To resolve the forbidden error, configure an API Service application in the target organization and assign the required administrative roles and scopes.

Step 1: Create an API Service App in the Target Organization

1. In the target organization, go to Applications > Applications.
2. Select Create App Integration.
3. Select API Services and click Next.
4. Enter an application name and click Save.

Step 2: Assign Administrative Roles

1. In the new API Service app, navigate to the Admin roles tab.
2. Click Edit assignments.
3. Select Super Admin or Org Admin from the Role dropdown menu.
4. Click Save Changes.

Step 3: Grant API Scopes

1. Navigate to the Okta API Scopes tab of the API Service app.
2. Locate and click Grant for the following scopes:
   • okta.groups.manage
   • okta.users.manage (required if provisioning users)

Step 4: Configure Provisioning in the Source Organization

1. In the source organization, navigate to the Okta Org2Org application.
2. Select the Provisioning tab and click Integration.
3. Click Configure API Integration and select Enable API integration.
4. Set the Authentication Scheme to OAUTH Auto-Rotation.
5. Provide the Client ID, Client Secret, and Token Endpoint from the API Service app created in the target organization.
6. Click Save.