Built to fit where Okta already is.
Your apps speak standards and your scripts speak Okta’s API. IdRa speaks both.
curl -G "https://acme.idra.team/api/v1/users" \
-H "Authorization: SSWS $TOKEN" \
--data-urlencode 'search=profile.email sw "ana"' \
-d limit=1
# HTTP 200
# Link: <…/api/v1/users?…>; rel="self"
# X-Rate-Limit-Limit: 600[
{
"id": "9guA0JYo2KkokOCeGfO8CBp6JpAJaErl",
"status": "ACTIVE",
"type": {
"id": "default"
},
"profile": {
"firstName": "Ana",
"lastName": "Rivera",
"email": "ana@example.com",
"login": "ana@example.com"
}
}
]Standards.
If an app works with Okta through one of these, it connects to IdRa the same way.
- SAML 2.0 Included
- SP- and IdP-initiated sign-on as an identity provider, metadata, attribute statements, signed requests, ForceAuthn, RSA-SHA256 or RSA-SHA512, extra ACS URLs, encrypted assertions, per-app signing keys and app-started Single Logout.
- OpenID Connect, OAuth 2.1 Included
- Code + PKCE, refresh, client credentials, device code, discovery, userinfo, introspection, revocation, back-channel logout, private_key_jwt, DPoP, PAR, signed request objects, on-behalf-of token exchange, JWT bearer and dynamic client registration. We run the OpenID conformance suite ourselves, with no failures.
- SCIM 2.0 Included
- Inbound server for users and groups, with PATCH and deprovisioning. Outbound client with create, update, deactivate, reactivate, opt-in delete, group push and app imports.
- WebAuthn and passkeys Included
- Phishing-resistant MFA with passkeys and security keys, at sign-in and step-up.
- Shared Signals (SSF, CAEP, RISC) Included
- Transmitter by push (RFC 8935) or poll (RFC 8936). Receiver accepts CAEP, RISC and Okta’s risk events.
- Global Token Revocation Included
- Calls draft-parecki-oauth-global-token-revocation endpoints during global sign-out.
- TOTP Included
- Any standard authenticator app.
The Okta-compatible API.
Under /api/v1, IdRa answers 185 operations in Okta’s Node SDK, following Okta’s authentication, cursor paging, error bodies and rate-limit headers.
| Resource | Endpoints |
|---|---|
| Users | /users, lifecycle, revoke sessions, list and delete factors, roles, groups, appLinks |
| Groups | /groups, members, apps |
| Group rules | /groups/rules, lifecycle |
| Apps | /apps, lifecycle, users, groups, policies, grants |
| Authorization servers | /authorizationServers, scopes, claims, policies, rules |
| Policies | /policies for sign-on, access and password types, with rules |
| Network zones | /zones |
| Devices | /devices |
| Event hooks | /eventHooks, lifecycle and verify |
| Logs | /logs, with filter, search and polling |
| User risk | /users/{id}/risk |
| Log streams | /logStreams |
Okta’s SDKs work with IdRa.
Change the issuer URL and keep your code. The SDK guide walks through it.
Moving off Okta, without a big bang.
People set a fresh password and enroll their factors in IdRa, and you can run both side by side while you move.
Look at what you have
Connect the Okta posture connector to inventory accounts, admins and MFA gaps.
Federate first
Add Okta as an OIDC or SAML identity provider so people keep signing in there and get IdRa accounts just in time. To connect people who already have an IdRa account, turn on linking for that provider and prove the allowed domains with a DNS TXT record.
Bring the rest across
Run the Okta importer, import a CSV or push users over SCIM. Then set up group rules, assign apps and activate people. Scripts can also do this through
/api/v1.Move apps one at a time
Point each SAML or OIDC app at its new IdRa issuer and metadata, then test it with a small group.
Switch sign-in over
Have people enroll passkeys or other factors in IdRa, then retire the federation.
Common questions.
Can I use Okta’s Terraform provider?
Yes, the Okta Terraform provider works with IdRa, using an API token. The migration guide lists the supported resources.
What happens to passwords and factors?
People set a fresh password and enroll their factors in IdRa when you activate them, or keep signing in through Okta while you federate.
Can I import from my Okta org?
Yes. The importer previews, then copies users, Okta-managed groups and apps with a read-only token, which it keeps encrypted only while the read runs. Read what it covers.
Do integrations built for Okta’s security-events endpoint work?
Yes. Point the partner integration at /ssf/events.
Which tokens does the API accept?
SSWS tokens from Security → API → Tokens, and OAuth access tokens with okta.* scopes from service apps. Both act with their admin’s current role.
Create your organization.
Pick an address and confirm your email, then sign in as its first admin. A setup wizard takes you through the rest.
