diff --git a/integrations/okta/manifest.yaml b/integrations/okta/manifest.yaml
new file mode 100644
index 0000000..27e98a6
--- /dev/null
+++ b/integrations/okta/manifest.yaml
@@ -0,0 +1,149 @@
+id: okta
+name: Okta
+version: 1.0.0
+description: "Okta (Core API) — identity containment and investigation: suspend/unsuspend/deactivate/unlock users, clear active sessions and tokens, expire passwords, reset MFA factors, read users and factors, query the System Log, and manage group membership. API-token (SSWS) authentication; stdlib-only, no extra Python dependencies."
+changelog: "1.0.0 — Initial release: user lifecycle (suspend/unsuspend/deactivate/unlock), clear sessions, expire password, reset factors, get/list users, get factors, system log, add/remove group membership."
+category: identity
+
+# Per-instance configuration. The API token is sent as 'Authorization: SSWS <api_token>'.
+config_schema:
+  properties:
+    base_url:
+      type: string
+      description: "Okta org URL (e.g. https://acme.okta.com)"
+    api_token:
+      type: string
+      description: "Okta API token (SSWS)"
+      x-soar-sensitive: true
+  required:
+    - base_url
+    - api_token
+
+commands:
+  - id: suspend_user
+    name: okta-suspend-user
+    description: "Suspend a user (blocks sign-in without deleting the account)."
+    inputs_schema:
+      properties:
+        user_id: { type: string, description: "User ID or login" }
+      required: [user_id]
+    outputs_schema: { properties: {} }
+  - id: unsuspend_user
+    name: okta-unsuspend-user
+    description: "Unsuspend a user (restores an ACTIVE status)."
+    inputs_schema:
+      properties:
+        user_id: { type: string, description: "User ID or login" }
+      required: [user_id]
+    outputs_schema: { properties: {} }
+  - id: deactivate_user
+    name: okta-deactivate-user
+    description: "Deactivate a user (stronger than suspend; requires reactivation to restore)."
+    inputs_schema:
+      properties:
+        user_id: { type: string, description: "User ID or login" }
+      required: [user_id]
+    outputs_schema: { properties: {} }
+  - id: unlock_user
+    name: okta-unlock-user
+    description: "Unlock a user that was locked out by failed sign-ins."
+    inputs_schema:
+      properties:
+        user_id: { type: string, description: "User ID or login" }
+      required: [user_id]
+    outputs_schema: { properties: {} }
+  - id: clear_user_sessions
+    name: okta-clear-user-sessions
+    description: "Revoke all of a user's active sessions and (optionally) OAuth tokens."
+    inputs_schema:
+      properties:
+        user_id: { type: string, description: "User ID" }
+        revoke_oauth_tokens: { type: boolean, description: "Also revoke OAuth refresh/access tokens (default true)" }
+      required: [user_id]
+    outputs_schema: { properties: {} }
+  - id: expire_password
+    name: okta-expire-password
+    description: "Expire a user's password, forcing a reset at next sign-in."
+    inputs_schema:
+      properties:
+        user_id: { type: string, description: "User ID or login" }
+      required: [user_id]
+    outputs_schema: { properties: {} }
+  - id: reset_factors
+    name: okta-reset-factors
+    description: "Reset (remove) all enrolled MFA factors for a user."
+    inputs_schema:
+      properties:
+        user_id: { type: string, description: "User ID" }
+      required: [user_id]
+    outputs_schema: { properties: {} }
+  - id: get_user
+    name: okta-get-user
+    description: "Get a user's profile and status."
+    risk: read
+    inputs_schema:
+      properties:
+        user_id: { type: string, description: "User ID or login" }
+      required: [user_id]
+    outputs_schema: { properties: {} }
+  - id: list_users
+    name: okta-list-users
+    description: "List/search users (free-text query or a filter/search expression)."
+    risk: read
+    inputs_schema:
+      properties:
+        query: { type: string, description: "Free-text search of name/email/username (q)" }
+        filter: { type: string, description: "Okta filter expression (e.g. status eq \"ACTIVE\")" }
+        search: { type: string, description: "Okta search expression (SCIM-like)" }
+        limit: { type: number, description: "Max users (default 50)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: get_user_factors
+    name: okta-get-user-factors
+    description: "List a user's enrolled MFA factors."
+    risk: read
+    inputs_schema:
+      properties:
+        user_id: { type: string, description: "User ID" }
+      required: [user_id]
+    outputs_schema: { properties: {} }
+  - id: get_logs
+    name: okta-get-logs
+    description: "Query the Okta System Log."
+    risk: read
+    inputs_schema:
+      properties:
+        query: { type: string, description: "Free-text query (q)" }
+        filter: { type: string, description: "SCIM filter expression" }
+        since: { type: string, description: "ISO-8601 start time" }
+        until: { type: string, description: "ISO-8601 end time" }
+        limit: { type: number, description: "Max events (default 100)" }
+      required: []
+    outputs_schema: { properties: {} }
+  - id: add_user_to_group
+    name: okta-add-user-to-group
+    description: "Add a user to a group."
+    inputs_schema:
+      properties:
+        group_id: { type: string, description: "Group ID" }
+        user_id: { type: string, description: "User ID" }
+      required: [group_id, user_id]
+    outputs_schema: { properties: {} }
+  - id: remove_user_from_group
+    name: okta-remove-user-from-group
+    description: "Remove a user from a group."
+    inputs_schema:
+      properties:
+        group_id: { type: string, description: "Group ID" }
+        user_id: { type: string, description: "User ID" }
+      required: [group_id, user_id]
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: okta-test-connection
+    description: "Verify connectivity and the API token (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }
diff --git a/integrations/okta/scripts/add_user_to_group.py b/integrations/okta/scripts/add_user_to_group.py
new file mode 100644
index 0000000..abc3b59
--- /dev/null
+++ b/integrations/okta/scripts/add_user_to_group.py
@@ -0,0 +1,60 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def request(method, path, cfg, body=None, params=None):
+    base = str(cfg.get("base_url", "")).rstrip("/") + "/api/v1"
+    url = base + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {
+        "Authorization": "SSWS " + str(cfg.get("api_token", "")),
+        "Accept": "application/json",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=60) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    group_id = inputs.get("group_id")
+    if not group_id:
+        raise Exception("group_id is required")
+    user_id = inputs.get("user_id")
+    if not user_id:
+        raise Exception("user_id is required")
+    q = lambda v: urllib.parse.quote(str(v), safe="")
+    request(
+        "PUT",
+        "/groups/{}/users/{}".format(q(group_id), q(user_id)),
+        cfg,
+        body=None,
+    )
+    return {"ok": True}
+
+
+_run(main)
diff --git a/integrations/okta/scripts/clear_user_sessions.py b/integrations/okta/scripts/clear_user_sessions.py
new file mode 100644
index 0000000..f37d17b
--- /dev/null
+++ b/integrations/okta/scripts/clear_user_sessions.py
@@ -0,0 +1,61 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def request(method, path, cfg, body=None, params=None):
+    base = str(cfg.get("base_url", "")).rstrip("/") + "/api/v1"
+    url = base + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {
+        "Authorization": "SSWS " + str(cfg.get("api_token", "")),
+        "Accept": "application/json",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=60) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    user_id = inputs.get("user_id")
+    if not user_id:
+        raise Exception("user_id is required")
+    revoke_oauth_tokens = inputs.get("revoke_oauth_tokens")
+    if revoke_oauth_tokens is None:
+        revoke_oauth_tokens = True
+    q = lambda v: urllib.parse.quote(str(v), safe="")
+    request(
+        "DELETE",
+        "/users/{}/sessions".format(q(user_id)),
+        cfg,
+        body=None,
+        params={"oauthTokens": "true" if revoke_oauth_tokens else "false"},
+    )
+    return {"ok": True}
+
+
+_run(main)
diff --git a/integrations/okta/scripts/deactivate_user.py b/integrations/okta/scripts/deactivate_user.py
new file mode 100644
index 0000000..03768af
--- /dev/null
+++ b/integrations/okta/scripts/deactivate_user.py
@@ -0,0 +1,58 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def request(method, path, cfg, body=None, params=None):
+    base = str(cfg.get("base_url", "")).rstrip("/") + "/api/v1"
+    url = base + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {
+        "Authorization": "SSWS " + str(cfg.get("api_token", "")),
+        "Accept": "application/json",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=60) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    user_id = inputs.get("user_id")
+    if not user_id:
+        raise Exception("user_id is required")
+    q = lambda v: urllib.parse.quote(str(v), safe="")
+    request(
+        "POST",
+        "/users/{}/lifecycle/deactivate".format(q(user_id)),
+        cfg,
+        body=None,
+        params={"sendEmail": "false"},
+    )
+    return {"ok": True}
+
+
+_run(main)
diff --git a/integrations/okta/scripts/expire_password.py b/integrations/okta/scripts/expire_password.py
new file mode 100644
index 0000000..53fa88b
--- /dev/null
+++ b/integrations/okta/scripts/expire_password.py
@@ -0,0 +1,51 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def request(method, path, cfg, body=None, params=None):
+    base = str(cfg.get("base_url", "")).rstrip("/") + "/api/v1"
+    url = base + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {
+        "Authorization": "SSWS " + str(cfg.get("api_token", "")),
+        "Accept": "application/json",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=60) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    user_id = inputs.get("user_id")
+    if not user_id:
+        raise Exception("user_id is required")
+    q = lambda v: urllib.parse.quote(str(v), safe="")
+    return request("POST", "/users/{}/lifecycle/expire_password".format(q(user_id)), cfg, body=None)
+
+
+_run(main)
diff --git a/integrations/okta/scripts/get_logs.py b/integrations/okta/scripts/get_logs.py
new file mode 100644
index 0000000..f37f271
--- /dev/null
+++ b/integrations/okta/scripts/get_logs.py
@@ -0,0 +1,58 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def request(method, path, cfg, body=None, params=None):
+    base = str(cfg.get("base_url", "")).rstrip("/") + "/api/v1"
+    url = base + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {
+        "Authorization": "SSWS " + str(cfg.get("api_token", "")),
+        "Accept": "application/json",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=60) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    query = inputs.get("query")
+    filter_ = inputs.get("filter")
+    since = inputs.get("since")
+    until = inputs.get("until")
+    limit = inputs.get("limit")
+    limit = int(limit) if limit not in (None, "") else 100
+    return request(
+        "GET",
+        "/logs",
+        cfg,
+        params={"q": query, "filter": filter_, "since": since, "until": until, "limit": limit},
+    )
+
+
+_run(main)
diff --git a/integrations/okta/scripts/get_user.py b/integrations/okta/scripts/get_user.py
new file mode 100644
index 0000000..db7987b
--- /dev/null
+++ b/integrations/okta/scripts/get_user.py
@@ -0,0 +1,51 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def request(method, path, cfg, body=None, params=None):
+    base = str(cfg.get("base_url", "")).rstrip("/") + "/api/v1"
+    url = base + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {
+        "Authorization": "SSWS " + str(cfg.get("api_token", "")),
+        "Accept": "application/json",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=60) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    user_id = inputs.get("user_id")
+    if not user_id:
+        raise Exception("user_id is required")
+    q = lambda v: urllib.parse.quote(str(v), safe="")
+    return request("GET", "/users/{}".format(q(user_id)), cfg)
+
+
+_run(main)
diff --git a/integrations/okta/scripts/get_user_factors.py b/integrations/okta/scripts/get_user_factors.py
new file mode 100644
index 0000000..efc8d72
--- /dev/null
+++ b/integrations/okta/scripts/get_user_factors.py
@@ -0,0 +1,51 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def request(method, path, cfg, body=None, params=None):
+    base = str(cfg.get("base_url", "")).rstrip("/") + "/api/v1"
+    url = base + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {
+        "Authorization": "SSWS " + str(cfg.get("api_token", "")),
+        "Accept": "application/json",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=60) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    user_id = inputs.get("user_id")
+    if not user_id:
+        raise Exception("user_id is required")
+    q = lambda v: urllib.parse.quote(str(v), safe="")
+    return request("GET", "/users/{}/factors".format(q(user_id)), cfg)
+
+
+_run(main)
diff --git a/integrations/okta/scripts/list_users.py b/integrations/okta/scripts/list_users.py
new file mode 100644
index 0000000..74718f8
--- /dev/null
+++ b/integrations/okta/scripts/list_users.py
@@ -0,0 +1,57 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def request(method, path, cfg, body=None, params=None):
+    base = str(cfg.get("base_url", "")).rstrip("/") + "/api/v1"
+    url = base + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {
+        "Authorization": "SSWS " + str(cfg.get("api_token", "")),
+        "Accept": "application/json",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=60) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    query = inputs.get("query")
+    filter_ = inputs.get("filter")
+    search = inputs.get("search")
+    limit = inputs.get("limit")
+    limit = int(limit) if limit not in (None, "") else 50
+    return request(
+        "GET",
+        "/users",
+        cfg,
+        params={"q": query, "filter": filter_, "search": search, "limit": limit},
+    )
+
+
+_run(main)
diff --git a/integrations/okta/scripts/remove_user_from_group.py b/integrations/okta/scripts/remove_user_from_group.py
new file mode 100644
index 0000000..d4ab3ed
--- /dev/null
+++ b/integrations/okta/scripts/remove_user_from_group.py
@@ -0,0 +1,59 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def request(method, path, cfg, body=None, params=None):
+    base = str(cfg.get("base_url", "")).rstrip("/") + "/api/v1"
+    url = base + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {
+        "Authorization": "SSWS " + str(cfg.get("api_token", "")),
+        "Accept": "application/json",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=60) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    group_id = inputs.get("group_id")
+    if not group_id:
+        raise Exception("group_id is required")
+    user_id = inputs.get("user_id")
+    if not user_id:
+        raise Exception("user_id is required")
+    q = lambda v: urllib.parse.quote(str(v), safe="")
+    request(
+        "DELETE",
+        "/groups/{}/users/{}".format(q(group_id), q(user_id)),
+        cfg,
+    )
+    return {"ok": True}
+
+
+_run(main)
diff --git a/integrations/okta/scripts/reset_factors.py b/integrations/okta/scripts/reset_factors.py
new file mode 100644
index 0000000..7f14f5f
--- /dev/null
+++ b/integrations/okta/scripts/reset_factors.py
@@ -0,0 +1,52 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def request(method, path, cfg, body=None, params=None):
+    base = str(cfg.get("base_url", "")).rstrip("/") + "/api/v1"
+    url = base + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {
+        "Authorization": "SSWS " + str(cfg.get("api_token", "")),
+        "Accept": "application/json",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=60) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    user_id = inputs.get("user_id")
+    if not user_id:
+        raise Exception("user_id is required")
+    q = lambda v: urllib.parse.quote(str(v), safe="")
+    request("POST", "/users/{}/lifecycle/reset_factors".format(q(user_id)), cfg, body=None)
+    return {"ok": True}
+
+
+_run(main)
diff --git a/integrations/okta/scripts/suspend_user.py b/integrations/okta/scripts/suspend_user.py
new file mode 100644
index 0000000..b4b1876
--- /dev/null
+++ b/integrations/okta/scripts/suspend_user.py
@@ -0,0 +1,52 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def request(method, path, cfg, body=None, params=None):
+    base = str(cfg.get("base_url", "")).rstrip("/") + "/api/v1"
+    url = base + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {
+        "Authorization": "SSWS " + str(cfg.get("api_token", "")),
+        "Accept": "application/json",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=60) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    user_id = inputs.get("user_id")
+    if not user_id:
+        raise Exception("user_id is required")
+    q = lambda v: urllib.parse.quote(str(v), safe="")
+    request("POST", "/users/{}/lifecycle/suspend".format(q(user_id)), cfg, body=None)
+    return {"ok": True}
+
+
+_run(main)
diff --git a/integrations/okta/scripts/test_connection.py b/integrations/okta/scripts/test_connection.py
new file mode 100644
index 0000000..cb1eeeb
--- /dev/null
+++ b/integrations/okta/scripts/test_connection.py
@@ -0,0 +1,48 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def request(method, path, cfg, body=None, params=None):
+    base = str(cfg.get("base_url", "")).rstrip("/") + "/api/v1"
+    url = base + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {
+        "Authorization": "SSWS " + str(cfg.get("api_token", "")),
+        "Accept": "application/json",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=60) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    request("GET", "/users", cfg, params={"limit": 1})
+    return {"ok": True}
+
+
+_run(main)
diff --git a/integrations/okta/scripts/unlock_user.py b/integrations/okta/scripts/unlock_user.py
new file mode 100644
index 0000000..3ee331c
--- /dev/null
+++ b/integrations/okta/scripts/unlock_user.py
@@ -0,0 +1,52 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def request(method, path, cfg, body=None, params=None):
+    base = str(cfg.get("base_url", "")).rstrip("/") + "/api/v1"
+    url = base + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {
+        "Authorization": "SSWS " + str(cfg.get("api_token", "")),
+        "Accept": "application/json",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=60) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    user_id = inputs.get("user_id")
+    if not user_id:
+        raise Exception("user_id is required")
+    q = lambda v: urllib.parse.quote(str(v), safe="")
+    request("POST", "/users/{}/lifecycle/unlock".format(q(user_id)), cfg, body=None)
+    return {"ok": True}
+
+
+_run(main)
diff --git a/integrations/okta/scripts/unsuspend_user.py b/integrations/okta/scripts/unsuspend_user.py
new file mode 100644
index 0000000..cf1975b
--- /dev/null
+++ b/integrations/okta/scripts/unsuspend_user.py
@@ -0,0 +1,52 @@
+import json, os, sys, urllib.parse, urllib.request, urllib.error
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def request(method, path, cfg, body=None, params=None):
+    base = str(cfg.get("base_url", "")).rstrip("/") + "/api/v1"
+    url = base + path
+    if params:
+        clean = {k: v for k, v in params.items() if v not in (None, "")}
+        if clean:
+            url += "?" + urllib.parse.urlencode(clean)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {
+        "Authorization": "SSWS " + str(cfg.get("api_token", "")),
+        "Accept": "application/json",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=60) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    user_id = inputs.get("user_id")
+    if not user_id:
+        raise Exception("user_id is required")
+    q = lambda v: urllib.parse.quote(str(v), safe="")
+    request("POST", "/users/{}/lifecycle/unsuspend".format(q(user_id)), cfg, body=None)
+    return {"ok": True}
+
+
+_run(main)