{"openapi":"3.1.0","info":{"title":"Okta (BYOK) API","version":"0.1.0","description":"Okta (BYOK) lets an AI assistant read your own Okta data through the Okta API with a key you supply (Okta API token). Read-only: 12 tools (get_org_settings, list_applications, list_groups, list_group_rules, list_authorization_servers, list_policies, list_identity_providers, list_network_zones, list_trusted_origins, list_authenticators, list_domains, list_event_hooks). The BYOK key travels with...\n\nEvery operation is read-only or compute-only. The same tools are available over MCP (streamable HTTP) at https://byok-okta.connectorbay.com/mcp.","contact":{"name":"Unify Dynamics LLC","email":"agent@connectorbay.com","url":"https://connectorbay.com/byok-okta/docs"},"termsOfService":"https://connectorbay.com/byok-okta/terms"},"servers":[{"url":"https://byok-okta.connectorbay.com"}],"externalDocs":{"url":"https://connectorbay.com/byok-okta/docs"},"security":[{"upstreamKey":[]}],"components":{"securitySchemes":{"bearer":{"type":"http","scheme":"bearer","description":"Optional. A Pro API key raises rate limits; no credentials are required."},"upstreamKey":{"type":"apiKey","in":"header","name":"X-Upstream-Key","description":"Your own key for the service this connector wraps (bring your own key). Used for that one call only; never stored, logged or cached."}},"schemas":{"Error":{"type":"object","properties":{"ok":{"const":false},"error":{"type":"object"}}}}},"paths":{"/v1/tools/get_org_settings":{"post":{"operationId":"get_org_settings","summary":"Show the Okta org the token belongs to: company name, subdomain, status, website, creation and last update dates. Use fo","description":"Show the Okta org the token belongs to: company name, subdomain, status, website, creation and last update dates. Use for \"Which Okta org is my token connected to\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"org":{"description":"Your Okta org subdomain: the part before .okta.com, for example 'acme' for acme.okta.com.","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Org","type":"string"}},"required":["org"],"title":"get_org_settingsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_applications":{"post":{"operationId":"list_applications","summary":"List applications integrated with the org, with label, sign-on mode (SAML, OIDC and so on) and status. Optional search o","description":"List applications integrated with the org, with label, sign-on mode (SAML, OIDC and so on) and status. Optional search on the label and a filter expression such as status eq \"ACTIVE\". Use for \"Which applications are configured in our Okta org and which are inactive\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"org":{"description":"Your Okta org subdomain: the part before .okta.com, for example 'acme' for acme.okta.com.","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Org","type":"string"},"q":{"anyOf":[{"maxLength":100,"type":"string"},{"type":"null"}],"default":null,"description":"Search applications whose label starts with this text.","title":"Q"},"filter":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Okta filter expression, for example 'status eq \"INACTIVE\"'.","title":"Filter"},"limit":{"anyOf":[{"maximum":200,"minimum":1,"type":"integer"},{"type":"null"}],"default":20,"description":"How many results to return (1 to 200).","title":"Limit"},"after":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Pagination cursor taken from the previous answer's next link; leave empty for the first page.","title":"After"}},"required":["org"],"title":"list_applicationsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_groups":{"post":{"operationId":"list_groups","summary":"List groups with name, description, type (OKTA_GROUP, APP_GROUP, BUILT_IN) and last membership change. Members are not l","description":"List groups with name, description, type (OKTA_GROUP, APP_GROUP, BUILT_IN) and last membership change. Members are not listed. Use for \"What groups exist in our Okta org\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"org":{"description":"Your Okta org subdomain: the part before .okta.com, for example 'acme' for acme.okta.com.","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Org","type":"string"},"q":{"anyOf":[{"maxLength":100,"type":"string"},{"type":"null"}],"default":null,"description":"Search groups whose name starts with this text.","title":"Q"},"limit":{"anyOf":[{"maximum":200,"minimum":1,"type":"integer"},{"type":"null"}],"default":20,"description":"How many results to return (1 to 200).","title":"Limit"},"after":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Pagination cursor taken from the previous answer's next link; leave empty for the first page.","title":"After"}},"required":["org"],"title":"list_groupsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_group_rules":{"post":{"operationId":"list_group_rules","summary":"List group rules that add users to groups automatically, with name, status and type. Use for \"Which group assignment rul","description":"List group rules that add users to groups automatically, with name, status and type. Use for \"Which group assignment rules are active in Okta\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"org":{"description":"Your Okta org subdomain: the part before .okta.com, for example 'acme' for acme.okta.com.","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Org","type":"string"},"search":{"anyOf":[{"maxLength":100,"type":"string"},{"type":"null"}],"default":null,"description":"Keyword to search rule names for.","title":"Search"},"limit":{"anyOf":[{"maximum":200,"minimum":1,"type":"integer"},{"type":"null"}],"default":50,"description":"How many results to return (1 to 200).","title":"Limit"},"after":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Pagination cursor taken from the previous answer's next link; leave empty for the first page.","title":"After"}},"required":["org"],"title":"list_group_rulesArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_authorization_servers":{"post":{"operationId":"list_authorization_servers","summary":"List custom authorization servers with name, audiences, issuer, issuer mode and status. Use for \"Which authorization ser","description":"List custom authorization servers with name, audiences, issuer, issuer mode and status. Use for \"Which authorization servers does our Okta org have and what are their issuers\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"org":{"description":"Your Okta org subdomain: the part before .okta.com, for example 'acme' for acme.okta.com.","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Org","type":"string"},"q":{"anyOf":[{"maxLength":100,"type":"string"},{"type":"null"}],"default":null,"description":"Search authorization servers by name.","title":"Q"},"limit":{"anyOf":[{"maximum":200,"minimum":1,"type":"integer"},{"type":"null"}],"default":20,"description":"How many results to return (1 to 200).","title":"Limit"},"after":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Pagination cursor taken from the previous answer's next link; leave empty for the first page.","title":"After"}},"required":["org"],"title":"list_authorization_serversArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_policies":{"post":{"operationId":"list_policies","summary":"List policies of one type (sign-on, password, access, profile enrollment, IdP discovery or OAuth authorization) with nam","description":"List policies of one type (sign-on, password, access, profile enrollment, IdP discovery or OAuth authorization) with name, priority and status. Use for \"What sign-on policies does our Okta org enforce and in which order\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"org":{"description":"Your Okta org subdomain: the part before .okta.com, for example 'acme' for acme.okta.com.","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Org","type":"string"},"type":{"description":"Policy type to list.","enum":["OKTA_SIGN_ON","PASSWORD","ACCESS_POLICY","PROFILE_ENROLLMENT","IDP_DISCOVERY","OAUTH_AUTHORIZATION_POLICY"],"title":"Type","type":"string"},"status":{"anyOf":[{"enum":["ACTIVE","INACTIVE"],"type":"string"},{"type":"null"}],"default":null,"description":"Only policies with this status.","title":"Status"}},"required":["org","type"],"title":"list_policiesArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_identity_providers":{"post":{"operationId":"list_identity_providers","summary":"List external identity providers (SAML, OIDC, social logins) configured for sign-in, with type, protocol and status. Use","description":"List external identity providers (SAML, OIDC, social logins) configured for sign-in, with type, protocol and status. Use for \"Which external identity providers can people use to sign in to Okta\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"org":{"description":"Your Okta org subdomain: the part before .okta.com, for example 'acme' for acme.okta.com.","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Org","type":"string"},"q":{"anyOf":[{"maxLength":100,"type":"string"},{"type":"null"}],"default":null,"description":"Search identity providers by name.","title":"Q"},"type":{"anyOf":[{"maxLength":30,"type":"string"},{"type":"null"}],"default":null,"description":"Only providers of this type, for example SAML2, GOOGLE, OIDC.","title":"Type"},"limit":{"anyOf":[{"maximum":200,"minimum":1,"type":"integer"},{"type":"null"}],"default":20,"description":"How many results to return (1 to 200).","title":"Limit"},"after":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Pagination cursor taken from the previous answer's next link; leave empty for the first page.","title":"After"}},"required":["org"],"title":"list_identity_providersArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_network_zones":{"post":{"operationId":"list_network_zones","summary":"List network zones used in policies and blocklists, with type, usage, status, and gateway, proxy and location counts. Us","description":"List network zones used in policies and blocklists, with type, usage, status, and gateway, proxy and location counts. Use for \"Which network zones and blocklists are defined in Okta\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"org":{"description":"Your Okta org subdomain: the part before .okta.com, for example 'acme' for acme.okta.com.","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Org","type":"string"},"filter":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Filter expression, for example 'usage eq \"BLOCKLIST\"'.","title":"Filter"},"limit":{"anyOf":[{"maximum":200,"minimum":1,"type":"integer"},{"type":"null"}],"default":20,"description":"How many results to return (1 to 200).","title":"Limit"},"after":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Pagination cursor taken from the previous answer's next link; leave empty for the first page.","title":"After"}},"required":["org"],"title":"list_network_zonesArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_trusted_origins":{"post":{"operationId":"list_trusted_origins","summary":"List trusted origins allowed for CORS, redirects and iframe embedding, with origin URL, scopes and status. Use for \"Whic","description":"List trusted origins allowed for CORS, redirects and iframe embedding, with origin URL, scopes and status. Use for \"Which origins are trusted for CORS or redirects in our Okta org\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"org":{"description":"Your Okta org subdomain: the part before .okta.com, for example 'acme' for acme.okta.com.","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Org","type":"string"},"filter":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Filter expression, for example 'status eq \"ACTIVE\"'.","title":"Filter"},"limit":{"anyOf":[{"maximum":200,"minimum":1,"type":"integer"},{"type":"null"}],"default":20,"description":"How many results to return (1 to 200).","title":"Limit"},"after":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Pagination cursor taken from the previous answer's next link; leave empty for the first page.","title":"After"}},"required":["org"],"title":"list_trusted_originsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_authenticators":{"post":{"operationId":"list_authenticators","summary":"List authenticators (password, phone, email, app, security key) with key, type and whether each is active. Use for \"Whic","description":"List authenticators (password, phone, email, app, security key) with key, type and whether each is active. Use for \"Which authentication factors are enabled in our Okta org\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"org":{"description":"Your Okta org subdomain: the part before .okta.com, for example 'acme' for acme.okta.com.","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Org","type":"string"}},"required":["org"],"title":"list_authenticatorsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_domains":{"post":{"operationId":"list_domains","summary":"List custom domains of the org with verification status and certificate source. Use for \"Which custom domains are verifi","description":"List custom domains of the org with verification status and certificate source. Use for \"Which custom domains are verified in our Okta org\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"org":{"description":"Your Okta org subdomain: the part before .okta.com, for example 'acme' for acme.okta.com.","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Org","type":"string"}},"required":["org"],"title":"list_domainsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_event_hooks":{"post":{"operationId":"list_event_hooks","summary":"List event hooks with name, status, verification status and the events they subscribe to. Use for \"Which event hooks are","description":"List event hooks with name, status, verification status and the events they subscribe to. Use for \"Which event hooks are configured in Okta\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"org":{"description":"Your Okta org subdomain: the part before .okta.com, for example 'acme' for acme.okta.com.","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Org","type":"string"}},"required":["org"],"title":"list_event_hooksArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}}}}