Okta (Edge)

Last updated on Nov 13, 2026

Okta is an identity and access management platform that helps organizations manage how users, devices, and applications authenticate and gain access to resources. It enables businesses to centralize user directories, enforce access policies, and monitor security activity across their applications.

Hevo uses the Okta Management API to replicate the users, groups, applications, devices, policies, System Log events, and other data of your Okta organization to the Destination of your choice. To ingest data, you must provide Hevo with the subdomain and domain of your Okta organization and an API token.


Supported Features

Feature Name Supported
Capture deletes Yes, for all objects except System Log
History mode No
Custom data (user-configured tables & fields) Yes, for the custom profile attributes of users
Data blocking (skip objects and fields) Yes
Resync (objects and Pipelines) Yes
API configurable Yes

Handling of Deletes

Hevo marks a record as deleted by setting the value of the metadata column __hevo__marked_deleted to True. Hevo captures deletes as follows:

  • For the objects whose records Hevo ingests in full in each run, Hevo compares the records fetched from Okta with those in the Destination table. Records that are no longer returned by Okta are marked as deleted in the Destination.

  • For the Device, Groups, and Users objects, Hevo does not capture deletes in the runs that ingest new and updated records. Records deleted in Okta are marked as deleted only when Hevo ingests all the records of these objects, which happens in the first run of the Pipeline and when you resync the object. A deactivated user is not deleted; Okta returns it with the status DEPROVISIONED until it is deleted.

  • For the System Log object, Okta never changes or deletes an event, so Hevo does not mark any events as deleted.

  • For child objects, when Hevo ingests a parent record, it replaces the child records of that parent in the Destination. Child records removed from the parent record in Okta are removed from the Destination table.


Source Considerations

  • The objects that Hevo can read depend on the role of the administrator who created the API token. If the token cannot read an object, the object fails to load, and Hevo continues to ingest the other objects.

  • Okta retains System Log events for 90 days. If the Pipeline is paused for more than 90 days, the events published during that time are not available to Hevo.



Revision History

Refer to the following table for the list of key updates made to this page:

Date Release Description of Change
Nov-12-2026 2.54 New document.

Tell us what went wrong