This article details what admin permissions are needed to create an API Token for Org2Org Provisioning.

• Okta Org2Org
• Okta Integration Network (OIN)
• Provisioning
• Okta Classic Engine

For Org2Org provisioning, a Super Administrator must generate the API token. Using another type of administrator with a different set of permissions will result in provisioning failures.

 

The failure occurs due to Okta executing multiple internal API calls, including but not limited to user creation. For instance, if an API key is generated with a different type of admin role, if the provision fails because of a permission issue, the user creation also fails. Occasionally, Okta also runs Group reconciliation Jobs besides the user creation API. 

Okta allows customers to set up provisioning with an API token generated by other types of admins. It will not show an error when they verify credentials in the provisioning tab, but it will fail when users are assigned.

It is essential to confirm the type of admin role used to create the API token in cases of Org2Org provisioning errors.