I am getting an "errorSummary": "Invalid search attribute." error back when trying find use the above search criteria and the documentation suggests that the only top level attributes I can search for are
id, status, created, activated, statusChanged and lastUpdated
The support team got back to me with the below. So it is NOT possible, to search based on lastLogin.
"As an alternative that would provide you the same result would be to do in Reports> Okta Password Health report and that will give you the last login as well. If you want to go with API call instead you can use "List Active Users". The call in the result will also provide you with the lastLogin field, but there is no API that will give you that specific result directly as a search."
I really hope though that this will become a searchable attribute some day, why would lastUpdated by searchable and lastLogin not?