Attempting to execute any Okta action cards in a workflow returns the following error when the workflow was previously executing successfully:
{
"error": {
"status": 500,
"message": {
"statusCode": 400,
"data": "{\"error\":\"invalid_grant\",\"error_description\":\"The refresh token is invalid or expired.\"}"
}
}
}
- Workflows
- Okta Connector
To determine if the session was deliberately cleared by Okta, use the following query to search the system logs (Okta Admin console > Reports > System Log) for the ID of the account used to authorize the connection during the time frame when the connection stopped working:
eventType eq "user.session.clear" and target.id eq "00urduzspHCdrPdL25d6"
If any events are found, the Actor object can be used to identify the user who cleared the session. If the Client > UserAgent > RawUserAgent attribute is set to Azuqua, the action was initiated by Workflows. In this case, the Actor will also be the account used for the Okta connection.
To prevent the issue from reoccurring after reauthorizing the connection, determine which workflows are using the Clear User Sessions card and add logic to the flow to avoid clearing the session of the account used for the Okta connection.
