riposte-marketplace/integrations/okta/manifest.yaml

id: okta
name: Okta
version: 1.1.1
description: "Okta (Core API) — identity containment and investigation: suspend/unsuspend/deactivate/unlock users, clear active sessions and tokens, expire passwords, reset MFA factors, read users and factors, query the System Log, and manage group membership. API-token (SSWS) authentication; stdlib-only, no extra Python dependencies."
changelog: "1.1.0 — Declare the risk tier on the 9 commands that carried none, all of them destructive. An unset risk was already gated as destructive, so the approval prompt does not move; what changes is that the tier is a stated decision rather than a default, and a command added later cannot inherit it by omission. | 1.0.0 — Initial release: user lifecycle (suspend/unsuspend/deactivate/unlock), clear sessions, expire password, reset factors, get/list users, get factors, system log, add/remove group membership."
category: identity

# Per-instance configuration. The API token is sent as 'Authorization: SSWS <api_token>'.
config_schema:
  properties:
    base_url:
      type: string
      description: "Okta org URL (e.g. https://acme.okta.com)"
    api_token:
      type: string
      description: "Okta API token (SSWS)"
      x-soar-sensitive: true
  required:
    - base_url
    - api_token

commands:
  - id: suspend_user
    name: okta-suspend-user
    description: "Suspend a user (blocks sign-in without deleting the account)."
    risk: destructive
    inputs_schema:
      properties:
        user_id: { type: string, description: "User ID or login" }
      required: [user_id]
    outputs_schema: { properties: {} }
  - id: unsuspend_user
    name: okta-unsuspend-user
    description: "Unsuspend a user (restores an ACTIVE status)."
    risk: destructive
    inputs_schema:
      properties:
        user_id: { type: string, description: "User ID or login" }
      required: [user_id]
    outputs_schema: { properties: {} }
  - id: deactivate_user
    name: okta-deactivate-user
    description: "Deactivate a user (stronger than suspend; requires reactivation to restore)."
    risk: destructive
    inputs_schema:
      properties:
        user_id: { type: string, description: "User ID or login" }
      required: [user_id]
    outputs_schema: { properties: {} }
  - id: unlock_user
    name: okta-unlock-user
    description: "Unlock a user that was locked out by failed sign-ins."
    risk: destructive
    inputs_schema:
      properties:
        user_id: { type: string, description: "User ID or login" }
      required: [user_id]
    outputs_schema: { properties: {} }
  - id: clear_user_sessions
    name: okta-clear-user-sessions
    description: "Revoke all of a user's active sessions and (optionally) OAuth tokens."
    risk: destructive
    inputs_schema:
      properties:
        user_id: { type: string, description: "User ID" }
        revoke_oauth_tokens: { type: boolean, description: "Also revoke OAuth refresh/access tokens (default true)" }
      required: [user_id]
    outputs_schema: { properties: {} }
  - id: expire_password
    name: okta-expire-password
    description: "Expire a user's password, forcing a reset at next sign-in."
    risk: destructive
    inputs_schema:
      properties:
        user_id: { type: string, description: "User ID or login" }
      required: [user_id]
    outputs_schema: { properties: {} }
  - id: reset_factors
    name: okta-reset-factors
    description: "Reset (remove) all enrolled MFA factors for a user."
    risk: destructive
    inputs_schema:
      properties:
        user_id: { type: string, description: "User ID" }
      required: [user_id]
    outputs_schema: { properties: {} }
  - id: get_user
    name: okta-get-user
    description: "Get a user's profile and status."
    risk: read
    inputs_schema:
      properties:
        user_id: { type: string, description: "User ID or login" }
      required: [user_id]
    outputs_schema: { properties: {} }
  - id: list_users
    name: okta-list-users
    description: "List/search users (free-text query or a filter/search expression)."
    risk: read
    inputs_schema:
      properties:
        query: { type: string, description: "Free-text search of name/email/username (q)" }
        filter: { type: string, description: "Okta filter expression (e.g. status eq \"ACTIVE\")" }
        search: { type: string, description: "Okta search expression (SCIM-like)" }
        limit: { type: number, description: "Max users (default 50)" }
      required: []
    outputs_schema: { properties: {} }
  - id: get_user_factors
    name: okta-get-user-factors
    description: "List a user's enrolled MFA factors."
    risk: read
    inputs_schema:
      properties:
        user_id: { type: string, description: "User ID" }
      required: [user_id]
    outputs_schema: { properties: {} }
  - id: get_logs
    name: okta-get-logs
    description: "Query the Okta System Log."
    risk: read
    inputs_schema:
      properties:
        query: { type: string, description: "Free-text query (q)" }
        filter: { type: string, description: "SCIM filter expression" }
        since: { type: string, description: "ISO-8601 start time" }
        until: { type: string, description: "ISO-8601 end time" }
        limit: { type: number, description: "Max events (default 100)" }
      required: []
    outputs_schema: { properties: {} }
  - id: add_user_to_group
    name: okta-add-user-to-group
    description: "Add a user to a group."
    risk: destructive
    inputs_schema:
      properties:
        group_id: { type: string, description: "Group ID" }
        user_id: { type: string, description: "User ID" }
      required: [group_id, user_id]
    outputs_schema: { properties: {} }
  - id: remove_user_from_group
    name: okta-remove-user-from-group
    description: "Remove a user from a group."
    risk: destructive
    inputs_schema:
      properties:
        group_id: { type: string, description: "Group ID" }
        user_id: { type: string, description: "User ID" }
      required: [group_id, user_id]
    outputs_schema: { properties: {} }

  - id: test_connection
    name: okta-test-connection
    description: "Verify connectivity and the API token (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }