← Course Home
Okta Certified Workflows - Specialty · Part I

Running and Maintaining Flows

13% of Part I

Running and Maintaining Flows

Sub-topic 2: Invoke a Flow with an API Endpoint

4 sub-topics · this deck covers sub-topic 2 of 4

↑ Module Overview

The Scenario

"An API Endpoint flow is a type of flow triggered by changes at an external source."

Unlike flows that start with an event tied to a connected app, an API Endpoint flow can be triggered at any time by an external client. When that client calls the designated endpoint, the flow executes and the client receives whatever output the flow produces.

The Mechanism

The only requirement to invoke this flow type is that the external client calls the endpoint with valid security credentials. There are three ways to secure an API Endpoint flow, and the exam distinguishes between them.

Method 1 — OAuth 2.0

The endpoint is secured using OAuth 2.0 for authorization of scoped access tokens. An admin adds the appropriate scopes to any app integration that needs to call the API.

This method supports the OAuth client credentials grant type using a private JSON Web Token (JWT). The flow triggers only after the Okta authorization server receives and approves the access token. Custom authorization servers aren't supported for this method.

Methods 2 & 3 — Client Token and Public

Client token — the flow is registered as a webhook and secured through a unique client token. It's only accessible if the requesting service passes the correct client token through the invoke URL, which is constructed using a flow alias.

None (public service) — the flow is publicly available to anyone who has the invoke URL, which is also constructed using a flow alias.

The Connection

API Endpoint flows are one of the "yellow zone" use cases called out under System Limitations (next sub-topic) — they carry specific timeout behavior (60 seconds synchronous, 120 seconds asynchronous) and are the exact scenario the platform's best practices for building flows are written around: structure asynchronously, close the connection early, and keep any synchronous path fast. The Execution History sub-topic is also how you'd confirm whether an API Endpoint flow ran in low-latency mode or was throttled.

The Angle — What Trips People Up

Watch for this in your own sandbox run:

→ Assuming OAuth 2.0 securing works with a custom authorization server — it doesn't; only the built-in org authorization server is supported for this method.

→ Confusing the client-token method with the public method — both build their invoke URL from a flow alias, but only the client-token method actually requires a secret to be passed for access.

One Line To Remember

An API Endpoint flow can be triggered anytime by an external client, and the client receives the flow's output. Secure it three ways: OAuth 2.0 (client credentials grant + private JWT, no custom authorization servers), client token (webhook, secret passed via a flow-alias invoke URL), or none/public (anyone with the flow-alias invoke URL).

Sources: help.okta.com — ext-about-invoke-api-flow (Invoke an API endpoint flow)