IdRa

API reference

Every operation of IdRa's /api/v1 management API, which is compatible with core Okta resources, with its OAuth scope and body fields. Also available as an OpenAPI file.

Paths are under /api/v1. This page and openapi.json are generated from IdRa's router, and a test fails if they list a path the router doesn't have. Start with Admin API for tokens, paging, errors and how IdRa differs from Okta.

121 operations are listed. On 2026-10-31, they answered 121 of the 815 operations in Okta's Node SDK (@okta/okta-sdk-nodejs 8.2.0), so most of Okta's API isn't here. A matching path shows that IdRa has the operation, not that it behaves the same as Okta.

What this reference doesn't cover

  • Responses aren't described. They follow the shape of the matching Okta resource: check the differences.
  • Request bodies aren't described for POST /policies, PUT /policies/{id}, POST /policies/{id}/rules, PUT /policies/{id}/rules/{ruleId}, because they're validated inside the handler.
  • Query parameters are listed in the summary, or come from the route's schema where it has one. Paging and filters are in the conventions.
  • Only /api/v1. The console's /api/admin, the OIDC and SAML endpoints under /api/auth and /sso/saml, the Okta path aliases under the issuer, and SCIM aren't here.

Users

OperationWhat it doesOAuth scopeBody fields
GET /usersList people. Query: q, filter, search, limit, afterokta.users.read
POST /usersCreate a person. Query: activateokta.users.manageprofile (required), credentials, groupIds
GET /users/{id}Get a person by ID or loginokta.users.read
POST /users/{id}Update a person, changing only the fields sentokta.users.manageprofile, credentials
PUT /users/{id}Replace a person's profileokta.users.manageprofile, credentials
DELETE /users/{id}Deactivate a person. A second call deletes themokta.users.manage
POST /users/{id}/lifecycle/activateActivate a personokta.users.manage
POST /users/{id}/lifecycle/reactivateReactivate a personokta.users.manage
POST /users/{id}/lifecycle/deactivateDeactivate a personokta.users.manage
POST /users/{id}/lifecycle/suspendSuspend a personokta.users.manage
POST /users/{id}/lifecycle/unsuspendUnsuspend a personokta.users.manage
POST /users/{id}/lifecycle/unlockUnlock a personokta.users.manage
POST /users/{id}/lifecycle/reset_passwordSend a password reset to a personokta.users.manage
POST /users/{id}/lifecycle/reset_factorsReset the factors of a personokta.users.manage
POST /users/{id}/credentials/change_passwordChange a password, given the old oneokta.users.manageoldPassword (required), newPassword (required)
GET /users/{id}/groupsList a person's groupsokta.users.read
GET /users/{id}/appLinksList a person's app linksokta.users.read
GET /users/{id}/factorsList a person's factorsokta.users.read
DELETE /users/{id}/factors/{factorId}Remove a factorokta.users.manage
DELETE /users/{id}/sessionsEnd a person's sessionsokta.users.manage
GET /users/{id}/rolesList a person's admin rolesokta.roles.read
POST /users/{id}/rolesAssign an admin roleokta.roles.managetype (required)
DELETE /users/{id}/roles/{roleId}Remove an admin roleokta.roles.manage
GET /users/{id}/riskGet a person's risk levelokta.userRisk.read
PUT /users/{id}/riskSet a person's risk levelokta.userRisk.manageriskLevel (required)

Groups

OperationWhat it doesOAuth scopeBody fields
GET /groups/rulesList group rulesokta.groups.read
POST /groups/rulesCreate a group ruleokta.groups.managename (required), conditions (required), actions (required)
GET /groups/rules/{ruleId}Get a group ruleokta.groups.read
PUT /groups/rules/{ruleId}Update a group ruleokta.groups.managename (required), conditions (required), actions (required)
DELETE /groups/rules/{ruleId}Delete a group ruleokta.groups.manage
POST /groups/rules/{ruleId}/lifecycle/activateActivate a group ruleokta.groups.manage
POST /groups/rules/{ruleId}/lifecycle/deactivateDeactivate a group ruleokta.groups.manage
GET /groupsList groups. Query: q, filter, search, limit, afterokta.groups.read
POST /groupsCreate a groupokta.groups.manageprofile (required)
GET /groups/{id}Get a groupokta.groups.read
PUT /groups/{id}Update a groupokta.groups.manageprofile (required)
DELETE /groups/{id}Delete a groupokta.groups.manage
GET /groups/{id}/usersList a group's membersokta.groups.read
PUT /groups/{id}/users/{userId}Add a memberokta.groups.manage
DELETE /groups/{id}/users/{userId}Remove a memberokta.groups.manage
GET /groups/{id}/appsList apps assigned to a groupokta.groups.read

System Log

OperationWhat it doesOAuth scopeBody fields
GET /logsRead the System Log. Query: since, until, filter, q, sortOrder, limitokta.logs.read

Apps

OperationWhat it doesOAuth scopeBody fields
GET /apps/{id}/grantsList a service app's okta.* scope grantsokta.appGrants.read
POST /apps/{id}/grantsGrant a service app an okta.* scopeokta.appGrants.manageissuer, scopeId (required)
DELETE /apps/{id}/grants/{scopeId}Remove a scope grantokta.appGrants.manage
GET /appsList appsokta.apps.read
POST /appsCreate a bookmark, OIDC or SAML appokta.apps.manageSee openapi.json
GET /apps/{id}Get an appokta.apps.read
PUT /apps/{id}Update an appokta.apps.manageSee openapi.json
DELETE /apps/{id}Delete an inactive appokta.apps.manage
POST /apps/{id}/lifecycle/activateActivate an appokta.apps.manage
POST /apps/{id}/lifecycle/deactivateDeactivate an appokta.apps.manage
GET /apps/{id}/usersList people assigned to an appokta.apps.read
POST /apps/{id}/usersAssign a person to an appokta.apps.managescope, credentials, profile
GET /apps/{id}/users/{userId}Get a person's assignmentokta.apps.read
DELETE /apps/{id}/users/{userId}Remove a person's assignmentokta.apps.manage
GET /apps/{id}/groupsList groups assigned to an appokta.apps.read
PUT /apps/{id}/groups/{groupId}Assign a group to an appokta.apps.manage
GET /apps/{id}/groups/{groupId}Get a group's assignmentokta.apps.read
DELETE /apps/{id}/groups/{groupId}Remove a group's assignmentokta.apps.manage
PUT /apps/{id}/policies/{policyId}Set an app's sign-on policyokta.apps.manage

Authorization servers

OperationWhat it doesOAuth scopeBody fields
GET /authorizationServersList authorization serversokta.authorizationServers.read
POST /authorizationServersCreate an authorization serverokta.authorizationServers.managename (required), description, audiences (required), issuerMode, issuer, credentials
GET /authorizationServers/{id}Get an authorization serverokta.authorizationServers.read
PUT /authorizationServers/{id}Update an authorization serverokta.authorizationServers.managename (required), description, audiences (required), issuerMode, issuer, credentials
DELETE /authorizationServers/{id}Delete an authorization serverokta.authorizationServers.manage
POST /authorizationServers/{id}/lifecycle/activateActivate an authorization serverokta.authorizationServers.manage
POST /authorizationServers/{id}/lifecycle/deactivateDeactivate an authorization serverokta.authorizationServers.manage
GET /authorizationServers/{id}/scopesList scopesokta.authorizationServers.read
POST /authorizationServers/{id}/scopesCreate a scopeokta.authorizationServers.managename (required), description, displayName, consent, metadataPublish, default, optional
GET /authorizationServers/{id}/scopes/{scopeId}Get a scopeokta.authorizationServers.read
PUT /authorizationServers/{id}/scopes/{scopeId}Update a scopeokta.authorizationServers.managename (required), description, displayName, consent, metadataPublish, default, optional
DELETE /authorizationServers/{id}/scopes/{scopeId}Delete a scopeokta.authorizationServers.manage
GET /authorizationServers/{id}/claimsList claimsokta.authorizationServers.read
POST /authorizationServers/{id}/claimsCreate a claimokta.authorizationServers.managename (required), claimType (required), valueType (required), value (required), alwaysIncludeInToken, conditions
GET /authorizationServers/{id}/claims/{claimId}Get a claimokta.authorizationServers.read
PUT /authorizationServers/{id}/claims/{claimId}Update a claimokta.authorizationServers.managename (required), claimType (required), valueType (required), value (required), alwaysIncludeInToken, conditions
DELETE /authorizationServers/{id}/claims/{claimId}Delete a claimokta.authorizationServers.manage
GET /authorizationServers/{id}/policiesList access policiesokta.authorizationServers.read
POST /authorizationServers/{id}/policiesCreate an access policyokta.authorizationServers.managetype (required), name (required), description, priority, conditions (required)
GET /authorizationServers/{id}/policies/{policyId}Get an access policyokta.authorizationServers.read
PUT /authorizationServers/{id}/policies/{policyId}Update an access policyokta.authorizationServers.managetype (required), name (required), description, priority, conditions (required)
DELETE /authorizationServers/{id}/policies/{policyId}Delete an access policyokta.authorizationServers.manage
POST /authorizationServers/{id}/policies/{policyId}/lifecycle/activateActivate an access policyokta.authorizationServers.manage
POST /authorizationServers/{id}/policies/{policyId}/lifecycle/deactivateDeactivate an access policyokta.authorizationServers.manage
GET /authorizationServers/{id}/policies/{policyId}/rulesList access rulesokta.authorizationServers.read
POST /authorizationServers/{id}/policies/{policyId}/rulesCreate an access ruleokta.authorizationServers.managetype (required), name (required), priority, conditions (required), actions
GET /authorizationServers/{id}/policies/{policyId}/rules/{ruleId}Get an access ruleokta.authorizationServers.read
PUT /authorizationServers/{id}/policies/{policyId}/rules/{ruleId}Update an access ruleokta.authorizationServers.managetype (required), name (required), priority, conditions (required), actions
DELETE /authorizationServers/{id}/policies/{policyId}/rules/{ruleId}Delete an access ruleokta.authorizationServers.manage
POST /authorizationServers/{id}/policies/{policyId}/rules/{ruleId}/lifecycle/activateActivate an access ruleokta.authorizationServers.manage
POST /authorizationServers/{id}/policies/{policyId}/rules/{ruleId}/lifecycle/deactivateDeactivate an access ruleokta.authorizationServers.manage

Policies

OperationWhat it doesOAuth scopeBody fields
GET /policiesList policies of a type: OKTA_SIGN_ON, ACCESS_POLICY or PASSWORDokta.policies.read
POST /policiesCreate a PASSWORD policyokta.policies.manage
GET /policies/{id}Get a policyokta.policies.read
PUT /policies/{id}Update a policyokta.policies.manage
DELETE /policies/{id}Delete a policyokta.policies.manage
POST /policies/{id}/lifecycle/activateActivate a policyokta.policies.manage
POST /policies/{id}/lifecycle/deactivateDeactivate a policyokta.policies.manage
GET /policies/{id}/rulesList a policy's rulesokta.policies.read
POST /policies/{id}/rulesCreate a ruleokta.policies.manage
GET /policies/{id}/rules/{ruleId}Get a ruleokta.policies.read
PUT /policies/{id}/rules/{ruleId}Update a ruleokta.policies.manage
DELETE /policies/{id}/rules/{ruleId}Delete a ruleokta.policies.manage
POST /policies/{id}/rules/{ruleId}/lifecycle/activateActivate a ruleokta.policies.manage
POST /policies/{id}/rules/{ruleId}/lifecycle/deactivateDeactivate a ruleokta.policies.manage

Network zones

OperationWhat it doesOAuth scopeBody fields
GET /zonesList network zonesokta.networkZones.read
POST /zonesCreate an IP or DYNAMIC zoneokta.networkZones.manageSee openapi.json
GET /zones/{id}Get a zoneokta.networkZones.read
PUT /zones/{id}Update a zoneokta.networkZones.manageSee openapi.json
DELETE /zones/{id}Delete a zoneokta.networkZones.manage
POST /zones/{id}/lifecycle/activateAnswers 200. Zones are always activeokta.networkZones.manage
POST /zones/{id}/lifecycle/deactivateAnswers 200 and changes nothing. Zones are always activeokta.networkZones.manage

Event hooks

OperationWhat it doesOAuth scopeBody fields
GET /eventHooksList event hooksokta.eventHooks.read
POST /eventHooksCreate an event hookokta.eventHooks.managename (required), description, events (required), channel (required)
GET /eventHooks/{id}Get an event hookokta.eventHooks.read
PUT /eventHooks/{id}Update an event hookokta.eventHooks.managename (required), description, events (required), channel (required)
DELETE /eventHooks/{id}Delete an inactive event hookokta.eventHooks.manage
POST /eventHooks/{id}/lifecycle/activateActivate an event hookokta.eventHooks.manage
POST /eventHooks/{id}/lifecycle/deactivateDeactivate an event hookokta.eventHooks.manage
POST /eventHooks/{id}/lifecycle/verifyVerify the endpoint of an event hookokta.eventHooks.manage

Admin API

Automate IdRa through its /api/v1 management API, compatible with core Okta resources: users, groups, System Log, applications, policies and event hooks.

idra CLI

SSH into servers with short-lived certificates issued by IdRa (Privileged Access).

On this page

What this reference doesn't coverUsersGroupsSystem LogAppsAuthorization serversPoliciesNetwork zonesEvent hooks