After registering an Event Hook, before you can use it, you need to have Okta make a one-time GET verification request to your endpoint, passing your service a verification value that your service needs to send back. This serves as a test confirming that you control the endpoint.

This one-time verification request is the only GET request Okta will send to your external service, while the ongoing requests to notify your service of event occurrences will be HTTPS POST requests. Your web service can use the GET versus POST distinction to implement logic to handle this special one-time request.

The way your service needs to handle this one-time verification is as follows: The request from Okta will contain an HTTP header named 

X-Okta-Verification-Challenge

. Your service needs to read the value of that header and return it in the response body, in a JSON object named 

verification , i.e.: { "verification" : "value_from_header" }

. Note that the value comes to you in an HTTP header, but you need to send it back in a JSON object.

Read More: https://support.okta.com/help/s/article/Unable-to-verify-event-hook-Hook-hook-name-execution-failed

https://developer.okta.com/docs/concepts/event-hooks/#one-time-verification-request

Hello Azhar,

I'm facing the same issue, my application can handle GET requests for verification, and also POST to get the event data in the payload.

Sending GET request manualy works well, verification code is sent back. And I can see my GET request arriving in the application access logs, generating an HTTP 200.

From OKTA now , verification fails with the same error (Hook timed out) the weirdest part is that I cannot see any GET request from OKTA arriving in the application access log.

I wondered if this issue was related to the ssl handshake on the loadbalancer in front of my application, but could not find any OKTA request arriving the access logs of the loadbalancer neither...

If anyone had any advice, this could be really helpful

Thanks

Hi,

I'm facing exaclty the same thing.

The application handles both GET (returning the verification code) and POST. However when doing the verification through OKTA I keep receiving Unable to verify event hook. Hook "CreateUserHook" execution failed. Hook timed out.

In the application's log files I can see calls from Okta which are receiving HTTP 400.

Hi All,

The abve same issue, I also facing, I used both get and post, but when I verify it, it's throwing an error.

Can someone provide a solution for that.

THanks

Hi Prabir Das.

Thanks for the response, I also confussion on this issue. I am using mulesoft flow endpoint, even single time also it's not working, Not sure the exact issue. If possible can we have a discussion on this issue.

Thanks,

Hi Prabir Das,

I just tried in my mulesoft devloper cloud environment, now it's working fine and the hook configured successfully, Only issue client cloud environment and it's because of the SSL, I already raise the case on Okta support team, hope will get a some solutions on that issue. I will also let you know.

Thanks,

Hi Everyone,

I am having exactly the same issue with

"Unable to verify event hook. Hook "test hook" execution failed. Hook timed out" while Postman handles both GET/POST just fine.

Is there any update on this?

Thanks!