Okta Admin Management API

Name: Okta Admin Management API
Brand: Okta Admin Management API
Availability: InStock

★ Only Publicly Available OpenAPI DocumentIdentity AuthDirectory ServicesapiKey, oauth2727 EndpointsREST

For Agents

Manage users, groups, applications, and authentication policies across an Okta organization. Provision identities, assign apps, configure MFA policies, and administer authorization servers.

Install Jentic One Beta

Connect the Okta Admin Management API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Okta Admin Management API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Okta Admin Management API.

Provision and deactivate user accounts with profile attributes and credential settings

Assign applications to users and groups with specific sign-on mode configurations

Configure authentication policies with MFA requirements and device trust rules

GET STARTED

Start building with Okta Admin Management API

Explore with Jentic

View OpenAPI Document

Use Cases

Patterns agents use Okta Admin Management API for, with concrete tasks.

★ AI Agent Identity Administration

AI agents perform identity administration tasks through Okta's Management API by searching Jentic for specific operations like user provisioning or group assignment. The agent loads the operation schema, supplies required fields (login, email, profile attributes), and executes directly against the Okta tenant. Handles user lifecycle from creation through deactivation across organizations with hundreds of thousands of identities.

Create a new user via POST /api/v1/users with profile containing firstName, lastName, email, and login, then activate the user and assign them to an application

Application Provisioning and SSO Configuration

Configure single sign-on for applications by creating app instances with SAML 2.0 or OIDC settings, then assigning users and groups. The /api/v1/apps endpoint supports 20+ application templates including custom SAML and bookmark apps. Credential settings, attribute mappings, and provisioning features are configurable per assignment.

Create a SAML 2.0 application via POST /api/v1/apps with signOnMode 'SAML_2_0', configure the assertion consumer service URL, then assign a user group to the application

Authentication Policy Management

Define and enforce authentication policies that control how users sign in, including MFA requirements, device trust conditions, and network zone restrictions. Policies are assigned to applications and evaluated in priority order. Supports progressive profiling, step-up authentication, and risk-based adaptive rules.

Create an authentication policy via POST /api/v1/policies with type 'ACCESS_POLICY', add a rule requiring MFA with possession factor, and assign it to a target application

Security Audit and Compliance Monitoring

Query the Okta system log for security-relevant events including login failures, privilege escalations, policy changes, and suspicious activity patterns. The /api/v1/logs endpoint supports filtering by event type, actor, target, and time range. Results include geo-location, device context, and authentication details for forensic analysis.

Query /api/v1/logs with filter for event type 'user.session.start' with outcome 'FAILURE' over the last 7 days, then aggregate results by actor to identify brute-force patterns

Authorization Server and API Access Control

Configure custom authorization servers that issue scoped access tokens for API protection. Define custom scopes, claims mapped from user profiles or groups, and access policies that control which clients receive which tokens. Supports token lifetime configuration and refresh token rotation policies.

Create a custom authorization server via POST /api/v1/authorizationServers, add a custom scope 'read:orders', define a claim mapping group membership, and create an access policy rule

Key Endpoints

727 endpoints — jentic publishes the only available openapi specification for okta admin management api, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

POST

/api/v1/users

Create a new user with profile and credentials

GET

/api/v1/users

List all users with search and filter

POST

/api/v1/apps

Create a new application instance

PUT

/api/v1/apps/{appId}/users/{userId}

Assign a user to an application

GET

/api/v1/logs

Query the system log for events

POST

/api/v1/groups

Create a new user group

POST

/api/v1/authorizationServers

Create a custom authorization server

POST

/api/v1/policies

Create an authentication or authorization policy

POST

/api/v1/users

Create a new user with profile and credentials

GET

/api/v1/users

List all users with search and filter

POST

/api/v1/apps

Create a new application instance

PUT

/api/v1/apps/{appId}/users/{userId}

Assign a user to an application

GET

/api/v1/logs

Query the system log for events

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Okta SSWS API tokens or OAuth 2.0 client credentials are stored encrypted in the Jentic vault (MAXsystem). Agents receive properly formatted Authorization headers — raw API tokens never enter the agent's context window.

Intent-based discovery

Agents search by intent (e.g., 'provision a new user in Okta') and Jentic returns matching operations with full schemas including required profile fields, so the agent can call POST /api/v1/users without browsing 727 endpoints.

Time to first call

Direct Okta integration: 3-7 days for auth setup, schema discovery across 482 paths, and error handling. Through Jentic: under 1 hour — search, load schema, execute.

FAQs

Specific to using Okta Admin Management API through Jentic.

Why is there no official OpenAPI spec for Okta Admin Management API?

Okta does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Okta Admin Management API via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the Okta Admin Management API use?

The Okta Admin Management API supports two authentication methods: an SSWS API token passed in the Authorization header as 'SSWS {token}', or OAuth 2.0 access tokens using the authorization code flow with granular scopes like okta.users.manage. Through Jentic, credentials are stored in the MAXsystem vault and agents receive properly formatted Authorization headers without handling raw tokens.

Can I provision users and assign applications with the Okta Admin Management API?

Yes. POST /api/v1/users creates a user with profile attributes (firstName, lastName, email, login) and optional credentials. Then PUT /api/v1/apps/{appId}/users/{userId} assigns that user to an application with an optional credentials object and profile mapping. Through Jentic, search for 'create okta user' to load the full schema and execute.

What are the rate limits for the Okta Admin Management API?

Okta enforces per-endpoint rate limits. The /api/v1/users endpoint allows 600 requests per minute for list operations and 100 per minute for create/update. /api/v1/logs allows 120 requests per minute. Rate limit headers (X-Rate-Limit-Limit, X-Rate-Limit-Remaining, X-Rate-Limit-Reset) are included in every response. Exceeding limits returns HTTP 429.

How do I query security events through the Okta Admin Management API via Jentic?

Search Jentic for 'query okta system log' to find the GET /api/v1/logs operation. The schema accepts filter parameters using Okta Expression Language (e.g., eventType eq 'user.session.start' and outcome.result eq 'FAILURE'), plus since and until timestamps. Results include actor, target, client, and geographic context for each event.

Can I configure custom authorization servers with the Okta Admin Management API?

Yes. POST /api/v1/authorizationServers creates a custom server with name, audiences, and description. Add scopes via POST /api/v1/authorizationServers/{authServerId}/scopes, define claims via the /claims endpoint, and set access policies via /policies. Each server issues tokens independently with its own signing keys and token lifetimes.

Does the Okta Admin Management API support group-based application assignment?

Yes. PUT /api/v1/apps/{appId}/groups/{groupId} assigns all members of a group to an application in a single call. Group rules at POST /api/v1/groups/rules can automatically add users to groups based on profile attributes, enabling dynamic application access based on department, location, or role.

Okta Admin Management API

Connect the Okta Admin Management API to your agent

Capabilities

Start building with Okta Admin Management API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs