---
title: "Get Okta SSO configuration"
method: GET
path: "/api/v1/org/sso/okta"
tags: ["Organizations"]
---

# Get Okta SSO configuration

`GET /api/v1/org/sso/okta`

Returns the current organization's Okta SSO configuration (sensitive
fields are not included).

## Response `200`

Ok

- ApiOktaSsoConfigResponse
  - `results` OktaSsoConfigSummary, required — Per-row flags shared by every SSO method configured at the org level. Stored as plain columns alongside the encrypted provider-specific config.
    - `oauth2ClientId` string, required
    - `oauth2Issuer` string, required
    - `oktaDomain` string, required
    - `authorizationServerId` string, nullable, required — Optional custom authorization server (Okta API Access Management).
    - `extraScopes` string, nullable, required — Optional extra scopes (space-separated) appended to the auth request.
    - `allowPassword` boolean, required — Controls whether email+password sign-in is shown alongside this method when it matches a user. When multiple matching SSO methods disagree, lenient rule applies (ANY method that allows → show password).
    - `emailDomains` string[], required — Strict whitelist (only consulted when `overrideEmailDomains` is true).
    - `overrideEmailDomains` boolean, required — When true, the method's own `emailDomains` list governs discovery. When false, the org's `allowed_email_domains` is used instead.
    - `enabled` boolean, required — When false the method is hidden from precheck even if discovery would match.
    - `hasClientSecret` boolean, required
  - `status` 'ok', required

## Other responses

- `default` — Error

---

[API](https://skmtc.net/lightdash/apis/lightdash-api.md) · [All operations](https://skmtc.net/lightdash/apis/lightdash-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lightdash/lightdash-api/versions/40c933755c9a/schema)