When using an Access Token issued to an API Service application to authorize an API request, Okta will return a 200 response code with an empty response body (even if the token is valid and was granted the necessary scope) if the application is not assigned any Admin Roles. Resolve this error by assigning the API Service application an Admin Role with the necessary permissions for the requested resource.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• API Services Application
• OAuth for Okta APIs
• Okta Management APIs

Even if the token was granted the scope needed for a given endpoint, the API Service applications must be granted Admin roles to receive the permissions required to make the request. 

 

How to Resolve an Empty Response Body When Using an OAuth Access Token?

Ensure that the API Service app has been granted sufficient Admin permissions to make the requests needed for the integration.

For example, if the integration is making GET requests to /api/v1/users, grant this application the okta.users.read scope AND assign it an admin role that has permission to read users.

• NOTE: Just like with an API token generated by an admin user, if the application is only granted a Groups admin role, it will only be able to make GET requests for members of its managed groups. 

Related References

• More details about silent downscoping are available in How to set up and use an OAuth for Okta Service app.