enrollments

Creates, updates, deletes, gets or lists an enrollments resource.

Overview

Name	enrollments
Type	Resource
Id	okta.webauthn_registration.enrollments

Fields

The following fields are returned by SELECT queries:

list_web_authn_preregistration_factors

User factor variant used for WebAuthn preregistration factors

Name	Datatype	Description
id	string	ID of the factor
_links	object	Specifies link relations (see Web Linking) available using the JSON Hypertext Application Language specification. This object is used for dynamic discovery of related resources and lifecycle operations.
created	string (date-time)	Timestamp indicating when the factor was enrolled
factorType	string	Type of factor (call, email, push, question, signed_nonce, sms, token, token:hardware, token:hotp, token:software:totp, u2f, web, webauthn)
lastUpdated	string (date-time)	Timestamp indicating when the factor was last updated
profile	string	Specific attributes related to the factor (opaque JSON object)
provider	string	(CUSTOM, DUO, FIDO, GOOGLE, OKTA, RSA, SYMANTEC, YUBICO)
status	string	Status of the factor (ACTIVE, DISABLED, ENROLLED, EXPIRED, INACTIVE, NOT_SETUP, PENDING_ACTIVATION) (example: ACTIVE)
vendorName	string	Name of the factor vendor. This is usually the same as the provider. (example: OKTA)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list_web_authn_preregistration_factors	select	userId, subdomain		Lists all WebAuthn preregistration factors for the specified user
delete_web_authn_preregistration_factor	delete	userId, authenticatorEnrollmentId, subdomain		Deletes a specific WebAuthn preregistration factor for a user
activate_preregistration_enrollment	exec	subdomain		Activates a preregistered WebAuthn factor. As part of this operation, Okta first decrypts and verifies the factor PIN and enrollment data sent by the fulfillment provider.
enroll_preregistration_enrollment	exec	subdomain		Enrolls a preregistered WebAuthn factor. This WebAuthn factor has a longer challenge timeout period to accommodate the fulfillment request process. As part of this operation, Okta generates elliptic curve (EC) key-pairs used to encrypt the factor PIN and enrollment data sent by the fulfillment provider.
generate_fulfillment_request	exec	subdomain		Generates a fulfillment request by sending a WebAuthn preregistration event to start the flow. The WebAuthn preregistration integration for Okta Workflows uses a preregistration event to populate the fulfillment request.
send_pin	exec	subdomain		Sends the decoded PIN for the specified WebAuthn preregistration enrollment. PINs are sent to the user's email. To resend the PIN, call this operation again.
assign_fulfillment_error_web_authn_preregistration_factor	exec	userId, authenticatorEnrollmentId, subdomain		Assigns the fulfillment error status to a WebAuthn preregistration factor for a user. The /mark-error path indicates that the specific FULFILLMENT_ERRORED AuthFactor status is set on the enrollment.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
authenticatorEnrollmentId	string	ID for a WebAuthn preregistration factor in Okta
subdomain	string	(default: my-org)
userId	string	ID of an existing Okta user

SELECT examples

list_web_authn_preregistration_factors

Lists all WebAuthn preregistration factors for the specified user

SELECT
id,
_links,
created,
factorType,
lastUpdated,
profile,
provider,
status,
vendorName
FROM okta.webauthn_registration.enrollments
WHERE userId = '{{ userId }}' -- required
AND subdomain = '{{ subdomain }}' -- required
;

DELETE examples

delete_web_authn_preregistration_factor

Deletes a specific WebAuthn preregistration factor for a user

DELETE FROM okta.webauthn_registration.enrollments
WHERE userId = '{{ userId }}' --required
AND authenticatorEnrollmentId = '{{ authenticatorEnrollmentId }}' --required
AND subdomain = '{{ subdomain }}' --required
;

Lifecycle Methods

activate_preregistration_enrollment

Activates a preregistered WebAuthn factor. As part of this operation, Okta first decrypts and verifies the factor PIN and enrollment data sent by the fulfillment provider.

EXEC okta.webauthn_registration.enrollments.activate_preregistration_enrollment 
@subdomain='{{ subdomain }}' --required 
@@json=
'{
"credResponses": "{{ credResponses }}", 
"fulfillmentProvider": "{{ fulfillmentProvider }}", 
"pinResponseJwe": "{{ pinResponseJwe }}", 
"serial": "{{ serial }}", 
"userId": "{{ userId }}", 
"version": "{{ version }}", 
"yubicoSigningJwks": "{{ yubicoSigningJwks }}"
}'
;

enroll_preregistration_enrollment

Enrolls a preregistered WebAuthn factor. This WebAuthn factor has a longer challenge timeout period to accommodate the fulfillment request process. As part of this operation, Okta generates elliptic curve (EC) key-pairs used to encrypt the factor PIN and enrollment data sent by the fulfillment provider.

EXEC okta.webauthn_registration.enrollments.enroll_preregistration_enrollment 
@subdomain='{{ subdomain }}' --required 
@@json=
'{
"enrollmentRpIds": "{{ enrollmentRpIds }}", 
"fulfillmentProvider": "{{ fulfillmentProvider }}", 
"userId": "{{ userId }}", 
"yubicoTransportKeyJWK": "{{ yubicoTransportKeyJWK }}"
}'
;

generate_fulfillment_request

Generates a fulfillment request by sending a WebAuthn preregistration event to start the flow. The WebAuthn preregistration integration for Okta Workflows uses a preregistration event to populate the fulfillment request.

EXEC okta.webauthn_registration.enrollments.generate_fulfillment_request 
@subdomain='{{ subdomain }}' --required 
@@json=
'{
"fulfillmentData": "{{ fulfillmentData }}", 
"fulfillmentProvider": "{{ fulfillmentProvider }}", 
"userId": "{{ userId }}"
}'
;

send_pin

Sends the decoded PIN for the specified WebAuthn preregistration enrollment. PINs are sent to the user's email. To resend the PIN, call this operation again.

EXEC okta.webauthn_registration.enrollments.send_pin 
@subdomain='{{ subdomain }}' --required 
@@json=
'{
"authenticatorEnrollmentId": "{{ authenticatorEnrollmentId }}", 
"fulfillmentProvider": "{{ fulfillmentProvider }}", 
"userId": "{{ userId }}"
}'
;

assign_fulfillment_error_web_authn_preregistration_factor

Assigns the fulfillment error status to a WebAuthn preregistration factor for a user. The /mark-error path indicates that the specific FULFILLMENT_ERRORED AuthFactor status is set on the enrollment.

EXEC okta.webauthn_registration.enrollments.assign_fulfillment_error_web_authn_preregistration_factor 
@userId='{{ userId }}' --required, 
@authenticatorEnrollmentId='{{ authenticatorEnrollmentId }}' --required, 
@subdomain='{{ subdomain }}' --required
;