{"openapi":"3.1.0","info":{"title":"Okta Admin Roles (BYOK) API","version":"0.1.0","description":"Okta Admin Roles (BYOK) lets an AI assistant read your own Okta Admin Roles data through the Okta Admin Roles API with a key you supply (Okta API token). Read-only: 7 tools (list_custom_roles, get_custom_role, list_role_permissions, list_resource_sets, get_resource_set, list_resource_set_resources, list_resource_set_bindings). The BYOK key travels with each request, is used for that one call only...\n\nEvery operation is read-only or compute-only. The same tools are available over MCP (streamable HTTP) at https://byok-okta-admin-roles.connectorbay.com/mcp.","contact":{"name":"Unify Dynamics LLC","email":"agent@connectorbay.com","url":"https://connectorbay.com/byok-okta-admin-roles/docs"},"termsOfService":"https://connectorbay.com/byok-okta-admin-roles/terms"},"servers":[{"url":"https://byok-okta-admin-roles.connectorbay.com"}],"externalDocs":{"url":"https://connectorbay.com/byok-okta-admin-roles/docs"},"security":[{"upstreamKey":[]}],"components":{"securitySchemes":{"bearer":{"type":"http","scheme":"bearer","description":"Optional. A Pro API key raises rate limits; no credentials are required."},"upstreamKey":{"type":"apiKey","in":"header","name":"X-Upstream-Key","description":"Your own key for the service this connector wraps (bring your own key). Used for that one call only; never stored, logged or cached."}},"schemas":{"Error":{"type":"object","properties":{"ok":{"const":false},"error":{"type":"object"}}}}},"paths":{"/v1/tools/list_custom_roles":{"post":{"operationId":"list_custom_roles","summary":"List custom administrator roles with id, label, description and dates. Use for \"Which custom admin roles are defined in ","description":"List custom administrator roles with id, label, description and dates. Use for \"Which custom admin roles are defined in our Okta org\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"org":{"description":"Your Okta org subdomain: the part before .okta.com, for example 'acme' for acme.okta.com.","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Org","type":"string"},"after":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Pagination cursor taken from the previous answer's next link; leave empty for the first page.","title":"After"}},"required":["org"],"title":"list_custom_rolesArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_custom_role":{"post":{"operationId":"get_custom_role","summary":"Get one custom administrator role: label, description and dates. Use for \"What is Okta custom role cr0Yq6IJxGIr0ouum0g3 ","description":"Get one custom administrator role: label, description and dates. Use for \"What is Okta custom role cr0Yq6IJxGIr0ouum0g3 for\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"org":{"description":"Your Okta org subdomain: the part before .okta.com, for example 'acme' for acme.okta.com.","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Org","type":"string"},"role_id":{"description":"Custom admin role id or label, for example cr0Yq6IJxGIr0ouum0g3.","maxLength":200,"title":"Role Id","type":"string"}},"required":["org","role_id"],"title":"get_custom_roleArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_role_permissions":{"post":{"operationId":"list_role_permissions","summary":"List the permissions granted by one custom administrator role (for example okta.users.read) with any attribute condition","description":"List the permissions granted by one custom administrator role (for example okta.users.read) with any attribute conditions and dates. Use for \"Which permissions does Okta custom role cr0Yq6IJxGIr0ouum0g3 grant\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"org":{"description":"Your Okta org subdomain: the part before .okta.com, for example 'acme' for acme.okta.com.","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Org","type":"string"},"role_id":{"description":"Custom admin role id or label, for example cr0Yq6IJxGIr0ouum0g3.","maxLength":200,"title":"Role Id","type":"string"}},"required":["org","role_id"],"title":"list_role_permissionsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_resource_sets":{"post":{"operationId":"list_resource_sets","summary":"List resource sets (collections of users, groups and apps that custom roles can be limited to) with id, label, descripti","description":"List resource sets (collections of users, groups and apps that custom roles can be limited to) with id, label, description and dates. Use for \"Which resource sets exist for delegated administration in Okta\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"org":{"description":"Your Okta org subdomain: the part before .okta.com, for example 'acme' for acme.okta.com.","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Org","type":"string"},"after":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Pagination cursor taken from the previous answer's next link; leave empty for the first page.","title":"After"}},"required":["org"],"title":"list_resource_setsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_resource_set":{"post":{"operationId":"get_resource_set","summary":"Get one resource set: label, description and dates. Use for \"What does Okta resource set iamoJDFKaJxGIr0oamd9g describe\"","description":"Get one resource set: label, description and dates. Use for \"What does Okta resource set iamoJDFKaJxGIr0oamd9g describe\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"org":{"description":"Your Okta org subdomain: the part before .okta.com, for example 'acme' for acme.okta.com.","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Org","type":"string"},"resource_set_id":{"description":"Resource set id or label, for example iamoJDFKaJxGIr0oamd9g.","maxLength":200,"title":"Resource Set Id","type":"string"}},"required":["org","resource_set_id"],"title":"get_resource_setArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_resource_set_resources":{"post":{"operationId":"list_resource_set_resources","summary":"List the resources in one resource set, each with its id and Okta resource name (ORN) and dates. Use for \"Which resource","description":"List the resources in one resource set, each with its id and Okta resource name (ORN) and dates. Use for \"Which resources belong to Okta resource set iamoJDFKaJxGIr0oamd9g\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"org":{"description":"Your Okta org subdomain: the part before .okta.com, for example 'acme' for acme.okta.com.","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Org","type":"string"},"resource_set_id":{"description":"Resource set id or label, for example iamoJDFKaJxGIr0oamd9g.","maxLength":200,"title":"Resource Set Id","type":"string"},"limit":{"anyOf":[{"maximum":200,"minimum":1,"type":"integer"},{"type":"null"}],"default":100,"description":"How many results to return (1 to 200).","title":"Limit"},"after":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Pagination cursor taken from the previous answer's next link; leave empty for the first page.","title":"After"}},"required":["org","resource_set_id"],"title":"list_resource_set_resourcesArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_resource_set_bindings":{"post":{"operationId":"list_resource_set_bindings","summary":"List the custom roles bound to one resource set (role ids only; members are not listed). Use for \"Which roles are bound ","description":"List the custom roles bound to one resource set (role ids only; members are not listed). Use for \"Which roles are bound to Okta resource set iamoJDFKaJxGIr0oamd9g\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"org":{"description":"Your Okta org subdomain: the part before .okta.com, for example 'acme' for acme.okta.com.","maxLength":200,"pattern":"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$","title":"Org","type":"string"},"resource_set_id":{"description":"Resource set id or label, for example iamoJDFKaJxGIr0oamd9g.","maxLength":200,"title":"Resource Set Id","type":"string"},"after":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Pagination cursor taken from the previous answer's next link; leave empty for the first page.","title":"After"}},"required":["org","resource_set_id"],"title":"list_resource_set_bindingsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}}}}