A recommended way to remove users from group rule exceptions via API is to use Postman, the Okta Groups API.

NOTE: Admins can only update rules with status='INACTIVE'.

• Okta Groups API
• Postman
• Group Rules

Prerequisites: 

• Postman configured for the org environment as described on the Test the Okta REST APIs using Postman article.
• An Okta Org.
• Okta API collections are imported into Postman.
• The targeted group rule to be in an inactive state. 

For the removal of all users from a group rule's exception list, Admins can leverage the following API endpoint:  

PUT /api/v1/groups/rules/${ruleId}

In the request body, similar to what is shown in the screenshot below (includes the request and response), please include the following appropriate details, as needed. An example of the request body sent can be found below: 

curl -v -X PUT \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: SSWS ${api_token}" \
-d '{
  "type": "group_rule",
  "id": "0pr3f7zMZZHPgUoWO0g4",
  "status": "INACTIVE",
  "name": "Engineering group rule",
  "conditions": {
    "people": {
      "users": {
        "exclude": []
      },
      "groups": {
        "exclude": []
      }
    },
    "expression": {
      "value": "user.role==\"Engineer\"",
      "type": "urn:okta:expression:1.0"
    }
  },
  "actions": {
    "assignUserToGroups": {
      "groupIds": [
        "00gjitX9HqABSoqTB0g3"
      ]
    }
  }
}'

A screenshot of the PUT request, with the appropriate endpoint and the response (bottom half of screenshot): 
 

Once admins run the API call, the UI will reflect the users that have been removed from the group rule exception list. 

 

Related References

• Test the Okta REST APIs with Postman
• Update Group Rule API Documentation
• Download Postman
• Okta API collections
• Using CSV and JSON Data Files in the Postman Collection Runner