Okta API

naftiko: 1.0.0-alpha2
info:
  label: Okta API
  description: Allows customers to easily access the Okta API
  tags:
  - Okta
  - API
  created: '2026-05-06'
  modified: '2026-05-06'
capability:
  consumes:
  - type: http
    namespace: okta
    baseUri: https://your-subdomain.okta.com
    description: Okta API HTTP API.
    authentication:
      type: apikey
      in: header
      name: Authorization
      value: '{{OKTA_TOKEN}}'
    resources:
    - name: api-v1-apps
      path: /api/v1/apps
      operations:
      - name: listapplications
        method: GET
        description: Okta List Applications
        inputParameters:
        - name: q
          in: query
          type: string
        - name: after
          in: query
          type: string
          description: Specifies the pagination cursor for the next page of apps
        - name: limit
          in: query
          type: integer
          description: Specifies the number of results for a page
        - name: filter
          in: query
          type: string
          description: Filters apps by status, user.id, group.id or credentials.signing.kid expression
        - name: expand
          in: query
          type: string
          description: Traverses users link relationship and optionally embeds Application User resource
        - name: includeNonDeleted
          in: query
          type: boolean
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: createapplication
        method: POST
        description: Okta Add Application
        inputParameters:
        - name: activate
          in: query
          type: boolean
          description: Executes activation lifecycle operation when creating the app
        - name: OktaAccessGateway-Agent
          in: header
          type: string
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-apps-appid
      path: /api/v1/apps/{appId}
      operations:
      - name: getapplication
        method: GET
        description: Okta Get Application
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        - name: expand
          in: query
          type: string
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: updateapplication
        method: PUT
        description: Okta Update Application
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: deleteapplication
        method: DELETE
        description: Okta Delete Application
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-apps-appid-connections-default
      path: /api/v1/apps/{appId}/connections/default
      operations:
      - name: getdefaultprovisioningconnectionforapplication
        method: GET
        description: Okta Fetches the default Provisioning Connection for an application.
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: setdefaultprovisioningconnectionforapplication
        method: POST
        description: Okta Sets the default Provisioning Connection for an application.
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        - name: activate
          in: query
          type: boolean
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-apps-appid-connections-default-lifecycle-
      path: /api/v1/apps/{appId}/connections/default/lifecycle/activate
      operations:
      - name: activatedefaultprovisioningconnectionforapplicat
        method: POST
        description: Okta Activate default Provisioning Connection for application
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-apps-appid-connections-default-lifecycle-
      path: /api/v1/apps/{appId}/connections/default/lifecycle/deactivate
      operations:
      - name: deactivatedefaultprovisioningconnectionforapplic
        method: POST
        description: Okta Deactivate default Provisioning Connection for application
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-apps-appid-credentials-csrs
      path: /api/v1/apps/{appId}/credentials/csrs
      operations:
      - name: listcsrsforapplication
        method: GET
        description: Okta List Certificate Signing Requests for Application
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: generatecsrforapplication
        method: POST
        description: Okta Generate Certificate Signing Request for Application
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-apps-appid-credentials-csrs-csrid
      path: /api/v1/apps/{appId}/credentials/csrs/{csrId}
      operations:
      - name: getcsrforapplication
        method: GET
        description: GET /api/v1/apps/{appId}/credentials/csrs/{csrId}
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        - name: csrId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: revokecsrfromapplication
        method: DELETE
        description: DELETE /api/v1/apps/{appId}/credentials/csrs/{csrId}
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        - name: csrId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-apps-appid-credentials-csrs-csrid-lifecyc
      path: /api/v1/apps/{appId}/credentials/csrs/{csrId}/lifecycle/publish
      operations:
      - name: post-api-v1-apps-appid-credentials-csrs-csrid-li
        method: POST
        description: POST /api/v1/apps/{appId}/credentials/csrs/{csrId}/lifecycle/publish
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        - name: csrId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-apps-appid-credentials-keys
      path: /api/v1/apps/{appId}/credentials/keys
      operations:
      - name: listapplicationkeys
        method: GET
        description: Okta List Key Credentials for Application
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-apps-appid-credentials-keys-generate
      path: /api/v1/apps/{appId}/credentials/keys/generate
      operations:
      - name: generateapplicationkey
        method: POST
        description: Generates a new X.509 certificate for an application key credential
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        - name: validityYears
          in: query
          type: integer
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-apps-appid-credentials-keys-keyid
      path: /api/v1/apps/{appId}/credentials/keys/{keyId}
      operations:
      - name: getapplicationkey
        method: GET
        description: Okta Get Key Credential for Application
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        - name: keyId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-apps-appid-credentials-keys-keyid-clone
      path: /api/v1/apps/{appId}/credentials/keys/{keyId}/clone
      operations:
      - name: cloneapplicationkey
        method: POST
        description: Okta Clone Application Key Credential
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        - name: keyId
          in: path
          type: string
          required: true
        - name: targetAid
          in: query
          type: string
          required: true
          description: Unique key of the target Application
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-apps-appid-credentials-secrets
      path: /api/v1/apps/{appId}/credentials/secrets
      operations:
      - name: listclientsecretsforapplication
        method: GET
        description: Okta List client secrets
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: createnewclientsecretforapplication
        method: POST
        description: Okta Add new client secret
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-apps-appid-credentials-secrets-secretid
      path: /api/v1/apps/{appId}/credentials/secrets/{secretId}
      operations:
      - name: getclientsecretforapplication
        method: GET
        description: Okta Get client secret
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        - name: secretId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: deleteclientsecretforapplication
        method: DELETE
        description: Removes a secret from the client's collection of secrets.
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        - name: secretId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-apps-appid-credentials-secrets-secretid-l
      path: /api/v1/apps/{appId}/credentials/secrets/{secretId}/lifecycle/activate
      operations:
      - name: activateclientsecretforapplication
        method: POST
        description: Okta Activate a client secret
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        - name: secretId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-apps-appid-credentials-secrets-secretid-l
      path: /api/v1/apps/{appId}/credentials/secrets/{secretId}/lifecycle/deactivate
      operations:
      - name: deactivateclientsecretforapplication
        method: POST
        description: Okta Deactivate a client secret
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        - name: secretId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-apps-appid-features
      path: /api/v1/apps/{appId}/features
      operations:
      - name: listfeaturesforapplication
        method: GET
        description: Okta Fetches the Feature objects for an application.
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-apps-appid-features-name
      path: /api/v1/apps/{appId}/features/{name}
      operations:
      - name: getfeatureforapplication
        method: GET
        description: Okta Fetches a Feature object for an application.
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        - name: name
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: updatefeatureforapplication
        method: PUT
        description: Okta Updates a Feature object for an application.
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        - name: name
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-apps-appid-grants
      path: /api/v1/apps/{appId}/grants
      operations:
      - name: listscopeconsentgrants
        method: GET
        description: Lists all scope consent grants for the application
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        - name: expand
          in: query
          type: string
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: grantconsenttoscope
        method: POST
        description: Grants consent for the application to request an OAuth 2.0 Okta scope
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-apps-appid-grants-grantid
      path: /api/v1/apps/{appId}/grants/{grantId}
      operations:
      - name: getscopeconsentgrant
        method: GET
        description: Fetches a single scope consent grant for the application
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        - name: grantId
          in: path
          type: string
          required: true
        - name: expand
          in: query
          type: string
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: revokescopeconsentgrant
        method: DELETE
        description: Revokes permission for the application to request the given scope
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        - name: grantId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-apps-appid-groups
      path: /api/v1/apps/{appId}/groups
      operations:
      - name: listapplicationgroupassignments
        method: GET
        description: Okta List Groups Assigned to Application
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        - name: q
          in: query
          type: string
        - name: after
          in: query
          type: string
          description: Specifies the pagination cursor for the next page of assignments
        - name: limit
          in: query
          type: integer
          description: Specifies the number of results for a page
        - name: expand
          in: query
          type: string
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-apps-appid-groups-groupid
      path: /api/v1/apps/{appId}/groups/{groupId}
      operations:
      - name: getapplicationgroupassignment
        method: GET
        description: Okta Get Assigned Group for Application
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        - name: groupId
          in: path
          type: string
          required: true
        - name: expand
          in: query
          type: string
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: createapplicationgroupassignment
        method: PUT
        description: Okta Assign Group to Application
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        - name: groupId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: deleteapplicationgroupassignment
        method: DELETE
        description: Okta Remove Group from Application
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        - name: groupId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-apps-appid-lifecycle-activate
      path: /api/v1/apps/{appId}/lifecycle/activate
      operations:
      - name: activateapplication
        method: POST
        description: Okta Activate Application
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-apps-appid-lifecycle-deactivate
      path: /api/v1/apps/{appId}/lifecycle/deactivate
      operations:
      - name: deactivateapplication
        method: POST
        description: Okta Deactivate Application
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-apps-appid-logo
      path: /api/v1/apps/{appId}/logo
      operations:
      - name: uploadapplicationlogo
        method: POST
        description: Okta The file must be in PNG, JPG, or GIF format, and less than 1 MB in size. For best results use landscape
          orientation, a transparent background, and a minimum size of 420px by 120px to prevent upscaling.
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-apps-appid-policies-policyid
      path: /api/v1/apps/{appId}/policies/{policyId}
      operations:
      - name: updateapplicationpolicy
        method: PUT
        description: Okta Update application policy
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        - name: policyId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-apps-appid-sso-saml-metadata
      path: /api/v1/apps/{appId}/sso/saml/metadata
      operations:
      - name: previewsamlappmetadata
        method: GET
        description: Previews SAML metadata based on a specific key credential for an application
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        - name: kid
          in: query
          type: string
          required: true
          description: unique key identifier of an Application Key Credential
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-apps-appid-tokens
      path: /api/v1/apps/{appId}/tokens
      operations:
      - name: listoauth2tokensforapplication
        method: GET
        description: Lists all tokens for the application
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        - name: expand
          in: query
          type: string
        - name: after
          in: query
          type: string
        - name: limit
          in: query
          type: integer
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: revokeoauth2tokensforapplication
        method: DELETE
        description: Revokes all tokens for the specified application
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-apps-appid-tokens-tokenid
      path: /api/v1/apps/{appId}/tokens/{tokenId}
      operations:
      - name: getoauth2tokenforapplication
        method: GET
        description: Gets a token for the specified application
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        - name: tokenId
          in: path
          type: string
          required: true
        - name: expand
          in: query
          type: string
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: revokeoauth2tokenforapplication
        method: DELETE
        description: Revokes the specified token for the specified application
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        - name: tokenId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-apps-appid-users
      path: /api/v1/apps/{appId}/users
      operations:
      - name: listapplicationusers
        method: GET
        description: Okta List Users Assigned to Application
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        - name: q
          in: query
          type: string
        - name: query_scope
          in: query
          type: string
        - name: after
          in: query
          type: string
          description: specifies the pagination cursor for the next page of assignments
        - name: limit
          in: query
          type: integer
          description: specifies the number of results for a page
        - name: filter
          in: query
          type: string
        - name: expand
          in: query
          type: string
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: assignusertoapplication
        method: POST
        description: Okta Assign User to Application for SSO & Provisioning
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-apps-appid-users-userid
      path: /api/v1/apps/{appId}/users/{userId}
      operations:
      - name: getapplicationuser
        method: GET
        description: Okta Get Assigned User for Application
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        - name: userId
          in: path
          type: string
          required: true
        - name: expand
          in: query
          type: string
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: updateapplicationuser
        method: POST
        description: Okta Update Application Profile for Assigned User
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        - name: userId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: deleteapplicationuser
        method: DELETE
        description: Okta Remove User from Application
        inputParameters:
        - name: appId
          in: path
          type: string
          required: true
        - name: userId
          in: path
          type: string
          required: true
        - name: sendEmail
          in: query
          type: boolean
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-authenticators
      path: /api/v1/authenticators
      operations:
      - name: listauthenticators
        method: GET
        description: Okta Lists all available Authenticators
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: createauthenticator
        method: POST
        description: Okta Create an Authenticator
        inputParameters:
        - name: activate
          in: query
          type: boolean
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-authenticators-authenticatorid
      path: /api/v1/authenticators/{authenticatorId}
      operations:
      - name: getauthenticator
        method: GET
        description: Success
        inputParameters:
        - name: authenticatorId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: updateauthenticator
        method: PUT
        description: Okta Update Authenticator
        inputParameters:
        - name: authenticatorId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-authenticators-authenticatorid-lifecycle-
      path: /api/v1/authenticators/{authenticatorId}/lifecycle/activate
      operations:
      - name: activateauthenticator
        method: POST
        description: Success
        inputParameters:
        - name: authenticatorId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-authenticators-authenticatorid-lifecycle-
      path: /api/v1/authenticators/{authenticatorId}/lifecycle/deactivate
      operations:
      - name: deactivateauthenticator
        method: POST
        description: Success
        inputParameters:
        - name: authenticatorId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-authorizationservers
      path: /api/v1/authorizationServers
      operations:
      - name: listauthorizationservers
        method: GET
        description: Success
        inputParameters:
        - name: q
          in: query
          type: string
        - name: limit
          in: query
          type: string
        - name: after
          in: query
          type: string
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: createauthorizationserver
        method: POST
        description: Success
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
    - name: api-v1-authorizationservers-authserverid
      path: /api/v1/authorizationServers/{authServerId}
      operations:
      - name: getauthorizationserver
        method: GET
        description: Success
        inputParameters:
        - name: authServerId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: updateauthorizationserver
        method: PUT
        description: Success
        inputParameters:
        - name: authServerId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
      - name: deleteauthorizationserver
        method: DELETE
        description: Success
        inputParameters:
        - name: authServerId
          in: path
          type: string
          required: true
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
  exposes:
  - type: rest
    port: 8080
    namespace: okta-rest
    description: REST adapter for Okta API.
    resources:
    - path: /api/v1/apps
      name: listapplications
      operations:
      - method: GET
        name: listapplications
        description: Okta List Applications
        call: okta.listapplications
        outputParameters:
        - type: object
          mapping: $.
    - path: /api/v1/apps
      name: createapplication
      operations:
      - method: POST
        name: createapplication
        description: Okta Add Application
        call: okta.createapplication
        outputParameters:
        - type: object
          mapping: $.
    - path: /api/v1/apps/{appId}
      name: getapplication
      operations:
      - method: GET
        name: getapplication
        description: Okta Get Application
        call: okta.getapplication
        with:
          appId: rest.appId
        outputParameters:
        - type: object
          mapping: $.
    - path: /api/v1/apps/{appId}
      name: updateapplication
      operations:
      - method: PUT
        name: updateapplication
        description: Okta Update Application
        call: okta.updateapplication
        with:
          appId: rest.appId
        outputParameters:
        - type: object
          mapping: $.
    - path: /api/v1/apps/{appId}
      name: deleteapplication
      operations:
      - method: DELETE
        name: deleteapplication
   

# --- truncated at 32 KB (86 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/capabilities/okta-capability.yaml