• API
• Group Rules
• Filtering Users

Since null or blank Attributes cannot be searched via API, users will have to be filtered with Group Rules first. This method will allow Administrators to filter users into a Group and then search for them via API.

Create the Group Rule in Okta by going to the Admin Dashboard > Directory > Groups > Group Rules, then use the following expressions:

• For users with a null value: user.attributeValue==null
• For users with a blank value or deleted values: user.attributeValue==""
• For users with a null, blank or deleted value: user.attributeValue==null or user.attributeValue==""
• For searching in a specific group only, then filter by null, blank or deleted values: isMemberOfGroupName("Everyone") and (user.attributeValue==null or user.attributeValue=="")

Example:

• The attribute is used instead of the placeholder user.attributeValue will be user.costCenter

  • Okta Admins can identify the variable name of an Attribute by navigating to Directories > Profile Editor > Okta User Profile > Edit and inspecting the desired Attribute.

    isMemberOfGroupName("New Employees") and (user.costCenter==null or user.costCenter=="")

     

• The result is that the users within the "New Employees" group are moved to the "no costcenter" group if they have no value in the user.costCenter attribute, where they can then be searched for via API.

Search for the users in the Group pointed to by the Group Rule above with:

{{url}}/api/v1/groups/{{groupId}}/users

NOTE: Please make sure not to use the user.attributeValue!=null or user.attributeValue!="" expression language. This one will trigger a massive user assignment to the targeted group. Okta will not see the NULL and blank values the same. In this case, if the user attribute is not defined on the Okta Profile, then will be added to the group. This is because these users had a value of NULL in the user.attributeValue, and since it was not " ", the second part of the expression was true, and the user will be assigned to the group.