Okta - Parable

Sync users, groups, and applications from Okta.

Overview
Setup Guide
Permissions
Troubleshooting

Connect Parable to Okta for identity, access management, and audit log data.

Identity

Users, groups, profiles

Security

Audit logs, system events

Data streams

This Provider Plugin defines 4 data streams.

Stream	Description	Sync
`users`	Okta org users	incremental
`audit_logs`	Okta System Log events	incremental
`applications`	Okta org applications	incremental
`application_users`	Users assigned to an Okta application	full

audit_logs keeps one row per System Log event. A read that covers time an earlier read already covered, such as a backfill over days a daily load already read, matches each event by its uuid and stores it once.

API token

What You’ll Need

Credential	What it is
API Token	SSWS token from Okta admin console
Domain	Your Okta subdomain (e.g., `your-org`)

Info: Setup access in Okta. These steps require Administrator, or a colleague with equivalent permissions who can create credentials for you. If that is not you, ask your Okta administrator.

Super Administrator or Organization Administrator role
Permission to create API tokens

Step 1: Access Okta Admin Console

Log in to your Okta org
Go to the Admin Console (click Admin in the top right)

Step 2: Navigate to API Settings

Go to Security → API
Click the Tokens tab

Step 3: Create API Token

Click Create Token
Name: Parable Integration
Click Create Token

Warning: Copy your API token now! This is the only time it will be displayed. Store it in a secure password manager before closing this page.

Warning: Token inherits the creating admin’s permissions. Use a dedicated admin account.

Step 4: Note Your Okta Domain

Your Okta domain format:

https://your-org.okta.com

Or for Okta preview:

https://your-org.oktapreview.com

Step 5: Enter values in the form

Domain: Your Okta org hostname (for example your-org.okta.com without https://).
API Token: Paste your SSWS API token.
Click Save & test connection.

Application Users

Developer identifier: application_usersApplication Users covers users assigned to an Okta application.

Enables: map the Okta accounts and memberships represented by Application Users records and trace a returned access assignment to its account or group.
Scope: Users assigned to an Okta application; Parable reads every record from /api/v1/apps/{id}/users on each sync. Object and event visibility follows the API token’s Okta administrative permissions; inaccessible objects or events are not returned. A successful full collection can reveal a previously returned row as absent, but a credential or permission change can produce the same observation.

Embedded

Developer identifier: application_users._embeddedEmbedded records embedded resources related to the app user, if requested via expand parameter. It is needed to preserve the exact Okta configuration or execution metadata attached to this Okta App User record.

Enables: inspect the keys in _embedded when reproducing or investigating this record’s configuration, parameters, or execution context.
Interpretation: Okta reports this value on the Okta App User object returned for Application Users; it is interpreted at one Okta App User record per row; the schema uses the Generic.JSON scalar; metadata keys and availability follow the Okta response and can vary by resource type or configuration.

Links

Developer identifier: application_users._linksLinks records HAL-style hypermedia links for the app user resource. It is needed to inspect the exact link included with this record.

Enables: open or correlate the exact Okta resource referenced by _links while retaining the containing Application Users record as provenance.
Interpretation: Okta reports this value on the Okta App User object returned for Application Users; it is link at one Okta App User record per row; the returned link or template does not establish that the current credential can retrieve its target.

App

Developer identifier: application_users._links.appApp records link to the parent application. It is needed to inspect the exact link included with this record.

Enables: open or correlate the exact Okta resource referenced by app while retaining the containing Application Users record as provenance.
Interpretation: Okta reports this value on the Okta App User Links object returned for Application Users; it is link at one Okta App User Links record per row; the returned link or template does not establish that the current credential can retrieve its target.

Href

Developer identifier: application_users._links.app.hrefHref records the URL of the linked resource. It is needed to retain the exact Okta resource or external link reported for this Application Users record.

Enables: open or correlate the resource named by href while retaining the containing Okta Hal Link row as provenance.
Interpretation: Okta reports this value on the Okta Hal Link object returned for Application Users; it is interpreted at one Okta Hal Link record per row; the schema uses the Network.Url scalar; the returned link or template does not establish that the current credential can retrieve its target.

Name

Developer identifier: application_users._links.app.nameName records optional name for the link. It is needed to compare the exact name configuration returned for this Okta Hal Link record.

Enables: compare the exact name configuration returned for each Okta Hal Link record and select records with the configuration under review.
Interpretation: Okta reports this value on the Okta Hal Link object returned for Application Users; it is interpreted at one Okta Hal Link record per row.

Type

Developer identifier: application_users._links.app.typeType records optional media type hint for the linked resource. It is needed to distinguish Application Users rows by the exact Okta-returned type value.

Enables: separate Application Users rows by the exact Okta-returned type label when comparing type.
Interpretation: Okta reports this value on the Okta Hal Link object returned for Application Users; it is interpreted at one Okta Hal Link record per row; classification values are Okta-returned labels rather than a universal taxonomy.

Self

Developer identifier: application_users._links.selfSelf records self link for this app user assignment. It is needed to preserve the nested self relationship or details on the parent Okta App User Links record.

Enables: expand self to connect the containing Okta App User Links row to its returned self entries.
Interpretation: Okta reports this value on the Okta App User Links object returned for Application Users; it is one nested object per containing Okta App User Links object when present.

User

Developer identifier: application_users._links.userUser records link to the Okta user resource. It is needed to inspect the exact link included with this record.

Enables: open or correlate the exact Okta resource referenced by user while retaining the containing Application Users record as provenance.
Interpretation: Okta reports this value on the Okta App User Links object returned for Application Users; it is link at one Okta App User Links record per row; the returned link or template does not establish that the current credential can retrieve its target.

App ID

Developer identifier: application_users.app_idApp ID records the app id of the parent app. Parable adds it to each row when it reads that app. Okta does not return this value with the record. It is needed to refer to the same app across records without relying on display text.

Enables: match app_id to app references carrying the same Okta-issued value in related Okta records.
Interpretation: Okta’s child response does not supply this field; Parable copies it from the parent record into each row; it is an identifier, not a measured quantity.

Created

Developer identifier: application_users.createdCreated records timestamp when the user was assigned to the application. It is needed to place the record at the time or date reported for this event or state.

Enables: bound Application Users records by created, order their returned events or state changes, and correlate records reported at the same time.
Interpretation: Okta reports this value on the Okta App User object returned for Application Users; it is interpreted at one Okta App User record per row; the schema uses the Temporal.DateTime scalar.

Credentials

Developer identifier: application_users.credentialsCredentials records credentials for the user in the target application. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: expand credentials to examine the returned credentials details for the containing Okta App User record.
Interpretation: Okta reports this value on the Okta App User object returned for Application Users; it is one nested object per containing Okta App User object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Password

Developer identifier: application_users.credentials.passwordPassword records password object for the user in the target application. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: expand password to examine the returned password details for the containing Okta App User Credentials record.
Interpretation: Okta reports this value on the Okta App User Credentials object returned for Application Users; it is one nested object per containing Okta App User Credentials object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Value

Developer identifier: application_users.credentials.password.valueValue records password value (only present during creation, never returned in GET responses). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate the exact value access value with the resource, account, or membership represented by the same Application Users row.
Interpretation: Okta reports this value on the Okta App User Password object returned for Application Users; it is interpreted at one Okta App User Password record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

User Name

Developer identifier: application_users.credentials.userNameUser Name records username for the user in the target application. Often an email address. It is needed to attribute this Application Users row to the returned person, account, or organization reference.

Enables: attribute the Application Users row to the returned person or account and match the exact userName value where it recurs in Okta.
Interpretation: Okta reports this value on the Okta App User Credentials object returned for Application Users; it is interpreted at one Okta App User Credentials record per row; the username format depends on the application configuration and may be a non-email identifier. The value is preserved without email normalization.

External ID

Developer identifier: application_users.externalIdExternal ID records external ID of the user in the target application, used for cross-system identity resolution. It is needed to refer to the same external across records without relying on display text.

Enables: match externalId to external references carrying the same Okta-issued value in related Okta records.
Interpretation: Okta reports this value on the Okta App User object returned for Application Users; it is an identifier, not a measured quantity.

Developer identifier: application_users.idID. Okta’s identifier for the user assigned to the application.

Enables: Connect each application membership to the member’s Okta account through application_users.id.
Interpretation: Okta reports this value in its user namespace. The same value repeats once for every application the member belongs to, so it does not identify a row on its own. Parable uses this field as the account’s ID when it links the account to a person.

Last Updated

Developer identifier: application_users.lastUpdatedLast Updated records timestamp when the app user assignment was last modified. It is needed to place the record at the time or date reported for this event or state.

Enables: bound Application Users records by lastUpdated, order their returned events or state changes, and correlate records reported at the same time.
Interpretation: Okta reports this value on the Okta App User object returned for Application Users; it is interpreted at one Okta App User record per row; Parable uses it to keep the latest version of each record; Parable treats it as the record’s metadata timestamp; the schema uses the Temporal.DateTime scalar.

Membership Key

Developer identifier: application_users.membership_keyMembership Key. A key Parable builds from app_id and id, so each combination of those values has one key.

Enables: Identify each application membership on its own, so a member who belongs to several Okta applications has one row per application.
Interpretation: Parable calculates membership_key when it reads the record. It identifies one application-to-member relationship, not the member or the application by itself, and is not an Okta identifier. It is the record key.

Password Changed

Developer identifier: application_users.passwordChangedPassword Changed records timestamp when the app user password was last changed. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate the exact passwordChanged access value with the resource, account, or membership represented by the same Application Users row.
Interpretation: Okta reports this value on the Okta App User object returned for Application Users; it is interpreted at one Okta App User record per row; the schema uses the Temporal.DateTime scalar; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Profile

Developer identifier: application_users.profileProfile records application-specific profile attributes for the user. Schema varies by application configuration. It is needed to compare the exact profile configuration returned for this Okta App User record.

Enables: compare the exact profile configuration returned for each Okta App User record and select records with the configuration under review.
Interpretation: Okta reports this value on the Okta App User object returned for Application Users; it is interpreted at one Okta App User record per row; the schema uses the Generic.JSON scalar.

Scope

Developer identifier: application_users.scopeScope records scope of the assignment (USER or GROUP). Distinguishes direct vs group-based app assignments. It is needed to distinguish Application Users rows by the exact Okta-returned scope value.

Enables: separate Application Users rows by the exact Okta-returned scope label when comparing scope.
Interpretation: Okta reports this value on the Okta App User object returned for Application Users; it is interpreted at one Okta App User record per row; classification values are Okta-returned labels rather than a universal taxonomy.

Status

Developer identifier: application_users.statusStatus records status of the app user (e.g., ACTIVE, INACTIVE, DEPROVISIONED, PROVISIONED). It is needed to distinguish Application Users rows by the exact Okta-returned status value.

Enables: separate Application Users rows by the exact Okta-returned status label when comparing status.
Interpretation: Okta reports this value on the Okta App User object returned for Application Users; it is interpreted at one Okta App User record per row; classification values are Okta-returned labels rather than a universal taxonomy.

Status Changed

Developer identifier: application_users.statusChangedStatus Changed records timestamp when the app user status last changed. It is needed to place the record at the time or date reported for this event or state.

Enables: bound Application Users records by statusChanged, order their returned events or state changes, and correlate records reported at the same time.
Interpretation: Okta reports this value on the Okta App User object returned for Application Users; it is interpreted at one Okta App User record per row; the schema uses the Temporal.DateTime scalar; classification values are Okta-returned labels rather than a universal taxonomy.

Sync State

Developer identifier: application_users.syncStateSync State records synchronization state of the app user (e.g., DISABLED, OUT_OF_SYNC, SYNCING, SYNCHRONIZED, ERROR). It is needed to distinguish Application Users rows by the exact Okta-returned sync state value.

Enables: separate Application Users rows by the exact Okta-returned syncState label when comparing sync state.
Interpretation: Okta reports this value on the Okta App User object returned for Application Users; it is interpreted at one Okta App User record per row; classification values are Okta-returned labels rather than a universal taxonomy.

Applications

Developer identifier: applicationsApplications covers Okta org applications.

Enables: inventory returned Okta applications and compare their provider-defined sign-on, visibility, credential, and application-link settings.
Scope: Okta org applications; Parable reads the records that changed since the previous sync from /api/v1/apps. Object and event visibility follows the API token’s Okta administrative permissions; inaccessible objects or events are not returned. This stream has no deletion signal, so a missing row does not establish that the Okta record was deleted.

Embedded

Developer identifier: applications._embeddedEmbedded records embedded resources related to the application. It is needed to preserve the exact Okta configuration or execution metadata attached to this Okta App record.

Enables: inspect the keys in _embedded when reproducing or investigating this record’s configuration, parameters, or execution context.
Interpretation: Okta reports this value on the Okta App object returned for Applications; it is interpreted at one Okta App record per row; the schema uses the Generic.JSON scalar; metadata keys and availability follow the Okta response and can vary by resource type or configuration.

Links

Developer identifier: applications._linksLinks records HAL-style hypermedia links for the application. It is needed to inspect the exact link included with this record.

Enables: open or correlate the exact Okta resource referenced by _links while retaining the containing Applications record as provenance.
Interpretation: Okta reports this value on the Okta App object returned for Applications; it is link at one Okta App record per row; the returned link or template does not establish that the current credential can retrieve its target.

Access Policy

Developer identifier: applications._links.accessPolicyAccess Policy records link to the access policy. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: expand accessPolicy to examine the returned access policy details for the containing Okta App Links record.
Interpretation: Okta reports this value on the Okta App Links object returned for Applications; it is link at one Okta App Links record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; the returned link or template does not establish that the current credential can retrieve its target.

Hints

Developer identifier: applications._links.accessPolicy.hintsHints records hints about the link (e.g., allowed HTTP methods). It is needed to compare the exact hints configuration returned for this Okta App Link record.

Enables: compare the exact hints configuration returned for each Okta App Link record and select records with the configuration under review.
Interpretation: Okta reports this value on the Okta App Link object returned for Applications; it is interpreted at one Okta App Link record per row; the schema uses the Generic.JSON scalar.

Href

Developer identifier: applications._links.accessPolicy.hrefHref records the URL of the linked resource. It is the key of this nested record.

Enables: match rows that carry the same Okta identifier in href.
Interpretation: Okta reports this value on the Okta App Link object returned for Applications; it is interpreted at one Okta App Link record per row; it is the key of this nested record; the schema uses the Network.Url scalar.

Name

Developer identifier: applications._links.accessPolicy.nameName records name of the link. It is needed to compare the returned name for individual Applications rows and select rows with a specific name value.

Enables: locate Applications rows whose returned name exactly matches name and retain the Okta identifier for any cross-record match.
Interpretation: Okta reports this value on the Okta App Link object returned for Applications; it is interpreted at one Okta App Link record per row.

Type

Developer identifier: applications._links.accessPolicy.typeType records media type of the linked resource. It is needed to distinguish Applications rows by the exact Okta-returned type value.

Enables: separate Applications rows by the exact Okta-returned type label when comparing type.
Interpretation: Okta reports this value on the Okta App Link object returned for Applications; it is interpreted at one Okta App Link record per row; classification values are Okta-returned labels rather than a universal taxonomy.

Activate

Developer identifier: applications._links.activateActivate records link to activate the application. It is needed to inspect the exact link included with this record.

Enables: open or correlate the exact Okta resource referenced by activate while retaining the containing Applications record as provenance.
Interpretation: Okta reports this value on the Okta App Links object returned for Applications; it is link at one Okta App Links record per row; the returned link or template does not establish that the current credential can retrieve its target.

App Links

Developer identifier: applications._links.appLinksApp Links records application launch links. It is needed to inspect the exact link included with this record.

Enables: open or correlate the exact Okta resource referenced by appLinks while retaining the containing Applications record as provenance.
Interpretation: Okta reports this value on the Okta App Links object returned for Applications; it is link at one Okta App Links record per row; the returned link or template does not establish that the current credential can retrieve its target.

Deactivate

Developer identifier: applications._links.deactivateDeactivate records link to deactivate the application. It is needed to inspect the exact link included with this record.

Enables: open or correlate the exact Okta resource referenced by deactivate while retaining the containing Applications record as provenance.
Interpretation: Okta reports this value on the Okta App Links object returned for Applications; it is link at one Okta App Links record per row; the returned link or template does not establish that the current credential can retrieve its target.

Groups

Developer identifier: applications._links.groupsGroups records link to the groups assigned to this application. It is needed to inspect the exact link included with this record.

Enables: open or correlate the exact Okta resource referenced by groups while retaining the containing Applications record as provenance.
Interpretation: Okta reports this value on the Okta App Links object returned for Applications; it is link at one Okta App Links record per row; the returned link or template does not establish that the current credential can retrieve its target.

Logo

Developer identifier: applications._links.logoLogo records application logo links. It is needed to preserve the nested logo relationship or details on the parent Okta App Links record.

Enables: expand logo to connect the containing Okta App Links row to its returned logo entries.
Interpretation: Okta reports this value on the Okta App Links object returned for Applications; it is one returned collection per containing Okta App Links object.

Metadata

Developer identifier: applications._links.metadataMetadata records link to application metadata (e.g., SAML metadata). It is needed to inspect the exact link included with this record.

Enables: open or correlate the exact Okta resource referenced by metadata while retaining the containing Applications record as provenance.
Interpretation: Okta reports this value on the Okta App Links object returned for Applications; it is link at one Okta App Links record per row; the returned link or template does not establish that the current credential can retrieve its target.

Policies

Developer identifier: applications._links.policiesPolicies records link to associated policies. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: expand policies to examine the returned policies details for the containing Okta App Links record.
Interpretation: Okta reports this value on the Okta App Links object returned for Applications; it is link at one Okta App Links record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; the returned link or template does not establish that the current credential can retrieve its target.

Profile Enrollment

Developer identifier: applications._links.profileEnrollmentProfile Enrollment records link to profile enrollment policy. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: expand profileEnrollment to examine the returned profile enrollment details for the containing Okta App Links record.
Interpretation: Okta reports this value on the Okta App Links object returned for Applications; it is link at one Okta App Links record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; the returned link or template does not establish that the current credential can retrieve its target.

Self

Developer identifier: applications._links.selfSelf records self link for this application. It is needed to preserve the nested self relationship or details on the parent Okta App Links record.

Enables: expand self to connect the containing Okta App Links row to its returned self entries.
Interpretation: Okta reports this value on the Okta App Links object returned for Applications; it is one nested object per containing Okta App Links object when present.

Upload Logo

Developer identifier: applications._links.uploadLogoUpload Logo records link to upload a logo for the application. It is needed to inspect the exact link included with this record.

Enables: open or correlate the exact Okta resource referenced by uploadLogo while retaining the containing Applications record as provenance.
Interpretation: Okta reports this value on the Okta App Links object returned for Applications; it is link at one Okta App Links record per row; the returned link or template does not establish that the current credential can retrieve its target.

Users

Developer identifier: applications._links.usersUsers records link to the users assigned to this application. It is needed to inspect the exact link included with this record.

Enables: open or correlate the exact Okta resource referenced by users while retaining the containing Applications record as provenance.
Interpretation: Okta reports this value on the Okta App Links object returned for Applications; it is link at one Okta App Links record per row; the returned link or template does not establish that the current credential can retrieve its target.

Accessibility

Developer identifier: applications.accessibilityAccessibility records accessibility settings for the application. It is needed to preserve the nested accessibility relationship or details on the parent Okta App record.

Enables: expand accessibility to connect the containing Okta App row to its returned accessibility entries.
Interpretation: Okta reports this value on the Okta App object returned for Applications; it is one nested object per containing Okta App object when present.

Error Redirect URL

Developer identifier: applications.accessibility.errorRedirectUrlError Redirect URL records custom error redirect URL. It is needed to inspect the exact link included with this record.

Enables: open or correlate the exact Okta resource referenced by errorRedirectUrl while retaining the containing Applications record as provenance.
Interpretation: Okta reports this value on the Okta App Accessibility object returned for Applications; it is link at one Okta App Accessibility record per row; the schema uses the Network.Url scalar; the returned link or template does not establish that the current credential can retrieve its target.

Developer identifier: applications.accessibility.loginRedirectUrlLogin Redirect URL records custom login redirect URL. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate the exact loginRedirectUrl access value with the resource, account, or membership represented by the same Applications row.
Interpretation: Okta reports this value on the Okta App Accessibility object returned for Applications; it is link at one Okta App Accessibility record per row; the schema uses the Network.Url scalar; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; the returned link or template does not establish that the current credential can retrieve its target.

Self Service

Developer identifier: applications.accessibility.selfServiceSelf Service records whether users can request access to the app. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: select Applications rows with the exact selfService access-related value being investigated.
Interpretation: Okta reports this value on the Okta App Accessibility object returned for Applications; it is interpreted at one Okta App Accessibility record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.

Activated

Developer identifier: applications.activatedActivated records timestamp when the application was activated. It is needed to place the record at the time or date reported for this event or state.

Enables: bound Applications records by activated, order their returned events or state changes, and correlate records reported at the same time.
Interpretation: Okta reports this value on the Okta App object returned for Applications; it is interpreted at one Okta App record per row; the schema uses the Temporal.DateTime scalar.

Created

Developer identifier: applications.createdCreated records timestamp when the application was created. It is needed to place the record at the time or date reported for this event or state.

Enables: bound Applications records by created, order their returned events or state changes, and correlate records reported at the same time.
Interpretation: Okta reports this value on the Okta App object returned for Applications; it is interpreted at one Okta App record per row; the schema uses the Temporal.DateTime scalar.

Credentials

Developer identifier: applications.credentialsCredentials records credential settings for the application. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: expand credentials to examine the returned credentials details for the containing Okta App record.
Interpretation: Okta reports this value on the Okta App object returned for Applications; it is one nested object per containing Okta App object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

OAuth Client

Developer identifier: applications.credentials.oauthClientOAuth Client records OAuth client credentials (for OIDC apps). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: expand oauthClient to examine the returned o auth client details for the containing Okta App Credentials record.
Interpretation: Okta reports this value on the Okta App Credentials object returned for Applications; it is one nested object per containing Okta App Credentials object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Auto Key Rotation

Developer identifier: applications.credentials.oauthClient.autoKeyRotationAuto Key Rotation records whether automatic key rotation is enabled. It is needed to distinguish Applications rows by the exact Okta-returned auto key rotation value.

Enables: select Applications rows where autoKeyRotation is true or false when comparing the condition described by Auto Key Rotation.
Interpretation: Okta reports this value on the Okta App OAuth Client object returned for Applications; it is interpreted at one Okta App OAuth Client record per row; classification values are Okta-returned labels rather than a universal taxonomy.

Client ID

Developer identifier: applications.credentials.oauthClient.client_idClient ID records OAuth client ID. It is needed to refer to the same client across records without relying on display text.

Enables: match client_id to client references carrying the same Okta-issued value in related Okta records.
Interpretation: Okta reports this value on the Okta App OAuth Client object returned for Applications; it is an identifier, not a measured quantity.

Token Endpoint Auth Method

Developer identifier: applications.credentials.oauthClient.token_endpoint_auth_methodToken Endpoint Auth Method records token endpoint authentication method (client_secret_basic, client_secret_post, private_key_jwt, none). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate the exact token_endpoint_auth_method access value with the resource, account, or membership represented by the same Applications row.
Interpretation: Okta reports this value on the Okta App OAuth Client object returned for Applications; it is interpreted at one Okta App OAuth Client record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Reveal Password

Developer identifier: applications.credentials.revealPasswordReveal Password records whether the password can be revealed to the user. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: select Applications rows with the exact revealPassword access-related value being investigated.
Interpretation: Okta reports this value on the Okta App Credentials object returned for Applications; it is interpreted at one Okta App Credentials record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.

Scheme

Developer identifier: applications.credentials.schemeScheme records authentication scheme (EDIT_USERNAME_AND_PASSWORD, EDIT_PASSWORD_ONLY, EXTERNAL_PASSWORD_SYNC, SHARED_USERNAME_AND_PASSWORD, ADMIN_SETS_CREDENTIALS). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate the exact scheme access value with the resource, account, or membership represented by the same Applications row.
Interpretation: Okta reports this value on the Okta App Credentials object returned for Applications; it is interpreted at one Okta App Credentials record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Signing

Developer identifier: applications.credentials.signingSigning records signing credential configuration. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: expand signing to examine the returned signing details for the containing Okta App Credentials record.
Interpretation: Okta reports this value on the Okta App Credentials object returned for Applications; it is one nested object per containing Okta App Credentials object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Kid

Developer identifier: applications.credentials.signing.kidKid records key ID of the signing key. It is needed to refer to the same kid across records without relying on display text.

Enables: match kid to kid references carrying the same Okta-issued value in related Okta records.
Interpretation: Okta reports this value on the Okta App Credentials Signing object returned for Applications; it is an identifier, not a measured quantity.

Last Rotated

Developer identifier: applications.credentials.signing.lastRotatedLast Rotated records timestamp of the last key rotation. It is needed to place the record at the time or date reported for this event or state.

Enables: bound Applications records by lastRotated, order their returned events or state changes, and correlate records reported at the same time.
Interpretation: Okta reports this value on the Okta App Credentials Signing object returned for Applications; it is interpreted at one Okta App Credentials Signing record per row; the schema uses the Temporal.DateTime scalar.

Next Rotation

Developer identifier: applications.credentials.signing.nextRotationNext Rotation records timestamp of the next scheduled key rotation. It is needed to place the record at the time or date reported for this event or state.

Enables: bound Applications records by nextRotation, order their returned events or state changes, and correlate records reported at the same time.
Interpretation: Okta reports this value on the Okta App Credentials Signing object returned for Applications; it is interpreted at one Okta App Credentials Signing record per row; the schema uses the Temporal.DateTime scalar.

Rotation Mode

Developer identifier: applications.credentials.signing.rotationModeRotation Mode records key rotation mode (AUTO or MANUAL). It is needed to distinguish Applications rows by the exact Okta-returned rotation mode value.

Enables: separate Applications rows by the exact Okta-returned rotationMode label when comparing rotation mode.
Interpretation: Okta reports this value on the Okta App Credentials Signing object returned for Applications; it is interpreted at one Okta App Credentials Signing record per row; classification values are Okta-returned labels rather than a universal taxonomy.

Use

Developer identifier: applications.credentials.signing.useUse records use of the key (sig). It is needed to inventory the exact Okta-reported configuration or classification represented by this field.

Enables: compare use among Applications records when reconciling this specific configuration, source, or classification.
Interpretation: Okta reports this value on the Okta App Credentials Signing object returned for Applications; it is interpreted at one Okta App Credentials Signing record per row; the value is a Okta-returned or configured label at the Okta App Credentials Signing grain rather than a universal taxonomy.

User Name Template

Developer identifier: applications.credentials.userNameTemplateUser Name Template records template used to generate usernames for the app. It is needed to preserve the nested user name template relationship or details on the parent Okta App Credentials record.

Enables: expand userNameTemplate to connect the containing Okta App Credentials row to its returned user name template entries.
Interpretation: Okta reports this value on the Okta App Credentials object returned for Applications; it is one nested object per containing Okta App Credentials object when present.

Push Status

Developer identifier: applications.credentials.userNameTemplate.pushStatusPush Status records push status for the username template. It is needed to distinguish Applications rows by the exact Okta-returned push status value.

Enables: separate Applications rows by the exact Okta-returned pushStatus label when comparing push status.
Interpretation: Okta reports this value on the Okta App User Name Template object returned for Applications; it is interpreted at one Okta App User Name Template record per row; classification values are Okta-returned labels rather than a universal taxonomy.

Suffix

Developer identifier: applications.credentials.userNameTemplate.suffixSuffix records suffix appended to the username. It is needed to attribute this Applications row to the returned person, account, or organization reference.

Enables: attribute the Applications row to the returned person or account and match the exact suffix value where it recurs in Okta.
Interpretation: Okta reports this value on the Okta App User Name Template object returned for Applications; it is interpreted at one Okta App User Name Template record per row.

Template

Developer identifier: applications.credentials.userNameTemplate.templateTemplate records Okta Expression Language template string (e.g., $(source.login)). It is needed to inspect the exact template text returned for this Okta App User Name Template record.

Enables: attribute the template text in template to the containing Applications identifier, owner or author, status, and update time where returned.
Interpretation: Okta reports this value on the Okta App User Name Template object returned for Applications; it is interpreted at one Okta App User Name Template record per row; this is only the template text included in the Okta response for this record.

Type

Developer identifier: applications.credentials.userNameTemplate.typeType records template type (BUILT_IN, CUSTOM, NONE). It is needed to distinguish Applications rows by the exact Okta-returned type value.

Enables: separate Applications rows by the exact Okta-returned type label when comparing type.
Interpretation: Okta reports this value on the Okta App User Name Template object returned for Applications; it is interpreted at one Okta App User Name Template record per row; classification values are Okta-returned labels rather than a universal taxonomy.

Features

Developer identifier: applications.featuresFeatures records list of enabled features for the application. It is needed to preserve the nested features relationship or details on the parent Okta App record.

Enables: expand features to connect the containing Okta App row to its returned features entries.
Interpretation: Okta reports this value on the Okta App object returned for Applications; it is one returned collection per containing Okta App object.

Developer identifier: applications.idID records unique identifier for the application. It identifies each Applications row across syncs.

Enables: use id as the record key for Applications and match repeated rows carrying the same Okta identifier.
Interpretation: Okta reports this value on the Okta App object returned for Applications; it is an identifier, not a measured quantity; it is the record key.

Label

Developer identifier: applications.labelLabel records human-readable display name of the application. It is needed to compare the returned label for individual Applications rows and select rows with a specific label value.

Enables: locate Applications rows whose returned label exactly matches label and retain the Okta identifier for any cross-record match.
Interpretation: Okta reports this value on the Okta App object returned for Applications; it is interpreted at one Okta App record per row; the schema uses the Identity.Name scalar.

Last Updated

Developer identifier: applications.lastUpdatedLast Updated records timestamp when the application was last modified. It is needed to place the record at the time or date reported for this event or state.

Enables: bound Applications records by lastUpdated, order their returned events or state changes, and correlate records reported at the same time.
Interpretation: Okta reports this value on the Okta App object returned for Applications; it is interpreted at one Okta App record per row; Parable uses it to keep the latest version of each record; Parable treats it as the record’s metadata timestamp; the schema uses the Temporal.DateTime scalar.

Name

Developer identifier: applications.nameName records internal name/template of the application (e.g., salesforce, bookmark, oidc_client). It is needed to compare the returned name for individual Applications rows and select rows with a specific name value.

Enables: locate Applications rows whose returned name exactly matches name and retain the Okta identifier for any cross-record match.
Interpretation: Okta reports this value on the Okta App object returned for Applications; it is interpreted at one Okta App record per row.

Orn

Developer identifier: applications.ornOrn records Okta Resource Name uniquely identifying the application across Okta (e.g., orn:okta:idp:OKTA_ORG:apps/0oab…). It is needed to preserve the exact Okta-reported business, directory, or identity attribute represented by this field.

Enables: match or segment Applications records by orn only within the same Okta attribute contract.
Interpretation: Okta reports this value on the Okta App object returned for Applications; it is interpreted at one Okta App record per row; the value is a Okta-returned or configured label and is not a universal identity or business taxonomy.

Profile

Developer identifier: applications.profileProfile records application profile attributes (varies by app type). It is needed to preserve the exact Okta configuration or execution metadata attached to this Okta App record.

Enables: inspect the keys in profile when reproducing or investigating this record’s configuration, parameters, or execution context.
Interpretation: Okta reports this value on the Okta App object returned for Applications; it is interpreted at one Okta App record per row; the schema uses the Generic.JSON scalar; metadata keys and availability follow the Okta response and can vary by resource type or configuration.

Settings

Developer identifier: applications.settingsSettings records application-specific settings. It is needed to preserve the nested settings relationship or details on the parent Okta App record.

Enables: expand settings to connect the containing Okta App row to its returned settings entries.
Interpretation: Okta reports this value on the Okta App object returned for Applications; it is one nested object per containing Okta App object when present.

App

Developer identifier: applications.settings.appApp records app-specific settings object (varies by application type). It is needed to compare the exact app configuration returned for this Okta App Settings record.

Enables: compare the exact app configuration returned for each Okta App Settings record and select records with the configuration under review.
Interpretation: Okta reports this value on the Okta App Settings object returned for Applications; it is interpreted at one Okta App Settings record per row; the schema uses the Generic.JSON scalar.

Implicit Assignment

Developer identifier: applications.settings.implicitAssignmentImplicit Assignment records whether implicit assignment is enabled. It is needed to distinguish Applications rows by the exact Okta-returned implicit assignment value.

Enables: select Applications rows where implicitAssignment is true or false when comparing the condition described by Implicit Assignment.
Interpretation: Okta reports this value on the Okta App Settings object returned for Applications; it is interpreted at one Okta App Settings record per row; classification values are Okta-returned labels rather than a universal taxonomy.

Manual Provisioning

Developer identifier: applications.settings.manualProvisioningManual Provisioning records whether manual provisioning is enabled. It is needed to distinguish Applications rows by the exact Okta-returned manual provisioning value.

Enables: select Applications rows where manualProvisioning is true or false when comparing the condition described by Manual Provisioning.
Interpretation: Okta reports this value on the Okta App Settings object returned for Applications; it is interpreted at one Okta App Settings record per row; classification values are Okta-returned labels rather than a universal taxonomy.

Notes

Developer identifier: applications.settings.notesNotes records admin and end-user notes for the application. It is needed to preserve the nested notes relationship or details on the parent Okta App Settings record.

Enables: expand notes to connect the containing Okta App Settings row to its returned notes entries.
Interpretation: Okta reports this value on the Okta App Settings object returned for Applications; it is one nested object per containing Okta App Settings object when present.

Admin

Developer identifier: applications.settings.notes.adminAdmin records admin notes for the application. It is needed to inventory the exact Okta-reported configuration or classification represented by this field.

Enables: compare admin among Applications records when reconciling this specific configuration, source, or classification.
Interpretation: Okta reports this value on the Okta App Notes object returned for Applications; it is interpreted at one Okta App Notes record per row; the value is a Okta-returned or configured label at the Okta App Notes grain rather than a universal taxonomy.

Enduser

Developer identifier: applications.settings.notes.enduserEnduser records end-user notes displayed to users. It is needed to attribute this Applications row to the returned person, account, or organization reference.

Enables: attribute the Applications row to the returned person or account and match the exact enduser value where it recurs in Okta.
Interpretation: Okta reports this value on the Okta App Notes object returned for Applications; it is interpreted at one Okta App Notes record per row.

Notifications

Developer identifier: applications.settings.notificationsNotifications records notification settings for the application. It is needed to preserve the nested notifications relationship or details on the parent Okta App Settings record.

Enables: expand notifications to connect the containing Okta App Settings row to its returned notifications entries.
Interpretation: Okta reports this value on the Okta App Settings object returned for Applications; it is one nested object per containing Okta App Settings object when present.

Vpn

Developer identifier: applications.settings.notifications.vpnVpn records VPN notification settings. It is needed to preserve the nested vpn relationship or details on the parent Okta App Notifications record.

Enables: expand vpn to connect the containing Okta App Notifications row to its returned vpn entries.
Interpretation: Okta reports this value on the Okta App Notifications object returned for Applications; it is one nested object per containing Okta App Notifications object when present.

Help URL

Developer identifier: applications.settings.notifications.vpn.helpUrlHelp URL records help URL for VPN notification. It is needed to inspect the exact link included with this record.

Enables: open or correlate the exact Okta resource referenced by helpUrl while retaining the containing Applications record as provenance.
Interpretation: Okta reports this value on the Okta App Vpn Notification object returned for Applications; it is link at one Okta App Vpn Notification record per row; the schema uses the Network.Url scalar; the returned link or template does not establish that the current credential can retrieve its target.

Message

Developer identifier: applications.settings.notifications.vpn.messageMessage records custom VPN notification message. It is needed to inspect the exact message text included with this record.

Enables: inspect the message text returned in message and attribute it to the same record’s parent record, owner, status, and update time where returned.
Interpretation: Okta reports this value on the Okta App Vpn Notification object returned for Applications; it is message text at one Okta App Vpn Notification record per row; this is only the content included in the Okta response for this record.

Network

Developer identifier: applications.settings.notifications.vpn.networkNetwork records network configuration for VPN notification. It is needed to preserve the nested network relationship or details on the parent Okta App Vpn Notification record.

Enables: expand network to connect the containing Okta App Vpn Notification row to its returned network entries.
Interpretation: Okta reports this value on the Okta App Vpn Notification object returned for Applications; it is one nested object per containing Okta App Vpn Notification object when present.

Connection

Developer identifier: applications.settings.notifications.vpn.network.connectionConnection records connection type (DISABLED, ANYWHERE, ON_NETWORK, OFF_NETWORK). It is needed to inventory the exact Okta-reported configuration or classification represented by this field.

Enables: compare connection among Applications records when reconciling this specific configuration, source, or classification.
Interpretation: Okta reports this value on the Okta App Vpn Network object returned for Applications; it is interpreted at one Okta App Vpn Network record per row; the value is a Okta-returned or configured label at the Okta App Vpn Network grain rather than a universal taxonomy.

Exclude

Developer identifier: applications.settings.notifications.vpn.network.excludeExclude records list of excluded network zones. It is needed to preserve the nested exclude relationship or details on the parent Okta App Vpn Network record.

Enables: expand exclude to connect the containing Okta App Vpn Network row to its returned exclude entries.
Interpretation: Okta reports this value on the Okta App Vpn Network object returned for Applications; it is one returned collection per containing Okta App Vpn Network object.

Include

Developer identifier: applications.settings.notifications.vpn.network.includeInclude records list of included network zones. It is needed to preserve the nested include relationship or details on the parent Okta App Vpn Network record.

Enables: expand include to connect the containing Okta App Vpn Network row to its returned include entries.
Interpretation: Okta reports this value on the Okta App Vpn Network object returned for Applications; it is one returned collection per containing Okta App Vpn Network object.

OAuth Client

Developer identifier: applications.settings.oauthClientOAuth Client records OAuth/OIDC-specific settings. It is needed to preserve the nested o auth client relationship or details on the parent Okta App Settings record.

Enables: expand oauthClient to connect the containing Okta App Settings row to its returned o auth client entries.
Interpretation: Okta reports this value on the Okta App Settings object returned for Applications; it is one nested object per containing Okta App Settings object when present.

Application Type

Developer identifier: applications.settings.oauthClient.application_typeApplication Type records application type (web, native, service, browser). It is needed to distinguish Applications rows by the exact Okta-returned application type value.

Enables: separate Applications rows by the exact Okta-returned application_type label when comparing application type.
Interpretation: Okta reports this value on the Okta App OAuth Settings object returned for Applications; it is interpreted at one Okta App OAuth Settings record per row; classification values are Okta-returned labels rather than a universal taxonomy.

Client URI

Developer identifier: applications.settings.oauthClient.client_uriClient URI records client URI. It is needed to inspect the exact link included with this record.

Enables: open or correlate the exact Okta resource referenced by client_uri while retaining the containing Applications record as provenance.
Interpretation: Okta reports this value on the Okta App OAuth Settings object returned for Applications; it is link at one Okta App OAuth Settings record per row; the schema uses the Network.Url scalar; the returned link or template does not establish that the current credential can retrieve its target.

Grant Types

Developer identifier: applications.settings.oauthClient.grant_typesGrant Types records allowed OAuth grant types. It is needed to preserve the nested grant types relationship or details on the parent Okta App OAuth Settings record.

Enables: expand grant_types to connect the containing Okta App OAuth Settings row to its returned grant types entries.
Interpretation: Okta reports this value on the Okta App OAuth Settings object returned for Applications; it is one returned collection per containing Okta App OAuth Settings object.

Idp Initiated Login

Developer identifier: applications.settings.oauthClient.idp_initiated_loginIdp Initiated Login records idP-initiated login configuration. It is needed to attribute this Applications row to the returned person, account, or organization reference.

Enables: attribute the Applications row to the returned person or account and match the exact idp_initiated_login value where it recurs in Okta.
Interpretation: Okta reports this value on the Okta App OAuth Settings object returned for Applications; it is interpreted at one Okta App OAuth Settings record per row; the schema uses the Generic.JSON scalar.

Initiate Login URI

Developer identifier: applications.settings.oauthClient.initiate_login_uriInitiate Login URI records initiate login URI. It is needed to inspect the exact link included with this record.

Enables: open or correlate the exact Okta resource referenced by initiate_login_uri while retaining the containing Applications record as provenance.
Interpretation: Okta reports this value on the Okta App OAuth Settings object returned for Applications; it is link at one Okta App OAuth Settings record per row; the schema uses the Network.Url scalar; the returned link or template does not establish that the current credential can retrieve its target.

Issuer Mode

Developer identifier: applications.settings.oauthClient.issuer_modeIssuer Mode records issuer mode (ORG_URL, CUSTOM_URL, DYNAMIC). It is needed to distinguish Applications rows by the exact Okta-returned issuer mode value.

Enables: separate Applications rows by the exact Okta-returned issuer_mode label when comparing issuer mode.
Interpretation: Okta reports this value on the Okta App OAuth Settings object returned for Applications; it is interpreted at one Okta App OAuth Settings record per row; classification values are Okta-returned labels rather than a universal taxonomy.

Logo URI

Developer identifier: applications.settings.oauthClient.logo_uriLogo URI records logo URI. It is needed to inspect the exact link included with this record.

Enables: open or correlate the exact Okta resource referenced by logo_uri while retaining the containing Applications record as provenance.
Interpretation: Okta reports this value on the Okta App OAuth Settings object returned for Applications; it is link at one Okta App OAuth Settings record per row; the schema uses the Network.Url scalar; the returned link or template does not establish that the current credential can retrieve its target.

Post Logout Redirect URIs

Developer identifier: applications.settings.oauthClient.post_logout_redirect_urisPost Logout Redirect URIs records list of post-logout redirect URIs. It is needed to inspect the exact link included with this record.

Enables: open or correlate the exact Okta resource referenced by post_logout_redirect_uris while retaining the containing Applications record as provenance.
Interpretation: Okta reports this value on the Okta App OAuth Settings object returned for Applications; it is link at one Okta App OAuth Settings record per row; the returned link or template does not establish that the current credential can retrieve its target.

Redirect URIs

Developer identifier: applications.settings.oauthClient.redirect_urisRedirect URIs records list of allowed redirect URIs. It is needed to inspect the exact link included with this record.

Enables: open or correlate the exact Okta resource referenced by redirect_uris while retaining the containing Applications record as provenance.
Interpretation: Okta reports this value on the Okta App OAuth Settings object returned for Applications; it is link at one Okta App OAuth Settings record per row; the returned link or template does not establish that the current credential can retrieve its target.

Response Types

Developer identifier: applications.settings.oauthClient.response_typesResponse Types records allowed OAuth response types. It is needed to preserve the nested response types relationship or details on the parent Okta App OAuth Settings record.

Enables: expand response_types to connect the containing Okta App OAuth Settings row to its returned response types entries.
Interpretation: Okta reports this value on the Okta App OAuth Settings object returned for Applications; it is one returned collection per containing Okta App OAuth Settings object.

Wildcard Redirect

Developer identifier: applications.settings.oauthClient.wildcard_redirectWildcard Redirect records wildcard redirect setting (DISABLED, SUBDOMAIN). It is needed to compare the exact wildcard redirect configuration returned for this Okta App OAuth Settings record.

Enables: compare the exact wildcard_redirect configuration returned for each Okta App OAuth Settings record and select records with the configuration under review.
Interpretation: Okta reports this value on the Okta App OAuth Settings object returned for Applications; it is interpreted at one Okta App OAuth Settings record per row.

Sign On

Developer identifier: applications.settings.signOnSign On records sign-on settings (varies by signOnMode, e.g., SAML assertion details). It is needed to compare the exact sign on configuration returned for this Okta App Settings record.

Enables: compare the exact signOn configuration returned for each Okta App Settings record and select records with the configuration under review.
Interpretation: Okta reports this value on the Okta App Settings object returned for Applications; it is interpreted at one Okta App Settings record per row; the schema uses the Generic.JSON scalar.

Sign On Mode

Developer identifier: applications.signOnModeSign On Mode records sign-on mode for the application. It is needed to distinguish Applications rows by the exact Okta-returned sign on mode value.

Enables: separate Applications rows by the exact Okta-returned signOnMode label when comparing sign on mode.
Interpretation: Okta reports this value on the Okta App object returned for Applications; it is interpreted at one Okta App record per row; classification values are Okta-returned labels rather than a universal taxonomy.

Status

Developer identifier: applications.statusStatus records application status (ACTIVE, INACTIVE, DELETED). It is needed to distinguish Applications rows by the exact Okta-returned status value.

Enables: separate Applications rows by the exact Okta-returned status label when comparing status.
Interpretation: Okta reports this value on the Okta App object returned for Applications; it is interpreted at one Okta App record per row; classification values are Okta-returned labels rather than a universal taxonomy.

Universal Logout

Developer identifier: applications.universalLogoutUniversal Logout records universal Logout (CAEP / OIDC RP-Initiated Logout) status block for the application. It is needed to preserve the nested universal logout relationship or details on the parent Okta App record.

Enables: expand universalLogout to connect the containing Okta App row to its returned universal logout entries.
Interpretation: Okta reports this value on the Okta App object returned for Applications; it is one nested object per containing Okta App object when present.

Status

Developer identifier: applications.universalLogout.statusStatus records universal Logout enablement status for the application (e.g., ‘ENABLED’, ‘DISABLED’, ‘NOT_AVAILABLE’). It is needed to distinguish Applications rows by the exact Okta-returned status value.

Enables: separate Applications rows by the exact Okta-returned status label when comparing status.
Interpretation: Okta reports this value on the Okta App Universal Logout object returned for Applications; it is interpreted at one Okta App Universal Logout record per row; classification values are Okta-returned labels rather than a universal taxonomy.

Visibility

Developer identifier: applications.visibilityVisibility records visibility settings for the application. It is needed to preserve the nested visibility relationship or details on the parent Okta App record.

Enables: expand visibility to connect the containing Okta App row to its returned visibility entries.
Interpretation: Okta reports this value on the Okta App object returned for Applications; it is one nested object per containing Okta App object when present.

App Links

Developer identifier: applications.visibility.appLinksApp Links records map of app link visibility settings (link name to boolean). It is needed to inspect the exact link included with this record.

Enables: open or correlate the exact Okta resource referenced by appLinks while retaining the containing Applications record as provenance.
Interpretation: Okta reports this value on the Okta App Visibility object returned for Applications; it is link at one Okta App Visibility record per row; the schema uses the Generic.JSON scalar; the returned link or template does not establish that the current credential can retrieve its target.

Auto Launch

Developer identifier: applications.visibility.autoLaunchAuto Launch records whether the app is auto-launched. It is needed to distinguish Applications rows by the exact Okta-returned auto launch value.

Enables: select Applications rows where autoLaunch is true or false when comparing the condition described by Auto Launch.
Interpretation: Okta reports this value on the Okta App Visibility object returned for Applications; it is interpreted at one Okta App Visibility record per row; classification values are Okta-returned labels rather than a universal taxonomy.

Auto Submit Toolbar

Developer identifier: applications.visibility.autoSubmitToolbarAuto Submit Toolbar records whether the sign-in form is auto-submitted. It is needed to distinguish Applications rows by the exact Okta-returned auto submit toolbar value.

Enables: select Applications rows where autoSubmitToolbar is true or false when comparing the condition described by Auto Submit Toolbar.
Interpretation: Okta reports this value on the Okta App Visibility object returned for Applications; it is interpreted at one Okta App Visibility record per row; classification values are Okta-returned labels rather than a universal taxonomy.

Hide

Developer identifier: applications.visibility.hideHide records hide settings for the application. It is needed to preserve the nested hide relationship or details on the parent Okta App Visibility record.

Enables: expand hide to connect the containing Okta App Visibility row to its returned hide entries.
Interpretation: Okta reports this value on the Okta App Visibility object returned for Applications; it is one nested object per containing Okta App Visibility object when present.

I OS

Developer identifier: applications.visibility.hide.iOSI OS records whether the app is hidden on iOS devices. It is needed to distinguish Applications rows by the exact Okta-returned i os value.

Enables: select Applications rows where iOS is true or false when comparing the condition described by I OS.
Interpretation: Okta reports this value on the Okta App Visibility Hide object returned for Applications; it is interpreted at one Okta App Visibility Hide record per row; classification values are Okta-returned labels rather than a universal taxonomy.

Web

Developer identifier: applications.visibility.hide.webWeb records whether the app is hidden in the Okta web dashboard. It is needed to distinguish Applications rows by the exact Okta-returned web value.

Enables: select Applications rows where web is true or false when comparing the condition described by Web.
Interpretation: Okta reports this value on the Okta App Visibility Hide object returned for Applications; it is interpreted at one Okta App Visibility Hide record per row; classification values are Okta-returned labels rather than a universal taxonomy.

Audit Logs

Developer identifier: audit_logsAudit Logs covers Okta System Log events.

Enables: reconstruct an Audit Logs timeline and correlate each returned actor, target, action, and timestamp during an investigation.
Scope: Okta System Log events; Parable reads the new records from /api/v1/logs on each sync, and each row is one event. Object and event visibility follows the API token’s Okta administrative permissions; inaccessible objects or events are not returned. This stream has no deletion signal, so a missing row does not establish that the Okta record was deleted.

Actor

Developer identifier: audit_logs.actorActor records the entity (user, app, client) that performed the action. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate actor with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log object returned for Audit Logs; it is one nested object per containing Okta Log object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Alternate ID

Developer identifier: audit_logs.actor.alternateIdAlternate ID records alternate identifier for the actor, usually email or login. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate alternateId with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log Actor object returned for Audit Logs; it is an identifier, not a measured quantity; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Detail Entry

Developer identifier: audit_logs.actor.detailEntryDetail Entry records additional details about the actor as key-value pairs. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate detailEntry with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log Actor object returned for Audit Logs; it is interpreted at one Okta Log Actor record per row; the schema uses the Generic.JSON scalar; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; keys and availability follow this Okta response and may vary by object type or Okta configuration.

Display Name

Developer identifier: audit_logs.actor.displayNameDisplay Name records human-readable display name of the actor. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate displayName with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log Actor object returned for Audit Logs; it is interpreted at one Okta Log Actor record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Developer identifier: audit_logs.actor.idID records unique identifier of the actor. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate id with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log Actor object returned for Audit Logs; it is an identifier, not a measured quantity; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Type

Developer identifier: audit_logs.actor.typeType records type of actor (e.g., User, SystemPrincipal, PublicClientApp). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: select Audit Logs investigation evidence with the exact type result, permission, or Okta classification being examined.
Interpretation: Okta reports this value on the Okta Log Actor object returned for Audit Logs; it is interpreted at one Okta Log Actor record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.

Authentication Context

Developer identifier: audit_logs.authenticationContextAuthentication Context records authentication context including step, protocol, and issuer. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate authenticationContext with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log object returned for Audit Logs; it is one nested object per containing Okta Log object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Authentication Provider

Developer identifier: audit_logs.authenticationContext.authenticationProviderAuthentication Provider records authentication provider type (e.g., FACTOR_PROVIDER, OKTA_AUTHENTICATION_PROVIDER, ACTIVE_DIRECTORY). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate authenticationProvider with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log Authentication Context object returned for Audit Logs; it is interpreted at one Okta Log Authentication Context record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Authentication Step

Developer identifier: audit_logs.authenticationContext.authenticationStepAuthentication Step records step number in the authentication flow (0 for single-factor, higher for MFA steps). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate authenticationStep with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log Authentication Context object returned for Audit Logs; it is interpreted at one Okta Log Authentication Context record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Credential Provider

Developer identifier: audit_logs.authenticationContext.credentialProviderCredential Provider records credential provider (e.g., OKTA_CREDENTIAL_PROVIDER, RSA, DUO, GOOGLE). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate credentialProvider with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log Authentication Context object returned for Audit Logs; it is interpreted at one Okta Log Authentication Context record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Credential Type

Developer identifier: audit_logs.authenticationContext.credentialTypeCredential Type records type of credential used (e.g., OTP, PASSWORD, ASSERTION, SMS, IWA). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: select Audit Logs investigation evidence with the exact credentialType result, permission, or Okta classification being examined.
Interpretation: Okta reports this value on the Okta Log Authentication Context object returned for Audit Logs; it is interpreted at one Okta Log Authentication Context record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.

External Session ID

Developer identifier: audit_logs.authenticationContext.externalSessionIdExternal Session ID records external session identifier linking events in the same session. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate externalSessionId with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log Authentication Context object returned for Audit Logs; it is an identifier, not a measured quantity; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Interface

Developer identifier: audit_logs.authenticationContext.interfaceInterface records interface used for authentication. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate interface with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log Authentication Context object returned for Audit Logs; it is interpreted at one Okta Log Authentication Context record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Issuer

Developer identifier: audit_logs.authenticationContext.issuerIssuer records issuer of the authentication assertion, if applicable. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: select Audit Logs investigation evidence with the exact issuer result, permission, or Okta classification being examined.
Interpretation: Okta reports this value on the Okta Log Authentication Context object returned for Audit Logs; it is one nested object per containing Okta Log Authentication Context object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Developer identifier: audit_logs.authenticationContext.issuer.idID records unique identifier of the issuer. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate id with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log Issuer object returned for Audit Logs; it is an identifier, not a measured quantity; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Type

Developer identifier: audit_logs.authenticationContext.issuer.typeType records type of issuer. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: select Audit Logs investigation evidence with the exact type result, permission, or Okta classification being examined.
Interpretation: Okta reports this value on the Okta Log Issuer object returned for Audit Logs; it is interpreted at one Okta Log Issuer record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.

Root Session ID

Developer identifier: audit_logs.authenticationContext.rootSessionIdRoot Session ID records root session identifier linking events across a chain of impersonated or delegated sessions. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate rootSessionId with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log Authentication Context object returned for Audit Logs; it is an identifier, not a measured quantity; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Client

Developer identifier: audit_logs.clientClient records client information including IP, user agent, device, and zone. It is needed to preserve the Okta-reported configured or derived address and place context for the same record.

Enables: correlate client with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
Interpretation: Okta reports this value on the Okta Log object returned for Audit Logs; it is one nested object per containing Okta Log object when present; the value is configured or derived address and place context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Device

Developer identifier: audit_logs.client.deviceDevice records type of device used (e.g., Computer, Mobile). It is needed to preserve the Okta-reported client device or software context for the same record.

Enables: correlate device with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
Interpretation: Okta reports this value on the Okta Log Client object returned for Audit Logs; it is interpreted at one Okta Log Client record per row; the value is client device or software context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Geographical Context

Developer identifier: audit_logs.client.geographicalContextGeographical Context records geographical location derived from the client IP address. It is needed to preserve the Okta-reported network address context for the same record.

Enables: correlate geographicalContext with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
Interpretation: Okta reports this value on the Okta Log Client object returned for Audit Logs; it is one nested object per containing Okta Log Client object when present; the value is network address context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

City

Developer identifier: audit_logs.client.geographicalContext.cityCity records city name. It is needed to preserve the Okta-reported configured or derived address and place context for the same record.

Enables: correlate city with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
Interpretation: Okta reports this value on the Okta Log Geographical Context object returned for Audit Logs; it is interpreted at one Okta Log Geographical Context record per row; the value is configured or derived address and place context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Country

Developer identifier: audit_logs.client.geographicalContext.countryCountry records country name. It is needed to preserve the Okta-reported configured or derived address and place context for the same record.

Enables: correlate country with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
Interpretation: Okta reports this value on the Okta Log Geographical Context object returned for Audit Logs; it is interpreted at one Okta Log Geographical Context record per row; the value is configured or derived address and place context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Geolocation

Developer identifier: audit_logs.client.geographicalContext.geolocationGeolocation records latitude and longitude coordinates. It is needed to preserve the Okta-reported geographic coordinate context for the same record.

Enables: correlate geolocation with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
Interpretation: Okta reports this value on the Okta Log Geographical Context object returned for Audit Logs; its unit or granularity is provider-reported geographic coordinates; the value is geographic coordinate context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Lat

Developer identifier: audit_logs.client.geographicalContext.geolocation.latLat records latitude coordinate. It is needed to preserve the Okta-reported configured or derived address and place context for the same record.

Enables: correlate lat with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
Interpretation: Okta reports this value on the Okta Log Geolocation object returned for Audit Logs; its unit or granularity is provider-reported geographic coordinates; the value is configured or derived address and place context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Lon

Developer identifier: audit_logs.client.geographicalContext.geolocation.lonLon records longitude coordinate. It is needed to preserve the Okta-reported configured or derived address and place context for the same record.

Enables: correlate lon with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
Interpretation: Okta reports this value on the Okta Log Geolocation object returned for Audit Logs; its unit or granularity is provider-reported geographic coordinates; the value is configured or derived address and place context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Postal Code

Developer identifier: audit_logs.client.geographicalContext.postalCodePostal Code records postal or ZIP code. It is needed to preserve the Okta-reported configured or derived address and place context for the same record.

Enables: correlate postalCode with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
Interpretation: Okta reports this value on the Okta Log Geographical Context object returned for Audit Logs; it is interpreted at one Okta Log Geographical Context record per row; the value is configured or derived address and place context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.

State

Developer identifier: audit_logs.client.geographicalContext.stateState records state or province name. It is needed to preserve the Okta-reported configured or derived address and place context for the same record.

Enables: correlate state with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
Interpretation: Okta reports this value on the Okta Log Geographical Context object returned for Audit Logs; it is interpreted at one Okta Log Geographical Context record per row; the value is configured or derived address and place context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.

Developer identifier: audit_logs.client.idID records unique identifier of the client, if available. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate id with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log Client object returned for Audit Logs; it is an identifier, not a measured quantity; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

IP Address

Developer identifier: audit_logs.client.ipAddressIP Address records IP address of the client that triggered the event. It is needed to preserve the Okta-reported network address context for the same record.

Enables: correlate ipAddress with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
Interpretation: Okta reports this value on the Okta Log Client object returned for Audit Logs; it is interpreted at one Okta Log Client record per row; the schema uses the Network.IpAddress scalar; the value is network address context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

User Agent

Developer identifier: audit_logs.client.userAgentUser Agent records user agent information from the client request. It is needed to preserve the Okta-reported client device or software context for the same record.

Enables: correlate userAgent with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
Interpretation: Okta reports this value on the Okta Log Client object returned for Audit Logs; it is one nested object per containing Okta Log Client object when present; the value is client device or software context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Browser

Developer identifier: audit_logs.client.userAgent.browserBrowser records browser parsed from the user agent. It is needed to preserve the Okta-reported client device or software context for the same record.

Enables: correlate browser with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
Interpretation: Okta reports this value on the Okta Log User Agent object returned for Audit Logs; it is interpreted at one Okta Log User Agent record per row; the value is client device or software context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Developer identifier: audit_logs.client.userAgent.osOS records operating system parsed from the user agent. It is needed to preserve the Okta-reported client device or software context for the same record.

Enables: correlate os with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
Interpretation: Okta reports this value on the Okta Log User Agent object returned for Audit Logs; it is interpreted at one Okta Log User Agent record per row; the value is client device or software context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Raw User Agent

Developer identifier: audit_logs.client.userAgent.rawUserAgentRaw User Agent records raw user agent string from the HTTP request. It is needed to preserve the Okta-reported client device or software context for the same record.

Enables: correlate rawUserAgent with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
Interpretation: Okta reports this value on the Okta Log User Agent object returned for Audit Logs; it is interpreted at one Okta Log User Agent record per row; the value is client device or software context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Zone

Developer identifier: audit_logs.client.zoneZone records the network zone the client request originated from. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate zone with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log Client object returned for Audit Logs; it is interpreted at one Okta Log Client record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Debug Context

Developer identifier: audit_logs.debugContextDebug Context records additional debug information for troubleshooting. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate debugContext with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log object returned for Audit Logs; it is one nested object per containing Okta Log object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Debug Data

Developer identifier: audit_logs.debugContext.debugDataDebug Data records key-value pairs with debug data such as requestUri, requestId, url, suspiciousActivity, etc. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate debugData with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log Debug Context object returned for Audit Logs; it is one nested object per containing Okta Log Debug Context object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; keys and availability follow this Okta response and may vary by object type or Okta configuration.

Dt Hash

Developer identifier: audit_logs.debugContext.debugData.dtHashDt Hash records hash representing the device token of the actor’s device. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate dtHash with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log Debug Data object returned for Audit Logs; it is interpreted at one Okta Log Debug Data record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Request ID

Developer identifier: audit_logs.debugContext.debugData.requestIdRequest ID records unique identifier for the request that produced this log event. Useful for correlating with other Okta logs and external systems. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate requestId with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log Debug Data object returned for Audit Logs; it is an identifier, not a measured quantity; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Request URI

Developer identifier: audit_logs.debugContext.debugData.requestUriRequest URI records URI path of the request that produced the event. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate requestUri with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log Debug Data object returned for Audit Logs; it is link at one Okta Log Debug Data record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; the returned link or template does not establish that the current credential can retrieve its target.

Suspicious Activity

Developer identifier: audit_logs.debugContext.debugData.suspiciousActivitySuspicious Activity records suspicious-activity classification, when set. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate suspiciousActivity with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log Debug Data object returned for Audit Logs; it is interpreted at one Okta Log Debug Data record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

URL

Developer identifier: audit_logs.debugContext.debugData.urlURL records the URL of the request that produced the event, when applicable. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate url with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log Debug Data object returned for Audit Logs, at one Okta Log Debug Data record per row; it is usually a path relative to the Okta org (starting with /, with any query string) and is kept exactly as Okta sends it, without an added host; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; the returned link does not establish that the current credential can retrieve its target.

Device

Developer identifier: audit_logs.deviceDevice records top-level device context returned by Okta System Log events. It is needed to preserve the Okta-reported client device or software context for the same record.

Enables: correlate device with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
Interpretation: Okta reports this value on the Okta Log object returned for Audit Logs; it is interpreted at one Okta Log record per row; the schema uses the Generic.JSON scalar; the value is client device or software context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Display Message

Developer identifier: audit_logs.displayMessageDisplay Message records human-readable description of the event. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate displayMessage with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log object returned for Audit Logs; it is message text at one Okta Log record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; this is only the content included in the Okta response for this record.

Event Type

Developer identifier: audit_logs.eventTypeEvent Type records type of event (e.g., user.session.start, app.user_membership.add). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: select Audit Logs investigation evidence with the exact eventType result, permission, or Okta classification being examined.
Interpretation: Okta reports this value on the Okta Log object returned for Audit Logs; it is interpreted at one Okta Log record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.

Gateway Context

Developer identifier: audit_logs.gatewayContextGateway Context records network gateway context returned by Okta System Log events. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate gatewayContext with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log object returned for Audit Logs; it is interpreted at one Okta Log record per row; the schema uses the Generic.JSON scalar; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Legacy Event Type

Developer identifier: audit_logs.legacyEventTypeLegacy Event Type records legacy event type identifier for backward compatibility. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: select Audit Logs investigation evidence with the exact legacyEventType result, permission, or Okta classification being examined.
Interpretation: Okta reports this value on the Okta Log object returned for Audit Logs; it is an identifier, not a measured quantity; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.

Outcome

Developer identifier: audit_logs.outcomeOutcome records the outcome/result of the event. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: select Audit Logs investigation evidence with the exact outcome result, permission, or Okta classification being examined.
Interpretation: Okta reports this value on the Okta Log object returned for Audit Logs; it is one nested object per containing Okta Log object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Reason

Developer identifier: audit_logs.outcome.reasonReason records reason for the outcome, especially useful for failures. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: select Audit Logs investigation evidence with the exact reason result, permission, or Okta classification being examined.
Interpretation: Okta reports this value on the Okta Log Outcome object returned for Audit Logs; it is interpreted at one Okta Log Outcome record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.

Result

Developer identifier: audit_logs.outcome.resultResult records result of the event. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: select Audit Logs investigation evidence with the exact result result, permission, or Okta classification being examined.
Interpretation: Okta reports this value on the Okta Log Outcome object returned for Audit Logs; it is interpreted at one Okta Log Outcome record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.

Published

Developer identifier: audit_logs.publishedPublished records timestamp when the event was published (ISO 8601). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate published with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log object returned for Audit Logs; it is interpreted at one Okta Log record per row; Parable uses it to keep the latest version of each record; Parable treats it as the record’s event time; the schema uses the Temporal.DateTime scalar; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Request

Developer identifier: audit_logs.requestRequest records details about the HTTP request that triggered the event. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate request with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log object returned for Audit Logs; it is one nested object per containing Okta Log object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

IP Chain

Developer identifier: audit_logs.request.ipChainIP Chain records chain of IP addresses from the request, including proxies. It is needed to preserve the Okta-reported network address context for the same record.

Enables: correlate ipChain with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
Interpretation: Okta reports this value on the Okta Log Request object returned for Audit Logs; it is one returned collection per containing Okta Log Request object; the value is network address context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Geographical Context

Developer identifier: audit_logs.request.ipChain.geographicalContextGeographical Context records geographical context for this IP address. It is needed to preserve the Okta-reported network address context for the same record.

Enables: correlate geographicalContext with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
Interpretation: Okta reports this value on the Okta Log Ip Chain Entry object returned for Audit Logs; it is one nested object per containing Okta Log Ip Chain Entry object when present; the value is network address context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Developer identifier: audit_logs.request.ipChain.ipIP records IP address at this hop. It is needed to preserve the Okta-reported network address context for the same record.

Enables: correlate ip with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
Interpretation: Okta reports this value on the Okta Log Ip Chain Entry object returned for Audit Logs; it is interpreted at one Okta Log Ip Chain Entry record per row; it is the key of this nested record; the schema uses the Network.IpAddress scalar; the value is network address context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Source

Developer identifier: audit_logs.request.ipChain.sourceSource records source of the IP information. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: select Audit Logs investigation evidence with the exact source result, permission, or Okta classification being examined.
Interpretation: Okta reports this value on the Okta Log Ip Chain Entry object returned for Audit Logs; it is interpreted at one Okta Log Ip Chain Entry record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.

Version

Developer identifier: audit_logs.request.ipChain.versionVersion records IP version (V4 or V6). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate version with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log Ip Chain Entry object returned for Audit Logs; it is interpreted at one Okta Log Ip Chain Entry record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Security Context

Developer identifier: audit_logs.securityContextSecurity Context records security threat context including proxy and ISP information. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate securityContext with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log object returned for Audit Logs; it is one nested object per containing Okta Log object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

As Number

Developer identifier: audit_logs.securityContext.asNumberAs Number records autonomous System Number of the client IP. It is needed to preserve the Okta-reported configured or derived address and place context for the same record.

Enables: correlate asNumber with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
Interpretation: Okta reports this value on the Okta Log Security Context object returned for Audit Logs; it is a Okta-reported count at one Okta Log Security Context record per row; the value is configured or derived address and place context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

As Org

Developer identifier: audit_logs.securityContext.asOrgAs Org records autonomous System Organization name. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate asOrg with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log Security Context object returned for Audit Logs; it is interpreted at one Okta Log Security Context record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Domain

Developer identifier: audit_logs.securityContext.domainDomain records domain associated with the client IP. It is needed to preserve the Okta-reported configured or derived address and place context for the same record.

Enables: correlate domain with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
Interpretation: Okta reports this value on the Okta Log Security Context object returned for Audit Logs; it is interpreted at one Okta Log Security Context record per row; the value is configured or derived address and place context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Isp

Developer identifier: audit_logs.securityContext.ispIsp records internet Service Provider name. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: select Audit Logs investigation evidence with the exact isp result, permission, or Okta classification being examined.
Interpretation: Okta reports this value on the Okta Log Security Context object returned for Audit Logs; it is interpreted at one Okta Log Security Context record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.

Is Proxy

Developer identifier: audit_logs.securityContext.isProxyIs Proxy records whether the client IP is a known proxy. It is needed to preserve the Okta-reported configured or derived address and place context for the same record.

Enables: correlate isProxy with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
Interpretation: Okta reports this value on the Okta Log Security Context object returned for Audit Logs; it is interpreted at one Okta Log Security Context record per row; the value is configured or derived address and place context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.

Risk

Developer identifier: audit_logs.securityContext.riskRisk records risk assessment for the event. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: select Audit Logs investigation evidence with the exact risk result, permission, or Okta classification being examined.
Interpretation: Okta reports this value on the Okta Log Security Context object returned for Audit Logs; it is one nested object per containing Okta Log Security Context object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Level

Developer identifier: audit_logs.securityContext.risk.levelLevel records risk level (e.g. LOW, MEDIUM, HIGH). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate level with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log Security Context object returned for Audit Logs; it is interpreted at one Okta Log Security Context record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Reasons

Developer identifier: audit_logs.securityContext.risk.reasonsReasons records reasons contributing to the risk level. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate reasons with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log Security Context object returned for Audit Logs; it is interpreted at one Okta Log Security Context record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Severity

Developer identifier: audit_logs.severitySeverity records severity level of the event (DEBUG, INFO, WARN, ERROR). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: select Audit Logs investigation evidence with the exact severity result, permission, or Okta classification being examined.
Interpretation: Okta reports this value on the Okta Log object returned for Audit Logs; it is interpreted at one Okta Log record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.

Target

Developer identifier: audit_logs.targetTarget records array of target objects affected by the event. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate target with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log object returned for Audit Logs; it is one returned collection per containing Okta Log object; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Alternate ID

Developer identifier: audit_logs.target.alternateIdAlternate ID records alternate identifier for the target, usually email or name. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate alternateId with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log Target object returned for Audit Logs; it is an identifier, not a measured quantity; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Change Details

Developer identifier: audit_logs.target.changeDetailsChange Details records before/after values describing configuration changes made to the target. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate changeDetails with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log Target object returned for Audit Logs; it is interpreted at one Okta Log Target record per row; the schema uses the Generic.JSON scalar; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Detail Entry

Developer identifier: audit_logs.target.detailEntryDetail Entry records additional details about the target as key-value pairs. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate detailEntry with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log Target object returned for Audit Logs; it is interpreted at one Okta Log Target record per row; the schema uses the Generic.JSON scalar; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; keys and availability follow this Okta response and may vary by object type or Okta configuration.

Display Name

Developer identifier: audit_logs.target.displayNameDisplay Name records human-readable display name of the target. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate displayName with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log Target object returned for Audit Logs; it is interpreted at one Okta Log Target record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Developer identifier: audit_logs.target.idID records unique identifier of the target. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate id with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log Target object returned for Audit Logs; it is an identifier, not a measured quantity; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Type

Developer identifier: audit_logs.target.typeType records type of the target (e.g., User, AppInstance, AppUser, Group). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: select Audit Logs investigation evidence with the exact type result, permission, or Okta classification being examined.
Interpretation: Okta reports this value on the Okta Log Target object returned for Audit Logs; it is interpreted at one Okta Log Target record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.

Transaction

Developer identifier: audit_logs.transactionTransaction records transaction details linking related events. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate transaction with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log object returned for Audit Logs; it is one nested object per containing Okta Log object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Detail

Developer identifier: audit_logs.transaction.detailDetail records additional transaction details as key-value pairs. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate detail with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log Transaction object returned for Audit Logs; it is interpreted at one Okta Log Transaction record per row; the schema uses the Generic.JSON scalar; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Developer identifier: audit_logs.transaction.idID records unique transaction identifier. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate id with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log Transaction object returned for Audit Logs; it is an identifier, not a measured quantity; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Type

Developer identifier: audit_logs.transaction.typeType records type of transaction (e.g., WEB, JOB). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: select Audit Logs investigation evidence with the exact type result, permission, or Okta classification being examined.
Interpretation: Okta reports this value on the Okta Log Transaction object returned for Audit Logs; it is interpreted at one Okta Log Transaction record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.

UUID

Developer identifier: audit_logs.uuidUUID records unique identifier for the log event. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate uuid with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log object returned for Audit Logs; it is an identifier, not a measured quantity; it is the record key; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Version

Developer identifier: audit_logs.versionVersion records versioning indicator for the log event schema. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate version with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Okta reports this value on the Okta Log object returned for Audit Logs; it is interpreted at one Okta Log record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Users

Developer identifier: usersUsers covers Okta org users.

Enables: map the Okta accounts and memberships represented by Users records and trace a returned access assignment to its account or group.
Scope: Okta org users; Parable reads the records that changed since the previous sync from /api/v1/users. Object and event visibility follows the API token’s Okta administrative permissions; inaccessible objects or events are not returned. This stream has no deletion signal, so a missing row does not establish that the Okta record was deleted.

Provider-defined fields may also be returned for this data stream.

Embedded

Developer identifier: users._embeddedEmbedded records HAL-style embedded resources, if requested via expand parameter. It is needed to preserve the exact Okta configuration or execution metadata attached to this Okta User record.

Enables: inspect the keys in _embedded when reproducing or investigating this record’s configuration, parameters, or execution context.
Interpretation: Okta reports this value on the Okta User object returned for Users; it is interpreted at one Okta User record per row; the schema uses the Generic.JSON scalar; metadata keys and availability follow the Okta response and can vary by resource type or configuration.

Links

Developer identifier: users._linksLinks records HAL-style hypermedia links for user actions and related resources. It is needed to inspect the exact link included with this record.

Enables: open or correlate the exact Okta resource referenced by _links while retaining the containing Users record as provenance.
Interpretation: Okta reports this value on the Okta User object returned for Users; it is link at one Okta User record per row; the schema uses the Generic.JSON scalar; the returned link or template does not establish that the current credential can retrieve its target.

Activated

Developer identifier: users.activatedActivated records timestamp when the user transitioned to ACTIVE status. It is needed to place the record at the time or date reported for this event or state.

Enables: bound Users records by activated, order their returned events or state changes, and correlate records reported at the same time.
Interpretation: Okta reports this value on the Okta User object returned for Users; it is interpreted at one Okta User record per row; the schema uses the Temporal.DateTime scalar.

Created

Developer identifier: users.createdCreated records timestamp when the user was created in Okta. It is needed to place the record at the time or date reported for this event or state.

Enables: bound Users records by created, order their returned events or state changes, and correlate records reported at the same time.
Interpretation: Okta reports this value on the Okta User object returned for Users; it is interpreted at one Okta User record per row; the schema uses the Temporal.DateTime scalar.

Credentials

Developer identifier: users.credentialsCredentials records the user’s credential information including provider and recovery question. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: expand credentials to examine the returned credentials details for the containing Okta User record.
Interpretation: Okta reports this value on the Okta User object returned for Users; it is one nested object per containing Okta User object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Emails

Developer identifier: users.credentials.emailsEmails records array of email credential objects with verification status. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: expand emails to examine the returned emails details for the containing User Credentials record.
Interpretation: Okta reports this value on the User Credentials object returned for Users; it is one returned collection per containing User Credentials object; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Status

Developer identifier: users.credentials.emails.statusStatus records verification status of the email (e.g., VERIFIED). It is needed to distinguish Users rows by the exact Okta-returned status value.

Enables: separate Users rows by the exact Okta-returned status label when comparing status.
Interpretation: Okta reports this value on the Credential Email object returned for Users; it is interpreted at one Credential Email record per row; classification values are Okta-returned labels rather than a universal taxonomy.

Type

Developer identifier: users.credentials.emails.typeType records type of email (e.g., PRIMARY). It is needed to distinguish Users rows by the exact Okta-returned type value.

Enables: separate Users rows by the exact Okta-returned type label when comparing type.
Interpretation: Okta reports this value on the Credential Email object returned for Users; it is interpreted at one Credential Email record per row; classification values are Okta-returned labels rather than a universal taxonomy.

Value

Developer identifier: users.credentials.emails.valueValue records the email address. It is the key of this nested record.

Enables: match rows that carry the same Okta identifier in value.
Interpretation: Okta reports this value on the Credential Email object returned for Users; it is interpreted at one Credential Email record per row; it is the key of this nested record; the schema uses the Contact.Email scalar.

Password

Developer identifier: users.credentials.passwordPassword records password credential metadata (hash details if present, never the actual password). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate the exact password access value with the resource, account, or membership represented by the same Users row.
Interpretation: Okta reports this value on the User Credentials object returned for Users; it is interpreted at one User Credentials record per row; the schema uses the Generic.JSON scalar; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; the field describes credential metadata and never the actual password.

Provider

Developer identifier: users.credentials.providerProvider records the credential provider that authenticated the user. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: expand provider to examine the returned provider details for the containing User Credentials record.
Interpretation: Okta reports this value on the User Credentials object returned for Users; it is one nested object per containing User Credentials object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Name

Developer identifier: users.credentials.provider.nameName records name of the credential provider (e.g., OKTA, ACTIVE_DIRECTORY, LDAP, FEDERATION, SOCIAL, IMPORT). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate the exact name access value with the resource, account, or membership represented by the same Users row.
Interpretation: Okta reports this value on the Credential Provider object returned for Users; it is interpreted at one Credential Provider record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Type

Developer identifier: users.credentials.provider.typeType records type of credential provider. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: select Users rows with the exact type access-related value being investigated.
Interpretation: Okta reports this value on the Credential Provider object returned for Users; it is interpreted at one Credential Provider record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.

Recovery Question

Developer identifier: users.credentials.recovery_questionRecovery Question records recovery question for self-service password reset. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: expand recovery_question to examine the returned recovery question details for the containing User Credentials record.
Interpretation: Okta reports this value on the User Credentials object returned for Users; it is one nested object per containing User Credentials object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Question

Developer identifier: users.credentials.recovery_question.questionQuestion records the recovery question text. It is needed to inspect the exact recovery-question text returned for this Recovery Question record.

Enables: attribute the recovery-question text in question to the containing Users identifier, owner or author, status, and update time where returned.
Interpretation: Okta reports this value on the Recovery Question object returned for Users; it is interpreted at one Recovery Question record per row; this is only the recovery-question text included in the Okta response for this record.

Developer identifier: users.idID records unique identifier for the user. It identifies each Users row across syncs.

Enables: use id as the record key for Users and match repeated rows carrying the same Okta identifier.
Interpretation: Okta reports this value on the Okta User object returned for Users; it is an identifier, not a measured quantity; it is the record key.

Last Login

Developer identifier: users.lastLoginLast Login records timestamp of the user’s most recent login. It is needed to place the record at the time or date reported for this event or state.

Enables: bound Users records by lastLogin, order their returned events or state changes, and correlate records reported at the same time.
Interpretation: Okta reports this value on the Okta User object returned for Users; it is interpreted at one Okta User record per row; the schema uses the Temporal.DateTime scalar.

Last Updated

Developer identifier: users.lastUpdatedLast Updated records timestamp when the user record was last modified. It is needed to place the record at the time or date reported for this event or state.

Enables: bound Users records by lastUpdated, order their returned events or state changes, and correlate records reported at the same time.
Interpretation: Okta reports this value on the Okta User object returned for Users; it is interpreted at one Okta User record per row; Parable uses it to keep the latest version of each record; Parable treats it as the record’s metadata timestamp; the schema uses the Temporal.DateTime scalar.

Password Changed

Developer identifier: users.passwordChangedPassword Changed records timestamp when the user’s password was last changed. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate the exact passwordChanged access value with the resource, account, or membership represented by the same Users row.
Interpretation: Okta reports this value on the Okta User object returned for Users; it is interpreted at one Okta User record per row; the schema uses the Temporal.DateTime scalar; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Profile

Developer identifier: users.profileProfile records the user’s profile attributes. It is needed to preserve the nested profile relationship or details on the parent Okta User record.

Enables: expand profile to connect the containing Okta User row to its returned profile entries.
Interpretation: Okta reports this value on the Okta User object returned for Users; it is one nested object per containing Okta User object when present.

City

Developer identifier: users.profile.cityCity records city or locality of the user. It is needed to preserve the Okta-reported configured or derived address and place context for the same record.

Enables: compare the Okta-reported configured or derived address and place context in city for individual Users rows without treating it as a verified physical location.
Interpretation: Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; the value is configured or derived address and place context; this Okta-reported or configured context does not establish residency or verified physical presence.

Cost Center

Developer identifier: users.profile.costCenterCost Center records cost center associated with the user. It is needed to preserve the exact Okta-reported business, directory, or identity attribute represented by this field.

Enables: match or segment Users records by costCenter only within the same Okta attribute contract.
Interpretation: Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; the value is a Okta-returned or configured label and is not a universal identity or business taxonomy.

Country Code

Developer identifier: users.profile.countryCodeCountry Code records ISO 3166-1 alpha-2 country code. It is needed to preserve the Okta-reported configured or derived address and place context for the same record.

Enables: compare the Okta-reported configured or derived address and place context in countryCode for individual Users rows without treating it as a verified physical location.
Interpretation: Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; the value is configured or derived address and place context; this Okta-reported or configured context does not establish residency or verified physical presence; classification values are Okta-returned labels rather than a universal taxonomy.

Department

Developer identifier: users.profile.departmentDepartment records user’s department. It is needed to compare the returned department for individual Users rows and select rows with a specific department value.

Enables: trace the department relationship returned in department from the User Profile row to its named Okta context.
Interpretation: Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row.

Display Name

Developer identifier: users.profile.displayNameDisplay Name records user’s display name. It is needed to attribute this Users row to the returned person, account, or organization reference.

Enables: attribute the Users row to the returned person or account and match the exact displayName value where it recurs in Okta.
Interpretation: Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; the schema uses the Identity.Name scalar.

Division

Developer identifier: users.profile.divisionDivision records division within the organization. It is needed to compare the returned division for individual Users rows and select rows with a specific division value.

Enables: trace the division relationship returned in division from the User Profile row to its named Okta context.
Interpretation: Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row.

Developer identifier: users.profile.emailEmail records user’s primary email address. It is needed to attribute this Users row to the returned person, account, or organization reference.

Enables: attribute the Users row to the returned person or account and match the exact email value where it recurs in Okta.
Interpretation: Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; the schema uses the Contact.Email scalar.

Employee Number

Developer identifier: users.profile.employeeNumberEmployee Number records employee number from HR system. It is needed to refer to the same employee number across records without relying on display text.

Enables: match employeeNumber to employee number references carrying the same Okta-issued value in related Okta records.
Interpretation: Okta reports this value on the User Profile object returned for Users; it is an identifier, not a measured quantity.

First Name

Developer identifier: users.profile.firstNameFirst Name records user’s first name. It is needed to attribute this Users row to the returned person, account, or organization reference.

Enables: attribute the Users row to the returned person or account and match the exact firstName value where it recurs in Okta.
Interpretation: Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; the schema uses the Identity.Name scalar.

Honorific Prefix

Developer identifier: users.profile.honorificPrefixHonorific Prefix records honorific prefix (e.g., Mr., Dr.). It is needed to preserve the exact Okta-reported business, directory, or identity attribute represented by this field.

Enables: match or segment Users records by honorificPrefix only within the same Okta attribute contract.
Interpretation: Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; the value is a Okta-returned or configured label and is not a universal identity or business taxonomy.

Honorific Suffix

Developer identifier: users.profile.honorificSuffixHonorific Suffix records honorific suffix (e.g., Jr., III). It is needed to preserve the exact Okta-reported business, directory, or identity attribute represented by this field.

Enables: match or segment Users records by honorificSuffix only within the same Okta attribute contract.
Interpretation: Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; the value is a Okta-returned or configured label and is not a universal identity or business taxonomy.

Last Name

Developer identifier: users.profile.lastNameLast Name records user’s last name. It is needed to attribute this Users row to the returned person, account, or organization reference.

Enables: attribute the Users row to the returned person or account and match the exact lastName value where it recurs in Okta.
Interpretation: Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; the schema uses the Identity.Name scalar.

Locale

Developer identifier: users.profile.localeLocale records user’s default location for date/time formatting (BCP 47). It is needed to place the record at the time or date reported for this event or state.

Enables: bound Users records by locale, order their returned events or state changes, and correlate records reported at the same time.
Interpretation: Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; the schema uses the Localization.Locale scalar.

Developer identifier: users.profile.loginLogin records user’s Okta login, typically an email address. It is needed to attribute this Users row to the returned person, account, or organization reference.

Enables: attribute the Users row to the returned person or account and match the exact login value where it recurs in Okta.
Interpretation: Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; the schema uses the Contact.Email scalar.

Manager

Developer identifier: users.profile.managerManager records user’s manager (login or display name, depending on org config). It is needed to attribute this Users row to the returned person, account, or organization reference.

Enables: attribute the Users row to the returned person or account and match the exact manager value where it recurs in Okta.
Interpretation: Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row.

Manager ID

Developer identifier: users.profile.managerIdManager ID records identifier for the user’s manager. It is needed to refer to the same manager across records without relying on display text.

Enables: match managerId to manager references carrying the same Okta-issued value in related Okta records.
Interpretation: Okta reports this value on the User Profile object returned for Users; it is an identifier, not a measured quantity.

Middle Name

Developer identifier: users.profile.middleNameMiddle Name records user’s middle name. It is needed to attribute this Users row to the returned person, account, or organization reference.

Enables: attribute the Users row to the returned person or account and match the exact middleName value where it recurs in Okta.
Interpretation: Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row.

Mobile Phone

Developer identifier: users.profile.mobilePhoneMobile Phone records user’s mobile phone number. It is needed to preserve the exact Okta-reported contact number for the person, company, or location represented by this row.

Enables: match the exact contact number in mobilePhone to the same User Profile record without treating it as an account identifier.
Interpretation: Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; the schema uses the Contact.PhoneNumber scalar.

Nick Name

Developer identifier: users.profile.nickNameNick Name records user’s casual or nickname. It is needed to attribute this Users row to the returned person, account, or organization reference.

Enables: attribute the Users row to the returned person or account and match the exact nickName value where it recurs in Okta.
Interpretation: Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row.

Organization

Developer identifier: users.profile.organizationOrganization records name of the user’s organization. It is needed to compare the returned organization for individual Users rows and select rows with a specific organization value.

Enables: trace the organization relationship returned in organization from the User Profile row to its named Okta context.
Interpretation: Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row.

Postal Address

Developer identifier: users.profile.postalAddressPostal Address records mailing address of the user. It is needed to preserve the Okta-reported configured or derived address and place context for the same record.

Enables: compare the Okta-reported configured or derived address and place context in postalAddress for individual Users rows without treating it as a verified physical location.
Interpretation: Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; the value is configured or derived address and place context; this Okta-reported or configured context does not establish residency or verified physical presence.

Preferred Language

Developer identifier: users.profile.preferredLanguagePreferred Language records user’s preferred written or spoken language (RFC 7231). It is needed to preserve the Okta-reported language or locale preference for this identity.

Enables: select identities by the exact preferredLanguage language or locale tag without inferring physical location.
Interpretation: Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; this Okta-reported setting or qualifier does not establish residency or verified physical presence.

Primary Phone

Developer identifier: users.profile.primaryPhonePrimary Phone records user’s primary phone number. It is needed to distinguish Users rows by the exact Okta-returned primary phone value.

Enables: separate Users rows by the exact Okta-returned primaryPhone label when comparing primary phone.
Interpretation: Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; the schema uses the Contact.PhoneNumber scalar; classification values are Okta-returned labels rather than a universal taxonomy.

Profile URL

Developer identifier: users.profile.profileUrlProfile URL records URL to the user’s online profile (e.g., a web page). It is needed to inspect the exact link included with this record.

Enables: open or correlate the exact Okta resource referenced by profileUrl while retaining the containing Users record as provenance.
Interpretation: Okta reports this value on the User Profile object returned for Users; it is link at one User Profile record per row; the schema uses the Network.Url scalar; the returned link or template does not establish that the current credential can retrieve its target.

Second Email

Developer identifier: users.profile.secondEmailSecond Email records user’s secondary email address. It is needed to attribute this Users row to the returned person, account, or organization reference.

Enables: attribute the Users row to the returned person or account and match the exact secondEmail value where it recurs in Okta.
Interpretation: Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; the schema uses the Contact.Email scalar.

State

Developer identifier: users.profile.stateState records state or region of the user. It is needed to distinguish Users rows by the exact Okta-returned state value.

Enables: separate Users rows by the exact Okta-returned state label when comparing state.
Interpretation: Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; classification values are Okta-returned labels rather than a universal taxonomy.

Street Address

Developer identifier: users.profile.streetAddressStreet Address records full street address of the user. It is needed to preserve the Okta-reported configured or derived address and place context for the same record.

Enables: compare the Okta-reported configured or derived address and place context in streetAddress for individual Users rows without treating it as a verified physical location.
Interpretation: Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; the value is configured or derived address and place context; this Okta-reported or configured context does not establish residency or verified physical presence.

Team

Developer identifier: users.profile.teamTeam records user’s team within the organization. It is needed to compare the returned team for individual Users rows and select rows with a specific team value.

Enables: trace the team relationship returned in team from the User Profile row to its named Okta context.
Interpretation: Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row.

Timezone

Developer identifier: users.profile.timezoneTimezone records user’s time zone (IANA timezone identifier). It is needed to preserve the Okta-reported timezone or locale setting for the same record.

Enables: compare the Okta-reported timezone or locale setting in timezone for individual Users rows without treating it as a verified physical location.
Interpretation: Okta reports this value on the User Profile object returned for Users; it is an identifier, not a measured quantity; the schema uses the Temporal.TimeZone scalar; the value is timezone or locale setting; this Okta-reported or configured context does not establish residency or verified physical presence.

Title

Developer identifier: users.profile.titleTitle records user’s job title. It is needed to preserve the business or job title reported for the person represented by this row.

Enables: select Users rows by the exact business or job title in title without treating the title as an authorization role.
Interpretation: Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row.

User Type

Developer identifier: users.profile.userTypeUser Type records used to describe the organization-to-user relationship (e.g., Employee, Contractor). It is needed to distinguish Users rows by the exact Okta-returned user type value.

Enables: separate Users rows by the exact Okta-returned userType label when comparing user type.
Interpretation: Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; classification values are Okta-returned labels rather than a universal taxonomy.

Zip Code

Developer identifier: users.profile.zipCodeZip Code records zip code or postal code of the user. It is needed to preserve the Okta-reported configured or derived address and place context for the same record.

Enables: compare the Okta-reported configured or derived address and place context in zipCode for individual Users rows without treating it as a verified physical location.
Interpretation: Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; the value is configured or derived address and place context; this Okta-reported or configured context does not establish residency or verified physical presence; classification values are Okta-returned labels rather than a universal taxonomy.

Realm ID

Developer identifier: users.realmIdRealm ID records identifier of the realm the user belongs to. It is needed to refer to the same realm across records without relying on display text.

Enables: match realmId to realm references carrying the same Okta-issued value in related Okta records.
Interpretation: Okta reports this value on the Okta User object returned for Users; it is an identifier, not a measured quantity.

Status

Developer identifier: users.statusStatus records current lifecycle status of the user. It is needed to distinguish Users rows by the exact Okta-returned status value.

Enables: separate Users rows by the exact Okta-returned status label when comparing status.
Interpretation: Okta reports this value on the Okta User object returned for Users; it is interpreted at one Okta User record per row; classification values are Okta-returned labels rather than a universal taxonomy.

Status Changed

Developer identifier: users.statusChangedStatus Changed records timestamp when the user’s status last changed. It is needed to place the record at the time or date reported for this event or state.

Enables: bound Users records by statusChanged, order their returned events or state changes, and correlate records reported at the same time.
Interpretation: Okta reports this value on the Okta User object returned for Users; it is interpreted at one Okta User record per row; the schema uses the Temporal.DateTime scalar; classification values are Okta-returned labels rather than a universal taxonomy.

Transitioning To Status

Developer identifier: users.transitioningToStatusTransitioning To Status records target status of an in-progress asynchronous status transition, if any. It is needed to distinguish Users rows by the exact Okta-returned transitioning to status value.

Enables: separate Users rows by the exact Okta-returned transitioningToStatus label when comparing transitioning to status.
Interpretation: Okta reports this value on the Okta User object returned for Users; it is interpreted at one Okta User record per row; classification values are Okta-returned labels rather than a universal taxonomy.

Type

Developer identifier: users.typeType records the user type associated with this user. It is needed to preserve the nested type relationship or details on the parent Okta User record.

Enables: expand type to connect the containing Okta User row to its returned type entries.
Interpretation: Okta reports this value on the Okta User object returned for Users; it is one nested object per containing Okta User object when present.

Developer identifier: users.type.idID records unique identifier for the user type. It is needed to refer to the same user type across records without relying on display text.

Enables: match id to user type references carrying the same Okta-issued value in related Okta records.
Interpretation: Okta reports this value on the User Type object returned for Users; it is an identifier, not a measured quantity.

Tip: Rate Limits: Okta enforces rate limits of varies by endpoint; typically 100-1000 requests/minute. If this occurs during syncing, Parable retries rate-limited requests for a limited time, so large initial syncs may take longer. If the sync still fails, review the connection error before retrying. If this occurs during setup, wait briefly, then click Save & test connection again.

Error	Meaning	Solution
`E0000011`	Invalid token	Verify token is correct
`E0000006`	Access denied	Verify token has required admin permissions
`E0000015`	Feature not enabled	Check required Okta features/licenses are active
`429`	Rate limit	If this occurs during setup, wait briefly, then click Save & test connection again. If this occurs during syncing, Parable retries automatically for a limited time. If the sync still fails, review the connection error before retrying.

Common Issues

Token created by deactivated user

If the admin who created the token is deactivated, the token becomes invalid. Create a new token with an active admin account.

Can’t access logs

System Log access requires Super Administrator or Report Administrator role.Okta API — Official API referenceRate Limits — Rate limit documentation

​Identity

​Security

​Data streams

​API token

​What You’ll Need

​Step 1: Access Okta Admin Console

​Step 2: Navigate to API Settings

​Step 3: Create API Token

​Step 4: Note Your Okta Domain

​Step 5: Enter values in the form

​Common Issues

​Token created by deactivated user

​Can’t access logs

Identity

Security

Data streams

API token

What You’ll Need

Step 1: Access Okta Admin Console

Step 2: Navigate to API Settings

Step 3: Create API Token

Step 4: Note Your Okta Domain

Step 5: Enter values in the form

Common Issues

Token created by deactivated user

Can’t access logs