# Error 400 When Making Postman API Calls to Okta REST APIs Integrated with Microsoft ADFS (MFA)

**URL:** <https://devforum.okta.com/t/error-400-when-making-postman-api-calls-to-okta-rest-apis-integrated-with-microsoft-adfs-mfa/31543>\
**Category:** OAuth/OIDC\
**Tags:** mfa\
**Created:** [December 23, 2024, 12:30pm UTC](https://devforum.okta.com/t/error-400-when-making-postman-api-calls-to-okta-rest-apis-integrated-with-microsoft-adfs-mfa/31543 "2024-12-23T12:30:05Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tnguyen571](https://avatars.discourse-cdn.com/v4/letter/t/8baadc/32.png) [@tnguyen571](https://devforum.okta.com/u/tnguyen571)\
**Post date:** [December 23, 2024, 12:30pm UTC](https://devforum.okta.com/t/error-400-when-making-postman-api-calls-to-okta-rest-apis-integrated-with-microsoft-adfs-mfa/31543/1 "2024-12-23T12:30:05Z")

</div>

I am creating Okta REST APIs with Postman, following the documentation at [https://developer.okta.com/docs/reference/rest/\*get-an-access-token-and-make-a-request](https://developer.okta.com/docs/reference/rest/*get-an-access-token-and-make-a-request).

However, when I attempt to call Get New Access Token, I receive a 400 Bad Request response.

My URL is:

“oauth2/default/v1/authorize?response\_type=code&client\_id=xxx&state=2&scope=okta.users.read&redirect\_uri=xxx&code\_challenge=xxx&code\_challenge\_method=S256”

There are no apparent errors in the System Log.

 ![Okta POC](https://global.discourse-cdn.com/oktadev/original/2X/b/b6316bd864978294daa16a95c15236ea027c94f4.png)  
 ![Screenshot 2024-12-23 223939](https://global.discourse-cdn.com/oktadev/original/2X/c/c4dea73fc1bca3833faa645aeee0c897ffe3e30e.png)

Pls suggest a possible root cause.  
Thanks

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [December 23, 2024, 7:28pm UTC](https://devforum.okta.com/t/error-400-when-making-postman-api-calls-to-okta-rest-apis-integrated-with-microsoft-adfs-mfa/31543/2 "2024-12-23T19:28:39Z")

</div>

Remove /default from your request path. When requesting okta.\* API scopes, you MUST use the [Org Authorization Server](https://developer.okta.com/docs/concepts/auth-servers/#org-authorization-server) and not a [Custom Authorization Server](https://developer.okta.com/docs/concepts/auth-servers/#custom-authorization-server). The ‘Default’ server you are trying to use is actually a Custom Authorization Server and is not the same thing as the Org Authorization Server.

More details in our docs here about how to Implement OAuth for Okta: [Implement OAuth for Okta | Okta Developer](https://developer.okta.com/docs/guides/implement-oauth-for-okta/main/)

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [January 22, 2025, 7:28pm UTC](https://devforum.okta.com/t/error-400-when-making-postman-api-calls-to-okta-rest-apis-integrated-with-microsoft-adfs-mfa/31543/3 "2025-01-22T19:28:42Z")

</div>

Closed on January 22, 2025, 7:28pm UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.