Okta Management API

Alert history

• Informational

  Okta Management API version bump to 2026.07.1

  Jul 14, 2026, 6:00 AM

  The Okta Management API specification version was incremented from 2026.07.0 to 2026.07.1. This is a version metadata update with no documented API changes.

• Informational

  Okta API 2026.07.0: lifecycle promotions and DevicePostureChecks removal

  Jul 13, 2026, 9:00 AM

  Several features have been promoted in lifecycle status, and the DevicePostureChecks schema plus associated examples have been removed from the spec:

  • ApplicationInterclientTrustMappings endpoints promoted from EA → LIMITED_GA
  • autoEnroll field, SsprSettings schema, sspr-recovery-email-without-enrollment examples, and MFA enroll policy examples promoted from EA → GA (isGenerallyAvailable: true)
  • DevicePostureChecks schema and the devicePostureChecks field on the device assurance policy object have been removed from the spec, along with MacOSWithDevicePostureChecks and WindowsWithDevicePostureChecks examples — this was previously an EA feature
  • SubmissionEM examples promoted from GA isGenerallyAvailable: false → true
  • Version bumped from 2026.06.3 to 2026.07.0
• Informational

  Version bump 2026.06.2 → 2026.06.3, SKU metadata cleared

  Jun 29, 2026, 9:00 AM

  The API version was incremented from 2026.06.2 to 2026.06.3, and the SKUs field in the x-okta-lifecycle metadata was changed from listing ["API Access Management"] to an empty array [] across all authorization server endpoints. This is a metadata change with no impact on endpoint behavior, request/response schemas, or authentication requirements.

• Informational

  DevicePostureCheck endpoints lifecycle status updated to LIMITED_GA

  Jun 26, 2026, 5:00 AM

  Three DevicePostureCheck endpoints (GET and DELETE on device posture checks collection and detail resource) have been reclassified from general availability (GA) to limited general availability (LIMITED_GA), and now require the Okta Identity Engine SKU. This is a product availability change that may affect feature access planning, though it does not alter the functional API contract.

• Informational

  DevicePostureCheck endpoints moved from EA to GA

  Jun 16, 2026, 5:00 AM

  Three DevicePostureCheck endpoints (GET /api/v1/device-posture-checks, GET /api/v1/device-posture-checks/{id}, and DELETE /api/v1/device-posture-checks/{id}) transitioned from Early Access (EA) to General Availability (GA). The x-okta-lifecycle metadata changed from lifecycle: EA with isGenerallyAvailable: false to lifecycle: GA with isGenerallyAvailable: true, and the SKUs field was removed. This is a status update indicating feature maturation but does not change the functional API contract.

• Informational

  Update lifecycle status for bot protection and telephony provider APIs

  Jun 9, 2026, 8:00 AM

  The specification updates lifecycle statuses for three feature groups: Bot Protection endpoints transition from EA to LIMITED_GA; Custom Telephony Provider endpoints transition from EA to GA; and SCIM submission examples along with related schemas transition from isGenerallyAvailable: false to isGenerallyAvailable: true. These are documentation-only changes indicating maturity progression of existing APIs with no impact on API functionality or contracts.

• Breaking

  Okta Management API 2026.05.1: schema changes, scope removals, new tag

  May 25, 2026, 5:01 PM

  This version bump (2026.03.0 → 2026.05.1) includes several potentially breaking changes alongside additive ones:

  • WorkflowsValidationError schema breaking change: The result property (a $ref to WorkflowsValidationErrorType enum) is removed and replaced with new required string fields code, flowName, message, and link. The WorkflowsValidationErrorType enum schema is also removed entirely. Any code deserializing this response shape will break.
  • OAuth scopes removed: okta.authenticators.manage.self, okta.manifests.manage, okta.manifests.read, okta.operations.read, okta.privilegedResources.manage, okta.privilegedResources.read, okta.riskEvents.manage, okta.riskProviders.manage, okta.riskProviders.read, okta.users.manage.self, and okta.users.read.self are no longer listed in the security scheme scopes — clients requesting these scopes may receive errors.
  • New OktaManagedUserAccount tag added (new API surface for managing Okta users via Okta Privileged Access) — purely additive.
  • Documentation updates: Policy type SIGN_ON renamed to OKTA_SIGN_ON in docs; new SESSION_VIOLATION_DETECTION and IDENTITY_CLAIM_SOURCING policy types documented; WebAuthn rebrand to Passkey (FIDO2 WebAuthn) finalized with no parameter name changes.