- Introduction
-
Getting Started
- Creating an Account in Hevo
- Subscribing to Hevo via AWS Marketplace
- Subscribing to Hevo via Snowflake Marketplace
- Connection Options
- Familiarizing with the UI
- Creating your First Pipeline
- Data Loss Prevention and Recovery
- Upgrading Pipeline from Standard to Edge
-
Data Ingestion
- Types of Data Synchronization
- Ingestion Modes and Query Modes for Database Sources
- Ingestion and Loading Frequency
- Data Ingestion Statuses
- Deferred Data Ingestion
- Handling of Primary Keys
- Handling of Updates
- Handling of Deletes
- Hevo-generated Metadata
- Best Practices to Avoid Reaching Source API Rate Limits
-
Edge
- Data Ingestion
- Core Concepts
-
Pipelines
- Familiarizing with the Pipelines UI
- Creating an Edge Pipeline
- Working with Edge Pipelines
- Pipeline Job History
- Pipeline Overview
- Needs Attention
- Object and Schema Management
- Activity Log
-
Sources
- Connect AI
- PostgreSQL
- Oracle
- MySQL
- SQL Server
- Troubleshooting Database Sources
- CockroachDB
- MongoDB
- SharePoint
- Salesforce Bulk API V2
- Ordergroove
- BambooHR
- Stripe
- NetSuite SuiteAnalytics
- Shopify
- Slack
- ClickUp
- Monday.com
- Pipedrive
- Workable
- Fathom
- HubSpot
- Salesforce Marketing Cloud
- Google Analytics 4
- Google Ads
- Facebook Ads
- Microsoft Ads
- LinkedIn Ads
- Xero
- Instagram Business
- Amazon Selling Partner
- TikTok Ads
- StackAdapt
- Amazon Ads
- Pinterest Organic
- Zendesk Support
- Snapchat Ads
- TikTok Organic
- Google Search Console
- Klaviyo v2
- Braintree Payments
- Facebook Pages
- Tempo
- PayPal
- Auth0
- Pinterest Ads
- Apple Search Ads
- Permit.io
- Amplitude Analytics
- Customer.io
- Paddle
- Jira Cloud
- Fullstory
- GitHub
- WorkOS
- ActiveCampaign
- Campaign Monitor
- Infobip
- Mailgun Send
- Metaplane
- Notion
- Recharge
- sevdesk
- Statuspage
- Teamwork.com
- Workday RaaS
- Yotpo
- TikTok Shop Partner Center
- Linear
- Microsoft Dynamics 365 Business Central
- Checkout.com
- Pylon
- Increase
- Microsoft Teams
- Rollbar
- Toggl Track
- QuickBooks Online
- Zoho Desk
- Livestorm
- Attentive
- SendGrid
- Bitly
- Shortcut
- Buzzsprout
- Persona
- Mailjet
- Open Exchange Rates
- PagerDuty
- CircleCI
- SonarQube
- Chargebee
- Bing Webmaster Tools
- Rundeck
- Cal.com
- Mixpanel
- Matomo
- Walmart Marketplace
- Xray
- Reddit Ads
- Zoho Recruit
- Freshchat
- Zoho Books
- Outreach
- Airtable
- Attio
- Okta
- Naming Conventions for Source Data Entities
- Destinations
- Transformations
- Alerts
- Activate
- Custom Connectors
-
Data Loading
- Loading Data in a Database Destination
- Loading Data to a Data Warehouse
- Optimizing Data Loading for a Destination Warehouse
- Deduplicating Data in a Data Warehouse Destination
- Manually Triggering the Loading of Events
- Scheduling Data Load for a Destination
- Loading Events in Batches
- Data Loading Statuses
- Data Spike Alerts
- Name Sanitization
- Table and Column Name Compression
- Parsing Nested JSON Fields in Events
-
Pipelines
- Data Flow in a Pipeline
- Familiarizing with the Pipelines UI
- Working with Pipelines
- Managing Objects in Pipelines
- Pipeline Jobs
-
Transformations
-
Python Code-Based Transformations
- Supported Python Modules and Functions
-
Transformation Methods in the Event Class
- Create an Event
- Retrieve the Event Name
- Rename an Event
- Retrieve the Properties of an Event
- Modify the Properties for an Event
- Fetch the Primary Keys of an Event
- Modify the Primary Keys of an Event
- Fetch the Data Type of a Field
- Check if the Field is a String
- Check if the Field is a Number
- Check if the Field is Boolean
- Check if the Field is a Date
- Check if the Field is a Time Value
- Check if the Field is a Timestamp
-
TimeUtils
- Convert Date String to Required Format
- Convert Date to Required Format
- Convert Datetime String to Required Format
- Convert Epoch Time to a Date
- Convert Epoch Time to a Datetime
- Convert Epoch to Required Format
- Convert Epoch to a Time
- Get Time Difference
- Parse Date String to Date
- Parse Date String to Datetime Format
- Parse Date String to Time
- Utils
- Examples of Python Code-based Transformations
-
Drag and Drop Transformations
- Special Keywords
-
Transformation Blocks and Properties
- Add a Field
- Change Datetime Field Values
- Change Field Values
- Drop Events
- Drop Fields
- Find & Replace
- Flatten JSON
- Format Date to String
- Format Number to String
- Hash Fields
- If-Else
- Mask Fields
- Modify Text Casing
- Parse Date from String
- Parse JSON from String
- Parse Number from String
- Rename Events
- Rename Fields
- Round-off Decimal Fields
- Split Fields
- Examples of Drag and Drop Transformations
- Effect of Transformations on the Destination Table Structure
- Transformation Reference
- Transformation FAQs
-
Python Code-Based Transformations
-
Schema Mapper
- Using Schema Mapper
- Mapping Statuses
- Auto Mapping Event Types
- Manually Mapping Event Types
- Modifying Schema Mapping for Event Types
- Schema Mapper Actions
- Fixing Unmapped Fields
- Resolving Incompatible Schema Mappings
- Resizing String Columns in the Destination
- Changing the Data Type of a Destination Table Column
- Schema Mapper Compatibility Table
- Limits on the Number of Destination Columns
- File Log
- Troubleshooting Failed Events in a Pipeline
- Mismatch in Events Count in Source and Destination
- Audit Tables
- Activity Log
-
Pipeline FAQs
- Can multiple Sources connect to one Destination?
- What happens if I re-create a deleted Pipeline?
- Why is there a delay in my Pipeline?
- Can I change the Destination post-Pipeline creation?
- Why is my billable Events high with Delta Timestamp mode?
- Can I drop multiple Destination tables in a Pipeline at once?
- How does Run Now affect scheduled ingestion frequency?
- Will pausing some objects increase the ingestion speed?
- Can I see the historical load progress?
- Why is my Historical Load Progress still at 0%?
- Why is historical data not getting ingested?
- How do I set a field as a primary key?
- How do I ensure that records are loaded only once?
- Why can't I see my Pipelines after logging in?
- Events Usage
-
Sources
- Free Sources
-
Databases and File Systems
- Data Warehouses
-
Databases
- Connecting to a Local Database
- Amazon DocumentDB
- Amazon DynamoDB
- Elasticsearch
-
MongoDB
- Generic MongoDB
- MongoDB Atlas
- Support for Multiple Data Types for the _id Field
- Example - Merge Collections Feature
-
Troubleshooting MongoDB
-
Errors During Pipeline Creation
- Error 1001 - Incorrect credentials
- Error 1005 - Connection timeout
- Error 1006 - Invalid database hostname
- Error 1007 - SSH connection failed
- Error 1008 - Database unreachable
- Error 1011 - Insufficient access
- Error 1028 - Primary/Master host needed for OpLog
- Error 1029 - Version not supported for Change Streams
- SSL 1009 - SSL Connection Failure
- Troubleshooting MongoDB Change Streams Connection
- Troubleshooting MongoDB OpLog Connection
-
Errors During Pipeline Creation
- SQL Server
-
MySQL
- Amazon Aurora MySQL
- Amazon RDS MySQL
- Azure MySQL
- Generic MySQL
- Google Cloud MySQL
- MariaDB MySQL
-
Troubleshooting MySQL
-
Errors During Pipeline Creation
- Error 1003 - Connection to host failed
- Error 1006 - Connection to host failed
- Error 1007 - SSH connection failed
- Error 1011 - Access denied
- Error 1012 - Replication access denied
- Error 1017 - Connection to host failed
- Error 1026 - Failed to connect to database
- Error 1027 - Unsupported BinLog format
- Failed to determine binlog filename/position
- Schema 'xyz' is not tracked via bin logs
- Errors Post-Pipeline Creation
-
Errors During Pipeline Creation
- MySQL FAQs
- Oracle
-
PostgreSQL
- Amazon Aurora PostgreSQL
- Amazon RDS PostgreSQL
- Azure PostgreSQL
- Generic PostgreSQL
- Google Cloud PostgreSQL
- Heroku PostgreSQL
- Upgrading Pipelines with PostgreSQL Sources to Use the pgoutput Plugin
-
Troubleshooting PostgreSQL
-
Errors during Pipeline creation
- Error 1003 - Authentication failure
- Error 1006 - Connection settings errors
- Error 1011 - Access role issue for logical replication
- Error 1012 - Access role issue for logical replication
- Error 1014 - Database does not exist
- Error 1017 - Connection settings errors
- Error 1023 - No pg_hba.conf entry
- Error 1024 - Number of requested standby connections
- Errors Post-Pipeline Creation
-
Errors during Pipeline creation
-
PostgreSQL FAQs
- Can I track updates to existing records in PostgreSQL?
- How can I migrate a Pipeline created with one PostgreSQL Source variant to another variant?
- How can I prevent data loss when migrating or upgrading my PostgreSQL database?
- Why do FLOAT4 and FLOAT8 values in PostgreSQL show additional decimal places when loaded to BigQuery?
- Why is data not being ingested from PostgreSQL Source objects?
- Troubleshooting Database Sources
- Database Source FAQs
- File Storage
- Engineering Analytics
- Finance & Accounting Analytics
-
Marketing Analytics
- ActiveCampaign
- AdRoll
- Amazon Ads
- Apple Search Ads
- AppsFlyer
- CleverTap
- Criteo
- Drip
- Facebook Ads
- Facebook Page Insights
- Firebase Analytics
- Freshsales
- Google Ads
- Google Analytics 4
- Google Analytics 360
- Google Play Console
- Google Search Console
- HubSpot
- Instagram Business
- Klaviyo v2
- Lemlist
- LinkedIn Ads
- Mailchimp
- Mailshake
- Marketo
- Microsoft Ads
- Onfleet
- Outbrain
- Pardot
- Pinterest Ads
- Pipedrive
- Recharge
- Segment
- SendGrid Webhook
- SendGrid
- Salesforce Marketing Cloud
- Snapchat Ads
- SurveyMonkey
- Taboola
- TikTok Ads
- Twitter Ads
- Typeform
- YouTube Analytics
- Product Analytics
- Sales & Support Analytics
- Source FAQs
-
Destinations
- Familiarizing with the Destinations UI
- Cloud Storage-Based
- Databases
-
Data Warehouses
- Amazon Redshift
- Amazon Redshift Serverless
- Azure Synapse Analytics
- Databricks
-
Google BigQuery
- Clustering in BigQuery
- Partitioning in BigQuery
- Structure of Data in the Google BigQuery Data Warehouse
- Loading Data to a Google BigQuery Data Warehouse
- Near Real-time Data Loading using Streaming
- Modifying BigQuery Destinations to Use Service Account Authentication
- Troubleshooting Google BigQuery
- Google BigQuery FAQs
- Hevo Managed Google BigQuery
- Snowflake
- Troubleshooting Data Warehouse Destinations
-
Destination FAQs
- Can I change the primary key in my Destination table?
- Can I change the Destination table name after creating the Pipeline?
- How can I change or delete the Destination table prefix?
- Why does my Destination have deleted Source records?
- How do I filter deleted Events from the Destination?
- Does a data load regenerate deleted Hevo metadata columns?
- How do I filter out specific fields before loading data?
- Transform
- Alerts
- Account Management
- Activate
- Glossary
-
Releases-
2026 Releases
- Release 2.53 (August 24 – September 21, 2026)
- Release 2.52 (July 27 – August 24, 2026)
- Release 2.51 (Jun 29 – July 27 , 2026)
- Release 2.50 (Jun 01–29, 2026)
- Release 2.49 (May 04-Jun 01, 2026)
- Release 2.48 (Apr 06-May 04, 2026)
- Release 2.47 (Mar 09-Apr 06, 2026)
- Release 2.46 (Feb 09-Mar 09, 2026)
- Release 2.45 (Jan 12-Feb 09, 2026)
-
2025 Releases
- Release 2.44 (Dec 01, 2025-Jan 12, 2026)
- Release 2.43 (Nov 03-Dec 01, 2025)
- Release 2.42 (Oct 06-Nov 03, 2025)
- Release 2.41 (Sep 08-Oct 06, 2025)
- Release 2.40 (Aug 11-Sep 08, 2025)
- Release 2.39 (Jul 07-Aug 11, 2025)
- Release 2.38 (Jun 09-Jul 07, 2025)
- Release 2.37 (May 12-Jun 09, 2025)
- Release 2.36 (Apr 14-May 12, 2025)
- Release 2.35 (Mar 17-Apr 14, 2025)
- Release 2.34 (Feb 17-Mar 17, 2025)
- Release 2.33 (Jan 20-Feb 17, 2025)
-
2024 Releases
- Release 2.32 (Dec 16 2024-Jan 20, 2025)
- Release 2.31 (Nov 18-Dec 16, 2024)
- Release 2.30 (Oct 21-Nov 18, 2024)
- Release 2.29 (Sep 30-Oct 22, 2024)
- Release 2.28 (Sep 02-30, 2024)
- Release 2.27 (Aug 05-Sep 02, 2024)
- Release 2.26 (Jul 08-Aug 05, 2024)
- Release 2.25 (Jun 10-Jul 08, 2024)
- Release 2.24 (May 06-Jun 10, 2024)
- Release 2.23 (Apr 08-May 06, 2024)
- Release 2.22 (Mar 11-Apr 08, 2024)
- Release 2.21 (Feb 12-Mar 11, 2024)
- Release 2.20 (Jan 15-Feb 12, 2024)
-
2023 Releases
- Release 2.19 (Dec 04, 2023-Jan 15, 2024)
- Release Version 2.18
- Release Version 2.17
- Release Version 2.16 (with breaking changes)
- Release Version 2.15 (with breaking changes)
- Release Version 2.14
- Release Version 2.13
- Release Version 2.12
- Release Version 2.11
- Release Version 2.10
- Release Version 2.09
- Release Version 2.08
- Release Version 2.07
- Release Version 2.06
-
2022 Releases
- Release Version 2.05
- Release Version 2.04
- Release Version 2.03
- Release Version 2.02
- Release Version 2.01
- Release Version 2.00
- Release Version 1.99
- Release Version 1.98
- Release Version 1.97
- Release Version 1.96
- Release Version 1.95
- Release Version 1.93 & 1.94
- Release Version 1.92
- Release Version 1.91
- Release Version 1.90
- Release Version 1.89
- Release Version 1.88
- Release Version 1.87
- Release Version 1.86
- Release Version 1.84 & 1.85
- Release Version 1.83
- Release Version 1.82
- Release Version 1.81
- Release Version 1.80 (Jan-24-2022)
- Release Version 1.79 (Jan-03-2022)
-
2021 Releases
- Release Version 1.78 (Dec-20-2021)
- Release Version 1.77 (Dec-06-2021)
- Release Version 1.76 (Nov-22-2021)
- Release Version 1.75 (Nov-09-2021)
- Release Version 1.74 (Oct-25-2021)
- Release Version 1.73 (Oct-04-2021)
- Release Version 1.72 (Sep-20-2021)
- Release Version 1.71 (Sep-09-2021)
- Release Version 1.70 (Aug-23-2021)
- Release Version 1.69 (Aug-09-2021)
- Release Version 1.68 (Jul-26-2021)
- Release Version 1.67 (Jul-12-2021)
- Release Version 1.66 (Jun-28-2021)
- Release Version 1.65 (Jun-14-2021)
- Release Version 1.64 (Jun-01-2021)
- Release Version 1.63 (May-19-2021)
- Release Version 1.62 (May-05-2021)
- Release Version 1.61 (Apr-20-2021)
- Release Version 1.60 (Apr-06-2021)
- Release Version 1.59 (Mar-23-2021)
- Release Version 1.58 (Mar-09-2021)
- Release Version 1.57 (Feb-22-2021)
- Release Version 1.56 (Feb-09-2021)
- Release Version 1.55 (Jan-25-2021)
- Release Version 1.54 (Jan-12-2021)
-
2020 Releases
- Release Version 1.53 (Dec-22-2020)
- Release Version 1.52 (Dec-03-2020)
- Release Version 1.51 (Nov-10-2020)
- Release Version 1.50 (Oct-19-2020)
- Release Version 1.49 (Sep-28-2020)
- Release Version 1.48 (Sep-01-2020)
- Release Version 1.47 (Aug-06-2020)
- Release Version 1.46 (Jul-21-2020)
- Release Version 1.45 (Jul-02-2020)
- Release Version 1.44 (Jun-11-2020)
- Release Version 1.43 (May-15-2020)
- Release Version 1.42 (Apr-30-2020)
- Release Version 1.41 (Apr-2020)
- Release Version 1.40 (Mar-2020)
- Release Version 1.39 (Feb-2020)
- Release Version 1.38 (Jan-2020)
-
2026 Releases
- Early Access New
Okta (Edge)
Okta is an identity and access management platform that helps organizations manage how users, devices, and applications authenticate and gain access to resources. It enables businesses to centralize user directories, enforce access policies, and monitor security activity across their applications.
Hevo uses the Okta Management API to replicate the users, groups, applications, devices, policies, System Log events, and other data of your Okta organization to the Destination of your choice. To ingest data, you must provide Hevo with the subdomain and domain of your Okta organization and an API token.
Supported Features
| Feature Name | Supported |
|---|---|
| Capture deletes | Yes, for all objects except System Log |
| History mode | No |
| Custom data (user-configured tables & fields) | Yes, for the custom profile attributes of users |
| Data blocking (skip objects and fields) | Yes |
| Resync (objects and Pipelines) | Yes |
| API configurable | Yes |
Prerequisites
-
An active Okta organization exists from which data is to be ingested.
-
You can log in to the Okta Admin Console as an administrator who can create API tokens. An API token has the permissions of the administrator who creates it, so create the token as a Super Administrator for Hevo to read all the objects. If the token cannot read an object, Hevo fails only that object and ingests the other objects.
-
The subdomain and domain of your Okta organization are available.
-
An API token is available to provide Hevo access to your Okta data.
Find your Okta Subdomain and Domain
The subdomain and domain are parts of the URL of your Okta organization. For example, if you log in to Okta at acme.okta.com, the subdomain is acme and the domain is okta.com. If the URL of your Admin Console contains -admin, such as acme-admin.okta.com, the subdomain is the part before -admin, that is, acme. Okta organizations use domains such as okta.com, oktapreview.com, and okta-emea.com.
Obtain the API Token
Hevo uses an API token to authenticate with your Okta organization. Okta recommends that you create the token from a dedicated service account, so that the permissions of the token do not change when an administrator’s role changes. Read Manage Okta API tokens.
Perform the following steps to obtain the API token:
-
Log in to your Okta Admin Console as an administrator.
-
In the left navigation pane, click Security, and then click API.

-
On the API page, click the Tokens tab, and then click Create token.

-
In the Create token dialog, specify the following, and then click Create token:

-
What do you want your token to be named?: A name for the token. For example, Hevo.
-
API calls made with this token must originate from: The network from which Okta accepts the API calls made with this token. Select Any IP. If you restrict the token to network zones, the zones must include the IP addresses of Hevo for your region.
Okta may ask you to verify your identity again before it creates the token.
-
-
Click the copy icon to copy the Token Value, and save it securely like any other password. Then, click OK, got it.

Note: Okta displays the token value only once.
Okta revokes an API token that is not used for 30 days, and when the administrator who created it is deactivated. If the API token is revoked, Hevo cannot read your Okta data, and the jobs of the Pipeline fail. To resume data replication, modify the Source configuration in the Pipeline with a new API token.
Configure Okta as a Source in your Pipeline
Perform the following steps to configure your Okta Source:
-
Click Pipelines in the Navigation Bar.
-
Click + Create Pipeline in the Pipelines List View.
-
On the Select Source Type page, select Okta.
-
On the Select Destination Type page, select the type of Destination you want to use.
-
In the Configure Source screen, specify the following:

-
Source Name: A unique name for your Source, not exceeding 255 characters. For example, Okta Source.
-
In the Connect to Okta section, specify the following:
-
-
Click Test & Continue to test the connection to your Okta Source. Once the test is successful, you can proceed to set up your Destination.
Data Replication
Hevo replicates data for all the objects selected on the Configure Objects page during Pipeline creation. By default, all supported objects and their available fields are selected. However, you can modify this selection while creating or editing the Pipeline. Selecting a parent object automatically includes its child objects. The Data Model lists the child objects of each parent object.
In the first run of the Pipeline, Hevo ingests all the data available for the selected objects in your Okta organization. For the System Log object, Hevo ingests the events of the last 90 days, which is how long Okta retains them. In the subsequent runs, as per the sync frequency, Hevo ingests data as follows:
| Ingestion | Objects |
|---|---|
| New and updated records, based on the time each record was last updated in Okta | Device, Groups, and Users |
| New events, based on the time each event was published | System Log |
| All the records, in each run | All the other parent objects, such as Application, Group Rule, Identity Provider, Network Zone, and Policy |
Hevo ingests the child objects of a parent object along with it. When Hevo ingests a parent record, it replaces the child records of that parent in the Destination.
Okta limits the number of API requests that an organization can make to each endpoint per minute. The limits depend on your Okta subscription, and the API token shares them with the other integrations of your organization. Read Rate limits. If Okta returns a rate limit error, Hevo waits and retries the request. If the limit is still exceeded, the object fails in that run, and Hevo ingests it again in the next run. To understand how Hevo handles such scenarios, read Handling Rate Limit Exceptions.
Pipelines with this Source support only the Merge load mode.
Schema and Primary Keys
Hevo uses the following schema to upload the records in the Destination. For a detailed view of the objects, fields, and relationships, click the ERD.
Data Model
The following is the list of tables (objects) that are created at the Destination when you run the Pipeline:
| Object | Description |
|---|---|
| API Token Metadata | Contains the details of the API tokens of your Okta organization, such as the token name, the user who created it, the creation and expiry times, and the network that the token is restricted to. Hevo does not ingest the token values. |
| Application | Contains the applications integrated with your Okta organization, including the name, label, status, sign-on mode, and settings. This object has the following child objects: - Application Client Credentials Link: The client credential links of an application. - Application Feature: The features enabled for an application. - Application Group: The groups assigned to an application. - Application Link: The resource links of an application. - Application Logo Link: The links to the logos of an application. - Application Sign On ACS Endpoint: The Assertion Consumer Service (ACS) endpoints of the SAML sign-on of an application. - Application Sign On Attribute Statement: The SAML attribute statements of an application. - Application Sign On Inline Hook: The inline hooks of the sign-on of an application. - Application User: The users assigned to an application, with the assignment scope and status. - Group Push Mapping: The mappings that push Okta groups to an application. - OAuth Client Grant Type: The OAuth grant types allowed for an application. - OAuth Client Post Logout Redirect URI: The post-logout redirect URIs of an OAuth application. - OAuth Client Redirect URI: The redirect URIs of an OAuth application. - OAuth Client Response Type: The OAuth response types allowed for an application. |
| Custom Role | Contains the custom administrator roles of your Okta organization. This object has the following child object: - Custom Role Permission: The permissions granted by a custom role. |
| Device | Contains the devices registered with your Okta organization, such as the platform, status, and registration time. This object has the following child object: - Device User: The users of a device. |
| Group Rule | Contains the group rules that assign users to groups based on conditions. This object has the following child objects: - Assign User To Group ID: The groups to which a group rule assigns users. - Group Excluded From Rule: The groups excluded from a group rule. - User Excluded From Rule: The users excluded from a group rule. |
| Groups | Contains the groups of your Okta organization, including the name, description, type, and the time the group or its membership was last updated. This object has the following child objects: - Group Logo Link: The links to the logos of a group. - Group Member: The users who are members of a group. - Group Role: The administrator roles assigned to a group. |
| Identity Provider | Contains the external identity providers (IdPs) federated with your Okta organization, including the name, type, status, and protocol settings. This object has the following child object: - Identity Provider Protocol Scope: The protocol scopes of an identity provider. |
| Network Zone | Contains the network zones of your Okta organization, including the name, type, status, and usage. This object has the following child objects: - Network Zone Gateway: The gateway IP addresses of a network zone. - Network Zone Proxy: The proxy IP addresses of a network zone. |
| Policy | Contains the policies of your Okta organization, such as sign-on, password, and authenticator enrollment policies, including the name, type, status, and priority. This object has the following child objects: - Policy Rule: The rules of a policy, including the conditions and actions. - Policy Rule Condition Excluded User: The users excluded from the conditions of a policy rule. |
| Profile Mapping | Contains the mappings of profile attributes between Okta and applications or identity providers. This object has the following child object: - Profile Mapping Property: The attribute mappings of a profile mapping. |
| Realm | Contains the realms of your Okta organization. Hevo ingests this object only if the Realms feature is enabled for your organization. |
| Realm Assignment | Contains the realm assignments that determine the realm of users. Hevo ingests this object only if the Realms feature is enabled for your organization. |
| Resource Set | Contains the resource sets that group resources for administrator role assignments. This object has the following child object: - Resource: The resources of a resource set. |
| System Log | Contains the System Log events of your Okta organization, such as the event type, actor, outcome, and the time the event was published. This object has the following child objects: - System Log Request: The IP chain of the request of an event. - System Log Target: The targets of an event. |
| User Type | Contains the user types of your Okta organization. |
| Users | Contains the users of your Okta organization, including their profile, status, and the times of their last login, last update, and last status change. This object has the following child objects: - User Authenticator Enrollment: The authenticators enrolled by a user. - User Credentials Email: The email addresses of the credentials of a user. - User Custom Profile: The custom profile attributes of a user, as name and value pairs. - User Enrolled Factor: The multifactor authentication factors enrolled by a user. - User Role: The administrator roles assigned to a user. |
Additional Information
Read the detailed Hevo documentation for the following related topics:
Handling of Deletes
Hevo marks a record as deleted by setting the value of the metadata column __hevo__marked_deleted to True. Hevo captures deletes as follows:
-
For the objects whose records Hevo ingests in full in each run, Hevo compares the records fetched from Okta with those in the Destination table. Records that are no longer returned by Okta are marked as deleted in the Destination.
-
For the Device, Groups, and Users objects, Hevo does not capture deletes in the runs that ingest new and updated records. Records deleted in Okta are marked as deleted only when Hevo ingests all the records of these objects, which happens in the first run of the Pipeline and when you resync the object. A deactivated user is not deleted; Okta returns it with the status DEPROVISIONED until it is deleted.
-
For the System Log object, Okta never changes or deletes an event, so Hevo does not mark any events as deleted.
-
For child objects, when Hevo ingests a parent record, it replaces the child records of that parent in the Destination. Child records removed from the parent record in Okta are removed from the Destination table.
Source Considerations
-
The objects that Hevo can read depend on the role of the administrator who created the API token. If the token cannot read an object, the object fails to load, and Hevo continues to ingest the other objects.
-
Okta retains System Log events for 90 days. If the Pipeline is paused for more than 90 days, the events published during that time are not available to Hevo.
Revision History
Refer to the following table for the list of key updates made to this page:
| Date | Release | Description of Change |
|---|---|---|
| Nov-12-2026 | 2.54 | New document. |