Monitoring certificate expiration dates prevents authentication errors caused by expired certificates. Obtain the expiration dates of certificates for Security Assertion Markup Language (SAML) applications by making an API call to the GET /api/v1/apps/<applicationId>/credentials/keys endpoint. Enumerate the key credentials for SAML Identity Providers (IdPs) by using the GET <url>/api/v1/idps/credentials/keys endpoint, which displays the entire list of SAML IdPs rather than retrieving the certificate expiration dates individually.

NOTE: Some of the curl code examples on this page include SSWS API token authentication. However, Okta recommends using scoped OAuth 2.0 and OpenID Connect (OIDC) access tokens to authenticate with Okta management APIs. OAuth 2.0 and OIDC access tokens provide fine-grain control over the bearer's actions on specific endpoints. See Okta API authentication methods.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta API
• Security Assertion Markup Language (SAML) Applications
• SAML Identity Providers (IdPs)

Monitoring certificate expiration dates is a common requirement for maintaining system security and functionality. Failure to update expired certificates results in authentication errors or service disruptions.

How are certificate expiration dates exported for SAML applications and Identity Providers?

Retrieve the expiration dates for SAML applications and SAML IdPs by executing the appropriate API GET requests and reviewing the returned key credentials.

Watch the video or follow the steps below.

1. Make a GET request to the /api/v1/apps/${applicationId}/credentials/keys endpoint.
   • The applicationId parameter requires a unique key representing an application. Replace ${applicationId} with the ID of the application.

Example GET request using curl:

curl -v -X GET \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: SSWS ${api_token}" \ "https://${OktaDomainName}/api/v1/apps/0oad5lTSBOMUBOBVVQSC/credentials/keys"

NOTE: Replace ${api_token} with the Okta API token and ${OktaDomainName} with the Okta domain.

2. Review the response array of Application Key Credentials. Each object in the array corresponds to a key credential and includes properties such as created (creation date) and expiresAt (expiration date). Look for the expiresAt field in the response to find the certificate expiration date.

Example response:

[
  {
    "created": "2015-12-10T18:56:23.000Z",
    "expiresAt": "2017-12-10T18:56:22.000Z",
    // other fields...
  },
  {
    "created": "2015-12-10T18:55:35.000Z",
    "expiresAt": "2045-01-23T02:15:23.000Z",
    // other fields...
  }
]

NOTE: In this example, the first key credential will expire on December 10, 2017, and the second one will expire on January 23, 2045.

When using the /api/v1/idps/credentials/keys endpoint to verify IdP expiration dates, Okta does not directly provide the IdP names. Instead, correlate the IdP names using the Key ID (KID) value. For example, use the received KID value to run a GET request against GET <url>/api/v1/idps?kid=<KIDvalue> to view the associated IdP name.

NOTE: After using GET <url>/api/v1/idps?kid=<KIDvalue>, Okta displays all the IdPs, including their name, creation date, and certificate expiration date, because the KID parameter does not support filtering.

Related Reference

• Identity Providers
• Okta API authentication methods