network_zones

Creates, updates, deletes, gets or lists a network_zones resource.

Overview

Name	network_zones
Type	Resource
Id	okta.zones.network_zones

Fields

The following fields are returned by SELECT queries:

get_network_zone

Name	Datatype	Description
id	string	Unique identifier for the Network Zone
name	string	Unique name for this Network Zone
_links	object	Specifies link relations (see Web Linking) available using the JSON Hypertext Application Language specification. This object is used for dynamic discovery of related resources and lifecycle operations.
created	string (date-time)	Timestamp when the object was created
lastUpdated	string (date-time)	Timestamp when the object was last modified
status	string	Network Zone status (ACTIVE, INACTIVE)
system	boolean	Indicates a system Network Zone: * true for system Network Zones * false for custom Network Zones The Okta org provides the following default system Network Zones: * LegacyIpZone * BlockedIpZone * DefaultEnhancedDynamicZone * DefaultExemptIpZone Admins can modify the name of the default system Network Zone and add up to 5000 gateway or proxy IP entries.
type	string	The type of Network Zone (DYNAMIC, IP, DYNAMIC_V2)
usage	string	The usage of the Network Zone (BLOCKLIST, POLICY)

list_network_zones

Name	Datatype	Description
id	string	Unique identifier for the Network Zone
name	string	Unique name for this Network Zone
_links	object	Specifies link relations (see Web Linking) available using the JSON Hypertext Application Language specification. This object is used for dynamic discovery of related resources and lifecycle operations.
created	string (date-time)	Timestamp when the object was created
lastUpdated	string (date-time)	Timestamp when the object was last modified
status	string	Network Zone status (ACTIVE, INACTIVE)
system	boolean	Indicates a system Network Zone: * true for system Network Zones * false for custom Network Zones The Okta org provides the following default system Network Zones: * LegacyIpZone * BlockedIpZone * DefaultEnhancedDynamicZone * DefaultExemptIpZone Admins can modify the name of the default system Network Zone and add up to 5000 gateway or proxy IP entries.
type	string	The type of Network Zone (DYNAMIC, IP, DYNAMIC_V2)
usage	string	The usage of the Network Zone (BLOCKLIST, POLICY)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_network_zone	select	zoneId, subdomain		Retrieves a Network Zone by zoneId
list_network_zones	select	subdomain	after, limit, filter	Lists all Network Zones with pagination. A subset of zones can be returned that match a supported filter expression or query. This operation requires URL encoding. For example, filter=(id eq "nzoul0wf9jyb8xwZm0g3" or id eq "nzoul1MxmGN18NDQT0g3") is encoded as filter=%28id+eq+%22nzoul0wf9jyb8xwZm0g3%22+or+id+eq+%22nzoul1MxmGN18NDQT0g3%22%29. Okta supports filtering on the id, usage, and system properties. See Filter for more information on the expressions that are used in filtering.
create_network_zone	insert	subdomain, name, type		Creates a Network Zone * For an IP Network Zone, you must define either gateways or proxies. * For a Dynamic Network Zone, you must define at least one of the following: asns, locations, or proxyType. * For an Enhanced Dynamic Network Zone, you must define at least one of the following: asns, locations, or ipServiceCategories. > Note: To view all properties for an Enhanced Dynamic Network Zone, select DYNAMIC_V2 from the type dropdown list.
replace_network_zone	replace	zoneId, subdomain, name, type		Replaces a Network Zone by zoneId. The replaced Network Zone type must be the same as the existing type. You can replace the usage (POLICY, BLOCKLIST) of a Network Zone by updating the usage attribute. IP exempt zone If you have the IP exempt zone feature enabled, you can allow traffic from specific gateway IPs irrespective of Okta ThreatInsight configurations, blocked network zones, or IP change events within Identity Threat Protection with Okta AI. When you enable this feature, Okta creates a zone called DefaultExemptIpZone. Gateway IPs that you add to this zone always have access to Okta resources. See IP exempt zone. > Note: You can't add trusted proxy IPs to this zone, delete the zone, or create additional exempt IP zones.
delete_network_zone	delete	zoneId, subdomain		Deletes a Network Zone by zoneId > Notes: > * You can't delete a Network Zone that's used by a Policy or Rule. > * For Okta Identity Engine orgs, you can't delete a Network Zone with an ACTIVE status. <x-lifecycle class="oie"></x-lifecycle>
activate_network_zone	exec	zoneId, subdomain		Activates a Network Zone by zoneId
deactivate_network_zone	exec	zoneId, subdomain		Deactivates a Network Zone by zoneId

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
subdomain	string	(default: my-org)
zoneId	string	id of the Network Zone (example: nzowc1U5Jh5xuAK0o0g3)
after	string
filter	string
limit	integer (int32)

SELECT examples

get_network_zone

Retrieves a Network Zone by zoneId

SELECT
id,
name,
_links,
created,
lastUpdated,
status,
system,
type,
usage
FROM okta.zones.network_zones
WHERE zoneId = '{{ zoneId }}' -- required
AND subdomain = '{{ subdomain }}' -- required
;

list_network_zones

Lists all Network Zones with pagination. A subset of zones can be returned that match a supported filter expression or query.

This operation requires URL encoding. For example, filter=(id eq "nzoul0wf9jyb8xwZm0g3" or id eq "nzoul1MxmGN18NDQT0g3") is encoded as filter=%28id+eq+%22nzoul0wf9jyb8xwZm0g3%22+or+id+eq+%22nzoul1MxmGN18NDQT0g3%22%29.

Okta supports filtering on the id, usage, and system properties. See Filter for more information on the expressions that are used in filtering.

SELECT
id,
name,
_links,
created,
lastUpdated,
status,
system,
type,
usage
FROM okta.zones.network_zones
WHERE subdomain = '{{ subdomain }}' -- required
AND after = '{{ after }}'
AND limit = '{{ limit }}'
AND filter = '{{ filter }}'
;

INSERT examples

create_network_zone

Creates a Network Zone
* For an IP Network Zone, you must define either gateways or proxies.
* For a Dynamic Network Zone, you must define at least one of the following: asns, locations, or proxyType.
* For an Enhanced Dynamic Network Zone, you must define at least one of the following: asns, locations, or ipServiceCategories.
> Note: To view all properties for an Enhanced Dynamic Network Zone, select DYNAMIC_V2 from the type dropdown list.

INSERT INTO okta.zones.network_zones (
name,
status,
type,
usage,
subdomain
)
SELECT 
'{{ name }}' /* required */,
'{{ status }}',
'{{ type }}' /* required */,
'{{ usage }}',
'{{ subdomain }}'
RETURNING
id,
name,
_links,
created,
lastUpdated,
status,
system,
type,
usage
;

Manifest

# Description fields are for documentation purposes
- name: network_zones
props:
  - name: subdomain
    value: "{{ subdomain }}"
    description: Required parameter for the network_zones resource.
  - name: name
    value: "{{ name }}"
    description: |
      Unique name for this Network Zone
  - name: status
    value: "{{ status }}"
    description: |
      Network Zone status
    valid_values: ['ACTIVE', 'INACTIVE']
  - name: type
    value: "{{ type }}"
    description: |
      The type of Network Zone
    valid_values: ['DYNAMIC', 'IP', 'DYNAMIC_V2']
  - name: usage
    value: "{{ usage }}"
    description: |
      The usage of the Network Zone
    valid_values: ['BLOCKLIST', 'POLICY']

REPLACE examples

replace_network_zone

Replaces a Network Zone by zoneId. The replaced Network Zone type must be the same as the existing type.
You can replace the usage (POLICY, BLOCKLIST) of a Network Zone by updating the usage attribute.

IP exempt zone

If you have the IP exempt zone feature enabled, you can allow traffic from specific gateway IPs irrespective of Okta ThreatInsight configurations, blocked network zones, or IP change events within Identity Threat Protection with Okta AI.



When you enable this feature, Okta creates a zone called DefaultExemptIpZone. Gateway IPs that you add to this zone always have access to Okta resources. See IP exempt zone.

> Note: You can't add trusted proxy IPs to this zone, delete the zone, or create additional exempt IP zones.

REPLACE okta.zones.network_zones
SET 
name = '{{ name }}',
status = '{{ status }}',
type = '{{ type }}',
usage = '{{ usage }}'
WHERE 
zoneId = '{{ zoneId }}' --required
AND subdomain = '{{ subdomain }}' --required
AND name = '{{ name }}' --required
AND type = '{{ type }}' --required
RETURNING
id,
name,
_links,
created,
lastUpdated,
status,
system,
type,
usage;

DELETE examples

delete_network_zone

Deletes a Network Zone by zoneId
> Notes:
> * You can't delete a Network Zone that's used by a Policy or Rule.
> * For Okta Identity Engine orgs, you can't delete a Network Zone with an ACTIVE status. <x-lifecycle class="oie"></x-lifecycle>

DELETE FROM okta.zones.network_zones
WHERE zoneId = '{{ zoneId }}' --required
AND subdomain = '{{ subdomain }}' --required
;

Lifecycle Methods

activate_network_zone

Activates a Network Zone by zoneId

EXEC okta.zones.network_zones.activate_network_zone 
@zoneId='{{ zoneId }}' --required, 
@subdomain='{{ subdomain }}' --required
;

deactivate_network_zone

Deactivates a Network Zone by zoneId

EXEC okta.zones.network_zones.deactivate_network_zone 
@zoneId='{{ zoneId }}' --required, 
@subdomain='{{ subdomain }}' --required
;