Imports users, groups, MFA enrollment, admin role assignments, and SSO application assignments from your Okta org via the Okta API.
For the general flow of adding a source, see Connect Data Sources.
Before you start
An Okta org (Identity Engine) with a Super Admin account, or an admin allowed to create app integrations and assign admin roles
Your Okta domain (e.g. acme.okta.com)
💡 Okta recommends the OAuth 2.0 service app below over the legacy API token: scoped, short-lived tokens instead of one long-lived credential that inherits an admin's full privilege level.
Step 1 — Create the service app
Sign in to the Okta Admin Console
Go to Applications and Resources → Applications → click Create App Integration
Select API Services as the sign-in method → click Next
Name it HARVEN and click Save
Step 2 — Generate a signing key pair
On the app's General tab, in the Client Credentials section, click Edit
Select Public key / Private key as the client authentication method
Click Add key → Generate new key
Click PEM if HARVEN asks for that format, then Copy to clipboard — the private key is only shown once
Click Done, then Save
Note the Client ID shown in the same Client Credentials section
Step 3 — Assign an admin role
On the app, open the Admin Roles tab → Edit assignments
Select Read-only Administrator — the least-privileged role that covers import → Save Changes
Step 4 — Grant API scopes
On the app, open the Okta API Scopes tab
Click Grant next to each of: okta.users.read, okta.groups.read, okta.roles.read, okta.apps.read
Step 5 — Remediation actions (optional)
Only required to act on a user from HARVEN (suspend, deactivate, expire password, clear sessions, remove a factor or a role). Click Grant on two more scopes — okta.users.manage and okta.roles.manage — or assign the app a role capable of those actions instead of Read-only Administrator.
⚠️ Deactivating a user is not reversible through the Okta API — re-provisioning is a separate onboarding flow, not a clean inverse. HARVEN's remediation plan flags this action as non-reversible.
Alternative — API token (legacy)
Simpler to set up, but the token inherits the creating admin's full privilege level and expires after 30 days of inactivity. HARVEN flags this method as legacy in the setup screen.
Sign in to the Okta Admin Console as an admin with the Read-only Administrator role (or higher)
Go to Security → API → Tokens → click Create token
Name it HARVEN, click Create Token, then copy the value immediately — it is only shown once
What to enter in HARVEN
Choose your authentication method, then fill in the matching fields:
Okta Domain — your org's domain, both methods (e.g. acme.okta.com)
Client ID and Private Key — OAuth service app, from Step 2
API Token — legacy fallback, from the Alternative section above
What HARVEN reads
users — Okta user directory and lifecycle: identity (user_id, login, email), lifecycle (status, created, activated, status_changed, last_login, last_updated), profile (first_name, last_name, department), security (password_changed)
user_factors — Enrolled MFA factors per user: factor (factor_id, user_id, factor_type, provider, vendor_name), status (status, created, last_updated)
groups — Group directory: identity (group_id, name, description, type), activity (created, last_membership_updated)
group_members — Group membership: membership (group_id, user_id)
user_role_assignments — Admin roles assigned directly to a user: role (user_id, role_id, role_type, label, status, created, last_updated)
group_role_assignments — Admin roles assigned to a group, inherited by every member: role (group_id, role_id, role_type, label, status, created, last_updated)
apps — Application catalog (SSO integrations): app (app_id, label, name, status, sign_on_mode), activity (created, last_updated)
app_user_assignments — Which users are assigned to which app: assignment (app_id, user_id, status, created)
How the tables are queried
user_factors, user_role_assignments, group_role_assignments and app_user_assignments mirror per-user, per-group or per-app Okta endpoints — a query needs an equality filter on user_id, group_id or app_id, otherwise it is rejected rather than silently enumerating every user, group or app in your org.
On users, filtering on status or last_updated is pushed down to Okta; other filters are applied by HARVEN after the data is fetched.
Official documentation
Need help? Contact [email protected].
