Fetch app *external* metadata url through API

Questions API
1

I have an Auth0 tenant with a number of connections created using Okta app metadata urls of the form https://XXXX.oktapreview.com/app/exkXXXX/sso/saml/metadata

I want to work out which Okta apps these correspond to. I could click into each app in the Okta admin dashboard & see the metadata url, but I wondered if I could use the API to retrieve all apps with their metadata urls.

The reply in this closed topic:

yields urls of the form https://XXXX.oktapreview.com/api/v1/apps/0oaXXXX/sso/saml/metadata - which require an admin dashboard session - so isn’t a solution to that topic’s question, or mine.

The “external” id doesn’t appear in the GET /api/v1/apps API response at all.

Is it possible to obtain these urls via the API?

2

Hi @richard.barnett ,

While the public /app/exk... URL isn’t returned directly as a field in GET /api/v1/apps, you can map them using the entityID returned from the app’s SAML metadata endpoint:

  1. Fetch the SAML Metadata XML:

    Query the metadata endpoint for your app using your API token and the 0oa... App ID:

    https://{yourOktaOrg}.oktapreview.com/api/v1/apps/{appId}/sso/saml/metadata
    Authorization: SSWS {api_token}
    Accept: application/xml

  2. Extract the exk... Key:

    In the root <md:EntityDescriptor> tag of the XML response, look at the entityID attribute:

    entityID="http://www.okta.com/exkXXXX"

  3. Map to the Public URL:

    The exkXXXX value in entityID directly matches the ID in your public/Auth0 metadata URL:
    https://{yourOktaOrg}.oktapreview.com/app/exkXXXX/sso/saml/metadata

3

Thanks. This isn’t the solution I hoped for but it would work. Can you explain why the exk... url isn’t in the API response?

4

Hi @richard.barnett

In Okta’s architecture, 0oa... represents the Application Instance ID (the administrative resource), while exk... represents the SAML Key / Signing Credential ID.

Because the Apps API is a generic container for multiple protocols (SAML, OIDC, SWA, etc.), protocol-specific details like SAML metadata and public routing keys are separated into their own sub-resources (e.g., /api/v1/apps/{appId}/sso/saml/metadata) rather than being flattened into the root GET /api/v1/apps response. The exk URL serves as the unauthenticated public SSO gateway identifier.