> ## Documentation Index
> Fetch the complete documentation index at: https://docs.parable.work/llms.txt
> Use this file to discover all available pages before exploring further.

# Okta

> Sync users, groups, and applications from Okta

Sync users, groups, and applications from Okta.

<Tabs>
  <Tab title="Overview">
    Connect Parable to Okta for identity, access management, and audit log data.

    #### Identity

    Users, groups, profiles

    #### Security

    Audit logs, system events

    ## Data streams

    This Provider Plugin defines 4 data streams.

    | Stream              | Description                           | Sync        |
    | ------------------- | ------------------------------------- | ----------- |
    | `users`             | Okta org users                        | incremental |
    | `audit_logs`        | Okta System Log events                | incremental |
    | `applications`      | Okta org applications                 | incremental |
    | `application_users` | Users assigned to an Okta application | full        |
  </Tab>

  <Tab title="Setup Guide">
    ### API token

    #### What You'll Need

    | Credential    | What it is                             |
    | ------------- | -------------------------------------- |
    | **API Token** | SSWS token from Okta admin console     |
    | **Domain**    | Your Okta subdomain (e.g., `your-org`) |

    > **Info:** **Setup access in Okta.** These steps require **Administrator**, or a colleague with equivalent permissions who can create credentials for you.
    >
    > If that is not you, ask your Okta administrator.

    * **Super Administrator** or **Organization Administrator** role
    * Permission to create API tokens

    #### Step 1: Access Okta Admin Console

    1. Log in to your Okta org
    2. Go to the Admin Console (click **Admin** in the top right)

    #### Step 2: Navigate to API Settings

    1. Go to **Security** → **API**
    2. Click the **Tokens** tab

    #### Step 3: Create API Token

    1. Click **Create Token**
    2. Name: `Parable Integration`
    3. Click **Create Token**

    > **Warning:** **Copy your API token now!**
    >
    > This is the only time it will be displayed. Store it in a secure password manager before closing this page.

    > **Warning:** Token inherits the creating admin's permissions. Use a dedicated admin account.

    #### Step 4: Note Your Okta Domain

    Your Okta domain format:

    ```
    https://your-org.okta.com
    ```

    Or for Okta preview:

    ```
    https://your-org.oktapreview.com
    ```

    #### Step 5: Enter values in the form

    1. **Domain**: Your Okta org hostname (for example `your-org.okta.com` without `https://`).
    2. **API Token**: Paste your SSWS API token.
    3. Click **Save & test connection**.

    ```bash Test Authentication theme={null}
    curl -H "Authorization: SSWS YOUR_TOKEN" \
      "https://your-org.okta.com/api/v1/users/me"
    ```

    ```bash List Users theme={null}
    curl -H "Authorization: SSWS YOUR_TOKEN" \
      "https://your-org.okta.com/api/v1/users?limit=5"
    ```

    > **Success:** **Success!** If you received a `200 OK` response with valid data, your credentials are configured correctly. You can now configure this Provider in Parable.
  </Tab>

  <Tab title="Permissions">
    <AccordionGroup>
      <Accordion id="provider-permission-tap-okta-application-users-1de82555fe60" title="Application Users" icon="address-book" iconType="sharp-duotone-solid">
        Developer identifier: `application_users`

        Application Users covers users assigned to an Okta application.

        * **Enables:** map the Okta accounts and memberships represented by Application Users records and trace a returned access assignment to its account or group.
        * **Scope:** Users assigned to an Okta application; the connector reads `/api/v1/apps/{id}/users` as a snapshot stream in full mode. Object and event visibility follows the API token's Okta administrative permissions; inaccessible objects or events are not returned. A successful full collection can reveal a previously returned row as absent, but a credential or permission change can produce the same observation.

        <AccordionGroup>
          <Accordion id="provider-permission-field-okta-application-users-embedded-0868f32f8b27" title="Embedded" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `application_users._embedded`

            Embedded records embedded resources related to the app user, if requested via expand parameter. It is needed to preserve the exact Okta configuration or execution metadata attached to this Okta App User record.

            * **Enables:** inspect the keys in `_embedded` when reproducing or investigating this record's configuration, parameters, or execution context.
            * **Interpretation:** Okta reports this value on the Okta App User object returned for Application Users; it is interpreted at one Okta App User record per row; the schema uses the `Generic.JSON` scalar; metadata keys and availability follow the Okta response and can vary by resource type or configuration.
          </Accordion>

          <Accordion id="provider-permission-field-okta-application-users-links-e9383debe4ed" title="Links" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `application_users._links`

            Links records HAL-style hypermedia links for the app user resource. It is needed to inspect the exact link included with this record.

            * **Enables:** open or correlate the exact Okta resource referenced by `_links` while retaining the containing Application Users record as provenance.
            * **Interpretation:** Okta reports this value on the Okta App User object returned for Application Users; it is link at one Okta App User record per row; the returned link or template does not establish that the current credential can retrieve its target.
          </Accordion>

          <Accordion id="provider-permission-field-okta-application-users-links-app-cdaf1e4ca2ab" title="App" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `application_users._links.app`

            App records link to the parent application. It is needed to inspect the exact link included with this record.

            * **Enables:** open or correlate the exact Okta resource referenced by `app` while retaining the containing Application Users record as provenance.
            * **Interpretation:** Okta reports this value on the Okta App User Links object returned for Application Users; it is link at one Okta App User Links record per row; the returned link or template does not establish that the current credential can retrieve its target.
          </Accordion>

          <Accordion id="provider-permission-field-okta-application-users-links-app-href-da077a61adcc" title="Href" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `application_users._links.app.href`

            Href records the URL of the linked resource. It is needed to retain the exact Okta resource or external link reported for this Application Users record.

            * **Enables:** open or correlate the resource named by `href` while retaining the containing Okta Hal Link row as provenance.
            * **Interpretation:** Okta reports this value on the Okta Hal Link object returned for Application Users; it is interpreted at one Okta Hal Link record per row; the schema uses the `Network.Url` scalar; the returned link or template does not establish that the current credential can retrieve its target.
          </Accordion>

          <Accordion id="provider-permission-field-okta-application-users-links-app-name-919fb350fcc5" title="Name" icon="percent" iconType="sharp-duotone-solid">
            Developer identifier: `application_users._links.app.name`

            Name records optional name for the link. It is needed to compare the exact name configuration returned for this Okta Hal Link record.

            * **Enables:** compare the exact `name` configuration returned for each Okta Hal Link record and select records with the configuration under review.
            * **Interpretation:** Okta reports this value on the Okta Hal Link object returned for Application Users; it is interpreted at one Okta Hal Link record per row.
          </Accordion>

          <Accordion id="provider-permission-field-okta-application-users-links-app-type-313a981adeaf" title="Type" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `application_users._links.app.type`

            Type records optional media type hint for the linked resource. It is needed to distinguish Application Users rows by the exact Okta-returned type value.

            * **Enables:** separate Application Users rows by the exact Okta-returned `type` label when comparing type.
            * **Interpretation:** Okta reports this value on the Okta Hal Link object returned for Application Users; it is interpreted at one Okta Hal Link record per row; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-application-users-links-self-cfdc654b1988" title="Self" icon="code-branch" iconType="sharp-duotone-solid">
            Developer identifier: `application_users._links.self`

            Self records self link for this app user assignment. It is needed to preserve the nested self relationship or details on the parent Okta App User Links record.

            * **Enables:** expand `self` to connect the containing Okta App User Links row to its returned self entries.
            * **Interpretation:** Okta reports this value on the Okta App User Links object returned for Application Users; it is one nested object per containing Okta App User Links object when present.
          </Accordion>

          <Accordion id="provider-permission-field-okta-application-users-links-user-f8c7d41bf95d" title="User" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `application_users._links.user`

            User records link to the Okta user resource. It is needed to inspect the exact link included with this record.

            * **Enables:** open or correlate the exact Okta resource referenced by `user` while retaining the containing Application Users record as provenance.
            * **Interpretation:** Okta reports this value on the Okta App User Links object returned for Application Users; it is link at one Okta App User Links record per row; the returned link or template does not establish that the current credential can retrieve its target.
          </Accordion>

          <Accordion id="provider-permission-field-okta-application-users-app-id-84952bc1403b" title="App ID" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `application_users.app_id`

            App ID records parent app id injected by the ingestor when iterating per-app (from the (id) path parameter in the `application_users` endpoint). Not part of the upstream Okta API response; written into each row at bronze ingestion time. It is needed to refer to the same app across records without relying on display text.

            * **Enables:** match `app_id` to app references carrying the same Okta-issued value in related Okta records.
            * **Interpretation:** Okta's child response does not supply this field; the connector injects parent context into each child row; it is an identifier, not a measured quantity.
          </Accordion>

          <Accordion id="provider-permission-field-okta-application-users-created-4eb1eb72ead3" title="Created" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `application_users.created`

            Created records timestamp when the user was assigned to the application. It is needed to place the record at the time or date reported for this event or state.

            * **Enables:** bound Application Users records by `created`, order their returned events or state changes, and correlate records reported at the same time.
            * **Interpretation:** Okta reports this value on the Okta App User object returned for Application Users; it is interpreted at one Okta App User record per row; the schema uses the `Temporal.DateTime` scalar.
          </Accordion>

          <Accordion id="provider-permission-field-okta-application-users-credentials-cb647d6a9dd2" title="Credentials" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `application_users.credentials`

            Credentials records credentials for the user in the target application. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** expand `credentials` to examine the returned credentials details for the containing Okta App User record.
            * **Interpretation:** Okta reports this value on the Okta App User object returned for Application Users; it is one nested object per containing Okta App User object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-application-users-credentials-password-58c10ef978bf" title="Password" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `application_users.credentials.password`

            Password records password object for the user in the target application. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** expand `password` to examine the returned password details for the containing Okta App User Credentials record.
            * **Interpretation:** Okta reports this value on the Okta App User Credentials object returned for Application Users; it is one nested object per containing Okta App User Credentials object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-application-users-credentials-password-valu-acc4218ad2b1" title="Value" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `application_users.credentials.password.value`

            Value records password value (only present during creation, never returned in GET responses). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate the exact `value` access value with the resource, account, or membership represented by the same Application Users row.
            * **Interpretation:** Okta reports this value on the Okta App User Password object returned for Application Users; it is interpreted at one Okta App User Password record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-application-users-credentials-username-99c2ffa49016" title="User Name" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `application_users.credentials.userName`

            User Name records username for the user in the target application. Often an email address. It is needed to attribute this Application Users row to the returned person, account, or organization reference.

            * **Enables:** attribute the Application Users row to the returned person or account and match the exact `userName` value where it recurs in Okta.
            * **Interpretation:** Okta reports this value on the Okta App User Credentials object returned for Application Users; it is interpreted at one Okta App User Credentials record per row; the schema uses the `Contact.Email` scalar.
          </Accordion>

          <Accordion id="provider-permission-field-okta-application-users-externalid-572e5dd0203a" title="External ID" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `application_users.externalId`

            External ID records external ID of the user in the target application, used for cross-system identity resolution. It is needed to refer to the same external across records without relying on display text.

            * **Enables:** match `externalId` to external references carrying the same Okta-issued value in related Okta records.
            * **Interpretation:** Okta reports this value on the Okta App User object returned for Application Users; it is an identifier, not a measured quantity.
          </Accordion>

          <Accordion id="provider-permission-field-okta-application-users-id-c8cd6a5eef98" title="ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `application_users.id`

            ID records unique identifier for the app user assignment. It is needed to distinguish repeated deliveries of the same Application Users row using the declared ingestion key.

            * **Enables:** use `id` as the declared ingestion deduplication key for Application Users and match repeated rows carrying the same Okta identifier.
            * **Interpretation:** Okta reports this value on the Okta App User object returned for Application Users; it is an identifier, not a measured quantity; the connector declares it as an ingestion deduplication key.
          </Accordion>

          <Accordion id="provider-permission-field-okta-application-users-lastupdated-6c3014df51c2" title="Last Updated" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `application_users.lastUpdated`

            Last Updated records timestamp when the app user assignment was last modified. It is needed to place the record at the time or date reported for this event or state.

            * **Enables:** bound Application Users records by `lastUpdated`, order their returned events or state changes, and correlate records reported at the same time.
            * **Interpretation:** Okta reports this value on the Okta App User object returned for Application Users; it is interpreted at one Okta App User record per row; the connector also declares it for record ordering; the schema assigns the `metadata_timestamp` semantic role; the schema uses the `Temporal.DateTime` scalar.
          </Accordion>

          <Accordion id="provider-permission-field-okta-application-users-passwordchanged-8075e95c20a9" title="Password Changed" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `application_users.passwordChanged`

            Password Changed records timestamp when the app user password was last changed. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate the exact `passwordChanged` access value with the resource, account, or membership represented by the same Application Users row.
            * **Interpretation:** Okta reports this value on the Okta App User object returned for Application Users; it is interpreted at one Okta App User record per row; the schema uses the `Temporal.DateTime` scalar; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-application-users-profile-e21b58d561e1" title="Profile" icon="chart-line" iconType="sharp-duotone-solid">
            Developer identifier: `application_users.profile`

            Profile records application-specific profile attributes for the user. Schema varies by application configuration. It is needed to compare the exact profile configuration returned for this Okta App User record.

            * **Enables:** compare the exact `profile` configuration returned for each Okta App User record and select records with the configuration under review.
            * **Interpretation:** Okta reports this value on the Okta App User object returned for Application Users; it is interpreted at one Okta App User record per row; the schema uses the `Generic.JSON` scalar.
          </Accordion>

          <Accordion id="provider-permission-field-okta-application-users-scope-b3d0b8379293" title="Scope" icon="percent" iconType="sharp-duotone-solid">
            Developer identifier: `application_users.scope`

            Scope records scope of the assignment (USER or GROUP). Distinguishes direct vs group-based app assignments. It is needed to distinguish Application Users rows by the exact Okta-returned scope value.

            * **Enables:** separate Application Users rows by the exact Okta-returned `scope` label when comparing scope.
            * **Interpretation:** Okta reports this value on the Okta App User object returned for Application Users; it is interpreted at one Okta App User record per row; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-application-users-status-d4074edba6c0" title="Status" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `application_users.status`

            Status records status of the app user (e.g., ACTIVE, INACTIVE, DEPROVISIONED, PROVISIONED). It is needed to distinguish Application Users rows by the exact Okta-returned status value.

            * **Enables:** separate Application Users rows by the exact Okta-returned `status` label when comparing status.
            * **Interpretation:** Okta reports this value on the Okta App User object returned for Application Users; it is interpreted at one Okta App User record per row; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-application-users-statuschanged-2018a233b740" title="Status Changed" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `application_users.statusChanged`

            Status Changed records timestamp when the app user status last changed. It is needed to place the record at the time or date reported for this event or state.

            * **Enables:** bound Application Users records by `statusChanged`, order their returned events or state changes, and correlate records reported at the same time.
            * **Interpretation:** Okta reports this value on the Okta App User object returned for Application Users; it is interpreted at one Okta App User record per row; the schema uses the `Temporal.DateTime` scalar; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-application-users-syncstate-4212aaf256fd" title="Sync State" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `application_users.syncState`

            Sync State records synchronization state of the app user (e.g., DISABLED, `OUT_OF_SYNC`, SYNCING, SYNCHRONIZED, ERROR). It is needed to distinguish Application Users rows by the exact Okta-returned sync state value.

            * **Enables:** separate Application Users rows by the exact Okta-returned `syncState` label when comparing sync state.
            * **Interpretation:** Okta reports this value on the Okta App User object returned for Application Users; it is interpreted at one Okta App User record per row; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>
        </AccordionGroup>
      </Accordion>

      <Accordion id="provider-permission-tap-okta-applications-e08c50db4eb4" title="Applications" icon="database" iconType="sharp-duotone-solid">
        Developer identifier: `applications`

        Applications covers Okta org applications.

        * **Enables:** inventory returned Okta applications and compare their provider-defined sign-on, visibility, credential, and application-link settings.
        * **Scope:** Okta org applications; the connector reads `/api/v1/apps` as a snapshot stream in incremental mode. Object and event visibility follows the API token's Okta administrative permissions; inaccessible objects or events are not returned. This stream has no deletion signal, so a missing row does not establish that the Okta record was deleted.

        <AccordionGroup>
          <Accordion id="provider-permission-field-okta-applications-embedded-2748d11e4a47" title="Embedded" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `applications._embedded`

            Embedded records embedded resources related to the application. It is needed to preserve the exact Okta configuration or execution metadata attached to this Okta App record.

            * **Enables:** inspect the keys in `_embedded` when reproducing or investigating this record's configuration, parameters, or execution context.
            * **Interpretation:** Okta reports this value on the Okta App object returned for Applications; it is interpreted at one Okta App record per row; the schema uses the `Generic.JSON` scalar; metadata keys and availability follow the Okta response and can vary by resource type or configuration.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-links-82c340373fc3" title="Links" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `applications._links`

            Links records HAL-style hypermedia links for the application. It is needed to inspect the exact link included with this record.

            * **Enables:** open or correlate the exact Okta resource referenced by `_links` while retaining the containing Applications record as provenance.
            * **Interpretation:** Okta reports this value on the Okta App object returned for Applications; it is link at one Okta App record per row; the returned link or template does not establish that the current credential can retrieve its target.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-links-accesspolicy-03e86e83ddbe" title="Access Policy" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `applications._links.accessPolicy`

            Access Policy records link to the access policy. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** expand `accessPolicy` to examine the returned access policy details for the containing Okta App Links record.
            * **Interpretation:** Okta reports this value on the Okta App Links object returned for Applications; it is link at one Okta App Links record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; the returned link or template does not establish that the current credential can retrieve its target.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-links-accesspolicy-hints-a38e13513144" title="Hints" icon="chart-pie" iconType="sharp-duotone-solid">
            Developer identifier: `applications._links.accessPolicy.hints`

            Hints records hints about the link (e.g., allowed HTTP methods). It is needed to compare the exact hints configuration returned for this Okta App Link record.

            * **Enables:** compare the exact `hints` configuration returned for each Okta App Link record and select records with the configuration under review.
            * **Interpretation:** Okta reports this value on the Okta App Link object returned for Applications; it is interpreted at one Okta App Link record per row; the schema uses the `Generic.JSON` scalar.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-links-accesspolicy-href-4077c611f1d9" title="Href" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `applications._links.accessPolicy.href`

            Href records the URL of the linked resource. It is needed to distinguish repeated deliveries of the same Applications row using the declared ingestion key.

            * **Enables:** use `href` as the declared ingestion deduplication key for Applications and match repeated rows carrying the same Okta identifier.
            * **Interpretation:** Okta reports this value on the Okta App Link object returned for Applications; it is interpreted at one Okta App Link record per row; the connector declares it as an ingestion deduplication key; the schema uses the `Network.Url` scalar.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-links-accesspolicy-name-908864202ed6" title="Name" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `applications._links.accessPolicy.name`

            Name records name of the link. It is needed to compare the returned name for individual Applications rows and select rows with a specific `name` value.

            * **Enables:** locate Applications rows whose returned name exactly matches `name` and retain the Okta identifier for any cross-record match.
            * **Interpretation:** Okta reports this value on the Okta App Link object returned for Applications; it is interpreted at one Okta App Link record per row.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-links-accesspolicy-type-a0879ca2c743" title="Type" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `applications._links.accessPolicy.type`

            Type records media type of the linked resource. It is needed to distinguish Applications rows by the exact Okta-returned type value.

            * **Enables:** separate Applications rows by the exact Okta-returned `type` label when comparing type.
            * **Interpretation:** Okta reports this value on the Okta App Link object returned for Applications; it is interpreted at one Okta App Link record per row; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-links-activate-af4d057b507d" title="Activate" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `applications._links.activate`

            Activate records link to activate the application. It is needed to inspect the exact link included with this record.

            * **Enables:** open or correlate the exact Okta resource referenced by `activate` while retaining the containing Applications record as provenance.
            * **Interpretation:** Okta reports this value on the Okta App Links object returned for Applications; it is link at one Okta App Links record per row; the returned link or template does not establish that the current credential can retrieve its target.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-links-applinks-7096486f403a" title="App Links" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `applications._links.appLinks`

            App Links records application launch links. It is needed to inspect the exact link included with this record.

            * **Enables:** open or correlate the exact Okta resource referenced by `appLinks` while retaining the containing Applications record as provenance.
            * **Interpretation:** Okta reports this value on the Okta App Links object returned for Applications; it is link at one Okta App Links record per row; the returned link or template does not establish that the current credential can retrieve its target.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-links-deactivate-6893c69004c8" title="Deactivate" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `applications._links.deactivate`

            Deactivate records link to deactivate the application. It is needed to inspect the exact link included with this record.

            * **Enables:** open or correlate the exact Okta resource referenced by `deactivate` while retaining the containing Applications record as provenance.
            * **Interpretation:** Okta reports this value on the Okta App Links object returned for Applications; it is link at one Okta App Links record per row; the returned link or template does not establish that the current credential can retrieve its target.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-links-groups-477c56f97acd" title="Groups" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `applications._links.groups`

            Groups records link to the groups assigned to this application. It is needed to inspect the exact link included with this record.

            * **Enables:** open or correlate the exact Okta resource referenced by `groups` while retaining the containing Applications record as provenance.
            * **Interpretation:** Okta reports this value on the Okta App Links object returned for Applications; it is link at one Okta App Links record per row; the returned link or template does not establish that the current credential can retrieve its target.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-links-logo-18b9b87972c1" title="Logo" icon="brackets-curly" iconType="sharp-duotone-solid">
            Developer identifier: `applications._links.logo`

            Logo records application logo links. It is needed to preserve the nested logo relationship or details on the parent Okta App Links record.

            * **Enables:** expand `logo` to connect the containing Okta App Links row to its returned logo entries.
            * **Interpretation:** Okta reports this value on the Okta App Links object returned for Applications; it is one returned collection per containing Okta App Links object.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-links-metadata-acd8a53c8956" title="Metadata" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `applications._links.metadata`

            Metadata records link to application metadata (e.g., SAML metadata). It is needed to inspect the exact link included with this record.

            * **Enables:** open or correlate the exact Okta resource referenced by `metadata` while retaining the containing Applications record as provenance.
            * **Interpretation:** Okta reports this value on the Okta App Links object returned for Applications; it is link at one Okta App Links record per row; the returned link or template does not establish that the current credential can retrieve its target.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-links-policies-f013b8184ce9" title="Policies" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `applications._links.policies`

            Policies records link to associated policies. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** expand `policies` to examine the returned policies details for the containing Okta App Links record.
            * **Interpretation:** Okta reports this value on the Okta App Links object returned for Applications; it is link at one Okta App Links record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; the returned link or template does not establish that the current credential can retrieve its target.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-links-profileenrollment-92fba3610154" title="Profile Enrollment" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `applications._links.profileEnrollment`

            Profile Enrollment records link to profile enrollment policy. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** expand `profileEnrollment` to examine the returned profile enrollment details for the containing Okta App Links record.
            * **Interpretation:** Okta reports this value on the Okta App Links object returned for Applications; it is link at one Okta App Links record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; the returned link or template does not establish that the current credential can retrieve its target.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-links-self-4e82e9d8e13a" title="Self" icon="code-branch" iconType="sharp-duotone-solid">
            Developer identifier: `applications._links.self`

            Self records self link for this application. It is needed to preserve the nested self relationship or details on the parent Okta App Links record.

            * **Enables:** expand `self` to connect the containing Okta App Links row to its returned self entries.
            * **Interpretation:** Okta reports this value on the Okta App Links object returned for Applications; it is one nested object per containing Okta App Links object when present.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-links-uploadlogo-d1726f7a1893" title="Upload Logo" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `applications._links.uploadLogo`

            Upload Logo records link to upload a logo for the application. It is needed to inspect the exact link included with this record.

            * **Enables:** open or correlate the exact Okta resource referenced by `uploadLogo` while retaining the containing Applications record as provenance.
            * **Interpretation:** Okta reports this value on the Okta App Links object returned for Applications; it is link at one Okta App Links record per row; the returned link or template does not establish that the current credential can retrieve its target.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-links-users-7a990a2a7096" title="Users" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `applications._links.users`

            Users records link to the users assigned to this application. It is needed to inspect the exact link included with this record.

            * **Enables:** open or correlate the exact Okta resource referenced by `users` while retaining the containing Applications record as provenance.
            * **Interpretation:** Okta reports this value on the Okta App Links object returned for Applications; it is link at one Okta App Links record per row; the returned link or template does not establish that the current credential can retrieve its target.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-accessibility-b175b7c3f6e2" title="Accessibility" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `applications.accessibility`

            Accessibility records accessibility settings for the application. It is needed to preserve the nested accessibility relationship or details on the parent Okta App record.

            * **Enables:** expand `accessibility` to connect the containing Okta App row to its returned accessibility entries.
            * **Interpretation:** Okta reports this value on the Okta App object returned for Applications; it is one nested object per containing Okta App object when present.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-accessibility-errorredirecturl-b8ff28d2ee8f" title="Error Redirect URL" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `applications.accessibility.errorRedirectUrl`

            Error Redirect URL records custom error redirect URL. It is needed to inspect the exact link included with this record.

            * **Enables:** open or correlate the exact Okta resource referenced by `errorRedirectUrl` while retaining the containing Applications record as provenance.
            * **Interpretation:** Okta reports this value on the Okta App Accessibility object returned for Applications; it is link at one Okta App Accessibility record per row; the schema uses the `Network.Url` scalar; the returned link or template does not establish that the current credential can retrieve its target.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-accessibility-loginredirecturl-c122adeece45" title="Login Redirect URL" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `applications.accessibility.loginRedirectUrl`

            Login Redirect URL records custom login redirect URL. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate the exact `loginRedirectUrl` access value with the resource, account, or membership represented by the same Applications row.
            * **Interpretation:** Okta reports this value on the Okta App Accessibility object returned for Applications; it is link at one Okta App Accessibility record per row; the schema uses the `Network.Url` scalar; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; the returned link or template does not establish that the current credential can retrieve its target.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-accessibility-selfservice-c1ecadc60578" title="Self Service" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `applications.accessibility.selfService`

            Self Service records whether users can request access to the app. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** select Applications rows with the exact `selfService` access-related value being investigated.
            * **Interpretation:** Okta reports this value on the Okta App Accessibility object returned for Applications; it is interpreted at one Okta App Accessibility record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-activated-b80d8d2cbc84" title="Activated" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `applications.activated`

            Activated records timestamp when the application was activated. It is needed to place the record at the time or date reported for this event or state.

            * **Enables:** bound Applications records by `activated`, order their returned events or state changes, and correlate records reported at the same time.
            * **Interpretation:** Okta reports this value on the Okta App object returned for Applications; it is interpreted at one Okta App record per row; the schema uses the `Temporal.DateTime` scalar.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-created-47a9bc98d399" title="Created" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `applications.created`

            Created records timestamp when the application was created. It is needed to place the record at the time or date reported for this event or state.

            * **Enables:** bound Applications records by `created`, order their returned events or state changes, and correlate records reported at the same time.
            * **Interpretation:** Okta reports this value on the Okta App object returned for Applications; it is interpreted at one Okta App record per row; the schema uses the `Temporal.DateTime` scalar.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-credentials-9b18ceb3dd33" title="Credentials" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `applications.credentials`

            Credentials records credential settings for the application. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** expand `credentials` to examine the returned credentials details for the containing Okta App record.
            * **Interpretation:** Okta reports this value on the Okta App object returned for Applications; it is one nested object per containing Okta App object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-credentials-oauthclient-81a43b346207" title="OAuth Client" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `applications.credentials.oauthClient`

            OAuth Client records OAuth client credentials (for OIDC apps). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** expand `oauthClient` to examine the returned o auth client details for the containing Okta App Credentials record.
            * **Interpretation:** Okta reports this value on the Okta App Credentials object returned for Applications; it is one nested object per containing Okta App Credentials object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-credentials-oauthclient-autoke-0c292be0d84b" title="Auto Key Rotation" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `applications.credentials.oauthClient.autoKeyRotation`

            Auto Key Rotation records whether automatic key rotation is enabled. It is needed to distinguish Applications rows by the exact Okta-returned auto key rotation value.

            * **Enables:** select Applications rows where `autoKeyRotation` is true or false when comparing the condition described by Auto Key Rotation.
            * **Interpretation:** Okta reports this value on the Okta App OAuth Client object returned for Applications; it is interpreted at one Okta App OAuth Client record per row; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-credentials-oauthclient-client-f095ca216928" title="Client ID" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `applications.credentials.oauthClient.client_id`

            Client ID records OAuth client ID. It is needed to refer to the same client across records without relying on display text.

            * **Enables:** match `client_id` to client references carrying the same Okta-issued value in related Okta records.
            * **Interpretation:** Okta reports this value on the Okta App OAuth Client object returned for Applications; it is an identifier, not a measured quantity.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-credentials-oauthclient-token--c285b7398a28" title="Token Endpoint Auth Method" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `applications.credentials.oauthClient.token_endpoint_auth_method`

            Token Endpoint Auth Method records token endpoint authentication method (`client_secret_basic`, `client_secret_post`, `private_key_jwt`, none). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate the exact `token_endpoint_auth_method` access value with the resource, account, or membership represented by the same Applications row.
            * **Interpretation:** Okta reports this value on the Okta App OAuth Client object returned for Applications; it is interpreted at one Okta App OAuth Client record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-credentials-revealpassword-d0f6d670cbb5" title="Reveal Password" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `applications.credentials.revealPassword`

            Reveal Password records whether the password can be revealed to the user. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** select Applications rows with the exact `revealPassword` access-related value being investigated.
            * **Interpretation:** Okta reports this value on the Okta App Credentials object returned for Applications; it is interpreted at one Okta App Credentials record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-credentials-scheme-4eefae387c1f" title="Scheme" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `applications.credentials.scheme`

            Scheme records authentication scheme (`EDIT_USERNAME_AND_PASSWORD`, `EDIT_PASSWORD_ONLY`, `EXTERNAL_PASSWORD_SYNC`, `SHARED_USERNAME_AND_PASSWORD`, `ADMIN_SETS_CREDENTIALS`). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate the exact `scheme` access value with the resource, account, or membership represented by the same Applications row.
            * **Interpretation:** Okta reports this value on the Okta App Credentials object returned for Applications; it is interpreted at one Okta App Credentials record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-credentials-signing-c4a8ccde61a8" title="Signing" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `applications.credentials.signing`

            Signing records signing credential configuration. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** expand `signing` to examine the returned signing details for the containing Okta App Credentials record.
            * **Interpretation:** Okta reports this value on the Okta App Credentials object returned for Applications; it is one nested object per containing Okta App Credentials object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-credentials-signing-kid-bd81182ae440" title="Kid" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `applications.credentials.signing.kid`

            Kid records key ID of the signing key. It is needed to refer to the same kid across records without relying on display text.

            * **Enables:** match `kid` to kid references carrying the same Okta-issued value in related Okta records.
            * **Interpretation:** Okta reports this value on the Okta App Credentials Signing object returned for Applications; it is an identifier, not a measured quantity.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-credentials-signing-lastrotate-b3a9450b0609" title="Last Rotated" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `applications.credentials.signing.lastRotated`

            Last Rotated records timestamp of the last key rotation. It is needed to place the record at the time or date reported for this event or state.

            * **Enables:** bound Applications records by `lastRotated`, order their returned events or state changes, and correlate records reported at the same time.
            * **Interpretation:** Okta reports this value on the Okta App Credentials Signing object returned for Applications; it is interpreted at one Okta App Credentials Signing record per row; the schema uses the `Temporal.DateTime` scalar.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-credentials-signing-nextrotati-e9f4fb03ebaa" title="Next Rotation" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `applications.credentials.signing.nextRotation`

            Next Rotation records timestamp of the next scheduled key rotation. It is needed to place the record at the time or date reported for this event or state.

            * **Enables:** bound Applications records by `nextRotation`, order their returned events or state changes, and correlate records reported at the same time.
            * **Interpretation:** Okta reports this value on the Okta App Credentials Signing object returned for Applications; it is interpreted at one Okta App Credentials Signing record per row; the schema uses the `Temporal.DateTime` scalar.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-credentials-signing-rotationmo-8390eded2c70" title="Rotation Mode" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `applications.credentials.signing.rotationMode`

            Rotation Mode records key rotation mode (AUTO or MANUAL). It is needed to distinguish Applications rows by the exact Okta-returned rotation mode value.

            * **Enables:** separate Applications rows by the exact Okta-returned `rotationMode` label when comparing rotation mode.
            * **Interpretation:** Okta reports this value on the Okta App Credentials Signing object returned for Applications; it is interpreted at one Okta App Credentials Signing record per row; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-credentials-signing-use-71227c2bd66d" title="Use" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `applications.credentials.signing.use`

            Use records use of the key (sig). It is needed to inventory the exact Okta-reported configuration or classification represented by this field.

            * **Enables:** compare `use` among Applications records when reconciling this specific configuration, source, or classification.
            * **Interpretation:** Okta reports this value on the Okta App Credentials Signing object returned for Applications; it is interpreted at one Okta App Credentials Signing record per row; the value is a Okta-returned or configured label at the Okta App Credentials Signing grain rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-credentials-usernametemplate-7dcb6df671e6" title="User Name Template" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `applications.credentials.userNameTemplate`

            User Name Template records template used to generate usernames for the app. It is needed to preserve the nested user name template relationship or details on the parent Okta App Credentials record.

            * **Enables:** expand `userNameTemplate` to connect the containing Okta App Credentials row to its returned user name template entries.
            * **Interpretation:** Okta reports this value on the Okta App Credentials object returned for Applications; it is one nested object per containing Okta App Credentials object when present.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-credentials-usernametemplate-p-0b6cceb16d1f" title="Push Status" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `applications.credentials.userNameTemplate.pushStatus`

            Push Status records push status for the username template. It is needed to distinguish Applications rows by the exact Okta-returned push status value.

            * **Enables:** separate Applications rows by the exact Okta-returned `pushStatus` label when comparing push status.
            * **Interpretation:** Okta reports this value on the Okta App User Name Template object returned for Applications; it is interpreted at one Okta App User Name Template record per row; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-credentials-usernametemplate-s-c20ced5cbc3f" title="Suffix" icon="clock-rotate-left" iconType="sharp-duotone-solid">
            Developer identifier: `applications.credentials.userNameTemplate.suffix`

            Suffix records suffix appended to the username. It is needed to attribute this Applications row to the returned person, account, or organization reference.

            * **Enables:** attribute the Applications row to the returned person or account and match the exact `suffix` value where it recurs in Okta.
            * **Interpretation:** Okta reports this value on the Okta App User Name Template object returned for Applications; it is interpreted at one Okta App User Name Template record per row.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-credentials-usernametemplate-t-68532b5cc6c2" title="Template" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `applications.credentials.userNameTemplate.template`

            Template records Okta Expression Language template string (e.g., \$(source.login)). It is needed to inspect the exact template text returned for this Okta App User Name Template record.

            * **Enables:** attribute the template text in `template` to the containing Applications identifier, owner or author, status, and update time where returned.
            * **Interpretation:** Okta reports this value on the Okta App User Name Template object returned for Applications; it is interpreted at one Okta App User Name Template record per row; this is only the template text included in the Okta response for this record.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-credentials-usernametemplate-t-0e093294ed58" title="Type" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `applications.credentials.userNameTemplate.type`

            Type records template type (`BUILT_IN`, CUSTOM, NONE). It is needed to distinguish Applications rows by the exact Okta-returned type value.

            * **Enables:** separate Applications rows by the exact Okta-returned `type` label when comparing type.
            * **Interpretation:** Okta reports this value on the Okta App User Name Template object returned for Applications; it is interpreted at one Okta App User Name Template record per row; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-features-4c7c37409542" title="Features" icon="circle-exclamation" iconType="sharp-duotone-solid">
            Developer identifier: `applications.features`

            Features records list of enabled features for the application. It is needed to preserve the nested features relationship or details on the parent Okta App record.

            * **Enables:** expand `features` to connect the containing Okta App row to its returned features entries.
            * **Interpretation:** Okta reports this value on the Okta App object returned for Applications; it is one returned collection per containing Okta App object.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-id-bd96891b15e6" title="ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `applications.id`

            ID records unique identifier for the application. It is needed to distinguish repeated deliveries of the same Applications row using the declared ingestion key.

            * **Enables:** use `id` as the declared ingestion deduplication key for Applications and match repeated rows carrying the same Okta identifier.
            * **Interpretation:** Okta reports this value on the Okta App object returned for Applications; it is an identifier, not a measured quantity; the connector declares it as an ingestion deduplication key.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-label-9d7664068a3c" title="Label" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `applications.label`

            Label records human-readable display name of the application. It is needed to compare the returned label for individual Applications rows and select rows with a specific `label` value.

            * **Enables:** locate Applications rows whose returned label exactly matches `label` and retain the Okta identifier for any cross-record match.
            * **Interpretation:** Okta reports this value on the Okta App object returned for Applications; it is interpreted at one Okta App record per row; the schema uses the `Identity.Name` scalar.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-lastupdated-73f2edafdae5" title="Last Updated" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `applications.lastUpdated`

            Last Updated records timestamp when the application was last modified. It is needed to place the record at the time or date reported for this event or state.

            * **Enables:** bound Applications records by `lastUpdated`, order their returned events or state changes, and correlate records reported at the same time.
            * **Interpretation:** Okta reports this value on the Okta App object returned for Applications; it is interpreted at one Okta App record per row; the connector also declares it for record ordering; the schema assigns the `metadata_timestamp` semantic role; the schema uses the `Temporal.DateTime` scalar.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-name-b804799d1e34" title="Name" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `applications.name`

            Name records internal name/template of the application (e.g., salesforce, bookmark, `oidc_client`). It is needed to compare the returned name for individual Applications rows and select rows with a specific `name` value.

            * **Enables:** locate Applications rows whose returned name exactly matches `name` and retain the Okta identifier for any cross-record match.
            * **Interpretation:** Okta reports this value on the Okta App object returned for Applications; it is interpreted at one Okta App record per row.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-orn-240b162ce335" title="Orn" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `applications.orn`

            Orn records Okta Resource Name uniquely identifying the application across Okta (e.g., orn:okta:idp:`OKTA_ORG`:apps/0oab...). It is needed to preserve the exact Okta-reported business, directory, or identity attribute represented by this field.

            * **Enables:** match or segment Applications records by `orn` only within the same Okta attribute contract.
            * **Interpretation:** Okta reports this value on the Okta App object returned for Applications; it is interpreted at one Okta App record per row; the value is a Okta-returned or configured label and is not a universal identity or business taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-profile-bfc6cf095f1d" title="Profile" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `applications.profile`

            Profile records application profile attributes (varies by app type). It is needed to preserve the exact Okta configuration or execution metadata attached to this Okta App record.

            * **Enables:** inspect the keys in `profile` when reproducing or investigating this record's configuration, parameters, or execution context.
            * **Interpretation:** Okta reports this value on the Okta App object returned for Applications; it is interpreted at one Okta App record per row; the schema uses the `Generic.JSON` scalar; metadata keys and availability follow the Okta response and can vary by resource type or configuration.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-settings-31793776c7a7" title="Settings" icon="code-commit" iconType="sharp-duotone-solid">
            Developer identifier: `applications.settings`

            Settings records application-specific settings. It is needed to preserve the nested settings relationship or details on the parent Okta App record.

            * **Enables:** expand `settings` to connect the containing Okta App row to its returned settings entries.
            * **Interpretation:** Okta reports this value on the Okta App object returned for Applications; it is one nested object per containing Okta App object when present.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-settings-app-8c6076dc03d6" title="App" icon="circle-info" iconType="sharp-duotone-solid">
            Developer identifier: `applications.settings.app`

            App records app-specific settings object (varies by application type). It is needed to compare the exact app configuration returned for this Okta App Settings record.

            * **Enables:** compare the exact `app` configuration returned for each Okta App Settings record and select records with the configuration under review.
            * **Interpretation:** Okta reports this value on the Okta App Settings object returned for Applications; it is interpreted at one Okta App Settings record per row; the schema uses the `Generic.JSON` scalar.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-settings-implicitassignment-69ba503d4352" title="Implicit Assignment" icon="circle-info" iconType="sharp-duotone-solid">
            Developer identifier: `applications.settings.implicitAssignment`

            Implicit Assignment records whether implicit assignment is enabled. It is needed to distinguish Applications rows by the exact Okta-returned implicit assignment value.

            * **Enables:** select Applications rows where `implicitAssignment` is true or false when comparing the condition described by Implicit Assignment.
            * **Interpretation:** Okta reports this value on the Okta App Settings object returned for Applications; it is interpreted at one Okta App Settings record per row; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-settings-manualprovisioning-9025a38d6f79" title="Manual Provisioning" icon="circle-info" iconType="sharp-duotone-solid">
            Developer identifier: `applications.settings.manualProvisioning`

            Manual Provisioning records whether manual provisioning is enabled. It is needed to distinguish Applications rows by the exact Okta-returned manual provisioning value.

            * **Enables:** select Applications rows where `manualProvisioning` is true or false when comparing the condition described by Manual Provisioning.
            * **Interpretation:** Okta reports this value on the Okta App Settings object returned for Applications; it is interpreted at one Okta App Settings record per row; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-settings-notes-aac1d7aab737" title="Notes" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `applications.settings.notes`

            Notes records admin and end-user notes for the application. It is needed to preserve the nested notes relationship or details on the parent Okta App Settings record.

            * **Enables:** expand `notes` to connect the containing Okta App Settings row to its returned notes entries.
            * **Interpretation:** Okta reports this value on the Okta App Settings object returned for Applications; it is one nested object per containing Okta App Settings object when present.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-settings-notes-admin-a383dc9cc5b6" title="Admin" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `applications.settings.notes.admin`

            Admin records admin notes for the application. It is needed to inventory the exact Okta-reported configuration or classification represented by this field.

            * **Enables:** compare `admin` among Applications records when reconciling this specific configuration, source, or classification.
            * **Interpretation:** Okta reports this value on the Okta App Notes object returned for Applications; it is interpreted at one Okta App Notes record per row; the value is a Okta-returned or configured label at the Okta App Notes grain rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-settings-notes-enduser-c9c2a1d6afbc" title="Enduser" icon="arrow-trend-up" iconType="sharp-duotone-solid">
            Developer identifier: `applications.settings.notes.enduser`

            Enduser records end-user notes displayed to users. It is needed to attribute this Applications row to the returned person, account, or organization reference.

            * **Enables:** attribute the Applications row to the returned person or account and match the exact `enduser` value where it recurs in Okta.
            * **Interpretation:** Okta reports this value on the Okta App Notes object returned for Applications; it is interpreted at one Okta App Notes record per row.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-settings-notifications-971d852f4f3b" title="Notifications" icon="code-branch" iconType="sharp-duotone-solid">
            Developer identifier: `applications.settings.notifications`

            Notifications records notification settings for the application. It is needed to preserve the nested notifications relationship or details on the parent Okta App Settings record.

            * **Enables:** expand `notifications` to connect the containing Okta App Settings row to its returned notifications entries.
            * **Interpretation:** Okta reports this value on the Okta App Settings object returned for Applications; it is one nested object per containing Okta App Settings object when present.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-settings-notifications-vpn-c745a8998154" title="Vpn" icon="code-merge" iconType="sharp-duotone-solid">
            Developer identifier: `applications.settings.notifications.vpn`

            Vpn records VPN notification settings. It is needed to preserve the nested vpn relationship or details on the parent Okta App Notifications record.

            * **Enables:** expand `vpn` to connect the containing Okta App Notifications row to its returned vpn entries.
            * **Interpretation:** Okta reports this value on the Okta App Notifications object returned for Applications; it is one nested object per containing Okta App Notifications object when present.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-settings-notifications-vpn-hel-e69462bd213c" title="Help URL" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `applications.settings.notifications.vpn.helpUrl`

            Help URL records help URL for VPN notification. It is needed to inspect the exact link included with this record.

            * **Enables:** open or correlate the exact Okta resource referenced by `helpUrl` while retaining the containing Applications record as provenance.
            * **Interpretation:** Okta reports this value on the Okta App Vpn Notification object returned for Applications; it is link at one Okta App Vpn Notification record per row; the schema uses the `Network.Url` scalar; the returned link or template does not establish that the current credential can retrieve its target.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-settings-notifications-vpn-mes-bbf0e9f9f264" title="Message" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `applications.settings.notifications.vpn.message`

            Message records custom VPN notification message. It is needed to inspect the exact message text included with this record.

            * **Enables:** inspect the message text returned in `message` and attribute it to the same record's parent record, owner, status, and update time where returned.
            * **Interpretation:** Okta reports this value on the Okta App Vpn Notification object returned for Applications; it is message text at one Okta App Vpn Notification record per row; this is only the content included in the Okta response for this record.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-settings-notifications-vpn-net-d2eb0339fe55" title="Network" icon="arrow-trend-up" iconType="sharp-duotone-solid">
            Developer identifier: `applications.settings.notifications.vpn.network`

            Network records network configuration for VPN notification. It is needed to preserve the nested network relationship or details on the parent Okta App Vpn Notification record.

            * **Enables:** expand `network` to connect the containing Okta App Vpn Notification row to its returned network entries.
            * **Interpretation:** Okta reports this value on the Okta App Vpn Notification object returned for Applications; it is one nested object per containing Okta App Vpn Notification object when present.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-settings-notifications-vpn-net-e5bf1009146f" title="Connection" icon="triangle-exclamation" iconType="sharp-duotone-solid">
            Developer identifier: `applications.settings.notifications.vpn.network.connection`

            Connection records connection type (DISABLED, ANYWHERE, `ON_NETWORK`, `OFF_NETWORK`). It is needed to inventory the exact Okta-reported configuration or classification represented by this field.

            * **Enables:** compare `connection` among Applications records when reconciling this specific configuration, source, or classification.
            * **Interpretation:** Okta reports this value on the Okta App Vpn Network object returned for Applications; it is interpreted at one Okta App Vpn Network record per row; the value is a Okta-returned or configured label at the Okta App Vpn Network grain rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-settings-notifications-vpn-net-8b39afc84ba7" title="Exclude" icon="code-commit" iconType="sharp-duotone-solid">
            Developer identifier: `applications.settings.notifications.vpn.network.exclude`

            Exclude records list of excluded network zones. It is needed to preserve the nested exclude relationship or details on the parent Okta App Vpn Network record.

            * **Enables:** expand `exclude` to connect the containing Okta App Vpn Network row to its returned exclude entries.
            * **Interpretation:** Okta reports this value on the Okta App Vpn Network object returned for Applications; it is one returned collection per containing Okta App Vpn Network object.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-settings-notifications-vpn-net-4fe83cc79622" title="Include" icon="brackets-curly" iconType="sharp-duotone-solid">
            Developer identifier: `applications.settings.notifications.vpn.network.include`

            Include records list of included network zones. It is needed to preserve the nested include relationship or details on the parent Okta App Vpn Network record.

            * **Enables:** expand `include` to connect the containing Okta App Vpn Network row to its returned include entries.
            * **Interpretation:** Okta reports this value on the Okta App Vpn Network object returned for Applications; it is one returned collection per containing Okta App Vpn Network object.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-settings-oauthclient-f23dd4731ac3" title="OAuth Client" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `applications.settings.oauthClient`

            OAuth Client records OAuth/OIDC-specific settings. It is needed to preserve the nested o auth client relationship or details on the parent Okta App Settings record.

            * **Enables:** expand `oauthClient` to connect the containing Okta App Settings row to its returned o auth client entries.
            * **Interpretation:** Okta reports this value on the Okta App Settings object returned for Applications; it is one nested object per containing Okta App Settings object when present.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-settings-oauthclient-applicati-41199f92667d" title="Application Type" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `applications.settings.oauthClient.application_type`

            Application Type records application type (web, native, service, browser). It is needed to distinguish Applications rows by the exact Okta-returned application type value.

            * **Enables:** separate Applications rows by the exact Okta-returned `application_type` label when comparing application type.
            * **Interpretation:** Okta reports this value on the Okta App OAuth Settings object returned for Applications; it is interpreted at one Okta App OAuth Settings record per row; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-settings-oauthclient-client-ur-91223606eba8" title="Client URI" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `applications.settings.oauthClient.client_uri`

            Client URI records client URI. It is needed to inspect the exact link included with this record.

            * **Enables:** open or correlate the exact Okta resource referenced by `client_uri` while retaining the containing Applications record as provenance.
            * **Interpretation:** Okta reports this value on the Okta App OAuth Settings object returned for Applications; it is link at one Okta App OAuth Settings record per row; the schema uses the `Network.Url` scalar; the returned link or template does not establish that the current credential can retrieve its target.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-settings-oauthclient-consent-m-08bba4698575" title="Consent Method" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `applications.settings.oauthClient.consent_method`

            Consent Method records consent method (REQUIRED, TRUSTED). It is needed to compare the exact consent method configuration returned for this Okta App OAuth Settings record.

            * **Enables:** compare the exact `consent_method` configuration returned for each Okta App OAuth Settings record and select records with the configuration under review.
            * **Interpretation:** Okta reports this value on the Okta App OAuth Settings object returned for Applications; it is interpreted at one Okta App OAuth Settings record per row.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-settings-oauthclient-grant-typ-19419053c115" title="Grant Types" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `applications.settings.oauthClient.grant_types`

            Grant Types records allowed OAuth grant types. It is needed to preserve the nested grant types relationship or details on the parent Okta App OAuth Settings record.

            * **Enables:** expand `grant_types` to connect the containing Okta App OAuth Settings row to its returned grant types entries.
            * **Interpretation:** Okta reports this value on the Okta App OAuth Settings object returned for Applications; it is one returned collection per containing Okta App OAuth Settings object.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-settings-oauthclient-idp-initi-82e2da341fc7" title="Idp Initiated Login" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `applications.settings.oauthClient.idp_initiated_login`

            Idp Initiated Login records idP-initiated login configuration. It is needed to attribute this Applications row to the returned person, account, or organization reference.

            * **Enables:** attribute the Applications row to the returned person or account and match the exact `idp_initiated_login` value where it recurs in Okta.
            * **Interpretation:** Okta reports this value on the Okta App OAuth Settings object returned for Applications; it is interpreted at one Okta App OAuth Settings record per row; the schema uses the `Generic.JSON` scalar.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-settings-oauthclient-initiate--321a5499fc71" title="Initiate Login URI" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `applications.settings.oauthClient.initiate_login_uri`

            Initiate Login URI records initiate login URI. It is needed to inspect the exact link included with this record.

            * **Enables:** open or correlate the exact Okta resource referenced by `initiate_login_uri` while retaining the containing Applications record as provenance.
            * **Interpretation:** Okta reports this value on the Okta App OAuth Settings object returned for Applications; it is link at one Okta App OAuth Settings record per row; the schema uses the `Network.Url` scalar; the returned link or template does not establish that the current credential can retrieve its target.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-settings-oauthclient-issuer-mo-8724dd78d9cc" title="Issuer Mode" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `applications.settings.oauthClient.issuer_mode`

            Issuer Mode records issuer mode (`ORG_URL`, `CUSTOM_URL`, DYNAMIC). It is needed to distinguish Applications rows by the exact Okta-returned issuer mode value.

            * **Enables:** separate Applications rows by the exact Okta-returned `issuer_mode` label when comparing issuer mode.
            * **Interpretation:** Okta reports this value on the Okta App OAuth Settings object returned for Applications; it is interpreted at one Okta App OAuth Settings record per row; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-settings-oauthclient-logo-uri-f702c7674a83" title="Logo URI" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `applications.settings.oauthClient.logo_uri`

            Logo URI records logo URI. It is needed to inspect the exact link included with this record.

            * **Enables:** open or correlate the exact Okta resource referenced by `logo_uri` while retaining the containing Applications record as provenance.
            * **Interpretation:** Okta reports this value on the Okta App OAuth Settings object returned for Applications; it is link at one Okta App OAuth Settings record per row; the schema uses the `Network.Url` scalar; the returned link or template does not establish that the current credential can retrieve its target.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-settings-oauthclient-post-logo-71f2cc9ccca9" title="Post Logout Redirect URIs" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `applications.settings.oauthClient.post_logout_redirect_uris`

            Post Logout Redirect URIs records list of post-logout redirect URIs. It is needed to inspect the exact link included with this record.

            * **Enables:** open or correlate the exact Okta resource referenced by `post_logout_redirect_uris` while retaining the containing Applications record as provenance.
            * **Interpretation:** Okta reports this value on the Okta App OAuth Settings object returned for Applications; it is link at one Okta App OAuth Settings record per row; the returned link or template does not establish that the current credential can retrieve its target.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-settings-oauthclient-redirect--a9ac3350f358" title="Redirect URIs" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `applications.settings.oauthClient.redirect_uris`

            Redirect URIs records list of allowed redirect URIs. It is needed to inspect the exact link included with this record.

            * **Enables:** open or correlate the exact Okta resource referenced by `redirect_uris` while retaining the containing Applications record as provenance.
            * **Interpretation:** Okta reports this value on the Okta App OAuth Settings object returned for Applications; it is link at one Okta App OAuth Settings record per row; the returned link or template does not establish that the current credential can retrieve its target.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-settings-oauthclient-response--2825bdaba0e8" title="Response Types" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `applications.settings.oauthClient.response_types`

            Response Types records allowed OAuth response types. It is needed to preserve the nested response types relationship or details on the parent Okta App OAuth Settings record.

            * **Enables:** expand `response_types` to connect the containing Okta App OAuth Settings row to its returned response types entries.
            * **Interpretation:** Okta reports this value on the Okta App OAuth Settings object returned for Applications; it is one returned collection per containing Okta App OAuth Settings object.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-settings-oauthclient-wildcard--c07a9f80f153" title="Wildcard Redirect" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `applications.settings.oauthClient.wildcard_redirect`

            Wildcard Redirect records wildcard redirect setting (DISABLED, SUBDOMAIN). It is needed to compare the exact wildcard redirect configuration returned for this Okta App OAuth Settings record.

            * **Enables:** compare the exact `wildcard_redirect` configuration returned for each Okta App OAuth Settings record and select records with the configuration under review.
            * **Interpretation:** Okta reports this value on the Okta App OAuth Settings object returned for Applications; it is interpreted at one Okta App OAuth Settings record per row.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-settings-signon-5d2dd3793cd9" title="Sign On" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `applications.settings.signOn`

            Sign On records sign-on settings (varies by signOnMode, e.g., SAML assertion details). It is needed to compare the exact sign on configuration returned for this Okta App Settings record.

            * **Enables:** compare the exact `signOn` configuration returned for each Okta App Settings record and select records with the configuration under review.
            * **Interpretation:** Okta reports this value on the Okta App Settings object returned for Applications; it is interpreted at one Okta App Settings record per row; the schema uses the `Generic.JSON` scalar.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-signonmode-1e5842ee62a8" title="Sign On Mode" icon="chart-column" iconType="sharp-duotone-solid">
            Developer identifier: `applications.signOnMode`

            Sign On Mode records sign-on mode for the application. It is needed to distinguish Applications rows by the exact Okta-returned sign on mode value.

            * **Enables:** separate Applications rows by the exact Okta-returned `signOnMode` label when comparing sign on mode.
            * **Interpretation:** Okta reports this value on the Okta App object returned for Applications; it is interpreted at one Okta App record per row; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-status-a962425e8283" title="Status" icon="calendar-clock" iconType="sharp-duotone-solid">
            Developer identifier: `applications.status`

            Status records application status (ACTIVE, INACTIVE, DELETED). It is needed to distinguish Applications rows by the exact Okta-returned status value.

            * **Enables:** separate Applications rows by the exact Okta-returned `status` label when comparing status.
            * **Interpretation:** Okta reports this value on the Okta App object returned for Applications; it is interpreted at one Okta App record per row; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-universallogout-a8380a98be8e" title="Universal Logout" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `applications.universalLogout`

            Universal Logout records universal Logout (CAEP / OIDC RP-Initiated Logout) status block for the application. It is needed to preserve the nested universal logout relationship or details on the parent Okta App record.

            * **Enables:** expand `universalLogout` to connect the containing Okta App row to its returned universal logout entries.
            * **Interpretation:** Okta reports this value on the Okta App object returned for Applications; it is one nested object per containing Okta App object when present.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-universallogout-status-a441872054b7" title="Status" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `applications.universalLogout.status`

            Status records universal Logout enablement status for the application (e.g., 'ENABLED', 'DISABLED', '`NOT_AVAILABLE`'). It is needed to distinguish Applications rows by the exact Okta-returned status value.

            * **Enables:** separate Applications rows by the exact Okta-returned `status` label when comparing status.
            * **Interpretation:** Okta reports this value on the Okta App Universal Logout object returned for Applications; it is interpreted at one Okta App Universal Logout record per row; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-visibility-45959a47bfd8" title="Visibility" icon="brackets-curly" iconType="sharp-duotone-solid">
            Developer identifier: `applications.visibility`

            Visibility records visibility settings for the application. It is needed to preserve the nested visibility relationship or details on the parent Okta App record.

            * **Enables:** expand `visibility` to connect the containing Okta App row to its returned visibility entries.
            * **Interpretation:** Okta reports this value on the Okta App object returned for Applications; it is one nested object per containing Okta App object when present.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-visibility-applinks-cc79d03614bd" title="App Links" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `applications.visibility.appLinks`

            App Links records map of app link visibility settings (link name to boolean). It is needed to inspect the exact link included with this record.

            * **Enables:** open or correlate the exact Okta resource referenced by `appLinks` while retaining the containing Applications record as provenance.
            * **Interpretation:** Okta reports this value on the Okta App Visibility object returned for Applications; it is link at one Okta App Visibility record per row; the schema uses the `Generic.JSON` scalar; the returned link or template does not establish that the current credential can retrieve its target.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-visibility-autolaunch-b4ac16065949" title="Auto Launch" icon="code-merge" iconType="sharp-duotone-solid">
            Developer identifier: `applications.visibility.autoLaunch`

            Auto Launch records whether the app is auto-launched. It is needed to distinguish Applications rows by the exact Okta-returned auto launch value.

            * **Enables:** select Applications rows where `autoLaunch` is true or false when comparing the condition described by Auto Launch.
            * **Interpretation:** Okta reports this value on the Okta App Visibility object returned for Applications; it is interpreted at one Okta App Visibility record per row; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-visibility-autosubmittoolbar-16e38d5e8536" title="Auto Submit Toolbar" icon="code-branch" iconType="sharp-duotone-solid">
            Developer identifier: `applications.visibility.autoSubmitToolbar`

            Auto Submit Toolbar records whether the sign-in form is auto-submitted. It is needed to distinguish Applications rows by the exact Okta-returned auto submit toolbar value.

            * **Enables:** select Applications rows where `autoSubmitToolbar` is true or false when comparing the condition described by Auto Submit Toolbar.
            * **Interpretation:** Okta reports this value on the Okta App Visibility object returned for Applications; it is interpreted at one Okta App Visibility record per row; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-visibility-hide-213dc4742130" title="Hide" icon="terminal" iconType="sharp-duotone-solid">
            Developer identifier: `applications.visibility.hide`

            Hide records hide settings for the application. It is needed to preserve the nested hide relationship or details on the parent Okta App Visibility record.

            * **Enables:** expand `hide` to connect the containing Okta App Visibility row to its returned hide entries.
            * **Interpretation:** Okta reports this value on the Okta App Visibility object returned for Applications; it is one nested object per containing Okta App Visibility object when present.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-visibility-hide-ios-564b5d4e1760" title="I OS" icon="code-commit" iconType="sharp-duotone-solid">
            Developer identifier: `applications.visibility.hide.iOS`

            I OS records whether the app is hidden on iOS devices. It is needed to distinguish Applications rows by the exact Okta-returned i os value.

            * **Enables:** select Applications rows where `iOS` is true or false when comparing the condition described by I OS.
            * **Interpretation:** Okta reports this value on the Okta App Visibility Hide object returned for Applications; it is interpreted at one Okta App Visibility Hide record per row; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-applications-visibility-hide-web-ee12b9860870" title="Web" icon="code-commit" iconType="sharp-duotone-solid">
            Developer identifier: `applications.visibility.hide.web`

            Web records whether the app is hidden in the Okta web dashboard. It is needed to distinguish Applications rows by the exact Okta-returned web value.

            * **Enables:** select Applications rows where `web` is true or false when comparing the condition described by Web.
            * **Interpretation:** Okta reports this value on the Okta App Visibility Hide object returned for Applications; it is interpreted at one Okta App Visibility Hide record per row; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>
        </AccordionGroup>
      </Accordion>

      <Accordion id="provider-permission-tap-okta-audit-logs-4ac70c3f4da8" title="Audit Logs" icon="shield-check" iconType="sharp-duotone-solid">
        Developer identifier: `audit_logs`

        Audit Logs covers Okta System Log events.

        * **Enables:** reconstruct an Audit Logs timeline and correlate each returned actor, target, action, and timestamp during an investigation.
        * **Scope:** Okta System Log events; the connector reads `/api/v1/logs` as an event stream in incremental mode. Object and event visibility follows the API token's Okta administrative permissions; inaccessible objects or events are not returned. This stream has no deletion signal, so a missing row does not establish that the Okta record was deleted.

        <AccordionGroup>
          <Accordion id="provider-permission-field-okta-audit-logs-actor-317a71c71928" title="Actor" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.actor`

            Actor records the entity (user, app, client) that performed the action. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `actor` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log object returned for Audit Logs; it is one nested object per containing Okta Log object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-actor-alternateid-9b4bb5894be2" title="Alternate ID" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.actor.alternateId`

            Alternate ID records alternate identifier for the actor, usually email or login. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `alternateId` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log Actor object returned for Audit Logs; it is an identifier, not a measured quantity; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-actor-detailentry-f81af79f3e96" title="Detail Entry" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.actor.detailEntry`

            Detail Entry records additional details about the actor as key-value pairs. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `detailEntry` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log Actor object returned for Audit Logs; it is interpreted at one Okta Log Actor record per row; the schema uses the `Generic.JSON` scalar; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; keys and availability follow this Okta response and may vary by object type or Okta configuration.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-actor-displayname-e780abfa4b99" title="Display Name" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.actor.displayName`

            Display Name records human-readable display name of the actor. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `displayName` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log Actor object returned for Audit Logs; it is interpreted at one Okta Log Actor record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-actor-id-1979f3737273" title="ID" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.actor.id`

            ID records unique identifier of the actor. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `id` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log Actor object returned for Audit Logs; it is an identifier, not a measured quantity; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-actor-type-56216ad0cb15" title="Type" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.actor.type`

            Type records type of actor (e.g., User, SystemPrincipal, PublicClientApp). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** select Audit Logs investigation evidence with the exact `type` result, permission, or Okta classification being examined.
            * **Interpretation:** Okta reports this value on the Okta Log Actor object returned for Audit Logs; it is interpreted at one Okta Log Actor record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-authenticationcontext-103d35f7e033" title="Authentication Context" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.authenticationContext`

            Authentication Context records authentication context including step, protocol, and issuer. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `authenticationContext` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log object returned for Audit Logs; it is one nested object per containing Okta Log object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-authenticationcontext-authentica-3053e240cb81" title="Authentication Provider" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.authenticationContext.authenticationProvider`

            Authentication Provider records authentication provider type (e.g., `FACTOR_PROVIDER`, `OKTA_AUTHENTICATION_PROVIDER`, `ACTIVE_DIRECTORY`). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `authenticationProvider` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log Authentication Context object returned for Audit Logs; it is interpreted at one Okta Log Authentication Context record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-authenticationcontext-authentica-6a92ced1617c" title="Authentication Step" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.authenticationContext.authenticationStep`

            Authentication Step records step number in the authentication flow (0 for single-factor, higher for MFA steps). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `authenticationStep` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log Authentication Context object returned for Audit Logs; it is interpreted at one Okta Log Authentication Context record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-authenticationcontext-credential-9d30843c1019" title="Credential Provider" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.authenticationContext.credentialProvider`

            Credential Provider records credential provider (e.g., `OKTA_CREDENTIAL_PROVIDER`, RSA, DUO, GOOGLE). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `credentialProvider` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log Authentication Context object returned for Audit Logs; it is interpreted at one Okta Log Authentication Context record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-authenticationcontext-credential-bf7ae16ab3b8" title="Credential Type" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.authenticationContext.credentialType`

            Credential Type records type of credential used (e.g., OTP, PASSWORD, ASSERTION, SMS, IWA). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** select Audit Logs investigation evidence with the exact `credentialType` result, permission, or Okta classification being examined.
            * **Interpretation:** Okta reports this value on the Okta Log Authentication Context object returned for Audit Logs; it is interpreted at one Okta Log Authentication Context record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-authenticationcontext-externalse-0e9ce62998f4" title="External Session ID" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.authenticationContext.externalSessionId`

            External Session ID records external session identifier linking events in the same session. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `externalSessionId` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log Authentication Context object returned for Audit Logs; it is an identifier, not a measured quantity; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-authenticationcontext-interface-31111e1872ea" title="Interface" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.authenticationContext.interface`

            Interface records interface used for authentication. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `interface` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log Authentication Context object returned for Audit Logs; it is interpreted at one Okta Log Authentication Context record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-authenticationcontext-issuer-aa70512a44e4" title="Issuer" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.authenticationContext.issuer`

            Issuer records issuer of the authentication assertion, if applicable. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** select Audit Logs investigation evidence with the exact `issuer` result, permission, or Okta classification being examined.
            * **Interpretation:** Okta reports this value on the Okta Log Authentication Context object returned for Audit Logs; it is one nested object per containing Okta Log Authentication Context object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-authenticationcontext-issuer-id-ba90a7a11885" title="ID" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.authenticationContext.issuer.id`

            ID records unique identifier of the issuer. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `id` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log Issuer object returned for Audit Logs; it is an identifier, not a measured quantity; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-authenticationcontext-issuer-typ-cfb698e015e8" title="Type" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.authenticationContext.issuer.type`

            Type records type of issuer. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** select Audit Logs investigation evidence with the exact `type` result, permission, or Okta classification being examined.
            * **Interpretation:** Okta reports this value on the Okta Log Issuer object returned for Audit Logs; it is interpreted at one Okta Log Issuer record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-authenticationcontext-rootsessio-9be4e168617a" title="Root Session ID" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.authenticationContext.rootSessionId`

            Root Session ID records root session identifier linking events across a chain of impersonated or delegated sessions. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `rootSessionId` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log Authentication Context object returned for Audit Logs; it is an identifier, not a measured quantity; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-client-ec7c6616ce35" title="Client" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.client`

            Client records client information including IP, user agent, device, and zone. It is needed to preserve the Okta-reported configured or derived address and place context for the same record.

            * **Enables:** correlate `client` with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
            * **Interpretation:** Okta reports this value on the Okta Log object returned for Audit Logs; it is one nested object per containing Okta Log object when present; the value is configured or derived address and place context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-client-device-d43876b9e159" title="Device" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.client.device`

            Device records type of device used (e.g., Computer, Mobile). It is needed to preserve the Okta-reported client device or software context for the same record.

            * **Enables:** correlate `device` with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
            * **Interpretation:** Okta reports this value on the Okta Log Client object returned for Audit Logs; it is interpreted at one Okta Log Client record per row; the value is client device or software context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-client-geographicalcontext-fc4dbd06e44d" title="Geographical Context" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.client.geographicalContext`

            Geographical Context records geographical location derived from the client IP address. It is needed to preserve the Okta-reported network address context for the same record.

            * **Enables:** correlate `geographicalContext` with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
            * **Interpretation:** Okta reports this value on the Okta Log Client object returned for Audit Logs; it is one nested object per containing Okta Log Client object when present; the value is network address context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-client-geographicalcontext-city-b3c27528f9f5" title="City" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.client.geographicalContext.city`

            City records city name. It is needed to preserve the Okta-reported configured or derived address and place context for the same record.

            * **Enables:** correlate `city` with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
            * **Interpretation:** Okta reports this value on the Okta Log Geographical Context object returned for Audit Logs; it is interpreted at one Okta Log Geographical Context record per row; the value is configured or derived address and place context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-client-geographicalcontext-count-993bf07f14a7" title="Country" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.client.geographicalContext.country`

            Country records country name. It is needed to preserve the Okta-reported configured or derived address and place context for the same record.

            * **Enables:** correlate `country` with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
            * **Interpretation:** Okta reports this value on the Okta Log Geographical Context object returned for Audit Logs; it is interpreted at one Okta Log Geographical Context record per row; the value is configured or derived address and place context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-client-geographicalcontext-geolo-f141c4b66ea5" title="Geolocation" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.client.geographicalContext.geolocation`

            Geolocation records latitude and longitude coordinates. It is needed to preserve the Okta-reported geographic coordinate context for the same record.

            * **Enables:** correlate `geolocation` with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
            * **Interpretation:** Okta reports this value on the Okta Log Geographical Context object returned for Audit Logs; its unit or granularity is provider-reported geographic coordinates; the value is geographic coordinate context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-client-geographicalcontext-geolo-2500450e4a60" title="Lat" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.client.geographicalContext.geolocation.lat`

            Lat records latitude coordinate. It is needed to preserve the Okta-reported configured or derived address and place context for the same record.

            * **Enables:** correlate `lat` with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
            * **Interpretation:** Okta reports this value on the Okta Log Geolocation object returned for Audit Logs; its unit or granularity is provider-reported geographic coordinates; the value is configured or derived address and place context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-client-geographicalcontext-geolo-ebc27bf7ae37" title="Lon" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.client.geographicalContext.geolocation.lon`

            Lon records longitude coordinate. It is needed to preserve the Okta-reported configured or derived address and place context for the same record.

            * **Enables:** correlate `lon` with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
            * **Interpretation:** Okta reports this value on the Okta Log Geolocation object returned for Audit Logs; its unit or granularity is provider-reported geographic coordinates; the value is configured or derived address and place context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-client-geographicalcontext-posta-e4cd7b9b35f0" title="Postal Code" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.client.geographicalContext.postalCode`

            Postal Code records postal or ZIP code. It is needed to preserve the Okta-reported configured or derived address and place context for the same record.

            * **Enables:** correlate `postalCode` with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
            * **Interpretation:** Okta reports this value on the Okta Log Geographical Context object returned for Audit Logs; it is interpreted at one Okta Log Geographical Context record per row; the value is configured or derived address and place context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-client-geographicalcontext-state-c4aa02381725" title="State" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.client.geographicalContext.state`

            State records state or province name. It is needed to preserve the Okta-reported configured or derived address and place context for the same record.

            * **Enables:** correlate `state` with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
            * **Interpretation:** Okta reports this value on the Okta Log Geographical Context object returned for Audit Logs; it is interpreted at one Okta Log Geographical Context record per row; the value is configured or derived address and place context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-client-id-f990a37e14bc" title="ID" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.client.id`

            ID records unique identifier of the client, if available. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `id` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log Client object returned for Audit Logs; it is an identifier, not a measured quantity; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-client-ipaddress-78c3b9c48a21" title="IP Address" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.client.ipAddress`

            IP Address records IP address of the client that triggered the event. It is needed to preserve the Okta-reported network address context for the same record.

            * **Enables:** correlate `ipAddress` with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
            * **Interpretation:** Okta reports this value on the Okta Log Client object returned for Audit Logs; it is interpreted at one Okta Log Client record per row; the schema uses the `Network.IpAddress` scalar; the value is network address context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-client-useragent-37cd425071a4" title="User Agent" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.client.userAgent`

            User Agent records user agent information from the client request. It is needed to preserve the Okta-reported client device or software context for the same record.

            * **Enables:** correlate `userAgent` with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
            * **Interpretation:** Okta reports this value on the Okta Log Client object returned for Audit Logs; it is one nested object per containing Okta Log Client object when present; the value is client device or software context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-client-useragent-browser-3134aecf9f5a" title="Browser" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.client.userAgent.browser`

            Browser records browser parsed from the user agent. It is needed to preserve the Okta-reported client device or software context for the same record.

            * **Enables:** correlate `browser` with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
            * **Interpretation:** Okta reports this value on the Okta Log User Agent object returned for Audit Logs; it is interpreted at one Okta Log User Agent record per row; the value is client device or software context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-client-useragent-os-d91888d41d77" title="OS" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.client.userAgent.os`

            OS records operating system parsed from the user agent. It is needed to preserve the Okta-reported client device or software context for the same record.

            * **Enables:** correlate `os` with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
            * **Interpretation:** Okta reports this value on the Okta Log User Agent object returned for Audit Logs; it is interpreted at one Okta Log User Agent record per row; the value is client device or software context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-client-useragent-rawuseragent-f4317f914352" title="Raw User Agent" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.client.userAgent.rawUserAgent`

            Raw User Agent records raw user agent string from the HTTP request. It is needed to preserve the Okta-reported client device or software context for the same record.

            * **Enables:** correlate `rawUserAgent` with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
            * **Interpretation:** Okta reports this value on the Okta Log User Agent object returned for Audit Logs; it is interpreted at one Okta Log User Agent record per row; the value is client device or software context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-client-zone-a576aadf1d37" title="Zone" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.client.zone`

            Zone records the network zone the client request originated from. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `zone` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log Client object returned for Audit Logs; it is interpreted at one Okta Log Client record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-debugcontext-e693dd5972a6" title="Debug Context" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.debugContext`

            Debug Context records additional debug information for troubleshooting. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `debugContext` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log object returned for Audit Logs; it is one nested object per containing Okta Log object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-debugcontext-debugdata-ed7a061a648b" title="Debug Data" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.debugContext.debugData`

            Debug Data records key-value pairs with debug data such as requestUri, requestId, url, suspiciousActivity, etc. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `debugData` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log Debug Context object returned for Audit Logs; it is one nested object per containing Okta Log Debug Context object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; keys and availability follow this Okta response and may vary by object type or Okta configuration.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-debugcontext-debugdata-dthash-cc4751b71a8d" title="Dt Hash" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.debugContext.debugData.dtHash`

            Dt Hash records hash representing the device token of the actor's device. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `dtHash` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log Debug Data object returned for Audit Logs; it is interpreted at one Okta Log Debug Data record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-debugcontext-debugdata-requestid-3f45f0cc09f5" title="Request ID" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.debugContext.debugData.requestId`

            Request ID records unique identifier for the request that produced this log event. Useful for correlating with other Okta logs and external systems. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `requestId` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log Debug Data object returned for Audit Logs; it is an identifier, not a measured quantity; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-debugcontext-debugdata-requestur-c872f172aff0" title="Request URI" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.debugContext.debugData.requestUri`

            Request URI records URI path of the request that produced the event. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `requestUri` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log Debug Data object returned for Audit Logs; it is link at one Okta Log Debug Data record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; the returned link or template does not establish that the current credential can retrieve its target.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-debugcontext-debugdata-suspiciou-41f8e9b19522" title="Suspicious Activity" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.debugContext.debugData.suspiciousActivity`

            Suspicious Activity records suspicious-activity classification, when set. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `suspiciousActivity` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log Debug Data object returned for Audit Logs; it is interpreted at one Okta Log Debug Data record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-debugcontext-debugdata-url-c21096c533c7" title="URL" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.debugContext.debugData.url`

            URL records full URL of the request, when applicable. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `url` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log Debug Data object returned for Audit Logs; it is link at one Okta Log Debug Data record per row; the schema uses the `Network.Url` scalar; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; the returned link or template does not establish that the current credential can retrieve its target.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-device-0d0dde4d1d08" title="Device" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.device`

            Device records top-level device context returned by Okta System Log events. It is needed to preserve the Okta-reported client device or software context for the same record.

            * **Enables:** correlate `device` with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
            * **Interpretation:** Okta reports this value on the Okta Log object returned for Audit Logs; it is interpreted at one Okta Log record per row; the schema uses the `Generic.JSON` scalar; the value is client device or software context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-displaymessage-3a17d0f3fb04" title="Display Message" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.displayMessage`

            Display Message records human-readable description of the event. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `displayMessage` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log object returned for Audit Logs; it is message text at one Okta Log record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; this is only the content included in the Okta response for this record.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-eventtype-9e5902127b03" title="Event Type" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.eventType`

            Event Type records type of event (e.g., user.session.start, app.`user_membership`.add). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** select Audit Logs investigation evidence with the exact `eventType` result, permission, or Okta classification being examined.
            * **Interpretation:** Okta reports this value on the Okta Log object returned for Audit Logs; it is interpreted at one Okta Log record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-gatewaycontext-de59fa34bcbd" title="Gateway Context" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.gatewayContext`

            Gateway Context records network gateway context returned by Okta System Log events. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `gatewayContext` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log object returned for Audit Logs; it is interpreted at one Okta Log record per row; the schema uses the `Generic.JSON` scalar; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-legacyeventtype-984ec3a30332" title="Legacy Event Type" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.legacyEventType`

            Legacy Event Type records legacy event type identifier for backward compatibility. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** select Audit Logs investigation evidence with the exact `legacyEventType` result, permission, or Okta classification being examined.
            * **Interpretation:** Okta reports this value on the Okta Log object returned for Audit Logs; it is an identifier, not a measured quantity; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-outcome-12adae35587b" title="Outcome" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.outcome`

            Outcome records the outcome/result of the event. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** select Audit Logs investigation evidence with the exact `outcome` result, permission, or Okta classification being examined.
            * **Interpretation:** Okta reports this value on the Okta Log object returned for Audit Logs; it is one nested object per containing Okta Log object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-outcome-reason-153136cf28d8" title="Reason" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.outcome.reason`

            Reason records reason for the outcome, especially useful for failures. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** select Audit Logs investigation evidence with the exact `reason` result, permission, or Okta classification being examined.
            * **Interpretation:** Okta reports this value on the Okta Log Outcome object returned for Audit Logs; it is interpreted at one Okta Log Outcome record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-outcome-result-80f48a547d3a" title="Result" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.outcome.result`

            Result records result of the event. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** select Audit Logs investigation evidence with the exact `result` result, permission, or Okta classification being examined.
            * **Interpretation:** Okta reports this value on the Okta Log Outcome object returned for Audit Logs; it is interpreted at one Okta Log Outcome record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-published-2ce3ae4119d7" title="Published" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.published`

            Published records timestamp when the event was published (ISO 8601). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `published` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log object returned for Audit Logs; it is interpreted at one Okta Log record per row; the connector also declares it for record ordering; the schema assigns the `event_time` semantic role; the schema uses the `Temporal.DateTime` scalar; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-request-68d6d41d901b" title="Request" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.request`

            Request records details about the HTTP request that triggered the event. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `request` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log object returned for Audit Logs; it is one nested object per containing Okta Log object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-request-ipchain-c7e7c2a41314" title="IP Chain" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.request.ipChain`

            IP Chain records chain of IP addresses from the request, including proxies. It is needed to preserve the Okta-reported network address context for the same record.

            * **Enables:** correlate `ipChain` with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
            * **Interpretation:** Okta reports this value on the Okta Log Request object returned for Audit Logs; it is one returned collection per containing Okta Log Request object; the value is network address context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-request-ipchain-geographicalcont-899e61281426" title="Geographical Context" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.request.ipChain.geographicalContext`

            Geographical Context records geographical context for this IP address. It is needed to preserve the Okta-reported network address context for the same record.

            * **Enables:** correlate `geographicalContext` with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
            * **Interpretation:** Okta reports this value on the Okta Log Ip Chain Entry object returned for Audit Logs; it is one nested object per containing Okta Log Ip Chain Entry object when present; the value is network address context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-request-ipchain-ip-ee8cb283ff5c" title="IP" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.request.ipChain.ip`

            IP records IP address at this hop. It is needed to preserve the Okta-reported network address context for the same record.

            * **Enables:** correlate `ip` with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
            * **Interpretation:** Okta reports this value on the Okta Log Ip Chain Entry object returned for Audit Logs; it is interpreted at one Okta Log Ip Chain Entry record per row; the connector declares it as an ingestion deduplication key; the schema uses the `Network.IpAddress` scalar; the value is network address context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-request-ipchain-source-9e9507d9eba2" title="Source" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.request.ipChain.source`

            Source records source of the IP information. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** select Audit Logs investigation evidence with the exact `source` result, permission, or Okta classification being examined.
            * **Interpretation:** Okta reports this value on the Okta Log Ip Chain Entry object returned for Audit Logs; it is interpreted at one Okta Log Ip Chain Entry record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-request-ipchain-version-d217a90ed9da" title="Version" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.request.ipChain.version`

            Version records IP version (V4 or V6). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `version` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log Ip Chain Entry object returned for Audit Logs; it is interpreted at one Okta Log Ip Chain Entry record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-securitycontext-6188cc63dee0" title="Security Context" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.securityContext`

            Security Context records security threat context including proxy and ISP information. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `securityContext` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log object returned for Audit Logs; it is one nested object per containing Okta Log object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-securitycontext-asnumber-24e0379c7e89" title="As Number" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.securityContext.asNumber`

            As Number records autonomous System Number of the client IP. It is needed to preserve the Okta-reported configured or derived address and place context for the same record.

            * **Enables:** correlate `asNumber` with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
            * **Interpretation:** Okta reports this value on the Okta Log Security Context object returned for Audit Logs; it is a Okta-reported count at one Okta Log Security Context record per row; the value is configured or derived address and place context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-securitycontext-asorg-a3e063b9e6af" title="As Org" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.securityContext.asOrg`

            As Org records autonomous System Organization name. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `asOrg` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log Security Context object returned for Audit Logs; it is interpreted at one Okta Log Security Context record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-securitycontext-domain-1d7f74a78ce2" title="Domain" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.securityContext.domain`

            Domain records domain associated with the client IP. It is needed to preserve the Okta-reported configured or derived address and place context for the same record.

            * **Enables:** correlate `domain` with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
            * **Interpretation:** Okta reports this value on the Okta Log Security Context object returned for Audit Logs; it is interpreted at one Okta Log Security Context record per row; the value is configured or derived address and place context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-securitycontext-isp-adb19814ea19" title="Isp" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.securityContext.isp`

            Isp records internet Service Provider name. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** select Audit Logs investigation evidence with the exact `isp` result, permission, or Okta classification being examined.
            * **Interpretation:** Okta reports this value on the Okta Log Security Context object returned for Audit Logs; it is interpreted at one Okta Log Security Context record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-securitycontext-isproxy-be12b27ce809" title="Is Proxy" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.securityContext.isProxy`

            Is Proxy records whether the client IP is a known proxy. It is needed to preserve the Okta-reported configured or derived address and place context for the same record.

            * **Enables:** correlate `isProxy` with the actor, request, or session on the same Okta event without treating it as proof of physical presence.
            * **Interpretation:** Okta reports this value on the Okta Log Security Context object returned for Audit Logs; it is interpreted at one Okta Log Security Context record per row; the value is configured or derived address and place context; Okta attaches this context to a System Log event or request chain; it does not establish residency or verified physical location; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-securitycontext-risk-65a10f57710a" title="Risk" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.securityContext.risk`

            Risk records risk assessment for the event. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** select Audit Logs investigation evidence with the exact `risk` result, permission, or Okta classification being examined.
            * **Interpretation:** Okta reports this value on the Okta Log Security Context object returned for Audit Logs; it is one nested object per containing Okta Log Security Context object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-securitycontext-risk-level-a899288cc20a" title="Level" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.securityContext.risk.level`

            Level records risk level (e.g. LOW, MEDIUM, HIGH). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `level` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log Security Context object returned for Audit Logs; it is interpreted at one Okta Log Security Context record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-securitycontext-risk-reasons-7eca2b3777d2" title="Reasons" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.securityContext.risk.reasons`

            Reasons records reasons contributing to the risk level. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `reasons` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log Security Context object returned for Audit Logs; it is interpreted at one Okta Log Security Context record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-severity-3cd00627fa76" title="Severity" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.severity`

            Severity records severity level of the event (DEBUG, INFO, WARN, ERROR). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** select Audit Logs investigation evidence with the exact `severity` result, permission, or Okta classification being examined.
            * **Interpretation:** Okta reports this value on the Okta Log object returned for Audit Logs; it is interpreted at one Okta Log record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-target-1f78509c75a3" title="Target" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.target`

            Target records array of target objects affected by the event. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `target` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log object returned for Audit Logs; it is one returned collection per containing Okta Log object; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-target-alternateid-bb765b666850" title="Alternate ID" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.target.alternateId`

            Alternate ID records alternate identifier for the target, usually email or name. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `alternateId` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log Target object returned for Audit Logs; it is an identifier, not a measured quantity; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-target-changedetails-58220f7155ca" title="Change Details" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.target.changeDetails`

            Change Details records before/after values describing configuration changes made to the target. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `changeDetails` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log Target object returned for Audit Logs; it is interpreted at one Okta Log Target record per row; the schema uses the `Generic.JSON` scalar; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-target-detailentry-287d96da939a" title="Detail Entry" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.target.detailEntry`

            Detail Entry records additional details about the target as key-value pairs. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `detailEntry` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log Target object returned for Audit Logs; it is interpreted at one Okta Log Target record per row; the schema uses the `Generic.JSON` scalar; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; keys and availability follow this Okta response and may vary by object type or Okta configuration.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-target-displayname-a92f665cfa4c" title="Display Name" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.target.displayName`

            Display Name records human-readable display name of the target. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `displayName` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log Target object returned for Audit Logs; it is interpreted at one Okta Log Target record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-target-id-5274ad4f0858" title="ID" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.target.id`

            ID records unique identifier of the target. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `id` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log Target object returned for Audit Logs; it is an identifier, not a measured quantity; the connector declares it as an ingestion deduplication key; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-target-type-5d08f0e8a86e" title="Type" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.target.type`

            Type records type of the target (e.g., User, AppInstance, AppUser, Group). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** select Audit Logs investigation evidence with the exact `type` result, permission, or Okta classification being examined.
            * **Interpretation:** Okta reports this value on the Okta Log Target object returned for Audit Logs; it is interpreted at one Okta Log Target record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-transaction-cc79db9bd73b" title="Transaction" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.transaction`

            Transaction records transaction details linking related events. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `transaction` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log object returned for Audit Logs; it is one nested object per containing Okta Log object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-transaction-detail-588e796f39cf" title="Detail" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.transaction.detail`

            Detail records additional transaction details as key-value pairs. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `detail` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log Transaction object returned for Audit Logs; it is interpreted at one Okta Log Transaction record per row; the schema uses the `Generic.JSON` scalar; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-transaction-id-83dcee536b0a" title="ID" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.transaction.id`

            ID records unique transaction identifier. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `id` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log Transaction object returned for Audit Logs; it is an identifier, not a measured quantity; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-transaction-type-5434f80e686a" title="Type" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.transaction.type`

            Type records type of transaction (e.g., WEB, JOB). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** select Audit Logs investigation evidence with the exact `type` result, permission, or Okta classification being examined.
            * **Interpretation:** Okta reports this value on the Okta Log Transaction object returned for Audit Logs; it is interpreted at one Okta Log Transaction record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-uuid-0b2b4145e6b2" title="UUID" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.uuid`

            UUID records unique identifier for the log event. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `uuid` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log object returned for Audit Logs; it is an identifier, not a measured quantity; the connector declares it as an ingestion deduplication key; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-audit-logs-version-a2e417ed6e1b" title="Version" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `audit_logs.version`

            Version records versioning indicator for the log event schema. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate `version` with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
            * **Interpretation:** Okta reports this value on the Okta Log object returned for Audit Logs; it is interpreted at one Okta Log record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>
        </AccordionGroup>
      </Accordion>

      <Accordion id="provider-permission-tap-okta-users-3589a2c546b6" title="Users" icon="people-group" iconType="sharp-duotone-solid">
        Developer identifier: `users`

        Users covers Okta org users.

        * **Enables:** map the Okta accounts and memberships represented by Users records and trace a returned access assignment to its account or group.
        * **Scope:** Okta org users; the connector reads `/api/v1/users` as a snapshot stream in incremental mode. Object and event visibility follows the API token's Okta administrative permissions; inaccessible objects or events are not returned. This stream has no deletion signal, so a missing row does not establish that the Okta record was deleted.

        Provider-defined fields may also be returned for this data stream.

        <AccordionGroup>
          <Accordion id="provider-permission-field-okta-users-embedded-3c7d4f63917b" title="Embedded" icon="circle-check" iconType="sharp-duotone-solid">
            Developer identifier: `users._embedded`

            Embedded records HAL-style embedded resources, if requested via expand parameter. It is needed to preserve the exact Okta configuration or execution metadata attached to this Okta User record.

            * **Enables:** inspect the keys in `_embedded` when reproducing or investigating this record's configuration, parameters, or execution context.
            * **Interpretation:** Okta reports this value on the Okta User object returned for Users; it is interpreted at one Okta User record per row; the schema uses the `Generic.JSON` scalar; metadata keys and availability follow the Okta response and can vary by resource type or configuration.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-links-8e3ffedf0c12" title="Links" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `users._links`

            Links records HAL-style hypermedia links for user actions and related resources. It is needed to inspect the exact link included with this record.

            * **Enables:** open or correlate the exact Okta resource referenced by `_links` while retaining the containing Users record as provenance.
            * **Interpretation:** Okta reports this value on the Okta User object returned for Users; it is link at one Okta User record per row; the schema uses the `Generic.JSON` scalar; the returned link or template does not establish that the current credential can retrieve its target.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-activated-c5b6843ccd92" title="Activated" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `users.activated`

            Activated records timestamp when the user transitioned to ACTIVE status. It is needed to place the record at the time or date reported for this event or state.

            * **Enables:** bound Users records by `activated`, order their returned events or state changes, and correlate records reported at the same time.
            * **Interpretation:** Okta reports this value on the Okta User object returned for Users; it is interpreted at one Okta User record per row; the schema uses the `Temporal.DateTime` scalar.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-created-5951aef2871c" title="Created" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `users.created`

            Created records timestamp when the user was created in Okta. It is needed to place the record at the time or date reported for this event or state.

            * **Enables:** bound Users records by `created`, order their returned events or state changes, and correlate records reported at the same time.
            * **Interpretation:** Okta reports this value on the Okta User object returned for Users; it is interpreted at one Okta User record per row; the schema uses the `Temporal.DateTime` scalar.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-credentials-35ecbd2981d1" title="Credentials" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `users.credentials`

            Credentials records the user's credential information including provider and recovery question. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** expand `credentials` to examine the returned credentials details for the containing Okta User record.
            * **Interpretation:** Okta reports this value on the Okta User object returned for Users; it is one nested object per containing Okta User object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-credentials-emails-548c395d0c98" title="Emails" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `users.credentials.emails`

            Emails records array of email credential objects with verification status. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** expand `emails` to examine the returned emails details for the containing User Credentials record.
            * **Interpretation:** Okta reports this value on the User Credentials object returned for Users; it is one returned collection per containing User Credentials object; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-credentials-emails-status-ccf53486b533" title="Status" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `users.credentials.emails.status`

            Status records verification status of the email (e.g., VERIFIED). It is needed to distinguish Users rows by the exact Okta-returned status value.

            * **Enables:** separate Users rows by the exact Okta-returned `status` label when comparing status.
            * **Interpretation:** Okta reports this value on the Credential Email object returned for Users; it is interpreted at one Credential Email record per row; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-credentials-emails-type-8f3abdffe61e" title="Type" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `users.credentials.emails.type`

            Type records type of email (e.g., PRIMARY). It is needed to distinguish Users rows by the exact Okta-returned type value.

            * **Enables:** separate Users rows by the exact Okta-returned `type` label when comparing type.
            * **Interpretation:** Okta reports this value on the Credential Email object returned for Users; it is interpreted at one Credential Email record per row; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-credentials-emails-value-c12bc01b9f74" title="Value" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `users.credentials.emails.value`

            Value records the email address. It is needed to distinguish repeated deliveries of the same Users row using the declared ingestion key.

            * **Enables:** use `value` as the declared ingestion deduplication key for Users and match repeated rows carrying the same Okta identifier.
            * **Interpretation:** Okta reports this value on the Credential Email object returned for Users; it is interpreted at one Credential Email record per row; the connector declares it as an ingestion deduplication key; the schema uses the `Contact.Email` scalar.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-credentials-password-c3378f3ba758" title="Password" icon="shield-check" iconType="sharp-duotone-solid">
            Developer identifier: `users.credentials.password`

            Password records password credential metadata (hash details if present, never the actual password). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate the exact `password` access value with the resource, account, or membership represented by the same Users row.
            * **Interpretation:** Okta reports this value on the User Credentials object returned for Users; it is interpreted at one User Credentials record per row; the schema uses the `Generic.JSON` scalar; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; the field describes credential metadata and never the actual password.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-credentials-provider-8cf444886a4f" title="Provider" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `users.credentials.provider`

            Provider records the credential provider that authenticated the user. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** expand `provider` to examine the returned provider details for the containing User Credentials record.
            * **Interpretation:** Okta reports this value on the User Credentials object returned for Users; it is one nested object per containing User Credentials object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-credentials-provider-name-13251912d6d7" title="Name" icon="user-shield" iconType="sharp-duotone-solid">
            Developer identifier: `users.credentials.provider.name`

            Name records name of the credential provider (e.g., OKTA, `ACTIVE_DIRECTORY`, LDAP, FEDERATION, SOCIAL, IMPORT). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate the exact `name` access value with the resource, account, or membership represented by the same Users row.
            * **Interpretation:** Okta reports this value on the Credential Provider object returned for Users; it is interpreted at one Credential Provider record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-credentials-provider-type-8bbd2b0b9935" title="Type" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `users.credentials.provider.type`

            Type records type of credential provider. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** select Users rows with the exact `type` access-related value being investigated.
            * **Interpretation:** Okta reports this value on the Credential Provider object returned for Users; it is interpreted at one Credential Provider record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-credentials-recovery-question-60db937610bb" title="Recovery Question" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `users.credentials.recovery_question`

            Recovery Question records recovery question for self-service password reset. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** expand `recovery_question` to examine the returned recovery question details for the containing User Credentials record.
            * **Interpretation:** Okta reports this value on the User Credentials object returned for Users; it is one nested object per containing User Credentials object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-credentials-recovery-question-questio-6fda1232141b" title="Question" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `users.credentials.recovery_question.question`

            Question records the recovery question text. It is needed to inspect the exact recovery-question text returned for this Recovery Question record.

            * **Enables:** attribute the recovery-question text in `question` to the containing Users identifier, owner or author, status, and update time where returned.
            * **Interpretation:** Okta reports this value on the Recovery Question object returned for Users; it is interpreted at one Recovery Question record per row; this is only the recovery-question text included in the Okta response for this record.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-id-637b6064dac0" title="ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `users.id`

            ID records unique identifier for the user. It is needed to distinguish repeated deliveries of the same Users row using the declared ingestion key.

            * **Enables:** use `id` as the declared ingestion deduplication key for Users and match repeated rows carrying the same Okta identifier.
            * **Interpretation:** Okta reports this value on the Okta User object returned for Users; it is an identifier, not a measured quantity; the connector declares it as an ingestion deduplication key.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-lastlogin-3563a900fbb3" title="Last Login" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `users.lastLogin`

            Last Login records timestamp of the user's most recent login. It is needed to place the record at the time or date reported for this event or state.

            * **Enables:** bound Users records by `lastLogin`, order their returned events or state changes, and correlate records reported at the same time.
            * **Interpretation:** Okta reports this value on the Okta User object returned for Users; it is interpreted at one Okta User record per row; the schema uses the `Temporal.DateTime` scalar.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-lastupdated-27a59ef43f2c" title="Last Updated" icon="passport" iconType="sharp-duotone-solid">
            Developer identifier: `users.lastUpdated`

            Last Updated records timestamp when the user record was last modified. It is needed to place the record at the time or date reported for this event or state.

            * **Enables:** bound Users records by `lastUpdated`, order their returned events or state changes, and correlate records reported at the same time.
            * **Interpretation:** Okta reports this value on the Okta User object returned for Users; it is interpreted at one Okta User record per row; the connector also declares it for record ordering; the schema assigns the `metadata_timestamp` semantic role; the schema uses the `Temporal.DateTime` scalar.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-passwordchanged-7f21b5b65884" title="Password Changed" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `users.passwordChanged`

            Password Changed records timestamp when the user's password was last changed. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

            * **Enables:** correlate the exact `passwordChanged` access value with the resource, account, or membership represented by the same Users row.
            * **Interpretation:** Okta reports this value on the Okta User object returned for Users; it is interpreted at one Okta User record per row; the schema uses the `Temporal.DateTime` scalar; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-profile-d0ed260ccf38" title="Profile" icon="brackets-curly" iconType="sharp-duotone-solid">
            Developer identifier: `users.profile`

            Profile records the user's profile attributes. It is needed to preserve the nested profile relationship or details on the parent Okta User record.

            * **Enables:** expand `profile` to connect the containing Okta User row to its returned profile entries.
            * **Interpretation:** Okta reports this value on the Okta User object returned for Users; it is one nested object per containing Okta User object when present.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-profile-city-ae5aed235d64" title="City" icon="map-location-dot" iconType="sharp-duotone-solid">
            Developer identifier: `users.profile.city`

            City records city or locality of the user. It is needed to preserve the Okta-reported configured or derived address and place context for the same record.

            * **Enables:** compare the Okta-reported configured or derived address and place context in `city` for individual Users rows without treating it as a verified physical location.
            * **Interpretation:** Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; the value is configured or derived address and place context; this Okta-reported or configured context does not establish residency or verified physical presence.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-profile-costcenter-09110034a7a9" title="Cost Center" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `users.profile.costCenter`

            Cost Center records cost center associated with the user. It is needed to preserve the exact Okta-reported business, directory, or identity attribute represented by this field.

            * **Enables:** match or segment Users records by `costCenter` only within the same Okta attribute contract.
            * **Interpretation:** Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; the value is a Okta-returned or configured label and is not a universal identity or business taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-profile-countrycode-d2e21d6677c6" title="Country Code" icon="map-location-dot" iconType="sharp-duotone-solid">
            Developer identifier: `users.profile.countryCode`

            Country Code records ISO 3166-1 alpha-2 country code. It is needed to preserve the Okta-reported configured or derived address and place context for the same record.

            * **Enables:** compare the Okta-reported configured or derived address and place context in `countryCode` for individual Users rows without treating it as a verified physical location.
            * **Interpretation:** Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; the value is configured or derived address and place context; this Okta-reported or configured context does not establish residency or verified physical presence; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-profile-department-5c1451a42cfa" title="Department" icon="terminal" iconType="sharp-duotone-solid">
            Developer identifier: `users.profile.department`

            Department records user's department. It is needed to compare the returned department for individual Users rows and select rows with a specific `department` value.

            * **Enables:** trace the department relationship returned in `department` from the User Profile row to its named Okta context.
            * **Interpretation:** Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-profile-displayname-1154c73a1e26" title="Display Name" icon="chart-column" iconType="sharp-duotone-solid">
            Developer identifier: `users.profile.displayName`

            Display Name records user's display name. It is needed to attribute this Users row to the returned person, account, or organization reference.

            * **Enables:** attribute the Users row to the returned person or account and match the exact `displayName` value where it recurs in Okta.
            * **Interpretation:** Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; the schema uses the `Identity.Name` scalar.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-profile-division-ec4dc2c3084f" title="Division" icon="code-merge" iconType="sharp-duotone-solid">
            Developer identifier: `users.profile.division`

            Division records division within the organization. It is needed to compare the returned division for individual Users rows and select rows with a specific `division` value.

            * **Enables:** trace the division relationship returned in `division` from the User Profile row to its named Okta context.
            * **Interpretation:** Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-profile-email-a1b67383af7a" title="Email" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `users.profile.email`

            Email records user's primary email address. It is needed to attribute this Users row to the returned person, account, or organization reference.

            * **Enables:** attribute the Users row to the returned person or account and match the exact `email` value where it recurs in Okta.
            * **Interpretation:** Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; the schema uses the `Contact.Email` scalar.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-profile-employeenumber-3c87c800ab88" title="Employee Number" icon="percent" iconType="sharp-duotone-solid">
            Developer identifier: `users.profile.employeeNumber`

            Employee Number records employee number from HR system. It is needed to refer to the same employee number across records without relying on display text.

            * **Enables:** match `employeeNumber` to employee number references carrying the same Okta-issued value in related Okta records.
            * **Interpretation:** Okta reports this value on the User Profile object returned for Users; it is an identifier, not a measured quantity.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-profile-firstname-35b9e803aff1" title="First Name" icon="chart-line" iconType="sharp-duotone-solid">
            Developer identifier: `users.profile.firstName`

            First Name records user's first name. It is needed to attribute this Users row to the returned person, account, or organization reference.

            * **Enables:** attribute the Users row to the returned person or account and match the exact `firstName` value where it recurs in Okta.
            * **Interpretation:** Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; the schema uses the `Identity.Name` scalar.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-profile-honorificprefix-0ba6848a7227" title="Honorific Prefix" icon="code-commit" iconType="sharp-duotone-solid">
            Developer identifier: `users.profile.honorificPrefix`

            Honorific Prefix records honorific prefix (e.g., Mr., Dr.). It is needed to preserve the exact Okta-reported business, directory, or identity attribute represented by this field.

            * **Enables:** match or segment Users records by `honorificPrefix` only within the same Okta attribute contract.
            * **Interpretation:** Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; the value is a Okta-returned or configured label and is not a universal identity or business taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-profile-honorificsuffix-9b9ad649ee74" title="Honorific Suffix" icon="terminal" iconType="sharp-duotone-solid">
            Developer identifier: `users.profile.honorificSuffix`

            Honorific Suffix records honorific suffix (e.g., Jr., III). It is needed to preserve the exact Okta-reported business, directory, or identity attribute represented by this field.

            * **Enables:** match or segment Users records by `honorificSuffix` only within the same Okta attribute contract.
            * **Interpretation:** Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; the value is a Okta-returned or configured label and is not a universal identity or business taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-profile-lastname-a4da6b5cbb59" title="Last Name" icon="arrow-trend-down" iconType="sharp-duotone-solid">
            Developer identifier: `users.profile.lastName`

            Last Name records user's last name. It is needed to attribute this Users row to the returned person, account, or organization reference.

            * **Enables:** attribute the Users row to the returned person or account and match the exact `lastName` value where it recurs in Okta.
            * **Interpretation:** Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; the schema uses the `Identity.Name` scalar.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-profile-locale-78a1fe8e01c2" title="Locale" icon="map-location-dot" iconType="sharp-duotone-solid">
            Developer identifier: `users.profile.locale`

            Locale records user's default location for date/time formatting (BCP 47). It is needed to place the record at the time or date reported for this event or state.

            * **Enables:** bound Users records by `locale`, order their returned events or state changes, and correlate records reported at the same time.
            * **Interpretation:** Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; the schema uses the `Localization.Locale` scalar.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-profile-login-f8d447196746" title="Login" icon="envelope" iconType="sharp-duotone-solid">
            Developer identifier: `users.profile.login`

            Login records user's Okta login, typically an email address. It is needed to attribute this Users row to the returned person, account, or organization reference.

            * **Enables:** attribute the Users row to the returned person or account and match the exact `login` value where it recurs in Okta.
            * **Interpretation:** Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; the schema uses the `Contact.Email` scalar.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-profile-manager-84cd17b8962b" title="Manager" icon="chart-line" iconType="sharp-duotone-solid">
            Developer identifier: `users.profile.manager`

            Manager records user's manager (login or display name, depending on org config). It is needed to attribute this Users row to the returned person, account, or organization reference.

            * **Enables:** attribute the Users row to the returned person or account and match the exact `manager` value where it recurs in Okta.
            * **Interpretation:** Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-profile-managerid-48097a455290" title="Manager ID" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `users.profile.managerId`

            Manager ID records identifier for the user's manager. It is needed to refer to the same manager across records without relying on display text.

            * **Enables:** match `managerId` to manager references carrying the same Okta-issued value in related Okta records.
            * **Interpretation:** Okta reports this value on the User Profile object returned for Users; it is an identifier, not a measured quantity.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-profile-middlename-d9330a313eb1" title="Middle Name" icon="chart-column" iconType="sharp-duotone-solid">
            Developer identifier: `users.profile.middleName`

            Middle Name records user's middle name. It is needed to attribute this Users row to the returned person, account, or organization reference.

            * **Enables:** attribute the Users row to the returned person or account and match the exact `middleName` value where it recurs in Okta.
            * **Interpretation:** Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-profile-mobilephone-c877f30d012a" title="Mobile Phone" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `users.profile.mobilePhone`

            Mobile Phone records user's mobile phone number. It is needed to preserve the exact Okta-reported contact number for the person, company, or location represented by this row.

            * **Enables:** match the exact contact number in `mobilePhone` to the same User Profile record without treating it as an account identifier.
            * **Interpretation:** Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; the schema uses the `Contact.PhoneNumber` scalar.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-profile-nickname-ad30b50d6718" title="Nick Name" icon="chart-line" iconType="sharp-duotone-solid">
            Developer identifier: `users.profile.nickName`

            Nick Name records user's casual or nickname. It is needed to attribute this Users row to the returned person, account, or organization reference.

            * **Enables:** attribute the Users row to the returned person or account and match the exact `nickName` value where it recurs in Okta.
            * **Interpretation:** Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-profile-organization-67aac892b963" title="Organization" icon="brackets-curly" iconType="sharp-duotone-solid">
            Developer identifier: `users.profile.organization`

            Organization records name of the user's organization. It is needed to compare the returned organization for individual Users rows and select rows with a specific `organization` value.

            * **Enables:** trace the organization relationship returned in `organization` from the User Profile row to its named Okta context.
            * **Interpretation:** Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-profile-postaladdress-c2a604ae6367" title="Postal Address" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `users.profile.postalAddress`

            Postal Address records mailing address of the user. It is needed to preserve the Okta-reported configured or derived address and place context for the same record.

            * **Enables:** compare the Okta-reported configured or derived address and place context in `postalAddress` for individual Users rows without treating it as a verified physical location.
            * **Interpretation:** Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; the value is configured or derived address and place context; this Okta-reported or configured context does not establish residency or verified physical presence.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-profile-preferredlanguage-ea249ca436a5" title="Preferred Language" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `users.profile.preferredLanguage`

            Preferred Language records user's preferred written or spoken language (RFC 7231). It is needed to preserve the Okta-reported language or locale preference for this identity.

            * **Enables:** select identities by the exact `preferredLanguage` language or locale tag without inferring physical location.
            * **Interpretation:** Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; this Okta-reported setting or qualifier does not establish residency or verified physical presence.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-profile-primaryphone-9197c208e6d3" title="Primary Phone" icon="id-card" iconType="sharp-duotone-solid">
            Developer identifier: `users.profile.primaryPhone`

            Primary Phone records user's primary phone number. It is needed to distinguish Users rows by the exact Okta-returned primary phone value.

            * **Enables:** separate Users rows by the exact Okta-returned `primaryPhone` label when comparing primary phone.
            * **Interpretation:** Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; the schema uses the `Contact.PhoneNumber` scalar; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-profile-profileurl-9cfc2e14ee4e" title="Profile URL" icon="unlock" iconType="sharp-duotone-solid">
            Developer identifier: `users.profile.profileUrl`

            Profile URL records URL to the user's online profile (e.g., a web page). It is needed to inspect the exact link included with this record.

            * **Enables:** open or correlate the exact Okta resource referenced by `profileUrl` while retaining the containing Users record as provenance.
            * **Interpretation:** Okta reports this value on the User Profile object returned for Users; it is link at one User Profile record per row; the schema uses the `Network.Url` scalar; the returned link or template does not establish that the current credential can retrieve its target.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-profile-secondemail-eba2fc5b254e" title="Second Email" icon="comments" iconType="sharp-duotone-solid">
            Developer identifier: `users.profile.secondEmail`

            Second Email records user's secondary email address. It is needed to attribute this Users row to the returned person, account, or organization reference.

            * **Enables:** attribute the Users row to the returned person or account and match the exact `secondEmail` value where it recurs in Okta.
            * **Interpretation:** Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; the schema uses the `Contact.Email` scalar.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-profile-state-7b44c8970817" title="State" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `users.profile.state`

            State records state or region of the user. It is needed to distinguish Users rows by the exact Okta-returned state value.

            * **Enables:** separate Users rows by the exact Okta-returned `state` label when comparing state.
            * **Interpretation:** Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-profile-streetaddress-cd2d1913a109" title="Street Address" icon="map-location-dot" iconType="sharp-duotone-solid">
            Developer identifier: `users.profile.streetAddress`

            Street Address records full street address of the user. It is needed to preserve the Okta-reported configured or derived address and place context for the same record.

            * **Enables:** compare the Okta-reported configured or derived address and place context in `streetAddress` for individual Users rows without treating it as a verified physical location.
            * **Interpretation:** Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; the value is configured or derived address and place context; this Okta-reported or configured context does not establish residency or verified physical presence.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-profile-team-692f8693f10f" title="Team" icon="code-commit" iconType="sharp-duotone-solid">
            Developer identifier: `users.profile.team`

            Team records user's team within the organization. It is needed to compare the returned team for individual Users rows and select rows with a specific `team` value.

            * **Enables:** trace the team relationship returned in `team` from the User Profile row to its named Okta context.
            * **Interpretation:** Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-profile-timezone-7a2b96a1f0cf" title="Timezone" icon="globe" iconType="sharp-duotone-solid">
            Developer identifier: `users.profile.timezone`

            Timezone records user's time zone (IANA timezone identifier). It is needed to preserve the Okta-reported timezone or locale setting for the same record.

            * **Enables:** compare the Okta-reported timezone or locale setting in `timezone` for individual Users rows without treating it as a verified physical location.
            * **Interpretation:** Okta reports this value on the User Profile object returned for Users; it is an identifier, not a measured quantity; the schema uses the `Temporal.TimeZone` scalar; the value is timezone or locale setting; this Okta-reported or configured context does not establish residency or verified physical presence.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-profile-title-6507dc5b9a6a" title="Title" icon="lock" iconType="sharp-duotone-solid">
            Developer identifier: `users.profile.title`

            Title records user's job title. It is needed to preserve the business or job title reported for the person represented by this row.

            * **Enables:** select Users rows by the exact business or job title in `title` without treating the title as an authorization role.
            * **Interpretation:** Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-profile-usertype-6f6d769a6535" title="User Type" icon="circle-info" iconType="sharp-duotone-solid">
            Developer identifier: `users.profile.userType`

            User Type records used to describe the organization-to-user relationship (e.g., Employee, Contractor). It is needed to distinguish Users rows by the exact Okta-returned user type value.

            * **Enables:** separate Users rows by the exact Okta-returned `userType` label when comparing user type.
            * **Interpretation:** Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-profile-zipcode-fd0e93f2a667" title="Zip Code" icon="location-crosshairs" iconType="sharp-duotone-solid">
            Developer identifier: `users.profile.zipCode`

            Zip Code records zip code or postal code of the user. It is needed to preserve the Okta-reported configured or derived address and place context for the same record.

            * **Enables:** compare the Okta-reported configured or derived address and place context in `zipCode` for individual Users rows without treating it as a verified physical location.
            * **Interpretation:** Okta reports this value on the User Profile object returned for Users; it is interpreted at one User Profile record per row; the value is configured or derived address and place context; this Okta-reported or configured context does not establish residency or verified physical presence; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-realmid-86a2bcf997d2" title="Realm ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `users.realmId`

            Realm ID records identifier of the realm the user belongs to. It is needed to refer to the same realm across records without relying on display text.

            * **Enables:** match `realmId` to realm references carrying the same Okta-issued value in related Okta records.
            * **Interpretation:** Okta reports this value on the Okta User object returned for Users; it is an identifier, not a measured quantity.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-status-6152ad40ed10" title="Status" icon="calendar-clock" iconType="sharp-duotone-solid">
            Developer identifier: `users.status`

            Status records current lifecycle status of the user. It is needed to distinguish Users rows by the exact Okta-returned status value.

            * **Enables:** separate Users rows by the exact Okta-returned `status` label when comparing status.
            * **Interpretation:** Okta reports this value on the Okta User object returned for Users; it is interpreted at one Okta User record per row; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-statuschanged-fbae9e11bcc6" title="Status Changed" icon="earth-americas" iconType="sharp-duotone-solid">
            Developer identifier: `users.statusChanged`

            Status Changed records timestamp when the user's status last changed. It is needed to place the record at the time or date reported for this event or state.

            * **Enables:** bound Users records by `statusChanged`, order their returned events or state changes, and correlate records reported at the same time.
            * **Interpretation:** Okta reports this value on the Okta User object returned for Users; it is interpreted at one Okta User record per row; the schema uses the `Temporal.DateTime` scalar; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-transitioningtostatus-3c083f40be4f" title="Transitioning To Status" icon="circle-info" iconType="sharp-duotone-solid">
            Developer identifier: `users.transitioningToStatus`

            Transitioning To Status records target status of an in-progress asynchronous status transition, if any. It is needed to distinguish Users rows by the exact Okta-returned transitioning to status value.

            * **Enables:** separate Users rows by the exact Okta-returned `transitioningToStatus` label when comparing transitioning to status.
            * **Interpretation:** Okta reports this value on the Okta User object returned for Users; it is interpreted at one Okta User record per row; classification values are Okta-returned labels rather than a universal taxonomy.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-type-f244cc7748dc" title="Type" icon="badge-check" iconType="sharp-duotone-solid">
            Developer identifier: `users.type`

            Type records the user type associated with this user. It is needed to preserve the nested type relationship or details on the parent Okta User record.

            * **Enables:** expand `type` to connect the containing Okta User row to its returned type entries.
            * **Interpretation:** Okta reports this value on the Okta User object returned for Users; it is one nested object per containing Okta User object when present.
          </Accordion>

          <Accordion id="provider-permission-field-okta-users-type-id-af6d057dc979" title="ID" icon="address-book" iconType="sharp-duotone-solid">
            Developer identifier: `users.type.id`

            ID records unique identifier for the user type. It is needed to refer to the same user type across records without relying on display text.

            * **Enables:** match `id` to user type references carrying the same Okta-issued value in related Okta records.
            * **Interpretation:** Okta reports this value on the User Type object returned for Users; it is an identifier, not a measured quantity.
          </Accordion>
        </AccordionGroup>
      </Accordion>
    </AccordionGroup>
  </Tab>

  <Tab title="Troubleshooting">
    | Endpoint         | Data                    |
    | ---------------- | ----------------------- |
    | `/api/v1/users`  | User profiles           |
    | `/api/v1/groups` | Groups and membership   |
    | `/api/v1/logs`   | System audit logs       |
    | `/api/v1/apps`   | Application assignments |

    > **Tip:** **Rate Limits:** Okta enforces rate limits of **varies by endpoint; typically 100-1000 requests/minute**.
    >
    > Parable handles rate limiting automatically with exponential backoff, but initial syncs of large datasets may take longer due to these limits.

    | Error      | Meaning             | Solution                                         |
    | ---------- | ------------------- | ------------------------------------------------ |
    | `E0000011` | Invalid token       | Verify token is correct                          |
    | `E0000006` | Access denied       | Verify token has required admin permissions      |
    | `E0000015` | Feature not enabled | Check required Okta features/licenses are active |
    | `429`      | Rate limit          | Implement backoff                                |

    #### Common Issues

    #### Token created by deactivated user

    If the admin who created the token is deactivated, the token becomes invalid. Create a new token with an active admin account.

    #### Can't access logs

    System Log access requires Super Administrator or Report Administrator role.

    **[Okta API](https://developer.okta.com/docs/reference/)** — Official API reference

    **[Rate Limits](https://developer.okta.com/docs/reference/rate-limits/)** — Rate limit documentation
  </Tab>
</Tabs>