# Okta Group Push via API **URL:** \ **Category:** API\ **Created:** [September 29, 2018, 2:42pm UTC](https://devforum.okta.com/t/okta-group-push-via-api/2956 "2018-09-29T14:42:41Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![geppe](https://avatars.discourse-cdn.com/v4/letter/g/439d5e/32.png) [@geppe](https://devforum.okta.com/u/geppe)\ **Post date:** [September 29, 2018, 2:42pm UTC](https://devforum.okta.com/t/okta-group-push-via-api/2956/1 "2018-09-29T14:42:41Z")
Hi, we are using the recently released Group Push functionality through which you can push groups from Okta to an AD thus making Okta the owner of the group. What I haven’t found yet is a way to trigger that push via API as we need to do that for more than 1000 groups… Has anyone figured out if and how it works? Best regards, G. ---
**Author:** ![andrey.maltsev](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrey.maltsev/32/849_2.png) [@andrey.maltsev](https://devforum.okta.com/u/andrey.maltsev)\ **Post date:** [December 28, 2018, 2:21pm UTC](https://devforum.okta.com/t/okta-group-push-via-api/2956/2 "2018-12-28T14:21:35Z")
Hello, I have the same problem. Easiest way is to trigger admin panel private API. Be careful with that as private API’s are for internal use only and can change without any notice as well as harm your instance if used with errors. In my case it looks like: curl ‘https://{{tenant-admin}}.okta.com/api/internal/instance/{{appId}}/grouppush/{{mappingId}}’ -H ‘Cookie: {{cookies}}’ -H ‘Origin: https://{{tenant-admin}}.okta.com’ -H ‘Accept-Encoding: gzip, deflate, br’ -H ‘X-Okta-XsrfToken: {{token}}’ -H ‘Accept-Language: en-US,en;q=0.9,ru;q=0.8’ -H ‘User-Agent: {{userAgent}}’ -H ‘Content-Type: application/json’ -H ‘Accept: application/json, text/javascript, _/_; q=0.01’ -H ‘Referer: https://{{tenant-admin}}.okta.com/admin/app/{{appName}}/instance/{{appId}}/’ -H ‘X-Requested-With: XMLHttpRequest’ -H ‘Connection: keep-alive’ –data-binary ‘{“action”:“PUSH”}’ –compressed ---
**Author:** ![geppe](https://avatars.discourse-cdn.com/v4/letter/g/439d5e/32.png) [@geppe](https://devforum.okta.com/u/geppe)\ **Post date:** [January 8, 2019, 12:23pm UTC](https://devforum.okta.com/t/okta-group-push-via-api/2956/3 "2019-01-08T12:23:07Z")
Hi Andrey, thanks for this! First time I hear about this. Do you know if there is any documentation on that? Just googled it but couldn’t find anything. Apart from making sure not to cause any harm, I’m wondering what values I would populate {{cookies}} {{userAgent}} with. And how do you get the group’s {{mappingId}}? Thanks a lot! Best regards, G. ---
**Author:** ![Govner](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/govner/32/1099_2.png) [@Govner](https://devforum.okta.com/u/Govner)\ **Post date:** [January 8, 2019, 12:54pm UTC](https://devforum.okta.com/t/okta-group-push-via-api/2956/4 "2019-01-08T12:54:44Z")
Also interested in other private API functions ---
**Author:** ![andrey.maltsev](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrey.maltsev/32/849_2.png) [@andrey.maltsev](https://devforum.okta.com/u/andrey.maltsev)\ **Post date:** [January 10, 2019, 10:14am UTC](https://devforum.okta.com/t/okta-group-push-via-api/2956/5 "2019-01-10T10:14:00Z")
Private APIs are not documented publicly. {{cookies}}, {{userAgent}}, {{mappingId}} are your own cookie, browser userAgent and group mappingId from your tenant. You can use Chrome DevTools to track these fields and copy necessary data to Postman or curl. Just check there what is happening when you do click on ‘Push now’ button in Okta UI. ---
**Author:** ![geppe](https://avatars.discourse-cdn.com/v4/letter/g/439d5e/32.png) [@geppe](https://devforum.okta.com/u/geppe)\ **Post date:** [January 18, 2019, 7:20pm UTC](https://devforum.okta.com/t/okta-group-push-via-api/2956/6 "2019-01-18T19:20:35Z")
Hi Andrey, I’ve been making some progress here in finding the needed values but I still haven’t managed to make it work. Looking at the values what strikes me as odd is the following: - {{mappingId}} is always a different string when I do group pushes in the front-end. Seems like this number is generated AFTER the group push is done and either refers to the mapping between the Okta group and the AD group, or the AD group’s ID. In other words - so I tried to populate the group’s Okta ID instead of a mapping ID but then wondered how should the AD in which OU to push the group (this is normally selected manually when pushing the group in the front-end) - so I guessed that maybe the {{mappingId}} is in fact the OU ID provided by the AD, but again, the number is always different even if I choose the same group and OU to push it to So I figured in the CURL parameters we’d have to specify at least 2 Okta IDs - the group ID and the OU ID. When you submit your CURL statement in your environment, in which OU is the group created? In the root OU? Thanks, G. ---
**Author:** ![andrey.maltsev](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrey.maltsev/32/849_2.png) [@andrey.maltsev](https://devforum.okta.com/u/andrey.maltsev)\ **Post date:** [January 29, 2019, 4:14pm UTC](https://devforum.okta.com/t/okta-group-push-via-api/2956/7 "2019-01-29T16:14:24Z")
Hello geppe, I have group push configured for Jira app and not AD. With Jira mappingID is unique ID for every groups I have pushed: group1-\>to\_Jira has one mappingID, group2\_to\_Jira has another. ---
**Author:** ![dmv5039](https://avatars.discourse-cdn.com/v4/letter/d/ed655f/32.png) [@dmv5039](https://devforum.okta.com/u/dmv5039)\ **Post date:** [July 27, 2021, 7:45pm UTC](https://devforum.okta.com/t/okta-group-push-via-api/2956/8 "2021-07-27T19:45:45Z")
I was able to do this with postman. 1. Push a group manually to AD with Chrome dev tools open to ‘network’ tab. 2. On the dev tools network tab, copy the request as a Curl 3. In postman, import the request as text, pasting the curl command copied in step 3. 4. Create a collection and save the request to the collection 5. Create and populate a csv with two columns, name, and id (this will be your okta group name and groupid) of the groups you want to push 6. In the body of the request, replace the group name with “{{name}}” and replace the group id with “{{id}}”. These must match your column headers of your csv 7. In Postman go to “Runner”, select your collection and API call. In data select your CSV. Check “save responses”/ 8. Start Run! ---
**Author:** ![DukeLe](https://avatars.discourse-cdn.com/v4/letter/d/d26b3c/32.png) [@DukeLe](https://devforum.okta.com/u/DukeLe)\ **Post date:** [August 19, 2022, 9:08pm UTC](https://devforum.okta.com/t/okta-group-push-via-api/2956/9 "2022-08-19T21:08:20Z")
@dmv5039 Thank you for the information. The challenge I am facing that the CURL copied to Postman uses an AppGroupID: {“status”:“ACTIVE”,“userGroupId”:“XXXX”,“existingAppGroupId”:“XXXX”,“groupPushAttributes”:{“groupScope”:“GLOBAL”,“groupType”:“SECURITY”,“distinguishedName”:“dc=XXXX,dc=com”,“samAccountName”:“XXX”}} Both Postman and Rockstar does not export the AppGroupId. Did you run into this issue and what did you do resolve it? ---
**Author:** ![dvogelsang](https://avatars.discourse-cdn.com/v4/letter/d/49beb7/32.png) [@dvogelsang](https://devforum.okta.com/u/dvogelsang)\ **Post date:** [October 18, 2022, 6:33pm UTC](https://devforum.okta.com/t/okta-group-push-via-api/2956/10 "2022-10-18T18:33:51Z")
Has anyone been able to figure out how to do this now that it is looking for an “existingAppGroupId”? @DukeLe - were you able to find out where that attribute exists? Or did you come up with another solution? This seems silly that there isn’t an easy way to link groups via API. Similar to @geppe we have a couple thousand Okta groups we need to link to AD groups- were you ever able to find a solution for your situation? ---
**Author:** ![ptaukulis](https://avatars.discourse-cdn.com/v4/letter/p/9de0a6/32.png) [@ptaukulis](https://devforum.okta.com/u/ptaukulis)\ **Post date:** [August 21, 2023, 8:38pm UTC](https://devforum.okta.com/t/okta-group-push-via-api/2956/11 "2023-08-21T20:38:13Z")
How do I authenticate to retrieve the token and cookies attributes? ---
**Author:** ![jonathanhle](https://avatars.discourse-cdn.com/v4/letter/j/bc8723/32.png) [@jonathanhle](https://devforum.okta.com/u/jonathanhle)\ **Post date:** [October 25, 2023, 12:25am UTC](https://devforum.okta.com/t/okta-group-push-via-api/2956/12 "2023-10-25T00:25:53Z")
I was able to pull off Group Push Failed Retries with the Private API above with Okta Workflows ![SCR-20231024-pgfl-2](https://global.discourse-cdn.com/oktadev/original/2X/e/eb2aca94088403064fbf37e69f547e3edbf3a104.png) ![SCR-20231024-pfpk-2](https://global.discourse-cdn.com/oktadev/original/2X/8/88019d951d0e9da0142906a413e986d24397918e.png) On the API/HTTP Post card, just go to Error Handling and give it a few more retries before returning values. Considering that there’s already a Workflow Card for capturing failed pushes, I don’t know why we don’t have a workflow card for retrying them. The only thing I have in the API Connector body is: ```auto { "action": "PUSH" } ``` The private API call maps to: https://{{your tenant}}-admin.okta.com/api/internal/instance/{{your app integration ID}}/grouppush/{{app mapping id betweeen okta and your downstream receiver}} ---
**Author:** ![jonathanhle](https://avatars.discourse-cdn.com/v4/letter/j/bc8723/32.png) [@jonathanhle](https://devforum.okta.com/u/jonathanhle)\ **Post date:** [November 16, 2023, 11:00pm UTC](https://devforum.okta.com/t/okta-group-push-via-api/2956/13 "2023-11-16T23:00:12Z")
I had to update things with an If/Error card because of a 500 status code being returned. The flow looks like this now: ![SCR-20231116-nhch-2](https://global.discourse-cdn.com/oktadev/original/2X/7/7d128ff9551f671c3f2baa6571ca957edc1b289c.png) ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [February 13, 2024, 12:26am UTC](https://devforum.okta.com/t/okta-group-push-via-api/2956/14 "2024-02-13T00:26:56Z")