;}%20.st6{fill:url(%23SVGID_00000021089067129159788970000008246765442136188072_);}%20.st7{fill:url(%23SVGID_00000117639240116366130650000015074833605515028638_);}%20.st8{opacity:0.4;fill:url(%23SVGID_00000101781798616409025840000016567063639337360777_);}%20.st9{opacity:0.4;fill:url(%23SVGID_00000052086836598721292040000002033117744178971046_);}%20.st10{opacity:0.4;fill:url(%23SVGID_00000159460939004760751800000002448009281983951536_);}%20.st11{opacity:0.4;fill:url(%23SVGID_00000013177830667419993080000017721442101626521532_);}%20.st12{opacity:0.4;fill:url(%23SVGID_00000152235521444854938490000006526001119318383285_);}%20.st13{opacity:0.4;fill:url(%23SVGID_00000119823135212293698520000012774889010992664993_);}%20%3c/style%3e%3cg%3e%3cpolygon%20class='st2'%20points='134.78,14.22%20114.31,48.21%20101.33,69.75%20158.22,69.75%20177.97,36.95%20191.67,14.22%20'/%3e%3cpolygon%20class='st3'%20points='227.55,69.75%20186.61,69.75%20101.33,69.75%20129.78,119.02%20158.16,119.02%20228.61,119.02%20256,119.02%20'/%3e%3cpolygon%20class='st3'%20points='136.93,132.47%20116.46,167.93%2073.82,241.78%20130.71,241.78%20144.9,217.2%20180.13,156.18%20193.82,132.46%20'/%3e%3cpolygon%20class='st3'%20points='121.7,131.95%20101.23,96.49%2058.59,22.63%2030.15,71.91%2044.34,96.49%2079.57,157.5%2093.26,181.22%20'/%3e%3cpolygon%20class='st2'%20points='64.81,131.95%2025.15,131.21%200,130.74%2028.44,180.01%2066.73,180.72%2093.26,181.21%20'/%3e%3cpolygon%20class='st2'%20points='165.38,181.74%20184.58,216.46%20196.75,238.47%20225.19,189.2%20206.66,155.69%20193.83,132.46%20'/%3e%3c/g%3e%3c/svg%3e)
Windmill HubOkta
Identity Org URL and API tokenManage Okta users, groups and applications from any Windmill script, flow or app.
Set up in 3 steps
Create an API token
In the Okta admin console, open Security then API then Tokens, and create one. Copy it — it is shown only once.
Add the resource in Windmill
Open Resources, add a resource of type okta. org_url is your org's base URL — https://yourorg.okta.com — and token is the API token.
Run your first script
Fork any script below and read before writing anything.
Scripts
Building blocks, if none of the projects above fit. Fork one, run it, or call it as a step inside your own flow.
New System Log Event
Update User
Set User Lifecycle State
Remove User from Group
List Users
List User Factors
List Policies
List Groups
List Group Members
List Applications
List Application Users
Get User
Get System Log Events
Delete User
Create User
Create Group
Assign User to Application
Add User to Group
Trigger flows from Okta
Okta is not only a destination. These inbound paths are supported today.
New System Log event (scheduled poll)
The New System Log Event trigger script polls the Okta System Log and returns the events published since its last run, optionally narrowed by a filter expression. To run it, open a flow, add a trigger and choose Scheduled Poll, then pick the trigger script and an interval. The steps after it run once per new item, and each flow keeps its own cursor.
Resource type
The shape of the credential every script on this page expects.
okta
View raw schema →| Field | Type | Required | What it is |
|---|---|---|---|
| org_url | string | Yes | Your Okta org base URL, without a trailing slash, e.g. https://dev-123456.okta.com or https://acme.okta.com. All API calls are made against this host under /api/v1. |
| token | string | Yes | Okta API token (SSWS). Create one in the Admin Console under Security > API > Tokens. It inherits the permissions of the admin who created it. |
Questions
What can the token do?
Exactly what the admin who created it can: Okta resolves permissions from that user.
The token stops working after a while
Okta expires API tokens that go unused for 30 days. A scheduled flow keeps one alive; an occasional script may find it dead.
Is my token stored on the hub?
Never. It lives only in your own Windmill workspace, encrypted at rest.