enrollments

Creates, updates, deletes, gets or lists an enrollments resource.

Overview

Name	enrollments
Type	Resource
Id	okta.webauthn_registration.enrollments

Fields

The following fields are returned by SELECT queries:

list_web_authn_preregistration_factors

Name	Datatype	Description
id	string	ID of the factor
_links	object	Specifies link relations (see Web Linking) available using the JSON Hypertext Application Language specification. This object is used for dynamic discovery of related resources and lifecycle operations.
created	string (date-time)	Timestamp indicating when the factor was enrolled
factorType	string	Type of factor
lastUpdated	string (date-time)	Timestamp indicating when the factor was last updated
profile	object	Specific attributes related to the factor
provider	string
status	string	Status of the factor (example: ACTIVE)
vendorName	string	Name of the factor vendor. This is usually the same as the provider. (example: OKTA)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list_web_authn_preregistration_factors	select	subdomain		Lists all WebAuthn preregistration factors for the specified user
delete_web_authn_preregistration_factor	delete	subdomain		Deletes a specific WebAuthn preregistration factor for a user
activate_preregistration_enrollment	exec	subdomain		Activates a preregistered WebAuthn factor. As part of this operation, Okta first decrypts and verifies the factor PIN and enrollment data sent by the fulfillment provider.
enroll_preregistration_enrollment	exec	subdomain		Enrolls a preregistered WebAuthn factor. This WebAuthn factor has a longer challenge timeout period to accommodate the fulfillment request process. As part of this operation, Okta generates elliptic curve (EC) key-pairs used to encrypt the factor PIN and enrollment data sent by the fulfillment provider.
generate_fulfillment_request	exec	subdomain		Generates a fulfillment request by sending a WebAuthn preregistration event to start the flow. The WebAuthn preregistration integration for Okta Workflows uses a preregistration event to populate the fulfillment request.
send_pin	exec	subdomain		Sends the decoded PIN for the specified WebAuthn preregistration enrollment. PINs are sent to the user's email. To resend the PIN, call this operation again.
assign_fulfillment_error_web_authn_preregistration_factor	exec	subdomain		Assigns the fulfillment error status to a WebAuthn preregistration factor for a user. The /mark-error path indicates that the specific FULFILLMENT_ERRORED AuthFactor status is set on the enrollment.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
subdomain	string	The domain of your organization. This can be a provided subdomain of an official okta domain (okta.com, oktapreview.com, etc) or one of your configured custom domains. (default: my-org)

SELECT examples

list_web_authn_preregistration_factors

Lists all WebAuthn preregistration factors for the specified user

SELECT
id,
_links,
created,
factorType,
lastUpdated,
profile,
provider,
status,
vendorName
FROM okta.webauthn_registration.enrollments
WHERE subdomain = '{{ subdomain }}' -- required;

DELETE examples

delete_web_authn_preregistration_factor

Deletes a specific WebAuthn preregistration factor for a user

DELETE FROM okta.webauthn_registration.enrollments
WHERE subdomain = '{{ subdomain }}' --required;

Lifecycle Methods

activate_preregistration_enrollment

Activates a preregistered WebAuthn factor. As part of this operation, Okta first decrypts and verifies the factor PIN and enrollment data sent by the fulfillment provider.

EXEC okta.webauthn_registration.enrollments.activate_preregistration_enrollment 
@subdomain='{{ subdomain }}' --required 
@@json=
'{
"credResponses": "{{ credResponses }}", 
"fulfillmentProvider": "{{ fulfillmentProvider }}", 
"pinResponseJwe": "{{ pinResponseJwe }}", 
"serial": "{{ serial }}", 
"userId": "{{ userId }}", 
"version": "{{ version }}", 
"yubicoSigningJwks": "{{ yubicoSigningJwks }}"
}';

enroll_preregistration_enrollment

Enrolls a preregistered WebAuthn factor. This WebAuthn factor has a longer challenge timeout period to accommodate the fulfillment request process. As part of this operation, Okta generates elliptic curve (EC) key-pairs used to encrypt the factor PIN and enrollment data sent by the fulfillment provider.

EXEC okta.webauthn_registration.enrollments.enroll_preregistration_enrollment 
@subdomain='{{ subdomain }}' --required 
@@json=
'{
"enrollmentRpIds": "{{ enrollmentRpIds }}", 
"fulfillmentProvider": "{{ fulfillmentProvider }}", 
"userId": "{{ userId }}", 
"yubicoTransportKeyJWK": "{{ yubicoTransportKeyJWK }}"
}';

generate_fulfillment_request

Generates a fulfillment request by sending a WebAuthn preregistration event to start the flow. The WebAuthn preregistration integration for Okta Workflows uses a preregistration event to populate the fulfillment request.

EXEC okta.webauthn_registration.enrollments.generate_fulfillment_request 
@subdomain='{{ subdomain }}' --required 
@@json=
'{
"fulfillmentData": "{{ fulfillmentData }}", 
"fulfillmentProvider": "{{ fulfillmentProvider }}", 
"userId": "{{ userId }}"
}';

send_pin

Sends the decoded PIN for the specified WebAuthn preregistration enrollment. PINs are sent to the user's email. To resend the PIN, call this operation again.

EXEC okta.webauthn_registration.enrollments.send_pin 
@subdomain='{{ subdomain }}' --required 
@@json=
'{
"authenticatorEnrollmentId": "{{ authenticatorEnrollmentId }}", 
"fulfillmentProvider": "{{ fulfillmentProvider }}", 
"userId": "{{ userId }}"
}';

assign_fulfillment_error_web_authn_preregistration_factor

Assigns the fulfillment error status to a WebAuthn preregistration factor for a user. The /mark-error path indicates that the specific FULFILLMENT_ERRORED AuthFactor status is set on the enrollment.

EXEC okta.webauthn_registration.enrollments.assign_fulfillment_error_web_authn_preregistration_factor 
@subdomain='{{ subdomain }}' --required;