When attempting to create an OpenID Connect (OIDC) "web" type application using the Okta API or Infrastructure as Code (IaC) tools like Terraform, the following error occurs:

Terraform Error

Error: failed to create OAuth application: the API returned an error: Self service application assignment is not enabled..
Causes: errorSummary: Self service application assignment for organization managed apps must be enabled.

API Error

{
    "errorCode": "E0000043",
    "errorSummary": "Self service application assignment is not enabled.",
    "errorLink": "E0000043",
    "errorId": "oaeLTJ3aTngQHCg3_4gY_HvDQ",
    "errorCauses": [
        {
            "errorSummary": "Self service application assignment for organization managed apps must be enabled."
        }
    ]
}

This article clarifies why this error occurs and how to resolve it by updating the organization settings or the request parameters.

• Okta Identity Engine (OIE)
• Terraform Provider
• Okta API
• OIDC application

The error occurs when the application configuration includes the accessibility_self_service parameter when using Terraform (or accessibility.selfService in the API) with its value set to true.

In Okta, enabling self-service assignment for organization-managed applications is a prerequisite for setting this property. If this feature is disabled at the organization level, the API rejects the creation request with a 403 Forbidden status.

This issue is not specific to Terraform and occurs in any direct API integration attempting to enable self-service assignment for a new application.

To resolve this error, enable the self-service application assignment settings in the Okta Admin Console or modify the Terraform configuration (or the API request body if that's how the application is being created).

Enable Self-Service Assignment in Okta

1. Sign in to the Okta Admin Console.

2. Navigate to Applications > Self Service.

3. Select the Settings tab.

4. Click Edit.

5. Enable Allow users to add org-managed apps.

6. Click Save.

Modify Application Configuration

If self-service assignment is not required for the application, update the request parameters to disable the feature.

For API Requests

Locate the accessibility object in the JSON payload and set selfService to false:

"accessibility": { "selfService": false, "errorRedirectUrl": null, "loginRedirectUrl": null }

For Terraform

1. Locate the okta_app_oauth resource in the configuration file.

2. Set the accessibility_self_service parameter to false.

3. Re-run the Terraform plan and apply.

Related References

• How to Capture Debug Logs from Terraform
• Terraform OAuth Resource
• Okta OIDC Application API Reference