Docs · Connector reference

Okta connector reference

Operations, inputs, troubleshooting, and questions for the Okta connection. Policy decides each change before the credential is resolved, and the action record carries the result.

Set up and verify the Okta connection

Choose one task and its account, and match the reads and actions on the overview page to it before granting provider permissions.
Prepare the connection settings from the overview page, connect the provider in Deixic, and choose which tools your agent can use.
Try a small task with a known result, and compare the returned identity and resource with what the account owner expects.
Configure approval for sensitive changes, review the destination and inputs, and check the result in the provider before expanding the workflow.

Information your agent can use

Resource	Record identity	Start with	Page coverage
Users	`id`	Top level	Link header
Groups	`id`	Top level	Link header
Apps	`id`	Top level	Link header
Logs	`uuid`	Top level	Link header
Group memberships	`id`	Groups	Link header
User admin roles	`id`	Users	Link header
App user assignments	`id`	Apps	Link header
App group assignments	`id`	Apps	Link header
Authenticators	`id`	Top level	Link header
User factors	`id`	Users	Link header
Mfa enrollment policies	`id`	Top level	Link header
Mfa enrollment policies rules	`id`	Mfa enrollment policies	Link header
Access policies	`id`	Top level	Link header
Access policies rules	`id`	Access policies	Link header

Record identity: Match on these fields before joining or deduplicating results; where none is specified, check the returned record first.
Start with: Resolve the parent identifier first.
Link header: Link-header pagination. The next page is identified in the response headers, rather than in the records.

Supported operations

Review the inputs before granting an action to an agent. Required inputs must be supplied, optional inputs narrow the request, and provider permissions apply in addition to Deixic policy.

Action: Can change provider state; review the target and inputs, then retain the result to avoid repeating completed work.
Read: Retrieves information; check the returned scope and identifiers before use.

Operation	Effect	Approval	Provider permissions	Inputs
Users Create	Action	Approval required	None named	2
Users Get	Read	By policy	users.read	1
User Deactivate	Action	Approval required	None named	2
User Suspend	Action	Approval required	None named	1
User Sessions Clear	Action	Approval required	None named	2
User Role Unassign	Action	Approval required	None named	2
User Factors List	Read	By policy	None named	1
User Factors Reset	Action	Approval required	None named	1

Inputs by operation

Users Create Action · approval required

Inputs for Okta Users Create
Input	Requirement	Accepted value
`activate`	Optional	boolean
`profile`	Required	object

Users Get Read

Inputs for Okta Users Get
Input	Requirement	Accepted value
`user_id`	Required	string

User Deactivate Action · approval required

Inputs for Okta User Deactivate
Input	Requirement	Accepted value
`sendEmail`	Optional	boolean
`user_id`	Required	stringMinimum characters: 1Maximum characters: 64

User Suspend Action · approval required

Inputs for Okta User Suspend
Input	Requirement	Accepted value
`user_id`	Required	stringMinimum characters: 1Maximum characters: 64

User Sessions Clear Action · approval required

Inputs for Okta User Sessions Clear
Input	Requirement	Accepted value
`oauthTokens`	Optional	boolean
`user_id`	Required	stringMinimum characters: 1Maximum characters: 64

User Role Unassign Action · approval required

Inputs for Okta User Role Unassign
Input	Requirement	Accepted value
`role_assignment_id`	Required	stringMinimum characters: 1Maximum characters: 64
`user_id`	Required	stringMinimum characters: 1Maximum characters: 64

User Factors List Read

Inputs for Okta User Factors List
Input	Requirement	Accepted value
`user_id`	Required	stringMinimum characters: 1Maximum characters: 64

User Factors Reset Action · approval required

Inputs for Okta User Factors Reset
Input	Requirement	Accepted value
`user_id`	Required	stringMinimum characters: 1Maximum characters: 64

When the Okta task does not produce the expected result

Connected, but the expected data is missing

Check the identity behind the api key connection and its access to the specific resource; a successful connection does not establish access to every object.

Resolve parent resources first: Groups, Users, Apps, Mfa enrollment policies, Access policies. A matching display name is not enough for a child lookup.

The answer covers only part of the data

Check the resource’s page coverage, query filters, and result limit, and have the agent state the account and time window it inspected, so a partial response yields a scoped answer.

The agent keeps doing the same work

Inspect the action history for repeated targets and inputs, keep the successful result’s identifiers with the task, and refresh a lookup only when the information changed.

A change is waiting or failed

Check whether the call awaits approval, was rejected by policy, lacks an input, or failed at the provider, and after a timeout inspect the destination before repeating a write.

See how an action proceeds and how to review an approval.

Questions about the Okta connector

Can I use my existing agent with Okta?

Yes: connect your agent to Deixic through MCP, choose which connected tools it can use, and Deixic checks calls routed through its gateway; Dex is available if your team also wants an agent.

Can an agent change data in Okta?

This connector supports 2 actions, listed on its overview page. Configure a connection and choose the tools and provider permissions your task needs; an available action is not permission for every agent to run it, and Deixic policy and any required approval still apply to calls through the gateway.

What do I need to connect Okta?

Prepare Okta org domain, API token; the connection uses API key, and the connected identity’s provider permissions determine which resources it can access.

Does connecting Okta keep every answer up to date?

No: an earlier answer is still an earlier answer, so for a decision that depends on current state, have the agent refresh the source and retain the lookup time, and save stable instructions separately from facts that can change.

Okta connector overview Docs All connectors