Directories Integration

The Directories Integration API provides operations to manage Active Directory (AD) and Lightweight Directory Access Protocol (LDAP) objects in a connected on-premises directory through Okta.

You can add or remove users from groups based on their identity and access requirements. This ensures that changes made to user access in Okta are reflected in AD or LDAP. When you use Okta Access Certifications to revoke a user's membership to an AD or LDAP group, the removal is reflected in AD or LDAP.

Okta can only manage group memberships for users and groups imported into Okta using the AD or LDAP integration. You can't use this API to manage users and groups that weren't imported through an AD or LDAP integration or are outside of the integration's org unit scope.

See AD Bidirectional Group Management and LDAP Bidirectional Group Management.

Update an external directory group membership
OAuth 2.0 scopes:
  • okta.directories.groups.manage

Updates an Active Directory or LDAP group membership directly in the Active Directory or LDAP server

Request
path Parameters
appInstanceId
required
string

ID of the Active Directory or LDAP app instance in Okta

Request Body schema: application/json
required
id
string

ID of the Active Directory or LDAP group to update

object (Parameters)

Attributes used for processing Active Directory or LDAP group membership update

action
string

The update action to take

Enum: Description
ADD

Add to the membership of the group

REMOVE

Remove from the membership of the group

attribute
string

The attribute that tracks group memberships in Active Directory or LDAP. For Active Directory, use member. For LDAP, use the appropriate attribute found in the LDAP server such as, but not limited to, uniqueMember or member.

values
Array of strings

List of user IDs whose group memberships to update

Responses
200

OK

400

Bad Request

403

Forbidden

404

Not Found

502

There are no connected agents.

504

Timed out waiting for agent

post/api/v1/directories/{appInstanceId}/groups/modify
Request samples
application/json
{
  • "id": "00g1xucgTZFrziXg10g4",
  • "parameters": {
    • "action": "ADD",
    • "attribute": "member",
    • "values": [
      ]
    }
}
Response samples
application/json
{
  • "errorCode": "E0000001",
  • "errorSummary": "Api validation failed: {0}",
  • "errorLink": "E0000001",
  • "errorId": "sampleiCF-8D5rLW6myqiPItW",
  • "errorCauses": [ ]
}