claims

Creates, updates, deletes, gets or lists a claims resource.

Overview

Name	claims
Type	Resource
Id	okta.authorizationservers.claims

Fields

The following fields are returned by SELECT queries:

get_oauth2_claim

Name	Datatype	Description
id	string	ID of the Claim
name	string	Name of the Claim
_links	object	Specifies link relations (see Web Linking) available using the JSON Hypertext Application Language specification. This object is used for dynamic discovery of related resources and lifecycle operations.
alwaysIncludeInToken	boolean	Specifies whether to include Claims in the token. The value is always TRUE for access token Claims. If the value is set to FALSE for an ID token claim, the Claim isn't included in the ID token when the token is requested with the access token or with the authorization_code. The client instead uses the access token to get Claims from the /userinfo endpoint.
claimType	string	Specifies whether the Claim is for an access token (RESOURCE) or an ID token (IDENTITY) (IDENTITY, RESOURCE)
conditions	object	Specifies the scopes for the Claim
group_filter_type	string	Specifies the type of group filter if valueType is GROUPS If valueType is GROUPS, then the groups returned are filtered according to the value of group_filter_type. If you have complex filters for Groups, you can create a Groups allowlist to put them all in a Claim. (CONTAINS, EQUALS, REGEX, STARTS_WITH)
status	string	(ACTIVE, INACTIVE)
system	boolean	When true, indicates that Okta created the Claim
value	string	Specifies the value of the Claim. This value must be a string literal if valueType is GROUPS, and the string literal is matched with the selected group_filter_type. The value must be an Okta EL expression if valueType is EXPRESSION.
valueType	string	Specifies whether the Claim is an Okta Expression Language (EL) expression (EXPRESSION), a set of groups (GROUPS), or a system claim (SYSTEM) (EXPRESSION, GROUPS, SYSTEM)

list_oauth2_claims

Name	Datatype	Description
id	string	ID of the Claim
name	string	Name of the Claim
_links	object	Specifies link relations (see Web Linking) available using the JSON Hypertext Application Language specification. This object is used for dynamic discovery of related resources and lifecycle operations.
alwaysIncludeInToken	boolean	Specifies whether to include Claims in the token. The value is always TRUE for access token Claims. If the value is set to FALSE for an ID token claim, the Claim isn't included in the ID token when the token is requested with the access token or with the authorization_code. The client instead uses the access token to get Claims from the /userinfo endpoint.
claimType	string	Specifies whether the Claim is for an access token (RESOURCE) or an ID token (IDENTITY) (IDENTITY, RESOURCE)
conditions	object	Specifies the scopes for the Claim
group_filter_type	string	Specifies the type of group filter if valueType is GROUPS If valueType is GROUPS, then the groups returned are filtered according to the value of group_filter_type. If you have complex filters for Groups, you can create a Groups allowlist to put them all in a Claim. (CONTAINS, EQUALS, REGEX, STARTS_WITH)
status	string	(ACTIVE, INACTIVE)
system	boolean	When true, indicates that Okta created the Claim
value	string	Specifies the value of the Claim. This value must be a string literal if valueType is GROUPS, and the string literal is matched with the selected group_filter_type. The value must be an Okta EL expression if valueType is EXPRESSION.
valueType	string	Specifies whether the Claim is an Okta Expression Language (EL) expression (EXPRESSION), a set of groups (GROUPS), or a system claim (SYSTEM) (EXPRESSION, GROUPS, SYSTEM)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_oauth2_claim	select	authServerId, claimId, subdomain		Retrieves a custom token Claim by the specified claimId
list_oauth2_claims	select	authServerId, subdomain		Lists all custom token Claims defined for a specified custom authorization server
create_oauth2_claim	insert	authServerId, subdomain		Creates a custom token Claim for a custom authorization server
replace_oauth2_claim	replace	authServerId, claimId, subdomain		Replaces a custom token Claim specified by the claimId
delete_oauth2_claim	delete	authServerId, claimId, subdomain		Deletes a custom token Claim specified by the claimId

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
authServerId	string	id of the Authorization Server
claimId	string	id of Claim
subdomain	string	(default: my-org)

SELECT examples

get_oauth2_claim

Retrieves a custom token Claim by the specified claimId

SELECT
id,
name,
_links,
alwaysIncludeInToken,
claimType,
conditions,
group_filter_type,
status,
system,
value,
valueType
FROM okta.authorizationservers.claims
WHERE authServerId = '{{ authServerId }}' -- required
AND claimId = '{{ claimId }}' -- required
AND subdomain = '{{ subdomain }}' -- required
;

list_oauth2_claims

Lists all custom token Claims defined for a specified custom authorization server

SELECT
id,
name,
_links,
alwaysIncludeInToken,
claimType,
conditions,
group_filter_type,
status,
system,
value,
valueType
FROM okta.authorizationservers.claims
WHERE authServerId = '{{ authServerId }}' -- required
AND subdomain = '{{ subdomain }}' -- required
;

INSERT examples

create_oauth2_claim

Creates a custom token Claim for a custom authorization server

INSERT INTO okta.authorizationservers.claims (
alwaysIncludeInToken,
claimType,
conditions,
group_filter_type,
name,
status,
system,
value,
valueType,
authServerId,
subdomain
)
SELECT 
{{ alwaysIncludeInToken }},
'{{ claimType }}',
'{{ conditions }}',
'{{ group_filter_type }}',
'{{ name }}',
'{{ status }}',
{{ system }},
'{{ value }}',
'{{ valueType }}',
'{{ authServerId }}',
'{{ subdomain }}'
RETURNING
id,
name,
_links,
alwaysIncludeInToken,
claimType,
conditions,
group_filter_type,
status,
system,
value,
valueType
;

Manifest

# Description fields are for documentation purposes
- name: claims
props:
  - name: authServerId
    value: "{{ authServerId }}"
    description: Required parameter for the claims resource.
  - name: subdomain
    value: "{{ subdomain }}"
    description: Required parameter for the claims resource.
  - name: alwaysIncludeInToken
    value: {{ alwaysIncludeInToken }}
    description: |
      Specifies whether to include Claims in the token. The value is always `TRUE` for access token Claims. If the value is set to `FALSE` for an ID token claim, the Claim isn't included in the ID token when the token is requested with the access token or with the `authorization_code`. The client instead uses the access token to get Claims from the `/userinfo` endpoint.
  - name: claimType
    value: "{{ claimType }}"
    description: |
      Specifies whether the Claim is for an access token (`RESOURCE`) or an ID token (`IDENTITY`)
    valid_values: ['IDENTITY', 'RESOURCE']
  - name: conditions
    description: |
      Specifies the scopes for the Claim
    value:
      scopes:
        - "{{ scopes }}"
  - name: group_filter_type
    value: "{{ group_filter_type }}"
    description: |
      Specifies the type of group filter if `valueType` is `GROUPS`
      If `valueType` is `GROUPS`, then the groups returned are filtered according to the value of `group_filter_type`.
      If you have complex filters for Groups, you can [create a Groups allowlist](https://developer.okta.com/docs/guides/customize-tokens-groups-claim/main/) to put them all in a Claim.
    valid_values: ['CONTAINS', 'EQUALS', 'REGEX', 'STARTS_WITH']
  - name: name
    value: "{{ name }}"
    description: |
      Name of the Claim
  - name: status
    value: "{{ status }}"
    valid_values: ['ACTIVE', 'INACTIVE']
  - name: system
    value: {{ system }}
    description: |
      When `true`, indicates that Okta created the Claim
  - name: value
    value: "{{ value }}"
    description: |
      Specifies the value of the Claim. This value must be a string literal if `valueType` is `GROUPS`, and the string literal is matched with the selected `group_filter_type`. The value must be an Okta EL expression if `valueType` is `EXPRESSION`.
  - name: valueType
    value: "{{ valueType }}"
    description: |
      Specifies whether the Claim is an Okta Expression Language (EL) expression (`EXPRESSION`), a set of groups (`GROUPS`), or a system claim (`SYSTEM`)
    valid_values: ['EXPRESSION', 'GROUPS', 'SYSTEM']

REPLACE examples

replace_oauth2_claim

Replaces a custom token Claim specified by the claimId

REPLACE okta.authorizationservers.claims
SET 
alwaysIncludeInToken = {{ alwaysIncludeInToken }},
claimType = '{{ claimType }}',
conditions = '{{ conditions }}',
group_filter_type = '{{ group_filter_type }}',
name = '{{ name }}',
status = '{{ status }}',
system = {{ system }},
value = '{{ value }}',
valueType = '{{ valueType }}'
WHERE 
authServerId = '{{ authServerId }}' --required
AND claimId = '{{ claimId }}' --required
AND subdomain = '{{ subdomain }}' --required
RETURNING
id,
name,
_links,
alwaysIncludeInToken,
claimType,
conditions,
group_filter_type,
status,
system,
value,
valueType;

DELETE examples

delete_oauth2_claim

Deletes a custom token Claim specified by the claimId

DELETE FROM okta.authorizationservers.claims
WHERE authServerId = '{{ authServerId }}' --required
AND claimId = '{{ claimId }}' --required
AND subdomain = '{{ subdomain }}' --required
;