Okta API Token Validity and Permission Changes During Admin Role Reassignment
Last Updated:
Overview
If the admin role assignments for a user who created an API token change, the API token permissions will change to match their current admin permissions. If the user loses all of their assigned admin roles, the API token will not be revoked/removed from Okta, but the user and their token will lose access to resources that require admin permissions. Users with a valid API token but no assigned admin permissions will also still be able to make API calls with this token to request information about their own user (for example, making a GET to /api/v1/users/me). Static API Tokens will still expire if they have not been used for 30 days.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic
- Admin Roles
- API Tokens
Solution
What happens when there is a change to the admin role assignments for a user who generated an API token?
If the admin role assignments for a user who created an API token change, the API token permissions will change to match their current admin permissions automatically. Their token can only be used to make requests to resources to which that user still has admin permissions.
What happens if the user who generated an API token loses all of their admin role assignments?
If the user loses all of their assigned admin roles, the API token will not be revoked/removed from Okta, but the user and their token will lose access to resources that require admin permissions. If their admin roles were revoked accidentally, assigning them back will restore admin permissions for both the user and their active API tokens.
Users with a valid API token but no assigned admin permissions will also still be able to make API calls with this token to request information about their own user (for example, making a GET to /api/v1/users/me).
NOTE: Static API Tokens will still expire if they have not been used for 30 days.
