Okta Certified Workflows - Specialty · Part II

Use API Endpoints to Create Users

20% of Part II — turning inbound API calls into new Okta users.

Task 2: Create New Users

3 tasks · this deck covers task 2 of 3

↑ Use API Endpoints to Create Users Overview

The Task

"Create new users"

Once the API Endpoint card (Task 1) delivers an inbound JSON payload, this task is about two things: turning that JSON into usable fields, then feeding those fields into the Okta connector's Create User action card.

Honest Gap — No Official User-Creation Tutorial

Honest Gap Okta's own "Tutorial: Make API requests, part 3" (the official JSON-processing walkthrough) doesn't create Okta users at all — it teaches the Parse / Get Multiple / Pluck / Flatten technique using a sample Amazon Petstore API response (dog IDs and prices), not a user profile. The parsing technique transfers directly to user fields; the tutorial itself is not a user-creation walkthrough. We're covering the transferable mechanism plus the real Create User card spec below, rather than inventing a user-specific tutorial that doesn't exist.

Step 1 — Parse the Incoming JSON

The JSON Parse function "parses a JSON string into a typed field, such as an object or a list." It is "the inverse of Stringify." You must "set the type of the output field to match the actual type represented in the string, or you may encounter runtime errors" — and "if the input string isn't in a valid JSON format, Workflows returns a runtime error."

Step 2 — Extract the Fields You Need

From the parsed object, cards like Object Get Multiple pull out named fields (e.g. username, firstName, lastName, email) as individual outputs you can drag straight into the Create User card's inputs — the same pattern the official tutorial uses to pull id/type/price out of its sample payload.

Step 3 — Create User Action Card

Required: Username (email format), First Name, Last Name, Primary Email
Profile Option (required dropdown): without Credentials / with Recovery Question / with Password / with Password & Recovery Questions / with Authentication Provider / in Group
Optional per option: Recovery Question+Answer, Password, Provider Name/Type, Activate flag

The Gotcha

"When you use a Group ID that corresponds to the default Everyone group in your Okta org, a 501 Not Implemented error occurs." If you're using the "in Group" Profile Option, that Group ID has to be a real, non-default group.

The Angle — What Trips People Up

Watch for this in your own sandbox run:

→ Forgetting to set the JSON Parse output field's type to match the incoming payload shape (object vs. list) — mismatches throw runtime errors.

→ Picking the "in Group" Profile Option and pointing it at the org's default Everyone group, triggering the 501 error.

One Line To Remember

Parse the inbound JSON (typed to match its actual shape), pull named fields out with Object Get Multiple, then feed them into Create User — which always needs Username, First Name, Last Name, and Primary Email, plus a Profile Option that governs credentials/group/recovery behavior. Never target the default Everyone group as the "in Group" option's Group ID.

Sources: help.okta.com/wf — function-reference/json/json_parse.htm; Tutorials/processjson-walkthrough/parse-results.htm; connector-reference/okta/actions/createuser.htm

Next: Task 3 →