AdhithyaS.10776 (Customer) asked a question.
I’m working on extracting an attribute value from an application and writing it into a custom user attribute in Okta.
While testing, I noticed that when I attempt to update the user using the "Update User" card in Okta Workflows, the update fails with a 404 Not Found error unless I also map core profile fields like firstName, lastName, username, and primaryEmail along with the custom attribute.
If I include these fields in the mapping, the update succeeds and the custom attribute is updated correctly.
However, this approach works only for Okta-mastered users. For Active Directory (AD)-sourced users, these fields are read-only, and trying to map them causes issues, making it impossible to update the custom attribute through the same flow.
Could you please advise on the best practice for updating a custom attribute for AD-sourced users in this situation?
@AdhithyaS.10776 (Customer) - I want to expand on Paul's response a bit to make sure things are clear.
While the article provided is focused on "Okta Workflows the API client" it is not limited to Okta Workflows. Any API client is going to receive the exact same results when a profile is mastered/sourced by another system. In those scenario's the systems are responsible for syncing/provisioning the attributes to the Okta Profile and thus they are locked on the Okta side otherwise they would just be overwritten on the next sync. Additionally, there is no direct way for Okta Workflows to communicate with an On-prem system. It is unsupported.
Finally, based on "How" you updated the user in your description you utilized "Strict" instead of "Partial". In the API documentation these actions are now labeled as "Replace & Update"
https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#tag/User/operation/replaceUser
Replace User will "update" the user with all specified values. All existing unspecified values will be "nulled out". This is considered "Strict" and utilizes a PUT operation.
Update User will update only the values specified. This is considered "partial" and it utilizes a POST operation.