Okta

Identity Org URL and API token

Manage Okta users, groups and applications from any Windmill script, flow or app.

Set up in 3 steps

Create an API token

In the Okta admin console, open Security then API then Tokens, and create one. Copy it — it is shown only once.

Add the resource in Windmill

Open Resources, add a resource of type okta. org_url is your org's base URL — https://yourorg.okta.com — and token is the API token.

Run your first script

Fork any script below and read before writing anything.

Scripts

Building blocks, if none of the projects above fit. Fork one, run it, or call it as a step inside your own flow.

Submit a script →

Trigger flows from Okta

Okta is not only a destination. These inbound paths are supported today.

New System Log event (scheduled poll)

The New System Log Event trigger script polls the Okta System Log and returns the events published since its last run, optionally narrowed by a filter expression. To run it, open a flow, add a trigger and choose Scheduled Poll, then pick the trigger script and an interval. Windmill puts the script first in the flow with a loop after it, so the steps you add run once per new item. The cursor is saved per flow: two flows polling the same source each get every item, and test runs keep a cursor of their own.

Resource type

The shape of the credential every script on this page expects.

okta

View raw schema →

Field	Type	Required	What it is
org_url	string	Yes	Your Okta org base URL, without a trailing slash, e.g. https://dev-123456.okta.com or https://acme.okta.com. All API calls are made against this host under /api/v1.
token	string	Yes	Okta API token (SSWS). Create one in the Admin Console under Security > API > Tokens. It inherits the permissions of the admin who created it.

Questions

What can the token do?

Exactly what the admin who created it can. Okta resolves permissions from that user, so create the token on an account with the narrowest admin role that works.

The token stops working after a while

Okta expires API tokens that go unused for 30 days. A scheduled flow keeps one alive; an occasional script may find it dead.

Is my token stored on the hub?

Never. It lives only in your own Windmill workspace, encrypted at rest.

Set up in 3 steps

Create an API token

Add the resource in Windmill

Run your first script

Scripts

New System Log Event

Update User

Set User Lifecycle State

Remove User from Group

List Users

List User Factors

List Policies

List Groups

List Group Members

List Applications

List Application Users

Get User

Get System Log Events

Delete User

Create User

Create Group

Assign User to Application

Add User to Group

Trigger flows from Okta

New System Log event (scheduled poll)

Resource type

okta

Questions