Okta Tables

Permissions

The Okta plugin requires the following permissions:

Permissions
okta.users.read
okta.userTypes.read
okta.groups.read
okta.apps.read
okta.roles.read
okta.policies.read
okta.devices.read
okta.authorizationServers.read
okta.trustedOrigins.read
okta.factors.read
okta.logs.read

Tables

OktaApiTokens

Stores API-token records used by Okta to authenticate API requests on behalf of users; includes metadata such as token issuer, status, creation and expiration times.

Name	Type	Description
ConfigID	integer	ETL-specific field: Multi-tenant configuration identifier for the Okta integration instance.
ApiTokenID	string	A unique ID for the API token.
Name	string	Name of the API token.
ClientName	string	Name of the client associated with the API token.
Created	datetime	Timestamp when the API token was created.
ExpiresAt	datetime	Timestamp when the API token expires.
LastUpdated	datetime	Timestamp when the API token was last updated.
NetworkConnection	string	Network connection type for the API token.
NetworkInclude	string	Network addresses included for the API token.
NetworkExclude	string	Network addresses excluded for the API token.
TokenWindow	string	Token window configuration.
UserId	string	User ID associated with the API token.
BatchDate	datetime	ETL-specific field: Timestamp when this record was processed in the ETL batch.

OktaApplications

Contains key details about applications configured within an Okta environment.

Name	Type	Description
ConfigID	integer	ETL-specific field: Multi-tenant configuration identifier for the Okta integration instance.
AppID	string	A unique ID for the application.
Name	string	The name of the application.
Label	string	User-defined display name for app.
Status	string	App instance status. Enum: `ACTIVE`, `DELETED`, `INACTIVE`.
LastUpdated	datetime	Timestamp when the application was last updated.
Created	datetime	Timestamp when the application was created.
SignOnMode	string	Authentication mode for the app. Values: `AUTO_LOGIN`, `BASIC_AUTH`, `BOOKMARK`, `BROWSER_PLUGIN`, `OPENID_CONNECT`, `SAML_1_1`, `SAML_2_0`, `SECURE_PASSWORD_STORE WS_FEDERATION`.
BatchDate	datetime	ETL-specific field: Timestamp when this record was processed in the ETL batch.

OktaCustomDomains

Represents custom domains configured for an Okta org, letting you map and manage alternate URLs or branded domains for sign-in and other services.

Name	Type	Description
ConfigID	integer	ETL-specific field: Multi-tenant configuration identifier for the Okta integration instance.
CustomDomainID	string	Unique identifier for the custom domain.
BrandId	string	Brand ID associated with the custom domain.
CertificateSourceType	string	Source type of the certificate.
Domain	string	The custom domain name.
ValidationStatus	string	Validation status of the custom domain.
CertificateExpiration	datetime	Expiration date of the certificate.
CertificateFingerprint	string	Fingerprint of the certificate.
CertificateSubject	string	Subject of the certificate.
BatchDate	datetime	ETL-specific field: Timestamp when this record was processed in the ETL batch.

OktaDevices

Captures key attributes about devices enrolled or recognized by Okta.

Name	Type	Description
ConfigID	integer	ETL-specific field: Multi-tenant configuration identifier for the Okta integration instance.
DeviceID	string	Unique identifier for the device.
Status	string	The state object of the device. Enum: `ACTIVE`, `DEACTIVATED`, `SUSPENDED`, `UNSUSPENDED`.
Created	datetime	Timestamp when the device was created.
LastUpdated	datetime	Timestamp when the device record was last updated. Updates occur when Okta collects and saves device signals during authentication and when the lifecycle state of the device changes.
DisplayName	string	Display name of the device.
Platform	string	OS platform of the device. Enum: `ANDROID`, `IOS`, `MACOS`, `WINDOWS`.
SerialNumber	string	Serial number of the device.
SID	string	Windows Security identifier of the device.
TPMPublicKeyHash	string	Windows Trusted Platform Module hash value.
UDID	string	macOS Unique device identifier of the device.
Registered	boolean	Indicates whether the device is registered with Okta.

OktaDNSRecords

Holds DNS record details (e.g. CNAME, TXT) associated with custom domains or other domain configurations in Okta, used for domain verification, TLS, and email/certificate setup.

Name	Type	Description
ConfigID	integer	ETL-specific field: Multi-tenant configuration identifier for the Okta integration instance.
DNSRecordID	bigint	Identity column for the DNS record.
CustomDomainID	string	Foreign key to OktaCustomDomains.
Expiration	string	Expiration information for the DNS record.
Fqdn	string	Fully qualified domain name.
RecordType	string	Type of DNS record such as `A`, `AAAA`, `CNAME`, `TXT`.
Values	string	DNS record values.
BatchDate	datetime	ETL-specific field: Timestamp when this record was processed in the ETL batch.

OktaFactors

Stores configuration details about authentication factors available or used in Okta.

Name	Type	Description
ConfigID	integer	ETL-specific field: Multi-tenant configuration identifier for the Okta integration instance.
FactorID	string	ID of the factor.
FactorType	string	Type of factor.
Provider	string	Provider for the factor. Each provider can support a subset of factor types.
VendorName	string	Name of the factor vendor. This is usually the same as the provider except for On-Prem MFA which depends on admin settings.
Status	string	Status of the factor. Enum: `ACTIVE`, `DISABLED`, `ENROLLED`, `EXPIRED`, `INACTIVE`, `NOT_SETUP PENDING_ACTIVATION`.
Created	datetime	Timestamp when the factor was created.
LastUpdated	datetime	Timestamp when the factor was last updated.
BatchDate	datetime	ETL-specific field: Timestamp when this record was processed in the ETL batch.

OktaGateways

Defines gateway IP addresses or proxy endpoints configured in Okta’s network-zone system; gateways act as entry points that requests must match to be considered inside a trusted zone.

Name	Type	Description
ConfigID	integer	ETL-specific field: Multi-tenant configuration identifier for the Okta integration instance.
ID	bigint	Identity column for the gateway.
NetworkZoneID	string	Foreign key to OktaNetworkZones.
Type	string	Type of gateway address. Common values: `CIDR` for IP address ranges, `DYNAMIC` for dynamic IP addresses.
Value	string	The gateway address value which can be an IP address or CIDR notation.
BatchDate	datetime	ETL-specific field: Timestamp when this record was processed in the ETL batch.

OktaGroups

Holds basic information about group records managed within an Okta tenant.

Name	Type	Description
ConfigID	integer	ETL-specific field: Multi-tenant configuration identifier for the Okta integration instance.
GroupID	string	Unique ID for the group.
Created	datetime	Timestamp when the group was created.
LastUpdated	datetime	Timestamp when the group's profile was last updated.
LastMembershipUpdated	datetime	Timestamp when the groups memberships were last updated.
Type	string	Determines how a group's profile and memberships are managed. Enum: `APP_GROUP`, `BUILT_IN OKTA_GROUP`.
ProfileName	string	Name of the group.
ProfileDescription	string	Description of the group.
BatchDate	datetime	ETL-specific field: Timestamp when this record was processed in the ETL batch.

OktaNetworkZones

Represents IP/network zones that define trusted or restricted perimeters for access — used for policy enforcement, API-token restrictions, login/IP controls, and to manage network-based access rules.

Name	Type	Description
ConfigID	integer	ETL-specific field: Multi-tenant configuration identifier for the Okta integration instance.
NetworkZoneID	string	Unique identifier for the network zone.
Name	string	Name of the network zone.
Type	string	Type of network zone. Common values: IP for IP-based zones DYNAMIC for dynamic zones.
Status	string	Status of the network zone. Enum: `ACTIVE`, `INACTIVE`.
Usage	string	Usage type of the network zone. Common values: `POLICY`, `BLOCKLIST`.
Created	datetime	Timestamp when the network zone was created.
LastUpdated	datetime	Timestamp when the network zone was last updated.
System	boolean	Indicates if this is a system network zone created by Okta and cannot be deleted.
UseAsExemptList	boolean	Indicates if the network zone is used as an exempt list.
BatchDate	datetime	ETL-specific field: Timestamp when this record was processed in the ETL batch.

OktaPolicies

Contains summarized information about policies configured in an Okta environment.

Name	Type	Description
ConfigID	integer	ETL-specific field: Multi-tenant configuration identifier for the Okta integration instance.
PolicyID	string	Identifier of the policy.
PolicyName	string	Name of the policy.
Status	string	Whether or not the policy is active. Enum: `ACTIVE`, `INACTIVE`.
PolicyType	string	All Okta orgs contain only one IdP Discovery policy with an immutable default rule routing to your org's sign-in page one Entity Risk policy and one Post Auth Session policy. Creating or replacing a policy with the `IDP_DISCOVERY` type the `ENTITY_RISK` type or the `POST_AUTH_SESSION` type is not supported. The following policy types are available with Identity Engine: `ACCESS_POLICY PROFILE_ENROLLMENT`, `POST_AUTH_SESSION` and `ENTITY_RISK`.
Created	datetime	Timestamp when the policy was created.
LastUpdated	datetime	Timestamp when the policy was last modified.
BatchDate	datetime	ETL-specific field: Timestamp when this record was processed in the ETL batch.

OktaPolicyPasswordSettings

Provides key settings related to password policy configurations in Okta.

Name	Type	Description
ConfigID	integer	ETL-specific field: Multi-tenant configuration identifier for the Okta integration instance.
PasswordSettingsID	integer	Identity column for the password settings.
PolicyID	string	Identifier of the policy.
TokenLifetimeMinutes	integer	The duration in minutes for which a token remains valid before expiration. After this time users will need to authenticate again.
SkipUnlock	boolean	Determines whether the account unlock process can be bypassed. If set to true the unlock step can be skipped.
MaxAttempts	integer	The maximum number of allowed failed password attempts before an account is locked or further action is triggered.
AutoUnlockMinutes	integer	Minutes it takes for a locked account to automatically unlock.
ShowLockoutFailures	boolean	Specifies whether users should be shown a message when they have failed login attempts and are locked out. If true users are notified about the lockout.
MinLength	integer	The minimum required length of a password.
MinLowerCase	integer	The minimum number of lowercase letters required in a password.
MinUpperCase	integer	The minimum number of uppercase letters required in a password.
MinNumber	integer	The minimum number of numerical digits required in a password.

OktaPolicyRules

Contains metadata about individual rules defined within Okta policies.

Name	Type	Description
ConfigID	integer	ETL-specific field: Multi-tenant configuration identifier for the Okta integration instance.
RuleID	string	Identifier for the rule.
PolicyID	string	Identifier of the policy.
Type	string	Rule type.
Name	string	Name of the rule.
Status	string	Whether or not the rule is active. Use the activate query parameter to set the status of a rule. Enum: `ACTIVE`, `INACTIVE`.
Priority	integer	Priority of the rule.
Created	datetime	Timestamp when the rule was created.
LastUpdated	datetime	Timestamp when the rule was last modified.
System	boolean	Specifies whether Okta created the policy rule where system equals true. You cannot delete policy rules that have system set to true.
BatchDate	datetime	ETL-specific field: Timestamp when this record was processed in the ETL batch.

OktaProxies

Lists trusted proxy IPs or proxy configurations associated with network zones; marking an IP as a proxy influences how Okta evaluates request origin and security context under Trusted Proxy settings.

Name	Type	Description
ConfigID	integer	ETL-specific field: Multi-tenant configuration identifier for the Okta integration instance.
ID	bigint	Identity column for the proxy.
NetworkZoneID	string	Foreign key to OktaNetworkZones.
Type	string	Type of proxy address. Common values: `CIDR` for IP address ranges, `DYNAMIC` for dynamic IP addresses.
Value	string	The proxy address value which can be an IP address or CIDR notation.
BatchDate	datetime	ETL-specific field: Timestamp when this record was processed in the ETL batch.

OktaRoles

Lists the administrative roles assigned within an Okta organization.

Name	Type	Description
ConfigID	integer	ETL-specific field: Multi-tenant configuration identifier for the Okta integration instance.
RoleID	string	Role assignment ID.
Label	string	Label for the role assignment.
Type	string	Standard role type. Common values: `SUPER_ADMIN`, `ORG_ADMIN`, `API_ACCESS_MANAGEMENT_ADMIN`, `APP_ADMIN`, `USER_ADMIN`, `GROUP_MEMBERSHIP_ADMIN HELP_DESK_ADMIN`, `READ_ONLY_ADMIN`, `MOBILE_ADMIN REPORT_ADMIN`.
Status	string	Status of the role assignment. Enum: `ACTIVE`, `INACTIVE`.
CreatedAt	datetime	Timestamp when the role was created.
LastUpdatedAt	datetime	Timestamp when the role was last modified.
AssignmentType	string	Role assignment type. Common values: `USER`, `GROUP`, `APP`.
BatchDate	datetime	ETL-specific field: Timestamp when this record was processed in the ETL batch.

OktaSystemLogRequests

Captures request-level metadata extracted from Okta system log events.

Name	Type	Description
ConfigID	integer	ETL-specific field: Multi-tenant configuration identifier for the Okta integration instance.
LogUUID	string	Foreign key to OktaSystemLogs `UUID`.
IP	string	IP address of the request.
City	string	City of the request location.
State	string	State of the request location.
Country	string	Country of the request location.
PostalCode	string	Postal code of the request location.
Lat	float	Latitude of the request location.
Lon	float	Longitude of the request location.
Version	string	IP version information such as IPv4 or IPv6.
Source	string	Source of the request such as `ORIGIN` or `PROXY`.
BatchDate	datetime	ETL-specific field: Timestamp when this record was processed in the ETL batch.

OktaSystemLogs

Contains detailed event-level records generated by Okta’s system log service.

Name	Type	Description
ConfigID	integer	ETL-specific field: Multi-tenant configuration identifier for the Okta integration instance.
UUID	string	Unique identifier for an individual event.
Version	string	Versioning indicator for the log event format.
Severity	string	Indicates how severe the event is. Enum: `DEBUG`, `ERROR`, `INFO`, `WARN`.
EventType	string	The published event type. Event instances are categorized by action in the event type attribute.
DisplayMessage	string	The display message for an event.
BatchDate	datetime	ETL-specific field: Timestamp when this record was processed in the ETL batch.
Published	datetime	Timestamp when the event is published.
ASNumber	integer	Autonomous System AS number associated with the IP address.
ASOrg	string	Autonomous System AS organization name associated with the IP address.
ActorAlternateID	string	Alternate identifier for the actor such as email address or username.
ActorDetailEntry	string	Detailed entry information about the actor typically a JSON object.

OktaSystemLogTargets

Identifies the specific entities targeted by actions recorded in Okta system log events.

Name	Type	Description
ConfigID	integer	ETL-specific field: Multi-tenant configuration identifier for the Okta integration instance.
TargetID	string	Identifier for the target which is the entity that was acted upon.
LogUUID	string	Foreign key to OktaSystemLogs `UUID`.
Type	string	Type of target. Common values: User Group AppInstance Policy Rule.
AlternateID	string	Alternate identifier for the target such as email address or username.
DisplayName	string	Display name of the target.
DetailEntry	string	Detailed entry information about the target typically a JSON object.
BatchDate	datetime	ETL-specific field: Timestamp when this record was processed in the ETL batch.

OktaTrustedOrigins

Captures allowed origin URIs (scheme + host + port) for cross-origin resource sharing (CORS) or redirect policies, enabling secure integration for external web apps, sign-in pages, or embedded flows using Okta APIs.

Name	Type	Description
ConfigID	integer	ETL-specific field: Multi-tenant configuration identifier for the Okta integration instance.
TrustedOriginID	string	Unique identifier for the trusted origin.
Name	string	Name of the trusted origin.
Origin	string	Origin URL or domain allowed for CORS and redirect operations.
Status	string	Status of the trusted origin. Enum: `ACTIVE`, `INACTIVE`.
Created	datetime	Timestamp when the trusted origin was created.
CreatedBy	string	User ID who created the trusted origin.
LastUpdated	datetime	Timestamp when the trusted origin was last updated.
LastUpdatedBy	string	User ID who last updated the trusted origin.
BatchDate	datetime	ETL-specific field: Timestamp when this record was processed in the ETL batch.

OktaTrustedOriginScopes

Maps each trusted origin to a set of scopes or permissions defining what kinds of requests or resources the origin is allowed to access; used to granularly manage cross-origin access and redirects.

Name	Type	Description
ConfigID	integer	ETL-specific field: Multi-tenant configuration identifier for the Okta integration instance.
ScopeID	bigint	Identity column for the scope.
OriginID	string	Foreign key to OktaTrustedOrigins.
Type	string	Type of scope. Common values: `CORS`, `REDIRECT`.
AllowedOktaApps	string	Comma-separated list of allowed Okta applications for this scope.
BatchDate	datetime	ETL-specific field: Timestamp when this record was processed in the ETL batch.

OktaUsers

Stores core details about user accounts managed within an Okta tenant.

Name	Type	Description
ConfigID	integer	ETL-specific field: Multi-tenant configuration identifier for the Okta integration instance.
UserID	string	The identifier of the user.
UserTypeID	string	The identifier that correponds to the given user's type.
FirstName	string	The first name of the user.
LastName	string	The last name of the user.
Email	string	The primary email address of the user.
Status	string	The current status of the user. Enum: `ACTIVE`, `DEPROVISIONED`, `LOCKED_OUT`, `PASSWORD_EXPIRED`, `PROVISIONED`, `RECOVERY`, `STAGED`, `SUSPENDED`.
Created	datetime	The timestamp when the user was created.
Activated	datetime	The timestamp when the user status transitioned to `ACTIVE`.
StatusChanged	datetime	The timestamp when the status of the user last changed.
LastLogin	datetime	The timestamp of the last login.
LastUpdated	datetime	The timestamp when the user was last updated.
PasswordChanged	datetime	The timestamp when the user's password was last updated.
BatchDate	datetime	ETL-specific field: Timestamp when this record was processed in the ETL batch.

OktaUserTypes

Contains metadata describing the different user type definitions configured in Okta.

Name	Type	Description
ConfigID	integer	ETL-specific field: Multi-tenant configuration identifier for the Okta integration instance.
UserTypeID	string	The unique key for the user type.
DisplayName	string	The human-readable name of the user type.
Name	string	The name of the user type.
Description	string	The human-readable description of the user type.
LastUpdatedBy	string	The user ID of the most recent account to edit the user type.
CreatedBy	string	The user ID of the account that created the user type.
Created	datetime	A timestamp from when the user type was created.
LastUpdated	datetime	A timestamp from when the user type was most recently updated.
BatchDate	datetime	ETL-specific field: Timestamp when this record was processed in the ETL batch.

Bridge Tables

OktaGroups_OktaUsers

Maps user membership relationships to groups within an Okta tenant.

Name	Type	Description
ConfigID	integer	ETL-specific field: Multi-tenant configuration identifier for the Okta integration instance.
GroupID	string	Unique ID for the group.
UserID	string	Unique ID for the user.

OktaPolicies_OktaGroups

Links Okta policies to the groups they apply to within the tenant.

Name	Type	Description
ConfigID	integer	ETL-specific field: Multi-tenant configuration identifier for the Okta integration instance.
PolicyID	string	Identifier of the policy.
GroupID	string	Unique ID for the group.
Relation	string	Relation of the group to the policy. Common values: `INCLUDE`, `EXCLUDE`.
BatchDate	datetime	ETL-specific field: Timestamp when this record was processed in the ETL batch.

OktaRoles_OktaUsers

Represents the assignment relationships between Okta roles and the users who hold them.

Name	Type	Description
ConfigID	integer	ETL-specific field: Multi-tenant configuration identifier for the Okta integration instance.
RoleID	string	Identifier of the role.
UserID	string	Identifier of the user.