Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -274,4 +274,10 @@ The following is an example of a JSON payload of a request from Okta to your ext
},
"eventTime": "2023-03-28T17:03:37.093Z",
"contentType": "application/json"
}```
}
```

## See also

- [Event hooks management APIs](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/EventHook/#tag/EventHook)
- [Hooks best practices](/docs/guides/hooks-best-practices/)
Original file line number Diff line number Diff line change
Expand Up @@ -211,3 +211,8 @@ A hook preview feature is available for the following hooks: SAML, telephony, to
The [Okta System Log](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/SystemLog/) also captures events related to inline hook setup and execution that you can use to troubleshoot your implementation. You can see descriptions of the relevant event types by querying the event types catalog with the `inline_hook` query parameter. See [Event Types](/docs/reference/api/event-types/).

> **Note:** You can see errors from the error object in the external service response, errors when Okta can't apply an inline hook response, and errors related to communication with the external service, such as network-related failures and responses with HTTP status codes other than `200`.

## See also

* [Inline hooks management APIs](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/InlineHook/#tag/InlineHook)
* [Hooks best practices](/docs/guides/hooks-best-practices/)
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,23 @@ Event hooks and inline hooks are outbound calls from Okta to an external service

The following sections review best practices to implement and secure Okta event hooks or inline hooks.

## Hook admin roles

By default, the Super Admin role can create and manage hooks for an org.

You can also grant granular hook management permissions to custom admin roles. Create a dedicated hook admin role, or add hook permissions to other custom roles. For information on using permissions, see [Permissions](https://developer.okta.com/docs/api/openapi/okta-management/guides/permissions/) and the following references:

| Hook type | Permission type | Permission link |
|-------------|---------------------|-------------------------------------------------------------------------------------------------------------------------------------|
| Event hook | Manage | [okta.eventhooks.manage](https://developer.okta.com/docs/api/openapi/okta-management/guides/permissions/#oktaeventhooksmanage) |
| Event hook | Read | [okta.eventhooks.read](https://developer.okta.com/docs/api/openapi/okta-management/guides/permissions/#oktaeventhooksread) |
| Inline hook | Manage | [okta.inlinehooks.manage](https://developer.okta.com/docs/api/openapi/okta-management/guides/permissions/#oktainlinehooksmanage) |
| Inline hook | Read | [okta.inlinehooks.read](https://developer.okta.com/docs/api/openapi/okta-management/guides/permissions/#oktainlinehooksread) |

For more information on custom roles, see [Roles in Okta](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#roles-in-okta) and [Custom admin roles](https://help.okta.com/oie/en-us/content/topics/security/custom-admin-role/custom-admin-roles.htm).

>**Note:** Custom permissions for hooks are a [self-service Early Access (EA)](/docs/concepts/feature-lifecycle-management/#self-service-features) feature. See [Manage Early Access and Beta features](https://help.okta.com/okta_help.htm?id=ext_secur_manage_ea_bata) to enable.

## Secure your hook endpoint

To prevent a malicious actor from making requests to the endpoint where your Okta hooks are sent, use the following best practices:
Expand Down