Be the first to get access to new connectors. Get early access →
ConnectorBay Early access

Okta Admin Roles (BYOK) — connector documentation

  • MCP endpoint: https://byok-okta-admin-roles.connectorbay.com/mcp
  • REST API: POST https://byok-okta-admin-roles.connectorbay.com/v1/tools/{tool_name}, described by the OpenAPI 3.1 spec at https://byok-okta-admin-roles.connectorbay.com/openapi.json
  • Transport: Streamable HTTP, stateless, MCP specification 2025-06-18 or later
  • Authentication: your own Okta Admin Roles Okta API token, sent in the X-Upstream-Key header of every request (never stored, logged or cached)
  • Health: https://byok-okta-admin-roles.connectorbay.com/health · Tool schemas: https://byok-okta-admin-roles.connectorbay.com/tools.json
  • Publisher: Unify Dynamics LLC · connectorbay.com/byok-okta-admin-roles · agent@connectorbay.com

What Okta Admin Roles (BYOK) is for

Okta Admin Roles (BYOK) lets an AI assistant read your own Okta Admin Roles data through the Okta Admin Roles API with a key you supply (Okta API token). Read-only: 7 tools (list_custom_roles, get_custom_role, list_role_permissions, list_resource_sets, get_resource_set, list_resource_set_resources, list_resource_set_bindings). The BYOK key travels with each request, is used for that one call only and is never stored, logged or cached; it is only ever sent to *.okta.com. Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Okta Admin Roles. Okta Admin Roles and its logos are trademarks of their owners and are used only to say which service the connector works with.

Ask your assistant things like:

  • "Which custom admin roles are defined in our Okta org?"
  • "What is Okta custom role cr0Yq6IJxGIr0ouum0g3 for?"
  • "Which permissions does Okta custom role cr0Yq6IJxGIr0ouum0g3 grant?"
  • "Which resource sets exist for delegated administration in Okta?"
  • "What does Okta resource set iamoJDFKaJxGIr0oamd9g describe?"
  • "Which resources belong to Okta resource set iamoJDFKaJxGIr0oamd9g?"

What it does

  • list_custom_roles: List custom administrator roles with id, label, description and dates.
  • get_custom_role: Get one custom administrator role: label, description and dates.
  • list_role_permissions: List the permissions granted by one custom administrator role (for example okta.users.read) with any attribute conditions and dates.
  • list_resource_sets: List resource sets (collections of users, groups and apps that custom roles can be limited to) with id, label, description and dates.
  • get_resource_set: Get one resource set: label, description and dates.
  • list_resource_set_resources: List the resources in one resource set, each with its id and Okta resource name (ORN) and dates.
  • list_resource_set_bindings: List the custom roles bound to one resource set (role ids only; members are not listed).

BYOK key

You bring your own Okta Admin Roles Okta API token (https://developer.okta.com/docs/guides/create-an-api-token/main/). Your assistant sends it in the X-Upstream-Key header with each request. ConnectorBay uses it for that one call only: it is never stored, logged or cached, never shown in an answer, and it is only sent to *.okta.com over https, with no redirects followed. Create a key with the fewest permissions the tools need (read-only if the provider offers it), and revoke it at the provider whenever you like.

Data sources

Live from the Okta Admin Roles API (*.okta.com) with a BYOK key; documentation: https://developer.okta.com/docs/api/openapi/okta-management/management/tag/RoleECustom/. Endpoints checked against that documentation on 2026-10-16.

What it is not

Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Okta Admin Roles. Okta Admin Roles and its logos are trademarks of their owners and are used only to say which service the connector works with. It is read-only: it never creates, changes, sends or deletes anything in your Okta Admin Roles account.

Built for: Worldwide. Languages: English.