Okta

Live 115 Actions 21 Events

Okta Integration for AI Agents

Connect your AI agent to 115 QA'd Okta actions via MCP, A2A, or SDK, with agent authentication, tool-calling execution, and security built-in, plus 21 events to subscribe to.

Start Free Book Demo Okta MCP Server

Okta AI Agent Actions

115 production-ready actions for your agent to do more on Okta.

Read the Okta docs

115 Actions

List Applications - Lists all applications in your Okta org with pagination, filtering, and search

Get Application - Retrieves a specific application by ID from your Okta org. Use list_applications to obtain the appId.

List Application Groups - Lists all group assignments for an application. Use list_applications to obtain the appId.

Get Application Group - Retrieves a specific group assignment for an application. Use list_applications and list_application_groups to obtain required IDs.

List Application Users - Lists all users assigned to an application. Use list_applications to obtain the appId.

Get Application User - Retrieves a specific user assigned to an application. Use list_applications and list_application_users to obtain required IDs.

Assign User To Application - Assigns a user to an application directly

Unassign User From Application - Removes a user's assignment to an application

Assign Group To Application - Assigns a group to an application, granting access to its members

Unassign Group From Application - Removes a group's assignment to an application

Activate Application - Activates an inactive application

Deactivate Application - Deactivates an active application and reconciles its group assignments

List Device Assurance Policies - Lists all device assurance policies in the org

Get Device Assurance Policy - Retrieves a single device assurance policy by ID

List Authenticators - Lists the authenticators configured in your org. Okta Identity Engine orgs only.

List Authenticator Methods - Lists the methods of an authenticator, such as sms and voice for phone. Okta Identity Engine orgs only. Use list_authenticators to obtain the authenticator ID.

List Devices - Lists all devices with pagination support and flexible search options

Get Device - Retrieves a device by its ID

Delete Device - Permanently deletes a device. Device must be in DEACTIVATED status first.

Activate Device - Activates a device by setting its status to ACTIVE

Deactivate Device - Deactivates a device by setting its status to DEACTIVATED

Suspend Device - Suspends a device temporarily without deactivating it

Unsuspend Device - Returns a suspended device to the active state

Get User Factor - Retrieves a single enrolled MFA factor for a user

List Supported Factors - Lists all MFA factors a user is eligible to enrol

List Access Certification Campaigns - Lists access certification campaigns in the org

Get Access Certification Campaign - Retrieves a single access certification campaign by ID

Launch Access Certification Campaign - Launches a scheduled campaign and assigns reviews to reviewers

List Access Requests - Lists access requests raised by users in the org

Get Access Request - Retrieves a single access request by ID

Create Access Request - Raises an access request for a resource on behalf of a user

Cancel Access Request - Cancels an open access request via the provider's Update a request operation

List Access Request Types - Lists the access request types defined in the org

Get Access Request Type - Retrieves a single access request type by ID

Publish Access Request Type - Publishes a request type, making it available to end users

Unpublish Access Request Type - Unpublishes a request type, returning it to draft

List Access Certification Reviews - Lists access certification reviews, optionally scoped to one campaign

Get Access Certification Review - Retrieves a single access certification review by ID

Reassign Access Certification Reviews - Reassigns a batch of reviews to a different reviewer

List Groups - Lists all groups with pagination support

Get Group - Retrieves a specific group by ID from your org. Use list_groups to obtain the groupId.

List Group Rules - Lists the group rules in your org with pagination support

Get Group Rule - Retrieves a specific group rule by ID. Use list_group_rules to obtain the groupRuleId.

Create Group - Adds a new group with OKTA_GROUP type to your org

Update Group - Replaces the profile for a group of OKTA_GROUP type

Delete Group - Deletes a group of OKTA_GROUP or APP_GROUP type from your org

List Group Members - Lists all users that are a member of a group. Use list_groups to obtain the groupId.

Add User To Group - Assigns a user to a group with OKTA_GROUP type. Use list_groups and list_users to obtain required IDs.

Remove User From Group - Unassigns a user from a group with OKTA_GROUP type. Use list_groups and list_group_members to obtain required IDs.

Activate Group Rule - Activates a group rule so it begins assigning members

Deactivate Group Rule - Deactivates a group rule so it stops assigning members

List Group Assigned Applications - Lists the applications assigned to a group

List Group Owners - Lists the owners of a group

List Policies - Lists all policies of a given type

Get Policy - Retrieves a specific policy by ID. Use list_policies to obtain the policyId.

Create Policy - Creates a new policy of the specified type. The returned policy ID can be used with get_policy, replace_policy, delete_policy, and policy rule actions.

Replace Policy - Replaces a policy with the provided data. Use list_policies or create_policy to obtain the policyId.

Delete Policy - Deletes a policy by ID

Activate Policy - Activates a policy by setting its status to ACTIVE

Deactivate Policy - Deactivates a policy by setting its status to INACTIVE

Clone An Existing Policy - Clones an existing ACCESS_POLICY to create a copy

Create A Policy Simulation - Simulates a policy evaluation to test access outcomes

List All Apps Mapped To A Policy - Lists all applications mapped to an ACCESS_POLICY. Use list_policies with type ACCESS_POLICY to obtain the policyId.

List All Resources Mapped To A Policy - Lists all resources mapped to a policy. Use list_policies to obtain the policyId.

Retrieve A Policy Resource Mapping - Retrieves a specific policy resource mapping. Use list_policy_mappings to obtain the mappingId.

List All Policy Rules - Lists all rules for a specific policy. Use list_policies to obtain the policyId first.

Retrieve A Policy Rule - Retrieves a specific rule for a policy

Create Policy Rule - Creates a new rule for a policy. Use list_policies to obtain the policyId. The created rule ID is returned in the response.

Replace Policy Rule - Replaces a policy rule with the provided data. Use list_policy_rules to obtain the ruleId.

Delete Policy Rule - Deletes a policy rule. Use list_policy_rules to obtain the ruleId.

Activate Policy Rule - Activates a policy rule. Use list_policy_rules to obtain the ruleId.

Deactivate Policy Rule - Deactivates a policy rule. Use list_policy_rules to obtain the ruleId.

List Realms - Lists all Realms with pagination support

Get Realm - Retrieves a Realm by its ID

Create Realm - Creates a new Realm

Update Realm - Replaces the realm profile by its ID

Delete Realm - Deletes a Realm by its ID

List User Assigned Roles - Lists all administrator roles assigned to a user

List Custom Roles - Lists the custom admin roles in your org, plus IAM-based standard roles such as WORKFLOWS_ADMIN.

List Users With Role Assignments - Lists every user in the org that holds an administrator role

List API Tokens - Lists the metadata of the active API tokens in your org

List Event Hooks - Lists the event hooks configured in your org

List Identity Providers - Lists the identity provider (IdP) integrations in your org with pagination support

List Network Zones - Lists the network zones in your org with pagination support

List Trusted Origins - Lists the trusted origins in your org with pagination support

Get User Info - Retrieves information about the currently authenticated user from the OAuth 2.0 UserInfo endpoint.

List System Log Events - Lists events from the Okta System Log with filtering, keyword search, and pagination

List Users - Lists all users in your org with pagination and flexible query options

Get User - Retrieves a user from your Okta org by ID, login, or shortname. Use list_users to find the user ID, or pass the user's login email directly.

Create User - Creates a new user in your Okta org with or without credentials

Update User - Updates a user's profile or credentials with partial update semantics. Use list_users or get_user to obtain the user ID.

Replace User - Replaces a user's profile, credentials, or both using strict-update semantics. Use get_user first to fetch the current profile, then provide all fields in the replacement.

List User Blocks - Lists information about how a user is blocked from accessing their account. Use list_users to obtain the user ID.

List User Factors - Lists the MFA factors a user has enrolled. Use list_users to obtain the user ID.

List User Authenticator Enrollments - Lists all authenticators a user has enrolled. Okta Identity Engine orgs only. Use list_users to obtain the user ID.

List User Groups - Lists the groups a user belongs to. Use list_users to obtain the user ID.

List User Roles - Lists the admin roles assigned to a user, including standard and custom roles. Use list_users to obtain the user ID.

Delete User - Permanently deletes a user from your Okta organization. Use list_users to obtain the user ID. Requires two calls — first deactivates, second deletes.

Suspend User - Suspends an active user, blocking sign-in without removing access

Unsuspend User - Returns a suspended user to the active state

Deactivate User - Deactivates a user and deprovisions them from all assigned apps

Activate User - Activates a staged or deprovisioned user

Reactivate User - Restarts the activation workflow for a provisioned or recovering user

Unlock User - Unlocks a locked-out user so they can sign in again

Reset User Password - Starts a password reset and moves the user into recovery

Expire User Password - Expires a user password, forcing a change at next sign-in

Revoke User Sessions - Revokes a user's active sessions, forcing re-authentication

List User App Links - Lists the apps a user can reach, directly or through a group

List User Devices - Lists the devices enrolled by a specific user

List User Types - Lists all user types in your Okta organization

Get User Type - Retrieves a user type by ID

Create User Type - Creates a new user type in your Okta organization

Update User Type - Partially updates an existing user type

Replace User Type - Fully replaces an existing user type

Delete User Type - Permanently deletes a user type

Okta Webhook Events

21 real-time Okta events your AI agent can subscribe to.

Webhooks for AI agents Read the Okta docs

21 Events

Active Check Responds to Okta's one-time verification GET by echoing the x-okta-verification-challenge header value back in the JSON response body.
User Created Emitted when a new user account is created in Okta (provisioned by an admin, sourced from a directory, or self-registered). Maps to Okta event `user.lifecycle.create`.
User Activated Emitted when a user transitions from STAGED, PROVISIONED, or DEPROVISIONED to ACTIVE status and gains access. Maps to Okta event `user.lifecycle.activate`.
User Deactivated Emitted when a user is deactivated — access is revoked and sessions are invalidated, but the account is preserved (status DEPROVISIONED). Maps to Okta event `user.lifecycle.deactivate`.
User Suspended Emitted when a user is temporarily suspended — sign-in is blocked and sessions are invalidated, but the user can be unsuspended without re-provisioning. Maps to Okta event `user.lifecycle.suspend`.
User Delete Initiated Emitted when a user-deletion request is initiated — the user enters DELETED status. Note that `user.lifecycle.delete.confirmed` is NOT event-hook-eligible — `initiated` is the only signal Okta provides. Maps to Okta event `user.lifecycle.delete.initiated`.
User Password Reset Emitted when a user's password is reset (admin-initiated, self-service, or via the connector's reset action). Maps to Okta event `user.account.reset_password`.
User Profile Updated Emitted when one or more user profile attributes are changed (first name, last name, email, phone, custom attributes, etc.). Maps to Okta event `user.account.update_profile`.
User Universal Logout Emitted when a Universal Logout signal terminates all of a user's sessions and tokens across federated apps. Maps to Okta event `user.authentication.universal_logout`.
Group Created Emitted when a new group is created in Okta. Maps to Okta event `group.lifecycle.create`.
Group Deleted Emitted when a group is deleted from Okta. Note that there is no `group.lifecycle.modify` or `update` event — group attribute changes are NOT subscribable via Event Hooks. Maps to Okta event `group.lifecycle.delete`.
Group Member Added Emitted when a user is added as a member of a group. Maps to Okta event `group.user_membership.add`.
Group Member Removed Emitted when a user is removed from a group's membership. Maps to Okta event `group.user_membership.remove`.
Device Activated Emitted when a device transitions from STAGED to ACTIVE status and becomes trusted. Maps to Okta event `device.lifecycle.activate`.
Device Deactivated Emitted when a device is deactivated and loses its trusted status. Maps to Okta event `device.lifecycle.deactivate`.
Device Deleted Emitted when a device is permanently removed from Okta. Maps to Okta event `device.lifecycle.delete`.
App User Assigned Emitted when a user is assigned to an application — the core "who has access to what" IAM signal. Maps to Okta event `application.user_membership.add`.
App User Removed Emitted when a user is removed from an application — deprovisioning / access-loss signal critical for downstream cleanup. Maps to Okta event `application.user_membership.remove`.
App Sign-On Access Denied Emitted when an application sign-on policy denies a user access during sign-in. Security / compliance signal — useful for fraud detection, conditional-access alerting, and audit logging. Maps to Okta event `application.policy.sign_on.deny_access`.
API Token Created Emitted when a new Okta admin API token is created. Security-critical signal — useful for audit logging, anomaly detection, and least-privilege monitoring. Maps to Okta event `system.api_token.create`.
API Token Revoked Emitted when an Okta admin API token is revoked. Security signal — useful for tracking credential lifecycle and detecting compromised-token responses. Maps to Okta event `system.api_token.revoke`.

Do More, Build Less

Integration Infrastructure for Okta AI Agents

Multiple Interfaces

Access integrations via API, AI SDKs, MCP & A2A.

Okta MCP server

Managed Authentication

Pre-built authentication UI.

Agent auth

Falcon Engine

Every Okta action runs on Falcon.

Agent Execution Engine

StackOne Defender

88.7% prompt injection detection.

Prompt injection defense

Start Free Book a Demo

"What impressed us most about StackOne is its ambition and clarity. They're creating infrastructure that modern software and the entire AI agent ecosystem can rely on. The depth of secure integrations, the pace of delivery, and the team's foresight into AI's future uniquely position StackOne to redefine this category."

Luna Schmid, Partner at GV

"We've been impressed by how quickly and deeply StackOne integrates with complex enterprise systems -- and now, with their focus on agent-to-agent interoperability, they're unlocking even more powerful use cases for customers. StackOne delivers all of the above in a universal layer -- without compromise."