Skip to main content

Connect the Okta Management API

How-to guide · Okta

Written by Agent Bob

Connect StackBob.ai to your Okta org to discover the apps your organization uses automatically, and to automate SCIM setup and reconciliation for your managed apps.
​

Once it's connected, StackBob.ai imports apps and their users from Okta and matches them to Identities in StackBob. When you set up SCIM provisioning, it also allows creating the app integration, groups, and Push Group mappings in Okta for you, so none of that setup is manual.
​

You grant access in two stages, both through a single API Services app integration in Okta:

  • Stage 1: App discovery. Read-only access to your Okta users, app integrations, and System Log.

  • Stage 2: Automated SCIM setup. Two additional scopes that let StackBob.ai create app integrations, groups, and Push Group mappings in Okta.

Complete Stage 1 to start discovering apps. Add Stage 2 when you want to use Automated setup in Set up SCIM provisioning from Okta. You can complete both stages in one sitting.

ℹ️ This Okta integration is separate from Okta SSO integration that lets your admins sign in to StackBob.ai with Okta. Do not reuse the StackBob SSO app for API access.

Prerequisites

  • A StackBob.ai organization where you hold the Org Admin role.

  • An Okta account with the Super Administrator role. Only super administrators can grant Okta API scopes and assign admin roles to an app integration.

API scopes StackBob.ai requests

Stage

Scope

What StackBob.ai uses it for

1

okta.users.read

Sync Okta identities into StackBob during discovery. Match app accounts to Okta users and detect Rogue users during SCIM setup.

1

okta.apps.read

Discover Okta apps during discovery.

1

okta.logs.read

Read sign-in events from the System Log to show app usage and last activity.

2

okta.apps.manage

Create/map Okta apps and link Push Groups.

2

okta.groups.manage

Create Okta Groups and add their members.

StackBob.ai does not request scopes for passwords, authentication factors, or policies.

Stage 1: Connect Okta for app discovery

1. Create an API Services app integration in Okta

  1. In the Okta Admin Console, go to Applications and select Create App Integration.

  2. Select API Services, then Next.

  3. Name the app integration StackBob API and select Save.

2. Grant the discovery scopes

  1. In the StackBob API app in Okta, go to the Okta API Scopes tab.

  2. Select Grant next to each of these scopes:

    • okta.users.read

    • okta.apps.read

    • okta.logs.read

3. Assign an admin role

  1. Go to the Admin roles tab in the StackBob API app in Okta and select Edit assignments.

  2. Under Role, select Read-Only Administrator.

  3. Select Save Changes.

ℹ️ The app integration needs both scopes and an admin role. Scopes decide which API calls StackBob.ai can make. The admin role decides which objects those calls can reach.

4. Generate a key pair

  1. Go to the General tab in StackBob API app in Okta . Under Client Credentials, select Edit.

  2. Set Client authentication to Public key / Private key.

  3. Under Public keys, select Add key, then select Generate new key.

  4. Copy the private key in JWK format, then select Done.

  5. Select Save.

⚠️ Okta shows the private key only once and does not store it. Paste it into StackBob.ai in the next step, and don't save it anywhere else. If you lose it, generate a new key pair.

5. Connect in StackBob.ai

  1. In StackBob.ai, add Okta as Managed App and select Connect.

  2. In the Connect Discovery Source drawer that opens → enter your Okta Org URL, for example your-company.okta.com → enter the Client ID of the StackBob API app created in Okta → Paste the Private Key in JWK format → then select Connect.

Stage 2: Enable automated SCIM setup

Complete Stage 1 first. Stage 2 adds scopes and roles to the same StackBob API app integration, and it reuses the key pair from Stage 1, so you don't need to generate a new key.

1. Grant the SCIM setup scopes

  1. In Okta, go to Applications → Applications and open the StackBob API app integration.

  2. Go to the Okta API Scopes tab.

  3. Select Grant next to each of these scopes:

    • okta.apps.manage

    • okta.groups.manage

2. Add admin roles

  1. Go to the Admin roles tab and select Edit assignments.

  2. Assign one of these roles:

    • Organization Administrator

    • A custom admin role with permissions to create and manage apps and to create and manage groups

  3. Select Save Changes.

✅ StackBob.ai can only perform actions at the intersection of what both the admin role and the granted API scopes allow. Even with a broad role such as Organization Administrator, the Stage 1 and Stage 2 scopes limit StackBob.ai to reading users, apps, and logs, and to managing apps and groups.

Result

StackBob.ai is now connected to your Okta org through the Okta Management API. With Stage 1 complete, StackBob discovers Okta apps, users and usage.
With Stage 2 complete, you can use Automated SCIM setup when setting up SCIM provisioning to a managed app from Okta.

Change or revoke access

  • To revoke write access: in Okta, revoke okta.apps.manage and okta.groups.manage on the Okta API Scopes tab. SCIM provisioning continues for apps you've already set up. Any new Okta Push Groups must then be created and linked manually in Okta.
    ​

  • To disconnect StackBob.ai from Okta entirely: deactivate the StackBob.ai app integration in Okta. This stops both app discovery and automated SCIM setup.

Troubleshooting

  • The connection succeeds, but no apps are discovered: check that all three discovery scopes are granted and that the Read-Only Administrator role is assigned.

  • Automated SCIM setup is not enabled: check that additional API scopes are granted and that the admin role assigned as listed in Stage 2 block above, then try again.

Next steps

Did this answer your question?