Okta Certified Workflows - Specialty · Part II

Use API Endpoints to Create Users

20% of Part II — turning inbound API calls into new Okta users.

Task 1: Create a Workflow Triggered by an On-Demand API Endpoint Card

3 tasks · this deck covers task 1 of 3

↑ Use API Endpoints to Create Users Overview

The Task

"Create a workflow that is triggered by an on-demand API endpoint card"

An API Endpoint flow is "a type of flow triggered by changes at an external source." Unlike event-driven flows off a connected app, it fires whenever an external client calls the endpoint you designate — on demand, not on a schedule or an app event.

The Mechanism

The API Endpoint card is the flow's trigger card. An external client invokes it by calling the flow's invoke URL, which is constructed using a flow alias. On invocation, the flow runs and "sends the flow output as a response object" back to the caller.

Three Security Modes

OAuth 2.0 — "the OAuth client credentials grant type with the use of a private JSON Web Token (JWT)"; custom authorization servers aren't supported
Client Token — "secured through a unique client token," passed via the invoke URL, functions as a webhook
Public Service — "publicly available to anyone with the invoke URL"; no authentication required

Choosing a Mode

Every mode besides Public Service requires "the external client calls the designated endpoint with valid security credentials." OAuth 2.0 is the most robust option (scoped access tokens, org-level app integration); Client Token is the lighter-weight webhook pattern; Public Service trades all authentication for simplicity.

The Angle — What Trips People Up

Watch for this in your own sandbox run:

→ Assuming a custom authorization server works with the OAuth 2.0 mode — it doesn't; only the client credentials grant with a private JWT is supported.

→ Picking Public Service for anything sensitive — remember it means the invoke URL alone grants access, with no credential check at all.

One Line To Remember

An API Endpoint flow triggers on demand when an external client calls its invoke URL (built from a flow alias), and returns the flow's output as the response. Secure it with OAuth 2.0 (client credentials + private JWT, no custom auth servers), a Client Token webhook, or leave it a fully open Public Service.

Sources: help.okta.com/wf — about-invoke-api-endpoint-flow.htm; execute/flow-api-endpoint.htm

Next: Task 2 →