Okta

Use okta in twins and put this configuration under seed_config.okta. Okta identity and access management organization with users, groups, application integrations, event hooks, sessions, authentication/MFA, policies/rules, group rules, user types/profile schemas, network zones, custom authorization servers/OIDC/PKCE/consent, organization customization/security, federation/authenticators/devices, directory extensions, admin roles, provisioning and Shared Signals.

Example seed

This is the complete Scenario request body for creating a Scenario. You can also import it with arga test-runner scenarios import --file scenario.json.

{
  "name": "Okta eval fixture",
  "twins": [
    "okta"
  ],
  "seed_config": {
    "okta": {
      "users": [
        {
          "id": "00uscenarioada",
          "alias": "ada",
          "profile": {
            "firstName": "Ada",
            "lastName": "Lovelace",
            "email": "ada@example.test",
            "login": "ada@example.test",
            "department": "Engineering",
            "employeeCode": "ENG-001"
          },
          "status": "ACTIVE"
        }
      ],
      "groups": [
        {
          "id": "00gscenarioengineering",
          "alias": "engineering",
          "profile": {
            "name": "Engineering",
            "description": "Scenario engineering group"
          },
          "members": [
            "ada"
          ]
        },
        {
          "id": "00gscenarioprovisioned",
          "profile": {
            "name": "Automatically provisioned engineers"
          }
        }
      ],
      "applications": [
        {
          "id": "0oascenarioportal",
          "alias": "developer_portal",
          "name": "oidc_client",
          "label": "Developer Portal",
          "signOnMode": "OPENID_CONNECT",
          "settings": {
            "oauthClient": {
              "client_uri": "https://portal.example.test",
              "redirect_uris": [
                "https://portal.example.test/oauth/callback"
              ],
              "response_types": [
                "code"
              ],
              "grant_types": [
                "authorization_code",
                "refresh_token"
              ],
              "application_type": "web"
            }
          },
          "users": [
            {
              "id": "ada",
              "profile": {
                "role": "maintainer"
              }
            }
          ],
          "groups": [
            {
              "id": "engineering",
              "priority": 1,
              "profile": {
                "role": "reader"
              }
            }
          ]
        }
      ],
      "event_hooks": [
        {
          "name": "Identity audit sink",
          "url": "https://hooks.example.test/okta",
          "events": [
            "user.lifecycle.create",
            "user.lifecycle.activate"
          ],
          "status": "ACTIVE",
          "verificationStatus": "VERIFIED"
        }
      ],
      "config": {
        "password_min_length": 8,
        "password_history_count": 0,
        "password_min_age_seconds": 0,
        "password_lockout_max_attempts": 5,
        "password_auto_unlock_minutes": 10,
        "mfa_required": false,
        "auto_deliver_event_hooks": false
      }
    }
  }
}

Parameters

The following fields belong directly inside seed_config.okta. Required nested fields are marked in their tables. Provider-native objects can contain service-specific fields beyond the representative record shapes below.

Parameter	Type	Description
`users`	`object[]`	Users fixtures in provider-native format.
`groups`	`object[]`	Group fixtures or memberships in the format shown below.
`applications`	`object[]`	Applications fixtures in provider-native format.
`event_hooks`	`object[]`	Event hooks fixtures in provider-native format.
`management`	`object`	Okta management resource maps keyed by explicit IDs.
`authorization_servers`	`object`	Authorization servers.
`config`	`OktaTwinConfig`	Runtime settings accepted by this Scenario adapter.
`sessions`	`object[]`	Sessions fixtures in provider-native format.
`eventHooks`	`array`	EventHooks fixtures in provider-native format.
`directory_extras`	`object`	Directory extras.
`organization`	`object`	Organization.
`apps`	`array`	Apps fixtures in provider-native format.
`session_tokens`	`array`	Session tokens fixtures in provider-native format.
`api_token_state`	`object`	Api token state.
`application_oauth`	`object`	Application oauth.
`identity`	`object`	Identity.
`organization_security`	`object`	Organization security.
`federation`	`object`	Federation.
`admin_roles`	`object`	Admin roles.
`provisioning`	`object`	Provisioning.
`app_extensions`	`object`	App extensions.
`enterprise`	`object`	Enterprise.
`oauth_flows`	`object`	Oauth flows.
`user_oauth`	`object`	User oauth.
`shared_signals`	`object`	Shared signals.
`password_history`	`object`	Password history.

Seeding behavior

Use explicit resource IDs inside management and exported subsystem maps. Alias resolution does not apply inside those maps. Preserve required built-in user types and schemas when replacing their collections. Password/MFA controls belong in config.

Resource fields

These tables describe the record shapes used by the example. Keep native field names and casing. Map keys such as property names, IDs, and metadata keys are supplied by your fixture.

`users[]`

Parameter	Type	Description
`id`	`string`	Explicit resource identifier, when supported.
`alias`	`string`	Fixture-local name used by supported relationship references.
`profile`	`object`	Owner identity and display profile.
`status`	`string`	Status.

`groups[]`

Parameter	Type	Description
`id`	`string`	Explicit resource identifier, when supported.
`alias`	`string`	Fixture-local name used by supported relationship references.
`profile`	`object`	Owner identity and display profile.
`members`	`string[]`	Members fixtures in provider-native format.

`applications[]`

Parameter	Type	Description
`id`	`string`	Explicit resource identifier, when supported.
`alias`	`string`	Fixture-local name used by supported relationship references.
`name`	`string`	Human-readable name.
`label`	`string`	Label.
`signOnMode`	`string`	SignOnMode.
`settings`	`object`	Settings.
`users`	`object[]`	Users fixtures in provider-native format.
`groups`	`object[]`	Group fixtures or memberships in the format shown below.

`applications[].users[]`

Parameter	Type	Description
`id`	`string`	Explicit resource identifier, when supported.
`profile`	`object`	Owner identity and display profile.

`applications[].groups[]`

Parameter	Type	Description
`id`	`string`	Explicit resource identifier, when supported.
`priority`	`integer`	Priority.
`profile`	`object`	Owner identity and display profile.

`event_hooks[]`

Parameter	Type	Description
`name`	`string`	Human-readable name.
`url`	`string`	Url.
`events`	`string[]`	Events fixtures in provider-native format.
`status`	`string`	Status.
`verificationStatus`	`string`	VerificationStatus.

Typed configuration objects

Named object types in the parameter table use these fields.

OktaTwinConfig

Parameter	Type	Description
`org_url`	`string`	Org url.
`api_tokens`	`object`	Api tokens.
`oauth_tokens`	`object`	Oauth tokens.
`oauth_clients`	`object`	Oauth clients.
`rate_limiting_enabled`	`boolean`	Enable request rate limiting.
`rate_limit_per_minute`	`integer`	Rate limit per minute.
`session_lifetime_seconds`	`integer`	Session lifetime seconds, in seconds.
`oauth_lifetime_seconds`	`integer`	Oauth lifetime seconds, in seconds.
`password_history_count`	`integer`	Password history count.
`password_min_length`	`integer`	Password min length.
`password_min_age_seconds`	`integer`	Password min age seconds, in seconds.
`password_complexity`	`object`	Password complexity.
`password_max_age_days`	`integer`	Password max age days.
`password_expire_warn_days`	`integer`	Password expire warn days.
`password_lockout_max_attempts`	`integer`	Password lockout max attempts.
`password_auto_unlock_minutes`	`integer`	Password auto unlock minutes.
`password_show_lockout_failures`	`boolean`	Enable or set password show lockout failures behavior.
`authn_transaction_lifetime_seconds`	`integer`	Authn transaction lifetime seconds, in seconds.
`session_token_lifetime_seconds`	`integer`	Session token lifetime seconds, in seconds.
`factor_challenge_lifetime_seconds`	`integer`	Factor challenge lifetime seconds, in seconds.
`factor_challenge_max_attempts`	`integer`	Factor challenge max attempts.
`mfa_required`	`boolean`	Enable or set mfa required behavior.
`auto_deliver_event_hooks`	`boolean`	Enable or set auto deliver event hooks behavior.
`start_time`	`string or null`	Start time.
`failure_rules`	`FailureRule[]`	Deterministic failure-injection rules.

FailureRule

Parameter	Type	Description
`method`	`string`	Method.
`path`	`string`	Path.
`status_code`	`integer`	Status code.
`error_code`	`string`	Error code.
`error_summary`	`string`	Error summary.
`remaining`	`integer`	Remaining.
`retry_after`	`int \| None`	Retry after.

See Scenario seeding for saving, provisioning, and resetting fixtures.

Get started

Digital twins

Tests

Setup

Integrations

Resources

Example seed

Parameters

Seeding behavior

Resource fields

`users[]`

`groups[]`

`applications[]`

`applications[].users[]`

`applications[].groups[]`

`event_hooks[]`

Typed configuration objects

OktaTwinConfig

FailureRule

​Example seed

​Parameters

​Seeding behavior

​Resource fields

​users[]

​groups[]

​applications[]

​applications[].users[]

​applications[].groups[]

​event_hooks[]

​Typed configuration objects

​OktaTwinConfig

​FailureRule

Example seed

Parameters

Seeding behavior

Resource fields

`users[]`

`groups[]`

`applications[]`

`applications[].users[]`

`applications[].groups[]`

`event_hooks[]`

Typed configuration objects

OktaTwinConfig

FailureRule