What is Provisioned status in Okta API?

Question

I have been playing around with user lifecycle events against the Okta REST APIs.

I'm confused about the various Okta user statuses, specifically STAGED, ACTIVE, and PROVISIONED. I have seen this diagram:

but it does not fit what I am experiencing.

When I run "create user", as in this example, and I pass in "activate=false" I get a user in STAGED status. If I pass in "activate=true" I get a user in ACTIVE status.

Once the user is created, I am running these REST calls:

• Reset Password
• Update User
• Activate User

Something I am doing puts my user into PROVISIONED status and I can't figure out what that is. Is it creating an "active" user, then updating? Or creating a "staged" user and then updating, or creating an "active" user and then resetting password and waiting an amount of time before they log in? As you can imagine, many permutations here.

What REST call combination puts a newly created Okta user into PROVISIONED status? Is PROVISIONED status like ACTIVE status where the user is "good to go" and can authenticate? Or PROVISIONED more like STAGED where I need to "activate" my user?

Answer 1

Is PROVISIONED status like ACTIVE status where the user is "good to go" and can authenticate? Or PROVISIONED more like STAGED where I need to "activate" my user?

PROVISIONED is almost like ACTIVE, except the user doesn't have any credentials yet and can't log in.

Here's a simple example:

Create a user (but with no password)

POST {{url}}/api/v1/users?activate=false
{
  "profile": {
    "firstName": "Test",
    "lastName": "Testerman",
    "email": "[email protected]",
    "login": "[email protected]"
  }
}

Activate!

POST {{url}}/api/v1/users/00ub09deolJQUhKPm0h7/lifecycle/activate?sendEmail=false

This results in a user with "status": "PROVISIONED".

What might be happening in your case is that the password reset operation is making it look like the user doesn't have a password, so when you do the activate operation, you get PROVISIONED.