When an administrator calls the application grants (/api/v1/apps/{appid}/grants) API, Okta generates an E0000006 error even when the administrator configures the correct scopes. This occurs because the endpoint strictly requires Super Administrator permissions to read the grants. Assign the Super Administrator role to the account making the API call to resolve the issue.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Management API
• Application Grants Endpoint

This error occurs because the /api/v1/apps/{appid}/grants endpoint requires Super Administrator permissions to read the application grants. Only Super Administrators who possess the required scopes can make the API call, and no other administrator type (custom or standard role) has permission to make the request, even if they have granted the scope.

What steps assign administrator roles to a service application?

Navigate to the application settings in the Okta Admin Console and edit the assignments on the administrator roles tab to grant the required permissions.

1. In the Okta Admin Console, go to Applications, and then select Applications.
2. Select the service application that generates the access token.
3. Select the Admin roles tab.
4. Select Edit assignments.
5. Assign the appropriate administrator role that grants permission to perform the desired action.
6. Select Save Changes.

The following steps assign administrator roles to a user.

Add an administrator role to the user from the security settings in the Okta Admin Console.

1. In the Okta Admin Console, go to Security, and then select Administrators.
2. Select the Admins tab.
3. Select Add administrator.
4. Select the user in the Select admin field.
5. Select the required role, and then select Save.

Related References

• Implement OAuth for Okta
• Standard administrator roles and permissions
• Work with the admin component
• Roles in Okta