# Okta

Okta Workforce Identity — users, groups, group memberships, sign-in events

## Prerequisites

- A Mesh administrator account with permission to manage connectors.
- Credentials for authentication: Token (stored write-only).

## Authentication

**Method:** Bearer token

Mesh authenticates with a bearer token.

| Field | Required | Secret | Description |
| --- | --- | --- | --- |
| `Token` | Yes | Yes (write-only) |  |

## Capabilities

<CapabilityMatrix
  capabilities={[
    { name: "User accounts", supported: true },
    { name: "Groups & membership", supported: true },
    { name: "Entitlements & relationships", supported: true },
    { name: "Sign-in / audit events", supported: true },
    { name: "Writeback / remediation", supported: false, notes: "Read-only" },
  ]}
/>

## Data model

### User accounts

- `display_name`
- `email`
- `id`
- `identity_key`
- `job_title`
- `principal`
- `status`

### Groups & membership

- `description`
- `id`
- `identity_key`
- `name`

### Entitlements & relationships

- `identity_key`
- `object_category`
- `object_key`
- `relationship_type`
- `subject_key`

### Sign-in / audit events

## Setup

1. Complete authentication as described above.
2. In Admin → Connectors, add the connector and enter its configuration.
3. Save and run an initial collection.

## Troubleshooting

_This information is not yet available from the connector schema._