Okta User API

openapi: 3.0.1
info:
  title: Okta Application User API
  description: Allows customers to easily access the Okta API
  termsOfService: https://developer.okta.com/terms/
  contact:
    name: Okta Developer Team
    url: https://developer.okta.com/
    email: devex-public@okta.com
  license:
    name: Apache-2.0
    url: https://www.apache.org/licenses/LICENSE-2.0.html
  version: 2.16.0
servers:
- url: https://your-subdomain.okta.com/
tags:
- name: User
paths:
  /api/v1/users:
    get:
      tags:
      - User
      summary: Okta List Users
      description: Lists users that do not have a status of 'DEPROVISIONED' (by default), up to the maximum (200 for most orgs), with pagination in most cases. A subset of users can be returned that match a supported filter expression or search criteria.
      operationId: listUsers
      parameters:
      - name: q
        in: query
        description: Finds a user that matches firstName, lastName, and email properties
        schema:
          type: string
      - name: after
        in: query
        description: Specifies the pagination cursor for the next page of users
        schema:
          type: string
      - name: limit
        in: query
        description: Specifies the number of results returned
        schema:
          type: integer
          format: int32
          default: 10
      - name: filter
        in: query
        description: Filters users with a supported expression for a subset of properties
        schema:
          type: string
      - name: search
        in: query
        description: Searches for users with a supported filtering  expression for most properties
        schema:
          type: string
      - name: sortBy
        in: query
        schema:
          type: string
      - name: sortOrder
        in: query
        schema:
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/User'
      security:
      - api_token: []
    post:
      tags:
      - User
      summary: Okta Create User
      description: Creates a new user in your Okta organization with or without credentials.
      operationId: createUser
      parameters:
      - name: activate
        in: query
        description: Executes activation lifecycle operation when creating the user
        schema:
          type: boolean
          default: true
      - name: provider
        in: query
        description: Indicates whether to create a user with a specified authentication provider
        schema:
          type: boolean
          default: false
      - name: nextLogin
        in: query
        description: With activate=true, set nextLogin to "changePassword" to have the password be EXPIRED, so user must change it the next time they log in.
        schema:
          type: string
          x-okta-added-version: 0.14.0
          x-openapi-v3-schema-ref: '#/definitions/UserNextLogin'
        x-okta-added-version: 0.14.0
        x-openapi-v3-schema-ref: '#/definitions/UserNextLogin'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateUserRequest'
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/User'
      security:
      - api_token: []
      x-codegen-request-body-name: body
  /api/v1/users/{associatedUserId}/linkedObjects/{primaryRelationshipName}/{primaryUserId}:
    put:
      tags:
      - User
      operationId: setLinkedObjectForUser
      parameters:
      - name: associatedUserId
        in: path
        required: true
        schema:
          type: string
      - name: primaryRelationshipName
        in: path
        required: true
        schema:
          type: string
      - name: primaryUserId
        in: path
        required: true
        schema:
          type: string
      responses:
        '204':
          description: Success
          content: {}
      security:
      - api_token: []
  /api/v1/users/{userId}:
    get:
      tags:
      - User
      summary: Okta Get User
      description: Fetches a user from your Okta organization.
      operationId: getUser
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/User'
      security:
      - api_token: []
    put:
      tags:
      - User
      summary: Okta Update User
      description: Update a user's profile and/or credentials using strict-update semantics.
      operationId: updateUser
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      - name: strict
        in: query
        schema:
          type: boolean
          x-okta-added-version: 1.10.0
        x-okta-added-version: 1.10.0
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/User'
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/User'
      security:
      - api_token: []
      x-codegen-request-body-name: user
    post:
      tags:
      - User
      description: Update a user's profile or credentials with partial update semantics.
      operationId: partialUpdateUser
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      - name: strict
        in: query
        schema:
          type: boolean
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/User'
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/User'
      security:
      - api_token: []
      x-codegen-request-body-name: user
    delete:
      tags:
      - User
      summary: Okta Delete User
      description: Deletes a user permanently.  This operation can only be performed on users that have a `DEPROVISIONED` status.  **This action cannot be recovered!**
      operationId: deactivateOrDeleteUser
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      - name: sendEmail
        in: query
        schema:
          type: boolean
          default: false
          x-okta-added-version: 1.5.0
        x-okta-added-version: 1.5.0
      responses:
        '202':
          description: ACCEPTED
          content: {}
      security:
      - api_token: []
  /api/v1/users/{userId}/appLinks:
    get:
      tags:
      - User
      summary: Okta Get Assigned App Links
      description: Fetches appLinks for all direct or indirect (via group membership) assigned applications.
      operationId: listAppLinks
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/AppLink'
      security:
      - api_token: []
  /api/v1/users/{userId}/clients:
    get:
      tags:
      - User
      description: Lists all client resources for which the specified user has grants or tokens.
      operationId: listUserClients
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/OAuth2Client'
      security:
      - api_token: []
  /api/v1/users/{userId}/clients/{clientId}/grants:
    get:
      tags:
      - User
      description: Lists all grants for a specified user and client
      operationId: listGrantsForUserAndClient
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      - name: clientId
        in: path
        required: true
        schema:
          type: string
      - name: expand
        in: query
        schema:
          type: string
      - name: after
        in: query
        schema:
          type: string
      - name: limit
        in: query
        schema:
          type: integer
          format: int32
          default: 20
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/OAuth2ScopeConsentGrant'
      security:
      - api_token: []
    delete:
      tags:
      - User
      description: Revokes all grants for the specified user and client
      operationId: revokeGrantsForUserAndClient
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      - name: clientId
        in: path
        required: true
        schema:
          type: string
      responses:
        '204':
          description: No Content
          content: {}
      security:
      - api_token: []
  /api/v1/users/{userId}/clients/{clientId}/tokens:
    get:
      tags:
      - User
      description: Lists all refresh tokens issued for the specified User and Client.
      operationId: listRefreshTokensForUserAndClient
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      - name: clientId
        in: path
        required: true
        schema:
          type: string
      - name: expand
        in: query
        schema:
          type: string
      - name: after
        in: query
        schema:
          type: string
      - name: limit
        in: query
        schema:
          type: integer
          format: int32
          default: 20
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/OAuth2RefreshToken'
      security:
      - api_token: []
    delete:
      tags:
      - User
      description: Revokes all refresh tokens issued for the specified User and Client.
      operationId: revokeTokensForUserAndClient
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      - name: clientId
        in: path
        required: true
        schema:
          type: string
      responses:
        '204':
          description: No Content
          content: {}
      security:
      - api_token: []
  /api/v1/users/{userId}/clients/{clientId}/tokens/{tokenId}:
    get:
      tags:
      - User
      description: Gets a refresh token issued for the specified User and Client.
      operationId: getRefreshTokenForUserAndClient
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      - name: clientId
        in: path
        required: true
        schema:
          type: string
      - name: tokenId
        in: path
        required: true
        schema:
          type: string
      - name: expand
        in: query
        schema:
          type: string
      - name: limit
        in: query
        schema:
          type: integer
          default: 20
      - name: after
        in: query
        schema:
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuth2RefreshToken'
      security:
      - api_token: []
    delete:
      tags:
      - User
      description: Revokes the specified refresh token.
      operationId: revokeTokenForUserAndClient
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      - name: clientId
        in: path
        required: true
        schema:
          type: string
      - name: tokenId
        in: path
        required: true
        schema:
          type: string
      responses:
        '204':
          description: No Content
          content: {}
      security:
      - api_token: []
  /api/v1/users/{userId}/credentials/change_password:
    post:
      tags:
      - User
      summary: Okta Change Password
      description: Changes a user's password by validating the user's current password. This operation can only be performed on users in `STAGED`, `ACTIVE`, `PASSWORD_EXPIRED`, or `RECOVERY` status that have a valid password credential
      operationId: changePassword
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      - name: strict
        in: query
        schema:
          type: boolean
          x-okta-added-version: 1.10.0
        x-okta-added-version: 1.10.0
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ChangePasswordRequest'
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserCredentials'
      security:
      - api_token: []
      x-codegen-request-body-name: changePasswordRequest
  /api/v1/users/{userId}/credentials/change_recovery_question:
    post:
      tags:
      - User
      summary: Okta Change Recovery Question
      description: Changes a user's recovery question & answer credential by validating the user's current password.  This operation can only be performed on users in **STAGED**, **ACTIVE** or **RECOVERY** `status` that have a valid password credential
      operationId: changeRecoveryQuestion
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UserCredentials'
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserCredentials'
      security:
      - api_token: []
      x-codegen-request-body-name: userCredentials
  /api/v1/users/{userId}/credentials/forgot_password:
    post:
      tags:
      - User
      summary: Okta Forgot Password
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForgotPasswordResponse'
      security:
      - api_token: []
      x-okta-multi-operation:
      - description: Generates a one-time token (OTT) that can be used to reset a user's password
        operationId: forgotPasswordGenerateOneTimeToken
        parameters:
        - default: true
          in: query
          name: sendEmail
          type: boolean
      - description: Sets a new password for a user by validating the user's answer to their current recovery question
        operationId: forgotPasswordSetNewPassword
        parameters:
        - in: body
          name: user
          required: true
          schema:
            $ref: '#/definitions/UserCredentials'
        - default: true
          in: query
          name: sendEmail
          type: boolean
  /api/v1/users/{userId}/grants:
    get:
      tags:
      - User
      description: Lists all grants for the specified user
      operationId: listUserGrants
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      - name: scopeId
        in: query
        schema:
          type: string
      - name: expand
        in: query
        schema:
          type: string
      - name: after
        in: query
        schema:
          type: string
      - name: limit
        in: query
        schema:
          type: integer
          format: int32
          default: 20
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/OAuth2ScopeConsentGrant'
      security:
      - api_token: []
    delete:
      tags:
      - User
      description: Revokes all grants for a specified user
      operationId: revokeUserGrants
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      responses:
        '204':
          description: No Content
          content: {}
      security:
      - api_token: []
  /api/v1/users/{userId}/grants/{grantId}:
    get:
      tags:
      - User
      description: Gets a grant for the specified user
      operationId: getUserGrant
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      - name: grantId
        in: path
        required: true
        schema:
          type: string
      - name: expand
        in: query
        schema:
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuth2ScopeConsentGrant'
      security:
      - api_token: []
    delete:
      tags:
      - User
      description: Revokes one grant for a specified user
      operationId: revokeUserGrant
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      - name: grantId
        in: path
        required: true
        schema:
          type: string
      responses:
        '204':
          description: No Content
          content: {}
      security:
      - api_token: []
  /api/v1/users/{userId}/groups:
    get:
      tags:
      - User
      summary: Okta Get Member Groups
      description: Fetches the groups of which the user is a member.
      operationId: listUserGroups
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Group'
      security:
      - api_token: []
  /api/v1/users/{userId}/idps:
    get:
      tags:
      - User
      summary: Okta Listing IdPs associated with a user
      description: Lists the IdPs associated with the user.
      operationId: listUserIdentityProviders
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/IdentityProvider'
      security:
      - api_token: []
  /api/v1/users/{userId}/lifecycle/activate:
    post:
      tags:
      - User
      summary: Okta Activate User
      description: Activates a user.  This operation can only be performed on users with a `STAGED` status.  Activation of a user is an asynchronous operation. The user will have the `transitioningToStatus` property with a value of `ACTIVE` during activation to indicate that the user hasn't completed the asynchronous operation.  The user will have a status of `ACTIVE` when the activation process is complete.
      operationId: activateUser
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      - name: sendEmail
        in: query
        description: Sends an activation email to the user if true
        required: true
        schema:
          type: boolean
          default: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserActivationToken'
      security:
      - api_token: []
  /api/v1/users/{userId}/lifecycle/deactivate:
    post:
      tags:
      - User
      summary: Okta Deactivate User
      description: 'Deactivates a user. This operation can only be performed on users that do not have a `DEPROVISIONED` status. While the asynchronous operation (triggered by HTTP header `Prefer: respond-async`) is proceeding the user''s `transitioningToStatus` property is `DEPROVISIONED`. The user''s status is `DEPROVISIONED` when the deactivation process is complete.'
      operationId: deactivateUser
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      - name: sendEmail
        in: query
        schema:
          type: boolean
          default: false
          x-okta-added-version: 1.5.0
        x-okta-added-version: 1.5.0
      responses:
        '200':
          description: OK
          content: {}
      security:
      - api_token: []
  /api/v1/users/{userId}/lifecycle/expire_password?tempPassword=false:
    post:
      tags:
      - User
      summary: Okta Expire Password
      description: This operation transitions the user to the status of `PASSWORD_EXPIRED` so that the user is required to change their password at their next login.
      operationId: expirePassword
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/User'
      security:
      - api_token: []
  /api/v1/users/{userId}/lifecycle/expire_password?tempPassword=true:
    post:
      tags:
      - User
      summary: Okta Expire Password
      description: This operation transitions the user to the status of `PASSWORD_EXPIRED` and the user's password is reset to a temporary password that is returned.
      operationId: expirePasswordAndGetTemporaryPassword
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TempPassword'
      security:
      - api_token: []
  /api/v1/users/{userId}/lifecycle/reactivate:
    post:
      tags:
      - User
      summary: Okta Reactivate User
      description: Reactivates a user.  This operation can only be performed on users with a `PROVISIONED` status.  This operation restarts the activation workflow if for some reason the user activation was not completed when using the activationToken from [Activate User](#activate-user).
      operationId: reactivateUser
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      - name: sendEmail
        in: query
        description: Sends an activation email to the user if true
        schema:
          type: boolean
          default: false
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserActivationToken'
      security:
      - api_token: []
  /api/v1/users/{userId}/lifecycle/reset_factors:
    post:
      tags:
      - User
      summary: Okta Reset Factors
      description: This operation resets all factors for the specified user. All MFA factor enrollments returned to the unenrolled state. The user's status remains ACTIVE. This link is present only if the user is currently enrolled in one or more MFA factors.
      operationId: resetFactors
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
          content: {}
      security:
      - api_token: []
  /api/v1/users/{userId}/lifecycle/reset_password:
    post:
      tags:
      - User
      summary: Okta Reset Password
      description: Generates a one-time token (OTT) that can be used to reset a user's password.  The OTT link can be automatically emailed to the user or returned to the API caller and distributed using a custom flow.
      operationId: resetPassword
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      - name: sendEmail
        in: query
        required: true
        schema:
          type: boolean
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResetPasswordToken'
      security:
      - api_token: []
  /api/v1/users/{userId}/lifecycle/suspend:
    post:
      tags:
      - User
      summary: Okta Suspend User
      description: Suspends a user.  This operation can only be performed on users with an `ACTIVE` status.  The user will have a status of `SUSPENDED` when the process is complete.
      operationId: suspendUser
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
          content: {}
      security:
      - api_token: []
  /api/v1/users/{userId}/lifecycle/unlock:
    post:
      tags:
      - User
      summary: Okta Unlock User
      description: Unlocks a user with a `LOCKED_OUT` status and returns them to `ACTIVE` status.  Users will be able to login with their current password.
      operationId: unlockUser
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success
          content: {}
      security:
      - api_token: []
  /api/v1/users/{userId}/lifecycle/unsuspend:
    post:
      tags:
      - User
      summary: Okta Unsuspend User
      description: Unsuspends a user and returns them to the `ACTIVE` state.  This operation can only be performed on users that have a `SUSPENDED` status.
      operationId: unsuspendUser
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success
          content: {}
      security:
      - api_token: []
  /api/v1/users/{userId}/linkedObjects/{relationshipName}:
    get:
      tags:
      - User
      description: Get linked objects for a user, relationshipName can be a primary or associated relationship name
      operationId: getLinkedObjectsForUser
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      - name: relationshipName
        in: path
        required: true
        schema:
          type: string
      - name: after
        in: query
        schema:
          type: string
      - name: limit
        in: query
        schema:
          type: integer
          format: int32
          default: -1
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/ResponseLinks'
      security:
      - api_token: []
    delete:
      tags:
      - User
      description: Delete linked objects for a user, relationshipName can be ONLY a primary relationship name
      operationId: removeLinkedObjectForUser
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      - name: relationshipName
        in: path
        required: true
        schema:
          type: string
      responses:
        '204':
          description: No Content
          content: {}
      security:
      - api_token: []
  /api/v1/users/{userId}/roles:
    get:
      tags:
      - User
      description: Lists all roles assigned to a user.
      operationId: listAssignedRolesForUser
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      - name: expand
        in: query
        schema:
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Role'
      security:
      - api_token: []
    post:
      tags:
      - User
      description: Assigns a role to a user.
      operationId: assignRoleToUser
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      - name: disableNotifications
        in: query
        schema:
          type: boolean
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AssignRoleRequest'
        required: true
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Role'
      security:
      - api_token: []
      x-codegen-request-body-name: assignRoleRequest
  /api/v1/users/{userId}/roles/{roleId}:
    get:
      tags:
      - User
      description: Gets role that is assigne to user.
      operationId: getUserRole
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      - name: roleId
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Role'
      security:
      - api_token: []
    delete:
      tags:
      - User
      description: Unassigns a role from a user.
      operationId: removeRoleFromUser
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      - name: roleId
        in: path
        required: true
        schema:
          type: string
      responses:
        '204':
          description: No Content
          content: {}
      security:
      - api_token: []
  /api/v1/users/{userId}/roles/{roleId}/targets/catalog/apps:
    get:
      tags:
      - User
      description: Lists all App targets for an `APP_ADMIN` Role assigned to a User. This methods return list may include full Applications or Instances. The response for an instance will have an `ID` value, while Application will not have an ID.
      operationId: listApplicationTargetsForApplicationAdministratorRoleForUser
      parameters:
      - name: userId
        in: path
        required: true
        schema:
          type: string
      - name: roleId
        in: path
        required: true
        schema:
          type: string
      - name: after
        in: query
        schema:
          type: string
      - name: limit
        in: query
        schema:
          type: integer
          format: int32
          default: 20
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/CatalogApplication'
      security:
      - api_token: []
    put:
      tags:
      - User


# --- truncated at 32 KB (77 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/openapi/okta-user-api-openapi.yml