Okta Admin Management API
★ Only Publicly Available OpenAPI DocumentIdentity AuthDirectory ServicesapiKey, oauth2727 EndpointsREST
For Agents
Manage users, groups, applications, and authentication policies across an Okta organization. Provision identities, assign apps, configure MFA policies, and administer authorization servers.
Use for: I need to create a new user in my Okta organization, Assign an application to a group of users, List all users who have been locked out of their accounts, I want to configure an MFA policy requiring push notifications
Not supported: Does not handle authentication flows for end users, token issuance, or SSO login ceremonies - use for administrative management of the Okta organization only.
Jentic publishes the only available OpenAPI specification for Okta Admin Management API, keeping it validated and agent-ready. Provides full administrative control over an Okta organization with 727 endpoints spanning user lifecycle management, application provisioning, group policies, authentication policies, and authorization server configuration. Supports both API token and OAuth 2.0 authentication with granular scopes for least-privilege access across tenant domains.
Install Jentic One Beta
Connect the Okta Admin Management API to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Okta Admin Management API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fokta.com%2Fokta" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fokta.com%2Fokta" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Okta Admin Management API.
Provision and deactivate user accounts with profile attributes and credential settings
Assign applications to users and groups with specific sign-on mode configurations
Configure authentication policies with MFA requirements and device trust rules
Define authorization server scopes, claims, and access policies for API protection
Synchronize user groups from Active Directory and LDAP via agent pools
Enroll and manage authenticator factors including TOTP, SMS, and push notifications
Monitor system log events for security audit and compliance reporting
Use Cases
Patterns agents use Okta Admin Management API for, with concrete tasks.
★ AI Agent Identity Administration
AI agents perform identity administration tasks through Okta's Management API by searching Jentic for specific operations like user provisioning or group assignment. The agent loads the operation schema, supplies required fields (login, email, profile attributes), and executes directly against the Okta tenant. Handles user lifecycle from creation through deactivation across organizations with hundreds of thousands of identities.
Create a new user via POST /api/v1/users with profile containing firstName, lastName, email, and login, then activate the user and assign them to an application
Application Provisioning and SSO Configuration
Configure single sign-on for applications by creating app instances with SAML 2.0 or OIDC settings, then assigning users and groups. The /api/v1/apps endpoint supports 20+ application templates including custom SAML and bookmark apps. Credential settings, attribute mappings, and provisioning features are configurable per assignment.
Create a SAML 2.0 application via POST /api/v1/apps with signOnMode 'SAML_2_0', configure the assertion consumer service URL, then assign a user group to the application
Authentication Policy Management
Define and enforce authentication policies that control how users sign in, including MFA requirements, device trust conditions, and network zone restrictions. Policies are assigned to applications and evaluated in priority order. Supports progressive profiling, step-up authentication, and risk-based adaptive rules.
Create an authentication policy via POST /api/v1/policies with type 'ACCESS_POLICY', add a rule requiring MFA with possession factor, and assign it to a target application
Security Audit and Compliance Monitoring
Query the Okta system log for security-relevant events including login failures, privilege escalations, policy changes, and suspicious activity patterns. The /api/v1/logs endpoint supports filtering by event type, actor, target, and time range. Results include geo-location, device context, and authentication details for forensic analysis.
Query /api/v1/logs with filter for event type 'user.session.start' with outcome 'FAILURE' over the last 7 days, then aggregate results by actor to identify brute-force patterns
Authorization Server and API Access Control
Configure custom authorization servers that issue scoped access tokens for API protection. Define custom scopes, claims mapped from user profiles or groups, and access policies that control which clients receive which tokens. Supports token lifetime configuration and refresh token rotation policies.
Create a custom authorization server via POST /api/v1/authorizationServers, add a custom scope 'read:orders', define a claim mapping group membership, and create an access policy rule
Key Endpoints
727 endpoints — jentic publishes the only available openapi specification for okta admin management api, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
POST
/api/v1/users
Create a new user with profile and credentials
GET
/api/v1/users
List all users with search and filter
POST
/api/v1/apps
Create a new application instance
PUT
/api/v1/apps/{appId}/users/{userId}
Assign a user to an application
GET
/api/v1/logs
Query the system log for events
POST
/api/v1/groups
Create a new user group
POST
/api/v1/authorizationServers
Create a custom authorization server
POST
/api/v1/policies
Create an authentication or authorization policy
POST
/api/v1/users
Create a new user with profile and credentials
GET
/api/v1/users
List all users with search and filter
POST
/api/v1/apps
Create a new application instance
PUT
/api/v1/apps/{appId}/users/{userId}
Assign a user to an application
GET
/api/v1/logs
Query the system log for events
POST
/api/v1/groups
Create a new user group
POST
/api/v1/authorizationServers
Create a custom authorization server
POST
/api/v1/policies
Create an authentication or authorization policy
Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring the Okta Admin Management API by hand means choosing between SSWS token and OAuth 2.0 auth, targeting your own Okta org domain, and navigating over 700 administrative endpoints across users, apps, groups, and policies yourself. Through Jentic you install once, import Okta from the API Directory, store the credential once, and your agent calls it.
Permission scoping
Okta puts resource ids in the URL path (for example /api/v1/apps/{appId}/users/{userId}), so a rule can pin your agent to one app's user assignments, and across the admin surface you limit it to the operations it needs, such as listing users or reading logs. You choose the operations it may call, so writes like creating a user or a policy are not included unless you add them.
Credential isolation
Your Okta SSWS token or OAuth client credentials are stored once, encrypted, by your own Jentic One instance and used to build the Authorization header at execution time. They never enter the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'provision a new user in Okta', and Jentic returns the matching operation with its full input schema, including required profile fields, so the agent calls POST /api/v1/users without scanning over 700 endpoints.
Related APIs
Alternatives and complements available in the Jentic catalogue.
Complementary
Snyk API
Security vulnerability scanning and remediation for application dependencies and container images
Use Snyk alongside Okta to correlate identity-based access policies with application security posture and vulnerability findings
FAQs
Specific to using Okta Admin Management API through Jentic.
Why is there no official OpenAPI spec for Okta Admin Management API?
Okta does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Okta Admin Management API via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.
What authentication does the Okta Admin Management API use?
The Okta Admin Management API supports two authentication methods: an SSWS API token passed in the Authorization header as 'SSWS {token}', or OAuth 2.0 access tokens using the authorization code flow with granular scopes like okta.users.manage. Through Jentic, credentials are stored in your Jentic One instance and agents receive properly formatted Authorization headers without handling raw tokens.
Can I provision users and assign applications with the Okta Admin Management API?
Yes. POST /api/v1/users creates a user with profile attributes (firstName, lastName, email, login) and optional credentials. Then PUT /api/v1/apps/{appId}/users/{userId} assigns that user to an application with an optional credentials object and profile mapping. Through Jentic, search for 'create okta user' to load the full schema and execute.
What are the rate limits for the Okta Admin Management API?
Okta enforces per-endpoint rate limits. The /api/v1/users endpoint allows 600 requests per minute for list operations and 100 per minute for create/update. /api/v1/logs allows 120 requests per minute. Rate limit headers (X-Rate-Limit-Limit, X-Rate-Limit-Remaining, X-Rate-Limit-Reset) are included in every response. Exceeding limits returns HTTP 429.
How do I query security events through the Okta Admin Management API via Jentic?
Search Jentic for 'query okta system log' to find the GET /api/v1/logs operation. The schema accepts filter parameters using Okta Expression Language (e.g., eventType eq 'user.session.start' and outcome.result eq 'FAILURE'), plus since and until timestamps. Results include actor, target, client, and geographic context for each event.
Can I configure custom authorization servers with the Okta Admin Management API?
Yes. POST /api/v1/authorizationServers creates a custom server with name, audiences, and description. Add scopes via POST /api/v1/authorizationServers/{authServerId}/scopes, define claims via the /claims endpoint, and set access policies via /policies. Each server issues tokens independently with its own signing keys and token lifetimes.
Does the Okta Admin Management API support group-based application assignment?
Yes. PUT /api/v1/apps/{appId}/groups/{groupId} assigns all members of a group to an application in a single call. Group rules at POST /api/v1/groups/rules can automatically add users to groups based on profile attributes, enabling dynamic application access based on department, location, or role.
Can I limit what my agent is allowed to do with the Okta Admin Management API?
Yes. Because you run Jentic One yourself, your own rules decide which of the 700-plus Okta operations and which stored credential the agent may use. Okta puts resource ids in the URL path, such as /api/v1/apps/{appId}/users/{userId}, so you can pin the agent to one application's user assignments or restrict it to read-only calls like listing users (GET /api/v1/users) or querying the system log (GET /api/v1/logs). Write operations such as creating a user (POST /api/v1/users) or an authentication policy (POST /api/v1/policies) are available to the agent only if you add them to its allowed set.
GET STARTED