secrets

Creates, updates, deletes, gets or lists a secrets resource.

Overview

Name	secrets
Type	Resource
Id	okta.apps.secrets

Fields

The following fields are returned by SELECT queries:

get_oauth2_client_secret

Name	Datatype	Description
id	string	The unique ID of the OAuth 2.0 client secret (example: ocs2f4zrZbs8nUa7p0g4)
_links	object	Specifies link relations (see Web Linking) available for the current status of an app using the JSON Hypertext Application Language specification. This object is used for dynamic discovery of related resources and lifecycle operations.
client_secret	string	The OAuth 2.0 client secret string (example: DRUFXGF9XbLn......a3x3POBiIxDreBCdZuFs5B)
created	string	Timestamp when the OAuth 2.0 client secret was created (example: 2023-02-21T20:08:24.000Z)
lastUpdated	string	Timestamp when the OAuth 2.0 client secret was updated (example: 2023-02-21T20:08:24.000Z)
secret_hash	string	OAuth 2.0 client secret string hash (example: yk4SVx4sUWVJVbHt6M-UPA)
status	string	Status of the OAuth 2.0 client secret (ACTIVE, INACTIVE) (example: ACTIVE, default: ACTIVE)

list_oauth2_client_secrets

Name	Datatype	Description
id	string	The unique ID of the OAuth 2.0 client secret (example: ocs2f4zrZbs8nUa7p0g4)
_links	object	Specifies link relations (see Web Linking) available for the current status of an app using the JSON Hypertext Application Language specification. This object is used for dynamic discovery of related resources and lifecycle operations.
client_secret	string	The OAuth 2.0 client secret string (example: DRUFXGF9XbLn......a3x3POBiIxDreBCdZuFs5B)
created	string	Timestamp when the OAuth 2.0 client secret was created (example: 2023-02-21T20:08:24.000Z)
lastUpdated	string	Timestamp when the OAuth 2.0 client secret was updated (example: 2023-02-21T20:08:24.000Z)
secret_hash	string	OAuth 2.0 client secret string hash (example: yk4SVx4sUWVJVbHt6M-UPA)
status	string	Status of the OAuth 2.0 client secret (ACTIVE, INACTIVE) (example: ACTIVE, default: ACTIVE)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_oauth2_client_secret	select	appId, secretId, subdomain		Retrieves an OAuth 2.0 client secrets by secretId
list_oauth2_client_secrets	select	appId, subdomain		Lists all client secrets for an OAuth 2.0 client app
create_oauth2_client_secret	insert	appId, subdomain		Creates an OAuth 2.0 client secret object with a new active client secret. You can create up to two secret objects. An error is returned if you attempt to create more than two secret objects. > Note: This API lets you bring your own secret. If token_endpoint_auth_method of the app is client_secret_jwt, then the minimum length of client_secret is 32 characters. If no secret is specified in the request, Okta adds a new system-generated secret.
delete_oauth2_client_secret	delete	appId, secretId, subdomain		Deletes an OAuth 2.0 client secret by secretId. You can only delete an inactive secret.
activate_oauth2_client_secret	exec	appId, secretId, subdomain		Activates an OAuth 2.0 client secret by secretId
deactivate_oauth2_client_secret	exec	appId, secretId, subdomain		Deactivates an OAuth 2.0 client secret by secretId. You can't deactivate a secret if it's the only secret of the client.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
appId	string	Application ID
secretId	string	Unique id of the OAuth 2.0 client secret (example: ocs2f4zrZbs8nUa7p0g4)
subdomain	string	(default: my-org)

SELECT examples

get_oauth2_client_secret

Retrieves an OAuth 2.0 client secrets by secretId

SELECT
id,
_links,
client_secret,
created,
lastUpdated,
secret_hash,
status
FROM okta.apps.secrets
WHERE appId = '{{ appId }}' -- required
AND secretId = '{{ secretId }}' -- required
AND subdomain = '{{ subdomain }}' -- required
;

list_oauth2_client_secrets

Lists all client secrets for an OAuth 2.0 client app

SELECT
id,
_links,
client_secret,
created,
lastUpdated,
secret_hash,
status
FROM okta.apps.secrets
WHERE appId = '{{ appId }}' -- required
AND subdomain = '{{ subdomain }}' -- required
;

INSERT examples

create_oauth2_client_secret

Creates an OAuth 2.0 client secret object with a new active client secret. You can create up to two secret objects. An error is returned if you attempt to create more than two secret objects.
> Note: This API lets you bring your own secret. If token_endpoint_auth_method of the app is client_secret_jwt, then the minimum length of client_secret is 32 characters. If no secret is specified in the request, Okta adds a new system-generated secret.

INSERT INTO okta.apps.secrets (
client_secret,
status,
appId,
subdomain
)
SELECT 
'{{ client_secret }}',
'{{ status }}',
'{{ appId }}',
'{{ subdomain }}'
RETURNING
id,
_links,
client_secret,
created,
lastUpdated,
secret_hash,
status
;

Manifest

# Description fields are for documentation purposes
- name: secrets
props:
  - name: appId
    value: "{{ appId }}"
    description: Required parameter for the secrets resource.
  - name: subdomain
    value: "{{ subdomain }}"
    description: Required parameter for the secrets resource.
  - name: client_secret
    value: "{{ client_secret }}"
    description: |
      The OAuth 2.0 client secret string
  - name: status
    value: "{{ status }}"
    description: |
      Status of the OAuth 2.0 client secret
    valid_values: ['ACTIVE', 'INACTIVE']

DELETE examples

delete_oauth2_client_secret

Deletes an OAuth 2.0 client secret by secretId. You can only delete an inactive secret.

DELETE FROM okta.apps.secrets
WHERE appId = '{{ appId }}' --required
AND secretId = '{{ secretId }}' --required
AND subdomain = '{{ subdomain }}' --required
;

Lifecycle Methods

activate_oauth2_client_secret

Activates an OAuth 2.0 client secret by secretId

EXEC okta.apps.secrets.activate_oauth2_client_secret 
@appId='{{ appId }}' --required, 
@secretId='{{ secretId }}' --required, 
@subdomain='{{ subdomain }}' --required
;

deactivate_oauth2_client_secret

Deactivates an OAuth 2.0 client secret by secretId. You can't deactivate a secret if it's the only secret of the client.

EXEC okta.apps.secrets.deactivate_oauth2_client_secret 
@appId='{{ appId }}' --required, 
@secretId='{{ secretId }}' --required, 
@subdomain='{{ subdomain }}' --required
;