> ## Documentation Index
> Fetch the complete documentation index at: https://docs.argalabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Okta

> Okta Scenario seeding parameters, nested fields, and examples

Use `okta` in `twins` and put this configuration under `seed_config.okta`.

Okta identity and access management organization with users, groups, application integrations, event hooks, sessions, authentication/MFA, policies/rules, group rules, user types/profile schemas, network zones, custom authorization servers/OIDC/PKCE/consent, organization customization/security, federation/authenticators/devices, directory extensions, admin roles, provisioning and Shared Signals.

## Example seed

This is the complete Scenario request body for [creating a Scenario](https://docs.argalabs.com/api-reference/post-create-a-scenario.md). You can also import it with `arga test-runner scenarios import --file scenario.json`.

```json theme={null}
{
  "name": "Okta eval fixture",
  "twins": [
    "okta"
  ],
  "seed_config": {
    "okta": {
      "users": [
        {
          "id": "00uscenarioada",
          "alias": "ada",
          "profile": {
            "firstName": "Ada",
            "lastName": "Lovelace",
            "email": "ada@example.test",
            "login": "ada@example.test",
            "department": "Engineering",
            "employeeCode": "ENG-001"
          },
          "status": "ACTIVE"
        }
      ],
      "groups": [
        {
          "id": "00gscenarioengineering",
          "alias": "engineering",
          "profile": {
            "name": "Engineering",
            "description": "Scenario engineering group"
          },
          "members": [
            "ada"
          ]
        },
        {
          "id": "00gscenarioprovisioned",
          "profile": {
            "name": "Automatically provisioned engineers"
          }
        }
      ],
      "applications": [
        {
          "id": "0oascenarioportal",
          "alias": "developer_portal",
          "name": "oidc_client",
          "label": "Developer Portal",
          "signOnMode": "OPENID_CONNECT",
          "settings": {
            "oauthClient": {
              "client_uri": "https://portal.example.test",
              "redirect_uris": [
                "https://portal.example.test/oauth/callback"
              ],
              "response_types": [
                "code"
              ],
              "grant_types": [
                "authorization_code",
                "refresh_token"
              ],
              "application_type": "web"
            }
          },
          "users": [
            {
              "id": "ada",
              "profile": {
                "role": "maintainer"
              }
            }
          ],
          "groups": [
            {
              "id": "engineering",
              "priority": 1,
              "profile": {
                "role": "reader"
              }
            }
          ]
        }
      ],
      "event_hooks": [
        {
          "name": "Identity audit sink",
          "url": "https://hooks.example.test/okta",
          "events": [
            "user.lifecycle.create",
            "user.lifecycle.activate"
          ],
          "status": "ACTIVE",
          "verificationStatus": "VERIFIED"
        }
      ],
      "config": {
        "password_min_length": 8,
        "password_history_count": 0,
        "password_min_age_seconds": 0,
        "password_lockout_max_attempts": 5,
        "password_auto_unlock_minutes": 10,
        "mfa_required": false,
        "auto_deliver_event_hooks": false
      }
    }
  }
}
```

## Parameters

The following fields belong directly inside `seed_config.okta`. Required nested fields are marked in their tables. Provider-native objects can contain service-specific fields beyond the representative record shapes below.

| Parameter | Type | Description |
| - | - | - |
| `users` | `object[]` | Users fixtures in provider-native format. |
| `groups` | `object[]` | Group fixtures or memberships in the format shown below. |
| `applications` | `object[]` | Applications fixtures in provider-native format. |
| `event_hooks` | `object[]` | Event hooks fixtures in provider-native format. |
| `management` | `object` | Okta management resource maps keyed by explicit IDs. |
| `authorization_servers` | `object` | Authorization servers. |
| `config` | `OktaTwinConfig` | Runtime settings accepted by this Scenario adapter. |
| `sessions` | `object[]` | Sessions fixtures in provider-native format. |
| `eventHooks` | `array` | EventHooks fixtures in provider-native format. |
| `directory_extras` | `object` | Directory extras. |
| `organization` | `object` | Organization. |
| `apps` | `array` | Apps fixtures in provider-native format. |
| `session_tokens` | `array` | Session tokens fixtures in provider-native format. |
| `api_token_state` | `object` | Api token state. |
| `application_oauth` | `object` | Application oauth. |
| `identity` | `object` | Identity. |
| `organization_security` | `object` | Organization security. |
| `federation` | `object` | Federation. |
| `admin_roles` | `object` | Admin roles. |
| `provisioning` | `object` | Provisioning. |
| `app_extensions` | `object` | App extensions. |
| `enterprise` | `object` | Enterprise. |
| `oauth_flows` | `object` | Oauth flows. |
| `user_oauth` | `object` | User oauth. |
| `shared_signals` | `object` | Shared signals. |
| `password_history` | `object` | Password history. |

## Seeding behavior

Use explicit resource IDs inside `management` and exported subsystem maps. Alias resolution does not apply inside those maps. Preserve required built-in user types and schemas when replacing their collections. Password/MFA controls belong in `config`.

## Resource fields

These tables describe the record shapes used by the example. Keep native field names and casing. Map keys such as property names, IDs, and metadata keys are supplied by your fixture.

### `users[]`

| Parameter | Type | Description |
| - | - | - |
| `id` | `string` | Explicit resource identifier, when supported. |
| `alias` | `string` | Fixture-local name used by supported relationship references. |
| `profile` | `object` | Owner identity and display profile. |
| `status` | `string` | Status. |

### `groups[]`

| Parameter | Type | Description |
| - | - | - |
| `id` | `string` | Explicit resource identifier, when supported. |
| `alias` | `string` | Fixture-local name used by supported relationship references. |
| `profile` | `object` | Owner identity and display profile. |
| `members` | `string[]` | Members fixtures in provider-native format. |

### `applications[]`

| Parameter | Type | Description |
| - | - | - |
| `id` | `string` | Explicit resource identifier, when supported. |
| `alias` | `string` | Fixture-local name used by supported relationship references. |
| `name` | `string` | Human-readable name. |
| `label` | `string` | Label. |
| `signOnMode` | `string` | SignOnMode. |
| `settings` | `object` | Settings. |
| `users` | `object[]` | Users fixtures in provider-native format. |
| `groups` | `object[]` | Group fixtures or memberships in the format shown below. |

### `applications[].users[]`

| Parameter | Type | Description |
| - | - | - |
| `id` | `string` | Explicit resource identifier, when supported. |
| `profile` | `object` | Owner identity and display profile. |

### `applications[].groups[]`

| Parameter | Type | Description |
| - | - | - |
| `id` | `string` | Explicit resource identifier, when supported. |
| `priority` | `integer` | Priority. |
| `profile` | `object` | Owner identity and display profile. |

### `event_hooks[]`

| Parameter | Type | Description |
| - | - | - |
| `name` | `string` | Human-readable name. |
| `url` | `string` | Url. |
| `events` | `string[]` | Events fixtures in provider-native format. |
| `status` | `string` | Status. |
| `verificationStatus` | `string` | VerificationStatus. |

## Typed configuration objects

Named object types in the parameter table use these fields.

### OktaTwinConfig

| Parameter | Type | Description |
| - | - | - |
| `org_url` | `string` | Org url. |
| `api_tokens` | `object` | Api tokens. |
| `oauth_tokens` | `object` | Oauth tokens. |
| `oauth_clients` | `object` | Oauth clients. |
| `rate_limiting_enabled` | `boolean` | Enable request rate limiting. |
| `rate_limit_per_minute` | `integer` | Rate limit per minute. |
| `session_lifetime_seconds` | `integer` | Session lifetime seconds, in seconds. |
| `oauth_lifetime_seconds` | `integer` | Oauth lifetime seconds, in seconds. |
| `password_history_count` | `integer` | Password history count. |
| `password_min_length` | `integer` | Password min length. |
| `password_min_age_seconds` | `integer` | Password min age seconds, in seconds. |
| `password_complexity` | `object` | Password complexity. |
| `password_max_age_days` | `integer` | Password max age days. |
| `password_expire_warn_days` | `integer` | Password expire warn days. |
| `password_lockout_max_attempts` | `integer` | Password lockout max attempts. |
| `password_auto_unlock_minutes` | `integer` | Password auto unlock minutes. |
| `password_show_lockout_failures` | `boolean` | Enable or set password show lockout failures behavior. |
| `authn_transaction_lifetime_seconds` | `integer` | Authn transaction lifetime seconds, in seconds. |
| `session_token_lifetime_seconds` | `integer` | Session token lifetime seconds, in seconds. |
| `factor_challenge_lifetime_seconds` | `integer` | Factor challenge lifetime seconds, in seconds. |
| `factor_challenge_max_attempts` | `integer` | Factor challenge max attempts. |
| `mfa_required` | `boolean` | Enable or set mfa required behavior. |
| `auto_deliver_event_hooks` | `boolean` | Enable or set auto deliver event hooks behavior. |
| `start_time` | `string or null` | Start time. |
| `failure_rules` | `FailureRule[]` | Deterministic failure-injection rules. |

### FailureRule

| Parameter | Type | Description |
| - | - | - |
| `method` | `string` | Method. |
| `path` | `string` | Path. |
| `status_code` | `integer` | Status code. |
| `error_code` | `string` | Error code. |
| `error_summary` | `string` | Error summary. |
| `remaining` | `integer` | Remaining. |
| `retry_after` | `int \| None` | Retry after. |

See [Scenario seeding](https://docs.argalabs.com/twins/seeding.md) for saving, provisioning, and resetting fixtures.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.