What Okta Management changed, 23 March 2026 to 27 October 2026
727 operations became 782. 3 were removed, 0 were newly deprecated, 58 were added, and 3 request fields became required.
Read from okta/okta-management-openapi-spec at fd9b9f8 and 5cf2dc4 (version 2026.42.1). Generated 31 October 2026 by the specification parser the APIBreak Action uses, applied to Okta Management's published specification.
Okta publishes its Management API description in okta/okta-management-openapi-spec, with one directory per release and a current directory. This page reads dist/current/management-minimal.yaml. Version policy and shutdown dates are not in the specification, so this page does not state them; it reads the deprecated flag on each operation.
Removed from the specification
- GET /okta-personal-settings/api/v1/export-blocklists removed in 86abad9 · 29 September 2026
- PUT /okta-personal-settings/api/v1/edit-feature removed in 86abad9 · 29 September 2026
- PUT /okta-personal-settings/api/v1/export-blocklists removed in 86abad9 · 29 September 2026
Newly deprecated in this window
A deprecation is the notice period. It is the cheapest moment to act and the easiest one to miss. This list compares operations present at the baseline.
No compared operation (one paired with a baseline operation) gained the deprecated flag in this window.
Deprecated as of the current specification (4)
Everything the vendor currently marks deprecated, whether or not it changed recently. The vendor has flagged each of these for possible removal, with or without a date attached.
- GET /api/v1/policies/{policyId}/app
- POST /api/v1/org/privacy/oktaSupport/extend
- POST /api/v1/org/privacy/oktaSupport/grant
- POST /api/v1/org/privacy/oktaSupport/revoke
Entries without a link were already marked deprecated at fd9b9f8 · 23 March 2026, the baseline compared here.
Request fields removed from the specification
The current specification no longer lists these request fields, which the baseline did. A caller that still sends one is sending a parameter the new version does not define; whether Okta Management rejects or ignores it at runtime is not something a specification diff can show, and what it means for an integration depends on how Okta Management versions — see the note at the top of this page.
- POST /api/v1/device-assurances no longer lists devicePostureChecks (application/json)
- PUT /api/v1/device-assurances/{deviceAssuranceId} no longer lists devicePostureChecks (application/json)
Request fields that became required
Only JSON request bodies are compared. A top-level field applies whenever the operation is sent a JSON body. A nested field applies only inside each object containing it that is sent (for an array, each element), so a caller that never sends that object, or sends an empty array, is not affected.
- POST /api/v1/iam/roles — now requires permissions[] when permissions is sent
- POST /privileged-access/api/v1/service-accounts — now requires password
- PUT /api/v1/users/{userId}/risk — now requires riskLevel
Okta Management API questions
Every answer below is computed from the snapshot above, and each links to the Okta Management specification it was read from.
- Which Okta Management API endpoints were removed recently?
- 3 operations were removed from dist/current/management-minimal.yaml in okta/okta-management-openapi-spec between 23 March 2026 and 27 October 2026: GET /okta-personal-settings/api/v1/export-blocklists, PUT /okta-personal-settings/api/v1/edit-feature and PUT /okta-personal-settings/api/v1/export-blocklists. The file went from 727 to 782 operations.
- Source: okta/okta-management-openapi-spec, the two commits compared
- Which Okta Management API endpoints are deprecated?
- As of 27 October 2026, dist/current/management-minimal.yaml in okta/okta-management-openapi-spec marks 4 operations deprecated: GET /api/v1/policies/{policyId}/app, POST /api/v1/org/privacy/oktaSupport/extend, POST /api/v1/org/privacy/oktaSupport/grant and POST /api/v1/org/privacy/oktaSupport/revoke. No compared operation (one the comparison paired with a baseline operation) gained the deprecated flag between 23 March 2026 and 27 October 2026. 4 were already deprecated at the baseline.
- Source: okta/okta-management-openapi-spec, the two commits compared
- Did any Okta Management API request fields become required?
- 3 JSON request fields became required between 23 March 2026 and 27 October 2026: permissions[] on POST /api/v1/iam/roles, password on POST /privileged-access/api/v1/service-accounts and riskLevel on PUT /api/v1/users/{userId}/risk. 2 are top-level fields of the JSON request body, which apply whenever a JSON body is sent; 1 is nested and applies only inside each object containing the field that the body sends (for an array, each element). A JSON body that leaves one out where it applies no longer matches the current specification.
- Source: okta/okta-management-openapi-spec, the two commits compared
- Where is the Okta Management OpenAPI specification?
- In the okta/okta-management-openapi-spec repository on GitHub. This page reads dist/current/management-minimal.yaml at commit 5cf2dc4 (version 2026.42.1), dated 27 October 2026.
- Source: okta/okta-management-openapi-spec on GitHub
The Action does not check Okta Management yet
It checks GitHub REST and Stripe. If you want your CI to check the Okta Management endpoints you call, say so in an issue, because requests like that decide which vendor the Action should support next.