Behavior Rules

The Behavior Rules API provides operations to manage the behavior detection rules for your organization.

List all Behavior Detection Rules
OAuth 2.0: okta.behaviors.read

Lists all behavior detection rules with pagination support

Responses
200

OK

403

Forbidden

429

Too Many Requests

get/api/v1/behaviors
Request samples
Response samples
application/json
[
  • {
    • "created": "2019-08-24T14:15:22Z",
    • "id": "string",
    • "lastUpdated": "2019-08-24T14:15:22Z",
    • "name": "string",
    • "status": "ACTIVE",
    • "type": "ANOMALOUS_DEVICE",
    • "_link": {
      }
    }
]

Create a Behavior Detection Rule
OAuth 2.0: okta.behaviors.manage

Creates a new behavior detection rule

Request
Request Body schema: application/json
required
name
required
string <= 128 characters
type
required
string (BehaviorRuleType)
status
string (LifecycleStatus)
Enum: "ACTIVE" "INACTIVE"
object (BehaviorRuleSettingsAnomalousLocation)
granularity
required
string (LocationGranularity)
Enum: "CITY" "COUNTRY" "LAT_LONG" "SUBDIVISION"
maxEventsUsedForEvaluation
integer [ 1 .. 100 ]
Default: 20
minEventsNeededForEvaluation
integer [ 0 .. 10 ]
Default: 0
radiusKilometers
integer

Required when granularity is LAT_LONG. Radius from the provided coordinates in kilometers.

Responses
201

Created

400

Bad Request

403

Forbidden

429

Too Many Requests

post/api/v1/behaviors
Request samples
application/json
{
  • "name": "My Behavior Rule",
  • "type": "VELOCITY"
}
Response samples
application/json
{
  • "id": "abcd1234",
  • "name": "My Behavior Rule",
  • "type": "VELOCITY",
  • "settings": {
    • "velocityKph": 805
    },
  • "status": "ACTIVE",
  • "created": "2021-11-09T20:38:10.000Z",
  • "lastUpdated": "2021-11-11T20:38:10.000Z",
  • "_link": {}
}

Retrieve a Behavior Detection Rule
OAuth 2.0: okta.behaviors.read

Retrieves a Behavior Detection Rule by behaviorId

Request
path Parameters
behaviorId
required
string

id of the Behavior Detection Rule

Example: abcd1234
Responses
200

OK

403

Forbidden

404

Not Found

429

Too Many Requests

get/api/v1/behaviors/{behaviorId}
Request samples
Response samples
application/json
{
  • "created": "2019-08-24T14:15:22Z",
  • "id": "string",
  • "lastUpdated": "2019-08-24T14:15:22Z",
  • "name": "string",
  • "status": "ACTIVE",
  • "type": "ANOMALOUS_LOCATION",
  • "_link": {
    • "self": {
      }
    },
  • "settings": {
    • "maxEventsUsedForEvaluation": 20,
    • "minEventsNeededForEvaluation": 0,
    • "granularity": "CITY",
    • "radiusKilometers": 0
    }
}

Replace a Behavior Detection Rule
OAuth 2.0: okta.behaviors.manage

Replaces a Behavior Detection Rule by behaviorId

Request
path Parameters
behaviorId
required
string

id of the Behavior Detection Rule

Example: abcd1234
Request Body schema: application/json
required
name
required
string <= 128 characters
type
required
string (BehaviorRuleType)
status
string (LifecycleStatus)
Enum: "ACTIVE" "INACTIVE"
object (BehaviorRuleSettingsAnomalousLocation)
granularity
required
string (LocationGranularity)
Enum: "CITY" "COUNTRY" "LAT_LONG" "SUBDIVISION"
maxEventsUsedForEvaluation
integer [ 1 .. 100 ]
Default: 20
minEventsNeededForEvaluation
integer [ 0 .. 10 ]
Default: 0
radiusKilometers
integer

Required when granularity is LAT_LONG. Radius from the provided coordinates in kilometers.

Responses
200

Created

400

Bad Request

403

Forbidden

404

Not Found

429

Too Many Requests

put/api/v1/behaviors/{behaviorId}
Request samples
application/json
{
  • "name": "My Behavior Rule",
  • "type": "VELOCITY"
}
Response samples
application/json
{
  • "id": "abcd1234",
  • "name": "My Behavior Rule",
  • "type": "VELOCITY",
  • "settings": {
    • "velocityKph": 805
    },
  • "status": "ACTIVE",
  • "created": "2021-11-09T20:38:10.000Z",
  • "lastUpdated": "2021-11-11T20:38:10.000Z",
  • "_link": {}
}

Delete a Behavior Detection Rule
OAuth 2.0: okta.behaviors.manage

Deletes a Behavior Detection Rule by behaviorId

Request
path Parameters
behaviorId
required
string

id of the Behavior Detection Rule

Example: abcd1234
Responses
204

No Content

403

Forbidden

404

Not Found

429

Too Many Requests

delete/api/v1/behaviors/{behaviorId}
Request samples
Response samples
application/json
{
  • "errorCode": "E0000006",
  • "errorSummary": "You do not have permission to perform the requested action",
  • "errorLink": "E0000006",
  • "errorId": "sampleNUSD_8fdkFd8fs8SDBK",
  • "errorCauses": [ ]
}

Activate a Behavior Detection Rule
OAuth 2.0: okta.behaviors.manage

Activates a behavior detection rule

Request
path Parameters
behaviorId
required
string

id of the Behavior Detection Rule

Example: abcd1234
Responses
200

Success

403

Forbidden

404

Not Found

429

Too Many Requests

post/api/v1/behaviors/{behaviorId}/lifecycle/activate
Request samples
Response samples
application/json
{
  • "id": "abcd1234",
  • "name": "My Behavior Rule",
  • "type": "VELOCITY",
  • "settings": {
    • "velocityKph": 805
    },
  • "status": "ACTIVE",
  • "created": "2021-11-09T20:38:10.000Z",
  • "lastUpdated": "2021-11-11T20:38:10.000Z",
  • "_link": {}
}

Deactivate a Behavior Detection Rule
OAuth 2.0: okta.behaviors.manage

Deactivates a behavior detection rule

Request
path Parameters
behaviorId
required
string

id of the Behavior Detection Rule

Example: abcd1234
Responses
200

Success

403

Forbidden

404

Not Found

429

Too Many Requests

post/api/v1/behaviors/{behaviorId}/lifecycle/deactivate
Request samples
Response samples
application/json
{
  • "id": "abcd1234",
  • "name": "My Behavior Rule",
  • "type": "VELOCITY",
  • "settings": {
    • "velocityKph": 805
    },
  • "status": "ACTIVE",
  • "created": "2021-11-09T20:38:10.000Z",
  • "lastUpdated": "2021-11-11T20:38:10.000Z",
  • "_link": {}
}