Per-client outbound SCIM request rate and rate limits Okta sends to a target endpoint

Questions SCIM
1

We’re an app vendor building a SCIM 2.0 endpoint for the OIN and are sizing it. We need data on the request rate a single customer tenant generates.

  1. What request rate (requests/sec) does Okta’s provisioning engine generate against a single target endpoint, and how does this scale for a large tenant of 2000+ users? Is there a per-client overall rate limit on outbound requests? Is there a per-client, per-API rate limit (e.g. on POST /Users)?
  2. How does Okta react to an HTTP 429? Does it retry with a short backoff, or defer to the next sync cycle?
2

Hi,

  1. There is no per-client overall rate limit on outbound requests. Okta make outbound requests to the external endpoint via Jobs, so there is no rate limit on it.
  2. Yes, we do have short backoff for the 429s. But we encourage that your SCIM server sends the Retry-After value in the 429 Response Header, so that Okta will retry after that specified time to prevent further 429s.
3

Consider a case where there are 2000 users all available for provisioning, will the Job pick all the 2000 users and send the calls for all 2000 of them at once or there will be a batch size of say 100 users and sends calls for 100 users and then the next batch of 100 users runs?

4

We don’t have any documented Request rate for the outbound calls. But in the use case you mentioned, Okta will keep firing the POST call to the /usersendpoint continuously for all 2k users, until the call is made for all the users.