Okta Developer Docs Release Notes (Classic Engine)

Weekly release 2025.10.1

Mon, 20 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Bug fixed in 2025.10.1	October 15, 2025

Bug fixed in 2025.10.1

When an admin attempted to update the signing certificate for an Org2Org IdP integration, an error was returned. (OKTA-1035340)

Monthly release 2025.10.0

Sun, 19 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Org2Org OIDC Sign-on mode is GA in Production	October 8, 2025
User status in Okta Expression Language is GA in Preview	October 8, 2025
Network zone restrictions for clients is GA in Preview	October 8, 2025
Okta Integration IdP type is GA in Production	October 8, 2025
Behavior Detections for new ASN	October 8, 2025
Developer documentation update in 2025.10.0	October 8, 2025

Org2Org OIDC Sign-on mode is GA in Production

The Org2Org app now includes an OIDC Sign-on mode using the Okta Integration IdP. This sign-on mode reduces the complexity of configuration between the Org2Org app and the target org, and takes advantage of modern security features of OIDC. See Secure API connections between orgs with OAuth 2.0.

User status in Okta Expression Language is GA in Preview

You can now reference User Status in the Okta Expression Language. Group Rules can leverage user statuses to drive group membership. Use the user.getInternalProperty('status') function to get the status of a user. See Okta user ID and status.

Network zone restrictions for clients is GA in Preview

You can now specify an allowlist or denylist network zone for each client to enhance OIDC token endpoint security.

Okta Integration IdP type is GA in Production

The new Okta Integration IdP type allows you to configure Org2Org OIDC IdPs with secure defaults. See Identity Providers.

Behavior Detections for new ASN

Admins have been able to create behavior detections for IP, Velocity, Location, or Device. This new functionality introduces behavior detection on a new ASN (Autonomous System Number), based on the IP found in the request tied to the event. See Add an ASN behavior.

Developer documentation update in 2025.10.0

The Create an API token guide has been moved from the Sign users in > Basics section to the API Security section of the Guides sidebar.

September

Weekly release 2025.09.2

Sat, 18 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Bugs fixed in 2025.09.2	October 1, 2025

Bugs fixed in 2025.09.2

+
Users couldn't access the IdP if the protocol.algorithms.response.signature value was missing from the response payload when the IdP was created. (OKTA-987923)
+
+
When you retrieved a factor’s transaction status (GET /users/{userId}/factors/{factorId}/transactions/{transactionId}), the request didn’t correctly validate that the userId matched the transactionId. (OKTA-969072)
+
+
When enrolling a phone factor (POST /users/{userId}/factors), an "Invalid Phone Number" error was sometimes incorrectly returned. (OKTA-1024021)
+

Weekly release 2025.09.1

Fri, 17 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
New functionality filters in the OIN catalog	September 17, 2025
Bugs fixed in 2025.09.1	September 17, 2025

New functionality filters in the OIN catalog

The Browse App Integration Catalog page now provides Cross App Access and Privileged Access Management functionality filters. The new filters help admins quickly find Cross App Access- and Privileged Access Management-enabled apps in the OIN.

Bugs fixed in 2025.09.1

+
When an error occurred during token encryption, a signed JWT was returned instead of an error. (OKTA-987783)
+
+
Users could submit OIN integrations with incomplete or invalid information. (OKTA-897453)
+

Monthly release 2025.09.0

Thu, 16 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
User API Projections	September 10, 2025
Org2Org OIDC Sign-on mode is GA in Preview	June 17, 2025
Anything-as-a-Source for groups and group memberships API is EA in Preview	September 10, 2025
New System Log events for bulk groups and bulk group memberships changes	September 10, 2025
Breached Credentials Protection is GA in Production	May 15, 2025
Group Push Mappings is GA in Production	August 7, 2025
New validation rule for integration variables in the OIN Wizard	September 10, 2025
Clear user factors for all devices is GA in Production	August 7, 2025
Secure Identity Integrations filters in the OIN catalog	September 10, 2025
Okta Integration IdP type is GA in Preview	June 25, 2025
User status in Okta Expression Language is GA in Preview	September 10, 2025
Developer documentation update in 2025.09.0	September 10, 2025

User API Projections

You can now use the fields query parameter with the list users endpoint (GET /api/v1/users/). This parameter lets you specify properties to return for users meeting the search criteria.

Org2Org OIDC Sign-on mode is GA in Preview

Anything-as-a-Source for groups and group memberships API is EA in Preview

Anything-as-a-Source (XaaS) capabilities allow customers to use a custom identity source with Okta. With XaaS, customers can connect a custom HR app or a custom database to source entities such as users into Okta’s Universal Directory. This release offers XaaS capabilities with groups and group memberships, allowing customers to start sourcing groups with XaaS. Okta now enables creating and updating users, creating and updating groups, and managing group memberships into Okta’s Universal Directory from any identity source using the Identity Source APIs. See Identity Sources.

New System Log events for bulk groups and bulk group memberships changes

The following new System Log events indicate when bulk group and bulk group memberships Identity Sources API are called:

system.identity_sources.bulk_group_upsert
system.identity_sources.bulk_group_delete
system.identity_sources.bulk_group_membership_upsert
system.identity_sources.bulk_group_membership_delete

Breached Credentials Protection is GA in Production

Protect your org from the impact of credentials that have been compromised. If Okta determines that a username and password combination has been compromised after being compared to a third-party curated dataset, the protection response is customizable through password policies, including resetting the user's password, forcing a logout, or calling a delegated Workflow. See the Okta Policies API.

This feature is following a slow rollout process.

Group Push Mappings is GA in Production

With the API for Group Push, admins can now programmatically create, link, or manage group push configuration in Okta. This allows admins to configure Okta groups to be pushed to connected apps at scale and reduces overhead for large deployments. See Group Push Mappings API.

New validation rule for integration variables in the OIN Wizard

The OIN Wizard now validates each integration variable name and displays an error if a reserved name is used.

Clear user factors for all devices is GA in Production

When you make a Revoke all user sessions (/api/v1/users/{userId}/sessions) request, include the new forgetDevices parameter (with a value of true) to clear a user's remembered factors on all devices. The user is prompted for full authentication on their next sign-in attempt from any device. The forgetDevices parameter is set to false by default.

Secure Identity Integrations filters in the OIN catalog

The Browse App Integration Catalog page now provides three new Secure Identity Integrations checkboxes: Secure Identity Integrations - Fundamental, Secure Identity Integrations - Advanced, and Secure Identity Integrations - Strategic. When you select one, the OIN catalog displays only the apps with that specific functionality.

Okta Integration IdP type is GA in Preview

The new Okta Integration IdP type allows you to configure Org2Org OIDC IdPs with secure defaults. See Identity Providers.

User status in Okta Expression Language is GA in Preview

You can now reference User Status in the Okta expression language. Group Rules can leverage user statuses to drive group membership. Use the user.getInternalProperty('status') function to get the status of a user. See Okta user ID and status.

Developer documentation update in 2025.09.0

+
The revocation and revocationCacheLifetime properties that are used with the Mutual TLS protocol in the Identity Providers API are now deprecated. Okta now handles CRL caching automatically.
+
As of October 8, 2025, in Preview orgs, and October 13, 2025, in Production orgs, these properties are ignored if they’re specified in any API requests. Specifying the properties in your API requests doesn't cause any errors since they have no effect.
+
See Deprecation Notice - Smart Card IdP Legacy CRL Cache Setting.
+
+
Best practice implementations of API use cases are now available for Identity Governance. See Identity Governance in the Guides sidebar.
+
+
Okta Identity Governance campaigns and entitlements can now be managed using the Okta Terraform Provider. This enables customers to manage their governance tasks and configure other resources in their Okta org that are maintained through the Terraform Infrastructure-as-Code tool. For more information, refer to Terraform Provider for Okta and the Terraform Registry documentation.
+

August

Weekly release 2025.08.4

Wed, 15 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Bugs fixed in 2025.08.4	September 4, 2025

Bugs fixed in 2025.08.4

+
Admins were sometimes unable to enroll custom TOTP factors (POST /users/{userId}/factors). (OKTA-1007379)
+
+
Sometimes the /userinfo endpoint returned an error if the EA federated claims feature was enabled. (OKTA-1007745)
+

Weekly release 2025.08.2

Tue, 14 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Bugs fixed in 2025.08.2	August 20, 2025

Bugs fixed in 2025.08.2

+
Some app groups that were deleted were still visible in searches. This fix will be slowly made available to all orgs. (OKTA-972614)
+
+
When an app was deleted, group push rules weren't deleted and would sometimes trigger erroneous System Log entries. This fix will be slowly made available to all orgs. (OKTA-881642)
+

Monthly release 2025.08.0

Mon, 13 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Breached Credentials Protection is GA in Preview	May 15, 2025
Clear user factors for all devices is GA in Preview	August 7, 2025
Encryption of ID tokens and access tokens is EA	August 7, 2025
Expanded use of user.getGroups() function in Okta Expression Language is GA in Production	June 4, 2025
Group Push Mappings is GA in Preview	August 7, 2025
Multiple active IdP signing certificates is EA	August 7, 2025
New user profile permission	August 7, 2025
OAuth 2.0 provisioning for Org2Org with Autorotation is GA in Production	April 2, 2025
Service Accounts API is EA	August 7, 2025
Unified claims generation for custom apps is self-service EA in Preview	July 30, 2025
Web app integrations now mandate the use of the Authorization Code flow	August 7, 2025
Developer documentation updates in 2025.08.0	August 7, 2025

Breached Credentials Protection is GA in Preview

Clear user factors for all devices is GA in Preview

When you make a Revoke all user sessions (/api/v1/users/{userId}/sessions) request, include the new forgetDevices parameter (with a value of true) to clear a user's remembered factors on all devices. The user is prompted for full authentication on their next sign-in attempt from any device. The forgetDevices parameter is set to false by default.

Encryption of ID tokens and access tokens is EA

You can now encrypt OIDC ID tokens for Okta-protected custom app integrations using JSON Web Encryption. You can also now encrypt access tokens minted by a custom authorization server. See Key management.

Expanded use of user.getGroups() function in Okta Expression Language is GA in Production

You can now use the user.getGroups() function across all features that support Expression Language. See Group functions.

Group Push Mappings is GA in Preview

Multiple active IdP signing certificates is EA

Okta now supports multiple active signing certificates for a single SAML identity provider (IdP), enabling seamless certificate rotation with zero downtime. Use the new additionalKids parameter to add another signing certificate for the IdP. You can upload up to two certificates per IdP connection. This improvement eliminates the need for tightly coordinated swaps with IdP partners and reduces the risk of authentication failures due to expired certificates.

New user profile permission

A new user profile permission (okta.users.userprofile.read) is now available that allows granular read-only access to the user profile. See Permissions.

OAuth 2.0 provisioning for Org2Org with Autorotation is GA in Production

Admins deploying multi-org architectures (for example Okta hub-and-spoke orgs) need to secure user and group provisioning. Provisioning using OAuth2.0 scoped tokens has several advantages over API tokens, including more access granularity, shorter token lifespans, and automatic key rotation. You can now enable OAuth 2.0 Auto-Rotation for Org2Org app provisioning directly from the Admin Console, in addition to the API.

To support these updates, the Application Connections API includes a new endpoint, Retrieve a JSON Web Key Set (JWKS) for the default provisioning connection, and schema updates to support token autorotation, rotationMode=AUTO. See Update the default provisioning connection and Integrate Okta Org2Org with Okta.

Service Accounts API is EA

The new Service Accounts API is now available for Okta Privileged Access-enabled orgs. This API allows you to manage SaaS or On-Prem Provisioning (OPP) app accounts. App accounts that you create through the Service Accounts API are visible to resource admins in the Okta Privileged Access dashboard. See Manage service accounts in the Okta Privileged Access product documentation.

This feature is available only if you're subscribed to Okta Privileged Access. Ensure that you've set up the Okta Privileged Access app before creating app accounts through the API.

Unified claims generation for custom apps is self-service EA in preview

Unified claims generation is a new streamlined interface for managing claims (OIDC) and attribute statements (SAML) for Okta-protected custom app integrations. In addition to group and user profile claims, the following new claim types are available: entitlements (required OIG), device.profile, session.id, and session.amr. Collection projections in Expression Language can also be used to get claims information. See Okta Expression Language in Identity Engine.

Web app integrations now mandate the use of the Authorization Code flow

To enhance security, web app integrations now mandate the use of the Authorization Code flow, as the Implicit flow is no longer recommended. See Build a Single Sign-On (SSO) integration.

Developer documentation updates in 2025.08.0

The Archived Okta Identity Governance API changelog (2023-2024) has been removed. For updates on these APIs, see the Okta Identity Governance API release notes.

July

Weekly release 2025.07.3

Sun, 12 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Bugs fixed in 2025.07.3	July 30, 2025

Bugs fixed in 2025.07.3

Okta displayed different error messages for valid and invalid usernames after failed sign-in attempts (failed POST /authn/factors/{factorIdOrFactorType}/verify requests). (OKTA-958229)
The List all user grants operation (/api/v1/users/me/grants) didn't include pagination links in the header of the response. (OKTA-918661)
The Attack Protection API endpoints returned HTTP 404 Not Found errors unless -admin was appended to your org subdomain in the URL path. You can now use your standard org subdomain in the URL path when using the Attack Protection API. (OKTA-925650)

Weekly release 2025.07.1

Sat, 11 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Bugs fixed in 2025.07.1	July 9, 2025

Bugs fixed in 2025.07.1

The multiple identifiers feature didn't process case sensitivity correctly when evaluating identifier attributes. (OKTA-899235)
When GET /api/v1/apps/{appId} is called, admins with the okta.groups.appAssignment.manage permission or okta.users.appAssignment.manage permission could view app details without having the required okta.apps.manage or okta.apps.read permissions. (OKTA-801567)

Monthly release 2025.07.0

Fri, 10 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
OAuth 2.0 provisioning for Org2Org with key auto-rotation is GA in Preview	July 2, 2025
System Log event for monitoring LDAP Agent config file changes is EA	July 2, 2025
New validation rule for user profile attributes in OIN Wizard	July 2, 2025
Conditions for create user permission is GA in Production	June 9, 2025
Changes to Okta app API responses	July 7, 2025
Restrict access to the Admin Console is GA in Production	December 11, 2024
Developer documentation updates in 2025.07.0	July 2, 2025
Bug fixed in 2025.07.0	July 2, 2025

OAuth 2.0 provisioning for Org2Org with key auto-rotation is GA in Preview

Admins deploying multi-org architectures (for example, Okta hub-and-spoke orgs) need to secure user and group provisioning. Provisioning using OAuth2.0 scoped tokens has several advantages over API tokens, including more access granularity, shorter token lifespans, and automatic key rotation. You can now enable OAuth 2.0 Auto-Rotation for Org2Org app provisioning directly from the Admin Console, in addition to the API.

To support these updates, the Application Connections API includes a new endpoint, Retrieve a JSON Web Key Set (JWKS) for the default provisioning connection, and schema updates to support key auto-rotation, rotationMode=AUTO. See Update the default provisioning connection and Integrate Okta Org2Org with Okta.

System Log event for monitoring LDAP Agent config file changes is EA

A system.agent.ldap.config_change_detected event is generated when an LDAP agent detects changes to its configuration file.

New validation rule for user profile attributes in OIN Wizard

The OIN Wizard now requires the use of valid user profile properties when referencing attribute values in EL expressions. The system rejects any invalid user EL expressions and attributes that aren't included in the allowlist. See SAML properties.

Conditions for create user permission is GA in Production

You can now add conditions to the okta.user.create permission for custom admin roles. This enables you to granularly control which user attributes admins can set values for during user creation. See Permissions conditions.

Changes to Okta app API responses

The following Okta apps won't be returned in the API response for endpoints that list apps (such as the List all applications GET /api/vi/apps endpoint):

Okta Access Certifications (key name: okta_iga)
Okta Access Requests Admin (key name: okta_access_requests_admin)
Okta Entitlement Management (key name: okta_entitlement_management)

In addition, a single app retrieval endpoint won't return these apps either. For example: GET /api/v1/apps/{appId} won't return the app object if {appId} is the ID for the okta_iga, okta_access_requests_admin, or okta_entitlement_management apps in your org.

Restrict access to the Admin Console is GA in Production

By default, users and groups with assigned admin roles have access to the Admin Console app. With this feature, super admins can choose to manually assign the app to delegated admins instead. This is recommended for orgs with admins who don't need access, like business partners, third-party admins, or admins who only use the Okta API. See Configure administrator settings and the corresponding APIs: Retrieve the Okta Admin Console Assignment Setting and Update the Okta Admin Console Assignment Setting.

Developer documentation updates in 2025.07.0

+
The Okta Admin Management APIs have been reorganized into functional service groups for improved navigation and user experience. All previous anchors and links to the APIs remain the same.
+
+
The Agent Pools API has been renamed Directory Agent Pools API and is now grouped under External Identity Sources. There are no other changes to the API. All previous anchors and links to the API remain the same.
+
+
The Password import inline hook guide was revised to demonstrate the hook call using the ngrok utility, rather than the sample code hosted on Glitch.com. The hosted sample app on Glitch is scheduled for deprecation on July 8th, 2025.
+

Bug fixed in 2025.07.0

Admins couldn't modify the classicFooterHelpTitle object on their sign-in page when sending PUT requests to these endpoints.

/api/v1/brands/{brandId}/pages/sign-in/customized
/api/v1/brands/{brandId}/pages/sign-in/preview
/api/v1/brands/{brandId}/pages/sign-in/default

GET requests didn't return the object either. (OKTA-917840)

June

Weekly release 2025.06.2

Thu, 09 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Network zone restrictions for clients is self-service EA in Preview	Jun 25, 2025
Org2Org OIDC Sign-on mode is self-service EA in Preview	Jun 17, 2025
Okta Integration IdP type is self-service EA in Preview	Jun 25, 2025
Bugs fixed in 2025.06.2	Jun 25, 2025

Network zone restrictions for clients is self-service EA in Preview

You can now specify an allowlist or denylist network zone for each client to enhance token endpoint security.

Org2Org OIDC Sign-on mode is self-service EA in Preview

The Org2Org app now includes an OIDC Sign-on mode using the Okta Integration IdP. This sign-on mode reduces the complexity of configuration between the Org2Org app and the target org, and takes advantage of modern security features of OIDC. You also need to enable the Okta Integration IdP feature to use the OIDC Sign-on mode. See Secure API connections between orgs with OAuth 2.0.

Okta Integration IdP type is self-service EA in Preview

The new Okta Integration IdP type allows you to configure Org2Org OIDC IdPs with secure defaults. See Identity Providers and Add an Okta Identity Provider.

Bugs fixed in 2025.06.2

+
When an app with imported app groups was deactivated, and users were subsequently removed from these groups, the event wasn't recorded in the System Log. (OKTA-934264)
+
+
The delete operation for the Roles API (/iam/roles/{roleIdOrLabel}) and the Resource Sets API (/iam/resource-sets/{iamPolicyIdOrLabel}) allowed users to delete IAM-based standard roles and resource sets, respectively. (OKTA-926830)
+
+
The expiry time of one-time verification code emails didn't appear in the message. (OKTA-911703)
+
+
Using a private/public key for client authentication with an empty kid in the assertion threw a null pointer exception if there was an invalid use parameter in the key. (OKTA-963932)
+

Weekly release 2025.06.1

Wed, 08 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Frame-ancestors rollout for Content Security Policy	Jun 17, 2025
Bugs fixed in 2025.06.1	Jun 17, 2025

Frame-ancestors rollout for Content Security Policy

Okta is rolling out the frame-ancestors directive of the Content Security Policy (CSP) for the /auth/services/devicefingerprint and /api/v1/internal/device/nonce endpoints. To prevent blocking access to these endpoints from embedded frames, add any embedder origin as a trusted origin. See the Trusted Origins API.

In addition, Okta is rolling out the use of nonce with the script-src directive of the CSP for the /auth/services/devicefingerprint. To prevent blocking inline scripts that you may have injected on the page returned by this endpoint, allowlist your inline script to account for the nonce addition to script-src.

Bugs fixed in 2025.06.1

+
When calling the Replace the resource set resource conditions endpoint, /api/v1/iam/resource-sets/{resourceSetIdOrLabel}/resources/{resourceId}, including an empty body didn't remove conditions. (OKTA-947764)
+
+
The Directories Integration API for AD Bidirectional Group Management returned a 500 error because of a null pointer exception. (OKTA-948743)
+
+
User grants weren't returned from the Users API (/users/clients//grants) after revoking user sessions and OAuth 2.0 tokens. (OKTA-944549)
+
+
Users could sometimes receive too many password reset emails. (OKTA-916357)
+
+
App logos could be added or updated using any SVG format. See Application Logos. (OKTA-876028)
+

Monthly release 2025.06.0

Tue, 07 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Admins prevented from deleting published app instances	June 4, 2025
Authentication claims sharing between Okta orgs is GA in Production	May 7, 2025
Claims sharing between third-party IdPs and Okta is GA in Production	April 9, 2025
Conditions for create user permission	June 9, 2025
Define default values for custom user attributes is GA in Production	May 7, 2025
Domain restrictions on Realms is GA in Production	April 23, 2025
Number matching challenge with the Factors API is GA in Production	April 9, 2025
Restrict access to the Admin Console is GA in Preview	December 11, 2024
Expanded use of user.getGroups() function in Okta Expression Language is GA in Preview	June 4, 2025
Developer documentation updates in 2025.06.0	June 4, 2025
Bug fixed in 2025.06.0	June 4, 2025

Admins prevented from deleting published app instances

When an app instance has the Published version status in OIN Wizard, admins can no longer delete it from the Integrator Free Plan org.

Authentication claims sharing between Okta orgs is GA in Production

Authentication claims sharing allows an admin to configure their Okta org to trust claims from IdPs during SSO. Sharing claims also allows Okta to interpret the authentication context from an IdP. This helps eliminate duplicate factor challenges during user authentication and helps improve security posture. See Configure claims sharing.

Claims sharing between third-party IdPs and Okta is GA in Production

Authentication claims sharing allows an admin to configure their Okta org to trust claims from third-party IdPs during SSO. Sharing claims also allows Okta to interpret the authentication context from a third-party IdP. This helps eliminate duplicate factor challenges during user authentication and helps improve security posture. See Configure claims sharing.

Conditions for create user permission

Define default values for custom user attributes is GA in Production

You can now define default values for custom attributes in a user profile. See the Update User Profile endpoint in the Schemas API.

Domain restrictions on Realms is GA in Production

You can now limit users to a specific domain in Realms, which adds an extra layer of oversight for realm and partner admins and enforces boundaries between user populations. See the Realms and Realm Assignments APIs.

Number matching challenge with the Factors API is GA in Production

You can now send number matching challenges for Okta Verify push factor enrollments when you send POST requests to the /users/{userId}/factors/{factorId}/verify endpoint. For orgs that can't adopt Okta FastPass, this feature improves their overall security. See the Factors API.

Restrict access to the Admin Console is GA in Preview

Expanded use of user.getGroups() function in Okta Expression Language is GA in Preview

You can now use the user.getGroups() function across all features that support Expression Language. See Group functions.

Developer documentation updates in 2025.06.0

+
The Email Customization API has been relabelled as the Org Email Settings API. There are no other changes to the API. All previous anchors and links to the API remain the same.
+
+
New release notes for Okta Privileged Access APIs are now available.
+

Bug fixed in 2025.06.0

An HTTP 500 error occurred when API requests were sent to api/v1/policies/{policyId} and api/v1/policies/{policyId}/rules/{ruleID} with certain values in the Accept header. (OKTA-892315)

May

Weekly release 2025.05.3

Mon, 06 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Integrator Free Plan org now available	May 22, 2025
Bugs fixed in 2025.05.3	May 29, 2025

Integrator Free Plan org now available

The Integrator Free Plan org is now available on the Sign up page of the developer documentation site. These orgs replace the previous Developer Editions Service orgs, which will start being deactivated on July 18th. See Changes Are Coming to the Okta Developer Edition Organizations. For information on the configurations for the Integrator Free Plan orgs, see Okta Integrator Free Plan org configurations.

Bugs fixed in 2025.05.3

When enrolling an sms factor (POST /users/{userId}/factors), an Invalid Phone Number error was sometimes incorrectly returned. (OKTA-923373)

Weekly release 2025.05.1

Sun, 05 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Bugs fixed in 2025.05.1	May 14, 2025

Bugs fixed in 2025.05.1

+
When Okta-to-Okta claims sharing was enabled for a Classic Engine org to an Identity Engine org flow, and the State Token for All Flows feature flag was enabled in the Classic Engine org, users were prompted for MFA on the Identity Engine org when MFA had already been completed on the Classic Engine org. (OKTA-932454)
+
+
An error appeared for some Org2Org users after they completed multifactor authentication when Claims Sharing was enabled. (OKTA-932402)
+
+
In some situations, the /api/v1/agentPools API failed to return agents that were stuck in an error state. (OKTA-910056)
+

Monthly release 2025.05.0

Sat, 04 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Breached Credentials Protection is EA in Preview	May 15, 2025
New User Role Targets API endpoint	May 7, 2025
Define default values for custom user attributes	May 7, 2025
Directories integration API is GA in Preview and Production	May 7, 2025
Number matching challenge with the Factors API is GA in Preview	May 7, 2025
Claims sharing between third-party IdPs and Okta is GA in Preview	May 7, 2025
Entitlement claims is GA in Production	January 2, 2025
POST requests to authorize endpoint is GA in Production	January 8, 2025
Authentication claims sharing between Okta orgs is GA in Preview	May 7, 2025
Bugs fixed in 2025.05.0	May 7, 2025

Breached Credentials Protection is EA in Preview

This feature is following a slow rollout process beginning on May 15.

New User Role Targets API endpoint

The User Role Targets API now includes a new endpoint, Retrieve a role target by assignment type, that retrieves role targets by user or group assignment type.

Define default values for custom user attributes

You can now define default values for custom attributes in a user profile. See the Update User Profile endpoint in the Schemas API.

Directories integration API is GA in Preview and Production

The Directories Integration API provides operations to manage Active Directory (AD) group memberships using Okta. This API enables you to define adding or removing users for AD groups. This is now generally available. Previously, this was only available to subscribers of Okta Identity Governance. See Directories Integration.

Number matching challenge with the Factors API is GA in Preview

Claims sharing between third-party IdPs and Okta is GA in Preview

Entitlement claims is GA in Production

You can now enrich tokens with app entitlements that produce deeper integrations. After you configure this feature for your app integration, use the Okta Expression Language in Identity Engine to add entitlements at runtime as OpenID Connect claims and SAML assertions. See Federated claims with entitlements.

POST requests to authorize endpoint is GA in Production

You can now send user data securely in a POST request body to the /authorize endpoint.

Authentication claims sharing between Okta orgs is GA in Preview

Bugs fixed in 2025.05.0

+
If a third-party SAML IdP sent the session.amr SAML attribute without the attribute schema type, Okta rejected the response when the third-party claims sharing feature was enabled. (OKTA-925864)
+
+
When third-party IdP claims sharing was enabled, the redirect to the IdP happened during reauthentication even if the IdP didn't provide any AMR claims. (OKTA-922086)
+

April

Weekly release 2025.04.3

Fri, 03 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Bugs fixed in 2025.04.3	April 30, 2025

Bugs fixed in 2025.04.3

+
Some versions of the Sign-In Widget v3 returned an error when trying to display the consent screen. (OKTA-755616)
+
+
Requests made using the sortBy parameter with custom attributes to the List all users or List all groups endpoints threw an HTTP 400 Bad Request error. (OKTA-886166)
+
+
Some admins with a custom role (okta.apps.read, okta.apps.clientCredentials.read permissions) couldn’t view client secrets for apps that they had permission to view. (OKTA-893511)
+
+
The number of groups that could be returned in tokens for a groups claim was still restricted in the authorization code sign-in flow when an inline hook was used. (OKTA-907362)
+
+
When a resource set contained a devices resource, the Retrieve a resource endpoint returned a null response for the devices self object. (OKTA-914364)
+
+
When the List all Subscriptions API with a Workflows Administrator role (WORKFLOWS_ADMIN) was called, an HTTP 400 Bad Request error was returned. (OKTA-918276)
+
+
Users received an HTTP 400 Bad Request error during self-service registration in preview orgs with a Registration Inline hook. (OKTA-918774)
+
+
When an Okta Classic Engine org was involved in a multi-org Okta-to-Okta authentication flow, and Okta-to-Okta claims sharing was enabled, the OktaAuth (SAML) and okta_auth (OIDC) claims weren't processed correctly. (OKTA-918969)
+

Weekly release 2025.04.2

Thu, 02 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Subscriptions API no longer supports OKTA_ISSUE	April 9, 2025
Bugs fixed in 2025.04.2	April 16, 2025

Subscriptions API no longer supports OKTA_ISSUE

The Subscriptions API no longer supports the notificationType value OKTA_ISSUE.

Bugs fixed in 2025.04.2

+
Email notifications weren’t sent to end users when security methods were enrolled using POST requests to the /users/{userId}/factors endpoint and the activate parameter was set to true. (OKTA-891169)
+
+
Updates made to ACS URIs for an app using the Applications API (PUT /apps/{appId}) didn't take effect if the app was created without those URLs. (OKTA-909218)
+

Weekly release 2025.04.1

Wed, 01 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Claims sharing between third-party IdPs and Okta is self-service EA in Preview	April 9, 2025
Number matching challenge with the Factors API is self-service EA in Preview	April 9, 2025
OAuth 2.0 provisioning for Org2Org with Auto-Rotation is self-service EA in Preview	April 2, 2025
Bugs fixed in 2025.04.1	April 9, 2025

Advanced device posture checks

Advanced posture checks provide extended device assurance to users. It empowers admins to enforce compliance based on customized device attributes that extend beyond Okta’s standard checks. Using osquery, this feature facilitates real-time security assessments across macOS devices. As a result, orgs gain enhanced visibility and control over their device fleet and ensure that only trusted devices can access sensitive resources. See Configure advanced posture checks for device assurance and the Device Posture Checks API.

Claims sharing between third-party IdPs and Okta is self-service EA in Preview

Number matching challenge with the Factors API is self-service EA in Preview

OAuth 2.0 provisioning for Org2Org with Auto-Rotation is self-service EA in Preview

Admins deploying multi-org architectures (for example, Okta hub-and-spoke orgs) need to secure user and group provisioning. Provisioning using OAuth 2.0 scoped tokens has several advantages over API tokens, including more access granularity, shorter token lifespans, and automatic key rotation. You can now enable OAuth 2.0 Auto-Rotation for Org2Org app provisioning directly from the Admin Console, in addition to the API.

Bugs fixed in 2025.04.1

+
In Preview orgs, org admins couldn't edit IdP group assignments when a super admin group was included in the group list. (OKTA-880124)
+
+
The id_token_hint parameter was exposed in the System Log. (OKTA-890738)
+
+
POST requests to the /authorize endpoint that contained query parameters received an error. (OKTA-905143)
+

Monthly release 2025.04.0

Tue, 30 Sep 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Domain restrictions on Realms	April 2, 2025
OAuth 2.0 provisioning for Org2Org with Auto-Rotation is EA in Preview	April 2, 2025
OIN test account information deleted after 30 days	April 2, 2025
POST requests to authorize endpoint is GA Preview	January 8, 2025
Integration variable limit increase in OIN Submission	April 2, 2025
Conditional requests and entity tags are GA in Production	January 16, 2025
New rate limit event type	April 2, 2025
Create dynamic resource sets with conditions is GA in Preview	November 7, 2024
Developer documentation update in 2025.04.0	April 2, 2025
Bugs fixed in 2025.04.0	April 2, 2025

Domain restrictions on Realms

OAuth 2.0 provisioning for Org2Org with Auto-Rotation is EA in Preview

Admins deploying multi-org architectures (for example, Okta hub-and-spoke orgs) need to secure user and group provisioning. Provisioning using OAuth 2.0 scoped tokens has several advantages over API tokens, including more access granularity, shorter token lifespans, and automatic key rotation. You can now enable OAuth 2.0 Auto-Rotation for Org2Org app provisioning directly from the Admin Console, in addition to the API.

To support these updates, the Application Connections API includes a new endpoint, Retrieve a JSON Web Key Set (JWKS) for the default provisioning connection, and schema updates to support token auto-rotation, rotationMode=AUTO. See Update the default provisioning connection and Integrate Okta Org2Org with Okta.

OIN test account information deleted after 30 days

Okta deletes your test account credentials 30 days after you publish your app in OIN Wizard. You must create a new test account and re-enter the required information before submitting the app.

POST requests to authorize endpoint is GA Preview

You can now send user data securely in a POST request body to the /authorize endpoint.

Integration variable limit increase in OIN Submission

The maximum number of integration variables allowed in OIN submission has increased from three to eight. The apps migrated from OIN Manager with more than eight variables can retain all existing variables but can't add new variables.

Conditional requests and entity tags are GA in Production

You can now use conditional requests and entity tags to tag and check for specific versions of resources. Currently this is only available to use with user profiles. See Conditional Requests and Entity Tags.

New rate limit event type

This rate limit event type now appears in the System Log: system.rate_limit.configuration.update. It logs the following:

Changes to client-based rate limit settings
Changes in the rate limit warning notification threshold
If the rate limit notification is enabled or disabled
Updates to the rate-limit percentage of an API token

Create dynamic resource sets with conditions is GA in Preview

Resource set conditions help you limit the scope of a role by excluding an admin's access to certain apps. This gives you more granular control over your custom admin roles and helps meet your org's unique security needs. See Resource set conditions and the corresponding Resource Set Resources API.

Developer documentation update in 2025.04.0

The Update a published integration with the OIN Wizard is a newly restructured guide which consists of our existing publish integration content and a brand new updating the attribute mapping flow section for SCIM integrations.

Bugs fixed in 2025.04.0

+
The result of System Log events triggered by the use_dpop_nonce OAuth 2.0 error was FAILURE instead of CHALLENGE. (OKTA-902314)
+
+
Admins couldn't disable the Trust claims from this identity provider setting. (OKTA-899883)
+
+
Admins using multiple user types sometimes encountered an internal error when attempting to update an app instance. (OKTA-880825)
+
+
A Policies API GET request (/api/v1/policies) returned a rel="next" link when there were no more results. (OKTA-858605)
+
+
The OIN Submission Tester didn't support custom domains in the IdP flow. (OKTA-835402)
+
+
When /api/v1/apps was called, it returned all applications assigned, even though the user wasn't part of the assigned resource set. (OKTA-826548)
+

March

Weekly release 2025.03.3

Mon, 29 Sep 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Advanced search using conditioned profile attributes	March 26, 2025
Bugs fixed in 2025.03.3	March 26, 2025

Advanced search using conditioned profile attributes

If you have an admin role with permission conditions to access certain user profile attributes, you can now search for those users with those attributes. Note that this search enhancement doesn't support the OR operator.

Bugs fixed in 2025.03.3

+
Custom role admins with permission conditions couldn't search for users by firstName or lastName. (OKTA-894392)
+
+
GET requests to the /api/v1/users/me/appLinks endpoint sometimes returned an HTTP 500 Internal Server error. (OKTA-873694)
+

Weekly release 2025.03.2

Sun, 28 Sep 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Bug fixed in 2025.03.2	March 19, 2025

Bug fixed in 2025.03.2

Step-up authentication using the ACR value urn:okta:loa:2fa:any didn't always challenge the user for an additional authentication factor with each /authorize request, even when the user didn't have an upgraded Okta session from initial authentication. (OKTA-754476)

Weekly release 2025.03.1

Sat, 27 Sep 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Bugs fixed in 2025.03.1	March 12, 2025

Bugs fixed in 2025.03.1

+
createdBy and lastUpdatedBy custom attributes couldn't be used in group rules. (OKTA-566492)
+
+
Custom admins who were limited to viewing only application group members received incomplete results when using the List All Users API without a search or filter parameter. (OKTA-801592)
+
+
The JSON Web Token that Okta generates and sends to the OpenID Connect identity provider contained a string exp instead of a number 'exp'. (OKTA-852446)
+
+
When making POST requests to users/{userId}/factors/{factorId}/verify or authn/factors/{factorId}/verify endpoints with factorType instead of factorId in the URL path, multiple failed verification attempts didn't lock users out and the failed attempts weren't logged in the System Log. (OKTA-871469)
+

Monthly release 2025.03.0

Fri, 26 Sep 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
OIDC IdPs now support group sync is GA in Production	October 23, 2024
Granular account linking for certain Identity Providers is GA in Production	December 11, 2024
Improved group search functionality is GA in Production	February 12, 2025
Improved user search functionality is GA in Production	February 12, 2025
Improved realms and device search functionality is GA in Production	February 12, 2025
Realms for Workforce is GA in Production	February 13, 2025
Identity Security Posture Management functionality in the OIN catalog	March 5, 2025
Default global session policy rule update	March 5, 2025
Developer documentation update in 2025.03.0	March 5, 2025
Bug fixed in 2025.03.0	March 5, 2025

OIDC IdPs now support group sync is GA in Production

OpenID Connect identity providers (IdPs) now support full group sync and adding a user to a group that they don't already belong to. A user who authenticates with an external IdP is added to all available groups when Full sync of groups is enabled. The user is added to any groups that they don't already belong to when Add user to missing groups is enabled. This allows you to specify certain groups that users should be added to.

Granular account linking for certain Identity Providers is GA in Production

When admins link users from SAML and OIDC identity providers, they can now exclude specific users and admins. This improves security by allowing admins to configure granular access control scenarios. See Add an external Identity Provider for OpenId Connect and SAML 2.0.

Improved group search functionality is GA in Production

You can now search for groups whose names or descriptions contain specified text. This makes it easier to find a group when you don't recall its exact name. Use the co operator within the search parameter of the Groups API. See Operators and search within the Groups API.

Improved user search functionality is GA in Production

You can now search for users whose names, email addresses, or usernames contain specified text. This makes it easier to do user lookups and add users to groups. Use the co operator within the search parameter of the Users API. See Operators and search within the Users API.

Improved realms and device search functionality is GA in Production

We've extended the contains (co) operator to realms and devices. You can now search for realms and devices whose profile attributes contain specified text through API. This makes lookups easier without needing to recall the exact names of various profile attributes. Use the co operator within the search parameter. See Contains operator and the search parameter in the Realms and Devices APIs.

Realms for Workforce is GA in Production

The Realms and Realms Management APIs allow you to unlock greater flexibility in managing and delegating the management of your distinct user populations within a single Okta org. See Realms and Realm Assignments.

Identity Security Posture Management functionality in the OIN catalog

The Okta Integration Network page now provides Identity Security Posture Management functionality. When you select it, the OIN catalog displays only the apps with Identity Security Posture Management functionality.

Default global session policy rule update

The default value for the maxSessionLifetimeMinutes property of the default global session policy rule is now 1440 (24 hours) and can be changed. Previously the maxSessionLifetimeMinutes property of the default global session policy rule was read-only. +See Policies API.

Developer documentation update in 2025.03.0

The list of public permissions has moved from the Roles in Okta topic to the Permissions in Okta topic. The new topic contains more permission details for you to define your custom admin roles.

Bug fixed in 2025.03.0

Some certificates with trailing characters were uploaded successfully to the /domains/{domainId}/certificate endpoint, despite their invalid format. (OKTA-486406)

February

Weekly release 2025.02.2

Thu, 25 Sep 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Bugs fixed in 2025.02.2	February 20, 2025

Bugs fixed in 2025.02.2

+
An API request to create a resource set with a duplicate name sometimes returned a 5xx error instead of a 4xx error response. (OKTA-867792)
+
+
Admins couldn't retrieve more than five entitlement SAML assertions and OIDC claims when configuring apps. (OKTA-865900)
+
+
The contains (co) operator sometimes gave unclear error messages when using less than three characters or with other operators. (OKTA-846206)
+
+
When an admin attempted to revoke an API token (DELETE /api/v1/api-tokens/{apiTokenId}), and the credential used to authenticate the request was an access_token for a Service client, an HTTP 403 error was returned. (OKTA-844384)
+

Weekly release 2025.02.1

Wed, 24 Sep 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Bugs fixed in 2025.02.1	February 13, 2025

Bugs fixed in 2025.02.1

+
When a GET request was made using the User Grants API (/api/v1/users/{userId}/grants), the response didn't include pagination links in the response header. (OKTA-826775)
+
+
The Users API returned inconsistent responses in Classic Engine orgs that allowed self-service registration and in Identity Engine orgs that were migrated from these orgs. (OKTA-833094)
+
+
In the Admin Console, updates in the code editor that Okta couldn't parse returned a 500 Internal Server Error. (OKTA-837068)
+
+
The On-Behalf of Token Exchange flow was returning the wrong error message when an invalid subject_token_type was requested. (OKTA-841223)
+
+
When a POST request was made (/api/v1/authorizationServers/{authServerId}/policies) to create an authorization policy, the created and lastUpdated properties had a null value. (OKTA-848623)
+
+
Some identity provider API POST (/api/v1/idps) and PUT (/api/v1/idps/{idpId}) requests returned an HTTP 500 error code if the request didn't have the policy.accountLink object in the request body. (OKTA-865143)
+

Monthly release 2025.02.0

Tue, 23 Sep 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
IP Exempt Zone is GA in Preview	October 23, 2024
OIDC IdPs now support group sync is GA in Preview	October 23, 2024
Granular account linking for certain identity providers is GA	December 11, 2024
Realms for Workforce is GA in Preview	February 13, 2025
Improved group search functionality is GA in Preview	February 12, 2025
Improved user search functionality is GA in Preview	February 12, 2025
Support for importing Active Directory group descriptions is GA in Production	February 6, 2025
Developer documentation updates in 2025.02.0	February 6, 2025
Bugs fixed in 2025.02.0	February 6, 2025

IP Exempt Zone is GA in Preview

This feature introduces useAsExemptList as a read-only Boolean property that distinguishes the new default IP exempt zones from other zones. When you enable this feature and you make a GET api/v1/zones request, Okta returns useAsExemptList in the response. The value true indicates that the zone is an exempt zone. Only system generated exempt zones are available.

OIDC IdPs now support group sync is GA in Preview

OpenID Connect (OIDC) identity providers (IdPs) now support full group sync and adding a user to a group that they don't already belong to. A user who authenticates with an external IdP is added to all available groups when Full sync of groups is enabled. The user is added to any groups that they don't already belong to when Add user to missing groups is enabled. This allows you to specify certain groups that users should be added to.

Granular account linking for certain identity providers is GA

Realms for Workforce is GA in Preview

Improved group search functionality is GA in Preview

Improved user search functionality is GA in Preview

You can now search for users whose names, email addresses, or usernames contain specified text. This makes it easier to add users to groups or apps. Use the co operator within the search parameter of the Users API. See Operators and search within the Users API.

Support for importing Active Directory group descriptions is GA in Production

The descriptions of groups sourced from Active Directory now use their description from AD. These replace any previous descriptions of AD-sourced groups in Okta, which used a pretty-printed version of the distinguished name (DN) instead.

Developer documentation updates in 2025.02.0

The OIN Manager: submit an integration guide has been updated to include API service submission instructions.

Bugs fixed in 2025.02.0

When calling deleted app users through the Apps API, the API returned a 500 internal server error instead of a 404 error. (OKTA-832609)
PUT requests (/api/v1/apps/appId) to update an OpenID Connect app took 30 seconds to complete. (OKTA-852488)
When the List all devices API was used with a search query parameter, it sometimes returned outdated records for screenLockType and managementStatus. (OKTA-856387)

January

Weekly release 2025.01.2

Mon, 22 Sep 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Authentication claims sharing between Okta orgs is EA in Preview	January 29, 2025
Bugs fixed in 2025.01.2	January 29, 2025

Authentication claims sharing between Okta orgs is EA in Preview

Bugs fixed in 2025.01.2

When the Default Network Zone IP Exempt List feature was enabled for an org, an admin was able to delete the default example IP zone using the Zones API (/api/v1/zones/{DefaultExemptIpZone ID}). (OKTA-817263)
The List all principal rate limits returned an empty response when querying with a custom client_id and using OAuth 2.0 for authentication. (OKTA-832687)
When a super admin updated a deactivated user to a different realm, admins received a Resource not found error. (OKTA-699778)
Events for tokens revoked in bulk for a resource didn't appear in the System Log. (OKTA-834025)

Weekly release 2025.01.1

Sun, 21 Sep 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Bug fixed in 2025.01.1	January 15, 2025

Bug fixed in 2025.01.1

When an admin attempted to delete an IdP using the SDK, the operation failed with an HTTP 500 response code. (OKTA-846005)

Monthly release 2025.01.0

Sat, 20 Sep 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Additional use case selection in the OIN Wizard	January 8, 2025
Deprecated API endpoints: Extend, Grant, and Revoke Okta Support access	January 8, 2025
Granular configuration for Keep Me Signed In is EA in Preview	January 8, 2025
POST requests to the authorize endpoint is self-service EA	January 8, 2025

Additional use case selection in the OIN Wizard

Independent software vendors (ISVs) can select the following additional use case categories when they submit their integration to the OIN:

Automation
Centralized Logging
Directory and HR Sync
Multifactor Authentication (MFA)

See OIN Wizard use case selection.

Deprecated API endpoints: Extend, Grant, and Revoke Okta Support access

The following API endpoints have been deprecated:

Extend Okta Support access (POST /api/v1/org/privacy/oktaSupport/extend)
Grant Okta Support access (POST /api/v1/org/privacy/oktaSupport/grant)
Revoke Okta Support access (POST /api/v1/org/privacy/oktaSupport/revoke)

Use the Update an Okta Support case endpoint to extend, grant, or revoke Okta Support access for a specific support case. For the corresponding Okta Admin Console feature, see Give access to Okta Support.

Granular configuration for Keep Me Signed In is EA in Preview

Admins can now configure the post-authentication prompt for Keep Me Signed In (KMSI) at a granular level in authentication policies. This allows admins to selectively enable post-authentication KMSI on a per-user, per-group, or per-app basis. When enabled, this feature exposes a frequency setting that lets admins control how often the post-authentication prompt is presented to users. See Configure Keep me signed in (KMSI).

The post-authentication prompt text (title, subtitle, accept button, and reject button) is now customizable through the Brands API. See Customize post-authentication sign-in prompts.

POST requests to the authorize endpoint is Self-Service EA

You can now send user data securely in a POST request body to the /authorize endpoint.

Weekly release 2025.10.1

Mon, 20 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Custom IDV vendors	October 22, 2025
Bugs fixed in 2025.10.1	October 15, 2025

Custom IDV vendors

Okta now supports using custom identity verification (IDV) vendors as identity verification providers. Custom IDV vendors must use a standardized process to integrate with Okta. See Integrate Okta with identity verification vendors. Use the Create an IdP endpoint or the Admin Console to add a custom IDV vendor.

Bugs fixed in 2025.10.1

+
When an admin attempted to update the signing certificate for an Org2Org IdP integration, an error was returned. (OKTA-1035340)
+
+
When a call was made to the User Risk (/api/v1/users/{userId}/risk) endpoint with an OAuth 2.0 access token issued to a service app, the endpoint returned an HTTP 403 "Invalid session" error. (OKTA-1024961)
+
+
The GET /api/v1/sessions/{sessionId} and POST /api/v1/sessions/{sessionId}/lifecycle/refresh operations didn't work for IDX sessions in Identity Engine. When the GET /api/v1/sessions/me and POST /api/v1/sessions/me/lifecycle/refresh endpoints were used with an IDX session, the Session.createdAt property was populated with the user's last sign-in time instead of the actual session creation time. (OKTA-948866)
+
+
Authentication challenges sometimes returned an incorrect app ID when a custom relying party ID was used. (OKTA-1025465)
+

Monthly release 2025.10.0

Sun, 19 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Org2Org OIDC Sign-on mode is GA in Production	October 8, 2025
User status in Okta Expression Language is GA in Production	October 8, 2025
Network zone restrictions for clients is GA in Preview	October 8, 2025
Okta Integration IdP type is GA in Production	October 8, 2025
Behavior Detections for new ASN	October 8, 2025
Temporary Access Code authenticator is GA in Preview	July 16, 2025
Custom admin roles for ITP	May 7, 2025
Enrollment grace periods is GA in Preview	May 21, 2025
Developer documentation update in 2025.10.0	October 8, 2025

Org2Org OIDC Sign-on mode is GA in Production

User status in Okta Expression Language is GA in Production

Network zone restrictions for clients is GA in Preview

You can now specify an allowlist or denylist network zone for each client to enhance OIDC token endpoint security.

Okta Integration IdP type is GA in Production

The new Okta Integration IdP type allows you to configure Org2Org OIDC IdPs with secure defaults. See Identity Providers.

Behavior Detections for new ASN

Temporary Access Code authenticator is GA in Preview

The new Temporary Access Code (TAC) authenticator allows admins to generate temporary codes that let users authenticate in onboarding, account recovery, and other temporary access scenarios. This authenticator enhances security in these scenarios by granting users access to their orgs without having to use their usual authenticators.

To configure the authenticator with Okta APIs, see Temporary access code authenticator integration guide, and to configure it in the Admin Console, see Configure the temporary access code authenticator.

Custom admin roles for ITP is GA in Production

Through this feature, customers can use granular ITP permissions and resources to create custom roles to right-size authorization for ITP configuration and monitoring. See Configure custom admin roles for ITP.

Enrollment grace periods is GA in Preview

Today, when admins define an enrollment policy for a group, the entire group must enroll immediately, which can be disruptive to their day-to-day tasks.

With Enrollment Grace Periods, end users can defer enrollment in new authenticators until an admin-defined deadline when enrollment becomes mandatory. This allows end users to enroll at a time convenient to them and allows for more graceful enrollment before enforcing new authenticator types in authentication policies. See Authenticator enrollment policies and the Policies API.

Developer documentation update in 2025.10.0

+
The new Validate SSO Federation guide explains how to validate your single sign-on (SSO) and Just-In-Time (JIT) provisioning integration, and then test different sign-in flows.
+
+
The Create an API token guide has been moved from the Sign users in > Basics section to the API Security section of the Guides sidebar.
+

September

Weekly release 2025.09.2

Sat, 18 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Bugs fixed in 2025.09.2	October 1, 2025

Bugs fixed in 2025.09.2

+
The DELETE /policies/{policyId}/mappings/{mappingId} operation didn’t work when you used it to delete a resource mapping between an API service app and a policy. (OKTA-1020064)
+
+
Users couldn't access the IdP if the protocol.algorithms.response.signature value was missing from the response payload when the IdP was created. (OKTA-987923)
+
+
When you retrieved a factor’s transaction status (GET /users/{userId}/factors/{factorId}/transactions/{transactionId}), the request didn’t correctly validate that the userId matched the transactionId. (OKTA-969072)
+
+
In the System Log, policy.auth_reevaluate.fail events didn't display risk unless the event was a synchronous flow and the global session policy failed without remediation. (OKTA-1024106)
+
+
When enrolling a phone factor (POST /users/{userId}/factors), an "Invalid Phone Number" error was sometimes incorrectly returned. (OKTA-1024021)
+
+
GET calls for federated users to the /idp/myaccount/authenticators and /idp/myaccount/authenticators/{authenticatorId} endpoints that included an expand=requirements query parameter returned an HTTP 404 Not Found error. (OKTA-1022960)
+

Weekly release 2025.09.1

Fri, 17 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
New functionality filters in the OIN catalog	September 17, 2025
Bugs fixed in 2025.09.1	September 17, 2025

New functionality filters in the OIN catalog

Bugs fixed in 2025.09.1

+
In the System Log, policy.auth_reevaluate.fail events didn't display risk unless the event was a synchronous flow and the global session policy failed without remediation. (OKTA-1017389)
+
+
When an error occurred during token encryption, a signed JWT was returned instead of an error. (OKTA-987783)
+
+
Users could submit OIN integrations with incomplete or invalid information. (OKTA-897453)
+

Monthly release 2025.09.0

Thu, 16 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
User API Projections	September 10, 2025
Org2Org OIDC Sign-on mode is GA in Preview	June 17, 2025
Anything-as-a-Source for groups and group memberships API is EA	September 10, 2025
New System Log events for bulk groups and bulk group memberships changes	September 10, 2025
Breached Credentials Protection is GA in Production	May 15, 2025
Group Push Mappings is GA in Production	August 7, 2025
Default app sign-in policy for API service apps	September 10, 2025
New validation rule for integration variables in the OIN Wizard	September 10, 2025
Clear user factors for all devices is GA in Production	August 7, 2025
New User Authenticator Enrollments API is GA in Production	July 9, 2025
MyAccount WebAuthn API is GA in Production	July 16, 2025
Response body updates for the MyAccount Authenticators API	June 17, 2025
Secure Identity Integrations filters in the OIN catalog	September 10, 2025
Okta Integration IdP type is GA in Preview	June 25, 2025
Send app context to external IdPs is GA in Production	May 21, 2025
New claims supported for identity verification (IDV) vendor integration is self-service EA in Preview	August 13, 2025
Passkey and security key subdomain support is self-service EA in Preview	September 4, 2025
User status in Okta Expression Language is GA in Preview	September 10, 2025
Developer documentation update in 2025.09.0	September 10, 2025

User API Projections

You can now use the fields query parameter with the list users endpoint (GET /api/v1/users/). This parameter lets you specify properties to return for users meeting the search criteria.

Org2Org OIDC Sign-on mode is GA in Preview

Anything-as-a-Source for groups and group memberships API is EA

New System Log events for bulk groups and bulk group memberships changes

The following new System Log events indicate when bulk group and bulk group memberships Identity Sources API are called:

system.identity_sources.bulk_group_upsert
system.identity_sources.bulk_group_delete
system.identity_sources.bulk_group_membership_upsert
system.identity_sources.bulk_group_membership_delete

Breached Credentials Protection is GA in Production

This feature is following a slow rollout process.

Group Push Mappings is GA in Production

Default app sign-in policy for API service apps

API service apps are no longer assigned to the shared default app sign-in policy when they're created.

New validation rule for integration variables in the OIN Wizard

The OIN Wizard now validates each integration variable name and displays an error if a reserved name is used.

Clear user factors for all devices is GA in Production

When you make a Revoke all user sessions (/api/v1/users/{userId}/sessions) request, include the new forgetDevices parameter to clear a user's remembered factors on all devices. The user is prompted for full authentication on their next sign-in attempt from any device. The forgetDevices parameter is set to true by default.

New User Authenticator Enrollments API is GA in Production

The User Authenticator Enrollments API enables admins to manage the specific authenticator enrollments of their users.

Currently, admins in Identity Engine orgs can’t use Okta APIs to manage user authenticator enrollments with the same level of control that’s possible in Classic Engine orgs. This feature helps admins more effectively manage their user’s enrollments and improves parity between Classic Engine and Identity Engine orgs.

MyAccount WebAuthn API is GA in Production

You can now use the MyAccount WebAuthn API to enroll, list, and delete WebAuthn enrollments. Admins can build out an in-app passkey creation and enrollment experience with the MyAccount WebAuthn API operations.

Response body updates for the MyAccount Authenticators API

Two new response properties are now returned for password enrollments when you make GET calls to the /idp/myaccount/authenticators/{authenticatorId}/enrollments/ endpoint. These properties provide more specific insight about password enrollments than the canReset property. The canReset property is now deprecated. It's still functional but it's not recommended for use.

canChangePassword indicates if a user has permission to perform a password change operation.
canResetPassword indicates if a user has permission to perform a password reset operation.

Secure Identity Integrations filters in the OIN catalog

Okta Integration IdP type is GA in Preview

The new Okta Integration IdP type allows you to configure Org2Org OIDC IdPs with secure defaults. See Identity Providers.

Send app context to external IdPs is GA in Production

You can now forward context about an app to an external identity provider (IdP) when a user attempts to access the app. When you set the sendApplicationContext parameter to true for an IdP, the app name and unique instance ID are included in the SAML or OpenID Connect request sent to the external IdP. This enhancement allows external IdPs to make more informed, context-aware authentication decisions, supporting advanced security scenarios, and Zero Trust environments.

New claims supported for identity verification (IDV) vendor integration is self-service EA in Preview

IDV vendors can now use more OpenID Connect claims when they integrate their IDV service with Okta. And, all claims properties now support the fuzzy logic extension. See Supported OIDC claims.

Passkey and security key subdomain support is self-service EA in Preview

You can now set a custom relying party (RP) ID for the WebAuthn authenticator. When you set the domain of a custom RP ID, you can allow users to create a single passkey that’s valid for all of the subdomains of the RP ID.

Use the Replace an authenticator method endpoint to update your WebAuthn authenticator, or set the custom RP ID in the Admin Console. See Configure a relying party ID.

User status in Okta Expression Language is GA in Preview

Developer documentation update in 2025.09.0

+
The new Sign users in through your web app journey helps you connect your web app to Okta and sign your users in and out.
+
+
The new Manage user credentials concept page describes token storage strategies for your app to mitigate risk.
+
+
The new Multifactor authentication concept page explains how MFA works and helps you understand some key terminology when you implement MFA using Okta APIs.
+
+
The new OAuth 2.0 and OIDC claims concept page provides a high-level overview of what claims are, including their types and how they're used in Okta.
+
+
The revocation and revocationCacheLifetime properties that are used with the Mutual TLS protocol in the Identity Providers API are now deprecated. Okta now handles CRL caching automatically.
+
As of October 8, 2025, in Preview orgs, and October 13, 2025, in Production orgs, these properties are ignored if they’re specified in any API requests. Specifying the properties in your API requests doesn't cause any errors since they have no effect.
+
See Deprecation Notice - Smart Card IdP Legacy CRL Cache Setting.
+
+
The new Single Sign-on concept is an overview of SSO, explaining what it is, how it differs from a basic sign-in flow, and how Okta supports it.
+
+
Authentication policies have been renamed and are now known as "app sign-in policies." The term "authentication policies" now refers to a group of policies: app sign-in policies, the Okta account management policy, and the session protection policy.
+
In the Policies API, the policy type for app sign-in policies is still ACCESS_POLICY. There are no changes to the API. All previous anchors and links to the API remain the same.
+
+
Best practice implementations of API use cases are now available for Identity Governance. See Identity Governance in the Guides sidebar.
+
+
Okta Identity Governance campaigns and entitlements can now be managed using the Okta Terraform Provider. This enables you to manage their governance tasks and configure other resources in their Okta org that are maintained through the Terraform Infrastructure-as-Code tool. For more information, refer to Terraform Provider for Okta and the Terraform Registry documentation.
+

August

Weekly release 2025.08.4

Wed, 15 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Bugs fixed in 2025.08.4	September 4, 2025

Bugs fixed in 2025.08.4

+
Admins were sometimes unable to enroll custom TOTP factors (POST /users/{userId}/factors). (OKTA-1007379)
+
+
Sometimes the /userinfo endpoint returned an error if the EA federated claims feature was enabled. (OKTA-1007745)
+
+
The DELETE api/v1/sessions/{sessionId} and POST /api/v1/users/me/lifecycle/delete_sessions operations didn't work for IDX sessions in Identity Engine. (OKTA-948863, OKTA-455249)
+

Weekly release 2025.08.3

Tue, 14 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Bug fixed in 2025.08.3	August 27, 2025

Bug fixed in 2025.08.3

If a SAML IdP response was missing the InResponseTo attribute, OIDC ID tokens that were minted during the same authentication flow sometimes contained the Okta org ID instead of the IdP ID in the idp claim. (OKTA-986463)

Weekly release 2025.08.2

Mon, 13 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Bugs fixed in 2025.08.2	August 20, 2025

Bugs fixed in 2025.08.2

+
Some custom admin roles had different permissions for authentication policies (ACCESS_POLICY) and device signal collection policies (DEVICE_SIGNAL_COLLECTION) and couldn't access or manage device signal collection policies and rules. (OKTA-982043)
+
+
Some app groups that were deleted were still visible in searches. This fix will be slowly made available to all orgs. (OKTA-972614)
+
+
When an app was deleted, group push rules weren't deleted and would sometimes trigger erroneous System Log entries. This fix will be slowly made available to all orgs. (OKTA-881642)
+

Monthly release 2025.08.0

Sun, 12 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Associated Domain Customizations API is self-service EA in Preview	July 16, 2025
Automate SCIM Integration for OIN Apps with Express Configuration	August 7, 2025
Breached Credentials Protection is GA in Preview	May 15, 2025
Clear user factors for all devices is GA in Preview	August 7, 2025
Cross App Access is self-service EA in Preview	August 7, 2025
Custom FIDO2 AAGUID is self-service EA in Preview	July 16, 2025
Device signal collection policy is self-service EA in Preview	August 7, 2025
Encryption of ID tokens and access tokens is EA	August 7, 2025
Expanded use of user.getGroups() function in Okta Expression Language is GA in Production	June 4, 2025
Granular configuration for Keep Me Signed In is GA in Production	January 8, 2025
Group Push Mappings is GA in Preview	August 7, 2025
MyAccount Password API is GA in Production	May 24, 2023
MyAccount WebAuthn API is EA in Production and GA in Preview	July 16, 2025
Multiple active IdP signing certificates is EA	August 7, 2025
New User Authenticator Enrollments API is GA in Preview	July 9, 2025
New user profile permission	August 7, 2025
OAuth 2.0 provisioning for Org2Org with Autorotation is GA in Production	July 2, 2025
Passkeys from Android devices is self-service EA in Preview	July 16, 2025
Send app context to external IdPs is GA in Preview	May 21, 2025
Service Accounts API is EA	August 7, 2025
System Log event for Identity Assertion Authorization Grant (ID-JAG) issuance is EA in Preview	August 7, 2025
System Log updates for ID verification events	August 7, 2025
Temporary Access Code authenticator is self-service EA in Preview	July 16, 2025
Unified claims generation for custom apps is self-service EA in preview	July 30, 2025
Universal Logout in the OIN Wizard	August 7, 2025
Web app integrations now mandate the use of the Authorization Code flow	August 7, 2025
Developer documentation updates in 2025.08.0	August 7, 2025
Bug fixed in 2025.08.0	August 7, 2025

Associated Domain Customizations API is self-service EA in Preview

You can now use the Associated Domain Customizations API to view and update the associated domains of your custom domain. Associated domains let you build a trust relationship among your app, the referring domain, the user's credentials that are associated with that domain, and your brand in Okta. This feature makes it easier to adopt phishing-resistant authenticators, like passkeys in the FIDO2 (WebAuthn) authenticator.

See Customize associated domains.

Automate SCIM Integration for OIN Apps with Express Configuration

Express Configuration is a feature designed to automate the setup of SSO and SCIM for instances of OIN SaaS integrations by enterprise customers with minimal manual effort. It allows enterprise customers to securely configure OIDC and SCIM integrations without copying and pasting configuration values between Okta and Auth0-enabled apps. See Express Configuration.

Breached Credentials Protection is GA in Preview

Clear user factors for all devices is GA in Preview

When you make a Revoke all user sessions (/api/v1/users/{userId}/sessions) request, include the new forgetDevices parameter to clear a user's remembered factors on all devices. The user is prompted for full authentication on their next sign-in attempt from any device. The forgetDevices parameter is set to true by default.

Cross App Access is self-service EA in Preview

Admins can now manage third-party app data sharing with the new Cross App Access feature in the Okta Admin Console. This feature moves complex consent processes away from end-users, enhancing security and streamlining the experience. Once configured, end users can access their data from other SaaS apps without navigating OAuth consent flows. See the Applications Cross Apps Connections API and Configure Cross App Access.

Custom FIDO2 AAGUID is self-service EA in Preview

You can now use the Authenticators API to create, view, and update custom Authenticator Attestation Global Unique Identifiers (AAGUIDs).

Admins can add non-FIDO Metadata Service (MDS) security keys and other authenticators and have more granular control over them. This extends FIDO2 (WebAuthn) authenticator support to a wider range of security keys and other authenticators, which gives admins greater flexibility and control over the security in their environment.

Device signal collection policy is self-service EA in Preview

With the new device signal collection policy, admins can override Okta default behavior and specify how Okta must collect device data, which is then used to evaluate authentication policies.

See Configure a device signal collection policy.

Encryption of ID tokens and access tokens is EA

Expanded use of user.getGroups() function in Okta Expression Language is GA in Production

You can now use the user.getGroups() function across all features that support Expression Language. See Group functions.

Granular configuration for Keep Me Signed In is GA in Production

The post-authentication prompt text (title, subtitle, accept button, and reject button) is now customizable through the Brands API. See Customize post-authentication sign-in prompts.

Group Push Mappings is GA in Preview

MyAccount Password API is GA in Production

You can now use the MyAccount Password API to update passwords.

MyAccount WebAuthn API is EA in Production and GA in Preview

Multiple active IdP signing certificates is EA

New User Authenticator Enrollments API is GA in Preview

The User Authenticator Enrollments API enables admins to manage the specific authenticator enrollments of their users.

New user profile permission

A new user profile permission (okta.users.userprofile.read) is now available that allows granular read-only access to the user profile. See Permissions.

OAuth 2.0 provisioning for Org2Org with Autorotation is GA in Production

Passkeys from Android devices is self-service EA in Preview

Okta now accepts passkeys that are generated by Android devices. Okta associates these passkeys with trusted web domains to enable users to authenticate with them. This expands the number of device types that Okta supports for passkey use.

You can enable Android passkeys by customizing the assetlinks.json file. See Customize associated domains and Add support for Digital Asset Links.

Send app context to external IdPs is GA in Preview

Service Accounts API is EA

This feature is available only if you're subscribed to Okta Privileged Access. Ensure that you've set up the Okta Privileged Access app before creating app accounts through the API.

System Log event for Identity Assertion Authorization Grant (ID-JAG) issuance is EA in Preview

The app.oauth2.token.grant.id_jag event is generated when an app completes an OAuth 2.0 token exchange to get an Identity Assertion Authorization Grant (ID-JAG) JWT.

System Log updates for ID verification events

There are several updates for events related to identity verification:

+
A new event related to ID verification (user.identity_verification.start) can be viewed in the System Log.
+
+
New reasons for the DENY result of the user.identity_verification event have been added.
+
+
Admins can use two new properties (IdvReferenceId and IdvFlowId) to track events related to IDV processes.
+

See Event Types and Identity verification events.

Temporary Access Code authenticator is self-service EA in Preview

Unified claims generation for custom apps is self-service EA in preview

Universal Logout in the OIN Wizard

Universal Logout (UL) in the Okta Integration Network Wizard allows you to build, test, and submit UL functionality to the Okta Integration Network (OIN). Universal Logout lets you terminate users' sessions and revoke their tokens for supported OIN apps, as well as for generic OpenID Connect (OIDC) and Security Assertion Markup Language (SAML) apps. See Submit an integration with the OIN Wizard.

Web app integrations now mandate the use of the Authorization Code flow

To enhance security, web app integrations now mandate the use of the Authorization Code flow, as the Implicit flow is no longer recommended. See Build a Single Sign-On (SSO) integration.

Developer documentation updates in 2025.08.0

+
The Archived Okta Identity Governance API changelog (2023-2024) has been removed. For updates on these APIs, see the Okta Identity Governance API release notes.
+
+
Journeys is a new and evolving section that includes content to help guide you through your development project.
+
Journeys break down your development project into consumable steps:
+
- Key concepts to absorb
- Information on planning for tasks that you need to complete
- Links to individual guides to help you build your project
- Additional content to hep you enhance your project.
+
The first journey available is Secure your first web app. This journey helps you connect your web app to Okta and configure a secure sign-in experience.
+
+
The new Create an app integration guide explains what an app integration is, why you need one, and how to create one.
+
+
The new Direct authentication concept explains what direct authentication is and how you can use it.
+
+
The new Set up your org guide outlines how to set up your Okta org with some basic, but important, settings and how to configure it for different use cases.
+
+
The Sign in to your native mobile app guide describes how to add authentication to your mobile app using the Okta Client SDK for Swift. This example implements a sample iOS app, using Okta APIs and interaction code flow, for browserless authentication.
+
+
The new Sign-In Widget concept provides a high-level overview of the Okta Sign-In Widget.
+
+
The new Understand the token lifecycle concept provides an overview of OAuth 2.0 tokens, their use, and their lifecycles.
+

Bug fixed in 2025.08.0

Some app types were incorrectly assigned to authentication policies. (OKTA-956009)

July

Weekly release 2025.07.3

Sat, 11 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Bugs fixed in 2025.07.3	July 30, 2025

Bugs fixed in 2025.07.3

The List all user grants operation (/api/v1/users/me/grants) didn't include pagination links in the header of the response. (OKTA-918661)
The Attack Protection API endpoints returned HTTP 404 Not Found errors unless -admin was appended to your org subdomain in the URL path. You can now use your standard org subdomain in the URL path when using the Attack Protection API. (OKTA-925650)
Users with case-insensitive usernames didn't match to existing strict case-sensitive users. (OKTA-969228)

Weekly release 2025.07.2

Fri, 10 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Bugs fixed in 2025.07.2	July 16, 2025

Bugs fixed in 2025.07.2

When the Direct Authentication feature was enabled, calling the Apps API with a custom role couldn’t create OIDC apps. (OKTA-970705)
When an admin enabled the Temporary Access Code feature, subsequent GET /users/{userId}/factors requests returned HTTP 400 Bad Request errors. (OKTA-979585)
This update includes security enhancements. (OKTA-909930)

Weekly release 2025.07.1

Thu, 09 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Bugs fixed in 2025.07.1	July 9, 2025

Bugs fixed in 2025.07.1

The multiple identifiers feature didn't process case sensitivity correctly when evaluating identifier attributes. (OKTA-899235)
When GET /api/v1/apps/{appId} is called, admins with the okta.groups.appAssignment.manage permission or okta.users.appAssignment.manage permission could view app details without having the required okta.apps.manage or okta.apps.read permissions. (OKTA-801567)

Monthly release 2025.07.0

Wed, 08 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
OAuth 2.0 provisioning for Org2Org with key auto-rotation is GA in Preview	July 2, 2025
MyAccount Password API is GA in Preview	May 24, 2023
New Okta Expression Language component is self-service EA in Preview	July 2, 2025
System Log event for monitoring LDAP Agent config file changes is EA	July 2, 2025
Integrate Okta with Device Posture Provider	July 2, 2025
New validation rule for user profile attributes in OIN Wizard	July 2, 2025
Conditions for create user permission is GA in Production	June 9, 2025
CLEAR Verified and Incode as third-party identity verification providers is GA in Production	July 2, 2025
Changes to Okta app API responses	July 7, 2025
Restrict access to the Admin Console is GA in Production	December 11, 2024
Developer documentation updates in 2025.07.0	July 2, 2025

OAuth 2.0 provisioning for Org2Org with key auto-rotation is GA in Preview

To support these updates, the Application Connections API includes a new endpoint, Retrieve a JSON Web Key Set (JWKS) for the default provisioning connection, and schema updates to support key auto-rotation, rotationMode=AUTO. See Update the default provisioning connection and Integrate Okta Org2Org with Okta.

MyAccount Password API is GA in Preview

You can now use the MyAccount Password API to update passwords.

New Okta Expression Language component is self-service EA in Preview

You can now use the metadata component in an Expression Language condition for an Okta account management policy. You can only use metadata in an expression that’s related to password expiry. See Enable password expiry.

System Log event for monitoring LDAP Agent config file changes is EA

A system.agent.ldap.config_change_detected event is generated when an LDAP agent detects changes to its configuration file.

Integrate Okta with Device Posture Provider

The Device Posture Provider feature enhances Zero Trust security by integrating external device compliance signals into the Okta policy engine. Previously, Okta couldn't leverage signals from third-party or custom tools to enforce access policies. Now, by accepting SAML/OIDC assertions from external compliance services, admins can incorporate custom compliance attributes into device assurance policies. This enables orgs to use their existing device trust signals within Okta, and foster a more flexible and secure posture without the need for extra agents or redundant tooling. See the Device Integrations API and Integrate Okta with Device Posture Provider.

New validation rule for user profile attributes in OIN Wizard

Conditions for create user permission is GA in Production

CLEAR Verified and Incode as third-party identity verification providers is GA in Production

Okta now supports using Incode and CLEAR Verified as identity providers. This increases the number of identity verification vendors (IDVs) you can use to verify the identity of your users when they onboard or reset their account. Set IDV_INCODE or IDV_CLEAR as the IdP type when you create an IdP.

Changes to Okta app API responses

The following Okta apps won't be returned in the API response for endpoints that list apps (such as the List all applications GET /api/vi/apps endpoint):

Okta Access Certifications (key name: okta_iga)
Okta Access Requests Admin (key name: okta_access_requests_admin)
Okta Entitlement Management (key name: okta_entitlement_management)

Restrict access to the Admin Console is GA in Production

Developer documentation updates in 2025.07.0

+
The Okta Admin Management APIs have been reorganized into functional service groups for improved navigation and user experience. All previous anchors and links to the APIs remain the same.
+
+
A new guide is available that explains how to register security events providers in Okta, which enables continuous sharing of security information with Okta to prevent security threats.
+
+
The Agent Pools API has been renamed Directory Agent Pools API and is now grouped under External Identity Sources. There are no other changes to the API. All previous anchors and links to the API remain the same.
+
+
The Password import inline hook guide was revised to demonstrate the hook call using the ngrok utility, rather than the sample code hosted on Glitch.com. The hosted sample app on Glitch is scheduled for deprecation on July 8th, 2025.
+

June

Weekly release 2025.06.2

Tue, 07 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Network zone restrictions for clients is self-service EA in Preview	Jun 25, 2025
Org2Org OIDC Sign-on mode is self-service EA in Preview	Jun 17, 2025
Okta Integration IdP type is self-service EA in Preview	Jun 25, 2025
Bugs fixed in 2025.06.2	Jun 25, 2025

Network zone restrictions for clients is self-service EA in Preview

You can now specify an allowlist or denylist network zone for each client to enhance token endpoint security.

Org2Org OIDC Sign-on mode is self-service EA in Preview

The Org2Org app now includes an OIDC Sign-on mode using the Okta Integration IdP. This sign-on mode reduces the complexity of configuration between the Org2Org app and the target org, and takes advantage of modern security features of OIDC. You also need to enable the Okta Integration IdP feature to use the OIDC Sign-on mode. See Secure API connections between orgs with OAuth 2.0.

Okta Integration IdP type is self-service EA in Preview

The new Okta Integration IdP type allows you to configure Org2Org OIDC IdPs with secure defaults. See Identity Providers and Add an Okta Identity Provider.

Bugs fixed in 2025.06.2

+
When an app with imported app groups was deactivated, and users were subsequently removed from these groups, the event wasn't recorded in the System Log. (OKTA-934264)
+
+
The delete operation for the Roles API (/iam/roles/{roleIdOrLabel}) and the Resource Sets API (/iam/resource-sets/{iamPolicyIdOrLabel}) allowed users to delete IAM-based standard roles and resource sets, respectively. (OKTA-926830)
+
+
Using a private/public key for client authentication with an empty kid in the assertion threw a null pointer exception if there was an invalid use parameter in the key. (OKTA-963932)
+

Weekly release 2025.06.1

Mon, 06 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Frame-ancestors rollout for Content Security Policy	Jun 17, 2025
Response body updates for the MyAccount Authenticators API	Jun 17, 2025
Bugs fixed in 2025.06.1	Jun 17, 2025

Frame-ancestors rollout for Content Security Policy

Response body updates for the MyAccount Authenticators API

A new response property, canChange, is now returned for password enrollments when you make GET calls to the /idp/myaccount/authenticators/{authenticatorId}/enrollments/ endpoint. This property indicates if the value of a password enrollment can be changed. With the addition of the canChange property, canReset, an existing response property, now indicates whether or not the user can reset the value of their password enrollment.

See the MyAccount Authenticators API.

Bugs fixed in 2025.06.1

+
When calling the Replace the resource set resource conditions endpoint, /api/v1/iam/resource-sets/{resourceSetIdOrLabel}/resources/{resourceId}, including an empty body didn't remove conditions. (OKTA-947764)
+
+
Customization fields in email templates were populated with unencoded information. (OKTA-922766)
+
+
The Directories Integration API for AD Bidirectional Group Management returned a 500 error because of a null pointer exception. (OKTA-948743)
+
+
User grants weren't returned from the Users API (/users/clients//grants) after revoking user sessions and OAuth 2.0 tokens. (OKTA-944549)
+
+
Users could sometimes receive too many password reset emails. (OKTA-916357)
+
+
App logos could be added or updated using any SVG format. See Application Logos. (OKTA-876028)
+

Monthly release 2025.06.0

Sun, 05 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Admins prevented from deleting published app instances	June 4, 2025
Authentication claims sharing between Okta orgs is GA in Production	June 4, 2025
Claims sharing between third-party IdPs and Okta is GA in Production	April 9, 2025
Conditions for create user permission	June 9, 2025
Define default values for custom user attributes is GA in Production	May 7, 2025
Domain restrictions on Realms is GA in Production	April 23, 2025
New password complexity property is self-service EA in Preview	June 4, 2025
Number matching challenge with the Factors API is GA in Production	April 9, 2025
Restrict access to the Admin Console is GA in Preview	December 11, 2024
Shared signal transmitters is GA in Production	May 7, 2025
Single Logout for IdPs is EA in Preview	June 4, 2025
Expanded use of user.getGroups() function in Okta Expression Language is GA in Preview	June 4, 2025
Developer documentation updates in 2025.06.0	June 4, 2025
Bugs fixed in 2025.06.0	June 4, 2025

Admins prevented from deleting published app instances

When an app instance has the Published version status in OIN Wizard, admins can no longer delete it from the Integrator Free Plan org.

Authentication claims sharing between Okta orgs is GA in Production

Claims sharing between third-party IdPs and Okta is GA in Production

Conditions for create user permission

Define default values for custom user attributes is GA in Production

You can now define default values for custom attributes in a user profile. See the Update User Profile endpoint in the Schemas API.

Domain restrictions on Realms is GA in Production

New password complexity property is self-service EA in Preview

You can now use the oelStatement property to block words from being used in passwords. This feature enhances security by allowing you to customize your password strength requirements. See the Policy API.

Number matching challenge with the Factors API is GA in Production

Restrict access to the Admin Console is GA in Preview

Shared signal transmitters is GA in Production

Okta uses CAEP to send security-related events and other data-subject signals to third-party security vendors. To enable the transmission of signals from Okta, create an SSF stream using the SSF Transmitter API. Then, configure the third-party receiver to accept signals sent as Security Event Tokens (SETs) from Okta. See the SSF Transmitter API and SSF Transmitter SET payload structures.

Single Logout for IdPs is EA in Preview

The Single Logout (SLO) for IdPs feature boosts security for organizations using shared devices and external IdPs by automatically ending IdP sessions when a user signs out of any app. This feature also requires a fresh authentication for every new user, eliminating session hijacking risks on shared devices. SLO for IdP supports both SAML 2.0 and OIDC IdP connections, which provides robust session management for shared workstations in any environment. See Configure Single Logout for IdPs.

Expanded use of user.getGroups() function in Okta Expression Language is GA in Preview

You can now use the user.getGroups() function across all features that support Expression Language. See Group functions.

Developer documentation updates in 2025.06.0

+
The Email Customization API has been relabelled as the Org Email Settings API. There are no other changes to the API. All previous anchors and links to the API remain the same.
+
+
A new guide explains how to migrate customizations from the second generation (Gen2) to the third generation (Gen3) of the Sign-In Widget. It describes how to use design tokens instead of CSS className selectors to customize Gen3, and which variables and functions help with your migration.
+
+
New release notes for Okta Privileged Access APIs are now available.
+

Bugs fixed in 2025.06.0

+
The /idp/myaccount/sessions endpoint didn't accept access tokens granted by custom authorization servers. (OKTA-929488)
+
+
An HTTP 500 error occurred when API requests were sent to api/v1/policies/{policyId} and api/v1/policies/{policyId}/rules/{ruleID} with certain values in the Accept header. (OKTA-892315)
+
+
MyAccount Authenticators API GET requests (/idp/myaccount/authenticators/ and /idp/myaccount/authenticators/{authenticatorId}) didn't return custom logo details. (OKTA-880048)
+

May

Weekly release 2025.05.3

Sat, 04 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Integrator Free Plan org now available	May 22, 2025
Bugs fixed in 2025.05.3	May 29, 2025

Integrator Free Plan org now available

Bugs fixed in 2025.05.3

+
When third-party claims sharing was enabled, users couldn't sign in using their IdP because of an authentication loop. (OKTA-939862)
+
+
When enrolling an sms factor (POST /users/{userId}/factors), an Invalid Phone Number error was sometimes incorrectly returned. (OKTA-923373)
+
+
Users with + in their email address couldn't reset their passwords from email templates. Use the ${encode(String html)} expression to encode special characters. (OKTA-914601)
+
+
Sending a phone challenge with the MyAccount Phone API (POST /idp/myaccount/phones/{id}/challenge) sometimes returned an HTTP 500 Internal Server error. (OKTA-946865)
+

Weekly release 2025.05.2

Fri, 03 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Enrollment grace periods is EA in Preview	May 21, 2025
Send app context to external IdPs is EA in Preview	May 21, 2025

Enrollment grace periods is EA in Preview

Today, when admins define an enrollment policy for a group, the entire group must enroll immediately, which can be disruptive to their day-to-day tasks.

Send app context to external IdPs is EA in Preview

You can now forward context about an app to an external identity provider (IdP) when a user attempts to access the app. When you enable the Application context checkbox for an IdP, the app name and unique instance ID are included in the SAML or OpenID Connect request sent to the external IdP. This enhancement allows external IdPs to make more informed, context-aware authentication decisions, supporting advanced security scenarios, and Zero Trust environments. To enable this feature, go to Settings > Features in the Admin Console, locate Send Application Context to an External IdP, and enable.

Weekly release 2025.05.1

Thu, 02 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Bugs fixed in 2025.05.1	May 14, 2025

Bugs fixed in 2025.05.1

+
After enrolling a call factor (POST /users/{userId}/factors), the resend.href link in the response body returned an HTTP 404 Not Found error when it was used. (OKTA-926672)
+
+
In some situations, the /api/v1/agentPools API failed to return agents that were stuck in an error state. (OKTA-910056)
+

Monthly release 2025.05.0

Wed, 01 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Breached Credentials Protection is EA in Preview	May 15, 2025
Custom admin roles for ITP	May 7, 2025
New User Role Targets API endpoint	May 7, 2025
Define default values for custom user attributes	May 7, 2025
Directories integration API is GA in Preview and Production	May 7, 2025
Number matching challenge with the Factors API is GA in Preview	May 7, 2025
Claims sharing between third-party IdPs and Okta is GA in Preview	May 7, 2025
Express Configuration for OIN apps	May 7, 2025
New End-user Enrollments API is GA in Production	March 5, 2025
New System Log for super admin privilege grant	May 7, 2025
Entitlement claims is GA in Production	January 2, 2025
POST requests to authorize endpoint is GA in Production	January 8, 2025
Authentication claims sharing between Okta orgs is GA in Preview	May 7, 2025
Shared signal transmitters is GA in Preview	May 7, 2025
Developer documentation update in 2025.05.0	May 7, 2025
Bugs fixed in 2025.05.0	May 7, 2025

Breached Credentials Protection is EA in Preview

This feature is following a slow rollout process beginning on May 15.

Custom admin roles for ITP

New User Role Targets API endpoint

The User Role Targets API now includes a new endpoint, Retrieve a role target by assignment type, that retrieves role targets by user or group assignment type.

Define default values for custom user attributes

You can now define default values for custom attributes in a user profile. See the Update User Profile endpoint in the Schemas API.

Directories integration API is GA in Preview and Production

Number matching challenge with the Factors API is GA in Preview

Claims sharing between third-party IdPs and Okta is GA in Preview

Express Configuration for OIN apps

Express Configuration is a feature designed to automate the setup of SSO for instances of OIN SaaS integrations by enterprise customers with minimal manual effort. It allows enterprise customers to securely configure OpenID Connect (OIDC) integrations without copying and pasting configuration values between Okta and Auth0-enabled apps. See Express Configuration.

New End-user Enrollments API is GA in Production

The new End-user Enrollments API enables end users to enroll and unenroll authenticators by entering a URL directly into their browser. This reduces the time spent administering complex authenticator enrollment flows, and provides a streamlined enrollment process for users. After a user enrolls or unenrolls an authenticator, you can use the redirect_uri property to redirect them to another page.

New System Log for super admin privilege grant

A new System Log event now indicates when the super admin role (app.oauth2.client.privilege.grant) is granted to an API service integration.

Entitlement claims is GA in Production

POST requests to authorize endpoint is GA in Production

You can now send user data securely in a POST request body to the /authorize endpoint.

Authentication claims sharing between Okta orgs is GA in Preview

Shared signal transmitters is GA in Preview

New Applications API object

A new universalLogout object is returned in the Applications API for orgs that have Identity Threat Protection enabled.

Developer documentation update in 2025.05.0

The new Integrate Okta with identity verification vendors guide describes how third-party identity verification (IDV) vendors can integrate with Okta. IDV vendors can use the guide to integrate their service with Okta orgs.

Bugs fixed in 2025.05.0

+
If a third-party SAML IdP sent the session.amr SAML attribute without the attribute schema type, Okta rejected the response when the third-party claims sharing feature was enabled. (OKTA-925864)
+
+
When third-party IdP claims sharing was enabled, the redirect to the IdP happened during reauthentication even if the IdP didn't provide any AMR claims. (OKTA-922086)
+

April

Weekly release 2025.04.3

Tue, 30 Sep 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Bugs fixed in 2025.04.3	April 30, 2025

Bugs fixed in 2025.04.3

+
Some versions of the Sign-In Widget v3 returned an error when trying to display the consent screen. (OKTA-755616)
+
+
The user.profile.firstName tag in email templates didn't escape or render Unicode characters correctly. (OKTA-840719)
+
+
Requests made using the sortBy parameter with custom attributes to the List all users or List all groups endpoints threw an HTTP 400 Bad Request error. (OKTA-886166)
+
+
Some admins with a custom role (okta.apps.read, okta.apps.clientCredentials.read permissions) couldn’t view client secrets for apps that they had permission to view. (OKTA-893511)
+
+
After their accounts were suspended, users who correctly answered their security question were moved to an Active status in API calls. (OKTA-897292)
+
+
The number of groups that could be returned in tokens for a groups claim was still restricted in the authorization code sign-in flow when an inline hook was used. (OKTA-907362)
+
+
When a resource set contained a devices resource, the Retrieve a resource endpoint returned a null response for the devices self object. (OKTA-914364)
+
+
When the List all Subscriptions API with a Workflows Administrator role (WORKFLOWS_ADMIN) was called, an HTTP 400 Bad Request error was returned. (OKTA-918276)
+
+
Users received an HTTP 400 Bad Request error during self-service registration in preview orgs with a Registration Inline hook. (OKTA-918774)
+
+
When an Okta Classic Engine org was involved in a multi-org Okta-to-Okta authentication flow, and Okta-to-Okta claims sharing was enabled, the OktaAuth (SAML) and okta_auth (OIDC) claims weren't processed correctly. (OKTA-918969)
+
+
When Okta-to-Okta claims sharing was enabled, federated users who were sourced from a third-party identity provider were incorrectly prompted to provide a password on their hub org. (OKTA-919385)
+

Weekly release 2025.04.2

Mon, 29 Sep 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Subscriptions API no longer supports OKTA_ISSUE	April 9, 2025
Bugs fixed in 2025.04.2	April 16, 2025

Subscriptions API no longer supports OKTA_ISSUE

The Subscriptions API no longer supports the notificationType value OKTA_ISSUE.

Bugs fixed in 2025.04.2

+
Email notifications weren’t sent to end users when security methods were enrolled using POST requests to the /users/{userId}/factors endpoint and the activate parameter was set to true. (OKTA-891169)
+
+
Updates made to ACS URIs for an app using the Applications API (PUT /apps/{appId}) didn't take effect if the app was created without those URLs. (OKTA-909218)
+

Weekly release 2025.04.1

Sun, 28 Sep 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Advanced device posture checks	April 9, 2025
Claims sharing between third-party IdPs and Okta is self-service EA in Preview	April 9, 2025
Number matching challenge with the Factors API is self-service EA in Preview	April 9, 2025
OAuth 2.0 provisioning for Org2Org with Auto-Rotation is self-service EA in Preview	April 2, 2025
Bugs fixed in 2025.04.1	April 9, 2025

Advanced device posture checks

Claims sharing between third-party IdPs and Okta is self-service EA in Preview

Number matching challenge with the Factors API is self-service EA in Preview

OAuth 2.0 provisioning for Org2Org with Auto-Rotation is self-service EA in Preview

Admins deploying multi-org architectures (for example, Okta hub-and-spoke orgs) need to secure user and group provisioning. Provisioning using OAuth 2.0 scoped tokens has several advantages over API tokens, including more access granularity, shorter token lifespans, and automatic key rotation. You can now enable OAuth 2.0 Auto-Rotation for Org2Org app provisioning directly from the Admin Console, in addition to the API.

Bugs fixed in 2025.04.1

+
In Preview orgs, org admins couldn't edit IdP group assignments when a super admin group was included in the group list. (OKTA-880124)
+
+
The id_token_hint parameter was exposed in the System Log. (OKTA-890738)
+
+
POST requests to the /authorize endpoint that contained query parameters received an error. (OKTA-905143)
+

Monthly release 2025.04.0

Sat, 27 Sep 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Domain restrictions on Realms	April 23, 2025
OAuth 2.0 provisioning for Org2Org with Auto-Rotation is EA in Preview	April 2, 2025
Retrieve the SSF Stream status is EA in Preview	April 2, 2025
OIN test account information deleted after 30 days	April 2, 2025
Risk Provider and Risk Events APIs are deprecated	April 2, 2025
POST requests to authorize endpoint is GA Preview	January 8, 2025
Integration variable limit increase in OIN Submission	April 2, 2025
Conditional requests and entity tags are GA in Production	January 16, 2025
New rate limit event type	April 2, 2025
Create dynamic resource sets with conditions is GA in Preview	November 7, 2024
Okta account management policy is GA in Production	December 11, 2024
Okta Sign-In Widget custom template updates	April 2, 2025
Developer documentation update in 2025.04.0	April 2, 2025
Bugs fixed in 2025.04.0	April 2, 2025

Domain restrictions on Realms

OAuth 2.0 provisioning for Org2Org with Auto-Rotation is EA in Preview

Admins deploying multi-org architectures (for example, Okta hub-and-spoke orgs) need to secure user and group provisioning. Provisioning using OAuth 2.0 scoped tokens has several advantages over API tokens, including more access granularity, shorter token lifespans, and automatic key rotation. You can now enable OAuth 2.0 Auto-Rotation for Org2Org app provisioning directly from the Admin Console, in addition to the API.

To support these updates, the Application Connections API includes a new endpoint, Retrieve a JSON Web Key Set (JWKS) for the default provisioning connection, and schema updates to support token auto-rotation, rotationMode=AUTO. See Update the default provisioning connection and Integrate Okta Org2Org with Okta.

Retrieve the SSF Stream status is EA in Preview

Retrieve the SSF Stream status endpoint (/api/v1/ssf/stream/status) is now available. The status indicates whether the transmitter is able to transmit events over the stream. This endpoint is available if you have enabled the Enable Managed Apple ID federation and provisioning feature for your org.

OIN test account information deleted after 30 days

Okta deletes your test account credentials 30 days after you publish your app in OIN Wizard. You must create a new test account and re-enter the required information before submitting the app.

Risk Provider and Risk Events APIs are deprecated

These APIs have been deprecated. Use the SSF Security Event Tokens API instead to receive security-related events and other data-subject signals. Use the SSF Receiver API for third-party security event providers.

POST requests to authorize endpoint is GA Preview

You can now send user data securely in a POST request body to the /authorize endpoint.

Integration variable limit increase in OIN Submission

Conditional requests and entity tags are GA in Production

New rate limit event type

This rate limit event type now appears in the System Log: system.rate_limit.configuration.update. It logs the following:

Changes to client-based rate limit settings
Changes in the rate limit warning notification threshold
If the rate limit notification is enabled or disabled
Updates to the rate-limit percentage of an API token

Create dynamic resource sets with conditions is GA in Preview

Okta account management policy is GA in Production

The Okta account management policy helps admins easily build phishing resistance into actions such as account unlock, password recovery, authenticator enrollment, and profile setting changes. Using the familiar rule-based framework of an authentication policy, admins can now customize which phishing-resistant authenticators are required when users attempt these common self-service actions. All of the configurations in the authentication policies can now be applied for authenticator management. See Configure an Okta account management policy.

Okta Sign-In Widget custom template updates

Admins can now use the useSiwGen3 variable in the sign-in page code editor to help with migrations from Gen2 to Gen3 of the Okta Sign-In Widget. See Use the code editor.

Developer documentation update in 2025.04.0

Bugs fixed in 2025.04.0

+
The result of System Log events triggered by the use_dpop_nonce OAuth 2.0 error was FAILURE instead of CHALLENGE. (OKTA-902314)
+
+
When the Okta-to-Okta Claims Sharing feature was enabled, users who signed in using ADSSO on a spoke org were prompted for their password in the hub org. (OKTA-897340)
+
+
Admins using multiple user types sometimes encountered an internal error when attempting to update an app instance. (OKTA-880825)
+
+
If an AAGUID key that wasn’t verified by the FIDO Alliance Metadata Service (MDS) was added to an authenticator group, then future PUT requests to api/v1/authenticators/{authenticatorId}/methods/webauthn failed. (OKTA-875920)
+
+
The wrong HTTP error code was returned for the SSF stream creation operation when one stream already existed. (OKTA-868972)
+
+
A Policies API GET request (/api/v1/policies) returned a rel="next" link when there were no more results. (OKTA-858605)
+
+
The OIN Submission Tester didn't support custom domains in the IdP flow. (OKTA-835402)
+
+
When /api/v1/apps was called, it returned all applications assigned, even though the user wasn't part of the assigned resource set. (OKTA-826548)
+

March

Weekly release 2025.03.3

Fri, 26 Sep 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Advanced search using conditioned profile attributes	March 26, 2025
Bugs fixed in 2025.03.3	March 26, 2025

Advanced search using conditioned profile attributes

Bugs fixed in 2025.03.3

+
Custom role admins with permission conditions couldn't search for users by firstName or lastName. (OKTA-894392)
+
+
The user.identity_verification System Log event displayed an incorrect assurance level for completed identity verifications with DENY results. (OKTA-893343)
+
+
Some PUT requests to the brands/{brandId}/templates/email/{templateName}/settings endpoint received HTTP 500 Internal Server Error messages. (OKTA-886167)
+
+
GET requests to the /api/v1/users/me/appLinks endpoint sometimes returned an HTTP 500 Internal Server error. (OKTA-873694)
+

Weekly release 2025.03.1

Thu, 25 Sep 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Bugs fixed in 2025.03.1	March 12, 2025

Bugs fixed in 2025.03.1

+
createdBy and lastUpdatedBy custom attributes couldn't be used in group rules. (OKTA-566492)
+
+
Custom admins who were limited to viewing only application group members received incomplete results when using the List All Users API without a search or filter parameter. (OKTA-801592)
+
+
The JSON Web Token that Okta generates and sends to the OpenID Connect identity provider contained a string exp instead of a number 'exp'. (OKTA-852446)
+
+
When making POST requests to users/{userId}/factors/{factorId}/verify or authn/factors/{factorId}/verify endpoints with factorType instead of factorId in the URL path, multiple failed verification attempts didn't lock users out and the failed attempts weren't logged in the System Log. (OKTA-871469)
+
+
When Okta sent a request with a refresh token to the token inline hook, the session user was sometimes sent rather than the refresh token user in request.data.context. (OKTA-869758)
+

Monthly release 2025.03.0

Wed, 24 Sep 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Global token revocation for wizard SAML and OIDC apps is GA in Production	September 11, 2024
OIDC IdPs now support group sync is GA in Production	October 23, 2024
Granular account linking for certain Identity Providers is GA in Production	December 11, 2024
Realms for Workforce is GA in Production	February 13, 2025
Improved group search functionality is GA in Production	February 12, 2025
Improved user search functionality is GA in Production	February 12, 2025
Improved realms and device search functionality is GA in Production	February 12, 2025
New End-user Enrollments API is GA in Preview	March 5, 2025
CLEAR Verified as a third-party identity verification provider is EA in Preview	March 5, 2025
Verify an SSF Stream is EA in Preview	March 5, 2025
MyAccount Password API updates	March 5, 2025
Identity Security Posture Management functionality in the OIN catalog	March 5, 2025
Default global session policy rule update	March 5, 2025
Developer documentation updates in 2025.03.0	March 5, 2025
Bugs fixed in 2025.03.0	March 5, 2025

Global token revocation for wizard SAML and OIDC apps is GA in Production

Universal Logout clears sessions and tokens for wizard SAML and OIDC apps. This enhancement extends Universal Logout functionality to more types of apps and provides greater flexibility to admins.

OIDC IdPs now support group sync is GA in Production

Granular account linking for certain Identity Providers is GA in Production

Realms for Workforce is GA in Production

Improved group search functionality is GA in Production

Improved user search functionality is GA in Production

Improved realms and device search functionality is GA in Production

New End-user Enrollments API is GA in Production

CLEAR Verified as a third-party identity verification provider is EA in Preview

Okta now supports using CLEAR Verified as an identity provider. This increases the number of identity verification vendors (IDVs) you can use to verify the identity of your users when they onboard or reset their account. Set IDV_CLEAR as the IdP type when you create an IdP.

Verify an SSF Stream is EA in Preview

Okta SSF Transmitter now supports the verification endpoint to enable receivers to request verification events and validate the end-to-end delivery between the transmitter and receiver. In addition, the SSF Transmitter verification events claim structure is now compliant with the OpenID Shared Signals Framework ID3 spec.

MyAccount Password API updates

Admins can now send a PUT request to the /idp/myaccount/password endpoint to update the password for a user. Also, admins can send a GET request to the /idp/myaccount/password/complexity-requirements endpoint to retrieve password complexity requirements. See Replace a Password and Retrieve the Password Complexity Requirements.

Identity Security Posture Management functionality in the OIN catalog

Default global session policy rule update

Developer documentation updates in 2025.03.0

+
The list of public permissions has moved from the Roles in Okta topic to the Permissions in Okta topic. The new topic contains more permission details for you to define your custom admin roles.
+
+
A new section has been added to the API documentation: Sign-in Experience API. It contains the new End-user Enrollments API that enables end users to enroll and unenroll authenticators by entering a URL directly into their browser.
+

Bugs fixed in 2025.03.0

+
Some certificates with trailing characters were uploaded successfully to the /domains/{domainId}/certificate endpoint, despite their invalid format. (OKTA-486406)
+
+
An incorrect response was returned when a /token request was sent with an inactive user in a direct authentication flow. (OKTA-853984)
+

February

Weekly release 2025.02.2

Tue, 23 Sep 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Incode as a third-party identity verification provider is EA in Preview	February 20, 2025
Bugs fixed in 2025.02.2	February 20, 2025

Incode as a third-party identity verification provider is EA in Preview

Okta now supports using Incode as an identity provider. This increases the number of identity verification vendors (IDVs) you can use to verify the identity of your users when they onboard or reset their account. Set IDV_INCODE as the IdP type when you create an IdP.

Bugs fixed in 2025.02.2

+
An API request to create a resource set with a duplicate name sometimes returned a 5xx error instead of a 4xx error response. (OKTA-867792)
+
+
Admins couldn't retrieve more than five entitlement SAML assertions and OIDC claims when configuring apps. (OKTA-865900)
+
+
The contains (co) operator sometimes gave unclear error messages when using less than three characters or with other operators. (OKTA-846206)
+
+
When an admin attempted to revoke an API token (DELETE /api/v1/api-tokens/{apiTokenId}), and the credential used to authenticate the request was an access_token for a Service client, an HTTP 403 error was returned. (OKTA-844384)
+

Weekly release 2025.02.1

Mon, 22 Sep 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Bugs fixed in 2025.02.1	February 13, 2025

Bugs fixed in 2025.02.1

+
When a GET request was made using the User Grants API (/api/v1/users/{userId}/grants), the response didn't include pagination links in the response header. (OKTA-826775)
+
+
The Users API returned inconsistent responses in Classic Engine orgs that allowed self-service registration and in Identity Engine orgs that were migrated from these orgs. (OKTA-833094)
+
+
In the Admin Console, updates in the code editor that Okta couldn't parse returned a 500 Internal Server Error. (OKTA-837068)
+
+
The On-Behalf of Token Exchange flow was returning the wrong error message when an invalid subject_token_type was requested. (OKTA-841223)
+
+
When a POST request was made (/api/v1/authorizationServers/{authServerId}/policies) to create an authorization policy, the created and lastUpdated properties had a null value. (OKTA-848623)
+
+
The /user/verify_idx_credentials endpoint didn't accept arbitrary fromUri values. (OKTA-853353)
+
+
AMR values weren't forwarded to the app when a user signed in and Okta-to-Okta claims sharing was configured. (OKTA-860242)
+
+
Some identity provider API POST (/api/v1/idps) and PUT (/api/v1/idps/{idpId}) requests returned an HTTP 500 error code if the request didn't have the policy.accountLink object in the request body. (OKTA-865143)
+

Monthly release 2025.02.0

Sun, 21 Sep 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
IP Exempt Zone is GA in Preview	October 23, 2024
Global token revocation for wizard SAML and OIDC apps is GA in Preview	September 11, 2024
OIDC IdPs now support group sync is GA in Preview	October 23, 2024
Granular account linking for certain identity providers is GA	December 11, 2024
Realms for Workforce is GA in Preview	February 13, 2025
Improved group search functionality is GA in Preview	February 12, 2025
Improved user search functionality is GA in Preview	February 12, 2025
Support for importing Active Directory group descriptions is GA in Production	February 6, 2025
Developer documentation updates in 2025.02.0	February 6, 2025
Bugs fixed in 2025.02.0	February 6, 2025

IP Exempt Zone is GA in Preview

Global token revocation for wizard SAML and OIDC apps is GA in Preview

Universal Logout clears sessions and tokens for wizard SAML and OIDC apps. This enhancement extends Universal Logout functionality to more types of apps and provides greater flexibility to admins.

OIDC IdPs now support group sync is GA in Preview

Granular account linking for certain identity providers is GA

Realms for Workforce is GA in Preview

Improved group search functionality is GA in Preview

Improved user search functionality is GA in Preview

Support for importing Active Directory group descriptions is GA in Production

Developer documentation updates in 2025.02.0

The Style the Sign-In Widget (third generation) guide, under Brand and Customize, now describes how to use the afterTransform function. The function allows you to apply DOM customizations to the third generation of the widget. For example, you can use afterTransform to change button text or to add an instructional paragraph.
The new Configure a device assurance policy guide, under Sign users in, describes how to manage device assurance policies in your org. The guide uses the Device Assurance Policies API to create and edit a policy, and add device assurance to an authentication policy. It also shows how to use the System Log API to check for device assurance events.
The OIN Manager: submit an integration guide has been updated to include API service submission instructions.

Bugs fixed in 2025.02.0

When calling deleted app users through the Apps API, the API returned a 500 internal server error instead of a 404 error. (OKTA-832609)
PUT requests (/api/v1/apps/appId) to update an OpenID Connect app took 30 seconds to complete. (OKTA-852488)
When the List all devices API was used with a search query parameter, it sometimes returned outdated records for screenLockType and managementStatus. (OKTA-856387)

January

Weekly release 2025.01.2

Sat, 20 Sep 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Authentication claims sharing between Okta orgs is EA in Preview	January 29, 2025
Bugs fixed in 2025.01.2	January 29, 2025

Authentication claims sharing between Okta orgs is EA in Preview

Bugs fixed in 2025.01.2

When the Default Network Zone IP Exempt List feature was enabled for an org, an admin was able to delete the default example IP zone using the Zones API (/api/v1/zones/{DefaultExemptIpZone ID}). (OKTA-817263)
The List all principal rate limits returned an empty response when querying with a custom client_id and using OAuth 2.0 for authentication. (OKTA-832687)
When a super admin updated a deactivated user to a different realm, admins received a Resource not found error. (OKTA-699778)
Events for tokens revoked in bulk for a resource didn't appear in the System Log. (OKTA-834025)
Refresh tokens for OpenID Connect apps that have Single Logout enabled with user session details were getting invalidated before their max lifetime. (OKTA-730794)
Account unlock didn't work for some orgs using the Okta account management policy. (OKTA-848066)

Weekly release 2025.01.1

Fri, 19 Sep 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Bugs fixed in 2025.01.1	January 15, 2025

Bugs fixed in 2025.01.1

+
When an admin attempted to delete an IdP using the SDK, the operation failed with an HTTP 500 response code. (OKTA-846005)
+
+
POST requests with an OAuth token to the /devices/{deviceId}/lifecycle/deactivate endpoint by an API service app using the Client Credentials flow returned 403 error responses. The deactivations succeeded in spite of the error response. (OKTA-838539)
+

Monthly release 2025.01.0

Thu, 18 Sep 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Additional use case selection in the OIN Wizard	January 8, 2025
Configure Identity Verification with third-party Identity Verification providers is GA Production	October 2, 2024
Deprecated API endpoints: Extend, Grant, and Revoke Okta Support access	January 8, 2025
Granular configuration for Keep Me Signed In is EA in Preview	January 8, 2025
Multiple Identifiers is GA in Preview	November 7, 2024
New group.source.id key for group functions in Expression Language	January 2, 2025
POST requests to the authorize endpoint is self-service EA	January 8, 2025
Bug fixed in 2025.01.0	January 8, 2025

Additional use case selection in the OIN Wizard

Independent software vendors (ISVs) can select the following additional use case categories when they submit their integration to the OIN:

Automation
Centralized Logging
Directory and HR Sync
Multifactor Authentication (MFA)

See OIN Wizard use case selection.

Configure Identity Verification with third-party Identity Verification providers is GA Production

You can now configure third-party Identity Verification providers using the IdP API and Okta account management policy rules. Okta supports Persona as a third-party Identity Verification provider.

Identity Verification enables you to use a third-party Identity Verification provider to verify the identity of your users. Verification requirements and the Identity Verification provider are based on your authentication policies and configurations within your Okta org. To configure an Identity Verification provider in the Admin Console, see Add an Identity Verification vendor as Identity Provider.

Deprecated API endpoints: Extend, Grant, and Revoke Okta Support access

The following API endpoints have been deprecated:

Extend Okta Support access (POST /api/v1/org/privacy/oktaSupport/extend)
Grant Okta Support access (POST /api/v1/org/privacy/oktaSupport/grant)
Revoke Okta Support access (POST /api/v1/org/privacy/oktaSupport/revoke)

Granular configuration for Keep Me Signed In is EA in Preview

The post-authentication prompt text (title, subtitle, accept button, and reject button) is now customizable through the Brands API. See Customize post-authentication sign-in prompts.

Multiple Identifiers is GA in Preview

Today, end users must sign in to Okta with a username or email address only. With the Multiple Identifiers feature, admins can configure identifiers, or user attributes from Universal Directory, that an end user can enter to authenticate. Multiplier identifiers work in sign-in, recovery, self-service registration, and unlock flows. Admins can configure up to three identifiers, including email (which is still a required identifier). See Configure multiple identifiers.

New group.source.id key for group functions in Expression Language

You can now use the group.source.id key in Expression Language group functions to filter between groups that have the same name. See Group functions.

POST requests to the authorize endpoint is Self-Service EA

You can now send user data securely in a POST request body to the /authorize endpoint.

Developer documentation updates in 2025.01.0

The Sign users in to your SPA using redirect guides for the Angular and React platforms are now revised to use updated versions of Okta SDKs, framework dependencies, and coding patterns.

Bug fixed in 2025.01.0

Requests to the /policies/{policyId}/rules and /policies/{policyId}/rules/{ruleId} endpoints to create or update Okta account management policy rules included default Keep me signed in (KMSI) settings in the responses. (OKTA-848236)

Weekly release 2025.10.1

Mon, 20 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Bug fixed in 2025.10.1	October 15, 2025

Bug fixed in 2025.10.1

The client credential flow for API service apps didn’t work for some governance API requests. (OKTA-926552)

Monthly release 2025.10.0

Sun, 19 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Entitlement history is Beta	September 10, 2025
New governance setting System Log event	October 8, 2025

Entitlement history is Beta

Admins can now access a user's entitlement history. This feature improves auditing and compliance tasks and enhances visibility for troubleshooting access issues. See Retrieve an entitlement history in the Principal Entitlements API.

You can also access this feature from the Admin Console. See View user entitlements in the product documentation.

New governance setting System Log event

The governance.settings.update System Log event is triggered when super admins update the delegate settings to allow or block users from assigning their own delegate.

September

Weekly release 2025.09.1

Sat, 18 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Bugs fixed in 2025.09.1	September 17, 2025

Bugs fixed in 2025.09.1

The list entitlement bundles request (GET /governance/api/v1/entitlement-bundles) returned an error when the name filter had a single quote. (OKTA-1007878)
The retrieve principal entitlements request (GET /governance/api/v1/principal-entitlements) returned an invalid-condition error when a resource ORN was used in the filter. (OKTA-928086)

Monthly release 2025.09.0

Fri, 17 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Auditor reporting package is self-service EA	August 13, 2025
Entitlement bundle documented response updates	September 10, 2025
Resource Owners API is Beta	September 10, 2025
Governance Labels API is Beta	September 10, 2025
ORN property included in collections	September 10, 2025
ORN property included in entitlement bundles and values	September 10, 2025
Org Governance Settings API is Beta	September 10, 2025
Security Access Reviews API is EA	September 10, 2025
Developer documentation updates in 2025.09.0	September 10, 2025

Auditor reporting package is self-service EA

You can now generate access certification campaign reports that are tailored to meet auditor requirements. These reports make preparing for compliance audits faster and easier by reducing the time and manual effort required for assembling and exporting campaign and user access data.

Access certification campaign reports are generated from the auditor reporting package, which is triggered post-campaign completion when the createReportingPackageEnabled parameter is true. See reportingSettings.createReportingPackageEnabled in the Create a campaign resource.

Entitlement bundle documented response updates

The documented response for List all entitlement bundles and Retrieve an entitlement bundle has been updated to remove the One of (oneOf) payload structure. The documented response payload is now flattened to include properties for both entitlement-bundles-list and entitlement-bundles-list-with-entitlements schemas. This is backward-compatible because the expected returned response schema is the same as before.

Resource Owners API is Beta

Drive automation and simplify Okta Identity Governance (OIG) configuration by assigning owners to resources, such as apps, groups, and entitlements. You can automatically assign reviewers for access certifications that are scoped with specific owner-assigned resources. See the Resource Owners API to manage assigning owners to resources in your OIG org.

Governance Labels API is Beta

The Labels API enables you to categorize and organize resources, such as apps, groups, entitlements, and collections. You can create, update, and assign key-value labels to resources to support automation, streamline configuration, and simplify the management of access reviews and requests. See Labels API.

ORN property included in collections

Collection resources now include their Okta resource name (ORN) in the response payload. See the orn property in the collection resource.

ORN property included in entitlement bundles and values

The entitlement bundle and value resources now include their Okta resource name (ORN) in the response payload. See the orn property in the entitlement value response and in the entitlement bundles response payloads.

Org Governance Settings API is Beta

To complement the Governance delegates feature, admins can now configure whether end users can set their own delegates with the Org Governance Settings API. See delegates.enduser.permissions in the Update the org settings API.

End users can also view their delegate permissions in the My Settings API. See delegates.permissions in the Retrieve the settings API.

Security Access Reviews API is EA

Security Access Reviews are a new, security-focused type of access review that can be automatically triggered by events. These reviews provide a unified view of a user's access and contextual information about their access history. Also included is an AI-generated access summary, allowing you to investigate and take immediate remediation actions like revoking access. See Security Access Reviews in the product documentation.

See the Security Access Reviews API and Launch a security access review guide for details on how to trigger security access reviews through the API.

Developer documentation updates in 2025.09.0

+
Best practice implementations of API use cases are now available for Identity Governance. See Identity Governance in the Guides sidebar.
+
+
Okta Identity Governance campaigns and entitlements can now be managed using the Okta Terraform Provider. This enables customers to manage their governance tasks and configure other resources in their Okta org that are maintained through the Terraform Infrastructure-as-Code tool. For more information, refer to Terraform Provider for Okta and the Terraform Registry documentation.
+

August

Weekly release 2025.08.2

Thu, 16 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Bug fixed in 2025.08.2	August 20, 2025

Bug fixed in 2025.08.2

The List all grants API operation ( GET /governance/api/v1/grants) returned an incorrect number of objects. (OKTA-995619)

Monthly release 2025.08.0

Wed, 15 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Governance delegates APIs are Beta	August 7, 2025
List all access request catalog entries for a user is GA	July 16, 2025
Unified requester experience is EA	July 16, 2025
Developer documentation updates in 2025.08.0	August 7, 2025
Bug fixed in 2025.08.0	August 7, 2025

Governance delegates APIs are Beta

+ +

Super admins and users can assign delegates to complete governance tasks. These include access certification campaign reviews and access request approvals, questions, and tasks. When approvers are unavailable, their tasks can be assigned to different stakeholders ( delegates) for a period of time to ensure that governance processes don't stall. This also reduces the time admins and users spend reassigning requests and reviews manually.

The following APIs support the governance delegates flow and are available as Beta:

Principal Settings API > Update the principal settings
Delegates > List all delegate appointments
My Settings > Retrieve the settings
My Settings > Update the settings
My Settings > List the eligible delegate users

List all access request catalog entries for a user is GA

The List all access request catalog entries for a user (GET /governance/api/v2/catalogs/default/user/{userId}/entries) operation is now included in the Access Requests - V2 > Catalogs API. As an admin, use this operation to list access request catalog entries for a user. A filter expression query parameter is required to specify the set of entries in the response.

Unified requester experience is EA

Use this feature to create a consistent and unified experience for initiating requests in End-User Dashboard, Slack, and Microsoft Teams regardless of whether the request is managed by conditions or request types. This gives you the flexibility to use either or both methods together to manage resource access without altering the requester experience.

Request types now appear as tiles in the End-User Dashboard's resource catalog alongside other resources. Your settings for a request type's audience continue to govern which users can view the request type on their dashboard and request access.
In Slack and Microsoft Teams, users can now request access to resources that are governed by access request conditions, and the user experience for requesting resources that are managed by request types has also been changed.

Additionally, in the Okta Access Requests app, the Access requests page has been renamed to Resource catalog and clicking it redirects requesters to the resource catalog on the End-User Dashboard. The Request types section in the web app is only visible to admins and team members who own the request type. See Create requests.

This is an Early Access feature. See Enable self-service features.

The following Access Request API updates have been made to support the unified requester experience:

New REQUEST_TYPE option for accessScopeType in the Requests API
New validRequestOnBehalfOfSettings property for Request Settings API
Related entry link updates for catalog entry responses
List all access request catalog entries for a user

Developer documentation updates in 2025.08.0

The Archived Okta Identity Governance API changelog (2023-2024) has been removed.

Bug fixed in 2025.08.0

The filtered entitlement bundles request (GET /governance/api/v1/entitlement-bundles) with the contains (co) operator didn't sort results by the substring's location within the name field.

July

Weekly release 2025.07.2

Tue, 14 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Related entity link updates for catalog entry responses	July 16, 2025
Bug fixed in 2025.07.2	July 16, 2025

Bug fixed in 2025.07.2

A null pointer exception occurred when a PUT /governance/api/v1/collections/{collecionId}/resources/{resourceId} request was made on a collection without resources. (OKTA-970817)

Monthly release 2025.07.0

Mon, 13 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Changes to Okta app API responses	July 7, 2025

Changes to Okta app API responses

The following Okta apps won't be returned in the API response for endpoints that list apps (such as the List all applications GET /api/vi/apps endpoint):

Okta Access Certifications (key name: okta_iga)
Okta Access Requests Admin (key name: okta_access_requests_admin)
Okta Entitlement Management (key name: okta_entitlement_management)

June

Weekly release 2025.06.1

Sun, 12 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
List all access request catalog entries for a user is Beta	June 17, 2025

List all access request catalog entries for a user is Beta

+ +

The List all access request catalog entries for a user (GET /governance/api/v2/catalogs/default/user/{userId}/entries) operation is now included in the Access Requests - V2 > Catalogs API. As an admin, use this operation to list access request catalog entries for a particular user. A filter expression query parameter is required to specify the set of entries in the response.

May

Weekly release 2025.05.3

Sat, 11 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Request condition name length increase	May 29, 2025

Request condition name length increase

The Request Condition API has increased the length of the request condition name from 50 to 255 characters.

Weekly release 2025.05.1

Fri, 10 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
New variable for Access Certification campaign emails	May 14, 2025
Generate a risk assessment is Beta	May 14, 2025

New variable for Access Certification campaign emails

You can now include the campaign description in your customized Access Certification campaign email notifications. See the new ${campaign.campaignDescription} variable in Use VTL variables.

Generate a risk assessment is Beta

+ +

The Generate a risk assessment operation is now included in the Risk Rules API. This operation requires the okta.governance.riskRule.read OAuth 2.0 scope. Use this resource to evaluate potential separation of duties (SOD) violations when a user requests entitlements.

April

Monthly release 2025.04.0

Thu, 09 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Risk Rules API is Beta	April 2, 2025

Risk Rules API is Beta

+ +

The Risk Rules API is now available in Beta and includes the following new scopes:

okta.governance.riskRule.manage
okta.governance.riskRule.read

Use this API to define risk rules to support separation of duties (SOD) in Access Certifications and Access Requests.

The following new properties were added to support the SOD feature in existing Identity Governance resources:

+
Campaigns resource: principalScopeSettings.onlyIncludeUsersWithSODConflicts
+
+
Reviews resource: riskRuleConflicts
+
+
Request Settings: validRiskSettings and riskSettings
+

See Separation of duties in the product documentation.

March

Weekly release 2025.03.2

Wed, 08 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Collections API is Beta	March 19, 2025

Collections API is Beta

+ +

The Collections API is available in Beta. This API allows you to manage sets of apps and entitlements. See Resource collections.

Weekly release 2025.03.1

Tue, 07 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Bug fixed in 2025.03.1	March 12, 2025

Bug fixed in 2025.03.1

The requestOnBehalfOfSettings property wasn’t validated for DIRECT_REPORT when a user calls the Retrieve an entry’s request fields (GET /governance/api/v2/my/catalogs/default/entries/{entryId}/request-fields). (OKTA-807528)

Monthly release 2025.03.0

Mon, 06 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + + + + + +

Change	Expected in Preview Orgs
Entitlements and Entitlement Bundles APIs are GA	March 5, 2025
New Access Certifications campaign	March 5, 2025
Bug fixed in 2025.03.0	March 5, 2025

Entitlements and Entitlement Bundles APIs are GA

The following APIs have transitioned from Beta to GA:

+
Entitlements
+
+
Entitlement Bundles
+

New Access Certifications campaign

A new property, resourceSettings.includeAdminRoles, has been added to the access certification campaign schema in the Campaigns API . This property indicates that the user-centric access certification campaign includes users’ admin role assignments.

Bug fixed in 2025.03.0

The remediationSettings.autoRemediationSettings and principalScopeSettings.predefinedInactiveUsersScope properties were missing from the Access Certification campaign schema in the Campaigns API reference. (OKTA-880900)

February

Weekly release 2025.02.1

Sun, 05 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
List all entitlements API response update	February 13, 2025

List all entitlements API response update

+ +

Breaking change: The List all entitlement response no longer returns a values object. Previously, this response returned an empty array for this property after the following update in 2024.04.0: List all entitlements will no longer return values. To fetch values for a given entitlement, use List all values for an entitlement or List all entitlement values.

Monthly release 2025.02.0

Sat, 04 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
New System Log event	February 6, 2025

New system log event

An access.request.settings.update System Log event now appears when a Request of behalf of setting is toggled on or off in the Admin Console, or when you set or change the requestOnBehalfOfSettings object for Requests Settings. The event's debugData property includes the app for which the setting was updated and the changeDetails property includes the previous and new state of the setting.

January

Weekly release 2025.01.2

Fri, 03 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Bug fixed in 2025.01.2	January 29, 2025

Bug fixed in 2025.01.2

The okta.accessRequests.catalog.read scope was missing from the Okta Identity Governance APIs. (OKTA-846162)

Monthly release 2025.01.0

Thu, 02 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview Orgs
Selected Okta Identity Governance APIs are now GA	January 8, 2025

Selected Okta Identity Governance APIs are now GA

The following Okta Identity Governance APIs are GA:

The following Access Requests - V2 administrative APIs are now EA:

For further information, see Identity Governance and Okta Identity Governance API.

Monthly release 2025.10.0

Mon, 20 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + + + + +

Change	Expected in Preview	Expected in Production
More account details for end users	October 9, 2025
Random password generator for unmanaged SaaS accounts is GA	September 18, 2025	September 29, 2025

More account details for end users

End users now have access to more account and rotation details from the Active Directory account details page, such as the sAMAccountName, the security identifier (sid), and password rotation statistics. +See the following changes to the response schema of Retrieve an Active Directory account:

New rotation object
Additional properties in the account object
New last_checked_out_by property in the checkout_details object

Random password generator for unmanaged SaaS accounts is GA

Okta Privilege Access (OPA) end users can generate passwords for their unmanaged SaaS accounts. See Generate a random password in the Random Password Generation API.

September

Weekly release 2025.09.2

Sun, 19 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + +

Change	Expected in Preview	Expected in Production
Exclude symbols in project password policy	September 18, 2025	September 22, 2025

Exclude symbols in project password policy

You can now exclude specific symbols from the generated passwords for server, SaaS app service, Okta service, and Active Directory accounts. This is useful when the target system doesn’t allow certain symbols in its passwords. See character_options.exclude_certain_symbols in Update project password policy for server accounts, Update a project password policy for SaaS app resources, Update a project password policy for Universal Directory resources, and Update a project password policy for Active Directory resources.

Weekly release 2025.09.1

Sat, 18 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + +

Change	Expected in Preview
Random password generator for unmanaged SaaS accounts is EA	September 18, 2025

Random password generator for unmanaged SaaS accounts is EA

Okta Privilege Access (OPA) end users can generate passwords for their unmanaged SaaS accounts. See Generate a random password in the Random Password Generation API.

Monthly release 2025.09.0

Fri, 17 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + +

Change	Expected in Preview	Expected in Production
Enable Okta-managed Active Directory accounts is EA	September 8, 2025	September 15, 2025

Enable Okta-managed Active Directory accounts is EA

You can now set up Active Directory (AD) account rules to import AD users that are managed by Okta. When you enable an AD account that's managed by Okta, active users can sign in to Okta and access all their SSO apps through the Okta End-User Dashboard. Admins and users can still rotate passwords through Okta Privileged Access and have those passwords synchronized with the AD server and Okta. This provides a seamless experience for active AD users to sign in to Okta-integrated apps and benefit from Okta Privileged Access features, such as password rotation.

When you set up AD account rules, you can filter on account names or Okta group memberships in AD rules that have the Okta user management functionality enabled.

To enable Okta-managed users on import, set enable_import_okta_users and enhanced_filters in the Create an Active Directory account rule.

August

Weekly release 2025.08.4

Thu, 16 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + +

Change	Expected in Preview	Expected in Production
Role permission updates for attribute operations	August 28, 2025	September 2, 2025

Role permission updates for attribute operations

In addition to previous role permissions, users with security_admin permissions can now access the following operations:

List all attributes for a group (GET /v1/teams/{team_name}/groups/{group_name}/attributes)
Retrieve a group attribute (GET /v1/teams/{team_name}/groups/{group_name}/attributes/{attribute_id})
List all attributes for a user (GET/v1/teams/{team_name}/users/{user_name}/attributes)
Retrieve a user attribute (GET /v1/teams/{team_name}/users/{user_name}/attributes/{attribute_id})
List all attribute conflicts for a team (GET /v1/teams/{team_name}/attributes/conflicts)

Users need the security_admin permission instead of the resource_admin permission to access the following operations:

Update a group attribute (PUT /v1/teams/{team_name}/groups/{group_name}/attributes/{attribute_id})
Update a user attribute (PUT /v1/teams/{team_name}/users/{user_name}/attributes/{attribute_id})

Weekly release 2025.08.2

Wed, 15 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + +

Change	Expected in Preview	Expected in Production
Active Directory Remote Desktop Protocol (RDP) support is EA	August 20, 2025	August 27, 2025

Active Directory Remote Desktop Protocol (RDP) support is EA

Security admins can grant users RDP access to Windows servers with Active Directory (AD) credentials. After RDP access is granted, end users can connect to Windows servers through RDP using the SFT client. Security admins can set requirements, such as multifactor authentication, approval requests, or resource checkout, in order for users to connect through RDP. Currently, gateways aren't supported for RDP connections with AD credentials.

You can grant RDP permission to AD users on Windows servers through the security policy. See privileges in the Security Policy API. See user access method details in the List all user access methods for an Active Directory account method and in Server Resolve resource names. For product documentation, see Add rules to a policy.

Monthly release 2025.08.0

Tue, 14 Oct 2025 17:14:18 GMT

+ + + + + + + + + + + + + + + + + + + + +

Change	Expected in Preview
Active Directory rotate password configuration is EA	August 7, 2025
Service Accounts API is EA	August 7, 2025
Search capability for Okta Privileged Access secrets	August 5, 2025

Active Directory rotate password configuration is EA

Resource admins can now disable the initial password rotation for discovered Active Directory (AD) accounts. Previously, all new or updated AD accounts discovered were automatically initiated for password rotation. Security admins can now set up security policies with rotate-password privileges. End users under that security policy can rotate accessible AD accounts regardless of whether the password was initially rotated. This feature provides the flexibility for OPA admins and end users to manage password rotation.

Resource admins can disable initial password rotation through an AD account rule (see enable_initial_password_rotation in Create an Active Directory account rule).
Security admins can create security policies with AD rules that enable password rotation privileges for end users (see the update_password privilege in rules.privileges from Create a security policy).
End users with the rotate password privilege can rotate their account password (see Rotate the password for Active Directory account).

Service Accounts API is EA

This feature is available only if you're subscribed to Okta Privileged Access. Ensure that you've set up the Okta Privileged Access app before creating app accounts through the API.

Search capability for Okta Privileged Access secrets

Okta Privileged Access users can now search secrets and their folders. A new search query parameter is available for the List top-level secret folder for a user operation. End users can search for secrets or secret folders that they have access to by the secret name or description that contains a substring.

June

Monthly release 2025.06.0

Mon, 13 Oct 2025 17:14:18 GMT

Updates to password rotation frequency

You can now schedule the password rotation frequency for all projects up to a maximum of 400 days. The periodic_rotation_duration_in_seconds parameter now has a maximum value of 34,560,000 seconds in the following operations:

Update project password policy for server accounts(/v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/server_password_settings)
Update a project password policy for Active Directory resources (/v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/active_directory_password_settings)

May

Weekly release 2025.05.3

Sun, 12 Oct 2025 17:14:18 GMT

OPA Active Directory API resources are EA

You can now manage Okta Privileged Access (OPA) Active Directory (AD) integrations through the API. To enable this Early Access feature, contact Okta Support. See the Manage Active Directory accounts product documentation. The following OPA AD API resources are available:

Cloud Infrastructure Entitlements API is deprecated

The Cloud infrastructure entitlements feature is no longer supported in Okta Privileged Access. All resources in the Cloud Infrastructure Entitlements API are now deprecated.

${rel.title}

${rel.pubDate.toUTCString()}

${rel.description}

Weekly release 2025.10.1

Mon, 20 Oct 2025 17:14:18 GMT

@@ -54,7 +54,7 @@ Monthly release 2025.10.0 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025100 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025100 - Sun, 19 Oct 2025 17:14:18 GMT + Tue, 21 Oct 2025 15:20:27 GMT @@ -137,7 +137,7 @@ Weekly release 2025.09.2 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025092 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025092 - Sat, 18 Oct 2025 17:14:18 GMT + Mon, 20 Oct 2025 15:20:27 GMT @@ -181,7 +181,7 @@ Weekly release 2025.09.1 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025091 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025091 - Fri, 17 Oct 2025 17:14:18 GMT + Sun, 19 Oct 2025 15:20:27 GMT @@ -222,7 +222,7 @@ Monthly release 2025.09.0 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025090 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025090 - Thu, 16 Oct 2025 17:14:18 GMT + Sat, 18 Oct 2025 15:20:27 GMT @@ -400,7 +400,7 @@ Weekly release 2025.08.4 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025084 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025084 - Wed, 15 Oct 2025 17:14:18 GMT + Fri, 17 Oct 2025 15:20:27 GMT @@ -435,7 +435,7 @@ Weekly release 2025.08.3 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025083 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025083 - Tue, 14 Oct 2025 17:14:18 GMT + Thu, 16 Oct 2025 15:20:27 GMT @@ -460,7 +460,7 @@ Weekly release 2025.08.2 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025082 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025082 - Mon, 13 Oct 2025 17:14:18 GMT + Wed, 15 Oct 2025 15:20:27 GMT @@ -495,7 +495,7 @@ Monthly release 2025.08.0 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025080 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025080 - Sun, 12 Oct 2025 17:14:18 GMT + Tue, 14 Oct 2025 15:20:27 GMT @@ -737,7 +737,7 @@ Weekly release 2025.07.3 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025073 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025073 - Sat, 11 Oct 2025 17:14:18 GMT + Mon, 13 Oct 2025 15:20:27 GMT @@ -766,7 +766,7 @@ Weekly release 2025.07.2 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025072 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025072 - Fri, 10 Oct 2025 17:14:18 GMT + Sun, 12 Oct 2025 15:20:27 GMT @@ -795,7 +795,7 @@ Weekly release 2025.07.1 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025071 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025071 - Thu, 09 Oct 2025 17:14:18 GMT + Sat, 11 Oct 2025 15:20:27 GMT @@ -823,7 +823,7 @@ Monthly release 2025.07.0 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025070 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025070 - Wed, 08 Oct 2025 17:14:18 GMT + Fri, 10 Oct 2025 15:20:27 GMT @@ -929,7 +929,7 @@ Weekly release 2025.06.2 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025062 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025062 - Tue, 07 Oct 2025 17:14:18 GMT + Thu, 09 Oct 2025 15:20:27 GMT @@ -982,7 +982,7 @@ Weekly release 2025.06.1 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025061 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025061 - Mon, 06 Oct 2025 17:14:18 GMT + Wed, 08 Oct 2025 15:20:27 GMT @@ -1040,7 +1040,7 @@ Monthly release 2025.06.0 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025060 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025060 - Sun, 05 Oct 2025 17:14:18 GMT + Tue, 07 Oct 2025 15:20:27 GMT @@ -1164,7 +1164,7 @@ Weekly release 2025.05.3 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025053 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025053 - Sat, 04 Oct 2025 17:14:18 GMT + Mon, 06 Oct 2025 15:20:27 GMT @@ -1208,7 +1208,7 @@ Weekly release 2025.05.2 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025052 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025052 - Fri, 03 Oct 2025 17:14:18 GMT + Sun, 05 Oct 2025 15:20:27 GMT @@ -1240,7 +1240,7 @@ Weekly release 2025.05.1 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025051 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025051 - Thu, 02 Oct 2025 17:14:18 GMT + Sat, 04 Oct 2025 15:20:27 GMT @@ -1272,7 +1272,7 @@ Monthly release 2025.05.0 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025050 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025050 - Wed, 01 Oct 2025 17:14:18 GMT + Fri, 03 Oct 2025 15:20:27 GMT @@ -1398,7 +1398,7 @@ Weekly release 2025.04.3 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025043 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025043 - Tue, 30 Sep 2025 17:14:18 GMT + Thu, 02 Oct 2025 15:20:27 GMT @@ -1457,7 +1457,7 @@ Weekly release 2025.04.2 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025042 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025042 - Mon, 29 Sep 2025 17:14:18 GMT + Wed, 01 Oct 2025 15:20:27 GMT @@ -1495,7 +1495,7 @@ Weekly release 2025.04.1 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025041 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025041 - Sun, 28 Sep 2025 17:14:18 GMT + Tue, 30 Sep 2025 15:20:27 GMT @@ -1555,7 +1555,7 @@ Monthly release 2025.04.0 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025040 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025040 - Sat, 27 Sep 2025 17:14:18 GMT + Mon, 29 Sep 2025 15:20:27 GMT @@ -1691,7 +1691,7 @@ Weekly release 2025.03.3 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025033 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025033 - Fri, 26 Sep 2025 17:14:18 GMT + Sun, 28 Sep 2025 15:20:27 GMT @@ -1735,7 +1735,7 @@ Weekly release 2025.03.1 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025031 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025031 - Thu, 25 Sep 2025 17:14:18 GMT + Sat, 27 Sep 2025 15:20:27 GMT @@ -1776,7 +1776,7 @@ Monthly release 2025.03.0 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025030 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025030 - Wed, 24 Sep 2025 17:14:18 GMT + Fri, 26 Sep 2025 15:20:27 GMT @@ -1901,7 +1901,7 @@ See the Weekly release 2025.02.1 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025021 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025021 - Mon, 22 Sep 2025 17:14:18 GMT + Wed, 24 Sep 2025 15:20:27 GMT @@ -1995,7 +1995,7 @@ See the Weekly release 2025.01.2 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025012 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025012 - Sat, 20 Sep 2025 17:14:18 GMT + Mon, 22 Sep 2025 15:20:27 GMT @@ -2121,7 +2121,7 @@ See the Monthly release 2025.01.0 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025010 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025010 - Thu, 18 Sep 2025 17:14:18 GMT + Sat, 20 Sep 2025 15:20:27 GMT diff --git a/packages/@okta/vuepress-site/.vuepress/public/rss/identity-governance.xml b/packages/@okta/vuepress-site/.vuepress/public/rss/identity-governance.xml index e9a9706b95f..875f58b8180 100644 --- a/packages/@okta/vuepress-site/.vuepress/public/rss/identity-governance.xml +++ b/packages/@okta/vuepress-site/.vuepress/public/rss/identity-governance.xml @@ -4,13 +4,13 @@ Okta Developer Docs Release Notes (Identity Governance) https://developer.okta.com/docs/release-notes/2025-okta-identity-governance/ Recent release notes for Okta Identity Governance API

Weekly release 2025.10.1

Wed, 22 Oct 2025 15:20:27 GMT

Weekly release 2025.10.2

Wed, 22 Oct 2025 15:22:11 GMT

Weekly release 2025.10.2

Wed, 22 Oct 2025 19:26:13 GMT

@@ -43,11 +20,13 @@ - +

test feature for 10.2	Bug fixed in 2025.10.2	October 22, 2025

Bug fixed in 2025.10.2

Update, update, update. Does this new update appear in the feed? (OKTA-1035340)

Weekly release 2025.10.1

Thu, 23 Oct 2025 19:26:13 GMT

Weekly release 2025.10.1

Wed, 12 Nov 2025 15:33:10 GMT

@@ -29,23 +29,6 @@

Custom IDV vendors

Bugs fixed in 2025.10.1

-
When an admin attempted to update the signing certificate for an Org2Org IdP integration, an error was returned. (OKTA-1035340)
-
-
When a call was made to the User Risk (/api/v1/users/{userId}/risk) endpoint with an OAuth 2.0 access token issued to a service app, the endpoint returned an HTTP 403 "Invalid session" error. (OKTA-1024961)
-
-
The GET /api/v1/sessions/{sessionId} and POST /api/v1/sessions/{sessionId}/lifecycle/refresh operations didn't work for IDX sessions in Identity Engine. When the GET /api/v1/sessions/me and POST /api/v1/sessions/me/lifecycle/refresh endpoints were used with an IDX session, the Session.createdAt property was populated with the user's last sign-in time instead of the actual session creation time. (OKTA-948866)
-
-
Authentication challenges sometimes returned an incorrect app ID when a custom relying party ID was used. (OKTA-1025465)
-

Weekly release 2025.10.1

Wed, 12 Nov 2025 15:33:10 GMT

@@ -25,8 +25,6 @@

Bug fixed in 2025.10.1

The client credential flow for API service apps didn’t work for some governance API requests. (OKTA-926552)

Monthly release 2025.10.0

Wed, 12 Nov 2025 15:33:10 GMT

@@ -32,17 +32,6 @@

More account details for end users

End users now have access to more account and rotation details from the Active Directory account details page, such as the sAMAccountName, the security identifier (sid), and password rotation statistics. -See the following changes to the response schema of Retrieve an Active Directory account:

New rotation object
Additional properties in the account object
New last_checked_out_by property in the checkout_details object

Random password generator for unmanaged SaaS accounts is GA

Okta Privilege Access (OPA) end users can generate passwords for their unmanaged SaaS accounts. See Generate a random password in the Random Password Generation API.

September

Test Weekly release 2025.10.3

Wed, 12 Nov 2025 20:19:01 GMT

+ + + + + + +

Change	Expected in Preview Orgs

Weekly release 2025.10.2

Wed, 12 Nov 2025 19:49:55 GMT

@@ -37,7 +37,7 @@ Monthly release 2025.10.0 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025100 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025100 - Tue, 11 Nov 2025 19:49:55 GMT + Tue, 11 Nov 2025 20:19:01 GMT @@ -92,7 +92,7 @@ Weekly release 2025.09.2 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025092 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025092 - Mon, 10 Nov 2025 19:49:55 GMT + Mon, 10 Nov 2025 20:19:01 GMT @@ -115,7 +115,7 @@ Weekly release 2025.09.1 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025091 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025091 - Sun, 09 Nov 2025 19:49:55 GMT + Sun, 09 Nov 2025 20:19:01 GMT @@ -142,7 +142,7 @@ Monthly release 2025.09.0 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025090 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025090 - Sat, 08 Nov 2025 19:49:55 GMT + Sat, 08 Nov 2025 20:19:01 GMT @@ -237,7 +237,7 @@ Weekly release 2025.08.4 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025084 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025084 - Fri, 07 Nov 2025 19:49:55 GMT + Fri, 07 Nov 2025 20:19:01 GMT @@ -260,7 +260,7 @@ Weekly release 2025.08.3 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025083 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025083 - Thu, 06 Nov 2025 19:49:55 GMT + Thu, 06 Nov 2025 20:19:01 GMT @@ -283,7 +283,7 @@ Weekly release 2025.08.2 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025082 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025082 - Wed, 05 Nov 2025 19:49:55 GMT + Wed, 05 Nov 2025 20:19:01 GMT @@ -306,7 +306,7 @@ Monthly release 2025.08.0 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025080 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025080 - Tue, 04 Nov 2025 19:49:55 GMT + Tue, 04 Nov 2025 20:19:01 GMT @@ -437,7 +437,7 @@ Weekly release 2025.07.3 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025073 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025073 - Mon, 03 Nov 2025 19:49:55 GMT + Mon, 03 Nov 2025 20:19:01 GMT @@ -460,7 +460,7 @@ Weekly release 2025.07.2 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025072 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025072 - Sun, 02 Nov 2025 19:49:55 GMT + Sun, 02 Nov 2025 20:19:01 GMT @@ -483,7 +483,7 @@ Weekly release 2025.07.1 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025071 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025071 - Sat, 01 Nov 2025 19:49:55 GMT + Sat, 01 Nov 2025 20:19:01 GMT @@ -506,7 +506,7 @@ Monthly release 2025.07.0 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025070 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025070 - Fri, 31 Oct 2025 19:49:55 GMT + Fri, 31 Oct 2025 20:19:01 GMT @@ -569,7 +569,7 @@ Weekly release 2025.06.2 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025062 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025062 - Thu, 30 Oct 2025 19:49:55 GMT + Thu, 30 Oct 2025 20:19:01 GMT @@ -604,7 +604,7 @@ Weekly release 2025.06.1 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025061 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025061 - Wed, 29 Oct 2025 19:49:55 GMT + Wed, 29 Oct 2025 20:19:01 GMT @@ -635,7 +635,7 @@ Monthly release 2025.06.0 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025060 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025060 - Tue, 28 Oct 2025 19:49:55 GMT + Tue, 28 Oct 2025 20:19:01 GMT @@ -710,7 +710,7 @@ Weekly release 2025.05.3 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025053 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025053 - Mon, 27 Oct 2025 19:49:55 GMT + Mon, 27 Oct 2025 20:19:01 GMT @@ -737,7 +737,7 @@ Weekly release 2025.05.2 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025052 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025052 - Sun, 26 Oct 2025 19:49:55 GMT + Sun, 26 Oct 2025 20:19:01 GMT @@ -764,7 +764,7 @@ Weekly release 2025.05.1 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025051 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025051 - Sat, 25 Oct 2025 19:49:55 GMT + Sat, 25 Oct 2025 20:19:01 GMT @@ -787,7 +787,7 @@ Monthly release 2025.05.0 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025050 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025050 - Fri, 24 Oct 2025 19:49:55 GMT + Fri, 24 Oct 2025 20:19:01 GMT @@ -870,7 +870,7 @@ Weekly release 2025.04.3 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025043 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025043 - Thu, 23 Oct 2025 19:49:55 GMT + Thu, 23 Oct 2025 20:19:01 GMT @@ -893,7 +893,7 @@ Weekly release 2025.04.2 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025042 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025042 - Wed, 22 Oct 2025 19:49:55 GMT + Wed, 22 Oct 2025 20:19:01 GMT @@ -920,7 +920,7 @@ Weekly release 2025.04.1 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025041 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025041 - Tue, 21 Oct 2025 19:49:55 GMT + Tue, 21 Oct 2025 20:19:01 GMT @@ -959,7 +959,7 @@ Monthly release 2025.04.0 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025040 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025040 - Mon, 20 Oct 2025 19:49:55 GMT + Mon, 20 Oct 2025 20:19:01 GMT @@ -1034,7 +1034,7 @@ Weekly release 2025.03.3 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025033 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025033 - Sun, 19 Oct 2025 19:49:55 GMT + Sun, 19 Oct 2025 20:19:01 GMT @@ -1061,7 +1061,7 @@ Weekly release 2025.03.1 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025031 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025031 - Sat, 18 Oct 2025 19:49:55 GMT + Sat, 18 Oct 2025 20:19:01 GMT @@ -1084,7 +1084,7 @@ Monthly release 2025.03.0 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025030 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025030 - Fri, 17 Oct 2025 19:49:55 GMT + Fri, 17 Oct 2025 20:19:01 GMT @@ -1163,7 +1163,7 @@ Weekly release 2025.02.2 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025022 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025022 - Thu, 16 Oct 2025 19:49:55 GMT + Thu, 16 Oct 2025 20:19:01 GMT @@ -1190,7 +1190,7 @@ Weekly release 2025.02.1 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025021 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025021 - Wed, 15 Oct 2025 19:49:55 GMT + Wed, 15 Oct 2025 20:19:01 GMT @@ -1213,7 +1213,7 @@ Monthly release 2025.02.0 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025020 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025020 - Tue, 14 Oct 2025 19:49:55 GMT + Tue, 14 Oct 2025 20:19:01 GMT @@ -1272,7 +1272,7 @@ Weekly release 2025.01.2 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025012 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025012 - Mon, 13 Oct 2025 19:49:55 GMT + Mon, 13 Oct 2025 20:19:01 GMT @@ -1299,7 +1299,7 @@ Weekly release 2025.01.1 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025011 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Weeklyrelease2025011 - Sun, 12 Oct 2025 19:49:55 GMT + Sun, 12 Oct 2025 20:19:01 GMT @@ -1322,7 +1322,7 @@ Monthly release 2025.01.0 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025010 https://developer.okta.com/docs/release-notes/2025-okta-identity-engine/#Monthlyrelease2025010 - Sat, 11 Oct 2025 19:49:55 GMT + Sat, 11 Oct 2025 20:19:01 GMT diff --git a/packages/@okta/vuepress-site/.vuepress/public/rss/identity-governance.xml b/packages/@okta/vuepress-site/.vuepress/public/rss/identity-governance.xml index 03f0bb4c61d..b00bb747adb 100644 --- a/packages/@okta/vuepress-site/.vuepress/public/rss/identity-governance.xml +++ b/packages/@okta/vuepress-site/.vuepress/public/rss/identity-governance.xml @@ -1,16 +1,16 @@ - Okta Developer Docs Release Notes (Identity Governance) + Okta Identity Governance API release notes https://developer.okta.com/docs/release-notes/2025-okta-identity-governance/ Recent release notes for Okta Identity Governance API

Test Weekly release 2025.10.3

Wed, 12 Nov 2025 20:19:01 GMT

Test Bug fixed in 2025.10.3 October 22, 2025

Weekly release 2025.10.1

Wed, 12 Nov 2025 20:19:01 GMT

- - - - - - - - - - - - - - - - -

Change	Expected in Preview Orgs
Custom IDV vendors	October 22, 2025
Bugs fixed in 2025.10.1	October 15, 2025

Weekly release 2025.10.1

Wed, 12 Nov 2025 20:19:01 GMT

- - - - - - - - - - - - -

Change	Expected in Preview Orgs
Bug fixed in 2025.10.1	October 15, 2025

Monthly release 2025.10.0

Wed, 12 Nov 2025 20:19:01 GMT

- - - - - - - - - - - - - - - - - - - -

Change	Expected in Preview	Expected in Production
More account details for end users	October 9, 2025
Random password generator for unmanaged SaaS accounts is GA	September 18, 2025	September 29, 2025

Custom IDV vendors
Bugs fixed in 2025.10.1

Weekly release 2025.10.1

Tue, 08 Jul 2025 18:25:32 GMT

Bug fixed in 2025.10.1

Monthly release 2025.10.0

Tue, 16 Sep 2025 18:25:32 GMT

More account details for end users
Random password generator for unmanaged SaaS accounts is GA

Test Weekly release 2025.10.4

Tue, 01 Apr 2025 05:00:00 GMT

Bug fixed in 2025.10.1

Weekly release 2025.10.1

Tue, 01 Apr 2025 18:27:29 GMT

Custom IDV vendors
Bugs fixed in 2025.10.1

Weekly release 2025.10.1

Tue, 08 Jul 2025 18:27:29 GMT

Bug fixed in 2025.10.1

Monthly release 2025.10.0

Tue, 16 Sep 2025 18:27:29 GMT

More account details for end users
Random password generator for unmanaged SaaS accounts is GA

Test Weekly release 2025.10.4

Tue, 18 Nov 2025 05:00:00 GMT

Breached Credentials Protection is GA in Preview
Clear user factors for all devices is GA in Preview
Encryption of ID tokens and access tokens is EA
Expanded use of user.getGroups() function in Okta Expression Language is GA in Production
Group Push Mappings is GA in Preview
Multiple active IdP signing certificates is EA
New user profile permission
OAuth 2.0 provisioning for Org2Org with Autorotation is GA in Production
Service Accounts API is EA
Unified claims generation for custom apps is self-service EA in Preview
Web app integrations now mandate the use of the Authorization Code flow
Developer documentation updates in 2025.08.0

Monthly release 2025.10.0

Tue, 04 Nov 2025 18:31:05 GMT

Org2Org OIDC Sign-on mode is GA in Production
User status in Okta Expression Language is GA in Production
Network zone restrictions for clients is GA in Preview
Okta Integration IdP type is GA in Production
Behavior Detections for new ASN
Temporary Access Code authenticator is GA in Preview
Custom admin roles for ITP
Enrollment grace periods is GA in Preview
Developer documentation update in 2025.10.0

Weekly release 2025.09.2

Tue, 28 Oct 2025 18:31:05 GMT

Bugs fixed in 2025.09.2

Weekly release 2025.09.1

Tue, 21 Oct 2025 18:31:05 GMT

New functionality filters in the OIN catalog
Bugs fixed in 2025.09.1

Monthly release 2025.09.0

Tue, 14 Oct 2025 18:31:05 GMT

User API Projections
Org2Org OIDC Sign-on mode is GA in Preview
Anything-as-a-Source for groups and group memberships API is EA
New System Log events for bulk groups and bulk group memberships changes
Breached Credentials Protection is GA in Production
Group Push Mappings is GA in Production
Default app sign-in policy for API service apps
New validation rule for integration variables in the OIN Wizard
Clear user factors for all devices is GA in Production
New User Authenticator Enrollments API is GA in Production
MyAccount WebAuthn API is GA in Production
Response body updates for the MyAccount Authenticators API
Secure Identity Integrations filters in the OIN catalog
Okta Integration IdP type is GA in Preview
Send app context to external IdPs is GA in Production
New claims supported for identity verification (IDV) vendor integration is self-service EA in Preview
Passkey and security key subdomain support is self-service EA in Preview
User status in Okta Expression Language is GA in Preview
Developer documentation update in 2025.09.0

Weekly release 2025.08.4

Tue, 07 Oct 2025 18:31:05 GMT

Bugs fixed in 2025.08.4

Weekly release 2025.08.3

Tue, 30 Sep 2025 18:31:05 GMT

Bug fixed in 2025.08.3

Weekly release 2025.08.2

Tue, 23 Sep 2025 18:31:05 GMT

Bugs fixed in 2025.08.2

Monthly release 2025.08.0

Tue, 16 Sep 2025 18:31:05 GMT

Associated Domain Customizations API is self-service EA in Preview
Automate SCIM Integration for OIN Apps with Express Configuration
Breached Credentials Protection is GA in Preview
Clear user factors for all devices is GA in Preview
Cross App Access is self-service EA in Preview
Custom FIDO2 AAGUID is self-service EA in Preview
Device signal collection policy is self-service EA in Preview
Encryption of ID tokens and access tokens is EA
Expanded use of user.getGroups() function in Okta Expression Language is GA in Production
Granular configuration for Keep Me Signed In is GA in Production
Group Push Mappings is GA in Preview
MyAccount Password API is GA in Production
MyAccount WebAuthn API is EA in Production and GA in Preview
Multiple active IdP signing certificates is EA
New User Authenticator Enrollments API is GA in Preview
New user profile permission
OAuth 2.0 provisioning for Org2Org with Autorotation is GA in Production
Passkeys from Android devices is self-service EA in Preview
Send app context to external IdPs is GA in Preview
Service Accounts API is EA
System Log event for Identity Assertion Authorization Grant (ID-JAG) issuance is EA in Preview
System Log updates for ID verification events
Temporary Access Code authenticator is self-service EA in Preview
Unified claims generation for custom apps is self-service EA in preview
Universal Logout in the OIN Wizard
Web app integrations now mandate the use of the Authorization Code flow
Developer documentation updates in 2025.08.0
Bug fixed in 2025.08.0

Weekly release 2025.07.3

Tue, 09 Sep 2025 18:31:05 GMT

Bugs fixed in 2025.07.3

Weekly release 2025.07.2

Tue, 02 Sep 2025 18:31:05 GMT

Bugs fixed in 2025.07.2

Weekly release 2025.07.1

Tue, 26 Aug 2025 18:31:05 GMT

Bugs fixed in 2025.07.1

Monthly release 2025.07.0

Tue, 19 Aug 2025 18:31:05 GMT

OAuth 2.0 provisioning for Org2Org with key auto-rotation is GA in Preview
MyAccount Password API is GA in Preview
New Okta Expression Language component is self-service EA in Preview
System Log event for monitoring LDAP Agent config file changes is EA
Integrate Okta with Device Posture Provider
New validation rule for user profile attributes in OIN Wizard
Conditions for create user permission is GA in Production
CLEAR Verified and Incode as third-party identity verification providers is GA in Production
Changes to Okta app API responses
Restrict access to the Admin Console is GA in Production
Developer documentation updates in 2025.07.0

Weekly release 2025.06.2

Tue, 12 Aug 2025 18:31:05 GMT

Network zone restrictions for clients is self-service EA in Preview
Org2Org OIDC Sign-on mode is self-service EA in Preview
Okta Integration IdP type is self-service EA in Preview
Bugs fixed in 2025.06.2

Weekly release 2025.06.1

Tue, 05 Aug 2025 18:31:05 GMT

Frame-ancestors rollout for Content Security Policy
Response body updates for the MyAccount Authenticators API
Bugs fixed in 2025.06.1

Monthly release 2025.06.0

Tue, 29 Jul 2025 18:31:05 GMT

Admins prevented from deleting published app instances
Authentication claims sharing between Okta orgs is GA in Production
Claims sharing between third-party IdPs and Okta is GA in Production
Conditions for create user permission
Define default values for custom user attributes is GA in Production
Domain restrictions on Realms is GA in Production
New password complexity property is self-service EA in Preview
Number matching challenge with the Factors API is GA in Production
Restrict access to the Admin Console is GA in Preview
Shared signal transmitters is GA in Production
Single Logout for IdPs is EA in Preview
Expanded use of user.getGroups() function in Okta Expression Language is GA in Preview
Developer documentation updates in 2025.06.0
Bugs fixed in 2025.06.0

Weekly release 2025.05.3

Tue, 22 Jul 2025 18:31:05 GMT

Integrator Free Plan org now available
Bugs fixed in 2025.05.3

Weekly release 2025.05.2

Tue, 15 Jul 2025 18:31:05 GMT

Enrollment grace periods is EA in Preview
Send app context to external IdPs is EA in Preview

Weekly release 2025.05.1

Tue, 08 Jul 2025 18:31:05 GMT

Bugs fixed in 2025.05.1

Monthly release 2025.05.0

Tue, 01 Jul 2025 18:31:05 GMT

Breached Credentials Protection is EA in Preview
Custom admin roles for ITP
New User Role Targets API endpoint
Define default values for custom user attributes
Directories integration API is GA in Preview and Production
Number matching challenge with the Factors API is GA in Preview
Claims sharing between third-party IdPs and Okta is GA in Preview
Express Configuration for OIN apps
New End-user Enrollments API is GA in Production
New System Log for super admin privilege grant
Entitlement claims is GA in Production
POST requests to authorize endpoint is GA in Production
Authentication claims sharing between Okta orgs is GA in Preview
Shared signal transmitters is GA in Preview
Developer documentation update in 2025.05.0
Bugs fixed in 2025.05.0

Weekly release 2025.04.3

Tue, 24 Jun 2025 18:31:05 GMT

Bugs fixed in 2025.04.3

Weekly release 2025.04.2

Tue, 17 Jun 2025 18:31:05 GMT

Subscriptions API no longer supports OKTA_ISSUE
Bugs fixed in 2025.04.2

Weekly release 2025.04.1

Tue, 10 Jun 2025 18:31:05 GMT

Advanced device posture checks
Claims sharing between third-party IdPs and Okta is self-service EA in Preview
Number matching challenge with the Factors API is self-service EA in Preview
OAuth 2.0 provisioning for Org2Org with Auto-Rotation is self-service EA in Preview
Bugs fixed in 2025.04.1

Monthly release 2025.04.0

Tue, 03 Jun 2025 18:31:05 GMT

Domain restrictions on Realms
OAuth 2.0 provisioning for Org2Org with Auto-Rotation is EA in Preview
Retrieve the SSF Stream status is EA in Preview
OIN test account information deleted after 30 days
Risk Provider and Risk Events APIs are deprecated
POST requests to authorize endpoint is GA Preview
Integration variable limit increase in OIN Submission
Conditional requests and entity tags are GA in Production
New rate limit event type
Create dynamic resource sets with conditions is GA in Preview
Okta account management policy is GA in Production
Okta Sign-In Widget custom template updates
Developer documentation update in 2025.04.0
Bugs fixed in 2025.04.0

Weekly release 2025.03.3

Tue, 27 May 2025 18:31:05 GMT

Advanced search using conditioned profile attributes
Bugs fixed in 2025.03.3

Weekly release 2025.03.1

Tue, 20 May 2025 18:31:05 GMT

Bugs fixed in 2025.03.1

Monthly release 2025.03.0

Tue, 13 May 2025 18:31:05 GMT

Global token revocation for wizard SAML and OIDC apps is GA in Production
OIDC IdPs now support group sync is GA in Production
Granular account linking for certain Identity Providers is GA in Production
Realms for Workforce is GA in Production
Improved group search functionality is GA in Production
Improved user search functionality is GA in Production
Improved realms and device search functionality is GA in Production
New End-user Enrollments API is GA in Preview
CLEAR Verified as a third-party identity verification provider is EA in Preview
Verify an SSF Stream is EA in Preview
MyAccount Password API updates
Identity Security Posture Management functionality in the OIN catalog
Default global session policy rule update
Developer documentation updates in 2025.03.0
Bugs fixed in 2025.03.0

Weekly release 2025.02.2

Tue, 06 May 2025 18:31:05 GMT

Incode as a third-party identity verification provider is EA in Preview
Bugs fixed in 2025.02.2

Weekly release 2025.02.1

Tue, 29 Apr 2025 18:31:05 GMT

Bugs fixed in 2025.02.1

Monthly release 2025.02.0

Tue, 22 Apr 2025 18:31:05 GMT

IP Exempt Zone is GA in Preview
Global token revocation for wizard SAML and OIDC apps is GA in Preview
OIDC IdPs now support group sync is GA in Preview
Granular account linking for certain identity providers is GA
Realms for Workforce is GA in Preview
Improved group search functionality is GA in Preview
Improved user search functionality is GA in Preview
Support for importing Active Directory group descriptions is GA in Production
Developer documentation updates in 2025.02.0
Bugs fixed in 2025.02.0

Weekly release 2025.01.2

Tue, 15 Apr 2025 18:31:05 GMT

Authentication claims sharing between Okta orgs is EA in Preview
Bugs fixed in 2025.01.2

Weekly release 2025.01.1

Tue, 08 Apr 2025 18:31:05 GMT

Bugs fixed in 2025.01.1

Monthly release 2025.01.0

Tue, 01 Apr 2025 18:31:05 GMT

Additional use case selection in the OIN Wizard
Configure Identity Verification with third-party Identity Verification providers is GA Production
Deprecated API endpoints: Extend, Grant, and Revoke Okta Support access
Granular configuration for Keep Me Signed In is EA in Preview
Multiple Identifiers is GA in Preview
New group.source.id key for group functions in Expression Language
POST requests to the authorize endpoint is self-service EA
Bug fixed in 2025.01.0

Weekly release 2025.10.1

Tue, 11 Nov 2025 18:31:05 GMT

Bug fixed in 2025.10.1

Monthly release 2025.10.0

Tue, 04 Nov 2025 18:31:05 GMT

Entitlement history is Beta
New governance setting System Log event

Weekly release 2025.09.1

Tue, 28 Oct 2025 18:31:05 GMT

Bugs fixed in 2025.09.1

Monthly release 2025.09.0

Tue, 21 Oct 2025 18:31:05 GMT

Auditor reporting package is self-service EA
Entitlement bundle documented response updates
Resource Owners API is Beta
Governance Labels API is Beta
ORN property included in collections
ORN property included in entitlement bundles and values
Org Governance Settings API is Beta
Security Access Reviews API is EA
Developer documentation updates in 2025.09.0

Weekly release 2025.08.2

Tue, 14 Oct 2025 18:31:05 GMT

Bug fixed in 2025.08.2

Monthly release 2025.08.0

Tue, 07 Oct 2025 18:31:05 GMT

Governance delegates APIs are Beta
List all access request catalog entries for a user is GA
Unified requester experience is EA
Developer documentation updates in 2025.08.0
Bug fixed in 2025.08.0

Weekly release 2025.07.2

Tue, 30 Sep 2025 18:31:05 GMT

Monthly release 2025.07.0

Tue, 23 Sep 2025 18:31:05 GMT

Changes to Okta app API responses

Weekly release 2025.06.1

Tue, 16 Sep 2025 18:31:05 GMT

List all access request catalog entries for a user is Beta

Weekly release 2025.05.3

Tue, 09 Sep 2025 18:31:05 GMT

Request condition name length increase

Weekly release 2025.05.1

Tue, 02 Sep 2025 18:31:05 GMT

New variable for Access Certification campaign emails
Generate a risk assessment is Beta

Monthly release 2025.04.0

Tue, 26 Aug 2025 18:31:05 GMT

Risk Rules API is Beta

Weekly release 2025.03.2

Tue, 19 Aug 2025 18:31:05 GMT

Collections API is Beta

Weekly release 2025.03.1

Tue, 12 Aug 2025 18:31:05 GMT

Bug fixed in 2025.03.1

Monthly release 2025.03.0

Tue, 05 Aug 2025 18:31:05 GMT

Entitlements and Entitlement Bundles APIs are GA
New Access Certifications campaign
Bug fixed in 2025.03.0

Weekly release 2025.02.1

Tue, 29 Jul 2025 18:31:05 GMT

List all entitlements API response update

Monthly release 2025.02.0

Tue, 22 Jul 2025 18:31:05 GMT

New System Log event

Weekly release 2025.01.2

Tue, 15 Jul 2025 18:31:05 GMT

Bug fixed in 2025.01.2

Monthly release 2025.01.0

Tue, 08 Jul 2025 18:31:05 GMT

Selected Okta Identity Governance APIs are now GA

Monthly release 2025.10.0

Tue, 11 Nov 2025 18:31:05 GMT

More account details for end users
Random password generator for unmanaged SaaS accounts is GA

Weekly release 2025.09.2

Tue, 04 Nov 2025 18:31:05 GMT

Exclude symbols in project password policy

Weekly release 2025.09.1

Tue, 28 Oct 2025 18:31:05 GMT

Random password generator for unmanaged SaaS accounts is EA

Monthly release 2025.09.0

Tue, 21 Oct 2025 18:31:05 GMT

Enable Okta-managed Active Directory accounts is EA

Weekly release 2025.08.4

Tue, 14 Oct 2025 18:31:05 GMT

Role permission updates for attribute operations

Weekly release 2025.08.2

Tue, 07 Oct 2025 18:31:05 GMT

Active Directory Remote Desktop Protocol (RDP) support is EA

Monthly release 2025.08.0

Tue, 30 Sep 2025 18:31:05 GMT

Active Directory rotate password configuration is EA
Service Accounts API is EA
Search capability for Okta Privileged Access secrets

Monthly release 2025.06.0

Tue, 23 Sep 2025 18:31:05 GMT

Weekly release 2025.05.3

Tue, 16 Sep 2025 18:31:05 GMT

${rel.title}

${rel.pubDate.toUTCString()}

Test Bug fixed in 2025.10.3

Monthly release 2025.10.0

Tue, 21 Oct 2025 05:00:00 GMT

Org2Org OIDC Sign-on mode is GA in Production
User status in Okta Expression Language is GA in Preview
Network zone restrictions for clients is GA in Preview
Okta Integration IdP type is GA in Production
Behavior Detections for new ASN
Developer documentation update in 2025.10.0

Weekly release 2025.09.2

Tue, 14 Oct 2025 05:00:00 GMT

Bugs fixed in 2025.09.2

Weekly release 2025.09.1

Tue, 07 Oct 2025 05:00:00 GMT

New functionality filters in the OIN catalog
Bugs fixed in 2025.09.1

Monthly release 2025.09.0

Tue, 30 Sep 2025 05:00:00 GMT

User API Projections
Org2Org OIDC Sign-on mode is GA in Preview
Anything-as-a-Source for groups and group memberships API is EA in Preview
New System Log events for bulk groups and bulk group memberships changes
Breached Credentials Protection is GA in Production
Group Push Mappings is GA in Production
New validation rule for integration variables in the OIN Wizard
Clear user factors for all devices is GA in Production
Secure Identity Integrations filters in the OIN catalog
Okta Integration IdP type is GA in Preview
User status in Okta Expression Language is GA in Preview
Developer documentation update in 2025.09.0

Weekly release 2025.08.4

Tue, 23 Sep 2025 05:00:00 GMT

Bugs fixed in 2025.08.4

Weekly release 2025.08.2

Tue, 16 Sep 2025 05:00:00 GMT

Bugs fixed in 2025.08.2

Monthly release 2025.08.0

Tue, 09 Sep 2025 05:00:00 GMT

Weekly release 2025.07.3

Tue, 02 Sep 2025 05:00:00 GMT

Bugs fixed in 2025.07.3

Weekly release 2025.07.1

Tue, 26 Aug 2025 05:00:00 GMT

Bugs fixed in 2025.07.1

Monthly release 2025.07.0

Tue, 19 Aug 2025 05:00:00 GMT

OAuth 2.0 provisioning for Org2Org with key auto-rotation is GA in Preview
System Log event for monitoring LDAP Agent config file changes is EA
New validation rule for user profile attributes in OIN Wizard
Conditions for create user permission is GA in Production
Changes to Okta app API responses
Restrict access to the Admin Console is GA in Production
Developer documentation updates in 2025.07.0
Bug fixed in 2025.07.0

Weekly release 2025.06.2

Tue, 12 Aug 2025 05:00:00 GMT

Weekly release 2025.06.1

Tue, 05 Aug 2025 05:00:00 GMT

Frame-ancestors rollout for Content Security Policy
Bugs fixed in 2025.06.1

Monthly release 2025.06.0

Tue, 29 Jul 2025 05:00:00 GMT

Admins prevented from deleting published app instances
Authentication claims sharing between Okta orgs is GA in Production
Claims sharing between third-party IdPs and Okta is GA in Production
Conditions for create user permission
Define default values for custom user attributes is GA in Production
Domain restrictions on Realms is GA in Production
Number matching challenge with the Factors API is GA in Production
Restrict access to the Admin Console is GA in Preview
Expanded use of user.getGroups() function in Okta Expression Language is GA in Preview
Developer documentation updates in 2025.06.0
Bug fixed in 2025.06.0

Weekly release 2025.05.3

Tue, 22 Jul 2025 05:00:00 GMT

Integrator Free Plan org now available
Bugs fixed in 2025.05.3

Weekly release 2025.05.1

Tue, 15 Jul 2025 05:00:00 GMT

Breached Credentials Protection is EA in Preview
New User Role Targets API endpoint
Define default values for custom user attributes
Directories integration API is GA in Preview and Production
Number matching challenge with the Factors API is GA in Preview
Claims sharing between third-party IdPs and Okta is GA in Preview
Entitlement claims is GA in Production
POST requests to authorize endpoint is GA in Production
Authentication claims sharing between Okta orgs is GA in Preview
Bugs fixed in 2025.05.0

Weekly release 2025.04.3

Tue, 01 Jul 2025 05:00:00 GMT

Bugs fixed in 2025.04.3

Weekly release 2025.04.2

Tue, 24 Jun 2025 05:00:00 GMT

Subscriptions API no longer supports OKTA_ISSUE
Bugs fixed in 2025.04.2

Weekly release 2025.04.1

Tue, 17 Jun 2025 05:00:00 GMT

Claims sharing between third-party IdPs and Okta is self-service EA in Preview
Number matching challenge with the Factors API is self-service EA in Preview
OAuth 2.0 provisioning for Org2Org with Auto-Rotation is self-service EA in Preview
Bugs fixed in 2025.04.1

Monthly release 2025.04.0

Tue, 10 Jun 2025 05:00:00 GMT

Domain restrictions on Realms
OAuth 2.0 provisioning for Org2Org with Auto-Rotation is EA in Preview
OIN test account information deleted after 30 days
POST requests to authorize endpoint is GA Preview
Integration variable limit increase in OIN Submission
Conditional requests and entity tags are GA in Production
New rate limit event type
Create dynamic resource sets with conditions is GA in Preview
Developer documentation update in 2025.04.0
Bugs fixed in 2025.04.0

Weekly release 2025.03.3

Tue, 03 Jun 2025 05:00:00 GMT

Advanced search using conditioned profile attributes
Bugs fixed in 2025.03.3

Weekly release 2025.03.2

Tue, 27 May 2025 05:00:00 GMT

Bug fixed in 2025.03.2

Weekly release 2025.03.1

Tue, 20 May 2025 05:00:00 GMT

Bugs fixed in 2025.03.1

Monthly release 2025.03.0

Tue, 13 May 2025 05:00:00 GMT

OIDC IdPs now support group sync is GA in Production
Granular account linking for certain Identity Providers is GA in Production
Improved group search functionality is GA in Production
Improved user search functionality is GA in Production
Improved realms and device search functionality is GA in Production
Realms for Workforce is GA in Production
Identity Security Posture Management functionality in the OIN catalog
Default global session policy rule update
Developer documentation update in 2025.03.0
Bug fixed in 2025.03.0

Weekly release 2025.02.2

Tue, 06 May 2025 05:00:00 GMT

Bugs fixed in 2025.02.2

Weekly release 2025.02.1

Tue, 29 Apr 2025 05:00:00 GMT

Bugs fixed in 2025.02.1

Monthly release 2025.02.0

Tue, 22 Apr 2025 05:00:00 GMT

IP Exempt Zone is GA in Preview
OIDC IdPs now support group sync is GA in Preview
Granular account linking for certain identity providers is GA
Realms for Workforce is GA in Preview
Improved group search functionality is GA in Preview
Improved user search functionality is GA in Preview
Support for importing Active Directory group descriptions is GA in Production
Developer documentation updates in 2025.02.0
Bugs fixed in 2025.02.0

Weekly release 2025.01.2

Tue, 15 Apr 2025 05:00:00 GMT

Authentication claims sharing between Okta orgs is EA in Preview
Bugs fixed in 2025.01.2

Weekly release 2025.01.1

Tue, 08 Apr 2025 05:00:00 GMT

Bug fixed in 2025.01.1

Monthly release 2025.01.0

Tue, 01 Apr 2025 05:00:00 GMT

Additional use case selection in the OIN Wizard
Deprecated API endpoints: Extend, Grant, and Revoke Okta Support access
Granular configuration for Keep Me Signed In is EA in Preview
POST requests to the authorize endpoint is self-service EA

Weekly release 2025.10.1

Tue, 11 Nov 2025 18:55:10 GMT

Custom IDV vendors
Bugs fixed in 2025.10.1

Monthly release 2025.10.0

Tue, 04 Nov 2025 18:55:10 GMT

Weekly release 2025.09.2

Tue, 28 Oct 2025 18:55:10 GMT

Bugs fixed in 2025.09.2

Weekly release 2025.09.1

Tue, 21 Oct 2025 18:55:10 GMT

New functionality filters in the OIN catalog
Bugs fixed in 2025.09.1

Monthly release 2025.09.0

Tue, 14 Oct 2025 18:55:10 GMT

Weekly release 2025.08.4

Tue, 07 Oct 2025 18:55:10 GMT

Bugs fixed in 2025.08.4

Weekly release 2025.08.3

Tue, 30 Sep 2025 18:55:10 GMT

Bug fixed in 2025.08.3

Weekly release 2025.08.2

Tue, 23 Sep 2025 18:55:10 GMT

Bugs fixed in 2025.08.2

Monthly release 2025.08.0

Tue, 16 Sep 2025 18:55:10 GMT

Weekly release 2025.07.3

Tue, 09 Sep 2025 18:55:10 GMT

Bugs fixed in 2025.07.3

Weekly release 2025.07.2

Tue, 02 Sep 2025 18:55:10 GMT

Bugs fixed in 2025.07.2

Weekly release 2025.07.1

Tue, 26 Aug 2025 18:55:10 GMT

Bugs fixed in 2025.07.1

Monthly release 2025.07.0

Tue, 19 Aug 2025 18:55:10 GMT

Weekly release 2025.06.2

Tue, 12 Aug 2025 18:55:10 GMT

Weekly release 2025.06.1

Tue, 05 Aug 2025 18:55:10 GMT

Frame-ancestors rollout for Content Security Policy
Response body updates for the MyAccount Authenticators API
Bugs fixed in 2025.06.1

Monthly release 2025.06.0

Tue, 29 Jul 2025 18:55:10 GMT

Weekly release 2025.05.3

Tue, 22 Jul 2025 18:55:10 GMT

Integrator Free Plan org now available
Bugs fixed in 2025.05.3

Weekly release 2025.05.2

Tue, 15 Jul 2025 18:55:10 GMT

Enrollment grace periods is EA in Preview
Send app context to external IdPs is EA in Preview

Weekly release 2025.05.1

Tue, 08 Jul 2025 18:55:10 GMT

Bugs fixed in 2025.05.1

Monthly release 2025.05.0

Tue, 01 Jul 2025 18:55:10 GMT

Weekly release 2025.04.3

Tue, 24 Jun 2025 18:55:10 GMT

Bugs fixed in 2025.04.3

Weekly release 2025.04.2

Tue, 17 Jun 2025 18:55:10 GMT

Subscriptions API no longer supports OKTA_ISSUE
Bugs fixed in 2025.04.2

Weekly release 2025.04.1

Tue, 10 Jun 2025 18:55:10 GMT

Monthly release 2025.04.0

Tue, 03 Jun 2025 18:55:10 GMT

Weekly release 2025.03.3

Tue, 27 May 2025 18:55:10 GMT

Advanced search using conditioned profile attributes
Bugs fixed in 2025.03.3

Weekly release 2025.03.1

Tue, 20 May 2025 18:55:10 GMT

Bugs fixed in 2025.03.1

Monthly release 2025.03.0

Tue, 13 May 2025 18:55:10 GMT

Weekly release 2025.02.2

Tue, 06 May 2025 18:55:10 GMT

Incode as a third-party identity verification provider is EA in Preview
Bugs fixed in 2025.02.2

Weekly release 2025.02.1

Tue, 29 Apr 2025 18:55:10 GMT

Bugs fixed in 2025.02.1

Monthly release 2025.02.0

Tue, 22 Apr 2025 18:55:10 GMT

Weekly release 2025.01.2

Tue, 15 Apr 2025 18:55:10 GMT

Authentication claims sharing between Okta orgs is EA in Preview
Bugs fixed in 2025.01.2

Weekly release 2025.01.1

Tue, 08 Apr 2025 18:55:10 GMT

Bugs fixed in 2025.01.1

Monthly release 2025.01.0

Tue, 01 Apr 2025 18:55:10 GMT

Weekly release 2025.10.1

Tue, 11 Nov 2025 18:55:10 GMT

Bug fixed in 2025.10.1

Monthly release 2025.10.0

Tue, 04 Nov 2025 18:55:10 GMT

Entitlement history is Beta
New governance setting System Log event

Weekly release 2025.09.1

Tue, 28 Oct 2025 18:55:10 GMT

Bugs fixed in 2025.09.1

Monthly release 2025.09.0

Tue, 21 Oct 2025 18:55:10 GMT

Weekly release 2025.08.2

Tue, 14 Oct 2025 18:55:10 GMT

Bug fixed in 2025.08.2

Monthly release 2025.08.0

Tue, 07 Oct 2025 18:55:10 GMT

Governance delegates APIs are Beta
List all access request catalog entries for a user is GA
Unified requester experience is EA
Developer documentation updates in 2025.08.0
Bug fixed in 2025.08.0

Weekly release 2025.07.2

Tue, 30 Sep 2025 18:55:10 GMT

Monthly release 2025.07.0

Tue, 23 Sep 2025 18:55:10 GMT

Changes to Okta app API responses

Weekly release 2025.06.1

Tue, 16 Sep 2025 18:55:10 GMT

List all access request catalog entries for a user is Beta

Weekly release 2025.05.3

Tue, 09 Sep 2025 18:55:10 GMT

Request condition name length increase

Weekly release 2025.05.1

Tue, 02 Sep 2025 18:55:10 GMT

New variable for Access Certification campaign emails
Generate a risk assessment is Beta

Monthly release 2025.04.0

Tue, 26 Aug 2025 18:55:10 GMT

Risk Rules API is Beta

Weekly release 2025.03.2

Tue, 19 Aug 2025 18:55:10 GMT

Collections API is Beta

Weekly release 2025.03.1

Tue, 12 Aug 2025 18:55:10 GMT

Bug fixed in 2025.03.1

Monthly release 2025.03.0

Tue, 05 Aug 2025 18:55:10 GMT

Entitlements and Entitlement Bundles APIs are GA
New Access Certifications campaign
Bug fixed in 2025.03.0

Weekly release 2025.02.1

Tue, 29 Jul 2025 18:55:10 GMT

List all entitlements API response update

Monthly release 2025.02.0

Tue, 22 Jul 2025 18:55:10 GMT

New System Log event

Weekly release 2025.01.2

Tue, 15 Jul 2025 18:55:10 GMT

Bug fixed in 2025.01.2

Monthly release 2025.01.0

Tue, 08 Jul 2025 18:55:10 GMT

Selected Okta Identity Governance APIs are now GA

Monthly release 2025.10.0

Tue, 11 Nov 2025 18:55:10 GMT

More account details for end users
Random password generator for unmanaged SaaS accounts is GA

Weekly release 2025.09.2

Tue, 04 Nov 2025 18:55:10 GMT

Exclude symbols in project password policy

Weekly release 2025.09.1

Tue, 28 Oct 2025 18:55:10 GMT

Random password generator for unmanaged SaaS accounts is EA

Monthly release 2025.09.0

Tue, 21 Oct 2025 18:55:10 GMT

Enable Okta-managed Active Directory accounts is EA

Weekly release 2025.08.4

Tue, 14 Oct 2025 18:55:10 GMT

Role permission updates for attribute operations

Weekly release 2025.08.2

Tue, 07 Oct 2025 18:55:10 GMT

Active Directory Remote Desktop Protocol (RDP) support is EA

Monthly release 2025.08.0

Tue, 30 Sep 2025 18:55:10 GMT

Active Directory rotate password configuration is EA
Service Accounts API is EA
Search capability for Okta Privileged Access secrets

Monthly release 2025.06.0

Tue, 23 Sep 2025 18:55:10 GMT

Tue, 21 Oct 2025 05:00:00 GMT

Weekly release 2025.09.2

Tue, 14 Oct 2025 05:00:00 GMT

Bugs fixed in 2025.09.2

Weekly release 2025.09.1

Tue, 07 Oct 2025 05:00:00 GMT

New functionality filters in the OIN catalog
Bugs fixed in 2025.09.1

Monthly release 2025.09.0

Tue, 30 Sep 2025 05:00:00 GMT

Weekly release 2025.08.4

Tue, 23 Sep 2025 05:00:00 GMT

Bugs fixed in 2025.08.4

Weekly release 2025.08.2

Tue, 16 Sep 2025 05:00:00 GMT

Bugs fixed in 2025.08.2

Monthly release 2025.08.0

Tue, 09 Sep 2025 05:00:00 GMT

Weekly release 2025.07.3

Tue, 02 Sep 2025 05:00:00 GMT

Bugs fixed in 2025.07.3

Weekly release 2025.07.1

Tue, 26 Aug 2025 05:00:00 GMT

Bugs fixed in 2025.07.1

Monthly release 2025.07.0

Tue, 19 Aug 2025 05:00:00 GMT

Weekly release 2025.06.2

Tue, 12 Aug 2025 05:00:00 GMT

Weekly release 2025.06.1

Tue, 05 Aug 2025 05:00:00 GMT

Frame-ancestors rollout for Content Security Policy
Bugs fixed in 2025.06.1

Monthly release 2025.06.0

Tue, 29 Jul 2025 05:00:00 GMT

Admins prevented from deleting published app instances
Authentication claims sharing between Okta orgs is GA in Production
Claims sharing between third-party IdPs and Okta is GA in Production
Conditions for create user permission
Define default values for custom user attributes is GA in Production
Domain restrictions on Realms is GA in Production
Number matching challenge with the Factors API is GA in Production
Restrict access to the Admin Console is GA in Preview
Expanded use of user.getGroups() function in Okta Expression Language is GA in Preview
Developer documentation updates in 2025.06.0
Bug fixed in 2025.06.0

Weekly release 2025.05.3

Tue, 22 Jul 2025 05:00:00 GMT

Integrator Free Plan org now available
Bugs fixed in 2025.05.3

Weekly release 2025.05.1

Tue, 15 Jul 2025 05:00:00 GMT

Bugs fixed in 2025.05.1

Monthly release 2025.05.0

Tue, 08 Jul 2025 05:00:00 GMT

Weekly release 2025.04.3

Tue, 01 Jul 2025 05:00:00 GMT

Bugs fixed in 2025.04.3

Weekly release 2025.04.2

Tue, 24 Jun 2025 05:00:00 GMT

Subscriptions API no longer supports OKTA_ISSUE
Bugs fixed in 2025.04.2

Weekly release 2025.04.1

Tue, 17 Jun 2025 05:00:00 GMT

Monthly release 2025.04.0

Tue, 10 Jun 2025 05:00:00 GMT

Weekly release 2025.03.3

Tue, 03 Jun 2025 05:00:00 GMT

Advanced search using conditioned profile attributes
Bugs fixed in 2025.03.3

Weekly release 2025.03.2

Tue, 27 May 2025 05:00:00 GMT

Bug fixed in 2025.03.2

Weekly release 2025.03.1

Tue, 20 May 2025 05:00:00 GMT

Bugs fixed in 2025.03.1

Monthly release 2025.03.0

Tue, 13 May 2025 05:00:00 GMT

Weekly release 2025.02.2

Tue, 06 May 2025 05:00:00 GMT

Bugs fixed in 2025.02.2

Weekly release 2025.02.1

Tue, 29 Apr 2025 05:00:00 GMT

Bugs fixed in 2025.02.1

Monthly release 2025.02.0

Tue, 22 Apr 2025 05:00:00 GMT

Weekly release 2025.01.2

Tue, 15 Apr 2025 05:00:00 GMT

Authentication claims sharing between Okta orgs is EA in Preview
Bugs fixed in 2025.01.2

Weekly release 2025.01.1

Tue, 08 Apr 2025 05:00:00 GMT

Bug fixed in 2025.01.1

Monthly release 2025.01.0

Tue, 01 Apr 2025 05:00:00 GMT

Weekly release 2025.10.1

Tue, 11 Nov 2025 19:08:47 GMT

Custom IDV vendors
Bugs fixed in 2025.10.1

Monthly release 2025.10.0

Tue, 04 Nov 2025 19:08:47 GMT

Weekly release 2025.09.2

Tue, 28 Oct 2025 19:08:47 GMT

Bugs fixed in 2025.09.2

Weekly release 2025.09.1

Tue, 21 Oct 2025 19:08:47 GMT

New functionality filters in the OIN catalog
Bugs fixed in 2025.09.1

Monthly release 2025.09.0

Tue, 14 Oct 2025 19:08:47 GMT

Weekly release 2025.08.4

Tue, 07 Oct 2025 19:08:47 GMT

Bugs fixed in 2025.08.4

Weekly release 2025.08.3

Tue, 30 Sep 2025 19:08:47 GMT

Bug fixed in 2025.08.3

Weekly release 2025.08.2

Tue, 23 Sep 2025 19:08:47 GMT

Bugs fixed in 2025.08.2

Monthly release 2025.08.0

Tue, 16 Sep 2025 19:08:47 GMT

Weekly release 2025.07.3

Tue, 09 Sep 2025 19:08:47 GMT

Bugs fixed in 2025.07.3

Weekly release 2025.07.2

Tue, 02 Sep 2025 19:08:47 GMT

Bugs fixed in 2025.07.2

Weekly release 2025.07.1

Tue, 26 Aug 2025 19:08:47 GMT

Bugs fixed in 2025.07.1

Monthly release 2025.07.0

Tue, 19 Aug 2025 19:08:47 GMT

Weekly release 2025.06.2

Tue, 12 Aug 2025 19:08:47 GMT

Weekly release 2025.06.1

Tue, 05 Aug 2025 19:08:47 GMT

Frame-ancestors rollout for Content Security Policy
Response body updates for the MyAccount Authenticators API
Bugs fixed in 2025.06.1

Monthly release 2025.06.0

Tue, 29 Jul 2025 19:08:47 GMT

Weekly release 2025.05.3

Tue, 22 Jul 2025 19:08:47 GMT

Integrator Free Plan org now available
Bugs fixed in 2025.05.3

Weekly release 2025.05.2

Tue, 15 Jul 2025 19:08:47 GMT

Enrollment grace periods is EA in Preview
Send app context to external IdPs is EA in Preview

Weekly release 2025.05.1

Tue, 08 Jul 2025 19:08:47 GMT

Bugs fixed in 2025.05.1

Monthly release 2025.05.0

Tue, 01 Jul 2025 19:08:47 GMT

Weekly release 2025.04.3

Tue, 24 Jun 2025 19:08:47 GMT

Bugs fixed in 2025.04.3

Weekly release 2025.04.2

Tue, 17 Jun 2025 19:08:47 GMT

Subscriptions API no longer supports OKTA_ISSUE
Bugs fixed in 2025.04.2

Weekly release 2025.04.1

Tue, 10 Jun 2025 19:08:47 GMT

Monthly release 2025.04.0

Tue, 03 Jun 2025 19:08:47 GMT

Weekly release 2025.03.3

Tue, 27 May 2025 19:08:47 GMT

Advanced search using conditioned profile attributes
Bugs fixed in 2025.03.3

Weekly release 2025.03.1

Tue, 20 May 2025 19:08:47 GMT

Bugs fixed in 2025.03.1

Monthly release 2025.03.0

Tue, 13 May 2025 19:08:47 GMT

Weekly release 2025.02.2

Tue, 06 May 2025 19:08:47 GMT

Incode as a third-party identity verification provider is EA in Preview
Bugs fixed in 2025.02.2

Weekly release 2025.02.1

Tue, 29 Apr 2025 19:08:47 GMT

Bugs fixed in 2025.02.1

Monthly release 2025.02.0

Tue, 22 Apr 2025 19:08:47 GMT

Weekly release 2025.01.2

Tue, 15 Apr 2025 19:08:47 GMT

Authentication claims sharing between Okta orgs is EA in Preview
Bugs fixed in 2025.01.2

Weekly release 2025.01.1

Tue, 08 Apr 2025 19:08:47 GMT

Bugs fixed in 2025.01.1

Monthly release 2025.01.0

Tue, 01 Apr 2025 19:08:47 GMT

Weekly release 2025.10.1

Tue, 11 Nov 2025 19:08:47 GMT

Bug fixed in 2025.10.1

Monthly release 2025.10.0

Tue, 04 Nov 2025 19:08:47 GMT

Entitlement history is Beta
New governance setting System Log event

Weekly release 2025.09.1

Tue, 28 Oct 2025 19:08:47 GMT

Bugs fixed in 2025.09.1

Monthly release 2025.09.0

Tue, 21 Oct 2025 19:08:47 GMT

Weekly release 2025.08.2

Tue, 14 Oct 2025 19:08:47 GMT

Bug fixed in 2025.08.2

Monthly release 2025.08.0

Tue, 07 Oct 2025 19:08:47 GMT

Governance delegates APIs are Beta
List all access request catalog entries for a user is GA
Unified requester experience is EA
Developer documentation updates in 2025.08.0
Bug fixed in 2025.08.0

Weekly release 2025.07.2

Tue, 30 Sep 2025 19:08:47 GMT

Monthly release 2025.07.0

Tue, 23 Sep 2025 19:08:47 GMT

Changes to Okta app API responses

Weekly release 2025.06.1

Tue, 16 Sep 2025 19:08:47 GMT

List all access request catalog entries for a user is Beta

Weekly release 2025.05.3

Tue, 09 Sep 2025 19:08:47 GMT

Request condition name length increase

Weekly release 2025.05.1

Tue, 02 Sep 2025 19:08:47 GMT

New variable for Access Certification campaign emails
Generate a risk assessment is Beta

Monthly release 2025.04.0

Tue, 26 Aug 2025 19:08:47 GMT

Risk Rules API is Beta

Weekly release 2025.03.2

Tue, 19 Aug 2025 19:08:47 GMT

Collections API is Beta

Weekly release 2025.03.1

Tue, 12 Aug 2025 19:08:47 GMT

Bug fixed in 2025.03.1

Monthly release 2025.03.0

Tue, 05 Aug 2025 19:08:47 GMT

Entitlements and Entitlement Bundles APIs are GA
New Access Certifications campaign
Bug fixed in 2025.03.0

Weekly release 2025.02.1

Tue, 29 Jul 2025 19:08:47 GMT

List all entitlements API response update

Monthly release 2025.02.0

Tue, 22 Jul 2025 19:08:47 GMT

New System Log event

Weekly release 2025.01.2

Tue, 15 Jul 2025 19:08:47 GMT

Bug fixed in 2025.01.2

Monthly release 2025.01.0

Tue, 08 Jul 2025 19:08:47 GMT

Selected Okta Identity Governance APIs are now GA

Monthly release 2025.10.0

Tue, 11 Nov 2025 19:08:47 GMT

More account details for end users
Random password generator for unmanaged SaaS accounts is GA

Weekly release 2025.09.2

Tue, 04 Nov 2025 19:08:47 GMT

Exclude symbols in project password policy

Weekly release 2025.09.1

Tue, 28 Oct 2025 19:08:47 GMT

Random password generator for unmanaged SaaS accounts is EA

Monthly release 2025.09.0

Tue, 21 Oct 2025 19:08:47 GMT

Enable Okta-managed Active Directory accounts is EA

Weekly release 2025.08.4

Tue, 14 Oct 2025 19:08:47 GMT

Role permission updates for attribute operations

Weekly release 2025.08.2

Tue, 07 Oct 2025 19:08:47 GMT

Active Directory Remote Desktop Protocol (RDP) support is EA

Monthly release 2025.08.0

Tue, 30 Sep 2025 19:08:47 GMT

Active Directory rotate password configuration is EA
Service Accounts API is EA
Search capability for Okta Privileged Access secrets

Monthly release 2025.06.0

Tue, 23 Sep 2025 19:08:47 GMT

Weekly release 2025.05.3

Tue, 16 Sep 2025 19:08:47 GMT

Test Weekly release 2025.10.4

Tue, 18 Nov 2025 19:33:57 GMT

Custom IDV vendors
Bugs fixed in 2025.10.1

Weekly release 2025.10.1

Tue, 11 Nov 2025 19:33:57 GMT

Bug fixed in 2025.10.1

Monthly release 2025.10.0

Tue, 11 Nov 2025 19:33:57 GMT

More account details for end users
Random password generator for unmanaged SaaS accounts is GA

Test Monthly release 2025.11.0

Thu, 27 Nov 2025 05:00:00 GMT

Test feature
Test Bug fixed in 2025.10.3

Test Weekly release 2025.10.4

Wed, 19 Nov 2025 18:10:31 GMT

Custom IDV vendors
Bugs fixed in 2025.10.1

Weekly release 2025.10.1

Wed, 12 Nov 2025 18:10:31 GMT

Bug fixed in 2025.10.1

Monthly release 2025.10.0

Wed, 12 Nov 2025 18:10:31 GMT

More account details for end users
Random password generator for unmanaged SaaS accounts is GA