Overview

An Okta Resource Name (ORN) is a way to identify Okta resources in your Okta tenant.  Okta API REST URL is also supported.  Let us dig into ways to derive or look up your respective ORN!  This article will highlight some of the use cases surrounding Okta Identity Governance (OIG) APIs using resourceOrn.

Types of Okta Resource Names can be looked up in the Resources documentation.

orn:{partition}:{service}:{yourOrgId}:{objectType}:{objectId}:contained_resources

orn:{partition}:{service}:{yourOrgId}:{objectType}:{appName}:{objectId}

orn:{partition}:{service}:{yourOrgId}:contained_resources

Applies To

Assumptions

• Some APIs used by Okta Identity Governance may use or may require the use of the Okta Resource Name (ORN).

Supported Resources

The following article mentions some of the supported resources used in Okta Identity Governance.  Please note that there are other supported resources, but they may not apply to OIG at the time of authoring this document. 

The supported API endpoints:

Methods to derive an ORN

Determining {partition}  

The partition is nothing more than the environment visible in the Okta tenant name.

• https://{tenantName}.okta.com = partition of Okta
• https://{tenantName}.oktapreview.com = partition of Oktapreview

Determining {yourOrgId}  

The Organization Id is not as easily visible as the partition. The easiest way to determine it is to call an API. Instructions on how to use the API to pull the Organization Id can be found in the How to Find the Okta OrgId article.

Determining {appType} and {appId}

1. Log in to the Okta Admin Console. 
2. Navigate to Applications > Applications section. 
3. Find the desired group and click on it. 
4. The {appType} and {appId} will be part of the URL in the administrative panel. For example, it would follow a format like: 
   1. https:domain-admin.oktapreview.com/admin/app/{appType}/instance/{appId}/#tab-assignments

https://your-okta-domain.com/admin/app/oidc_client/client/0oal5aedkkx4TNnPm1d7#tab-general (OIDC App)

https://your-okta-domain.com/admin/app/TestApp_s1/instance/0oakzkm8ozawSvRVL1d7/#tab-assignments (SAML App)

https://your-okta-domain.com/admin/app/salesforce/instance/0oa9d0l878boNXWzs1d7/#tab-assignments (OIN Catalog App)

Determining {groupId}

1. Log in to the Okta Admin Console. 
2. Navigate to Directory > Groups section. 
3. Find the desired group and click on it. 
4. The group ID will be part of the URL in the administrative panel. For example, it might look like the following, where the bold value is the groupId:

https://your-okta-domain.com/admin/group/00gga58j68YCcZ9Zh1d7

Determining {userId}

1. Log in to the Okta Admin Console. 
2. Navigate to the Directory > People section. 
3. Find the desired user profile and click on it. 
4. The user ID will be part of the URL in the administrative panel. For example, it might look like the following, where the bold value is the userId:

  https://your-okta-domain.com/admin/user/profile/view/abcdefgh123454654875454

Determining {bundleId}

1. Log in to the Okta Admin Console. 
2. Navigate to the Applications > Applications section.
3. Find the application with governance enabled.
4. Navigate to the Governance tab.
5. Navigate to the Bundles tab.
6. Click on Actions/Edit after selecting the target bundle.
7. The bundle ID will be part of the URL in the administrative panel. For example, it might look like the following, where the bold value is the bundleId:  https://your-okta-domain.com/admin/app/em/instance/0oa9h0l878boNXWzs1d7/entitlements/bundles/enbxpt1ogCEmrRa2T1d6/edit

Determining {entitlementValueId}

1. The entitlement value ID is specific to an application in which it was created/imported.  To pull that Id you need to run two API calls.

Pull a list of entitlements assigned to application with https://developer.okta.com/docs/api/iga/openapi/governance.api/tag/Entitlements/#tag/Entitlements/operation/listEntitlements
Then pull the list of entitlement values listed under the entitlement pulled from the previous step. https://developer.okta.com/docs/api/iga/openapi/governance.api/tag/Entitlements/#tag/Entitlements/operation/listAllEntitlementValues

Determining {collectionId}

1. Log in to the Okta Admin Console. 
2. Find the application with governance enabled.
3. Navigate to the Okta Identity Governance section. 
4. Select Resource Collections menu.
5. Find the collection and select the view button.
6. The collection id will be part of the URL in the administrative panel. For example, it might look like the following, where the bold value is the collectionId: 
   https://your-okta-domain.com/admin/governance/collections/col1047tkvYH3ALCK1d7

Related References

• Revert a user to Policy in Okta Identity Governance
• Guide on using Okta Identity Governance API’s