Okta_ApiServiceIntegration

An API service integration

Overview

API service integrations in Okta represent OAuth 2.0 service (daemon) applications that can be granted machine-to-machine access to Okta APIs. There are some important differences between API service integrations and regular OIDC service applications in Okta:

Feature	Service Applications	API Service Integrations
Can be created manually:	✅	❌
Can be added from the OIN Catalog:	✅	✅
Require role assignments:	✅	❌
Support authentication using client secrets:	✅	✅
Support authentication using private keys:	✅	❌
Admins can read cleartext client secrets:	✅	❌

API service integrations are represented as Okta_ApiServiceIntegration nodes in BloodHound.

Edges

The tables below list edges defined by the Okta extension only. Additional edges to or from this node may be created by other extensions.

Inbound Edges

Edge Type	Source Node Types	Traversable
Okta_AppAdmin	Okta_User, Okta_Group, Okta_Application	✅
Okta_Contains	Okta_Organization	✅
Okta_CreatorOf	Okta_User, Okta_Application, Okta_ApiServiceIntegration	❌
Okta_ResourceSetContains	Okta_ResourceSet	✅
Okta_ScopedTo	Okta_RoleAssignment	❌
Okta_SecretOf	Okta_ClientSecret	✅

Outbound Edges

Edge Type	Destination Node Types	Traversable
Okta_CreatorOf	Okta_ApiServiceIntegration	❌

Properties

Name	Source	Type	Description
id	service.id	string	Unique API service integration identifier.
name	service.name	string	Name of the API service integration in Okta.
display_name	service.name	string	Display label used in BloodHound.
okta_domain	Collector context (non-API)	string	Okta organization domain where the integration exists.
app_type	service.type	string	Integration/application type identifier.
oauth_scopes	service.grantedScopes	string[]	OAuth 2.0 scopes granted to the integration.
created_at	service.createdAt	datetime	Timestamp when the integration was created.

Sample Property Values

id: 0oaz7jy5f2oXnvtmN697
name: Falcon Shield
display_name: Falcon Shield
okta_domain: contoso.okta.com
app_type: falconshieldapiservice
oauth_scopes:
  - okta.users.read
  - okta.oauthIntegrations.read
  - okta.threatInsights.read
  - okta.devices.read
  - okta.apiTokens.read
  - okta.roles.read
  - okta.logs.read
  - okta.groups.read
  - okta.apps.read
  - okta.domains.read
  - okta.factors.read
  - okta.authenticators.read
  - okta.policies.read
  - okta.networkZones.read
  - okta.features.read
created_at: 2026-01-15T12:25:42.000Z

Integration OAuth 2.0 Scopes

Each API service integration comes with a pre-defined set of OAuth 2.0 scopes to access Okta APIs: