apizie.tech/v1/security:okta/update-feature-for-application` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| featureName | string | yes | Name of the Feature |
| body | object | yes | JSON request body |

### List all configured federated claims
`GET https://apizie.tech/v1/security:okta/list-federated-claims` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |

### Create a federated claim
`POST https://apizie.tech/v1/security:okta/create-federated-claim` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| body | object | yes | JSON request body |

### Retrieve a federated claim
`GET https://apizie.tech/v1/security:okta/get-federated-claim` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| claimId | string | yes | The unique `id` of the federated claim |

### Replace a federated claim
`POST https://apizie.tech/v1/security:okta/replace-federated-claim` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| claimId | string | yes | The unique `id` of the federated claim |
| body | object | no | JSON request body |

### Delete a federated claim
`POST https://apizie.tech/v1/security:okta/delete-federated-claim` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| claimId | string | yes | The unique `id` of the federated claim |

### List all app grants
`GET https://apizie.tech/v1/security:okta/list-scope-consent-grants` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| expand | string | no | An optional parameter to return scope details in the `_embedded` property. Valid value: `scope` |

### Grant consent to scope
`POST https://apizie.tech/v1/security:okta/grant-consent-to-scope` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| body | object | yes | JSON request body |

### Retrieve an app grant
`GET https://apizie.tech/v1/security:okta/get-scope-consent-grant` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| grantId | string | yes | Grant ID |
| expand | string | no | An optional parameter to return scope details in the `_embedded` property. Valid value: `scope` |

### Revoke an app grant
`POST https://apizie.tech/v1/security:okta/revoke-scope-consent-grant` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| grantId | string | yes | Grant ID |

### List all group push mappings
`GET https://apizie.tech/v1/security:okta/list-group-push-mappings` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| after | string | no | Specifies the pagination cursor for the next page of mappings |
| limit | integer | no | Specifies the number of results returned |
| lastUpdated | string | no | Filters group push mappings by last updated date. The `lastUpdated` parameter supports the following format: `YYYY-MM-DDTHH:mm:ssZ`. This… |
| sourceGroupId | string | no | Filters group push mappings by source group ID. If you don't specify a value, all group push mappings are returned. |
| status | string | no | Filters group push mappings by status. If you don't specify a value, all group push mappings are returned. |

### Create a group push mapping
`POST https://apizie.tech/v1/security:okta/create-group-push-mapping` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| body | object | yes | JSON request body |

### Retrieve a group push mapping
`GET https://apizie.tech/v1/security:okta/get-group-push-mapping` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| mappingId | string | yes | Group push mapping ID |

### Update a group push mapping
`POST https://apizie.tech/v1/security:okta/update-group-push-mapping` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| mappingId | string | yes | Group push mapping ID |
| body | object | yes | JSON request body |

### Delete a group push mapping
`POST https://apizie.tech/v1/security:okta/delete-group-push-mapping` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| mappingId | string | yes | Group push mapping ID |
| deleteTargetGroup | boolean | yes | If set to `true`, the target group is also deleted. If set to `false`, the target group isn't deleted. |

### List all application groups
`GET https://apizie.tech/v1/security:okta/list-application-group-assignments` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| q | string | no | Specifies a filter for a list of assigned groups returned based on their names. The value of `q` is matched against the group `name`. This… |
| after | string | no | Specifies the pagination cursor for the `next` page of results. Treat this as an opaque value obtained through the next link relationship.… |
| limit | integer | no | Specifies the number of objects to return per page. If there are multiple pages of results, the Link header contains a `next` link that… |
| expand | string | no | An optional query parameter to return the corresponding assigned [group](openapi/okta-management/management/group) or the group assignment… |

### Retrieve an application group
`GET https://apizie.tech/v1/security:okta/get-application-group-assignment` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| groupId | string | yes | The `id` of the group |
| expand | string | no | An optional query parameter to return the corresponding assigned [group](openapi/okta-management/management/group) or the group assignment… |

### Assign an application group
`POST https://apizie.tech/v1/security:okta/assign-group-to-application` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| groupId | string | yes | The `id` of the group |
| body | object | no | JSON request body |

### Update an application group
`POST https://apizie.tech/v1/security:okta/update-group-assignment-to-application` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| groupId | string | yes | The `id` of the group |
| body | object | no | JSON request body |

### Unassign an application group
`POST https://apizie.tech/v1/security:okta/unassign-application-from-group` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| groupId | string | yes | The `id` of the group |

### List all allowed apps for a target app
`GET https://apizie.tech/v1/security:okta/list-interclient-allowed-applications` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |

### Create an allowed app mapping for a target app
`POST https://apizie.tech/v1/security:okta/create-interclient-trust-mapping` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| body | object | yes | JSON request body |

### Delete an interclient trust mapping
`POST https://apizie.tech/v1/security:okta/delete-interclient-trust-mapping` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| allowedAppId | string | yes | App ID of the allowed app instance to delete mapping from the target app. |

### List all target apps for an allowed app
`GET https://apizie.tech/v1/security:okta/list-interclient-target-applications` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |

### Activate an application
`POST https://apizie.tech/v1/security:okta/activate-application` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |

### Deactivate an application
`POST https://apizie.tech/v1/security:okta/deactivate-application` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |

### Upload an application logo
`POST https://apizie.tech/v1/security:okta/upload-application-logo` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| body | object | no | Form fields as a JSON object |

### Assign an app sign-in policy
`POST https://apizie.tech/v1/security:okta/assign-application-policy` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| policyId | string | yes | `id` of the policy |

### Preview the application SAML metadata
`GET https://apizie.tech/v1/security:okta/preview-samlmetadata-for-application` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| kid | string | yes |  |

### List all application refresh tokens
`GET https://apizie.tech/v1/security:okta/list-oauth2-tokens-for-application` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| expand | string | no | An optional parameter to return scope details in the `_embedded` property. Valid value: `scope` |
| after | string | no | Specifies the pagination cursor for the next page of results. Treat this as an opaque value obtained through the next link relationship.… |
| limit | integer | no | A limit on the number of objects to return |

### Revoke all application tokens
`POST https://apizie.tech/v1/security:okta/revoke-oauth2-tokens-for-application` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |

### Retrieve an application token
`GET https://apizie.tech/v1/security:okta/get-oauth2-token-for-application` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| tokenId | string | yes | `id` of Token |
| expand | string | no | An optional parameter to return scope details in the `_embedded` property. Valid value: `scope` |

### Revoke an application token
`POST https://apizie.tech/v1/security:okta/revoke-oauth2-token-for-application` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| tokenId | string | yes | `id` of Token |

### List all application users
`GET https://apizie.tech/v1/security:okta/list-application-users` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| after | string | no | Specifies the pagination cursor for the next page of results. Treat this as an opaque value obtained through the next link relationship.… |
| limit | integer | no | Specifies the number of objects to return per page. If there are multiple pages of results, the Link header contains a `next` link that… |
| q | string | no | Specifies a filter for the list of application users returned based on their profile attributes. The value of `q` is matched against the… |
| expand | string | no | An optional query parameter to return the corresponding [User](/openapi/okta-management/management/tags/user) object in the `_embedded`… |

### Assign an application user
`POST https://apizie.tech/v1/security:okta/assign-user-to-application` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| body | object | yes | JSON request body |

### Retrieve an application user
`GET https://apizie.tech/v1/security:okta/get-application-user` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| userId | string | yes | ID of an existing Okta user |
| expand | string | no | An optional query parameter to return the corresponding [User](/openapi/okta-management/management/tags/user) object in the `_embedded`… |

### Update an application user
`POST https://apizie.tech/v1/security:okta/update-application-user` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| userId | string | yes | ID of an existing Okta user |
| body | object | yes | JSON request body |

### Unassign an application user
`POST https://apizie.tech/v1/security:okta/unassign-user-from-application` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appId | string | yes | Application ID |
| userId | string | yes | ID of an existing Okta user |
| sendEmail | boolean | no | Sends a deactivation email to the administrator if `true` |

### Verify the provisioning connection
`POST https://apizie.tech/v1/security:okta/verify-provisioning-connection-for-application` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| appName | string | yes | Application name for the provisioning connection |
| appId | string | yes | Application ID |
| code | string | no | Unique string associated with each authentication request |
| state | string | no | A temporary code string that the client exchanges for an access token |

### List all authenticators
`GET https://apizie.tech/v1/security:okta/list-authenticators` (byok)

### Create an authenticator
`POST https://apizie.tech/v1/security:okta/create-authenticator` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| activate | boolean | no | Whether to execute the activation lifecycle operation when Okta creates the authenticator |
| body | object | yes | JSON request body |

### Retrieve an authenticator
`GET https://apizie.tech/v1/security:okta/get-authenticator` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| authenticatorId | string | yes | `id` of the authenticator |

### Replace an authenticator
`POST https://apizie.tech/v1/security:okta/replace-authenticator` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| authenticatorId | string | yes | `id` of the authenticator |
| body | object | yes | JSON request body |

### List all custom AAGUIDs
`GET https://apizie.tech/v1/security:okta/list-all-custom-aaguids` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| authenticatorId | string | yes | `id` of the authenticator |

### Create a custom AAGUID
`POST https://apizie.tech/v1/security:okta/create-custom-aaguid` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| authenticatorId | string | yes | `id` of the authenticator |
| body | object | no | JSON request body |

### Retrieve a custom AAGUID
`GET https://apizie.tech/v1/security:okta/get-custom-aaguid` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| authenticatorId | string | yes | `id` of the authenticator |
| aaguid | string | yes | Unique ID of a custom AAGUID |

### Replace a custom AAGUID
`POST https://apizie.tech/v1/security:okta/replace-custom-aaguid` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| authenticatorId | string | yes | `id` of the authenticator |
| aaguid | string | yes | Unique ID of a custom AAGUID |
| body | object | no | JSON request body |

### Update a custom AAGUID
`POST https://apizie.tech/v1/security:okta/update-custom-aaguid` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| authenticatorId | string | yes | `id` of the authenticator |
| aaguid | string | yes | Unique ID of a custom AAGUID |
| body | object | no | JSON request body |

### Delete a custom AAGUID
`POST https://apizie.tech/v1/security:okta/delete-custom-aaguid` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| authenticatorId | string | yes | `id` of the authenticator |
| aaguid | string | yes | Unique ID of a custom AAGUID |

### Activate an authenticator
`POST https://apizie.tech/v1/security:okta/activate-authenticator` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| authenticatorId | string | yes | `id` of the authenticator |

### Deactivate an authenticator
`POST https://apizie.tech/v1/security:okta/deactivate-authenticator` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| authenticatorId | string | yes | `id` of the authenticator |

### List all methods of an authenticator
`GET https://apizie.tech/v1/security:okta/list-authenticator-methods` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| authenticatorId | string | yes | `id` of the authenticator |

### Retrieve an authenticator method
`GET https://apizie.tech/v1/security:okta/get-authenticator-method` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| authenticatorId | string | yes | `id` of the authenticator |
| methodType | string | yes | Type of authenticator method |

### Replace an authenticator method
`POST https://apizie.tech/v1/security:okta/replace-authenticator-method` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| authenticatorId | string | yes | `id` of the authenticator |
| methodType | string | yes | Type of authenticator method |
| body | object | no | JSON request body |

### Activate an authenticator method
`POST https://apizie.tech/v1/security:okta/activate-authenticator-method` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| authenticatorId | string | yes | `id` of the authenticator |
| methodType | string | yes | Type of authenticator method |

### Deactivate an authenticator method
`POST https://apizie.tech/v1/security:okta/deactivate-authenticator-method` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| authenticatorId | string | yes | `id` of the authenticator |
| methodType | string | yes | Type of authenticator method |

### Verify a Relying Party ID domain
`POST https://apizie.tech/v1/security:okta/verify-rp-id-domain` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| authenticatorId | string | yes | `id` of the authenticator |
| webAuthnMethodType | string | yes | Type of authenticator method |

…and 280 more. See the OpenAPI spec.

## Example
```
curl "https://apizie.tech/v1/security:okta/get-well-known-app-authenticator-configuration" \
  -H "x-api-key: $APIZIE_KEY" \
  -H "x-upstream-key: $PROVIDER_KEY"
```

## FAQ

### How do I call the Okta Admin Management API API?
Create a free Apizie key, then send GET https://apizie.tech/v1/security:okta/get-well-known-app-authenticator-configuration with the header x-api-key. Every endpoint returns { project, data, timestamp }.

### Is the Okta Admin Management API API free on Apizie?
Yes. The Free plan includes 1,000 requests a month at 100 requests a minute, no credit card. Okta Admin Management API itself also needs your own key from okta.

### Can AI agents use the Okta Admin Management API API?
Yes. Add the Apizie MCP server (https://apizie.tech/mcp) to Claude, ChatGPT, Cursor or VS Code, then ask in plain language. The agent calls run_scraper with project key security:okta.

### What is the status of the Okta Admin Management API API?
Needs your own provider key (bring your own key)