I85PREP
⌘ K
Okta Certified Developer study materials
Okta Certified Developer study resources

Okta Certified Developer: Okta APIs and SDKs

Okta Certified Developer · Work through your exam, one topic at a time.

All guide sections

Okta APIs and SDKs

This domain tests whether you can drive Okta from code: which API surface and credential to use, how to page through large collections, how to read an error body, and how to stay inside rate limits. Vague answers about "calling the REST API" lose marks; the exam wants exact conventions.

Two surfaces, two credentials

  • Core Okta API - https://{yourOktaDomain}/api/v1/... covers users, groups, apps, policies, sessions and log events. Authenticate with a scoped OAuth 2.0 service app (private-key JWT, scopes such as okta.users.manage) or a legacy SSWS token sent as Authorization: SSWS {token}.
  • OIDC/OAuth 2.0 and Identity Engine endpoints - /oauth2/{authServerId}/v1/... and /idp/idx/... use client-based flows; they never accept SSWS.

Paging and querying

Pagination is cursor-based, not offset-based. Send limit (capped at 200 for users, groups and apps) and follow the Link header's rel="next" URL, which already carries after=<cursor>. Stop when no next link is returned. filter is a legacy parameter with a fixed allowlist (for users: status, lastUpdated, id, provider), while search takes a SCIM-style grammar with a narrow operator set - check the endpoint before relying on or.

Errors and throttling

Error bodies carry errorCode, errorSummary, errorId and sometimes errorCauses. A 429 includes X-Rate-Limit-Limit, X-Rate-Limit-Remaining and X-Rate-Limit-Reset (epoch seconds). Okta also enforces a per-org concurrency ceiling, so raising parallelism still produces 429s.

SDK choice

Management SDKs (Java, .NET, Go, Node, Python, PHP, Ruby) wrap the Core API with typed models, retries and paging helpers. Authentication SDKs such as okta-auth-js implement OIDC flows in the browser. Never embed an SSWS token in a single-page app.

Worked example

List every ACTIVE user. Call GET /api/v1/users?search=status eq "ACTIVE"&limit=200, then request the absolute next URL verbatim - it already carries after, so no offset arithmetic is needed. Loop until next disappears. If a page returns 429, wait until X-Rate-Limit-Reset and retry only that page; restarting the whole scan is how jobs exhaust their quota.

Traps

Treating after as an offset; assuming filter accepts any profile attribute; retrying 429s immediately; and mixing org and custom authorization server URLs in one client.