# API **URL:** https://devforum.okta.com/c/questions/api/22.md [Latest](https://devforum.okta.com/latest.md) · [Categories](https://devforum.okta.com/categories.md) · [Tags](https://devforum.okta.com/tags.md) --- ## [Fetch app \*external\* metadata url through API](https://devforum.okta.com/t/fetch-app-external-metadata-url-through-api/35468)
**Author:** [@richard.barnett](https://devforum.okta.com/u/richard.barnett)\ **Replies:** 4\ **Last updated:** [October 13, 2026, 9:49pm UTC](https://devforum.okta.com/t/fetch-app-external-metadata-url-through-api/35468 "2026-10-13T21:49:14Z")
I have an Auth0 tenant with a number of connections created using Okta app metadata urls of the form https://XXXX.oktapreview.com/app/exkXXXX/sso/saml/metadata I want to work out which Okta apps these correspond to. I c… --- ## [E0000011 Invalid token provided - Integrator Free Plan org (SSWS)](https://devforum.okta.com/t/e0000011-invalid-token-provided-integrator-free-plan-org-ssws/35479)
**Author:** [@Geeth](https://devforum.okta.com/u/Geeth)\ **Replies:** 1\ **Last updated:** [September 30, 2026, 8:28am UTC](https://devforum.okta.com/t/e0000011-invalid-token-provided-integrator-free-plan-org-ssws/35479 "2026-09-30T08:28:22Z")
This looks like the same defect from : If it is, Please apply the API token fix. Org: https://ust-integrator-1970529.okta.com Plan: Integrator Free Plan Admin Console: works. Token: Active. Origin: Any IP. Creator:… --- ## [Can OPA(Okta Provisioning Agent) reach a custom app's REST API without opening inbound ports?](https://devforum.okta.com/t/can-opa-okta-provisioning-agent-reach-a-custom-apps-rest-api-without-opening-inbound-ports/35467)
**Author:** [@artois](https://devforum.okta.com/u/artois)\ **Replies:** 1\ **Last updated:** [September 22, 2026, 11:09am UTC](https://devforum.okta.com/t/can-opa-okta-provisioning-agent-reach-a-custom-apps-rest-api-without-opening-inbound-ports/35467 "2026-09-22T11:09:32Z")
Hi all, We need to provision users to an on-prem app that only exposes a custom REST API (no SCIM support), and we can’t open any inbound firewall ports . Can OPA call that REST API directly, or does it always need a S… --- ## [Possible issue with SystemLogApi.ListLogEvents() in Okta.Sdk 10.0.3](https://devforum.okta.com/t/possible-issue-with-systemlogapi-listlogevents-in-okta-sdk-10-0-3/35404)
**Author:** [@yhijazi1](https://devforum.okta.com/u/yhijazi1)\ **Replies:** 3\ **Last updated:** [August 11, 2026, 12:12pm UTC](https://devforum.okta.com/t/possible-issue-with-systemlogapi-listlogevents-in-okta-sdk-10-0-3/35404 "2026-08-11T12:12:13Z")
Hello, I’m using Okta.Sdk 10.0.3 with OAuth 2.0 (private\_key\_jwt). Authentication is successful: UserApi.ListUsers() works. Calling GET /api/v1/logs via the REST API with the same access token works. However, when u… --- ## [E0000011 Invalid token provided on new Integrator Free Plan org](https://devforum.okta.com/t/e0000011-invalid-token-provided-on-new-integrator-free-plan-org/35417)
**Author:** [@ayu9996](https://devforum.okta.com/u/ayu9996)\ **Replies:** 3\ **Last updated:** [August 10, 2026, 4:26pm UTC](https://devforum.okta.com/t/e0000011-invalid-token-provided-on-new-integrator-free-plan-org/35417 "2026-08-10T16:26:14Z")
Newly created Integrator Free Plan org. API tokens return 401 E0000011 “Invalid token provided” immediately after creation. Reproducible with plain curl, so not an SDK issue. Admin console works normally Token shows as… --- ## [Creating Network Zone with 'INACTIVE' status always results in 'ACTIVE'](https://devforum.okta.com/t/creating-network-zone-with-inactive-status-always-results-in-active/35405)
**Author:** [@devave](https://devforum.okta.com/u/devave)\ **Replies:** 1\ **Last updated:** [August 4, 2026, 7:20am UTC](https://devforum.okta.com/t/creating-network-zone-with-inactive-status-always-results-in-active/35405 "2026-08-04T07:20:53Z")
When using the Okta REST API to create a network zone, the status field in the request body is ignored. Regardless of the value provided (e.g., setting "status": "INACTIVE"), the resulting zone is always created with a s… --- ## [Okta groups fetching api](https://devforum.okta.com/t/okta-groups-fetching-api/35237)
**Author:** [@prashanth-s](https://devforum.okta.com/u/prashanth-s)\ **Replies:** 7\ **Last updated:** [May 26, 2026, 9:22pm UTC](https://devforum.okta.com/t/okta-groups-fetching-api/35237 "2026-05-26T21:22:10Z")
just want to understand more on /api/v1/users/me/groups okta endpoint. here me is the current authenticated user I believe and has the access token and the app has okta.groups.read scope grant given. but when the above … --- ## [Possible bug: AuthorizationException](https://devforum.okta.com/t/possible-bug-authorizationexception/35272)
**Author:** [@Stephan](https://devforum.okta.com/u/Stephan)\ **Replies:** 2\ **Last updated:** [May 26, 2026, 10:42am UTC](https://devforum.okta.com/t/possible-bug-authorizationexception/35272 "2026-05-26T10:42:38Z")
We have an issue with the AuthorisationException for token refresh: in our view, it is thrown too quickly, for example even in the case of connection problems or 500 server errors. Our apps have always responded to an Au… --- ## [Okta resource type "exk"](https://devforum.okta.com/t/okta-resource-type-exk/35271)
**Author:** [@rhornsby](https://devforum.okta.com/u/rhornsby)\ **Replies:** 3\ **Last updated:** [May 15, 2026, 11:10pm UTC](https://devforum.okta.com/t/okta-resource-type-exk/35271 "2026-05-15T23:10:42Z")
related to Utility flow to look up type of resource id's Appreciate the information in that post from @christianjm. Confirms the pattern of ids I’ve been seeing. We came across an id that starts with “exk” but that’s n… --- ## [For the /api/v1/users endpoint response, why are profile.firstName and profile.lastName documented as being nullable?](https://devforum.okta.com/t/for-the-api-v1-users-endpoint-response-why-are-profile-firstname-and-profile-lastname-documented-as-being-nullable/35219)
**Author:** [@jenip](https://devforum.okta.com/u/jenip)\ **Replies:** 1\ **Last updated:** [April 13, 2026, 2:55am UTC](https://devforum.okta.com/t/for-the-api-v1-users-endpoint-response-why-are-profile-firstname-and-profile-lastname-documented-as-being-nullable/35219 "2026-04-13T02:55:08Z")
When adding a user, the following fields cannot be left blank : However, as shown in List all users , profile.​firstName and profile.​lastName are documented as being nullable. Thus, why are profile.​firstName and p… --- ## [Unable to get LOCKED\_OUT status from /api/v1/authn endpoint even after enabling the "Show lock out failures" setting](https://devforum.okta.com/t/unable-to-get-locked-out-status-from-api-v1-authn-endpoint-even-after-enabling-the-show-lock-out-failures-setting/35193)
**Author:** [@jenip](https://devforum.okta.com/u/jenip)\ **Replies:** 1\ **Last updated:** [April 2, 2026, 3:18am UTC](https://devforum.okta.com/t/unable-to-get-locked-out-status-from-api-v1-authn-endpoint-even-after-enabling-the-show-lock-out-failures-setting/35193 "2026-04-02T03:18:59Z")
According to Authentication | Okta Developer , if the password policy is configured to hide lockout failures, a 401 Unauthorized error is returned. This is the default behaviour because Okta configures password policies … --- ## [API support for Factor Enrollment Nicknames?](https://devforum.okta.com/t/api-support-for-factor-enrollment-nicknames/35159)
**Author:** [@elibon](https://devforum.okta.com/u/elibon)\ **Replies:** 2\ **Last updated:** [March 19, 2026, 5:40pm UTC](https://devforum.okta.com/t/api-support-for-factor-enrollment-nicknames/35159 "2026-03-19T17:40:10Z")
Enabling the “Includes factor enrollment nickname in SIW” feature allows end-users to set a nickname for some of their factors in the Okta web-ui. However, it seems like there is no support for this value in the User Fa… --- ## ["Invalid token provided" with API token calls](https://devforum.okta.com/t/invalid-token-provided-with-api-token-calls/34651)
**Author:** [@aray73](https://devforum.okta.com/u/aray73)\ **Replies:** 55\ **Last updated:** [March 13, 2026, 4:40pm UTC](https://devforum.okta.com/t/invalid-token-provided-with-api-token-calls/34651 "2026-03-13T16:40:36Z")
Hi, Environment: two trial okta spaces, both have similar configurations. Both used by the same way, including access by api calls with okta api-token. Problem: since dec-03 one trial okta got issue with API calls - er… --- ## [Why for external OIDC Identity Provider configured in Okta gives idp type as "SOCIAL" in api/v1/sessions/me api?](https://devforum.okta.com/t/why-for-external-oidc-identity-provider-configured-in-okta-gives-idp-type-as-social-in-api-v1-sessions-me-api/35061)
**Author:** [@spring](https://devforum.okta.com/u/spring)\ **Replies:** 1\ **Last updated:** [February 19, 2026, 4:15am UTC](https://devforum.okta.com/t/why-for-external-oidc-identity-provider-configured-in-okta-gives-idp-type-as-social-in-api-v1-sessions-me-api/35061 "2026-02-19T04:15:08Z")
api/v1/sessions/me shows, idp type as “SOCIAL” when authenticated with a custom built external OIDC Authorization server configured as an IDP in Okta tenant. It is not any social idp like Google, Microsoft or Facebook. … --- ## [Api/vi/authn giving 401 on API side but works on UI for trial-\*.okta.com endpoint](https://devforum.okta.com/t/api-vi-authn-giving-401-on-api-side-but-works-on-ui-for-trial-okta-com-endpoint/34658)
**Author:** [@shardulb](https://devforum.okta.com/u/shardulb)\ **Replies:** 7\ **Last updated:** [January 13, 2026, 4:30pm UTC](https://devforum.okta.com/t/api-vi-authn-giving-401-on-api-side-but-works-on-ui-for-trial-okta-com-endpoint/34658 "2026-01-13T16:30:12Z")
I have a https://trial-\*.okta.com account curently in use. Something has changed last week, and any curl commands to https://trial-\*.okta.com/api/v1/authn are giving me 401 Authentication Error. The exact same user cre… --- ## [API Token E0000011 error in integration plan](https://devforum.okta.com/t/api-token-e0000011-error-in-integration-plan/34640)
**Author:** [@davidegranata](https://devforum.okta.com/u/davidegranata)\ **Replies:** 4\ **Last updated:** [January 10, 2026, 12:41am UTC](https://devforum.okta.com/t/api-token-e0000011-error-in-integration-plan/34640 "2026-01-10T00:41:38Z")
Hi everyone, from november 26th we are unable to use api tokens on our developer integration tenant. We always receive E0000011 Invalid Token provided error. The token is active and the user that created the token is a… --- ## [API calls to reset Authenticators](https://devforum.okta.com/t/api-calls-to-reset-authenticators/34710)
**Author:** [@nicholasf](https://devforum.okta.com/u/nicholasf)\ **Replies:** 0\ **Last updated:** [January 8, 2026, 3:29am UTC](https://devforum.okta.com/t/api-calls-to-reset-authenticators/34710 "2026-01-08T03:29:55Z")
Hi, I need to implement reset authenticator functionality via API calls to the User (or other API) such as I get the same effect as via the Okta console depicted in the Youtube here: Reset multifactor authentication for… --- ## [Okta Service App for access to Mgmt API](https://devforum.okta.com/t/okta-service-app-for-access-to-mgmt-api/34652)
**Author:** [@saschaschwarz](https://devforum.okta.com/u/saschaschwarz)\ **Replies:** 3\ **Last updated:** [December 24, 2025, 7:52pm UTC](https://devforum.okta.com/t/okta-service-app-for-access-to-mgmt-api/34652 "2025-12-24T19:52:07Z")
I am running automated test of my code against my developer Okta account. I use a script to setup an app of type service with JWT authentication. I have assigned Okta API scopes okta.groups.read and okta.users.read and… --- ## [Resetting Email Bounce List on Trial host](https://devforum.okta.com/t/resetting-email-bounce-list-on-trial-host/34486)
**Author:** [@lsandoz](https://devforum.okta.com/u/lsandoz)\ **Replies:** 4\ **Last updated:** [December 18, 2025, 9:11pm UTC](https://devforum.okta.com/t/resetting-email-bounce-list-on-trial-host/34486 "2025-12-18T21:11:13Z")
Hi, I have the following problem with the trial host I I use for local development: My company provides me with an email address, which is what I used to sign up for the trial host and use to do most of my testing on. W… --- ## [Reveal Okta Service Account password in OPA through API](https://devforum.okta.com/t/reveal-okta-service-account-password-in-opa-through-api/34671)
**Author:** [@vliapko](https://devforum.okta.com/u/vliapko)\ **Replies:** 0\ **Last updated:** [December 16, 2025, 4:58pm UTC](https://devforum.okta.com/t/reveal-okta-service-account-password-in-opa-through-api/34671 "2025-12-16T16:58:57Z")
I’m trying to use OPA API to reveal OPA managed Okta Service Account password. This would allow some test tools to get password automatically from OPA. I was kinda able to reveal password, but there are a few things tha… --- ## [User import inline Hook : return command has no impact on user import](https://devforum.okta.com/t/user-import-inline-hook-return-command-has-no-impact-on-user-import/34643)
**Author:** [@waheedk](https://devforum.okta.com/u/waheedk)\ **Replies:** 1\ **Last updated:** [December 15, 2025, 6:36pm UTC](https://devforum.okta.com/t/user-import-inline-hook-return-command-has-no-impact-on-user-import/34643 "2025-12-15T18:36:10Z")
We are using a User Import Inline Hook on our Workday application to control matching and linking behavior during user imports. The application is configured to match users on a custom attribute. When no match is found,… --- ## [Cleanup of deprecated transitive dependencies in @okta/okta-auth-js](https://devforum.okta.com/t/cleanup-of-deprecated-transitive-dependencies-in-okta-okta-auth-js/34644)
**Author:** [@satya.nagendra](https://devforum.okta.com/u/satya.nagendra)\ **Replies:** 1\ **Last updated:** [December 3, 2025, 3:17pm UTC](https://devforum.okta.com/t/cleanup-of-deprecated-transitive-dependencies-in-okta-okta-auth-js/34644 "2025-12-03T15:17:12Z")
Hi team, I’m using @okta/okta-auth-js in an enterprise project, and our security scan flagged a few deprecated and inactive transitive dependencies that come through the SDK. These are not direct dependencies in our c… --- ## [User lookup using Webfinger API?](https://devforum.okta.com/t/user-lookup-using-webfinger-api/34642)
**Author:** [@anleandr](https://devforum.okta.com/u/anleandr)\ **Replies:** 1\ **Last updated:** [December 3, 2025, 12:32am UTC](https://devforum.okta.com/t/user-lookup-using-webfinger-api/34642 "2025-12-03T00:32:01Z")
Hi all, I’m exploring a way to know whether a user exists or not from the Okta Sign-In widget. The use case is: “User enters the email, if it does not exist in Okta, show the registration flow, if exists, show the logi… --- ## [Missing discriminators in OpenAPI spec 5.1.0](https://devforum.okta.com/t/missing-discriminators-in-openapi-spec-5-1-0/34599)
**Author:** [@MichaelG](https://devforum.okta.com/u/MichaelG)\ **Replies:** 0\ **Last updated:** [November 19, 2025, 1:23pm UTC](https://devforum.okta.com/t/missing-discriminators-in-openapi-spec-5-1-0/34599 "2025-11-19T13:23:52Z")
Hi, I tried to generate a custom Okta Management API client from OpenAPI specification version 5.1.0 using Microsoft Kiota. These are some of the errors I got: The schema AppUserUpdateRequest is a polymorphic type but … --- ## [API - /api/v1/domains - The meaning of validationStatus values](https://devforum.okta.com/t/api-api-v1-domains-the-meaning-of-validationstatus-values/34593)
**Author:** [@eshechter](https://devforum.okta.com/u/eshechter)\ **Replies:** 0\ **Last updated:** [November 18, 2025, 3:36pm UTC](https://devforum.okta.com/t/api-api-v1-domains-the-meaning-of-validationstatus-values/34593 "2025-11-18T15:36:06Z")
Hey, I’m want to use the API /api/v1/domains. The response have the field validationStatus which have several values: “COMPLETED” “IN\_PROGRESS” “NOT\_STARTED” “VERIFIED”. There is no explanation for this values. I want to… --- ## [Getting AD attributes through the API](https://devforum.okta.com/t/getting-ad-attributes-through-the-api/34524)
**Author:** [@MichaelG](https://devforum.okta.com/u/MichaelG)\ **Replies:** 5\ **Last updated:** [November 18, 2025, 9:48am UTC](https://devforum.okta.com/t/getting-ad-attributes-through-the-api/34524 "2025-11-18T09:48:07Z")
Hi, I am unable to fetch AD attributes of synced users using thew API. How can that be done, please? But these values are not present in the JSON data: { "id": "00uw2sodowQc75SUm697", "status": "ACTIVE", … --- ## [Hi, Can you please help me to generate the api token using python app using the client credentials](https://devforum.okta.com/t/hi-can-you-please-help-me-to-generate-the-api-token-using-python-app-using-the-client-credentials/34504)
**Author:** [@Haniya1207](https://devforum.okta.com/u/Haniya1207)\ **Replies:** 3\ **Last updated:** [October 27, 2025, 4:46pm UTC](https://devforum.okta.com/t/hi-can-you-please-help-me-to-generate-the-api-token-using-python-app-using-the-client-credentials/34504 "2025-10-27T16:46:35Z")
Hi, Can you please help me to generate the api token using python app using the client credentials. So that we can directly use the api token that is generated in okta app and use that token in our python code. --- ## [Listing privileged groups and apps](https://devforum.okta.com/t/listing-privileged-groups-and-apps/34530)
**Author:** [@MichaelG](https://devforum.okta.com/u/MichaelG)\ **Replies:** 1\ **Last updated:** [October 27, 2025, 4:42pm UTC](https://devforum.okta.com/t/listing-privileged-groups-and-apps/34530 "2025-10-27T16:42:29Z")
Hi, while developing a tool for Okta security assessments, I need to fetch a list of privileged entities (users, groups, and apps). For users, there is this official endpoint: /api/v1/iam/assignees/users. But for groups… --- ## [403 Forbidden when trying to access api-services endpoint](https://devforum.okta.com/t/403-forbidden-when-trying-to-access-api-services-endpoint/34533)
**Author:** [@guilhermerelyance](https://devforum.okta.com/u/guilhermerelyance)\ **Replies:** 3\ **Last updated:** [October 27, 2025, 3:25pm UTC](https://devforum.okta.com/t/403-forbidden-when-trying-to-access-api-services-endpoint/34533 "2025-10-27T15:25:26Z")
Hi, I’ve posted this question first on support center and got advised to ask here instead. We have an Oauth2 app (OIDC - Web app) and after authenticating with it we are trying to hit this endpoint integrations/api/v1/… --- ## [Create service app with custom client\_id](https://devforum.okta.com/t/create-service-app-with-custom-client-id/34414)
**Author:** [@warpig](https://devforum.okta.com/u/warpig)\ **Replies:** 1\ **Last updated:** [September 30, 2025, 9:18pm UTC](https://devforum.okta.com/t/create-service-app-with-custom-client-id/34414 "2025-09-30T21:18:59Z")
Hi! Similar to what I’m able to do using the Okta Terraform provider, is it possible to create a new service app with a custom client\_id using the /oauth2/v1/clients endpoint? I just created a simple python script to ach… [Next page](https://devforum.okta.com/c/questions/api/22.md?page=1)