The Okta connector for Workflows does not have a built-in Event card for every Okta event that is event-hook-eligible. For event hook-eligible events that do not have a corresponding Event card in workflows, an API Endpoint flow can be triggered via an event hook configured in the Okta Admin dashboard. The Okta Event Types Catalog contains a complete list of event types and includes tags indicating whether each event is event-hook-eligible.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Workflows
• Okta Connector Events
• Application Programming Interface (API) Endpoint
• Event Hooks

How is an API Endpoint flow created?

Create an API Endpoint Workflow in the Workflows console to receive the event details.

1. In the Workflows console, navigate to the Flows tab, click + New Flow to create a new workflow.
2. Click the Add event card, then select API Endpoint under Okta apps.
3. Choose the security level for the flow and click Close. It is recommended to start with Secure with client token while initially building and testing the flow. See the documentation for the steps to configure the Secure with OAuth 2.0 security level.
4. Give the flow a name and click the Save button.
5. On the API Endpoint event card, click the Endpoint settings icon, </>, to edit the settings.
6. Copy the Invoke URL, as it will be needed to configure an Event Hook.  Note that the flow must be saved to generate the complete Invoke URL. If the URL contains placeholders for <alias> and <client-token>, it has not been saved.
7. Build out the rest of the workflow to address the intended use case.  When the flow is invoked from the event hook, the payload passed into the flow will contain the event details and can be retrieved from the body field on the API Endpoint flow event card.
   • NOTE: If the API Endpoint flow does not fully execute within the event hook timeout threshold, Okta retries the event hook, which sends the data twice to Workflows. To prevent timeouts, add the API Connector Close card as the first card in the flow to immediately release the HTTP connection. Review Event Hook Sends Data Twice to Workflows and Place the API Connector Close Card first in a flow for more information.
8. The flow must be turned on before it will be triggered.

Create an Event Hook in the Okta Admin Console

Configure an Event Hook in the Okta Admin Console to trigger the API Endpoint flow and pass the event details in the payload whenever the subscribed events occur.

1. In the Okta Admin Console, navigate to Workflow > Event Hooks and click Create Event Hook.
2. Paste the URL copied from the API Endpoint flow into the Endpoint URL field and fill in the Event Hook name field.
3. In the Select Events section, search for and select the event(s) that will trigger the workflow.
4. Click Create hook and Continue.
5. Click through the remaining steps, and at the end, click Verify. When the Endpoint URL is an API Endpoint flow, it will be automatically verified.
6. After successful verification, the Event Hook status will be set to Active.

Once the workflow is turned on, whenever the subscribed event(s) occur, the flow should trigger. The payload sent to the flow will contain the event details.

When configuring the API Endpoint flow to use the Secure with client token security level, Okta includes the client token in the clientToken query parameter in the URL. Remove the clientToken query parameter from the Endpoint URL and configure the event hook to send the token in the request headers to enhance security.

1. Identify the URL format containing the query parameter:
   https://orgname.workflows.oktapreview.com/api/flo/54490ab...f203774/invoke?clientToken=bc1b80...e1dfe2
2. Remove the clientToken query parameter from the Endpoint URL to allow the client token to transmit in the HEADER object instead of the plain text query string:
   https://orgname.workflows.oktapreview.com/api/flo/54490ab...f203774/invoke
3. Navigate to the Customize request section of the event hook and locate the Enhance security section.
4. Set the Authentication field value to x-api-client-token.
5. Set the Authentication secret to the value of the clientToken.

Review the following image for an example of the customized request configuration.

Related References

• Invoke a flow with an API endpoint
• Event Types Catalog
• Create an event hook
• Okta Workflows API Endpoint Alias and Client Token Values Are Not Generated
• Event Hook Sends Data Twice to Workflows