Setting status to INACTIVE does not create rule in INACTIVE status using IdP Discovery Policy with API

[aimeedelgado]

I’m using POST /api/v1/policies/{{policyid}}/rules. The rule gets created, but it does not set the rule to INACTIVE. Am I missing something? I need the rules to be created in INACTIVE status.

The parameters in my request:

{
  "name": "Test IdP Rule",
  "status": "INACTIVE",
  "actions": {
    "idp": {
      "providers": [
        {
          "type": "SAML2",
          "id": "{{idpid}}"
        }
      ],
      "idpSelectionType": "SPECIFIC"
    }
  },
  "type": "IDP_DISCOVERY",
  "conditions": {
    "network": {
      "connection": "ANYWHERE"
    },
    "userIdentifier": {
      "patterns": [
        {
          "matchType": "SUFFIX",
          "value": "test.com"
        }
      ],
      "type": "IDENTIFIER"
    }
  }
}```

[SitaRam]

By default new rules are created in an ACTIVE state when you call POST /api/v1/policies/{{policyid}}/rules.

To achieve your desired outcome of creating a rule in an INACTIVE status you can follow this two-step process:

1. Create the rule using the POST request (as you’re currently doing).
2. Immediately after creating the rule, send a separate request to deactivate it.

So, After creating the rule, you’ll receive a response that includes the newly created rule’s ID. Use this ID to immediately deactivate the rule:

curl -v -X POST \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: SSWS ${api_token}" \
"https://${yourOktaDomain}/api/v1/policies/${policyId}/rules/${ruleId}/lifecycle/deactivate"

By following these steps, you’ll effectively create a rule and set its status to INACTIVE. The deactivate endpoint (POST /api/v1/policies/${policyId}/rules/${ruleId}/lifecycle/deactivate) is specifically designed for this purpose.