One-time verification handshake. After an Event Hook is created (or its
endpoint URL changes), Okta sends a single HTTP GET request to the registered
endpoint with an `x-okta-verification-challenge` header. The endpoint must
echo the header value back in a JSON body under the property `verification`.
The Event Hook's `verificationStatus` transitions from `UNVERIFIED` to
`VERIFIED` on success. `UNV
Provider:OktaAsyncAPI: v2.6.0Spec: Okta Event Hooks and Log StreamsOperations: 2Messages: 2
Channel address
okta/event-hook/verification
Operations
publish
respondEventHookVerification
Echo the challenge value in a JSON body to complete verification.
subscribe
receiveEventHookVerification
Receive the one-time verification GET from Okta.
Messages
EventHookVerificationResponse
JSON body the endpoint must return to complete verification — a single
property `verification` containing the value of the
`x-okta-verification-challenge` header from the GET request.
Content-Type: application/json
EventHookVerificationChallenge
The single GET request Okta sends to confirm endpoint ownership. The
challenge value is in the `x-okta-verification-challenge` header; no
request body is sent.
Content-Type: application/json
About AsyncAPI
The AsyncAPI specification describes event-driven APIs the way OpenAPI describes request/response APIs. A channel is the named pipe — a webhook URL, a Kafka topic, a WebSocket route, an MQTT subject — that producers and consumers publish or subscribe to. Each channel carries one or more messages with structured payloads, and an operation declares whether a given party sends or receives on that channel.
Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we
store it to create your key and to recognise you if you sign in with another
provider. See our Privacy Policy and
Terms.