{"manifest":{"id":"okta","name":"Okta","description":"Stateful Okta OAuth, OpenID Connect, users, groups, apps, and authorization server emulator.","docsUrl":"https://docs.emulators.dev/okta","surfaces":[{"id":"rest","kind":"rest","title":"Management API","status":"partial","basePath":"/api/v1"},{"id":"oauth","kind":"oauth","title":"Okta OAuth 2.0","status":"supported","basePath":"/oauth2"},{"id":"oidc","kind":"oidc","title":"OpenID Connect","status":"supported","basePath":"/.well-known"}],"auth":[{"id":"oauth-code","title":"OAuth authorization code","type":"oauth-authorization-code","status":"supported"},{"id":"client-credentials","title":"OAuth client credentials","type":"oauth-client-credentials","status":"supported"},{"id":"oidc","title":"OIDC identity tokens","type":"oidc","status":"supported"},{"id":"api-token","title":"SSWS API token","type":"api-key","status":"supported"}],"specs":[{"kind":"oauth-metadata","title":"Okta OIDC metadata","coverage":"hand-authored","operations":[{"operationId":"oidc/discovery","method":"GET","path":"/.well-known/openid-configuration","status":"hand-authored"},{"operationId":"oauth/authorizationServerMetadata","method":"GET","path":"/.well-known/oauth-authorization-server","status":"hand-authored"},{"operationId":"oidc/authServerDiscovery","method":"GET","path":"/oauth2/:authServerId/.well-known/openid-configuration","status":"hand-authored"},{"operationId":"oauth/authServerAuthorizationServerMetadata","method":"GET","path":"/oauth2/:authServerId/.well-known/oauth-authorization-server","status":"hand-authored"},{"operationId":"oidc/pathInsertAuthServerDiscovery","method":"GET","path":"/.well-known/openid-configuration/oauth2/:authServerId","status":"hand-authored"},{"operationId":"oauth/pathInsertAuthServerAuthorizationServerMetadata","method":"GET","path":"/.well-known/oauth-authorization-server/oauth2/:authServerId","status":"hand-authored"},{"operationId":"oidc/jwks","method":"GET","path":"/oauth2/v1/keys","status":"hand-authored"},{"operationId":"oauth/authorize","method":"GET","path":"/oauth2/v1/authorize","status":"hand-authored"},{"operationId":"oauth/registerClient","method":"POST","path":"/oauth2/v1/clients","status":"hand-authored"},{"operationId":"oauth/registerAuthServerClient","method":"POST","path":"/oauth2/:authServerId/v1/clients","status":"hand-authored"},{"operationId":"oauth/token","method":"POST","path":"/oauth2/v1/token","status":"hand-authored"},{"operationId":"oauth/userinfo","method":"GET","path":"/oauth2/v1/userinfo","status":"hand-authored"},{"operationId":"oauth/introspect","method":"POST","path":"/oauth2/v1/introspect","status":"hand-authored"},{"operationId":"oauth/revoke","method":"POST","path":"/oauth2/v1/revoke","status":"hand-authored"},{"operationId":"oauth/logout","method":"GET","path":"/oauth2/v1/logout","status":"hand-authored"}]},{"kind":"openapi","title":"Okta management API subset","coverage":"hand-authored","url":"/openapi.json","operations":[{"operationId":"users/list","method":"GET","path":"/api/v1/users","status":"hand-authored"},{"operationId":"users/create","method":"POST","path":"/api/v1/users","status":"hand-authored"},{"operationId":"users/getCurrent","method":"GET","path":"/api/v1/users/me","status":"hand-authored"},{"operationId":"users/get","method":"GET","path":"/api/v1/users/:userId","status":"hand-authored"},{"operationId":"users/update","method":"PUT","path":"/api/v1/users/:userId","status":"hand-authored"},{"operationId":"users/partialUpdate","method":"POST","path":"/api/v1/users/:userId","status":"hand-authored"},{"operationId":"users/delete","method":"DELETE","path":"/api/v1/users/:userId","status":"hand-authored"},{"operationId":"users/listGroups","method":"GET","path":"/api/v1/users/:userId/groups","status":"hand-authored"},{"operationId":"users/activate","method":"POST","path":"/api/v1/users/:userId/lifecycle/activate","status":"hand-authored"},{"operationId":"users/deactivate","method":"POST","path":"/api/v1/users/:userId/lifecycle/deactivate","status":"hand-authored"},{"operationId":"users/suspend","method":"POST","path":"/api/v1/users/:userId/lifecycle/suspend","status":"hand-authored"},{"operationId":"users/unsuspend","method":"POST","path":"/api/v1/users/:userId/lifecycle/unsuspend","status":"hand-authored"},{"operationId":"users/reactivate","method":"POST","path":"/api/v1/users/:userId/lifecycle/reactivate","status":"hand-authored"},{"operationId":"groups/list","method":"GET","path":"/api/v1/groups","status":"hand-authored"},{"operationId":"groups/create","method":"POST","path":"/api/v1/groups","status":"hand-authored"},{"operationId":"groups/get","method":"GET","path":"/api/v1/groups/:groupId","status":"hand-authored"},{"operationId":"groups/update","method":"PUT","path":"/api/v1/groups/:groupId","status":"hand-authored"},{"operationId":"groups/delete","method":"DELETE","path":"/api/v1/groups/:groupId","status":"hand-authored"},{"operationId":"groups/listUsers","method":"GET","path":"/api/v1/groups/:groupId/users","status":"hand-authored"},{"operationId":"groups/addUser","method":"PUT","path":"/api/v1/groups/:groupId/users/:userId","status":"hand-authored"},{"operationId":"groups/removeUser","method":"DELETE","path":"/api/v1/groups/:groupId/users/:userId","status":"hand-authored"},{"operationId":"apps/list","method":"GET","path":"/api/v1/apps","status":"hand-authored"},{"operationId":"apps/create","method":"POST","path":"/api/v1/apps","status":"hand-authored"},{"operationId":"apps/get","method":"GET","path":"/api/v1/apps/:appId","status":"hand-authored"},{"operationId":"apps/update","method":"PUT","path":"/api/v1/apps/:appId","status":"hand-authored"},{"operationId":"apps/delete","method":"DELETE","path":"/api/v1/apps/:appId","status":"hand-authored"},{"operationId":"apps/listUsers","method":"GET","path":"/api/v1/apps/:appId/users","status":"hand-authored"},{"operationId":"apps/assignUser","method":"PUT","path":"/api/v1/apps/:appId/users/:userId","status":"hand-authored"},{"operationId":"apps/unassignUser","method":"DELETE","path":"/api/v1/apps/:appId/users/:userId","status":"hand-authored"},{"operationId":"apps/activate","method":"POST","path":"/api/v1/apps/:appId/lifecycle/activate","status":"hand-authored"},{"operationId":"apps/deactivate","method":"POST","path":"/api/v1/apps/:appId/lifecycle/deactivate","status":"hand-authored"},{"operationId":"authorizationServers/list","method":"GET","path":"/api/v1/authorizationServers","status":"hand-authored"},{"operationId":"authorizationServers/create","method":"POST","path":"/api/v1/authorizationServers","status":"hand-authored"},{"operationId":"authorizationServers/get","method":"GET","path":"/api/v1/authorizationServers/:authServerId","status":"hand-authored"},{"operationId":"authorizationServers/update","method":"PUT","path":"/api/v1/authorizationServers/:authServerId","status":"hand-authored"},{"operationId":"authorizationServers/delete","method":"DELETE","path":"/api/v1/authorizationServers/:authServerId","status":"hand-authored"},{"operationId":"authorizationServers/activate","method":"POST","path":"/api/v1/authorizationServers/:authServerId/lifecycle/activate","status":"hand-authored"},{"operationId":"authorizationServers/deactivate","method":"POST","path":"/api/v1/authorizationServers/:authServerId/lifecycle/deactivate","status":"hand-authored"}]}],"seedSchema":{"description":"Seed users, groups, apps, OAuth clients, and authorization servers.","fields":[{"key":"users","title":"Users","description":"Directory users addressable by login.","example":[{"login":"testuser@okta.local","email":"testuser@okta.local","first_name":"Test","last_name":"User"}]},{"key":"groups","title":"Groups","description":"Directory groups for membership assignment.","example":[{"name":"Everyone","description":"All users","type":"BUILT_IN","okta_id":"00g_everyone"}]},{"key":"apps","title":"Applications","description":"Okta application integrations.","example":[{"name":"My App","label":"My App","sign_on_mode":"OPENID_CONNECT","status":"ACTIVE"}]},{"key":"oauth_clients","title":"OAuth clients","description":"OIDC clients usable in OAuth flows.","example":[{"client_id":"okta-test-client","client_secret":"okta-test-secret","name":"Sample OIDC Client","redirect_uris":["http://localhost:3000/callback"],"auth_server_id":"default"}]},{"key":"authorization_servers","title":"Authorization servers","description":"Custom authorization servers that issue access tokens.","example":[{"id":"default","name":"default","audiences":["api://default"]}]},{"key":"group_memberships","title":"Group memberships","description":"Links between users and groups by Okta id.","example":[{"group_okta_id":"00g_everyone","user_okta_id":"00u_example"}]},{"key":"app_assignments","title":"App assignments","description":"Links between users and applications by Okta id.","example":[{"app_okta_id":"0oa_example","user_okta_id":"00u_example"}]}],"example":{"users":[{"login":"testuser@okta.local","email":"testuser@okta.local","first_name":"Test","last_name":"User"}],"groups":[{"name":"Everyone","description":"All users","type":"BUILT_IN","okta_id":"00g_everyone"}],"authorization_servers":[{"id":"default","name":"default","audiences":["api://default"]}],"oauth_clients":[{"client_id":"okta-test-client","client_secret":"okta-test-secret","name":"Sample OIDC Client","redirect_uris":["http://localhost:3000/callback"],"auth_server_id":"default"}]}},"stateModel":{"description":"Entities mutated by Okta provider calls.","collections":[{"name":"users"},{"name":"groups"},{"name":"apps"},{"name":"oauth_clients"},{"name":"auth_servers"},{"name":"group_memberships"},{"name":"app_assignments"}]},"connections":[{"id":"okta-auth-js","title":"Okta Auth JS (TypeScript)","kind":"sdk","language":"typescript","description":"Point the Okta Auth JS SDK at the emulator instance.","template":"import { OktaAuth } from \"@okta/okta-auth-js\";\n\nconst authClient = new OktaAuth({\n  issuer: \"{{baseUrl}}/oauth2/default\",\n  clientId: \"{{clientId}}\",\n  redirectUri: \"http://localhost:3000/callback\",\n  scopes: [\"openid\", \"profile\", \"email\"],\n});"},{"id":"okta-env","title":"Okta issuer (env)","kind":"env","language":"bash","description":"Point Okta SDKs and the management API at the emulator.","template":"OKTA_ORG_URL={{baseUrl}}\nOKTA_ISSUER={{baseUrl}}/oauth2/default\nOKTA_CLIENT_ID={{clientId}}\nOKTA_CLIENT_SECRET={{clientSecret}}\nOKTA_API_TOKEN={{token}}"},{"id":"curl","title":"curl","kind":"curl","language":"bash","description":"Read the OIDC discovery document.","template":"curl -s {{baseUrl}}/oauth2/default/.well-known/openid-configuration"},{"id":"base-url","title":"Base URL (env)","kind":"env","language":"bash","description":"Point your SDK or app at the emulator instead of the real provider.","template":"{{SERVICE_UPPER}}_BASE_URL={{baseUrl}}"},{"id":"create-credential","title":"Create a credential","kind":"curl","language":"bash","description":"Mint a working credential for this instance.","template":"curl -s -X POST {{controlBaseUrl}}/credentials \\\n  -H \"content-type: application/json\" \\\n  -d '{\"type\":\"{{defaultAuthType}}\"}'"},{"id":"inspect-ledger","title":"Inspect requests","kind":"curl","language":"bash","description":"Read the request ledger to validate how your app called the service.","template":"curl -s {{controlBaseUrl}}/ledger"}],"resetBehavior":{"description":"Resets the instance to its seeded baseline.","reseeds":true,"clearsLedger":true,"clearsWebhooks":true},"ledger":{"description":"Recent provider requests with sensitive headers and fields redacted.","recordsFields":["timestamp","method","host","path","route","operationId","correlationId","identity","request","response","summary","sideEffects","webhookDeliveries","durationMs"],"redactsSensitive":true,"correlationId":true,"webhookDeliveries":true,"sideEffects":true,"persistent":true,"maxEntries":1000},"inspectorTabs":[{"id":"overview","title":"Overview","kind":"landing","description":"Service surfaces, base URLs, and connection snippets."},{"id":"ledger","title":"Ledger","kind":"ledger","description":"Recent provider requests recorded by the emulator."},{"id":"state","title":"State","kind":"state","description":"Current seeded and mutated instance state."},{"id":"credentials","title":"Credentials","kind":"credentials","description":"Mint tokens, API keys, or OAuth clients."},{"id":"seed","title":"Seed","kind":"seed","description":"Seed state or load a scenario."},{"id":"spec","title":"Spec","kind":"spec","description":"OpenAPI / GraphQL spec sources and coverage."}]},"instance":null,"sampleInstance":{"service":"okta","instance":"your-instance","baseUrl":"https://okta.your-instance.emulators.dev","providerBaseUrl":"https://okta.your-instance.emulators.dev","controlBaseUrl":"https://okta.your-instance.emulators.dev/_emulate"},"connections":[{"id":"okta-auth-js","title":"Okta Auth JS (TypeScript)","kind":"sdk","language":"typescript","description":"Point the Okta Auth JS SDK at the emulator instance.","template":"import { OktaAuth } from \"@okta/okta-auth-js\";\n\nconst authClient = new OktaAuth({\n  issuer: \"{{baseUrl}}/oauth2/default\",\n  clientId: \"{{clientId}}\",\n  redirectUri: \"http://localhost:3000/callback\",\n  scopes: [\"openid\", \"profile\", \"email\"],\n});","body":"import { OktaAuth } from \"@okta/okta-auth-js\";\n\nconst authClient = new OktaAuth({\n  issuer: \"https://okta.your-instance.emulators.dev/oauth2/default\",\n  clientId: \"<client_id>\",\n  redirectUri: \"http://localhost:3000/callback\",\n  scopes: [\"openid\", \"profile\", \"email\"],\n});"},{"id":"okta-env","title":"Okta issuer (env)","kind":"env","language":"bash","description":"Point Okta SDKs and the management API at the emulator.","template":"OKTA_ORG_URL={{baseUrl}}\nOKTA_ISSUER={{baseUrl}}/oauth2/default\nOKTA_CLIENT_ID={{clientId}}\nOKTA_CLIENT_SECRET={{clientSecret}}\nOKTA_API_TOKEN={{token}}","body":"OKTA_ORG_URL=https://okta.your-instance.emulators.dev\nOKTA_ISSUER=https://okta.your-instance.emulators.dev/oauth2/default\nOKTA_CLIENT_ID=<client_id>\nOKTA_CLIENT_SECRET=<client_secret>\nOKTA_API_TOKEN=<token>"},{"id":"curl","title":"curl","kind":"curl","language":"bash","description":"Read the OIDC discovery document.","template":"curl -s {{baseUrl}}/oauth2/default/.well-known/openid-configuration","body":"curl -s https://okta.your-instance.emulators.dev/oauth2/default/.well-known/openid-configuration"},{"id":"base-url","title":"Base URL (env)","kind":"env","language":"bash","description":"Point your SDK or app at the emulator instead of the real provider.","template":"{{SERVICE_UPPER}}_BASE_URL={{baseUrl}}","body":"OKTA_BASE_URL=https://okta.your-instance.emulators.dev"},{"id":"create-credential","title":"Create a credential","kind":"curl","language":"bash","description":"Mint a working credential for this instance.","template":"curl -s -X POST {{controlBaseUrl}}/credentials \\\n  -H \"content-type: application/json\" \\\n  -d '{\"type\":\"{{defaultAuthType}}\"}'","body":"curl -s -X POST https://okta.your-instance.emulators.dev/_emulate/credentials \\\n  -H \"content-type: application/json\" \\\n  -d '{\"type\":\"oauth-authorization-code\"}'"},{"id":"inspect-ledger","title":"Inspect requests","kind":"curl","language":"bash","description":"Read the request ledger to validate how your app called the service.","template":"curl -s {{controlBaseUrl}}/ledger","body":"curl -s https://okta.your-instance.emulators.dev/_emulate/ledger"}]}