Policies

The Okta Policy API enables an Administrator to perform Policy and Policy Rule operations. The Policy framework is used by Okta to control Rules and settings that govern, among other things, user session lifetime, whether multi-factor authentication is required when logging in, what MFA factors may be employed, password complexity requirements, what types of self-service operations are permitted under various circumstances, and what identity provider to route users to.

Policy settings for a particular Policy type, such as Sign On Policy, consist of one or more Policy objects, each of which contains one or more Policy Rules. Policies and Rules contain conditions that determine whether they are applicable to a particular user at a particular time.

List all Policies
OAuth 2.0: `okta.policies.read`

Lists all policies with the specified type

Request

query Parameters

type required	string
status	string
expand	string Default: ""

Responses

200

Success

403

Forbidden

429

Too Many Requests

get/api/v1/policies

Request samples

Response samples

200
403
429

application/json

[{"created": "2019-08-24T14:15:22Z",
"description": "string",
"id": "string",
"lastUpdated": "2019-08-24T14:15:22Z",
"name": "string",
"priority": 0,
"status": "ACTIVE",
"system": true,
"type": "ACCESS_POLICY",
"_embedded": {"property1": { },
"property2": { }
},
"_links": {"activate": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"deactivate": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"mappings": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"rules": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"self": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
}
}
}
]

Create a Policy
OAuth 2.0: `okta.policies.manage`

Creates a policy

Request

query Parameters

activate

boolean

Default: true

Request Body schema: application/json
required

description

string

Policy description

name

string

Policy name

priority

integer

Specifies the order in which this Policy is evaluated in relation to the other policies

status

string (LifecycleStatus)

Enum: "ACTIVE" "INACTIVE"

system

boolean

Specifies whether Okta created the Policy

type

string (PolicyType)

All Okta orgs contain only one IdP Discovery Policy with an immutable default Rule routing to your org's sign-in page. Creating or replacing a policy with IDP_DISCOVERY type isn't supported.

object (PolicyLinks)

object (PolicyRuleConditions)

object (AppAndInstancePolicyRuleCondition)

	Array of objects (AppAndInstanceConditionEvaluatorAppOrInstance)
	Array of objects (AppAndInstanceConditionEvaluatorAppOrInstance)

object (AppInstancePolicyRuleCondition)

exclude	Array of strings
include	Array of strings

object (PolicyRuleAuthContextCondition)

authType

string (PolicyRuleAuthContextType)

Enum: "ANY" "RADIUS"

object (PasswordPolicyAuthenticationProviderCondition)

include	Array of strings
provider	string (PasswordPolicyAuthenticationProviderType) Enum: "ACTIVE_DIRECTORY" "ANY" "LDAP" "OKTA"

object (BeforeScheduledActionPolicyRuleCondition)

	object (Duration)
	object (ScheduledUserLifecycleAction)

object (ClientPolicyCondition)

Specifies which clients are included in the Policy

include

Array of strings

Which clients are included in the Policy

object (ContextPolicyRuleCondition)

migrated	boolean
	object (DevicePolicyRuleConditionPlatform)
rooted	boolean
trustLevel	string (DevicePolicyTrustLevel) Enum: "ANY" "TRUSTED"
expression	string

object (DevicePolicyRuleCondition)

migrated	boolean
	object (DevicePolicyRuleConditionPlatform)
rooted	boolean
trustLevel	string (DevicePolicyTrustLevel) Enum: "ANY" "TRUSTED"

object (GrantTypePolicyRuleCondition)

Array of grant types that this condition includes. Determines the mechanism that Okta uses to authorize the creation of the tokens.

include

Array of strings

Array of grant types thagt this condition includes.

object (GroupPolicyRuleCondition)

Specifies a set of Groups whose Users are to be included or excluded

exclude	Array of strings Groups to be excluded
include	Array of strings Groups to be included

object (IdentityProviderPolicyRuleCondition)

idpIds	Array of strings
provider	string (IdentityProviderPolicyProvider) Enum: "ANY" "OKTA" "SPECIFIC_IDP"

object (MDMEnrollmentPolicyRuleCondition)

blockNonSafeAndroid	boolean
enrollment	string (MDMEnrollmentPolicyEnrollment) Enum: "ANY_OR_NONE" "OMM"

object (PolicyNetworkCondition)

connection	string (PolicyNetworkConnection) Network selection mode Enum: "ANYWHERE" "ZONE"
exclude	Array of strings
include	Array of strings

object (PolicyPeopleCondition)

Identifies Users and Groups that are used together

	object (GroupCondition) Specifies a set of Groups whose Users are to be included or excluded
	object (UserCondition) Specifies a set of Users to be included or excluded

object (PlatformPolicyRuleCondition)

	Array of objects (PlatformConditionEvaluatorPlatform)
	Array of objects (PlatformConditionEvaluatorPlatform)

object (RiskPolicyRuleCondition)

behaviors

Array of strings unique

object (RiskScorePolicyRuleCondition)

level

string

object (OAuth2ScopesMediationPolicyRuleCondition)

Array of scopes that the condition includes

include

Array of strings

object (UserIdentifierPolicyRuleCondition)

attribute	string
	Array of objects (UserIdentifierConditionEvaluatorPattern)
type	string (UserIdentifierType) Enum: "ATTRIBUTE" "IDENTIFIER"

object (UserPolicyRuleCondition)

Specifies a set of Users to be included or excluded

exclude	Array of strings Users to be excluded
	object (InactivityPolicyRuleCondition)
include	Array of strings Users to be included
	object (LifecycleExpirationPolicyRuleCondition)
	object (PasswordExpirationPolicyRuleCondition)
	object (UserLifecycleAttributePolicyRuleCondition)

object (UserStatusPolicyRuleCondition)

value

string (PolicyUserStatus)

Enum: "ACTIVATING" "ACTIVE" "DELETED" "DELETING" "EXPIRED_PASSWORD" "INACTIVE" "PENDING" "SUSPENDED"

Responses

200

Success

400

Bad Request

403

Forbidden

429

Too Many Requests

post/api/v1/policies

Request samples

application/json

{"description": "string",
"name": "string",
"priority": 0,
"status": "ACTIVE",
"system": true,
"type": "ACCESS_POLICY",
"_links": { },
"conditions": {"app": {"exclude": [{"name": "string",
"type": "APP"
}
],
"include": [{"name": "string",
"type": "APP"
}
]
},
"apps": {"exclude": ["string"
],
"include": ["string"
]
},
"authContext": {"authType": "ANY"
},
"authProvider": {"include": ["string"
],
"provider": "ACTIVE_DIRECTORY"
},
"beforeScheduledAction": {"duration": {"number": 0,
"unit": "string"
},
"lifecycleAction": {"status": "ACTIVATING"
}
},
"clients": {"include": ["string"
]
},
"context": {"migrated": true,
"platform": {"supportedMDMFrameworks": ["AFW"
],
"types": ["ANDROID"
]
},
"rooted": true,
"trustLevel": "ANY",
"expression": "string"
},
"device": {"migrated": true,
"platform": {"supportedMDMFrameworks": ["AFW"
],
"types": ["ANDROID"
]
},
"rooted": true,
"trustLevel": "ANY"
},
"grantTypes": {"include": ["string"
]
},
"groups": {"exclude": ["string"
],
"include": ["string"
]
},
"identityProvider": {"idpIds": ["string"
],
"provider": "ANY"
},
"mdmEnrollment": {"blockNonSafeAndroid": true,
"enrollment": "ANY_OR_NONE"
},
"network": {"connection": "ANYWHERE",
"exclude": ["string"
],
"include": ["string"
]
},
"people": {"groups": {"exclude": ["string"
],
"include": ["string"
]
},
"users": {"exclude": ["string"
],
"include": ["string"
]
}
},
"platform": {"exclude": [{"os": {"expression": "string",
"type": "ANDROID",
"version": {"matchType": "EXPRESSION",
"value": "string"
}
},
"type": "ANY"
}
],
"include": [{"os": {"expression": "string",
"type": "ANDROID",
"version": {"matchType": "EXPRESSION",
"value": "string"
}
},
"type": "ANY"
}
]
},
"risk": {"behaviors": ["string"
]
},
"riskScore": {"level": "string"
},
"scopes": {"include": ["string"
]
},
"userIdentifier": {"attribute": "string",
"patterns": [{"matchType": "CONTAINS",
"value": "string"
}
],
"type": "ATTRIBUTE"
},
"users": {"exclude": ["string"
],
"inactivity": {"number": 0,
"unit": "string"
},
"include": ["string"
],
"lifecycleExpiration": {"lifecycleStatus": "string",
"number": 0,
"unit": "string"
},
"passwordExpiration": {"number": 0,
"unit": "string"
},
"userLifecycleAttribute": {"attributeName": "string",
"matchingValue": "string"
}
},
"userStatus": {"value": "ACTIVATING"
}
}
}

Response samples

200
400
403
429

application/json

{"created": "2019-08-24T14:15:22Z",
"description": "string",
"id": "string",
"lastUpdated": "2019-08-24T14:15:22Z",
"name": "string",
"priority": 0,
"status": "ACTIVE",
"system": true,
"type": "ACCESS_POLICY",
"_embedded": {"property1": { },
"property2": { }
},
"_links": {"activate": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"deactivate": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"mappings": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"rules": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"self": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
}
},
"conditions": {"app": {"exclude": [{"id": "string",
"name": "string",
"type": "APP"
}
],
"include": [{"id": "string",
"name": "string",
"type": "APP"
}
]
},
"apps": {"exclude": ["string"
],
"include": ["string"
]
},
"authContext": {"authType": "ANY"
},
"authProvider": {"include": ["string"
],
"provider": "ACTIVE_DIRECTORY"
},
"beforeScheduledAction": {"duration": {"number": 0,
"unit": "string"
},
"lifecycleAction": {"status": "ACTIVATING"
}
},
"clients": {"include": ["string"
]
},
"context": {"migrated": true,
"platform": {"supportedMDMFrameworks": ["AFW"
],
"types": ["ANDROID"
]
},
"rooted": true,
"trustLevel": "ANY",
"expression": "string"
},
"device": {"migrated": true,
"platform": {"supportedMDMFrameworks": ["AFW"
],
"types": ["ANDROID"
]
},
"rooted": true,
"trustLevel": "ANY"
},
"grantTypes": {"include": ["string"
]
},
"groups": {"exclude": ["string"
],
"include": ["string"
]
},
"identityProvider": {"idpIds": ["string"
],
"provider": "ANY"
},
"mdmEnrollment": {"blockNonSafeAndroid": true,
"enrollment": "ANY_OR_NONE"
},
"network": {"connection": "ANYWHERE",
"exclude": ["string"
],
"include": ["string"
]
},
"people": {"groups": {"exclude": ["string"
],
"include": ["string"
]
},
"users": {"exclude": ["string"
],
"include": ["string"
]
}
},
"platform": {"exclude": [{"os": {"expression": "string",
"type": "ANDROID",
"version": {"matchType": "EXPRESSION",
"value": "string"
}
},
"type": "ANY"
}
],
"include": [{"os": {"expression": "string",
"type": "ANDROID",
"version": {"matchType": "EXPRESSION",
"value": "string"
}
},
"type": "ANY"
}
]
},
"risk": {"behaviors": ["string"
]
},
"riskScore": {"level": "string"
},
"scopes": {"include": ["string"
]
},
"userIdentifier": {"attribute": "string",
"patterns": [{"matchType": "CONTAINS",
"value": "string"
}
],
"type": "ATTRIBUTE"
},
"users": {"exclude": ["string"
],
"inactivity": {"number": 0,
"unit": "string"
},
"include": ["string"
],
"lifecycleExpiration": {"lifecycleStatus": "string",
"number": 0,
"unit": "string"
},
"passwordExpiration": {"number": 0,
"unit": "string"
},
"userLifecycleAttribute": {"attributeName": "string",
"matchingValue": "string"
}
},
"userStatus": {"value": "ACTIVATING"
}
}
}

Create a Policy Simulation
Identity Engine
OAuth 2.0: `okta.policies.read`

Creates a policy or policy rule simulation. The access simulation evaluates policy and policy rules based on the existing policy rule configuration. The evaluation result simulates what the real-world authentication flow is and what policy rules have been applied or matched to the authentication flow.

Request

query Parameters

expand

string

Use expand=EVALUATED to include a list of evaluated but not matched policies and policy rules. Use expand=RULE to include details about why a rule condition was (not) matched.

Example: expand=expand=EVALUATED&expand=RULE

Request Body schema: application/json
required

Array

appInstance

required

string

The application instance ID for a simulate operation

object (PolicyContext)

	object
required	object An array of Group IDs for the simulate operation. Only user IDs or Group IDs are allowed, not both.
ip	string The network rule condition, zone, or IP address
	object The risk rule condition level
required	object The user ID for the simulate operation. Only user IDs or Group IDs are allowed, not both.
	object

policyTypes

Array of strings (PolicyType)

Supported policy types for a simulate operation. The default value, null, returns all types.

Items Enum: "ACCESS_POLICY" "IDP_DISCOVERY" "MFA_ENROLL" "OKTA_SIGN_ON" "PASSWORD" "PROFILE_ENROLLMENT"

Responses

204

Success

403

Forbidden

404

Not Found

429

Too Many Requests

post/api/v1/policies/simulate

Request samples

application/json

Simulate policy request body

{"policyType": ["OKTA_SIGN_ON",
"MFA_ENROLL"
],
"appInstance": "0oa4eroj3nYCIJIW70g7",
"policyContext": {"groups": {"ids": ["00g4eralvekR5RLuS0g7",
"00g4eralvekR5RLuS0g8"
]
}
},
"risk": {"level": "LOW"
},
"zones": {"ids": ["nzo4eralxcRnbIHYJ0g7"
]
},
"device": {"platform": "IOS",
"registered": true,
"managed": true
}
}

Response samples

204
403
404
429

application/json

Simulate policy response body

{"evaluation": [{"status": null,
"policyType": "OkTA_SIGN_ON",
"result": {"policies": [{"id": "00p4eromwukk6qUku0g7"
},
{"name": "test policy"
},
{"status": "MATCH"
},
{"conditions": [ ]
},
{"rules": [{"id": "0pr4erof85nGcyC7Y0g7"
},
{"name": "test rule"
},
{"status": "MATCH"
},
{"conditions": [{"type": "people.groups.include"
},
{"status": "MATCH"
}
]
}
]
}
]
},
"undefined": {"policies": null
},
"evaluated": {"policies": null
}
},
{"status": null,
"policyType": "ACCESS_POLICY",
"result": {"policies": [{"id": "rst4eram06ZKZewEe0g7"
},
{"name": "Any two factors"
},
{"status": "MATCH"
},
{"conditions": [ ]
},
{"rules": [{"id": "rul4eram07VsWgybo0g7"
},
{"name": "Catch-all rule"
},
{"status": "MATCH"
},
{"conditions": [ ]
}
]
}
]
},
"undefined": {"policies": null
},
"evaluated": {"policies": null
}
},
{"status": null,
"policyType": "PROFILE_ENROLLMENT",
"result": {"policies": [{"id": "rst4eram08ZSjPTOl0g7"
},
{"name": "Default Policy"
},
{"status": "MATCH"
},
{"conditions": [ ]
},
{"rules": [{"id": "rul4eram094PrQ2BX0g7"
},
{"name": "Catch-all rule"
},
{"status": "MATCH"
},
{"conditions": [ ]
}
]
}
]
},
"undefined": {"policies": null
},
"evaluated": {"policies": null
}
}
]
}

Retrieve a Policy
OAuth 2.0: `okta.policies.read`

Retrieves a policy

Request

path Parameters

policyId

required

string

id of the Policy

Example: 00plrilJ7jZ66Gn0X0g3

query Parameters

expand

string

Default: ""

Responses

200

Success

403

Forbidden

404

Not Found

429

Too Many Requests

get/api/v1/policies/{policyId}

Request samples

Response samples

200
403
404
429

application/json

{"created": "2019-08-24T14:15:22Z",
"description": "string",
"id": "string",
"lastUpdated": "2019-08-24T14:15:22Z",
"name": "string",
"priority": 0,
"status": "ACTIVE",
"system": true,
"type": "ACCESS_POLICY",
"_embedded": {"property1": { },
"property2": { }
},
"_links": {"activate": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"deactivate": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"mappings": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"rules": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"self": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
}
},
"conditions": {"app": {"exclude": [{"id": "string",
"name": "string",
"type": "APP"
}
],
"include": [{"id": "string",
"name": "string",
"type": "APP"
}
]
},
"apps": {"exclude": ["string"
],
"include": ["string"
]
},
"authContext": {"authType": "ANY"
},
"authProvider": {"include": ["string"
],
"provider": "ACTIVE_DIRECTORY"
},
"beforeScheduledAction": {"duration": {"number": 0,
"unit": "string"
},
"lifecycleAction": {"status": "ACTIVATING"
}
},
"clients": {"include": ["string"
]
},
"context": {"migrated": true,
"platform": {"supportedMDMFrameworks": ["AFW"
],
"types": ["ANDROID"
]
},
"rooted": true,
"trustLevel": "ANY",
"expression": "string"
},
"device": {"migrated": true,
"platform": {"supportedMDMFrameworks": ["AFW"
],
"types": ["ANDROID"
]
},
"rooted": true,
"trustLevel": "ANY"
},
"grantTypes": {"include": ["string"
]
},
"groups": {"exclude": ["string"
],
"include": ["string"
]
},
"identityProvider": {"idpIds": ["string"
],
"provider": "ANY"
},
"mdmEnrollment": {"blockNonSafeAndroid": true,
"enrollment": "ANY_OR_NONE"
},
"network": {"connection": "ANYWHERE",
"exclude": ["string"
],
"include": ["string"
]
},
"people": {"groups": {"exclude": ["string"
],
"include": ["string"
]
},
"users": {"exclude": ["string"
],
"include": ["string"
]
}
},
"platform": {"exclude": [{"os": {"expression": "string",
"type": "ANDROID",
"version": {"matchType": "EXPRESSION",
"value": "string"
}
},
"type": "ANY"
}
],
"include": [{"os": {"expression": "string",
"type": "ANDROID",
"version": {"matchType": "EXPRESSION",
"value": "string"
}
},
"type": "ANY"
}
]
},
"risk": {"behaviors": ["string"
]
},
"riskScore": {"level": "string"
},
"scopes": {"include": ["string"
]
},
"userIdentifier": {"attribute": "string",
"patterns": [{"matchType": "CONTAINS",
"value": "string"
}
],
"type": "ATTRIBUTE"
},
"users": {"exclude": ["string"
],
"inactivity": {"number": 0,
"unit": "string"
},
"include": ["string"
],
"lifecycleExpiration": {"lifecycleStatus": "string",
"number": 0,
"unit": "string"
},
"passwordExpiration": {"number": 0,
"unit": "string"
},
"userLifecycleAttribute": {"attributeName": "string",
"matchingValue": "string"
}
},
"userStatus": {"value": "ACTIVATING"
}
}
}

Replace a Policy
OAuth 2.0: `okta.policies.manage`

Replaces the properties of a Policy identified by policyId

Request

path Parameters

policyId

required

string

id of the Policy

Example: 00plrilJ7jZ66Gn0X0g3

Request Body schema: application/json
required

description

string

Policy description

name

string

Policy name

priority

integer

Specifies the order in which this Policy is evaluated in relation to the other policies

status

string (LifecycleStatus)

Enum: "ACTIVE" "INACTIVE"

system

boolean

Specifies whether Okta created the Policy

type

string (PolicyType)

All Okta orgs contain only one IdP Discovery Policy with an immutable default Rule routing to your org's sign-in page. Creating or replacing a policy with IDP_DISCOVERY type isn't supported.

object (PolicyLinks)

object (PolicyRuleConditions)

object (AppAndInstancePolicyRuleCondition)

	Array of objects (AppAndInstanceConditionEvaluatorAppOrInstance)
	Array of objects (AppAndInstanceConditionEvaluatorAppOrInstance)

object (AppInstancePolicyRuleCondition)

exclude	Array of strings
include	Array of strings

object (PolicyRuleAuthContextCondition)

authType

string (PolicyRuleAuthContextType)

Enum: "ANY" "RADIUS"

object (PasswordPolicyAuthenticationProviderCondition)

include	Array of strings
provider	string (PasswordPolicyAuthenticationProviderType) Enum: "ACTIVE_DIRECTORY" "ANY" "LDAP" "OKTA"

object (BeforeScheduledActionPolicyRuleCondition)

	object (Duration)
	object (ScheduledUserLifecycleAction)

object (ClientPolicyCondition)

Specifies which clients are included in the Policy

include

Array of strings

Which clients are included in the Policy

object (ContextPolicyRuleCondition)

migrated	boolean
	object (DevicePolicyRuleConditionPlatform)
rooted	boolean
trustLevel	string (DevicePolicyTrustLevel) Enum: "ANY" "TRUSTED"
expression	string

object (DevicePolicyRuleCondition)

migrated	boolean
	object (DevicePolicyRuleConditionPlatform)
rooted	boolean
trustLevel	string (DevicePolicyTrustLevel) Enum: "ANY" "TRUSTED"

object (GrantTypePolicyRuleCondition)

Array of grant types that this condition includes. Determines the mechanism that Okta uses to authorize the creation of the tokens.

include

Array of strings

Array of grant types thagt this condition includes.

object (GroupPolicyRuleCondition)

Specifies a set of Groups whose Users are to be included or excluded

exclude	Array of strings Groups to be excluded
include	Array of strings Groups to be included

object (IdentityProviderPolicyRuleCondition)

idpIds	Array of strings
provider	string (IdentityProviderPolicyProvider) Enum: "ANY" "OKTA" "SPECIFIC_IDP"

object (MDMEnrollmentPolicyRuleCondition)

blockNonSafeAndroid	boolean
enrollment	string (MDMEnrollmentPolicyEnrollment) Enum: "ANY_OR_NONE" "OMM"

object (PolicyNetworkCondition)

connection	string (PolicyNetworkConnection) Network selection mode Enum: "ANYWHERE" "ZONE"
exclude	Array of strings
include	Array of strings

object (PolicyPeopleCondition)

Identifies Users and Groups that are used together

	object (GroupCondition) Specifies a set of Groups whose Users are to be included or excluded
	object (UserCondition) Specifies a set of Users to be included or excluded

object (PlatformPolicyRuleCondition)

	Array of objects (PlatformConditionEvaluatorPlatform)
	Array of objects (PlatformConditionEvaluatorPlatform)

object (RiskPolicyRuleCondition)

behaviors

Array of strings unique

object (RiskScorePolicyRuleCondition)

level

string

object (OAuth2ScopesMediationPolicyRuleCondition)

Array of scopes that the condition includes

include

Array of strings

object (UserIdentifierPolicyRuleCondition)

attribute	string
	Array of objects (UserIdentifierConditionEvaluatorPattern)
type	string (UserIdentifierType) Enum: "ATTRIBUTE" "IDENTIFIER"

object (UserPolicyRuleCondition)

Specifies a set of Users to be included or excluded

exclude	Array of strings Users to be excluded
	object (InactivityPolicyRuleCondition)
include	Array of strings Users to be included
	object (LifecycleExpirationPolicyRuleCondition)
	object (PasswordExpirationPolicyRuleCondition)
	object (UserLifecycleAttributePolicyRuleCondition)

object (UserStatusPolicyRuleCondition)

value

string (PolicyUserStatus)

Enum: "ACTIVATING" "ACTIVE" "DELETED" "DELETING" "EXPIRED_PASSWORD" "INACTIVE" "PENDING" "SUSPENDED"

Responses

200

Success

400

Bad Request

403

Forbidden

404

Not Found

429

Too Many Requests

put/api/v1/policies/{policyId}

Request samples

application/json

{"description": "string",
"name": "string",
"priority": 0,
"status": "ACTIVE",
"system": true,
"type": "ACCESS_POLICY",
"_links": { },
"conditions": {"app": {"exclude": [{"name": "string",
"type": "APP"
}
],
"include": [{"name": "string",
"type": "APP"
}
]
},
"apps": {"exclude": ["string"
],
"include": ["string"
]
},
"authContext": {"authType": "ANY"
},
"authProvider": {"include": ["string"
],
"provider": "ACTIVE_DIRECTORY"
},
"beforeScheduledAction": {"duration": {"number": 0,
"unit": "string"
},
"lifecycleAction": {"status": "ACTIVATING"
}
},
"clients": {"include": ["string"
]
},
"context": {"migrated": true,
"platform": {"supportedMDMFrameworks": ["AFW"
],
"types": ["ANDROID"
]
},
"rooted": true,
"trustLevel": "ANY",
"expression": "string"
},
"device": {"migrated": true,
"platform": {"supportedMDMFrameworks": ["AFW"
],
"types": ["ANDROID"
]
},
"rooted": true,
"trustLevel": "ANY"
},
"grantTypes": {"include": ["string"
]
},
"groups": {"exclude": ["string"
],
"include": ["string"
]
},
"identityProvider": {"idpIds": ["string"
],
"provider": "ANY"
},
"mdmEnrollment": {"blockNonSafeAndroid": true,
"enrollment": "ANY_OR_NONE"
},
"network": {"connection": "ANYWHERE",
"exclude": ["string"
],
"include": ["string"
]
},
"people": {"groups": {"exclude": ["string"
],
"include": ["string"
]
},
"users": {"exclude": ["string"
],
"include": ["string"
]
}
},
"platform": {"exclude": [{"os": {"expression": "string",
"type": "ANDROID",
"version": {"matchType": "EXPRESSION",
"value": "string"
}
},
"type": "ANY"
}
],
"include": [{"os": {"expression": "string",
"type": "ANDROID",
"version": {"matchType": "EXPRESSION",
"value": "string"
}
},
"type": "ANY"
}
]
},
"risk": {"behaviors": ["string"
]
},
"riskScore": {"level": "string"
},
"scopes": {"include": ["string"
]
},
"userIdentifier": {"attribute": "string",
"patterns": [{"matchType": "CONTAINS",
"value": "string"
}
],
"type": "ATTRIBUTE"
},
"users": {"exclude": ["string"
],
"inactivity": {"number": 0,
"unit": "string"
},
"include": ["string"
],
"lifecycleExpiration": {"lifecycleStatus": "string",
"number": 0,
"unit": "string"
},
"passwordExpiration": {"number": 0,
"unit": "string"
},
"userLifecycleAttribute": {"attributeName": "string",
"matchingValue": "string"
}
},
"userStatus": {"value": "ACTIVATING"
}
}
}

Response samples

200
400
403
404
429

application/json

{"created": "2019-08-24T14:15:22Z",
"description": "string",
"id": "string",
"lastUpdated": "2019-08-24T14:15:22Z",
"name": "string",
"priority": 0,
"status": "ACTIVE",
"system": true,
"type": "ACCESS_POLICY",
"_embedded": {"property1": { },
"property2": { }
},
"_links": {"activate": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"deactivate": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"mappings": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"rules": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"self": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
}
},
"conditions": {"app": {"exclude": [{"id": "string",
"name": "string",
"type": "APP"
}
],
"include": [{"id": "string",
"name": "string",
"type": "APP"
}
]
},
"apps": {"exclude": ["string"
],
"include": ["string"
]
},
"authContext": {"authType": "ANY"
},
"authProvider": {"include": ["string"
],
"provider": "ACTIVE_DIRECTORY"
},
"beforeScheduledAction": {"duration": {"number": 0,
"unit": "string"
},
"lifecycleAction": {"status": "ACTIVATING"
}
},
"clients": {"include": ["string"
]
},
"context": {"migrated": true,
"platform": {"supportedMDMFrameworks": ["AFW"
],
"types": ["ANDROID"
]
},
"rooted": true,
"trustLevel": "ANY",
"expression": "string"
},
"device": {"migrated": true,
"platform": {"supportedMDMFrameworks": ["AFW"
],
"types": ["ANDROID"
]
},
"rooted": true,
"trustLevel": "ANY"
},
"grantTypes": {"include": ["string"
]
},
"groups": {"exclude": ["string"
],
"include": ["string"
]
},
"identityProvider": {"idpIds": ["string"
],
"provider": "ANY"
},
"mdmEnrollment": {"blockNonSafeAndroid": true,
"enrollment": "ANY_OR_NONE"
},
"network": {"connection": "ANYWHERE",
"exclude": ["string"
],
"include": ["string"
]
},
"people": {"groups": {"exclude": ["string"
],
"include": ["string"
]
},
"users": {"exclude": ["string"
],
"include": ["string"
]
}
},
"platform": {"exclude": [{"os": {"expression": "string",
"type": "ANDROID",
"version": {"matchType": "EXPRESSION",
"value": "string"
}
},
"type": "ANY"
}
],
"include": [{"os": {"expression": "string",
"type": "ANDROID",
"version": {"matchType": "EXPRESSION",
"value": "string"
}
},
"type": "ANY"
}
]
},
"risk": {"behaviors": ["string"
]
},
"riskScore": {"level": "string"
},
"scopes": {"include": ["string"
]
},
"userIdentifier": {"attribute": "string",
"patterns": [{"matchType": "CONTAINS",
"value": "string"
}
],
"type": "ATTRIBUTE"
},
"users": {"exclude": ["string"
],
"inactivity": {"number": 0,
"unit": "string"
},
"include": ["string"
],
"lifecycleExpiration": {"lifecycleStatus": "string",
"number": 0,
"unit": "string"
},
"passwordExpiration": {"number": 0,
"unit": "string"
},
"userLifecycleAttribute": {"attributeName": "string",
"matchingValue": "string"
}
},
"userStatus": {"value": "ACTIVATING"
}
}
}

Delete a Policy
OAuth 2.0: `okta.policies.manage`

Deletes a policy

Request

path Parameters

policyId

required

string

id of the Policy

Example: 00plrilJ7jZ66Gn0X0g3

Responses

204

No Content

403

Forbidden

404

Not Found

429

Too Many Requests

delete/api/v1/policies/{policyId}

Request samples

Response samples

403
404
429

application/json

{"errorCode": "E0000006",
"errorSummary": "You do not have permission to perform the requested action",
"errorLink": "E0000006",
"errorId": "sampleNUSD_8fdkFd8fs8SDBK",
"errorCauses": [ ]
}

List all Applications mapped to a Policy
OAuth 2.0: `okta.policies.read`
Deprecated

Lists all applications mapped to a policy identified by policyId

Note: Use List all resources mapped to a Policy to list all applications mapped to a policy.

Request

path Parameters

policyId

required

string

id of the Policy

Example: 00plrilJ7jZ66Gn0X0g3

Responses

200

Success

403

Forbidden

404

Not Found

429

Too Many Requests

get/api/v1/policies/{policyId}/app

Request samples

Response samples

200
403
404
429

application/json

[{"accessibility": {"errorRedirectUrl": "string",
"loginRedirectUrl": "string",
"selfService": true
},
"created": "2019-08-24T14:15:22Z",
"features": ["string"
],
"id": "string",
"label": "string",
"lastUpdated": "2019-08-24T14:15:22Z",
"licensing": {"seatCount": 0
},
"profile": {"property1": { },
"property2": { }
},
"signOnMode": "AUTO_LOGIN",
"status": "ACTIVE",
"visibility": {"appLinks": {"property1": true,
"property2": true
},
"autoLaunch": true,
"autoSubmitToolbar": true,
"hide": {"iOS": true,
"web": true
}
},
"_embedded": {"property1": { },
"property2": { }
},
"_links": {"accessPolicy": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"activate": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"deactivate": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"groups": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"logo": [{"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
}
],
"metadata": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"self": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"users": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
}
}
}
]

Clone an existing Policy
Identity Engine
OAuth 2.0: `okta.policies.manage`

Clones an existing policy

Request

path Parameters

policyId

required

string

id of the Policy

Example: 00plrilJ7jZ66Gn0X0g3

Responses

200

Success

400

Bad Request

403

Forbidden

404

Not Found

429

Too Many Requests

post/api/v1/policies/{policyId}/clone

Request samples

Response samples

200
400
403
404
429

application/json

{"created": "2019-08-24T14:15:22Z",
"description": "string",
"id": "string",
"lastUpdated": "2019-08-24T14:15:22Z",
"name": "string",
"priority": 0,
"status": "ACTIVE",
"system": true,
"type": "ACCESS_POLICY",
"_embedded": {"property1": { },
"property2": { }
},
"_links": {"activate": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"deactivate": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"mappings": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"rules": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"self": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
}
},
"conditions": {"app": {"exclude": [{"id": "string",
"name": "string",
"type": "APP"
}
],
"include": [{"id": "string",
"name": "string",
"type": "APP"
}
]
},
"apps": {"exclude": ["string"
],
"include": ["string"
]
},
"authContext": {"authType": "ANY"
},
"authProvider": {"include": ["string"
],
"provider": "ACTIVE_DIRECTORY"
},
"beforeScheduledAction": {"duration": {"number": 0,
"unit": "string"
},
"lifecycleAction": {"status": "ACTIVATING"
}
},
"clients": {"include": ["string"
]
},
"context": {"migrated": true,
"platform": {"supportedMDMFrameworks": ["AFW"
],
"types": ["ANDROID"
]
},
"rooted": true,
"trustLevel": "ANY",
"expression": "string"
},
"device": {"migrated": true,
"platform": {"supportedMDMFrameworks": ["AFW"
],
"types": ["ANDROID"
]
},
"rooted": true,
"trustLevel": "ANY"
},
"grantTypes": {"include": ["string"
]
},
"groups": {"exclude": ["string"
],
"include": ["string"
]
},
"identityProvider": {"idpIds": ["string"
],
"provider": "ANY"
},
"mdmEnrollment": {"blockNonSafeAndroid": true,
"enrollment": "ANY_OR_NONE"
},
"network": {"connection": "ANYWHERE",
"exclude": ["string"
],
"include": ["string"
]
},
"people": {"groups": {"exclude": ["string"
],
"include": ["string"
]
},
"users": {"exclude": ["string"
],
"include": ["string"
]
}
},
"platform": {"exclude": [{"os": {"expression": "string",
"type": "ANDROID",
"version": {"matchType": "EXPRESSION",
"value": "string"
}
},
"type": "ANY"
}
],
"include": [{"os": {"expression": "string",
"type": "ANDROID",
"version": {"matchType": "EXPRESSION",
"value": "string"
}
},
"type": "ANY"
}
]
},
"risk": {"behaviors": ["string"
]
},
"riskScore": {"level": "string"
},
"scopes": {"include": ["string"
]
},
"userIdentifier": {"attribute": "string",
"patterns": [{"matchType": "CONTAINS",
"value": "string"
}
],
"type": "ATTRIBUTE"
},
"users": {"exclude": ["string"
],
"inactivity": {"number": 0,
"unit": "string"
},
"include": ["string"
],
"lifecycleExpiration": {"lifecycleStatus": "string",
"number": 0,
"unit": "string"
},
"passwordExpiration": {"number": 0,
"unit": "string"
},
"userLifecycleAttribute": {"attributeName": "string",
"matchingValue": "string"
}
},
"userStatus": {"value": "ACTIVATING"
}
}
}

Activate a Policy
OAuth 2.0: `okta.policies.manage`

Activates a policy

Request

path Parameters

policyId

required

string

id of the Policy

Example: 00plrilJ7jZ66Gn0X0g3

Responses

204

No Content

403

Forbidden

404

Not Found

429

Too Many Requests

post/api/v1/policies/{policyId}/lifecycle/activate

Request samples

Response samples

403
404
429

application/json

{"errorCode": "E0000006",
"errorSummary": "You do not have permission to perform the requested action",
"errorLink": "E0000006",
"errorId": "sampleNUSD_8fdkFd8fs8SDBK",
"errorCauses": [ ]
}

Deactivate a Policy
OAuth 2.0: `okta.policies.manage`

Deactivates a policy

Request

path Parameters

policyId

required

string

id of the Policy

Example: 00plrilJ7jZ66Gn0X0g3

Responses

204

No Content

403

Forbidden

404

Not Found

429

Too Many Requests

post/api/v1/policies/{policyId}/lifecycle/deactivate

Request samples

Response samples

403
404
429

application/json

{"errorCode": "E0000006",
"errorSummary": "You do not have permission to perform the requested action",
"errorLink": "E0000006",
"errorId": "sampleNUSD_8fdkFd8fs8SDBK",
"errorCauses": [ ]
}

List all resources mapped to a Policy
OAuth 2.0: `okta.policies.read`

Lists all resources mapped to a Policy identified by policyId

Request

path Parameters

policyId

required

string

id of the Policy

Example: 00plrilJ7jZ66Gn0X0g3

Responses

200

Success

403

Forbidden

404

Not Found

429

Too Many Requests

get/api/v1/policies/{policyId}/mappings

Request samples

Response samples

200
403
404
429

application/json

[{"id": "string",
"_links": {"self": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"application": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"authenticator": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"policy": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
}
}
}
]

Map a resource to a Policy
OAuth 2.0: `okta.policies.manage`

Maps a resource to a Policy identified by policyId

Request

path Parameters

policyId

required

string

id of the Policy

Example: 00plrilJ7jZ66Gn0X0g3

Request Body schema: application/json
required

resourceId	string
resourceType	string (PolicyMappingResourceType) Value: "APP"

Responses

200

Success

400

Bad Request

403

Forbidden

404

Not Found

429

Too Many Requests

post/api/v1/policies/{policyId}/mappings

Request samples

application/json

{"resourceId": "string",
"resourceType": "APP"
}

Response samples

200
400
403
404
429

application/json

{"id": "string",
"_links": {"self": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"application": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"authenticator": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"policy": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
}
}
}

Retrieve a policy resource Mapping
OAuth 2.0: `okta.policies.read`

Retrieves a resource Mapping for a Policy identified by policyId and mappingId

Request

path Parameters

policyId required	string `id` of the Policy Example: 00plrilJ7jZ66Gn0X0g3
mappingId required	string `id` of the policy resource Mapping Example: maplr2rLjZ6NsGn1P0g3

Responses

200

Success

403

Forbidden

404

Not Found

429

Too Many Requests

get/api/v1/policies/{policyId}/mappings/{mappingId}

Request samples

Response samples

200
403
404
429

application/json

{"id": "string",
"_links": {"self": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"application": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"authenticator": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
},
"policy": {"hints": {"allow": ["DELETE"
]
},
"href": "string",
"name": "string",
"type": "string"
}
}
}

Delete a policy resource Mapping
OAuth 2.0: `okta.policies.manage`

Deletes the resource Mapping for a Policy identified by policyId and mappingId

Request

path Parameters

policyId required	string `id` of the Policy Example: 00plrilJ7jZ66Gn0X0g3
mappingId required	string `id` of the policy resource Mapping Example: maplr2rLjZ6NsGn1P0g3

Responses

204

No Content

403

Forbidden

404

Not Found

429

Too Many Requests

delete/api/v1/policies/{policyId}/mappings/{mappingId}

Request samples

Response samples

403
404
429

application/json

{"errorCode": "E0000006",
"errorSummary": "You do not have permission to perform the requested action",
"errorLink": "E0000006",
"errorId": "sampleNUSD_8fdkFd8fs8SDBK",
"errorCauses": [ ]
}

List all Policy Rules
OAuth 2.0: `okta.policies.read`

Lists all policy rules

Request

path Parameters

policyId

required

string

id of the Policy

Example: 00plrilJ7jZ66Gn0X0g3

Responses

200

Success

403

Forbidden

404

Not Found

429

Too Many Requests

get/api/v1/policies/{policyId}/rules

Request samples

Response samples

200
403
404
429

application/json

[{"created": "2019-08-24T14:15:22Z",
"id": "string",
"lastUpdated": "2019-08-24T14:15:22Z",
"name": "string",
"priority": 0,
"status": "ACTIVE",
"system": false,
"type": "ACCESS_POLICY"
}
]

Create a Policy Rule
OAuth 2.0: `okta.policies.manage`

Creates a policy rule

Request

path Parameters

policyId

required

string

id of the Policy

Example: 00plrilJ7jZ66Gn0X0g3

Request Body schema: application/json
required

id

string

Identifier for the rule

name

string

Name of the rule

priority

integer

Priority of the rule

status

string (LifecycleStatus)

Enum: "ACTIVE" "INACTIVE"

system

boolean

Default: false

Specifies whether Okta created the Policy Rule (system=true). You can't delete Policy Rules that have system set to true.

type

string (PolicyRuleType)

Rule type

object (AccessPolicyRuleActions)

object (AccessPolicyRuleApplicationSignOn)

access	string
	object (VerificationMethod)

object (AccessPolicyRuleConditions)

object (AppAndInstancePolicyRuleCondition)

	Array of objects (AppAndInstanceConditionEvaluatorAppOrInstance)
	Array of objects (AppAndInstanceConditionEvaluatorAppOrInstance)

object (AppInstancePolicyRuleCondition)

exclude	Array of strings
include	Array of strings

object (PolicyRuleAuthContextCondition)

authType

string (PolicyRuleAuthContextType)

Enum: "ANY" "RADIUS"

object (PasswordPolicyAuthenticationProviderCondition)

include	Array of strings
provider	string (PasswordPolicyAuthenticationProviderType) Enum: "ACTIVE_DIRECTORY" "ANY" "LDAP" "OKTA"

object (BeforeScheduledActionPolicyRuleCondition)

	object (Duration)
	object (ScheduledUserLifecycleAction)

object (ClientPolicyCondition)

Specifies which clients are included in the Policy

include

Array of strings

Which clients are included in the Policy

object (ContextPolicyRuleCondition)

migrated	boolean
	object (DevicePolicyRuleConditionPlatform)
rooted	boolean
trustLevel	string (DevicePolicyTrustLevel) Enum: "ANY" "TRUSTED"
expression	string

object (DeviceAccessPolicyRuleCondition)

migrated	boolean
	object
rooted	boolean
trustLevel	string Enum: "ANY" "TRUSTED"
	object (DevicePolicyRuleConditionAssurance)
managed	boolean
registered	boolean

object (GrantTypePolicyRuleCondition)

Array of grant types that this condition includes. Determines the mechanism that Okta uses to authorize the creation of the tokens.

include

Array of strings

Array of grant types thagt this condition includes.

object (GroupPolicyRuleCondition)

Specifies a set of Groups whose Users are to be included or excluded

exclude	Array of strings Groups to be excluded
include	Array of strings Groups to be included

object (IdentityProviderPolicyRuleCondition)

idpIds	Array of strings
provider	string (IdentityProviderPolicyProvider) Enum: "ANY" "OKTA" "SPECIFIC_IDP"

object (MDMEnrollmentPolicyRuleCondition)

blockNonSafeAndroid	boolean
enrollment	string (MDMEnrollmentPolicyEnrollment) Enum: "ANY_OR_NONE" "OMM"

object (PolicyNetworkCondition)

connection	string (PolicyNetworkConnection) Network selection mode Enum: "ANYWHERE" "ZONE"
exclude	Array of strings
include	Array of strings

object (PolicyPeopleCondition)

Identifies Users and Groups that are used together

	object (GroupCondition) Specifies a set of Groups whose Users are to be included or excluded
	object (UserCondition) Specifies a set of Users to be included or excluded

object (PlatformPolicyRuleCondition)

	Array of objects (PlatformConditionEvaluatorPlatform)
	Array of objects (PlatformConditionEvaluatorPlatform)

object (RiskPolicyRuleCondition)

behaviors

Array of strings unique

object (RiskScorePolicyRuleCondition)

level

string

object (OAuth2ScopesMediationPolicyRuleCondition)

Array of scopes that the condition includes

include

Array of strings

object (UserIdentifierPolicyRuleCondition)

attribute	string
	Array of objects (UserIdentifierConditionEvaluatorPattern)
type	string (UserIdentifierType) Enum: "ATTRIBUTE" "IDENTIFIER"

object (UserPolicyRuleCondition)

Specifies a set of Users to be included or excluded

exclude	Array of strings Users to be excluded
	object (InactivityPolicyRuleCondition)
include	Array of strings Users to be included
	object (LifecycleExpirationPolicyRuleCondition)
	object (PasswordExpirationPolicyRuleCondition)
	object (UserLifecycleAttributePolicyRuleCondition)

object (UserStatusPolicyRuleCondition)

value

string (PolicyUserStatus)

Enum: "ACTIVATING" "ACTIVE" "DELETED" "DELETING" "EXPIRED_PASSWORD" "INACTIVE" "PENDING" "SUSPENDED"

object (AccessPolicyRuleCustomCondition)

condition

string

object (UserTypeCondition)

exclude	Array of strings
include	Array of strings

Responses

200

Success

400

Bad Request

403

Forbidden

404

Not Found

429

Too Many Requests

post/api/v1/policies/{policyId}/rules

Request samples

application/json

This password policy permits self-service password change, reset, and unlock. Phone SMS and Okta Verify push are the initial authenticators, and the secondary authentication is a security question.

{"name": "SSPR Rule",
"priority": 1,
"status": "ACTIVE",
"conditions": {"people": {"users": {"exclude": [ ]
}
},
"network": {"connection": "ANYWHERE"
}
},
"actions": {"passwordChange": {"access": "ALLOW"
},
"selfServicePasswordReset": {"access": "ALLOW",
"requirement": {"primary": {"methods": ["push",
"sms"
]
},
"stepUp": {"required": true,
"methods": ["security_question"
]
}
}
},
"selfServiceUnlock": {"access": "ALLOW"
}
},
"system": false,
"type": "PASSWORD"
}

Response samples

200
400
403
404
429

application/json

{"id": "ruleId",
"_links": {"self": {"href": "https://sampleorg.okta.com/api/v1/policies/{policyId}/rules/{ruleId}",
"hints": {"allow": ["GET",
"PUT",
"DELETE"
]
}
},
"deactivate": {"href": "https://sampleorg.okta.com/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate",
"hints": {"allow": ["POST"
]
}
}
},
"name": "SSPR Rule",
"priority": 1,
"status": "ACTIVE",
"conditions": {"people": {"users": {"exclude": [ ]
}
},
"network": {"connection": "ANYWHERE"
}
},
"actions": {"passwordChange": {"access": "ALLOW"
},
"selfServicePasswordReset": {"access": "ALLOW",
"requirement": {"primary": {"methods": ["push",
"sms"
]
},
"stepUp": {"required": true,
"methods": ["security_question"
]
}
}
},
"selfServiceUnlock": {"access": "ALLOW"
}
},
"system": false,
"type": "PASSWORD"
}

Retrieve a Policy Rule
OAuth 2.0: `okta.policies.read`

Retrieves a policy rule

Request

path Parameters

policyId required	string `id` of the Policy Example: 00plrilJ7jZ66Gn0X0g3
ruleId required	string `id` of the Policy Rule Example: ruld3hJ7jZh4fn0st0g3

Responses

200

Success

403

Forbidden

404

Not Found

429

Too Many Requests

get/api/v1/policies/{policyId}/rules/{ruleId}

Request samples

Response samples

200
403
404
429

application/json

This password policy permits self-service password change, reset, and unlock. Phone SMS and Okta Verify push are initial authenticators, and the secondary authentication is a security question.

{"id": "ruleId",
"name": "SSPR Rule",
"priority": 1,
"status": "ACTIVE",
"conditions": {"people": {"users": {"exclude": [ ]
}
},
"network": {"connection": "ANYWHERE"
}
},
"actions": {"passwordChange": {"access": "ALLOW"
},
"selfServicePasswordReset": {"access": "ALLOW",
"requirement": {"primary": {"methods": ["push",
"sms"
]
},
"stepUp": {"required": true,
"methods": ["security_question"
]
}
}
},
"selfServiceUnlock": {"access": "ALLOW"
}
},
"system": false,
"type": "PASSWORD"
}

Replace a Policy Rule
OAuth 2.0: `okta.policies.manage`

Replaces the properties for a Policy Rule identified by policyId and ruleId

Request

path Parameters

policyId required	string `id` of the Policy Example: 00plrilJ7jZ66Gn0X0g3
ruleId required	string `id` of the Policy Rule Example: ruld3hJ7jZh4fn0st0g3

Request Body schema: application/json
required

id

string

Identifier for the rule

name

string

Name of the rule

priority

integer

Priority of the rule

status

string (LifecycleStatus)

Enum: "ACTIVE" "INACTIVE"

system

boolean

Default: false

Specifies whether Okta created the Policy Rule (system=true). You can't delete Policy Rules that have system set to true.

type

string (PolicyRuleType)

Rule type

object (AccessPolicyRuleActions)

object (AccessPolicyRuleApplicationSignOn)

access	string
	object (VerificationMethod)

object (AccessPolicyRuleConditions)

object (AppAndInstancePolicyRuleCondition)

	Array of objects (AppAndInstanceConditionEvaluatorAppOrInstance)
	Array of objects (AppAndInstanceConditionEvaluatorAppOrInstance)

object (AppInstancePolicyRuleCondition)

exclude	Array of strings
include	Array of strings

object (PolicyRuleAuthContextCondition)

authType

string (PolicyRuleAuthContextType)

Enum: "ANY" "RADIUS"

object (PasswordPolicyAuthenticationProviderCondition)

include	Array of strings
provider	string (PasswordPolicyAuthenticationProviderType) Enum: "ACTIVE_DIRECTORY" "ANY" "LDAP" "OKTA"

object (BeforeScheduledActionPolicyRuleCondition)

	object (Duration)
	object (ScheduledUserLifecycleAction)

object (ClientPolicyCondition)

Specifies which clients are included in the Policy

include

Array of strings

Which clients are included in the Policy

object (ContextPolicyRuleCondition)

migrated	boolean
	object (DevicePolicyRuleConditionPlatform)
rooted	boolean
trustLevel	string (DevicePolicyTrustLevel) Enum: "ANY" "TRUSTED"
expression	string

object (DeviceAccessPolicyRuleCondition)

migrated	boolean
	object
rooted	boolean
trustLevel	string Enum: "ANY" "TRUSTED"
	object (DevicePolicyRuleConditionAssurance)
managed	boolean
registered	boolean

object (GrantTypePolicyRuleCondition)

Array of grant types that this condition includes. Determines the mechanism that Okta uses to authorize the creation of the tokens.

include

Array of strings

Array of grant types thagt this condition includes.

object (GroupPolicyRuleCondition)

Specifies a set of Groups whose Users are to be included or excluded

exclude	Array of strings Groups to be excluded
include	Array of strings Groups to be included

object (IdentityProviderPolicyRuleCondition)

idpIds	Array of strings
provider	string (IdentityProviderPolicyProvider) Enum: "ANY" "OKTA" "SPECIFIC_IDP"

object (MDMEnrollmentPolicyRuleCondition)

blockNonSafeAndroid	boolean
enrollment	string (MDMEnrollmentPolicyEnrollment) Enum: "ANY_OR_NONE" "OMM"

object (PolicyNetworkCondition)

connection	string (PolicyNetworkConnection) Network selection mode Enum: "ANYWHERE" "ZONE"
exclude	Array of strings
include	Array of strings

object (PolicyPeopleCondition)

Identifies Users and Groups that are used together

	object (GroupCondition) Specifies a set of Groups whose Users are to be included or excluded
	object (UserCondition) Specifies a set of Users to be included or excluded

object (PlatformPolicyRuleCondition)

	Array of objects (PlatformConditionEvaluatorPlatform)
	Array of objects (PlatformConditionEvaluatorPlatform)

object (RiskPolicyRuleCondition)

behaviors

Array of strings unique

object (RiskScorePolicyRuleCondition)

level

string

object (OAuth2ScopesMediationPolicyRuleCondition)

Array of scopes that the condition includes

include

Array of strings

object (UserIdentifierPolicyRuleCondition)

attribute	string
	Array of objects (UserIdentifierConditionEvaluatorPattern)
type	string (UserIdentifierType) Enum: "ATTRIBUTE" "IDENTIFIER"

object (UserPolicyRuleCondition)

Specifies a set of Users to be included or excluded

exclude	Array of strings Users to be excluded
	object (InactivityPolicyRuleCondition)
include	Array of strings Users to be included
	object (LifecycleExpirationPolicyRuleCondition)
	object (PasswordExpirationPolicyRuleCondition)
	object (UserLifecycleAttributePolicyRuleCondition)

object (UserStatusPolicyRuleCondition)

value

string (PolicyUserStatus)

Enum: "ACTIVATING" "ACTIVE" "DELETED" "DELETING" "EXPIRED_PASSWORD" "INACTIVE" "PENDING" "SUSPENDED"

object (AccessPolicyRuleCustomCondition)

condition

string

object (UserTypeCondition)

exclude	Array of strings
include	Array of strings

Responses

200

Success

400

Bad Request

403

Forbidden

404

Not Found

429

Too Many Requests

put/api/v1/policies/{policyId}/rules/{ruleId}

Request samples

application/json

This password policy permits self-service password change, reset, and unlock. Phone SMS and Okta Verify push are initial authenticators, and the secondary authentication is a security question.

{"id": "ruleId",
"name": "SSPR Rule",
"priority": 1,
"status": "ACTIVE",
"conditions": {"people": {"users": {"exclude": [ ]
}
},
"network": {"connection": "ANYWHERE"
}
},
"actions": {"passwordChange": {"access": "ALLOW"
},
"selfServicePasswordReset": {"access": "ALLOW",
"requirement": {"primary": {"methods": ["push",
"sms"
]
},
"stepUp": {"required": true,
"methods": ["security_question"
]
}
}
},
"selfServiceUnlock": {"access": "ALLOW"
}
},
"system": false,
"type": "PASSWORD"
}

Response samples

200
400
403
404
429

application/json

{"id": "ruleId",
"_links": {"self": {"href": "https://sampleorg.okta.com/api/v1/policies/{policyId}/rules/{ruleId}",
"hints": {"allow": ["GET",
"PUT",
"DELETE"
]
}
},
"deactivate": {"href": "https://sampleorg.okta.com/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate",
"hints": {"allow": ["POST"
]
}
}
},
"name": "SSPR Rule",
"priority": 1,
"status": "ACTIVE",
"conditions": {"people": {"users": {"exclude": [ ]
}
},
"network": {"connection": "ANYWHERE"
}
},
"actions": {"passwordChange": {"access": "ALLOW"
},
"selfServicePasswordReset": {"access": "ALLOW",
"requirement": {"primary": {"methods": ["push",
"sms"
]
},
"stepUp": {"required": true,
"methods": ["security_question"
]
}
}
},
"selfServiceUnlock": {"access": "ALLOW"
}
},
"system": false,
"type": "PASSWORD"
}

Delete a Policy Rule
OAuth 2.0: `okta.policies.manage`

Deletes a Policy Rule identified by policyId and ruleId

Request

path Parameters

policyId required	string `id` of the Policy Example: 00plrilJ7jZ66Gn0X0g3
ruleId required	string `id` of the Policy Rule Example: ruld3hJ7jZh4fn0st0g3

Responses

204

No Content

403

Forbidden

404

Not Found

429

Too Many Requests

delete/api/v1/policies/{policyId}/rules/{ruleId}

Request samples

Response samples

403
404
429

application/json

{"errorCode": "E0000006",
"errorSummary": "You do not have permission to perform the requested action",
"errorLink": "E0000006",
"errorId": "sampleNUSD_8fdkFd8fs8SDBK",
"errorCauses": [ ]
}

Activate a Policy Rule
OAuth 2.0: `okta.policies.manage`

Activates a Policy Rule identified by policyId and ruleId

Request

path Parameters

policyId required	string `id` of the Policy Example: 00plrilJ7jZ66Gn0X0g3
ruleId required	string `id` of the Policy Rule Example: ruld3hJ7jZh4fn0st0g3

Responses

204

No Content

403

Forbidden

404

Not Found

429

Too Many Requests

post/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/activate

Request samples

Response samples

403
404
429

application/json

{"errorCode": "E0000006",
"errorSummary": "You do not have permission to perform the requested action",
"errorLink": "E0000006",
"errorId": "sampleNUSD_8fdkFd8fs8SDBK",
"errorCauses": [ ]
}

Deactivate a Policy Rule
OAuth 2.0: `okta.policies.manage`

Deactivates a Policy Rule identified by policyId and ruleId

Request

path Parameters

policyId required	string `id` of the Policy Example: 00plrilJ7jZ66Gn0X0g3
ruleId required	string `id` of the Policy Rule Example: ruld3hJ7jZh4fn0st0g3

Responses

204

No Content

403

Forbidden

404

Not Found

429

Too Many Requests

post/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate

Request samples

Response samples

403
404
429

application/json

{"errorCode": "E0000006",
"errorSummary": "You do not have permission to perform the requested action",
"errorLink": "E0000006",
"errorId": "sampleNUSD_8fdkFd8fs8SDBK",
"errorCauses": [ ]
}

Policies

List all PoliciesOAuth 2.0: okta.policies.read

query Parameters

Create a PolicyOAuth 2.0: okta.policies.manage

query Parameters

Request Body schema: application/jsonrequired

Create a Policy SimulationIdentity EngineOAuth 2.0: okta.policies.read

query Parameters

Request Body schema: application/jsonrequired

Retrieve a PolicyOAuth 2.0: okta.policies.read

path Parameters

query Parameters

Replace a PolicyOAuth 2.0: okta.policies.manage

path Parameters

Request Body schema: application/jsonrequired

Delete a PolicyOAuth 2.0: okta.policies.manage

path Parameters

List all Applications mapped to a PolicyOAuth 2.0: okta.policies.readDeprecated

path Parameters

Clone an existing PolicyIdentity EngineOAuth 2.0: okta.policies.manage

path Parameters

Activate a PolicyOAuth 2.0: okta.policies.manage

path Parameters

Deactivate a PolicyOAuth 2.0: okta.policies.manage

path Parameters

List all resources mapped to a PolicyOAuth 2.0: okta.policies.read

path Parameters

Map a resource to a PolicyOAuth 2.0: okta.policies.manage

path Parameters

Request Body schema: application/jsonrequired

Retrieve a policy resource MappingOAuth 2.0: okta.policies.read

path Parameters

Delete a policy resource MappingOAuth 2.0: okta.policies.manage

path Parameters

List all Policy RulesOAuth 2.0: okta.policies.read

path Parameters

Create a Policy RuleOAuth 2.0: okta.policies.manage

path Parameters

Request Body schema: application/jsonrequired

Retrieve a Policy RuleOAuth 2.0: okta.policies.read

path Parameters

Replace a Policy RuleOAuth 2.0: okta.policies.manage

path Parameters

Request Body schema: application/jsonrequired

Delete a Policy RuleOAuth 2.0: okta.policies.manage

path Parameters

Activate a Policy RuleOAuth 2.0: okta.policies.manage

path Parameters

Deactivate a Policy RuleOAuth 2.0: okta.policies.manage

path Parameters

List all Policies
OAuth 2.0: `okta.policies.read`

Create a Policy
OAuth 2.0: `okta.policies.manage`

Request Body schema: application/json
required

Create a Policy Simulation
Identity Engine
OAuth 2.0: `okta.policies.read`

Request Body schema: application/json
required

Retrieve a Policy
OAuth 2.0: `okta.policies.read`

Replace a Policy
OAuth 2.0: `okta.policies.manage`

Request Body schema: application/json
required

Delete a Policy
OAuth 2.0: `okta.policies.manage`

List all Applications mapped to a Policy
OAuth 2.0: `okta.policies.read`
Deprecated

Clone an existing Policy
Identity Engine
OAuth 2.0: `okta.policies.manage`

Activate a Policy
OAuth 2.0: `okta.policies.manage`

Deactivate a Policy
OAuth 2.0: `okta.policies.manage`

List all resources mapped to a Policy
OAuth 2.0: `okta.policies.read`

Map a resource to a Policy
OAuth 2.0: `okta.policies.manage`

Request Body schema: application/json
required

Retrieve a policy resource Mapping
OAuth 2.0: `okta.policies.read`

Delete a policy resource Mapping
OAuth 2.0: `okta.policies.manage`

List all Policy Rules
OAuth 2.0: `okta.policies.read`

Create a Policy Rule
OAuth 2.0: `okta.policies.manage`

Request Body schema: application/json
required

Retrieve a Policy Rule
OAuth 2.0: `okta.policies.read`

Replace a Policy Rule
OAuth 2.0: `okta.policies.manage`

Request Body schema: application/json
required

Delete a Policy Rule
OAuth 2.0: `okta.policies.manage`

Activate a Policy Rule
OAuth 2.0: `okta.policies.manage`

Deactivate a Policy Rule
OAuth 2.0: `okta.policies.manage`