jwks

Creates, updates, deletes, gets or lists a jwks resource.

Overview

Name	jwks
Type	Resource
Id	okta.apps.jwks

Fields

The following fields are returned by SELECT queries:

get_jwk

Name	Datatype	Description
id	string	The unique ID of the OAuth client JSON Web Key (example: pks2f4zrZbs8nUa7p0g4)
_links	object	Specifies link relations (see Web Linking) available for the current status of an app using the JSON Hypertext Application Language specification. This object is used for dynamic discovery of related resources and lifecycle operations.
created	string	Timestamp when the OAuth 2.0 client JSON Web Key was created (example: 2023-02-21T20:08:24.000Z)
e	string	RSA key value (exponent) for key binding (example: AQAB)
kid	string	Unique identifier of the JSON Web Key in the OAUth 2.0 client's JWKS (example: SIMcCQNY3uwXoW3y0vf6VxiBb5n9pf8L2fK8d-FIbm4)
kty	string	Cryptographic algorithm family for the certificate's key pair (RSA) (example: RSA)
lastUpdated	string	Timestamp when the OAuth 2.0 client JSON Web Key was updated (example: 2023-02-21T20:08:24.000Z)
n	string	RSA key value (modulus) for key binding (example: mkC6yAJVvFwUlmM9gKjb2d-YK5qHFt-mXSsbjWKKs4EfNm-BoQeeovBZtSACyaqLc8IYFTPEURFcbDQ9DkAL04uUIRD2gaHYY7uK0jsluEaXGq2RAIsmzAwNTzkiDw4q9pDL_q7n0f_SDt1TsMaMQayB6bU5jWsmqcWJ8MCRJ1aJMjZ16un5UVx51IIeCbe4QRDxEXGAvYNczsBoZxspDt28esSpq5W0dBFxcyGVudyl54Er3FzAguhgfMVjH-bUec9j2Tl40qDTktrYgYfxz9pfjm01Hl4WYP1YQxeETpSL7cQ5Ihz4jGDtHUEOcZ4GfJrPzrGpUrak8Qp5xcwCqQ)
status	string	Status of the OAuth 2.0 client JSON Web Key (ACTIVE, INACTIVE) (example: ACTIVE, default: ACTIVE)
use	string	Acceptable use of the JSON Web Key (enc) (example: enc)
x	string	The public x coordinate for the elliptic curve point
y	string	The public y coordinate for the elliptic curve point

list_jwk

Name	Datatype	Description

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_jwk	select	appId, keyId, subdomain		Retrieves an OAuth 2.0 client JSON Web Key by keyId
list_jwk	select	appId, subdomain		Lists all JSON Web Keys for an OAuth 2.0 client app
add_jwk	insert	appId, subdomain		Adds a new JSON Web Key to the clients JSON Web Keys.<br />> **Note:** This API doesn't allow you to add a key if the existing key doesn't have a kid. This is also consistent with how the [Dynamic Client Registration](https://developer.okta.com/docs/api/openapi/okta-oauth/oauth/client) or [Applications](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/application) APIs behave, as they don't allow the creation of multiple keys without kids. Use the [Replace an Application](https://developer.okta.com/docs/api/openapi/okta-management/management/application/replaceapplication) or the [Replace a Client Application](https://developer.okta.com/docs/api/openapi/okta-oauth/oauth/client/replaceclient) operation to update the JWKS or [Delete an OAuth 2.0 Client JSON Web Key](https://developer.okta.com/docs/api/openapi/okta-management/management/applicationssopublickeys/deletejwk) and re-add the key with a kid`.
deletejwk	delete	appId, keyId, subdomain		Deletes an OAuth 2.0 Client JSON Web Key by keyId. You can only delete an inactive key.
activate_oauth2_client_json_web_key	exec	appId, keyId, subdomain		Activates an OAuth 2.0 client JSON Web Key by keyId > Note: You can have only one active encryption key at any given time for an app. When you activate an inactive key, the current active key is automatically deactivated.
deactivate_oauth2_client_json_web_key	exec	appId, keyId, subdomain		Deactivates an OAuth 2.0 client JSON Web Key by keyId > Note: You can only deactivate signing keys. Deactivating the active encryption key isn't allowed if the client has ID token encryption enabled. You can activate another encryption key, which makes the current key inactive.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
appId	string	Application ID
keyId	string	Unique id of the OAuth 2.0 client JSON Web Key (example: pks2f4zrZbs8nUa7p0g4)
subdomain	string	(default: my-org)

SELECT examples

get_jwk

Retrieves an OAuth 2.0 client JSON Web Key by keyId

SELECT
id,
_links,
created,
e,
kid,
kty,
lastUpdated,
n,
status,
use,
x,
y
FROM okta.apps.jwks
WHERE appId = '{{ appId }}' -- required
AND keyId = '{{ keyId }}' -- required
AND subdomain = '{{ subdomain }}' -- required
;

list_jwk

Lists all JSON Web Keys for an OAuth 2.0 client app

SELECT
*
FROM okta.apps.jwks
WHERE appId = '{{ appId }}' -- required
AND subdomain = '{{ subdomain }}' -- required
;

INSERT examples

add_jwk

Adds a new JSON Web Key to the clients JSON Web Keys.<br />> **Note:** This API doesn't allow you to add a key if the existing key doesn't have a kid. This is also consistent with how the [Dynamic Client Registration](https://developer.okta.com/docs/api/openapi/okta-oauth/oauth/client) or [Applications](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/application) APIs behave, as they don't allow the creation of multiple keys without kids. Use the [Replace an Application](https://developer.okta.com/docs/api/openapi/okta-management/management/application/replaceapplication) or the [Replace a Client Application](https://developer.okta.com/docs/api/openapi/okta-oauth/oauth/client/replaceclient) operation to update the JWKS or [Delete an OAuth 2.0 Client JSON Web Key](https://developer.okta.com/docs/api/openapi/okta-management/management/applicationssopublickeys/deletejwk) and re-add the key with a kid`.

INSERT INTO okta.apps.jwks (
alg,
use,
e,
kty,
n,
kid,
status,
x,
y,
appId,
subdomain
)
SELECT 
'{{ alg }}',
'{{ use }}',
'{{ e }}',
'{{ kty }}',
'{{ n }}',
'{{ kid }}',
'{{ status }}',
'{{ x }}',
'{{ y }}',
'{{ appId }}',
'{{ subdomain }}'
RETURNING
id,
_links,
created,
e,
kid,
kty,
lastUpdated,
n,
status,
use,
x,
y
;

Manifest

# Description fields are for documentation purposes
- name: jwks
props:
  - name: appId
    value: "{{ appId }}"
    description: Required parameter for the jwks resource.
  - name: subdomain
    value: "{{ subdomain }}"
    description: Required parameter for the jwks resource.
  - name: alg
    value: "{{ alg }}"
    description: |
      Algorithm used in the key
  - name: use
    value: "{{ use }}"
    description: |
      Acceptable use of the JSON Web Key
    valid_values: ['sig']
  - name: e
    value: "{{ e }}"
    description: |
      RSA key value (exponent) for key binding
  - name: kty
    value: "{{ kty }}"
    description: |
      Cryptographic algorithm family for the certificate's key pair
    valid_values: ['RSA']
  - name: n
    value: "{{ n }}"
    description: |
      RSA key value (modulus) for key binding
  - name: kid
    value: "{{ kid }}"
    description: |
      Unique identifier of the JSON Web Key in the OAUth 2.0 client's JWKS
  - name: status
    value: "{{ status }}"
    description: |
      Status of the OAuth 2.0 client JSON Web Key
    valid_values: ['ACTIVE', 'INACTIVE']
    default: ACTIVE
  - name: x
    value: "{{ x }}"
    description: |
      The public x coordinate for the elliptic curve point
  - name: y
    value: "{{ y }}"
    description: |
      The public y coordinate for the elliptic curve point

DELETE examples

deletejwk

Deletes an OAuth 2.0 Client JSON Web Key by keyId. You can only delete an inactive key.

DELETE FROM okta.apps.jwks
WHERE appId = '{{ appId }}' --required
AND keyId = '{{ keyId }}' --required
AND subdomain = '{{ subdomain }}' --required
;

Lifecycle Methods

activate_oauth2_client_json_web_key

Activates an OAuth 2.0 client JSON Web Key by keyId
> Note: You can have only one active encryption key at any given time for an app. When you activate an inactive key, the current active key is automatically deactivated.

EXEC okta.apps.jwks.activate_oauth2_client_json_web_key 
@appId='{{ appId }}' --required, 
@keyId='{{ keyId }}' --required, 
@subdomain='{{ subdomain }}' --required
;

deactivate_oauth2_client_json_web_key

Deactivates an OAuth 2.0 client JSON Web Key by keyId
> Note: You can only deactivate signing keys. Deactivating the active encryption key isn't allowed if the client has ID token encryption enabled. You can activate another encryption key, which makes the current key inactive.

EXEC okta.apps.jwks.deactivate_oauth2_client_json_web_key 
@appId='{{ appId }}' --required, 
@keyId='{{ keyId }}' --required, 
@subdomain='{{ subdomain }}' --required
;