Trusted Origins

The Trusted Origins API provides operations to manage Trusted Origins and sources.

When external URLs are requested during sign-in, sign-out, or recovery operations, Okta checks those URLs against the allowed list of Trusted Origins. Trusted Origins also enable browser-based applications to access Okta APIs from JavaScript (CORS). If the origins aren't specified, the related operation (redirect or Okta API access) isn't permitted.

You can also configure Trusted Origins to allow iFrame embedding of Okta resources, such as Okta sign-in pages and the Okta End-User Dashboard, within that origin.

Notes:

This feature is supported for Okta domains only. It isn't currently supported for custom domains.

Some of the curl code examples on this page include SSWS API token authentication. However, Okta recommends using scoped OAuth 2.0 and OIDC access tokens to authenticate with Okta management APIs. OAuth 2.0 and OIDC access tokens provide fine-grain control over the bearer's actions on specific endpoints. See Okta API authentication methods.

List all trusted origins
OAuth 2.0:
okta.trustedOrigins.read

Lists all trusted origins

Request

query Parameters

q	string A search string that prefix matches against the `name` and `origin`
filter	string Filter trusted origins with a supported expression for a subset of properties. You can filter on the following properties: `name`, `origin`, `status`, and `type` (type of scopes). Examples: By name filter=name eq "Example trusted origin"
after	string After cursor provided by a prior request
limit	integer <int32> <= 200 Default: 20 Specifies the number of results

Responses

200

Success

403

Forbidden

429

Too Many Requests

get/api/v1/trustedOrigins

Request samples

Response samples

200
403
429

application/json

[{"id": "tos10hu7rkbtrFt1M0g4",
"name": "New trusted origin",
"origin": "http://example.com",
"status": "ACTIVE",
"scopes": [{"type": "CORS"
},
{"type": "REDIRECT"
}
],
"created": "2018-01-13T01:11:44.000Z",
"createdBy": "00ut5t92p6IEOi4bu0g3",
"lastedUpdated": "2018-01-13T01:11:44.000Z",
"lastedUpdatedBy": "00ut5t92p6IEOi4bu0g3",
"_links": {"self": {"href": "https://{yourOktaDomain}/api/v1/trustedOrigins/tos10hu7rkbtrFt1M0g4",
"hints": {"allow": ["GET",
"PUT",
"DELETE"
]
}
},
"deactivate": {"href": "https://{yourOktaDomain}/api/v1/trustedOrigins/tos10hu7rkbtrFt1M0g4/lifecycle/deactivate",
"hints": {"allow": ["POST"
]
}
}
}
}
]

Create a trusted origin
OAuth 2.0:
okta.trustedOrigins.manage

Creates a trusted origin

Request

Request Body schema: application/json
required

name

string (TrustedOriginName) <= 255

Unique name for the trusted origin

origin

string (TrustedOriginOrigin) <= 255

Unique origin URL for the trusted origin. The supported schemes for this attribute are HTTP, HTTPS, FTP, Ionic 2, and Capacitor.

Array of objects (TrustedOriginScopes) <= 3

Array of scope types that this trusted origin is used for

Array

allowedOktaApps

Array of strings (IframeEmbedScopeAllowedApps)

The allowed Okta apps for the trusted origin scope

Items Value: "OKTA_ENDUSER"

type

string (TrustedOriginScopeType)

The scope type. Supported values: When you use IFRAME_EMBED as the scope type, leave the allowedOktaApps property empty to allow iFrame embedding of only Okta sign-in pages. Include OKTA_ENDUSER as a value for the allowedOktaApps property to allow iFrame embedding of both Okta sign-in pages and the Okta End-User Dashboard.

Enum: "CORS" "IFRAME_EMBED" "REDIRECT"

Responses

200

Success

400

Bad Request

403

Forbidden

429

Too Many Requests

post/api/v1/trustedOrigins

Request samples

application/json

{"name": "New trusted origin",
"origin": "http://example.com",
"scopes": [{"type": "CORS"
},
{"type": "REDIRECT"
}
]
}

Response samples

200
400
403
429

application/json

{"id": "tos10hu7rkbtrFt1M0g4",
"name": "New trusted origin",
"origin": "http://example.com",
"status": "ACTIVE",
"scopes": [{"type": "CORS"
},
{"type": "REDIRECT"
}
],
"created": "2018-01-13T01:11:44.000Z",
"createdBy": "00ut5t92p6IEOi4bu0g3",
"lastedUpdated": "2018-01-13T01:11:44.000Z",
"lastedUpdatedBy": "00ut5t92p6IEOi4bu0g3",
"_links": {"self": {"href": "https://{yourOktaDomain}/api/v1/trustedOrigins/tos10hu7rkbtrFt1M0g4",
"hints": {"allow": ["GET",
"PUT",
"DELETE"
]
}
},
"deactivate": {"href": "https://{yourOktaDomain}/api/v1/trustedOrigins/tos10hu7rkbtrFt1M0g4/lifecycle/deactivate",
"hints": {"allow": ["POST"
]
}
}
}
}

Retrieve a trusted origin
OAuth 2.0:
okta.trustedOrigins.read

Retrieves a trusted origin

Request

path Parameters

trustedOriginId

required

string

id of the trusted origin

Example: 7j2PkU1nyNIDe26ZNufR

Responses

200

Success

403

Forbidden

404

Not Found

429

Too Many Requests

get/api/v1/trustedOrigins/{trustedOriginId}

Request samples

Response samples

200
403
404
429

application/json

{"id": "tos10hu7rkbtrFt1M0g4",
"name": "New trusted origin",
"origin": "http://example.com",
"status": "ACTIVE",
"scopes": [{"type": "CORS"
},
{"type": "REDIRECT"
}
],
"created": "2018-01-13T01:11:44.000Z",
"createdBy": "00ut5t92p6IEOi4bu0g3",
"lastedUpdated": "2018-01-13T01:11:44.000Z",
"lastedUpdatedBy": "00ut5t92p6IEOi4bu0g3",
"_links": {"self": {"href": "https://{yourOktaDomain}/api/v1/trustedOrigins/tos10hu7rkbtrFt1M0g4",
"hints": {"allow": ["GET",
"PUT",
"DELETE"
]
}
},
"deactivate": {"href": "https://{yourOktaDomain}/api/v1/trustedOrigins/tos10hu7rkbtrFt1M0g4/lifecycle/deactivate",
"hints": {"allow": ["POST"
]
}
}
}
}

Replace a trusted origin
OAuth 2.0:
okta.trustedOrigins.manage

Replaces a trusted origin

Request

path Parameters

trustedOriginId

required

string

id of the trusted origin

Example: 7j2PkU1nyNIDe26ZNufR

Request Body schema: application/json
required

createdBy

string

The ID of the user who created the trusted origin

lastUpdatedBy

string

The ID of the user who last updated the trusted origin

name

string (TrustedOriginName) <= 255

Unique name for the trusted origin

origin

string (TrustedOriginOrigin) <= 255

Unique origin URL for the trusted origin. The supported schemes for this attribute are HTTP, HTTPS, FTP, Ionic 2, and Capacitor.

Array of objects (TrustedOriginScopes) <= 3

Array of scope types that this trusted origin is used for

Array

allowedOktaApps

Array of strings (IframeEmbedScopeAllowedApps)

The allowed Okta apps for the trusted origin scope

Items Value: "OKTA_ENDUSER"

type

string (TrustedOriginScopeType)

The scope type. Supported values: When you use IFRAME_EMBED as the scope type, leave the allowedOktaApps property empty to allow iFrame embedding of only Okta sign-in pages. Include OKTA_ENDUSER as a value for the allowedOktaApps property to allow iFrame embedding of both Okta sign-in pages and the Okta End-User Dashboard.

Enum: "CORS" "IFRAME_EMBED" "REDIRECT"

status

string (LifecycleStatus)

Enum: "ACTIVE" "INACTIVE"

Responses

200

Success

400

Bad Request

403

Forbidden

404

Not Found

429

Too Many Requests

put/api/v1/trustedOrigins/{trustedOriginId}

Request samples

application/json

{"value": {"id": "tosue7JvguwJ7U6kz0g3",
"name": "Updated Example trusted origin",
"origin": "http://updated.example.com",
"scopes": [{"type": "CORS"
},
{"type": "REDIRECT"
}
],
"status": "ACTIVE",
"created": "2017-12-16T05:01:12.000Z",
"createdBy": "00ut5t92p6IEOi4bu0g3",
"lastUpdated": "2017-12-16T05:01:12.000Z",
"lastUpdatedBy": "00ut5t92p6IEOi4bu0g3",
"_links": {"self": {"href": "https://${yourOktaDomain}/api/v1/trustedOrigins/tosue7JvguwJ7U6kz0g3",
"hints": {"allow": ["GET",
"PUT",
"DELETE"
]
}
},
"deactivate": {"href": "https://${yourOktaDomain}/api/v1/trustedOrigins/tosue7JvguwJ7U6kz0g3/lifecycle/deactivate",
"hints": {"allow": ["POST"
]
}
}
}
}
}

Response samples

200
400
403
404
429

application/json

{"value": {"id": "tosue7JvguwJ7U6kz0g3",
"name": "Updated Example trusted origin",
"origin": "http://updated.example.com",
"scopes": [{"type": "CORS"
},
{"type": "REDIRECT"
}
],
"status": "ACTIVE",
"created": "2017-12-16T05:01:12.000Z",
"createdBy": "00ut5t92p6IEOi4bu0g3",
"lastUpdated": "2017-12-16T05:01:12.000Z",
"lastUpdatedBy": "00ut5t92p6IEOi4bu0g3",
"_links": {"self": {"href": "https://${yourOktaDomain}/api/v1/trustedOrigins/tosue7JvguwJ7U6kz0g3",
"hints": {"allow": ["GET",
"PUT",
"DELETE"
]
}
},
"deactivate": {"href": "https://${yourOktaDomain}/api/v1/trustedOrigins/tosue7JvguwJ7U6kz0g3/lifecycle/deactivate",
"hints": {"allow": ["POST"
]
}
}
}
}
}

Delete a trusted origin
OAuth 2.0:
okta.trustedOrigins.manage

Deletes a trusted origin

Request

path Parameters

trustedOriginId

required

string

id of the trusted origin

Example: 7j2PkU1nyNIDe26ZNufR

Responses

204

Success

403

Forbidden

404

Not Found

429

Too Many Requests

delete/api/v1/trustedOrigins/{trustedOriginId}

Request samples

Response samples

403
404
429

application/json

{"errorCode": "E0000006",
"errorSummary": "You do not have permission to perform the requested action",
"errorLink": "E0000006",
"errorId": "sampleNUSD_8fdkFd8fs8SDBK",
"errorCauses": [ ]
}

Activate a trusted origin
OAuth 2.0:
okta.trustedOrigins.manage

Activates a trusted origin. Sets the status to ACTIVE.

Request

path Parameters

trustedOriginId

required

string

id of the trusted origin

Example: 7j2PkU1nyNIDe26ZNufR

Responses

200

Success

403

Forbidden

404

Not Found

429

Too Many Requests

post/api/v1/trustedOrigins/{trustedOriginId}/lifecycle/activate

Request samples

Response samples

200
403
404
429

application/json

{"id": "tos10hu7rkbtrFt1M0g4",
"name": "New trusted origin",
"origin": "http://example.com",
"status": "ACTIVE",
"scopes": [{"type": "CORS"
},
{"type": "REDIRECT"
}
],
"created": "2018-01-13T01:11:44.000Z",
"createdBy": "00ut5t92p6IEOi4bu0g3",
"lastedUpdated": "2018-01-13T01:11:44.000Z",
"lastedUpdatedBy": "00ut5t92p6IEOi4bu0g3",
"_links": {"self": {"href": "https://{yourOktaDomain}/api/v1/trustedOrigins/tos10hu7rkbtrFt1M0g4",
"hints": {"allow": ["GET",
"PUT",
"DELETE"
]
}
},
"deactivate": {"href": "https://{yourOktaDomain}/api/v1/trustedOrigins/tos10hu7rkbtrFt1M0g4/lifecycle/deactivate",
"hints": {"allow": ["POST"
]
}
}
}
}

Deactivate a trusted origin
OAuth 2.0:
okta.trustedOrigins.manage

Deactivates a trusted origin. Sets the status to INACTIVE.

Request

path Parameters

trustedOriginId

required

string

id of the trusted origin

Example: 7j2PkU1nyNIDe26ZNufR

Responses

200

Success

403

Forbidden

404

Not Found

429

Too Many Requests

post/api/v1/trustedOrigins/{trustedOriginId}/lifecycle/deactivate

Request samples

Response samples

200
403
404
429

application/json

{"id": "tos10hu7rkbtrFt1M0g4",
"name": "New trusted origin",
"origin": "http://example.com",
"status": "INACTIVE",
"scopes": [{"type": "CORS"
},
{"type": "REDIRECT"
}
],
"created": "2018-01-13T01:11:44.000Z",
"createdBy": "00ut5t92p6IEOi4bu0g3",
"lastedUpdated": "2018-01-13T01:11:44.000Z",
"lastedUpdatedBy": "00ut5t92p6IEOi4bu0g3",
"_links": {"activate": {"href": "https://{yourOktaDomain}/api/v1/trustedOrigins/tos10hu7rkbtrFt1M0g4/lifecycle/activate",
"hints": {"allow": ["POST"
]
}
},
"self": {"href": "https://{yourOktaDomain}/api/v1/trustedOrigins/tos10hu7rkbtrFt1M0g4",
"hints": {"allow": ["GET",
"PUT",
"DELETE"
]
}
}
}
}

Trusted Origins

List all trusted originsOAuth 2.0: okta.trustedOrigins.read

query Parameters

Create a trusted originOAuth 2.0: okta.trustedOrigins.manage

Request Body schema: application/jsonrequired

Retrieve a trusted originOAuth 2.0: okta.trustedOrigins.read

path Parameters

Replace a trusted originOAuth 2.0: okta.trustedOrigins.manage

path Parameters

Request Body schema: application/jsonrequired

Delete a trusted originOAuth 2.0: okta.trustedOrigins.manage

path Parameters

Activate a trusted originOAuth 2.0: okta.trustedOrigins.manage

path Parameters

Deactivate a trusted originOAuth 2.0: okta.trustedOrigins.manage

path Parameters

List all trusted origins
OAuth 2.0:
okta.trustedOrigins.read

Create a trusted origin
OAuth 2.0:
okta.trustedOrigins.manage

Request Body schema: application/json
required

Retrieve a trusted origin
OAuth 2.0:
okta.trustedOrigins.read

Replace a trusted origin
OAuth 2.0:
okta.trustedOrigins.manage

Request Body schema: application/json
required

Delete a trusted origin
OAuth 2.0:
okta.trustedOrigins.manage

Activate a trusted origin
OAuth 2.0:
okta.trustedOrigins.manage

Deactivate a trusted origin
OAuth 2.0:
okta.trustedOrigins.manage