The Okta Identity Governance APIs can be used within Okta Workflows by leveraging the Okta Identity Governance connector or the Okta connector. The desired governance scopes will need to be granted to the Okta Workflows OAuth application before (re)authorizing the Okta Identity Governance connector or the Okta connector

If the scopes are not granted, a 403 Forbidden error can occur when trying to reach an OIG API endpoint. The www-authenticate response header included in the error message indicates that the access token does not contain the required scopes, in this example, the okta.governance.accessRequests.read scope:

www-authenticate: Bearer authorization_uri="http://{subdomain}.okta.com/oauth2/v1/authorize""", realm="http://{subdomain}.okta.com", scope="okta.governance.accessRequests.read", error="insufficient_scope", error_description="The access token provided does not contain the required scopes.", resource="/governance/api/v1/requests/{requestId}"

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Identity Governance (OIG)
• Okta Workflows
• Access Requests
• Access Certifications

Grant the necessary governance scopes to the Okta Workflows OAuth application and create/(re)authorize the connection in Okta Workflows by following these steps:

1. Navigate to the Admin Console as a Super Admin.
2. Go to Applications > Applications and open the Okta Workflows OAuth application.
3. Select the Scopes tab, locate the scopes needed for the API endpoints, and click Grant.
   • NOTE: Find a collection of OIG API scopes in the OIG OAuth 2.0 Scopes documentation.
   • 
4. Authorize or reauthorize the connection in Okta Workflows Console.
   • Okta recommends creating a connection using the Okta Identity Governance connector to leverage the existing OIG Event and Action cards, as well as the Custom API Action.
     • See OIG Authorization
   • If using the Okta connector, go to the Permissions tab in the pop-up window during reauthorization. Verify the desired scopes are selected under Customize scopes or re-select Use default scopes as mentioned in the Okta Workflows Connection - Insufficient Scope article.
5. Utilize the Okta Identity Governance APIs through the Okta Identity Governance connector cards or an Okta Custom API Action.