Okta - Atako

Let your agents manage users, groups, applications and audit logs in your Okta organization — list, create and update users, manage group membership, query app assignments and review the system log.

Connection

Authentication: API key (API token).
Required settings:
- Organization — The subdomain before .okta.com / .oktapreview.com / .okta-emea.com in your admin URL (e.g. “acme” from acme-admin.okta.com).
- Domain suffix — The Okta domain suffix for your org: okta.com (production), oktapreview.com (preview), or okta-emea.com (EMEA).

Sign in to the Okta Admin Console → Security → API → Tokens → Create token. Name it, copy the token (starts with 00…). The token inherits your admin role — use a dedicated API service account with the minimum required roles (Read-only Administrator for read-only, or Super Administrator for write).See Okta’s documentation.

Read actions (11)

Action	Description
`get_app`	Get a single application by ID.
`get_group`	Get a single group by ID.
`get_user`	Get a single user by ID.
`list_app_users`	List users assigned to an application. Supports pagination (limit ≤ 200).
`list_apps`	List applications in the organization. Supports search (q), filter and pagination (limit ≤ 200).
`list_group_members`	List users who are members of a group. Supports pagination (limit ≤ 200).
`list_groups`	List groups in the organization. Supports search (q), filter and pagination (limit ≤ 200).
`list_logs`	List system log events. Supports filter (SCIM), q (keyword search), since/until (ISO 8601 timestamps), limit (≤ 1000) and sortOrder (ascending/descending).
`list_user_app_links`	List SSO application links for a user (apps the user can access via SSO).
`list_user_groups`	List groups a user belongs to.
`list_users`	List users in the organization. Supports search (SCIM filter), query, status filter and pagination (limit ≤ 200).

Write actions (10)

Action	Description
`activate_user`	Activate a STAGED or SUSPENDED user. sendEmail: boolean — if true, Okta sends an activation email; if false, the response includes an activationToken string.
`add_user_to_group`	Add a user to a group. This is a membership operation, not a resource deletion.
`create_user`	Create a user. Required: profile object with firstName (string), lastName (string), email (string, used as primary email), login (string, used as primary login). Optional in profile: mobilePhone (string). Optional query params: activate (boolean, default true — if false the user is created in STAGED status), sendEmail (boolean — if true Okta sends an activation email). The credentials block (password) is NOT exposed; use lifecycle/activate or reset_password_email to set credentials.
`deactivate_user`	Deactivate a user. Terminates all active sessions and resets SSO tokens. The user can be reactivated.
`remove_user_from_group`	Remove a user from a group. This is a membership removal, not a user deletion.
`reset_password_email`	Trigger a password reset email for a user. The user receives a link to set a new password.
`suspend_user`	Suspend an active user. Prevents SSO and API access. Use unsuspend to restore.
`unlock_user`	Unlock a user locked out due to excessive failed authentications.
`unsuspend_user`	Unsuspend a suspended user, restoring SSO and API access.
`update_user_profile`	Update a user profile. Pass only the fields to change inside a profile object: firstName (string), lastName (string), email (string), login (string), mobilePhone (string). Omitted fields are unchanged.

Permissions

Every action above must be explicitly granted to an agent before it can be used. See Permissions for the grant model and Security for how credentials are protected.

Last reviewed against the provider API: September 2026.