Can OPA(Okta Provisioning Agent) reach a custom app's REST API without opening inbound ports?

Hi all,

We need to provision users to an on-prem app that only exposes a custom REST API (no SCIM support), and we can’t open any inbound firewall ports .

Can OPA call that REST API directly, or does it always need a SCIM connector in between (Provisioning Connector SDK or fully custom SCIM server)?

If a connector is required, is the SDK the recommended path, or is a fully custom SCIM server just as supported?

Any gotchas from experience welcome!

Thank you.

Thank you for reaching out here on the Okta Developer Forum. We noticed that your question is more closely related to Okta Provisioning Agent. To ensure you receive the most accurate and timely assistance, we recommend reposting your query on Okta’s Community at: Okta Support Center (Lightning)

Okta’s teams on the Community are better equipped to provide the comprehensive support and guidance you need as they have the specialised knowledge and expertise in this component.

We appreciate your understanding and are committed to ensuring you receive the best possible support. If you have any other questions or issues related to Okta’s developer tools and API’s, feel free to post them here, and we’ll be happy to assist!