How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

Need help?

Contact us
Okta

Okta User API

The User API from Okta — 36 operation(s) for user.

Documentation Provider Profile APIs.io OpenAPI GitHub

Okta User API is one of 28 APIs that Okta publishes on the APIs.io network, described by a machine-readable OpenAPI specification and an AsyncAPI event-driven specification.

This API exposes 4 JSON Schema definitions.

Tagged areas include User. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, an AsyncAPI specification, authentication docs, rate-limit docs, a JSON-LD context, and 4 JSON Schemas.

This API exposes 52 operations across 36 paths, and defines 65 schemas. It is described by OpenAPI 3.0.1, at version 2.16.0.

Requests are made against a single base URL, https://your-subdomain.okta.com/.

52 operations 36 paths 65 schemas 12 DELETE18 GET16 POST6 PUT

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.0.1
API Version
2.16.0
Base URL
https://your-subdomain.okta.com
Authentication
API Key
Contact
Okta Developer Team
License
Apache-2.0
Terms of Service
View terms
Resource Areas
1

Authentication & Security 1

Okta User API declares 1 security scheme for authenticating requests. An API key is passed in the header as Authorization (api_token).

  • api_token — SSWS {API Token}

Paths & Operations 52

Across 36 paths, the API surfaces 52 operations — 12 DELETE, 18 GET, 16 POST, 6 PUT. Each is listed below with its method, path, parameters, and response codes.

User 52
GET
/api/v1/users
Okta List Users
listUsers 7 params → 200
POST
/api/v1/users
Okta Create User
createUser 3 params body → 200
PUT
/api/v1/users/{associatedUserId}/linkedObjects/{primaryRelationshipName}/{primaryUserId}
setLinkedObjectForUser 3 params → 204
GET
/api/v1/users/{userId}
Okta Get User
getUser 1 param → 200
PUT
/api/v1/users/{userId}
Okta Update User
updateUser 2 params body → 200
POST
/api/v1/users/{userId}
Update a user's profile or credentials with partial update semantics.
partialUpdateUser 2 params body → 200
DELETE
/api/v1/users/{userId}
Okta Delete User
deactivateOrDeleteUser 2 params → 202
GET
/api/v1/users/{userId}/appLinks
Okta Get Assigned App Links
listAppLinks 1 param → 200
GET
/api/v1/users/{userId}/clients
Lists all client resources for which the specified user has grants or tokens.
listUserClients 1 param → 200
GET
/api/v1/users/{userId}/clients/{clientId}/grants
Lists all grants for a specified user and client
listGrantsForUserAndClient 5 params → 200
DELETE
/api/v1/users/{userId}/clients/{clientId}/grants
Revokes all grants for the specified user and client
revokeGrantsForUserAndClient 2 params → 204
GET
/api/v1/users/{userId}/clients/{clientId}/tokens
Lists all refresh tokens issued for the specified User and Client.
listRefreshTokensForUserAndClient 5 params → 200
DELETE
/api/v1/users/{userId}/clients/{clientId}/tokens
Revokes all refresh tokens issued for the specified User and Client.
revokeTokensForUserAndClient 2 params → 204
GET
/api/v1/users/{userId}/clients/{clientId}/tokens/{tokenId}
Gets a refresh token issued for the specified User and Client.
getRefreshTokenForUserAndClient 6 params → 200
DELETE
/api/v1/users/{userId}/clients/{clientId}/tokens/{tokenId}
Revokes the specified refresh token.
revokeTokenForUserAndClient 3 params → 204
POST
/api/v1/users/{userId}/credentials/change_password
Okta Change Password
changePassword 2 params body → 200
POST
/api/v1/users/{userId}/credentials/change_recovery_question
Okta Change Recovery Question
changeRecoveryQuestion 1 param body → 200
POST
/api/v1/users/{userId}/credentials/forgot_password
Okta Forgot Password
1 param → 200
GET
/api/v1/users/{userId}/grants
Lists all grants for the specified user
listUserGrants 5 params → 200
DELETE
/api/v1/users/{userId}/grants
Revokes all grants for a specified user
revokeUserGrants 1 param → 204
GET
/api/v1/users/{userId}/grants/{grantId}
Gets a grant for the specified user
getUserGrant 3 params → 200
DELETE
/api/v1/users/{userId}/grants/{grantId}
Revokes one grant for a specified user
revokeUserGrant 2 params → 204
GET
/api/v1/users/{userId}/groups
Okta Get Member Groups
listUserGroups 1 param → 200
GET
/api/v1/users/{userId}/idps
Okta Listing IdPs associated with a user
listUserIdentityProviders 1 param → 200
POST
/api/v1/users/{userId}/lifecycle/activate
Okta Activate User
activateUser 2 params → 200
POST
/api/v1/users/{userId}/lifecycle/deactivate
Okta Deactivate User
deactivateUser 2 params → 200
POST
/api/v1/users/{userId}/lifecycle/expire_password?tempPassword=false
Okta Expire Password
expirePassword 1 param → 200
POST
/api/v1/users/{userId}/lifecycle/expire_password?tempPassword=true
Okta Expire Password
expirePasswordAndGetTemporaryPassword 1 param → 200
POST
/api/v1/users/{userId}/lifecycle/reactivate
Okta Reactivate User
reactivateUser 2 params → 200
POST
/api/v1/users/{userId}/lifecycle/reset_factors
Okta Reset Factors
resetFactors 1 param → 200
POST
/api/v1/users/{userId}/lifecycle/reset_password
Okta Reset Password
resetPassword 2 params → 200
POST
/api/v1/users/{userId}/lifecycle/suspend
Okta Suspend User
suspendUser 1 param → 200
POST
/api/v1/users/{userId}/lifecycle/unlock
Okta Unlock User
unlockUser 1 param → 200
POST
/api/v1/users/{userId}/lifecycle/unsuspend
Okta Unsuspend User
unsuspendUser 1 param → 200
GET
/api/v1/users/{userId}/linkedObjects/{relationshipName}
Get linked objects for a user, relationshipName can be a primary or associated relationship name
getLinkedObjectsForUser 4 params → 200
DELETE
/api/v1/users/{userId}/linkedObjects/{relationshipName}
Delete linked objects for a user, relationshipName can be ONLY a primary relationship name
removeLinkedObjectForUser 2 params → 204
GET
/api/v1/users/{userId}/roles
Lists all roles assigned to a user.
listAssignedRolesForUser 2 params → 200
POST
/api/v1/users/{userId}/roles
Assigns a role to a user.
assignRoleToUser 2 params body → 201
GET
/api/v1/users/{userId}/roles/{roleId}
Gets role that is assigne to user.
getUserRole 2 params → 200
DELETE
/api/v1/users/{userId}/roles/{roleId}
Unassigns a role from a user.
removeRoleFromUser 2 params → 204
GET
/api/v1/users/{userId}/roles/{roleId}/targets/catalog/apps
Lists all App targets for an APPADMIN Role assigned to a User. This methods return list may include full Applications or Instances. The response for an instance will have an ID value, while Applicati…
listApplicationTargetsForApplicationAdministratorRoleForUser 4 params → 200
PUT
/api/v1/users/{userId}/roles/{roleId}/targets/catalog/apps
Success
addAllAppsAsTargetToRole 2 params → 200
PUT
/api/v1/users/{userId}/roles/{roleId}/targets/catalog/apps/{appName}
Success
addApplicationTargetToAdminRoleForUser 3 params → 200
DELETE
/api/v1/users/{userId}/roles/{roleId}/targets/catalog/apps/{appName}
Success
removeApplicationTargetFromApplicationAdministratorRoleForUser 3 params → 204
PUT
/api/v1/users/{userId}/roles/{roleId}/targets/catalog/apps/{appName}/{applicationId}
Okta Add App Instance Target to App Administrator Role given to a User
addApplicationTargetToAppAdminRoleForUser 4 params → 204
DELETE
/api/v1/users/{userId}/roles/{roleId}/targets/catalog/apps/{appName}/{applicationId}
Okta Remove App Instance Target to App Administrator Role given to a User
removeApplicationTargetFromAdministratorRoleForUser 4 params → 204
GET
/api/v1/users/{userId}/roles/{roleId}/targets/groups
Success
listGroupTargetsForRole 4 params → 200
PUT
/api/v1/users/{userId}/roles/{roleId}/targets/groups/{groupId}
Success
addGroupTargetToRole 3 params → 200
DELETE
/api/v1/users/{userId}/roles/{roleId}/targets/groups/{groupId}
Success
removeGroupTargetFromRole 3 params → 204
DELETE
/api/v1/users/{userId}/sessions
Removes all active identity provider sessions. This forces the user to authenticate on the next operation. Optionally revokes OpenID Connect and OAuth refresh and access tokens issued to the user.
clearUserSessions 2 params → 204
GET
/api/v1/users/{userId}/subscriptions
Okta List subscriptions of a User
listUserSubscriptions 1 param → 200404
GET
/api/v1/users/{userId}/subscriptions/{notificationType}
Okta Get the subscription of a User with a specific notification type
getUserSubscriptionByNotificationType 2 params → 200404

Schemas 65

The contract defines 65 schemas that model the data the API accepts and returns. The most detailed are UserProfile (31 properties), User (14 properties), OAuth2ScopeConsentGrant (12 properties), CatalogApplication (12 properties). Each schema is shown below with its type and property counts.

ProtocolEndpoint
object
4 properties
ChangePasswordRequest
object
2 properties
OAuth2Client
object
5 properties
CatalogApplicationStatus
string
AuthenticationProvider
object
2 properties
ProvisioningDeprovisionedCondition
object
1 property
OAuth2Actor
object
2 properties
OAuth2ScopeConsentGrantStatus
string
UserType
object
10 properties
OAuth2ScopeConsentGrant
object
12 properties
OAuth2RefreshToken
object
12 properties
ProtocolAlgorithmTypeSignature
object
2 properties
ProtocolEndpoints
object
8 properties
ProvisioningConditions
object
2 properties
User
object
14 properties
Provisioning
object
4 properties
Role
object
10 properties
UserActivationToken
object
2 properties
PasswordCredentialHash
object
5 properties
RoleAssignmentType
string
PasswordCredential
object
3 properties
ProtocolAlgorithmType
object
1 property
IdentityProviderCredentialsSigning
object
3 properties
SubscriptionStatus
string
ForgotPasswordResponse
object
1 property
AssignRoleRequest
object
1 property
UserStatus
string
PolicySubject
object
5 properties
CreateUserRequest
object
4 properties
AppLink
object
10 properties
PolicyAccountLink
object
2 properties
ProtocolRelayStateFormat
string
AuthenticationProviderType
string
CatalogApplication
object
12 properties
RoleType
string
Group
object
9 properties
IdentityProviderCredentialsClient
object
2 properties
ProtocolSettings
object
1 property
ProvisioningSuspendedCondition
object
1 property
ResetPasswordToken
object
1 property
IdentityProviderCredentials
object
3 properties
ResponseLinks
object
1 property
UserProfile
object
31 properties
Subscription
object
4 properties
PasswordCredentialHook
object
1 property
IdentityProvider
object
10 properties
PolicyUserNameTemplate
object
1 property
ProtocolAlgorithms
object
2 properties
OAuth2ScopeConsentGrantSource
string
NotificationType
string
PasswordCredentialHashAlgorithm
string
RecoveryQuestionCredential
object
2 properties
PolicyAccountLinkFilter
object
1 property
ProvisioningGroups
object
4 properties
GroupProfile
object
2 properties
GroupType
string
IdentityProviderCredentialsTrust
object
5 properties
PolicyAccountLinkFilterGroups
object
1 property
ProtocolRelayState
object
1 property
IdentityProviderPolicy
object
4 properties
RoleStatus
string
TempPassword
object
1 property
UserCredentials
object
3 properties
Protocol
object
8 properties
PolicySubjectMatchType
string

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

okta-user-api-openapi.yml Raw ↑

Other APIs Okta publishes across the network.

Cross-App Access (XAA)
AE Profile APIs.io
Okta for AI Agents
AE Profile APIs.io
Okta Application API
AE Profile APIs.io
Okta Authenticator API
AE Profile APIs.io
Okta AuthorizationServer API
AE Profile APIs.io
Okta Brand API
AE Profile APIs.io
Okta Domain API
AE Profile APIs.io
Okta EventHook API
AE Profile APIs.io
Okta Feature API
AE Profile APIs.io
Okta Group API
AE Profile APIs.io
Okta GroupSchema API
AE Profile APIs.io
Okta IdentityProvider API
AE Profile APIs.io
#User
← Back to O APIs
API Details
ID
okta:okta-user-api
Base URL
https://your-subdomain.okta.com
Docs
https://developer.okta.com/docs/reference/
Provider
Okta
APIs.io →  GitHub →
Explore more
All APIs Providers APIs.io Network
Work with this as data

Every API here is available over the API and to AI agents over MCP. APIs is not yet its own endpoint on the v1 API. Reach this content through network search and the tag graph, or the MCP server below.

Installs https://mcp.apievangelist.com/mcp in Claude, Cursor, VS Code and the rest — one button, every client.

MCP tools for apis
4 tools reach this content
  • search_api_evangelistSearch every content type across the network at once.
  • find_relatedThe shared-tag relevance graph — what else covers this.
  • get_tagEverything one tag labels, across all content types.
  • guide_topicPRO — a curated bundle for a topic: area, guidance, rules, papers, stories, services.
All tools & prompts
Call it yourself
curl for this page
Search the network for this 
curl "https://api.apievangelist.com/v1/search?q=okta-user-api&limit=10"
Everything under a tag 
curl "https://api.apievangelist.com/v1/tags/okta-user-api"

Discovery needs no key. Full bodies and the synthesis endpoints are Pro.

Get an API key

Free tier, no email required. Sign in with whichever identity you already have.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have. Your account

Where this information came from

This is an independent, third-party profile of Okta User API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.

The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.

Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.

info@apievangelist.com · Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.