Okta Workflows 501 and 403 Errors When Using Add User to Group and Remove User From Group Cards
Last Updated:
Overview
Okta Workflows generates 501 and 403 errors when attempting to add or remove users from a group that is not sourced by Okta or is a built-in Okta group. Verify the group type using the Read Group card and filter searches to only include Okta-sourced groups to resolve this issue.
Attempting to add a user to a group using the Add User to Group card fails with the following error:
501 Not Implemented
"body": {
"errorCode": "E0000060",
"errorSummary": "Unsupported operation.",
"errorLink": "E0000060",
"errorId": "oaea2E4hyiNQEOxzDmZRLX64Q",
"errorCauses": []
},
"message": "501 Not Implemented",
"code": 501,
"description": "HTTP Request Error"
Attempting to remove a user from a group using the Remove User from Group card fails with the following error:
403 Forbidden
"body": {
"errorCode": "E0000006",
"errorSummary": "You do not have permission to perform the requested action",
"errorLink": "E0000006",
"errorId": "oaei0xmdliuScGuKnrvNvZihg",
"errorCauses": []
},
"message": "403 Forbidden",
"code": 403,
"description": "HTTP Request Error"Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Okta Workflows
- Okta Connector Add User to Group Card
- Okta Connector Remove User From Group Card
Cause
These errors occur when attempting to add users to or remove users from a group not sourced by Okta or a built-in Okta group.
Solution
How are the 501 and 403 errors resolved in Okta Workflows?
Verify the group type using the Read Group card and filter the search results to include only Okta-sourced groups by performing the following actions.
- Use the Read Group card to retrieve the group Type attribute to verify that the group in question is an Okta-sourced group. The type returns as
OKTA_GROUPfor an Okta-sourced group,APP_GROUPfor an application group (such as Google or Office 365), or BUILT_IN for a built-in Okta group (such as Everyone). - When using the Search Groups card to find groups, set the Type attribute input to
OKTA_GROUPto filter the results to only Okta-sourced groups.
