According to Authentication | Okta Developer , if the password policy is configured to hide lockout failures, a 401 Unauthorized error is returned. This is the default behaviour because Okta configures password policies to hide lockout failures by default.
However, even after enabling the “Show lock out failures” setting for the password policy, I still get 401 Unauthorized errors via the /api/v1/authn endpoint for locked out user accounts, whether using correct or incorrect credentials
I’ve also disabled the User enumeration prevention feature, as explained in Okta Support Center (Lightning)
On the UI side, I see the following, whether using correct or incorrect credentials :


