User Authenticator Enrollments

The Authenticator Enrollments API provides operations for admins to manage the authenticator enrollments of their users.

An authenticator enrollment is the specific instance of an authenticator that a user has enrolled. For example, if a user enrolls an sms method with a phone number, they can use both sms and voice methods. The Authenticator Enrollments API allows admins to manage both of those user enrollments.

Note: You can currently only enroll Phone authenticators with this API.

List all authenticator enrollments
Early AccessIdentity Engine
OAuth 2.0 scopes:
  • okta.users.read

Lists all authenticator enrollments of the specified user

Request
path Parameters
userId
required
string

ID of an existing Okta user

Example: 00ub0oNGTSWTBKOLGLNR
Responses
200

Success

403

Forbidden

404

Not Found

429

Too Many Requests

get/api/v1/users/{userId}/authenticator-enrollments
Request samples 
Response samples 
application/json
[]
Create an auto-activated Phone authenticator enrollment
Early AccessIdentity Engine
OAuth 2.0 scopes: 
  • okta.users.manage
Creates a Phone authenticator enrollment that's automatically activated


Request 
path Parameters
userId
required
string
ID of an existing Okta user


 
 Example:  00ub0oNGTSWTBKOLGLNR
Request Body schema: application/json
required
authenticatorId
required
string
Unique identifier of the phone authenticator


 
required
object (AuthenticatorProfile) 
Defines the authenticator specific parameters


 
phoneNumber
required
string
The phone number for a call or sms authenticator enrollment.


 
Responses 
200
Success


400
Bad Request


403
Forbidden


429
Too Many Requests


post/api/v1/users/{userId}/authenticator-enrollments/phone
Request samples 
application/json
{
  • "authenticatorId": "aut5l4ttFyGEWdy6V0k7",
  • "profile": {
    • "phoneNumber": "+14086673418"
    }
}
Response samples 
application/json
{}
Retrieve an authenticator enrollment
Early AccessIdentity Engine
OAuth 2.0 scopes: 
  • okta.users.read
Retrieves a user's authenticator enrollment by enrollmentId


Request 
path Parameters
userId
required
string
ID of an existing Okta user


 
 Example:  00ub0oNGTSWTBKOLGLNR
enrollmentId
required
string
Unique identifier of an enrollment


 
 Example:  sms8lqwuzSpWT4kVs0g4
Responses 
200
Success


403
Forbidden


404
Not Found


429
Too Many Requests


get/api/v1/users/{userId}/authenticator-enrollments/{enrollmentId}
Request samples 
Response samples 
application/json
{}
Delete an authenticator enrollment
Early AccessIdentity Engine
OAuth 2.0 scopes: 
  • okta.users.manage
Deletes an existing enrollment for the specified user. The user can enroll the authenticator again.


Request 
path Parameters
userId
required
string
ID of an existing Okta user


 
 Example:  00ub0oNGTSWTBKOLGLNR
enrollmentId
required
string
Unique identifier of an enrollment


 
 Example:  sms8lqwuzSpWT4kVs0g4
Responses 
204
No Content


403
Forbidden


404
Not Found


429
Too Many Requests


delete/api/v1/users/{userId}/authenticator-enrollments/{enrollmentId}
Request samples 
Response samples 
application/json
{
  • "errorCode": "E0000006",
  • "errorSummary": "You do not have permission to perform the requested action",
  • "errorLink": "E0000006",
  • "errorId": "sampleNUSD_8fdkFd8fs8SDBK",
  • "errorCauses": [ ]
}