Okta Permissions Reference
This section details the API scopes and admin role required for SailPoint Entro's Okta integration.
Required API Scopes
| Scope | Purpose |
|---|---|
okta.apps.read |
Read application metadata |
okta.appGrants.read |
Read API grant permissions per app |
okta.roles.read |
List role assignments across users and apps |
okta.users.read |
Access user and employee profile data |
okta.logs.read |
Retrieve Okta audit logs |
okta.apiTokens.read |
Access API token metadata |
Required Admin Roles
| Role | Visibility |
|---|---|
| Super Administrator | Full visibility - includes API grant permissions per app |
| Custom Entro Role + Report Administrator | Partial visibility - API grant permissions per app not available |
Note
Super Administrator is the only built-in Okta role that can list API grant permissions per app. This is required for complete NHI visibility in SailPoint Entro. Refer to Okta's documentation for a full comparison of built-in admin roles.
Authentication Method
| Property | Value |
|---|---|
| Auth type | OAuth 2.0 - Client ID + Public Key pair |
| App type | API Service App |
| Key format | RSA public key (JWK) |
| Operations | Read-only - no write or delete actions performed |