mcp/okta-mcp-server repository overview

⁠Okta MCP Server

⁠:tada: It's Official :tada:

The Okta Open-Source MCP Server integrates with LLMs and AI agents, allowing you to perform various Okta management operations using natural language and is Generally Available (GA). .

What is an MCP Server?⁠

⁠MCP Info

⁠Image Building Info

⁠Available Tools (108)

---

⁠Tools Details

⁠Tool: list_applications

List all applications from the Okta organization.

⁠Tool: get_application

Get an application by ID from the Okta organization.

⁠Tool: create_application

Create a new application in the Okta organization.

⁠Tool: update_application

Update an application by ID in the Okta organization.

⁠Tool: delete_application

Delete an application by ID from the Okta organization. This tool deletes an application by its ID from the Okta organization. The user will be asked for confirmation before the deletion proceeds.

⁠Tool: confirm_delete_application

Confirm and execute application deletion after receiving confirmation. .. deprecated:: This tool exists for backward compatibility with clients that do not support MCP elicitation. New clients should rely on the built-in elicitation prompt in delete_application instead. This function MUST ONLY be called after the human user has explicitly typed 'DELETE' as confirmation. NEVER call this function automatically after delete_application.

⁠Tool: activate_application

Activate an application in the Okta organization.

⁠Tool: deactivate_application

Deactivate an application in the Okta organization.

⁠Tool: list_brands

List all brands in the Okta organization with pagination support.

⁠Tool: get_brand

Retrieve a specific brand by its ID.

⁠Tool: create_brand

Create a new brand in the Okta organization. A brand controls the look-and-feel of the sign-in page, error pages, email templates, and the End-User Dashboard. After creation you can customise it further with replace_brand and the Themes API.

⁠Tool: replace_brand

Replace (fully update) a brand by its ID. This is a full replacement (HTTP PUT). Every writable field in the brand will be overwritten — omitted optional fields revert to their defaults.

⁠Tool: delete_brand

Delete a brand by its ID. The user is asked to confirm before the deletion is carried out. The default (Okta) brand cannot be deleted — the API will return a 409 error in that case.

⁠Tool: list_brand_domains

List all custom domains associated with a brand. Each brand can have one or more domains. The default Okta subdomain (e.g. yourorg.okta.com) is always present; additional custom domains appear here once they have been verified and activated.

⁠Tool: list_custom_domains

List all custom domains in the Okta organization. Returns all custom domains including the default Okta subdomain (id: "default"). The API does not support pagination — all domains are returned in a single response. Each domain object includes: - id – Unique domain ID ("default" for the org base domain). - domain – The fully qualified domain name. - brandId – ID of the brand associated with this domain. - certificateSourceType– "MANUAL" or "OKTA_MANAGED". - validationStatus – NOT_STARTED | IN_PROGRESS | VERIFIED | COMPLETED | FAILED_TO_VERIFY. - dnsRecords – DNS records to configure at your DNS provider (TXT + CNAME, present until domain is verified). - publicCertificate – Certificate metadata (present after verification).

⁠Tool: create_custom_domain

Create a new custom domain for the Okta organization. After creating a domain, the response includes DNS records (TXT + CNAME) that you must configure at your DNS provider before calling verify_custom_domain. Okta does not automatically verify domains.

⁠Tool: get_custom_domain

Retrieve a custom domain by its ID.

⁠Tool: replace_custom_domain

Replace the brand associated with a custom domain. Associates a different brand with the given custom domain. The brand controls the look-and-feel of the sign-in page and email templates served under that domain. Constraints: - The default brand (isDefault: true) cannot be mapped to a custom domain (API returns 409). - The PUT is allowed regardless of the domain's validationStatus; the brand association can be changed at any point in the domain lifecycle.

⁠Tool: delete_custom_domain

Delete a custom domain by its ID. Permanently removes the custom domain from the organization. The default org domain (id: "default") cannot be deleted. A confirmation prompt is shown before proceeding.

⁠Tool: upsert_custom_domain_certificate

Upload or renew the TLS certificate for a MANUAL custom domain. Creates or replaces the PEM-encoded certificate for a custom domain whose certificateSourceType is MANUAL. If the domain is currently OKTA_MANAGED, calling this switches it to MANUAL and Okta stops auto-renewing the certificate. Okta supports TLS certificates and private keys that are PEM-encoded and 2048, 3072, or 4096 bits.

⁠Tool: verify_custom_domain

Verify a custom domain by checking its DNS records. Triggers Okta to verify that the TXT and CNAME records you added at your DNS provider match the values returned when the domain was created. DNS changes can take time to propagate — if verification fails immediately after adding records, wait a few minutes and try again. After a successful verification: - validationStatus becomes VERIFIED (or COMPLETED once the certificate is also installed). - If certificateSourceType is OKTA_MANAGED, Okta also provisions and installs a TLS certificate automatically.

⁠Tool: get_error_page_resources

Retrieve the error page sub-resource links for a brand. Returns navigation links (_links) for the customized, default, and preview error pages. Pass one or more values in expand to embed the full page content of those sub-resources inline in the response.

⁠Tool: get_customized_error_page

Retrieve the customized error page for a brand. The customized error page is what end-users see in the live environment when an error occurs. Returns 404 if no customization exists (the default page is in use).

⁠Tool: replace_customized_error_page

Replace (or create) the customized error page for a brand. Sets the HTML that appears in the live environment when an error occurs. Replaces the entire customized page; any fields omitted revert to their defaults.

⁠Tool: delete_customized_error_page

Delete the customized error page for a brand. Removes the customized error page so the Okta default error page is shown in the live environment. Requires explicit confirmation before proceeding.

⁠Tool: get_default_error_page

Retrieve the default (Okta-provided) error page for a brand. The default error page is shown when no customized error page exists. It cannot be modified; use replace_customized_error_page to override it.

⁠Tool: get_preview_error_page

Retrieve the preview error page for a brand. The preview page is a sandbox for testing error page changes before they go live. Returns 404 if no preview exists.

⁠Tool: replace_preview_error_page

Replace (or create) the preview error page for a brand. Sets the HTML for the error page preview environment. Use this to test changes before publishing to the live customized error page.

⁠Tool: delete_preview_error_page

Delete the preview error page for a brand. Removes the preview error page. The preview environment will fall back to the default error page. Requires explicit confirmation before proceeding.

⁠Tool: get_sign_in_page_resources

Retrieve the sign-in page sub-resource links for a brand. Returns navigation links (_links) for the customized, default, and preview sign-in pages. Pass one or more values in expand to embed the full page content of those sub-resources inline in the response.

⁠Tool: get_customized_sign_in_page

Retrieve the customized sign-in page for a brand. The customized sign-in page is what end-users see in the live environment. Returns 404 if no customization exists (the default page is in use).

⁠Tool: replace_customized_sign_in_page

Replace (or create) the customized sign-in page for a brand. Sets the HTML, widget version, and widget behaviour that appear in the live environment. The widgetCustomizations parameter lets you control labels, links, and toggles shown in the Okta sign-in widget.

⁠Tool: delete_customized_sign_in_page

Delete the customized sign-in page for a brand. Removes the customized sign-in page so the Okta default sign-in page is shown in the live environment. Requires explicit confirmation before proceeding.

⁠Tool: get_default_sign_in_page

Retrieve the default (Okta-provided) sign-in page for a brand. The default sign-in page is shown when no customized page exists. It cannot be modified; use replace_customized_sign_in_page to override it.

⁠Tool: get_preview_sign_in_page

Retrieve the preview sign-in page for a brand. The preview page is a sandbox for testing sign-in page changes before they go live. Returns 404 if no preview exists.

⁠Tool: replace_preview_sign_in_page

Replace (or create) the preview sign-in page for a brand. Sets the HTML, widget version, and widget behaviour for the sign-in page preview environment. Use this to test changes before publishing to the live customized sign-in page.

⁠Tool: delete_preview_sign_in_page

Delete the preview sign-in page for a brand. Removes the preview sign-in page. The preview environment will fall back to the default sign-in page. Requires explicit confirmation before proceeding.

⁠Tool: list_sign_in_widget_versions

List all available Okta Sign-In Widget versions for a brand. Returns the version strings that can be used in the widget_version parameter of replace_customized_sign_in_page and replace_preview_sign_in_page. Includes both specific versions and range expressions.

⁠Tool: get_sign_out_page_settings

Retrieve the sign-out page settings for a brand. Returns the current sign-out page configuration, which controls where users are redirected after signing out.

⁠Tool: replace_sign_out_page_settings

Replace the sign-out page settings for a brand. Controls where users are redirected after they sign out. Set type to OKTA_DEFAULT to use the built-in Okta sign-out page, or EXTERNALLY_HOSTED to redirect users to a URL you provide.

⁠Tool: list_email_templates

List all email templates for a brand with pagination support. Returns every Okta-managed email template available on the brand. By default each entry contains only the template name and _links. Use expand to embed additional metadata inline.

⁠Tool: get_email_template

Retrieve a single email template for a brand. Returns the named Okta email template with its navigation links. Pass expand to embed settings or customization count inline.

⁠Tool: list_email_customizations

List all customizations for an email template with pagination support. Returns every language variant that has been created for the specified email template. Each entry includes the full customization body, subject, language, isDefault flag, and timestamps.

⁠Tool: create_email_customization

Create a new language customization for an email template. Adds a new localized variant for the specified email template. Only one customization per language is allowed — creating a duplicate language returns a 409 Conflict error. The first customization created for a template automatically becomes the default (isDefault=True); subsequent ones default to False. The body must be valid HTML and must include all required Okta template variables for the template type. For example, UserActivation requires ${activationLink} or ${activationToken}.

⁠Tool: get_email_customization

Retrieve a specific email customization by its ID. Returns the full customization object including the HTML body, subject, language, isDefault status, and timestamps.

⁠Tool: replace_email_customization

Replace an existing email customization (full update). Replaces all fields on the specified customization. All required fields must be supplied; the operation is not a partial patch. The body must include all required Okta template variables for the template type or the request will be rejected with a validation error.

⁠Tool: delete_email_customization

Delete a specific email customization. Permanently removes the specified language customization from the email template. Requires explicit confirmation before proceeding. If this is the only customization (i.e. the default), you may need to delete all customizations instead; deleting the sole default customization may return an error — use delete_all_email_customizations in that case.

⁠Tool: delete_all_email_customizations

Delete ALL customizations for an email template. Permanently removes every language variant from the specified email template, reverting it to Okta's built-in default content. This is irreversible and cannot be undone. Requires explicit confirmation.

⁠Tool: get_email_customization_preview

Preview a rendered email customization. Returns the customization with all Okta template variables replaced by representative sample values. Useful for verifying how the email will appear to recipients before publishing.

⁠Tool: get_email_default_content

Retrieve the Okta default content for an email template. Returns the unmodified Okta-provided subject and body for the specified template. This is the fallback content shown when no customization exists for a given language. Useful for inspecting the baseline before creating a customization.

⁠Tool: get_email_default_content_preview

Preview the rendered Okta default content for an email template. Returns the Okta default subject and body with all template variables replaced by representative sample values. Unlike get_email_default_content, all ${variable} placeholders are substituted with real-looking data so you can see exactly what an end user would receive.

⁠Tool: get_email_settings

Retrieve the email settings for a template. Returns the recipient configuration for the specified email template, controlling which user populations will receive emails of this type.

⁠Tool: replace_email_settings

Replace the email settings for a template. Updates the recipient configuration for the specified email template. This controls who receives emails of this type across your Okta org.

⁠Tool: send_test_email

Send a test email for a template to the current API user. Triggers Okta to send a test version of the specified email template to the email address of the user associated with the current API token. If a customization exists for the requested language, the customized version is sent; otherwise the Okta default content is used.

⁠Tool: list_email_domains

List all email domains in the Okta organization. Returns every Email Domain configured in the org. Each domain shows its current validation status and the DNS records that must be published to complete verification.

⁠Tool: create_email_domain

Create a new email domain for the Okta organization. After creation the response includes DNS records (one TXT record and three CNAME records) that you must publish at your DNS provider. Call verify_email_domain once the records are live to complete setup.

⁠Tool: get_email_domain

Retrieve an email domain by it

[...]