> ## Documentation Index
> Fetch the complete documentation index at: https://docs.modulex.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Okta Integration for AI Agents & Workflows

> Manage users and user-type metadata in an Okta tenant via the Okta Management REST API (``/api/v1`` under your Okta subdomain).

{/* Self-hosted logo — build-time vendored from modulex.json / Iconify (see scripts/lib/logo.js). */}

<img className="block dark:hidden" src="https://mintcdn.com/modulexaillc/df8MOr-hXotYLTh5/logos/okta-light.svg?fit=max&auto=format&n=df8MOr-hXotYLTh5&q=85&s=37b76717f7da992810150ad10d482a6f" alt="Okta logo" width="72" height="72" data-path="logos/okta-light.svg" />

<img className="hidden dark:block" src="https://mintcdn.com/modulexaillc/df8MOr-hXotYLTh5/logos/okta-dark.svg?fit=max&auto=format&n=df8MOr-hXotYLTh5&q=85&s=3f02cd23b12a0e2814cc3fc48afb5a38" alt="Okta logo" width="72" height="72" data-path="logos/okta-dark.svg" />

## Overview

Add **Okta** to any ModuleX agent or workflow. Manage users and user-type metadata in an Okta tenant via the Okta Management REST API (`https://<subdomain>.okta.com/api/v1`).

<Info>
  **Categories**: Developer Tools & Infrastructure · Identity & Access Management · Productivity & Collaboration · **Auth**: Okta API Token · **Actions**: 4
</Info>

## Authentication

### Okta API Token

Authenticate with an Okta SSWS API token plus the tenant subdomain. The token is sent as `Authorization: SSWS &lt;token>` and the subdomain is used to build the request host (`https://&lt;subdomain>.okta.com`).

<Steps>
  <Step title="Step 1">
    Sign in to your Okta admin console.
  </Step>

  <Step title="Step 2">
    Open Security -> API -> Tokens, then click Create Token.
  </Step>

  <Step title="Step 3">
    Copy the generated SSWS token (it is shown only once).
  </Step>

  <Step title="Step 4">
    Your subdomain is the leading part of your admin URL, e.g. for `acme.okta.com` the subdomain is `acme`.
  </Step>
</Steps>

#### Required Credentials

| Field          | Description                                                                         | Required | Format                                    |
| -------------- | ----------------------------------------------------------------------------------- | -------- | ----------------------------------------- |
| Okta Subdomain | The tenant subdomain (e.g. `acme` for `acme.okta.com`). Do not include `.okta.com`. | Yes      | `acme`                                    |
| Okta API Token | Your SSWS API token from Okta admin (Security -> API -> Tokens).                    | Yes      | `00xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx` |

## Available Actions

<AccordionGroup>
  <Accordion title="create_user — Create a new user in the Okta tenant. The user is activated by default unless ``activate`` is set to false.">
    ### Parameters

    <ResponseField name="first_name" type="string" required>
      The first name of the user.
    </ResponseField>

    <ResponseField name="last_name" type="string" required>
      The last name of the user.
    </ResponseField>

    <ResponseField name="email" type="string" required>
      The email address of the user.
    </ResponseField>

    <ResponseField name="login" type="string" required>
      The login (typically the email) for the user.
    </ResponseField>

    <ResponseField name="mobile_phone" type="string">
      Optional mobile phone number for the user.
    </ResponseField>

    <ResponseField name="type_id" type="string">
      Optional ID of a non-default user type. Use list\_type\_id\_options to enumerate available IDs.
    </ResponseField>

    <ResponseField name="activate" type="boolean">
      Whether to execute the activation lifecycle on creation. Defaults to true. (Default: `true`)
    </ResponseField>

    ### Response

    ```json theme={null}
    {
      "$defs": {
        "UserResource": {
          "additionalProperties": false,
          "description": "An Okta user as returned by /users endpoints.\n\nField set is intentionally permissive — Okta returns many fields; we\nexpose the ones agents commonly need and let the rest live in ``profile``.",
          "properties": {
            "id": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Id"
            },
            "status": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Status"
            },
            "created": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Created"
            },
            "activated": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Activated"
            },
            "statusChanged": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Statuschanged"
            },
            "lastLogin": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Lastlogin"
            },
            "lastUpdated": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Lastupdated"
            },
            "passwordChanged": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Passwordchanged"
            },
            "type": {
              "anyOf": [
                {
                  "$ref": "#/$defs/UserTypeRef"
                },
                {
                  "type": "null"
                }
              ],
              "default": null
            },
            "profile": {
              "anyOf": [
                {
                  "additionalProperties": true,
                  "type": "object"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Profile"
            },
            "credentials": {
              "anyOf": [
                {
                  "additionalProperties": true,
                  "type": "object"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Credentials"
            }
          },
          "title": "UserResource",
          "type": "object"
        },
        "UserTypeRef": {
          "additionalProperties": false,
          "description": "Reference to a user type returned alongside a user resource.",
          "properties": {
            "id": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Id"
            }
          },
          "title": "UserTypeRef",
          "type": "object"
        }
      },
      "additionalProperties": false,
      "properties": {
        "success": {
          "title": "Success",
          "type": "boolean"
        },
        "error": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Error"
        },
        "user": {
          "anyOf": [
            {
              "$ref": "#/$defs/UserResource"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        }
      },
      "required": [
        "success"
      ],
      "title": "CreateUserOutput",
      "type": "object"
    }
    ```
  </Accordion>

  <Accordion title="get_user — Fetch a single Okta user by ID, login, or email address.">
    ### Parameters

    <ResponseField name="user_id" type="string" required>
      The unique identifier of the user (Okta user ID, login, or email).
    </ResponseField>

    ### Response

    ```json theme={null}
    {
      "$defs": {
        "UserResource": {
          "additionalProperties": false,
          "description": "An Okta user as returned by /users endpoints.\n\nField set is intentionally permissive — Okta returns many fields; we\nexpose the ones agents commonly need and let the rest live in ``profile``.",
          "properties": {
            "id": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Id"
            },
            "status": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Status"
            },
            "created": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Created"
            },
            "activated": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Activated"
            },
            "statusChanged": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Statuschanged"
            },
            "lastLogin": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Lastlogin"
            },
            "lastUpdated": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Lastupdated"
            },
            "passwordChanged": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Passwordchanged"
            },
            "type": {
              "anyOf": [
                {
                  "$ref": "#/$defs/UserTypeRef"
                },
                {
                  "type": "null"
                }
              ],
              "default": null
            },
            "profile": {
              "anyOf": [
                {
                  "additionalProperties": true,
                  "type": "object"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Profile"
            },
            "credentials": {
              "anyOf": [
                {
                  "additionalProperties": true,
                  "type": "object"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Credentials"
            }
          },
          "title": "UserResource",
          "type": "object"
        },
        "UserTypeRef": {
          "additionalProperties": false,
          "description": "Reference to a user type returned alongside a user resource.",
          "properties": {
            "id": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Id"
            }
          },
          "title": "UserTypeRef",
          "type": "object"
        }
      },
      "additionalProperties": false,
      "properties": {
        "success": {
          "title": "Success",
          "type": "boolean"
        },
        "error": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Error"
        },
        "user": {
          "anyOf": [
            {
              "$ref": "#/$defs/UserResource"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        }
      },
      "required": [
        "success"
      ],
      "title": "GetUserOutput",
      "type": "object"
    }
    ```
  </Accordion>

  <Accordion title="list_type_id_options — List the available user-type options for the tenant (``GET /meta/types/user``). Useful to discover valid ``type_id`` values for create_user / update_user.">
    ### Response

    ```json theme={null}
    {
      "$defs": {
        "TypeIdOption": {
          "additionalProperties": false,
          "description": "One row from the dropdown returned by list_type_id_options.",
          "properties": {
            "label": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Label"
            },
            "value": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Value"
            }
          },
          "title": "TypeIdOption",
          "type": "object"
        }
      },
      "additionalProperties": false,
      "properties": {
        "success": {
          "title": "Success",
          "type": "boolean"
        },
        "error": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Error"
        },
        "options": {
          "items": {
            "$ref": "#/$defs/TypeIdOption"
          },
          "title": "Options",
          "type": "array"
        }
      },
      "required": [
        "success"
      ],
      "title": "ListTypeIdOptionsOutput",
      "type": "object"
    }
    ```
  </Accordion>

  <Accordion title="update_user — Update the profile of an existing Okta user. Only the fields you pass are changed; the existing profile is merged with your updates server-side.">
    ### Parameters

    <ResponseField name="user_id" type="string" required>
      The unique identifier of the user to update.
    </ResponseField>

    <ResponseField name="first_name" type="string">
      New first name for the user.
    </ResponseField>

    <ResponseField name="last_name" type="string">
      New last name for the user.
    </ResponseField>

    <ResponseField name="email" type="string">
      New email address for the user.
    </ResponseField>

    <ResponseField name="login" type="string">
      New login for the user.
    </ResponseField>

    <ResponseField name="mobile_phone" type="string">
      New mobile phone number for the user.
    </ResponseField>

    <ResponseField name="type_id" type="string">
      Optional new user type ID. Use list\_type\_id\_options to discover valid IDs.
    </ResponseField>

    ### Response

    ```json theme={null}
    {
      "$defs": {
        "UserResource": {
          "additionalProperties": false,
          "description": "An Okta user as returned by /users endpoints.\n\nField set is intentionally permissive — Okta returns many fields; we\nexpose the ones agents commonly need and let the rest live in ``profile``.",
          "properties": {
            "id": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Id"
            },
            "status": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Status"
            },
            "created": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Created"
            },
            "activated": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Activated"
            },
            "statusChanged": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Statuschanged"
            },
            "lastLogin": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Lastlogin"
            },
            "lastUpdated": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Lastupdated"
            },
            "passwordChanged": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Passwordchanged"
            },
            "type": {
              "anyOf": [
                {
                  "$ref": "#/$defs/UserTypeRef"
                },
                {
                  "type": "null"
                }
              ],
              "default": null
            },
            "profile": {
              "anyOf": [
                {
                  "additionalProperties": true,
                  "type": "object"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Profile"
            },
            "credentials": {
              "anyOf": [
                {
                  "additionalProperties": true,
                  "type": "object"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Credentials"
            }
          },
          "title": "UserResource",
          "type": "object"
        },
        "UserTypeRef": {
          "additionalProperties": false,
          "description": "Reference to a user type returned alongside a user resource.",
          "properties": {
            "id": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ],
              "default": null,
              "title": "Id"
            }
          },
          "title": "UserTypeRef",
          "type": "object"
        }
      },
      "additionalProperties": false,
      "properties": {
        "success": {
          "title": "Success",
          "type": "boolean"
        },
        "error": {
          "anyOf": [
            {
              "type": "string"
            },
            {
              "type": "null"
            }
          ],
          "default": null,
          "title": "Error"
        },
        "user": {
          "anyOf": [
            {
              "$ref": "#/$defs/UserResource"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        }
      },
      "required": [
        "success"
      ],
      "title": "UpdateUserOutput",
      "type": "object"
    }
    ```
  </Accordion>
</AccordionGroup>

## Limits & Quotas

* Okta enforces per-org rate limits that vary by endpoint and plan; common
  defaults are 600 requests/minute for the Users endpoints on developer orgs
  and higher on production tiers. See
  [https://developer.okta.com/docs/reference/rl-global-mgmt/](https://developer.okta.com/docs/reference/rl-global-mgmt/).
* Each response includes `X-Rate-Limit-Limit`, `X-Rate-Limit-Remaining`, and
  `X-Rate-Limit-Reset` headers; agents that hit `429` should back off until
  the reset epoch.
* `update_user` issues one `GET` plus one `PUT` per call (the existing profile
  is merged client-side so partial updates do not blank out fields).
* **Error model**: non-2xx responses and timeouts are caught and returned as
  `success=False` + `error` rather than raising.

## Related integrations

<CardGroup cols={3}>
  <Card title="Jira" href="/integrations/tools/jira" />

  <Card title="Microsoft Entra ID" href="/integrations/tools/microsoft-entra-id" />

  <Card title="Algolia" href="/integrations/tools/algolia" />
</CardGroup>

## Links

* [Okta](https://www.okta.com)