User Management and Lifecycle
This domain tests the Users, Groups, hooks and System Log APIs: creating users in the right state, moving them through the lifecycle legally, updating profiles without data loss, and automating group membership.
Creating users
POST /api/v1/users takes a profile (with a unique, email-shaped login) and optional credentials. With activate=false the user is created in STAGED and no activation email is sent - you must supply a password or recovery question/answer. With the default activate=true, an activation email goes out and the user sits in PROVISIONED until they activate. Custom attributes must already exist in the profile schema.
Status machine and lifecycle endpoints
STAGED → PROVISIONED → ACTIVE, alongside RECOVERY, LOCKED_OUT, PASSWORD_EXPIRED, SUSPENDED and DEPROVISIONED. Operations are explicit sub-resources: /lifecycle/activate, /lifecycle/reactivate, /lifecycle/deactivate (optionally sendEmail=false), /lifecycle/suspend, /lifecycle/unsuspend, /lifecycle/unlock, /lifecycle/reset_password, /lifecycle/expire_password. DELETE /api/v1/users/{id} succeeds only on a DEPROVISIONED user.
Updates
PUT /api/v1/users/{id} replaces the profile, so omitted attributes can be nulled; POST merges. Read, merge, then write.
Groups, rules and hooks
Group rules (/api/v1/groups/rules) evaluate on user create and update, and Okta re-evaluates existing users when a rule is activated; only ACTIVE rules apply. Event hooks (/api/v1/eventHooks) deliver signed requests for subscribed events after a verification handshake using the x-okta-verification-challenge header. Inline hooks (/api/v1/inlineHooks) intercept import, registration, password import and token minting. The System Log API (/api/v1/logs) accepts since/until and filters like filter=eventType eq "user.lifecycle.deactivate", but only over a rolling retention window.
Worked example
Offboard a cohort: page search=status eq "ACTIVE", then for each user call POST /lifecycle/deactivate followed by DELETE. Skip users already DEPROVISIONED, since deleting an active user returns 403, and keep page sizes small enough to stay under rate limits.
Traps
Using PUT and wiping unset attributes; deleting an ACTIVE user; assuming activate=false still emails the user; expecting group rules to apply retroactively without activation.