keys

Creates, updates, deletes, gets or lists a keys resource.

Overview

Name	keys
Type	Resource
Id	okta.idps.keys

Fields

The following fields are returned by SELECT queries:

get_identity_provider_key

Name	Datatype	Description
created	string (date-time)	Timestamp when the object was created (example: 2016-01-03T18:15:47.000Z)
e	string	The exponent value for the RSA public key (example: AQAB)
expiresAt	string (date-time)	Timestamp when the object expires (example: 2016-01-03T18:15:47.000Z)
kid	string	Unique identifier for the key (example: your-key-id)
kty	string	Identifies the cryptographic algorithm family used with the key (example: RSA)
lastUpdated	string (date-time)	Timestamp when the object was last updated (example: 2016-01-03T18:15:47.000Z)
n	string	The modulus value for the RSA public key (example: 101438407598598116085679865987760095721749307901605456708912786847324207000576780508113360584555007890315805735307890113536927352312915634368993759211767770602174860126854831344273970871509573365292777620005537635317282520456901584213746937262823585533063042033441296629204165064680610660631365266976782082747)
use	string	Intended use of the public key (example: sig)
x5c	array	Base64-encoded X.509 certificate chain with DER encoding
x5t#S256	string	Base64url-encoded SHA-256 thumbprint of the DER encoding of an X.509 certificate (example: wzPVobIrveR1x-PCbjsFGNV-6zn7Rm9KuOWOG4Rk6jE)

list_identity_provider_keys

A JSON Web Key for a signature or encryption credential for an IdP

Name	Datatype	Description
created	string (date-time)	Timestamp when the object was created (example: 2016-01-03T18:15:47.000Z)
e	string	The exponent value for the RSA public key (example: AQAB)
expiresAt	string (date-time)	Timestamp when the object expires (example: 2016-01-03T18:15:47.000Z)
kid	string	Unique identifier for the key (example: your-key-id)
kty	string	Identifies the cryptographic algorithm family used with the key (example: RSA)
lastUpdated	string (date-time)	Timestamp when the object was last updated (example: 2016-01-03T18:15:47.000Z)
n	string	The modulus value for the RSA public key (example: 101438407598598116085679865987760095721749307901605456708912786847324207000576780508113360584555007890315805735307890113536927352312915634368993759211767770602174860126854831344273970871509573365292777620005537635317282520456901584213746937262823585533063042033441296629204165064680610660631365266976782082747)
use	string	Intended use of the public key (example: sig)
x5c	array	Base64-encoded X.509 certificate chain with DER encoding
x5t#S256	string	Base64url-encoded SHA-256 thumbprint of the DER encoding of an X.509 certificate (example: wzPVobIrveR1x-PCbjsFGNV-6zn7Rm9KuOWOG4Rk6jE)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_identity_provider_key	select	kid, subdomain		Retrieves a specific identity provider (IdP) key credential by kid
list_identity_provider_keys	select	subdomain	after, limit	Lists all identity provider (IdP) key credentials
create_identity_provider_key	insert	subdomain, x5c		Creates a new X.509 certificate credential in the identity provider (IdP) key store > Note: RSA-based certificates are supported for all IdP types. Okta currently supports EC-based certificates only for the X509 IdP type. For EC-based certificates we support only P-256, P-384, and P-521 curves.
replace_identity_provider_key	replace	kid, subdomain		Replaces an identity provider (IdP) key credential by kid
delete_identity_provider_key	delete	kid, subdomain		Deletes a specific identity provider (IdP) key credential by kid if it isn't currently being used by an active or inactive IdP

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
kid	string	Unique id of the IdP key credential
subdomain	string	(default: my-org)
after	string	The cursor to use for pagination. It is an opaque string that specifies your current location in the list and is obtained from the Link response header. See Pagination and Link header.
limit	integer	A limit on the number of objects to return

SELECT examples

get_identity_provider_key

Retrieves a specific identity provider (IdP) key credential by kid

SELECT
created,
e,
expiresAt,
kid,
kty,
lastUpdated,
n,
use,
x5c,
x5t#S256
FROM okta.idps.keys
WHERE kid = '{{ kid }}' -- required
AND subdomain = '{{ subdomain }}' -- required
;

list_identity_provider_keys

Lists all identity provider (IdP) key credentials

SELECT
created,
e,
expiresAt,
kid,
kty,
lastUpdated,
n,
use,
x5c,
x5t#S256
FROM okta.idps.keys
WHERE subdomain = '{{ subdomain }}' -- required
AND after = '{{ after }}'
AND limit = '{{ limit }}'
;

INSERT examples

create_identity_provider_key

Creates a new X.509 certificate credential in the identity provider (IdP) key store
> Note: RSA-based certificates are supported for all IdP types. Okta currently supports EC-based certificates only for the X509 IdP type. For EC-based certificates we support only P-256, P-384, and P-521 curves.

INSERT INTO okta.idps.keys (
x5c,
subdomain
)
SELECT 
'{{ x5c }}' /* required */,
'{{ subdomain }}'
RETURNING
created,
e,
expiresAt,
kid,
kty,
lastUpdated,
n,
use,
x5c,
x5t#S256
;

Manifest

# Description fields are for documentation purposes
- name: keys
props:
  - name: subdomain
    value: "{{ subdomain }}"
    description: Required parameter for the keys resource.
  - name: x5c
    value:
      - "{{ x5c }}"
    description: |
      Base64-encoded X.509 certificate chain with DER encoding

REPLACE examples

replace_identity_provider_key

Replaces an identity provider (IdP) key credential by kid

REPLACE okta.idps.keys
SET 
e = '{{ e }}',
kid = '{{ kid }}',
kty = '{{ kty }}',
n = '{{ n }}',
use = '{{ use }}',
x5c = '{{ x5c }}',
x5t#S256 = '{{ x5t#S256 }}'
WHERE 
kid = '{{ kid }}' --required
AND subdomain = '{{ subdomain }}' --required
RETURNING
created,
e,
expiresAt,
kid,
kty,
lastUpdated,
n,
use,
x5c,
x5t#S256;

DELETE examples

delete_identity_provider_key

Deletes a specific identity provider (IdP) key credential by kid if it isn't currently being used by an active or inactive IdP

DELETE FROM okta.idps.keys
WHERE kid = '{{ kid }}' --required
AND subdomain = '{{ subdomain }}' --required
;