> ## Documentation Index > Fetch the complete documentation index at: https://docs.atako.ai/llms.txt > Use this file to discover all available pages before exploring further. # Okta > Connect Okta to your Atako agents — 11 read and 10 write actions. Let your agents manage users, groups, applications and audit logs in your Okta organization — list, create and update users, manage group membership, query app assignments and review the system log. ## Connection * **Authentication**: API key (API token). * **Required settings**: * **Organization** — The subdomain before .okta.com / .oktapreview\.com / .okta-emea.com in your admin URL (e.g. "acme" from acme-admin.okta.com). * **Domain suffix** — The Okta domain suffix for your org: okta.com (production), oktapreview\.com (preview), or okta-emea.com (EMEA). Sign in to the Okta Admin Console → Security → API → Tokens → Create token. Name it, copy the token (starts with 00…). The token inherits your admin role — use a dedicated API service account with the minimum required roles (Read-only Administrator for read-only, or Super Administrator for write). See [Okta's documentation](https://developer.okta.com/docs/reference/api/users/). ## Read actions (11) | Action | Description | | --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | | `get_app` | Get a single application by ID. | | `get_group` | Get a single group by ID. | | `get_user` | Get a single user by ID. | | `list_app_users` | List users assigned to an application. Supports pagination (limit ≤ 200). | | `list_apps` | List applications in the organization. Supports search (q), filter and pagination (limit ≤ 200). | | `list_group_members` | List users who are members of a group. Supports pagination (limit ≤ 200). | | `list_groups` | List groups in the organization. Supports search (q), filter and pagination (limit ≤ 200). | | `list_logs` | List system log events. Supports filter (SCIM), q (keyword search), since/until (ISO 8601 timestamps), limit (≤ 1000) and sortOrder (ascending/descending). | | `list_user_app_links` | List SSO application links for a user (apps the user can access via SSO). | | `list_user_groups` | List groups a user belongs to. | | `list_users` | List users in the organization. Supports search (SCIM filter), query, status filter and pagination (limit ≤ 200). | ## Write actions (10) | Action | Description | | ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `activate_user` | Activate a STAGED or SUSPENDED user. sendEmail: boolean — if true, Okta sends an activation email; if false, the response includes an activationToken string. | | `add_user_to_group` | Add a user to a group. This is a membership operation, not a resource deletion. | | `create_user` | Create a user. Required: profile object with firstName (string), lastName (string), email (string, used as primary email), login (string, used as primary login). Optional in profile: mobilePhone (string). Optional query params: activate (boolean, default true — if false the user is created in STAGED status), sendEmail (boolean — if true Okta sends an activation email). The credentials block (password) is NOT exposed; use lifecycle/activate or reset\_password\_email to set credentials. | | `deactivate_user` | Deactivate a user. Terminates all active sessions and resets SSO tokens. The user can be reactivated. | | `remove_user_from_group` | Remove a user from a group. This is a membership removal, not a user deletion. | | `reset_password_email` | Trigger a password reset email for a user. The user receives a link to set a new password. | | `suspend_user` | Suspend an active user. Prevents SSO and API access. Use unsuspend to restore. | | `unlock_user` | Unlock a user locked out due to excessive failed authentications. | | `unsuspend_user` | Unsuspend a suspended user, restoring SSO and API access. | | `update_user_profile` | Update a user profile. Pass only the fields to change inside a profile object: firstName (string), lastName (string), email (string), login (string), mobilePhone (string). Omitted fields are unchanged. | ## Permissions Every action above must be explicitly granted to an agent before it can be used. See [Permissions](/integrations/permissions) for the grant model and [Security](/integrations/security) for how credentials are protected. *** *Last reviewed against the provider API: September 2026.*