okta-iga-governance-api

Reference Okta Identity Governance REST API endpoints, OAuth scopes, and tooling constraints.

1|Updated Aug 10, 2026
One-click install
npx skills add https://github.com/TheViziusGroup/vibe-engineering-skills --skill okta-iga-governance-api-theviziusgroup
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: okta-iga-governance-api
Source: https://github.com/TheViziusGroup/vibe-engineering-skills/tree/main/plugins/okta-api-reference/skills/okta-iga-governance-api
Command: npx skills add https://github.com/TheViziusGroup/vibe-engineering-skills --skill okta-iga-governance-api-theviziusgroup

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Developers integrating with Okta Identity Governance (OIG) face a separately-versioned API with OAuth-only authentication, no official Python SDK, and feature-flag-gated endpoints that return misleading 403/404 errors, causing wasted debugging time and failed integration designs. ## Core Features & Use Cases - API Surface Reference: Documents the /governance/api/v1 and /v2 endpoints covering campaigns, access requests, entitlements, bundles, grants, collections, risk rules, delegates, and security access reviews. - Authentication Guidance: Explains OAuth 2.0-only access with okta.governance.* scopes, admin role requirements for service apps, and the absence of SSWS token support. - Tooling Alternatives: Clarifies that no official Python SDK exists for governance endpoints and points to raw HTTP with httpx/requests, Okta Workflows connectors, or the Okta Terraform Provider (v6.1.0+) as practical options. - Use Case: When building a service-to-service integration that lists OIG campaigns from Python, use this Skill to learn that you must perform a client-credentials JWT exchange against /oauth2/v1/token and call the governance endpoints directly with a bearer token rather than searching for a nonexistent SDK. ## Quick Start Ask how to call the Okta Identity Governance campaigns API from Python and what authentication and scopes are required.

Frequently Asked Questions about okta-iga-governance-api

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
Is there an official Python SDK for the Okta Identity Governance API?

No official or community Python SDK exists for Okta Identity Governance endpoints. The official okta package is generated from the Management OpenAPI spec, which does not declare any /governance/api paths. Use raw HTTP via httpx or requests with your own OAuth token exchange instead.

How do I authenticate to the Okta governance API?

Okta governance endpoints accept only OAuth 2.0 bearer tokens with okta.governance.* scopes; SSWS tokens are not supported. Tokens come from an OIDC app or a service app using client_credentials, and service apps also need an admin role such as SUPER_ADMIN.

Can I use SSWS tokens with Okta IGA endpoints?

No, Okta Identity Governance endpoints are OAuth-only and reject SSWS tokens. Any design assuming SSWS access that works for the core Management API will fail for governance endpoints specifically.

Why does the Okta governance API return 403 or 404 on documented endpoints?

A 403 or 404 often means the OIG subscription or a specific feature flag is not enabled for the org, not a bug in calling code. Capabilities like Collections, Realms, and Security Access Reviews are gated by feature flags on top of the paid OIG subscription.

Does the Okta Terraform Provider support governance resources?

Yes, the Okta Terraform Provider officially supports the Okta Governance API starting at v6.1.0. Confirm the installed provider version is at least 6.1.0 before assuming governance resource coverage for campaigns and entitlements.

Does client_credentials work with Okta V2 Access Request APIs?

Historically, V2 Access Request APIs did not accept the client_credentials grant, tracked under Okta internal issues OKTA-1044065 and OKTA-926552. Test client_credentials against your specific org and API version before depending on it for service-to-service automation.