I85PREP
⌘ K
Okta Certified Developer study materials
Okta Certified Developer study resources

Okta Certified Developer practice questions

One question at a time. Build your Okta Certified Developer understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Okta APIs and SDKs

When calling an Okta management API endpoint, which HTTP header carries the API token used to authenticate the request?

  1. Okta-Api-Key: <token>
  2. Authorization: SSWS <token> Correct answer.
  3. Authorization: Bearer <token>
  4. X-Okta-Token: <token>

Explanation

Okta management APIs authenticate with a custom scheme in the Authorization header: the literal prefix SSWS followed by a space and the API token. Bearer tokens are used for OAuth 2.0 access tokens protecting other resource types, not the classic SSWS management token.

Question 2Okta APIs and SDKs

Which base URL pattern correctly targets the Okta management API for an org whose Okta domain is example.okta.com?

  1. https://example.okta.com/oauth2/v1/
  2. https://api.okta.com/v1/example/
  3. https://example.okta.com/api/v1/ Correct answer.
  4. https://example.okta.com/admin/api/

Explanation

The Okta management API is served under the /api/v1/ path on the org's own domain, for example https://example.okta.com/api/v1/users. The /oauth2/ path hosts authorization server endpoints rather than the management resources.

Question 3Okta APIs and SDKs

An application needs to list users and must paginate results. Which mechanism does the Okta Users API use to return the next page?

  1. A cookie named okta-next-page
  2. A Link header containing a rel="next" URL Correct answer.
  3. A JSON body field called nextPageToken
  4. An HTTP 202 status with a retry-after header

Explanation

Okta returns pagination links in the HTTP Link response header, including a rel="next" URL that the client follows for the subsequent page. Clients should parse the Link header rather than constructing URLs manually.

Question 4Okta APIs and SDKs

Which Okta SDK package would a Java developer add to call the management API from a backend service?

  1. okta-sdk-python
  2. com.okta.sdk:okta-sdk-api Correct answer.
  3. @okta/okta-angular
  4. com.okta:okta-react

Explanation

Okta publishes a Java management SDK whose Maven coordinates are in the com.okta.sdk group, with okta-sdk-api among its artifacts. The other choices are front-end or non-Java packages.

Question 5Okta APIs and SDKs

What does the Okta Rate Limit response header X-Rate-Limit-Remaining indicate?

  1. The total number of users in the org
  2. The number of requests still allowed in the current window Correct answer.
  3. The number of seconds until the token expires
  4. The remaining lifetime of the API token

Explanation

Okta returns rate-limit headers describing the current window, where X-Rate-Limit-Remaining reports how many calls remain before the limit is hit. X-Rate-Limit-Reset reports when the window resets.

Question 6Okta APIs and SDKs

Which HTTP method and path creates a new user in the Okta management API?

  1. PATCH /api/v1/user
  2. POST /api/v1/users Correct answer.
  3. GET /api/v1/users/create
  4. PUT /api/v1/users

Explanation

Creating a user is a POST to the /api/v1/users collection with a JSON body containing the profile and credentials. PUT is used to update or replace an existing resource identified by id.

Question 7Okta APIs and SDKs

Which OAuth 2.0 flow is recommended for a single-page application that cannot keep a client secret confidential?

  1. Client Credentials
  2. Authorization Code with PKCE Correct answer.
  3. SAML 2.0 assertion
  4. Resource Owner Password

Explanation

Public clients such as SPAs use Authorization Code with PKCE so the code exchange is bound to a proof key instead of a secret. Client Credentials and password flows require confidential handling or direct credential collection that a browser app cannot safely provide.

Question 8Okta APIs and SDKs

An Okta Expression Language expression is used to map a user attribute. Which syntax references the user's email in an Okta expression?

  1. ${user.email} Correct answer.
  2. user.email
  3. [[user.email]]
  4. #{user.email}

Explanation

Okta Expression Language interpolates values using the ${...} delimiters, so ${user.email} resolves to the user's email attribute. Bare property paths and other delimiter styles are not evaluated by the expression engine.

Question 9Okta APIs and SDKs

A developer receives an HTTP 429 from the Okta management API. What is the correct handling approach?

  1. Read X-Rate-Limit-Reset and retry after that time with backoff Correct answer.
  2. Switch to the /oauth2/v1/ base path to bypass limits
  3. Immediately resend the identical request in a tight loop
  4. Delete and recreate the API token

Explanation

A 429 means the rate limit was exceeded; clients should honor the reset time from X-Rate-Limit-Reset and retry with backoff. Hammering the endpoint or changing tokens does not restore quota.

Question 10Okta APIs and SDKs

Which Okta API call retrieves a single user by their login when the Okta user id is unknown?

  1. GET /api/v1/users/by-login
  2. GET /api/v1/users?search=profile.login eq "[email protected]" Correct answer.
  3. POST /api/v1/users/lookup
  4. GET /api/v1/users/{login}

Explanation

When the id is unknown, you query the users collection with a search or filter expression, such as search=profile.login eq "[email protected]". The path segment form accepts the id or login only when used as the identifier in the collection path, but the documented lookup by attribute uses search/filter.

Question 11Okta APIs and SDKs

A backend service must call Okta management APIs without storing a long-lived SSWS token. Which approach best fits Okta's guidance?

  1. Embed the admin's personal API token in the container image
  2. Use the org authorization server's implicit flow
  3. Store the SSWS token in a public client-side config
  4. Create an OAuth 2.0 service app with a private key JWT and request a scoped access token Correct answer.

Explanation

Okta recommends OAuth 2.0 service integrations using a private key JWT client assertion to obtain short-lived access tokens scoped to the needed management permissions. This avoids long-lived static tokens and supports least privilege.

Question 12Okta APIs and SDKs

Which Okta API endpoint updates a subset of fields on an existing user profile without replacing the whole resource?

  1. PATCH /api/v1/users/{id} Correct answer.
  2. DELETE /api/v1/users/{id}
  3. POST /api/v1/users/{id}
  4. GET /api/v1/users/{id}

Explanation

PATCH applies a partial update to the specified user, changing only the provided profile fields. POST to the id path is for lifecycle operations, and DELETE and GET do not modify the profile.

Question 13Okta APIs and SDKs

What is the purpose of the client assertion (private_key_jwt) in an Okta OAuth 2.0 service integration?

  1. To prove the client's identity to the token endpoint without sending a shared secret Correct answer.
  2. To hash the user's password before storage
  3. To encrypt the access token payload
  4. To sign the user's SAML assertion

Explanation

With private_key_jwt, the client signs a JWT with its private key and presents it to the token endpoint, letting Okta verify identity via the registered public key instead of a shared client secret. This is stronger for confidential service apps.

Question 14Okta APIs and SDKs

Which grant type should a confidential server-side app use to exchange an authorization code for tokens at the Okta token endpoint?

  1. password
  2. urn:ietf:params:oauth:grant-type:device_code
  3. authorization_code Correct answer.
  4. implicit

Explanation

A confidential server-side app receives an authorization code and exchanges it at the token endpoint using grant_type=authorization_code, optionally with PKCE. The implicit and password grants are discouraged, and device_code targets input-constrained devices.

Question 15Okta APIs and SDKs

An app calls the Okta token endpoint and receives an error with "error": "invalid_client". Which cause is most consistent with this response?

  1. The requested scope is not granted to the user
  2. The authorization code has already been used
  3. The client authentication method or credentials presented do not match the app's configuration Correct answer.
  4. The redirect_uri does not match a registered URI

Explanation

invalid_client indicates the client failed authentication, such as a wrong secret, mismatched authentication method, or unknown client_id. Scope, code reuse, and redirect mismatches produce other error codes.

Question 16Okta APIs and SDKs

Which Okta API resource manages the assignment of an application to a user?

  1. /api/v1/apps/{appId}/users Correct answer.
  2. /api/v1/apps/{appId}/groups
  3. /api/v1/authorizationServers
  4. /api/v1/users/{userId}/credentials

Explanation

Application-to-user assignments are managed under /api/v1/apps/{appId}/users, where a PUT assigns a user and a DELETE unassigns. Group assignments use the groups subresource, and credentials and authorization servers are unrelated to app assignment.

Question 17Okta APIs and SDKs

A developer needs to react to user lifecycle events such as deactivation without polling the Users API. Which Okta feature should they implement?

  1. Event hooks delivered to a registered HTTPS endpoint Correct answer.
  2. A cron job calling GET /api/v1/users every minute
  3. An offline refresh token rotation
  4. A webhook subscribed to the System Log via the Logs API stream

Explanation

Okta event hooks push lifecycle events to an HTTPS endpoint you register, letting the integration react in near real time. Polling is inefficient and subject to rate limits, and refresh token rotation concerns token lifetime rather than event delivery.

Question 18Okta APIs and SDKs

An Okta Expression Language mapping must transform a login like [email protected] into the prefix jane.doe. Which expression achieves this?

  1. ${user.login.split("@")}
  2. ${String.substringBefore(user.login, "@")} Correct answer.
  3. ${user.login.replace("@","")}
  4. ${user.login.length()}

Explanation

Okta Expression Language includes string helpers such as String.substringBefore, which returns the portion before the delimiter, yielding jane.doe. The other expressions return an array, strip the delimiter without truncating, or return a length.

Question 19Okta APIs and SDKs

Which Okta API is used to create and manage groups and their membership?

  1. /api/v1/roles
  2. /api/v1/groups and /api/v1/groups/{groupId}/users Correct answer.
  3. /api/v1/policies
  4. /api/v1/authenticators

Explanation

Groups are managed at /api/v1/groups, and membership is managed through the /api/v1/groups/{groupId}/users subresource with PUT to add and DELETE to remove. Roles, policies, and authenticators are separate resources.

Question 20Okta APIs and SDKs

A developer wants to test Okta API calls without affecting production data. Which approach aligns with Okta's guidance?

  1. Run destructive tests against production during off-hours
  2. Reuse production API tokens in CI logs
  3. Disable rate limiting on production
  4. Use a separate Okta developer or preview org for testing Correct answer.

Explanation

Okta provides separate developer and preview orgs intended for testing and integration work, keeping production data and configuration isolated. Testing against production risks data loss and is not supported by disabling safeguards.

Question 21Okta APIs and SDKs

When using the Okta Sign-In Widget embedded in a SPA, which API does the widget call to authenticate the user and obtain tokens?

  1. The Apps API assignment endpoint
  2. The Okta Authentication API for the initial authentication and the token endpoint for tokens Correct answer.
  3. The Users API directly with an admin token
  4. The Logs API stream

Explanation

The Sign-In Widget drives the Authentication API to verify credentials and complete factors, then the app obtains tokens through the OAuth 2.0 token endpoint. Admin APIs like Users or Apps require privileged tokens that must never ship to a browser.

Question 22Okta APIs and SDKs

An integration hits Okta's concurrent rate limit. Which behavior indicates the developer misunderstood the limit?

  1. Assuming the limit is a per-minute request count and ignoring concurrency Correct answer.
  2. Caching stable data to lower call volume
  3. Reading the Retry-After header and backing off
  4. Reducing parallel requests by pooling and queuing calls

Explanation

Okta enforces both a request-rate limit and a concurrent request limit; the concurrent limit caps in-flight calls at once, not calls per minute. Treating it as a per-minute count and ignoring concurrency leads to repeated throttling.

Question 23Okta APIs and SDKs

A developer builds a custom authorization server and needs an access token whose audience identifies their API. Which request parameter controls the token audience?

  1. The redirect_uri parameter
  2. The client_id parameter
  3. The state parameter
  4. The resource parameter or the authorization server's audience configuration Correct answer.

Explanation

The access token audience is determined by the resource parameter (RFC 8707) or by the authorization server's audience setting when a default is configured. client_id identifies the app, redirect_uri constrains the callback, and state protects against CSRF.

Question 24Okta APIs and SDKs

An app receives "error": "invalid_grant" when exchanging an authorization code at the Okta token endpoint. Which condition best explains this?

  1. The requested scope is unknown to the authorization server
  2. The client secret is incorrect
  3. The API token lacks admin permissions
  4. The authorization code was already redeemed or has expired Correct answer.

Explanation

invalid_grant signals a problem with the grant itself, such as a code that was already used, expired, or issued to a different redirect_uri. A bad client secret yields invalid_client, and an unknown scope yields invalid_scope.

Question 25Okta APIs and SDKs

A developer wants to search users by last name and department in one query. Which Okta Users API parameter supports a structured expression combining profile attributes?

  1. limit
  2. after
  3. search Correct answer.
  4. expand

Explanation

The search parameter accepts a SCIM-style filter expression over profile attributes, allowing conditions like lastName and department to be combined. limit, after, and expand control page size, pagination cursor, and related-resource expansion respectively.

Question 26Okta APIs and SDKs

Which HTTP header does Okta's management API use to authenticate requests made with a static API token?

  1. Authorization: Basic <api_token>
  2. Authorization: Bearer <api_token>
  3. Authorization: SSWS <api_token> Correct answer.
  4. X-Okta-Token: <api_token>

Explanation

Okta management API tokens are presented with the custom SSWS scheme in the Authorization header, so the value reads Authorization: SSWS followed by the token. Bearer is reserved for OAuth 2.0 access tokens, and Basic expects base64-encoded credentials rather than a raw API token.

Question 27Okta APIs and SDKs

Which base URL pattern does an Okta management API request use when the org is named example and lives in the oktapreview.com domain?

  1. https://oktapreview.com/api/example/v1/...
  2. https://example.oktapreview.com/api/v1/... Correct answer.
  3. https://api.oktapreview.com/example/v1/...
  4. https://example.oktapreview.com/oauth2/v1/...

Explanation

Each Okta org is addressed as a subdomain of its cell, and management resources live under the /api/v1 path on that org host. The /oauth2/v1 path is for authorization server endpoints, not for management resources such as users or groups.

Question 28Okta APIs and SDKs

A developer calls GET /api/v1/users/{id} and receives HTTP 404 with errorCode E0000007. What does this indicate?

  1. The request exceeded the org's rate limit
  2. The request body was malformed JSON
  3. The API token has expired and must be regenerated
  4. The requested user resource does not exist or is not visible to the caller Correct answer.

Explanation

Okta returns 404 with errorCode E0000007 when the addressed resource cannot be found, which includes an incorrect ID or a resource the caller's permissions do not expose. Authentication failures return 401, and rate limiting returns 429.

Question 29Okta APIs and SDKs

Which Okta API response header value helps a client decide how long to wait before retrying after a 429?

  1. Content-Length
  2. ETag
  3. X-Rate-Limit-Reset Correct answer.
  4. X-Okta-Request-Id

Explanation

Okta returns X-Rate-Limit-Reset as an epoch timestamp indicating when the current rate-limit window resets, so the client can compute the wait time. X-Okta-Request-Id is for support correlation, and ETag supports conditional reads.

Question 30Okta APIs and SDKs

Which Okta API resource is used to list the applications assigned to a specific user?

  1. GET /api/v1/apps/{id}/users
  2. GET /api/v1/apps with the filter user.id eq "{id}" Correct answer.
  3. GET /api/v1/users/{id}/groups
  4. GET /api/v1/users/{id}/roles

Explanation

The Apps API supports a filter query parameter on user.id, returning the applications assigned to that user. The users/{id}/roles path returns admin role assignments, and apps/{id}/users lists the users assigned to one application rather than the reverse.

Question 31Okta APIs and SDKs

Which Okta SDK package is the official library for calling the Okta management API from a Node.js server application?

  1. @okta/okta-sdk-nodejs Correct answer.
  2. @okta/okta-signin-widget
  3. @okta/okta-auth-js
  4. @okta/okta-react

Explanation

@okta/okta-sdk-nodejs wraps the Okta management API for server-side Node.js use. @okta/okta-auth-js is a browser-oriented authentication client, and the Sign-In Widget and framework wrappers handle end-user sign-in rather than admin API calls.

Question 32Okta APIs and SDKs

Which pagination mechanism does the Okta Users API use by default when listing many users?

  1. Keyset pagination via the since query parameter
  2. Cursor-based pagination via the Link header with after Correct answer.
  3. No pagination; the full collection is always returned
  4. Offset pagination via the page query parameter

Explanation

Okta list endpoints return a subset of results and include a Link header containing a next URL with an after cursor for subsequent pages. The page parameter exists only for a limited set of endpoints, and Okta never returns unbounded collections.

Question 33Okta APIs and SDKs

Which Okta API endpoint returns the OpenID Connect discovery document for the org authorization server?

  1. GET /oauth2/v1/keys
  2. GET /.well-known/openid-configuration Correct answer.
  3. GET /oauth2/v1/token
  4. GET /api/v1/meta/types/User

Explanation

The discovery document is published at /.well-known/openid-configuration and lists endpoints, supported scopes, and signing algorithms. The keys endpoint returns only JWKS material, and the token endpoint issues tokens.

Question 34Okta APIs and SDKs

A developer needs to create a group and then add a specific user to it. Which call sequence accomplishes this with Okta's management API?

  1. POST /api/v1/groups, then POST /api/v1/users/{userId}/groups
  2. POST /api/v1/users/{userId}/roles, then POST /api/v1/groups/{groupId}/roles
  3. POST /api/v1/groups, then PUT /api/v1/groups/{groupId}/users/{userId} Correct answer.
  4. PUT /api/v1/groups/{groupId}, then PATCH /api/v1/users/{userId}

Explanation

Groups are created with POST to /api/v1/groups, and membership is added with PUT to the group's users sub-resource addressed by user ID. The roles paths manage administrator grants, and PATCH on a user does not change group membership.

Question 35Okta APIs and SDKs

An integration must update only the department attribute of a user profile and leave all other attributes untouched. Which request is appropriate?

  1. PUT /api/v1/users/{id}
  2. PATCH /api/v1/users/{id} with a partial profile body Correct answer.
  3. POST /api/v1/users/{id} with the full profile
  4. DELETE /api/v1/users/{id} followed by a recreate

Explanation

PATCH performs a partial update, so only the supplied profile attributes change while others are preserved. PUT and POST replace or set the resource more broadly, which risks overwriting attributes the caller did not intend to change.

Question 36Okta APIs and SDKs

Which request correctly sets a user's status to ACTIVE after they were deactivated?

  1. PATCH /api/v1/users/{id} with status ACTIVE
  2. POST /api/v1/users/{id}/lifecycle/deactivate
  3. POST /api/v1/users/{id}/lifecycle/activate Correct answer.
  4. PUT /api/v1/users/{id}/lifecycle/activate

Explanation

Lifecycle operations are exposed as sub-paths under /lifecycle and are invoked with POST; activate transitions a deactivated user back to ACTIVE. Status is not writable through a profile PATCH, and the deactivate path moves the user the wrong direction.

Question 37Okta APIs and SDKs

A developer wants to validate an Okta-issued access token inside a resource server without calling Okta on every request. Which approach is correct?

  1. Verify the signature against the JWKS from the authorization server, then check issuer, audience, and expiry Correct answer.
  2. Decode the token payload and trust the claims without signature verification
  3. Call the introspection endpoint for every incoming request
  4. Compare the token string against a cached copy of the last issued token

Explanation

Access tokens are JWTs signed by the authorization server, so a resource server can fetch the JWKS, verify the signature locally, and validate issuer, audience, and exp claims. Skipping signature verification lets anyone forge claims, and per-request introspection adds avoidable latency.

Question 38Okta APIs and SDKs

Which Okta API call assigns an administrator role to a user?

  1. PUT /api/v1/apps/{id}/users/{userId}
  2. POST /api/v1/users/{id}/roles Correct answer.
  3. POST /api/v1/users/{id}/lifecycle/activate
  4. POST /api/v1/groups/{id}/users

Explanation

Administrator roles are granted by posting a role object to the user's roles sub-resource. The groups users path manages membership, and the apps users path assigns an application to a user rather than an admin role.

Question 39Okta APIs and SDKs

A developer must call the Okta management API from a CI pipeline without embedding a static SSWS token. Which Okta feature is designed for this?

  1. A session cookie obtained from the Sign-In Widget
  2. An API token stored in the repository as an environment variable
  3. An ID token issued for an end user
  4. An OAuth 2.0 service app using the client credentials grant with a private key JWT Correct answer.

Explanation

Okta supports OAuth 2.0 service apps that obtain management API access tokens through the client credentials grant, optionally authenticating with private_key_jwt so no shared secret is stored. Static tokens in a repository are a credential-leak risk, and session cookies and ID tokens are for end-user contexts.

Question 40Okta APIs and SDKs

Which request retrieves the group memberships of a user in a single paginated call?

  1. GET /api/v1/groups/{id}/users
  2. GET /api/v1/users/{id}/roles
  3. GET /api/v1/users/{id}/appLinks
  4. GET /api/v1/users/{id}/groups Correct answer.

Explanation

The users/{id}/groups sub-resource lists every group the user belongs to and supports pagination. The groups/{id}/users path answers the reverse question, and appLinks returns launch URLs rather than group data.

Question 41Okta APIs and SDKs

A developer needs to read the Okta system log events generated in the last hour for a specific application. Which parameter of the Logs API supports this?

  1. The expand parameter on the Apps API
  2. The search parameter on the Users API
  3. A filter or since parameter combined with a target filter on the app Correct answer.
  4. The page parameter only

Explanation

The Logs API accepts since and until for time bounds and filter expressions that can target a specific application, returning matching events. The page parameter alone cannot express a time window, and Users and Apps parameters do not query the system log.

Question 42Okta APIs and SDKs

Which Okta API call removes a user from a group?

  1. DELETE /api/v1/groups/{groupId}/users/{userId} Correct answer.
  2. DELETE /api/v1/users/{userId}
  3. DELETE /api/v1/groups/{groupId}
  4. PUT /api/v1/groups/{groupId}/users/{userId}

Explanation

Membership is represented by the group's users sub-resource, so deleting that specific member path removes the user from the group while leaving both entities intact. Deleting the user or group removes the entire resource, which is broader than requested.

Question 43Okta APIs and SDKs

An app uses the Org Authorization Server and requests an access token with a custom audience for its own API. What is the likely outcome?

  1. The request fails because the Org Authorization Server does not support custom audiences or custom scopes Correct answer.
  2. The token is issued but the audience is silently replaced by the org URL
  3. The token is issued with the custom audience as requested
  4. The request succeeds only if the client uses the implicit flow

Explanation

The Org Authorization Server is intended for Okta's own APIs and does not allow custom authorization servers, custom scopes, or custom audiences. To obtain tokens scoped to your own API you must create a custom authorization server.

Question 44Okta APIs and SDKs

A developer wants to attach a custom profile attribute to all users. Which Okta API resource is modified to add the attribute to the user schema?

  1. The user type schema under /api/v1/meta/types/User Correct answer.
  2. The Apps API for each application
  3. The Groups API profile object
  4. The authorization server policy resource

Explanation

Custom attributes are defined in the user type schema, which is read and updated through the schema endpoints under /api/v1/meta/types/User. Application, group, and policy resources do not define user profile attributes.

Question 45Okta APIs and SDKs

A developer needs to confirm which scopes an access token actually received after a successful token request. Which claim in the JWT access token should be inspected?

  1. exp
  2. iss
  3. scp Correct answer.
  4. sub

Explanation

Okta places granted scopes in the scp claim of the access token, so a client should inspect it to confirm what was authorized. The sub claim identifies the subject, iss identifies the issuer, and exp is the expiry timestamp.

Question 46Okta APIs and SDKs

A developer is writing an integration test that calls Okta APIs. Which practice keeps tests isolated and repeatable?

  1. Disable pagination so all results return in one page
  2. Use a dedicated Okta developer or preview org with seeded test data and clean up created resources Correct answer.
  3. Run the tests against the production org using real user accounts
  4. Hard-code a shared production API token in the test source

Explanation

A separate developer or preview org with seeded data isolates tests from production and allows safe cleanup of created resources. Running against production risks real data, and hard-coded tokens create a credential exposure.

Question 47Okta APIs and SDKs

An app calls the Okta token endpoint with grant_type=authorization_code and receives invalid_grant. Which cause best fits this error?

  1. The requested scope is not configured on the authorization server
  2. The client_id does not exist in the org
  3. The authorization code was already redeemed, expired, or the redirect_uri did not match the original request Correct answer.
  4. The client authentication method is unsupported

Explanation

invalid_grant indicates a problem with the grant itself, such as a reused or expired authorization code or a redirect_uri that differs from the one used at authorization. An unknown client produces invalid_client, and scope problems surface as invalid_scope.

Question 48Okta APIs and SDKs

A developer needs to retrieve more than the default page size of users in one logical operation. Which approach follows Okta's pagination contract?

  1. Loop the same request until the result count stops changing
  2. Increase the limit beyond the maximum and expect all records in one response
  3. Request the collection with the expand parameter
  4. Set the limit parameter and follow the next link from the Link header until no next link remains Correct answer.

Explanation

Okta caps the limit parameter and signals further results with a next link in the Link response header, so a client must iterate until that link is absent. Exceeding the maximum limit is rejected, and the expand parameter controls embedded resources.

Question 49Okta APIs and SDKs

A developer must ensure that a webhook handler can trust that a request genuinely came from Okta. Which mechanism is provided for this?

  1. Check that the request body contains a known user id
  2. Verify the signature in the x-okta-signature header using the webhook's secret Correct answer.
  3. Whitelist the request's User-Agent string
  4. Confirm that the request arrived over HTTPS

Explanation

Okta signs webhook deliveries, and the signature in the x-okta-signature header can be verified against the endpoint's secret to confirm authenticity and integrity. User-Agent strings and HTTPS alone do not prove the sender's identity.

Question 50Okta APIs and SDKs

An integration uses OAuth 2.0 for Okta management APIs and receives 403 with errorCode E0000006. What does this mean?

  1. The caller is authenticated but lacks the admin permission required for the operation Correct answer.
  2. The access token signature could not be verified
  3. The JSON body failed schema validation
  4. The org has exceeded its rate limit

Explanation

E0000006 indicates insufficient permissions, meaning the principal is recognized but is not authorized for the requested operation. Signature failures produce 401, rate limiting produces 429, and schema problems produce 400.