This article provides a step-by-step guide on how to update an access policy rule within an Okta Custom Authorization Server via the Okta Application Programming Interface (API) to trigger a Token Inline Hook.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Custom Authorization Servers
• Token Inline Hook
• Application Programming Interface (API)

Pre-Requisites

• Okta Domain
• API Token OR Access Token
• Authorization Server ID
• Access Policy ID (Authorization Server ID is needed to make this request)
• Access Rule ID (Authorization Server ID and Access Policy ID is needed to make this request)
• Inline Hook ID (Search only for the Token Hooks with this request: https://oktaDomain/api/v1/inlineHooks?type=com.okta.oauth2.tokens.transform)

Making the Update

Retrieve the current access rule configuration, modify the actions object to include the inline hook ID, and send a PUT request to apply the update.

1. Execute a GET request to retrieve the current configuration for the Access Rule.

   GET https://oktaDomain/api/v1/authorizationServers/{{authorizationServerId}}/policies/{{accessPolicyId}}/rules/{{accessRuleId}}

• • Example response:

    {
        "id": "0pr1234567890",
        "status": "ACTIVE",
        "name": "Token Hook",
        "priority": 2,
        "created": null,
        "lastUpdated": null,
        "system": false,
        "conditions": {
            "people": {
                "users": {
                    "include": [],
                    "exclude": []
                },
                "groups": {
                    "include": [
                        "EVERYONE"
                    ],
                    "exclude": []
                }
            },
            "grantTypes": {
                "include": [
                    "implicit",
                    "urn:ietf:params:oauth:grant-type:saml2-bearer",
                    "client_credentials",
                    "password",
                    "urn:ietf:params:oauth:grant-type:device_code",
                    "authorization_code",
                    "urn:ietf:params:oauth:grant-type:token-exchange"
                ]
            },
            "scopes": {
                "include": [
                    "*"
                ]
            }
        },
        "actions": {
            "token": {
                "accessTokenLifetimeMinutes": 60,
                "refreshTokenLifetimeMinutes": 0,
                "refreshTokenWindowMinutes": 10080
            }
        },
        "type": "RESOURCE_ACCESS"
    }

2. Format the request body for the update by modifying the actions object returned above to add the inlineHook.id:

   "actions": {
       "token": {
           "accessTokenLifetimeMinutes": 60,
           "refreshTokenLifetimeMinutes": 0,
           "refreshTokenWindowMinutes": 10080,
           "inlineHook": {
               "id": "<<inline hook id>>"
           }
       }
   }

3. Execute a PUT request to update the access rule with the modified JSON body.

   https://oktaDomain/api/v1/authorizationServers/{{authorizationServerId}}/policies/{{accessPolicyId}}/rules/{{accessRuleId}}

• • Example request body:

    {
        "id": "0pr123456789",
        "status": "ACTIVE",
        "name": "Token Hook",
        "priority": 2,
        "created": null,
        "lastUpdated": null,
        "system": false,
        "conditions": {
            "people": {
                "users": {
                    "include": [],
                    "exclude": []
                },
                "groups": {
                    "include": [
                        "EVERYONE"
                    ],
                    "exclude": []
                }
            },
            "grantTypes": {
                "include": [
                    "implicit",
                    "urn:ietf:params:oauth:grant-type:saml2-bearer",
                    "client_credentials",
                    "password",
                    "urn:ietf:params:oauth:grant-type:device_code",
                    "authorization_code",
                    "urn:ietf:params:oauth:grant-type:token-exchange"
                ]
            },
            "scopes": {
                "include": [
                    "*"
                ]
            }
        },
        "actions": {
            "token": {
                "accessTokenLifetimeMinutes": 60,
                "refreshTokenLifetimeMinutes": 0,
                "refreshTokenWindowMinutes": 10080,
                "inlineHook": {
                        "id": "cal1234567890"
                    }
            }
        },
        "type": "RESOURCE_ACCESS"
    }

Related References

• Custom Authorization Server Policies and Rules
• Inline Hook Management