users

Creates, updates, deletes, gets or lists a users resource.

Overview

Name	users
Type	Resource
Id	okta.groups.users

Fields

The following fields are returned by SELECT queries:

list_group_users

Name	Datatype	Description
id	string	The unique key for the user
_embedded	object	Embedded resources related to the user using the JSON Hypertext Application Language specification
_links	object	Specifies link relations (see Web Linking available for the current status of a user. The links object is used for dynamic discovery of related resources, lifecycle operations, and credential operations. The links object is read-only. For an individual user result, the links object contains a full set of link relations available for that user as determined by your policies. For a collection of users, the links object contains only the self link. Operations that return a collection of users include List all users and List all group member users.
activated	string (date-time)	The timestamp when the user status transitioned to ACTIVE
created	string (date-time)	The timestamp when the user was created
credentials	object	Specifies primary authentication and recovery credentials for a user. Credential types and requirements vary depending on the provider and security policy of the org.
lastLogin	string (date-time)	The timestamp of the last login
lastUpdated	string (date-time)	The timestamp when the user was last updated
passwordChanged	string (date-time)	The timestamp when the user's password was last updated
profile	object	Specifies the default and custom profile properties for a user. The default user profile is based on the System for Cross-domain Identity Management: Core Schema. The only permitted customizations of the default profile are to update permissions, change whether the firstName and lastName properties are nullable, and specify a pattern for login. You can use the Profile Editor in the Admin Console or the Schemas API to make schema modifications. You can extend user profiles with custom properties. You must first add the custom property to the user profile schema before you reference it. You can use the Profile Editor in the Admin Console or the Schemas API to manage schema extensions. Custom attributes can contain HTML tags. It's the client's responsibility to escape or encode this data before displaying it. Use best-practices to prevent cross-site scripting.
realmId	string	The ID of the realm in which the user is residing. See Realms. (example: guo1bfiNtSnZYILxO0g4)
status	string	The current status of the user. The status of a user changes in response to explicit events, such as admin-driven lifecycle changes, user login, or self-service password recovery. Okta doesn't asynchronously sweep through users and update their password expiry state, for example. Instead, Okta evaluates password policy at login time, notices the password has expired, and moves the user to the expired state. When running reports, remember that the data is valid as of the last login or lifecycle event for that user. > Note: The ACTIVATING status is a transitional status that occurs when a user is being activated but hasn't completed the activation process. This status isn't directly settable through the API, nor should you use it for any of your user management workflows. (ACTIVE, DEPROVISIONED, LOCKED_OUT, PASSWORD_EXPIRED, PROVISIONED, RECOVERY, STAGED, SUSPENDED)
statusChanged	string (date-time)	The timestamp when the status of the user last changed
transitioningToStatus	string	The target status of an in-progress asynchronous status transition. This property is only returned if the user's state is transitioning. (ACTIVE, DEPROVISIONED, PROVISIONED)
type	object	The user type that determines the schema for the user's profile. The type property is a map that identifies the User Types. Currently it contains a single element, id. It can be specified when creating a new user, and can be updated by an admin on a full replace of an existing user (but not a partial update).

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list_group_users	select	groupId, subdomain	after, limit	Lists all users that are a member of a group. The default user limit is set to a very high number due to historical reasons that are no longer valid for most orgs. This will change in a future version of this API. The recommended page limit is now limit=200.
assign_user_to_group	replace	groupId, userId, subdomain		Assigns a user to a group with the OKTA_GROUP type. > Note: You only can modify memberships for groups of the OKTA_GROUP type. App imports are responsible for managing group memberships for groups of the APP_GROUP type, such as Active Directory groups.
unassign_user_from_group	delete	groupId, userId, subdomain		Unassigns a user from a group with the OKTA_GROUP type. > Note: You only can modify memberships for groups of the OKTA_GROUP type. > > App imports are responsible for managing group memberships for groups of the APP_GROUP type, such as Active Directory groups.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
groupId	string	The id of the group
subdomain	string	(default: my-org)
userId	string	ID of an existing Okta user
after	string	The cursor to use for pagination. It is an opaque string that specifies your current location in the list and is obtained from the Link response header. See Pagination and Link header.
limit	integer (int32)	Specifies the number of user results in a page

SELECT examples

list_group_users

Lists all users that are a member of a group.
The default user limit is set to a very high number due to historical reasons that are no longer valid for most orgs. This will change in a future version of this API. The recommended page limit is now limit=200.

SELECT
id,
_embedded,
_links,
activated,
created,
credentials,
lastLogin,
lastUpdated,
passwordChanged,
profile,
realmId,
status,
statusChanged,
transitioningToStatus,
type
FROM okta.groups.users
WHERE groupId = '{{ groupId }}' -- required
AND subdomain = '{{ subdomain }}' -- required
AND after = '{{ after }}'
AND limit = '{{ limit }}'
;

REPLACE examples

assign_user_to_group

Assigns a user to a group with the OKTA_GROUP type.
> Note: You only can modify memberships for groups of the OKTA_GROUP type. App imports are responsible for managing group memberships for groups of the APP_GROUP type, such as Active Directory groups.

REPLACE okta.groups.users
SET 
-- No updatable properties
WHERE 
groupId = '{{ groupId }}' --required
AND userId = '{{ userId }}' --required
AND subdomain = '{{ subdomain }}' --required;

DELETE examples

unassign_user_from_group

Unassigns a user from a group with the OKTA_GROUP type.
> Note: You only can modify memberships for groups of the OKTA_GROUP type.
>
> App imports are responsible for managing group memberships for groups of the APP_GROUP type, such as Active Directory groups.

DELETE FROM okta.groups.users
WHERE groupId = '{{ groupId }}' --required
AND userId = '{{ userId }}' --required
AND subdomain = '{{ subdomain }}' --required
;