Skip to content
Okta Admin Management API
/
Applications
/
/
List all applications tha...

List all applications that match search filters

Request

Early Access
OAuth 2.0 scope:
  • okta.apps.read

Lists apps in the org that match the supplied typed filters.

Query
qstring, >= 2 characters

Case-insensitive substring match on app display name and instance label. Minimum 2 characters; leading/trailing whitespace is trimmed.

Example:q=salesforce
statusArray of strings

A comma-separated list of app statuses. Multiple values are combined using OR logic. Example: status=ACTIVE,INACTIVE.

Example:status=ACTIVE&status=INACTIVE
typesArray of strings

A comma-separated list of app types. Multiple values are combined using OR logic within the fixed type taxonomy. Example: types=SAML,OIDC,UNIVERSAL_LOGOUT.

Example:types=SAML&types=OIDC
labelsArray of strings

List of labels for the app-instance.

Example:labels=HR&labels=IT
afterstring

Specifies the pagination cursor for the next page of results. Treat this as an opaque value obtained through the next link relationship. See Pagination.

Example:after=16275000448691
limitinteger, (int32), [ 1 .. 500 ]

Specifies the number of objects to return per page. If there are multiple pages of results, the Link header contains a next link that you need to use as an opaque value (follow it, don't parse it). See Pagination.

Default:50
GET
/api/v1/apps/search
curl -i -X GET \
  'https://subdomain.okta.com/api/v1/apps/search?q=salesforce&status=ACTIVE%2CINACTIVE&types=SAML%2COIDC&labels=HR%2CIT&after=16275000448691&limit=50'

Responses

Success

Headers
Bodyapplication/json
Array [
accessibilityobject(ApplicationAccessibility)

Specifies access settings for the app

createdstring, (date-time)read-only

Timestamp when the application object was created

expressConfigurationobject(ApplicationExpressConfiguration)read-only
Indicates which Express Configuration capabilities the app supports and has enabled
featuresArray of stringsread-only

Enabled app features

Note: See Application Features for app provisioning features.

Items Enum ValueDescription
GROUP_PUSH

Creates or links an app group based on a group mapping in Okta. Okta is the authoritative source for group memberships; assigned group members are synced to the app

IMPORT_NEW_USERS

Creates or links a user in Okta to a user from the app

IMPORT_PROFILE_UPDATES

Updates a linked user's app profile during manual or scheduled imports

IMPORT_USER_SCHEMA

Discovers the profile schema for a user from the app automatically

PROFILE_MASTERING

Designates the app as the identity lifecycle and profile attribute authority for linked users. The user's profile in Okta is read-only.

PUSH_NEW_USERS

Creates or links a user account in the app when assigning the app to a user in Okta

PUSH_PASSWORD_UPDATES

Updates the user's app password when their password changes in Okta

PUSH_PROFILE_UPDATES

Updates a user's profile in the app when the user's profile changes in Okta (the profile source)

PUSH_USER_DEACTIVATION

Deactivates a user's account in the app when unassigned from the app in Okta or deactivated

REACTIVATE_USERS

Reactivates an existing inactive user when provisioning a user to the app

OUTBOUND_DEL_AUTH

Okta user authentication requests are delegated to a third-party app

DESKTOP_SSO

Okta user authentication requests are handled by desktop SSO negotiation (if possible)

FEDERATED_PROFILE

App user profiles are synchronized at sign-in and profile-view instances instead of during bulk imports

SUPPRESS_ACTIVATION_EMAIL

Activation emails aren't sent to users sourced by AD and orgs with DelAuth enabled

PUSH_PENDING_USERS

Users are in PENDING state in Okta and are created but not active in the sourced app user

MFA

App can verify credentials as a second factor

UPDATE_EXISTING_USERNAME

App can update the user name for existing users

EXCLUDE_USERNAME_UPDATE_ON_PROFILE_PUSH

Exclude username update during profile push

EXCHANGE_ACTIVE_SYNC

App supports synchronizing credentials with OMM enrolled devices

IMPORT_SYNC

Synchronize import events

IMPORT_SYNC_CONTACTS

Synchronize contacts

DEVICE_COMPLIANCE

Apps support device compliance rules

VPN_CONFIG

App supports pushing VPN configuration to OMM enrolled devices

IMPORT_SCHEMA_ENUM_VALUES

Creates or links an app group based on a group mapping in Okta. Okta is the authoritative source for group memberships; assigned group members are synced to the app

SCIM_PROVISIONING

App supports SCIM provisioning and can push custom attributes to a third-party app

DEVICE_FILTER_IN_SIGN_ON_RULES

App supports filtering by client type in app sign-on rules

PROFILE_TEMPLATE_UPGRADE

App supports profile template upgrades. This is primarily to help roll out the profile template upgrade feature for individual apps

DEFAULT_PUSH_STATUS_TO_PUSH

App defaults Push status to PUSH. This feature is for apps, such as SharePoint, that want to receive App User profile updates even though they didn't implement traditional PUSH_PROFILE_UPDATES in the client API.

REAL_TIME_SYNC

Apps support real-time synchronization

SSO

Apps support establishing a subject based on claims from an IdP

AUTHN_CONTEXT

Apps support establishing an authentication context based on claims from an IdP

JIT_PROVISIONING

Apps support provisioning a user based on claims from an IdP

GROUP_SYNC

Apps support syncing group information based on claims from an IdP

OPP_SCIM_INCREMENTAL_IMPORTS

Apps support incremental imports. Used for SCIM app instances

IN_MEMORY_APP_USER

Apps support in-memory app users. This feature is used as an alternative to Implicit App Assignment for a non-persisted app user.

LOG_STREAMING

Apps support log streaming

OAUTH_INTEGRATION

App is an OAuth 2.0 integration

IDP

Apps support IdP functionalities

PUSH_NEW_USERS_WITHOUT_PASSWORD

Don't send generated password for new users

SKYHOOK_SERVICE

Use the Skyhook microservice for LCM operations

ENTITLEMENT_MANAGEMENT

Marker to showcase which OIN apps are entitlement enabled

PUSH_NEW_USERS_WITH_HASHED_PASSWORD

Send hashed password for new users. This feature is only used for CIS to CIC migration.

idstringread-only

Unique ID for the app instance

labelstring(ApplicationLabel)required

User-defined display name for app

lastUpdatedstring, (date-time)read-only

Timestamp when the application object was last updated

licensingobject(ApplicationLicensing)

Licenses for the app

ornstringread-only

The Okta resource name (ORN) for the current app instance

profileobject

Contains any valid JSON schema for specifying properties that can be referenced from a request (only available to OAuth 2.0 client apps). For example, add an app manager contact email address or define an allowlist of groups that you can then reference using the Okta Expression Language getFilteredGroups function.

Notes:

  • profile isn't encrypted, so don't store sensitive data in it.
  • profile doesn't limit the level of nesting in the JSON schema you created, but there is a practical size limit. Okta recommends a JSON schema size of 1 MB or less for best performance.
signOnModestring(ApplicationSignOnMode)required

Authentication mode for the app

signOnModeDescription
AUTO_LOGINSecure Web Authentication (SWA)
BASIC_AUTHHTTP Basic Authentication with Okta Browser Plugin
BOOKMARKJust a bookmark (no-authentication)
BROWSER_PLUGINSecure Web Authentication (SWA) with Okta Browser Plugin
OPENID_CONNECTFederated Authentication with OpenID Connect (OIDC)
SAML_1_1Federated Authentication with SAML 1.1 WebSSO (not supported for custom apps)
SAML_2_0Federated Authentication with SAML 2.0 WebSSO
SECURE_PASSWORD_STORESecure Web Authentication (SWA) with POST (plugin not required)
WS_FEDERATIONFederated Authentication with WS-Federation Passive Requestor Profile

Select the signOnMode for your custom app:

Enum:"AUTO_LOGIN""BASIC_AUTH""BOOKMARK""BROWSER_PLUGIN""OPENID_CONNECT""SAML_1_1""SAML_2_0""SECURE_PASSWORD_STORE""WS_FEDERATION"
statusstring(ApplicationLifecycleStatus)read-only

App instance status

Enum:"ACTIVE""DELETED""INACTIVE"
typesArray of stringsread-only

App type categorization tags used by the Apps list page facets. Values align with the /apps/types taxonomy (for example, SAML, OIDC, PROVISIONING, UNIVERSAL_LOGOUT). Multi-valued because an app can belong to several buckets.

universalLogoutobject(ApplicationUniversalLogout)read-only
Universal Logout properties for the app. These properties are only returned and can't be updated.
Example:"ACTIVE"
visibilityobject(ApplicationVisibility)

Specifies visibility settings for the app

_embeddedobjectread-only

Embedded resources related to the app using the JSON Hypertext Application Language specification. If the expand=user/{userId} query parameter is specified, then the assigned Application User is embedded.

]
Response
[
  {
    "id": "0oa11qqppWT4SSHNp0g5",
    "orn": "orn:okta:idp:00o12xmdseDodgJDT0g4:apps:okta_flow_sso:0oa11qqppWT4SSHNp0g5",
    "label": "Okta Workflows",
    "status": "ACTIVE",
    "lastUpdated": "2026-06-24T07:44:42.000Z",
    "created": "2026-06-24T07:44:42.000Z",
    "authenticationPipeline": "ORG_DEFAULT",
    "accessibility": { … },
    "visibility": { … },
    "features": [],
    "signOnMode": "OPENID_CONNECT",
    "types": [ … ],
    "universalLogout": null,
    "licensing": { … },
    "profile": {},
    "_links": { … }
  },
  {
    "id": "0oa47qw4QJL1xMNcC0g4",
    "orn": "orn:okta:idp:00o12xmdseDodgJDT0g4:apps:template_saml_2_0:0oa47qw4QJL1xMNcC0g4",
    "label": "My SAML App",
    "status": "ACTIVE",
    "lastUpdated": "2026-05-12T09:04:33.000Z",
    "created": "2026-04-22T10:07:25.000Z",
    "authenticationPipeline": "ORG_DEFAULT",
    "accessibility": { … },
    "visibility": { … },
    "features": [ … ],
    "signOnMode": "SAML_2_0",
    "types": [ … ],
    "universalLogout": { … },
    "licensing": { … },
    "profile": {},
    "_links": { … }
  },
  {
    "id": "0oa3ck4vIANix4RD90g4",
    "orn": "orn:okta:idp:00o12xmdseDodgJDT0g4:apps:oidc_client:0oa3ck4vIANix4RD90g4",
    "label": "ApiServiceApp",
    "status": "ACTIVE",
    "lastUpdated": "2026-06-11T06:59:46.000Z",
    "created": "2026-04-20T15:49:56.000Z",
    "authenticationPipeline": "ORG_DEFAULT",
    "accessibility": { … },
    "visibility": { … },
    "features": [],
    "signOnMode": "OPENID_CONNECT",
    "types": [ … ],
    "universalLogout": null,
    "licensing": { … },
    "profile": {},
    "expressConfiguration": { … },
    "_links": { … }
  }
]