okta-admin-management

name	okta-admin-management
description	Okta Admin Management API skill. Use when working with Okta Admin Management for .well-known, api, attack-protection. Covers 705 endpoints.
version	1.0.0
generator	lapsh

Okta Admin Management

API version: 5.1.0

Auth

ApiKey Authorization in header | OAuth2

Base URL

https://subdomain.okta.com

Setup

1. Set your API key in the appropriate header
2. GET /.well-known/app-authenticator-configuration -- verify access
3. POST /api/v1/agentPools/{poolId}/updates -- create first updates

Endpoints

705 endpoints across 10 groups. See references/api-spec.lap for full details.

.well-known

Method	Path	Description
GET	/.well-known/app-authenticator-configuration	Retrieve the well-known app authenticator configuration
GET	/.well-known/apple-app-site-association	Retrieve the customized apple-app-site-association URI content
GET	/.well-known/assetlinks.json	Retrieve the customized assetlinks.json URI content
GET	/.well-known/okta-organization	Retrieve the Org metadata
GET	/.well-known/ssf-configuration	Retrieve the SSF transmitter metadata
GET	/.well-known/webauthn	Retrieve the customized webauthn URI content

api

Method	Path	Description
GET	/api/v1/agentPools	List all agent pools
GET	/api/v1/agentPools/{poolId}/updates	List all agent pool updates
POST	/api/v1/agentPools/{poolId}/updates	Create an agent pool update
GET	/api/v1/agentPools/{poolId}/updates/settings	Retrieve an agent pool update's settings
POST	/api/v1/agentPools/{poolId}/updates/settings	Update an agent pool update settings
GET	/api/v1/agentPools/{poolId}/updates/{updateId}	Retrieve an agent pool update by ID
POST	/api/v1/agentPools/{poolId}/updates/{updateId}	Update an agent pool update by ID
DELETE	/api/v1/agentPools/{poolId}/updates/{updateId}	Delete an agent pool update
POST	/api/v1/agentPools/{poolId}/updates/{updateId}/activate	Activate an agent pool update
POST	/api/v1/agentPools/{poolId}/updates/{updateId}/deactivate	Deactivate an agent pool update
POST	/api/v1/agentPools/{poolId}/updates/{updateId}/pause	Pause an agent pool update
POST	/api/v1/agentPools/{poolId}/updates/{updateId}/resume	Resume an agent pool update
POST	/api/v1/agentPools/{poolId}/updates/{updateId}/retry	Retry an agent pool update
POST	/api/v1/agentPools/{poolId}/updates/{updateId}/stop	Stop an agent pool update
GET	/api/v1/api-tokens	List all API token metadata
DELETE	/api/v1/api-tokens/current	Revoke the current API token
GET	/api/v1/api-tokens/{apiTokenId}	Retrieve an API token's metadata
PUT	/api/v1/api-tokens/{apiTokenId}	Upsert an API token network condition
DELETE	/api/v1/api-tokens/{apiTokenId}	Revoke an API token
GET	/api/v1/apps	List all applications
POST	/api/v1/apps

attack-protection

Method	Path	Description
GET	/attack-protection/api/v1/authenticator-settings	Retrieve the authenticator settings
PUT	/attack-protection/api/v1/authenticator-settings	Replace the authenticator settings
GET	/attack-protection/api/v1/user-lockout-settings	Retrieve the user lockout settings
PUT	/attack-protection/api/v1/user-lockout-settings	Replace the user lockout settings

device-access

Method	Path	Description
GET	/device-access/api/v1/desktop-mfa/enforce-number-matching-challenge-settings	Retrieve the Desktop MFA Enforce Number Matching Challenge org setting
PUT	/device-access/api/v1/desktop-mfa/enforce-number-matching-challenge-settings	Replace the Desktop MFA Enforce Number Matching Challenge org setting
GET	/device-access/api/v1/desktop-mfa/recovery-pin-settings	Retrieve the Desktop MFA Recovery PIN org setting
PUT	/device-access/api/v1/desktop-mfa/recovery-pin-settings	Replace the Desktop MFA Recovery PIN org setting

integrations

Method	Path	Description
GET	/integrations/api/v1/api-services	List all API service integration instances
POST	/integrations/api/v1/api-services	Create an API service integration instance
GET	/integrations/api/v1/api-services/{apiServiceId}	Retrieve an API service integration instance
DELETE	/integrations/api/v1/api-services/{apiServiceId}	Delete an API service integration instance
GET	/integrations/api/v1/api-services/{apiServiceId}/credentials/secrets	List all API service integration instance secrets
POST	/integrations/api/v1/api-services/{apiServiceId}/credentials/secrets	Create an API service integration instance secret
DELETE	/integrations/api/v1/api-services/{apiServiceId}/credentials/secrets/{secretId}	Delete an API service integration instance secret
POST	/integrations/api/v1/api-services/{apiServiceId}/credentials/secrets/{secretId}/lifecycle/activate	Activate an API service integration instance secret
POST	/integrations/api/v1/api-services/{apiServiceId}/credentials/secrets/{secretId}/lifecycle/deactivate	Deactivate an API service integration instance secret

oauth2

Method	Path	Description
GET	/oauth2/v1/clients/{clientId}/roles	List all client role assignments
POST	/oauth2/v1/clients/{clientId}/roles	Assign a client role
GET	/oauth2/v1/clients/{clientId}/roles/{roleAssignmentId}	Retrieve a client role
DELETE	/oauth2/v1/clients/{clientId}/roles/{roleAssignmentId}	Unassign a client role
GET	/oauth2/v1/clients/{clientId}/roles/{roleAssignmentId}/targets/catalog/apps	List all client role app targets
PUT	/oauth2/v1/clients/{clientId}/roles/{roleAssignmentId}/targets/catalog/apps/{appName}	Assign a client role app target
DELETE	/oauth2/v1/clients/{clientId}/roles/{roleAssignmentId}/targets/catalog/apps/{appName}	Unassign a client role app target
PUT	/oauth2/v1/clients/{clientId}/roles/{roleAssignmentId}/targets/catalog/apps/{appName}/{appId}	Assign a client role app instance target
DELETE	/oauth2/v1/clients/{clientId}/roles/{roleAssignmentId}/targets/catalog/apps/{appName}/{appId}	Unassign a client role app instance target
GET	/oauth2/v1/clients/{clientId}/roles/{roleAssignmentId}/targets/groups	List all client role group targets
PUT	/oauth2/v1/clients/{clientId}/roles/{roleAssignmentId}/targets/groups/{groupId}	Assign a client role group target
DELETE	/oauth2/v1/clients/{clientId}/roles/{roleAssignmentId}/targets/groups/{groupId}	Unassign a client role group target

okta-personal-settings

Method	Path	Description
PUT	/okta-personal-settings/api/v1/edit-feature	Replace the Okta Personal admin settings
GET	/okta-personal-settings/api/v1/export-blocklists	List all blocked email domains
PUT	/okta-personal-settings/api/v1/export-blocklists	Replace the blocked email domains

privileged-access

Method	Path	Description
GET	/privileged-access/api/v1/service-accounts	List all app service accounts
POST	/privileged-access/api/v1/service-accounts	Create an app service account
GET	/privileged-access/api/v1/service-accounts/{id}	Retrieve an app service account
PATCH	/privileged-access/api/v1/service-accounts/{id}	Update an existing app service account
DELETE	/privileged-access/api/v1/service-accounts/{id}	Delete an app service account

security

Method	Path	Description
POST	/security/api/v1/security-events	Publish a security event token

webauthn-registration

Method	Path	Description
POST	/webauthn-registration/api/v1/activate	Activate a preregistered WebAuthn factor
POST	/webauthn-registration/api/v1/enroll	Enroll a preregistered WebAuthn factor
POST	/webauthn-registration/api/v1/initiate-fulfillment-request	Generate a fulfillment request
POST	/webauthn-registration/api/v1/send-pin	Send a PIN to user
GET	/webauthn-registration/api/v1/users/{userId}/enrollments	List all WebAuthn preregistration factors
DELETE	/webauthn-registration/api/v1/users/{userId}/enrollments/{authenticatorEnrollmentId}	Delete a WebAuthn preregistration factor
POST	/webauthn-registration/api/v1/users/{userId}/enrollments/{authenticatorEnrollmentId}/mark-error	Assign the fulfillment error status to a WebAuthn preregistration factor

Common Questions

Match user requests to endpoints in references/api-spec.lap. Key patterns:

• "List all app-authenticator-configuration?" -> GET /.well-known/app-authenticator-configuration
• "List all apple-app-site-association?" -> GET /.well-known/apple-app-site-association
• "List all assetlinks.json?" -> GET /.well-known/assetlinks.json
• "List all okta-organization?" -> GET /.well-known/okta-organization
• "List all ssf-configuration?" -> GET /.well-known/ssf-configuration
• "List all webauthn?" -> GET /.well-known/webauthn
• "List all agentPools?" -> GET /api/v1/agentPools
• "List all updates?" -> GET /api/v1/agentPools/{poolId}/updates
• "Create a update?" -> POST /api/v1/agentPools/{poolId}/updates
• "List all settings?" -> GET /api/v1/agentPools/{poolId}/updates/settings
• "Create a setting?" -> POST /api/v1/agentPools/{poolId}/updates/settings
• "Get update details?" -> GET /api/v1/agentPools/{poolId}/updates/{updateId}
• "Delete a update?" -> DELETE /api/v1/agentPools/{poolId}/updates/{updateId}
• "Create a activate?" -> POST /api/v1/agentPools/{poolId}/updates/{updateId}/activate
• "Create a deactivate?" -> POST /api/v1/agentPools/{poolId}/updates/{updateId}/deactivate
• "Create a pause?" -> POST /api/v1/agentPools/{poolId}/updates/{updateId}/pause
• "Create a resume?" -> POST /api/v1/agentPools/{poolId}/updates/{updateId}/resume
• "Create a retry?" -> POST /api/v1/agentPools/{poolId}/updates/{updateId}/retry
• "Create a stop?" -> POST /api/v1/agentPools/{poolId}/updates/{updateId}/stop
• "List all api-tokens?" -> GET /api/v1/api-tokens
• "Get api-token details?" -> GET /api/v1/api-tokens/{apiTokenId}
• "Update a api-token?" -> PUT /api/v1/api-tokens/{apiTokenId}
• "Delete a api-token?" -> DELETE /api/v1/api-tokens/{apiTokenId}
• "Search apps?" -> GET /api/v1/apps
• "Create a app?" -> POST /api/v1/apps
• "Get app details?" -> GET /api/v1/apps/{appId}
• "Update a app?" -> PUT /api/v1/apps/{appId}
• "Delete a app?" -> DELETE /api/v1/apps/{appId}
• "List all default?" -> GET /api/v1/apps/{appId}/connections/default
• "Create a default?" -> POST /api/v1/apps/{appId}/connections/default
• "List all jwks?" -> GET /api/v1/apps/{appId}/connections/default/jwks
• "Create a activate?" -> POST /api/v1/apps/{appId}/connections/default/lifecycle/activate
• "Create a deactivate?" -> POST /api/v1/apps/{appId}/connections/default/lifecycle/deactivate
• "List all csrs?" -> GET /api/v1/apps/{appId}/credentials/csrs
• "Create a csr?" -> POST /api/v1/apps/{appId}/credentials/csrs
• "Get csr details?" -> GET /api/v1/apps/{appId}/credentials/csrs/{csrId}