Okta integration
Okta access changes,
recorded and verifiable.
Governax records access changes from Okta into a tamper-evident ledger: user lifecycle, group membership, application assignments, admin role grants, multi-factor changes and API tokens. Okta pushes them through an Event Hook that Governax registers for you, and each change is appended to a per-entity, SHA-256 hash-chained record.
What lands in the ledger
What does Governax record from Okta?
User lifecycle
Users created, activated, suspended, unsuspended, deactivated and deleted.
Groups
Members added to and removed from groups, and groups created and deleted.
Applications
App assignments and unassignments, and apps created, deactivated and deleted.
Administrative privilege
Admin roles granted and revoked, both to people and to groups.
Multi-factor
Factors added and removed, and MFA resets.
Policy and tokens
Policy changes, and API tokens created and revoked.
Not captured: Routine authentication and session events are deliberately excluded. Okta's System Log records every sign-in, and recording those would bury the access changes that matter.
How does the Okta connection work?
You create an API Services app in your Okta org, add a public key that is unique to your Governax entity, grant it two scopes, okta.eventHooks.manage and okta.users.read, and assign it an admin role. Only a Super Admin can grant Okta API scopes. You then enter your Okta domain and the app's client ID, so no secret of yours is ever pasted into Governax.
Governax signs in to your app, creates an Event Hook in your Okta org, and Okta verifies that hook before anything is saved. Each connection has its own hook URL and its own authorisation secret, which Governax checks on every delivery. Governax subscribes to 24 Okta System Log event types.
Governax checks each connection every six hours. Disconnecting deactivates and deletes the Event Hook in your Okta org.
The baseline snapshot on connect
When you connect, Governax records an access.baseline_observed event for every active user, using the okta.users.read scope. The snapshot runs in the background once the connection is saved, so the ledger starts from who already has access.
Scope
What Governax does not do
Governax is a system of record, not a control plane. It records Okta access changes after they have happened; it does not grant, revoke or block anything.
It requests two scopes only
One to manage the single Event Hook it creates, and one to read users. It requests nothing that changes users, groups or app assignments.
It does not record sign-ins
Routine authentication and session events are excluded. Only access and configuration changes are recorded.
It does not block changes
Events arrive after a change has taken effect in Okta. Governax records changes; it cannot prevent one.
How this helps with audits
When an auditor asks who had access in Okta and when it changed, the answer is a filtered view of the ledger rather than a folder of screenshots. Approvals are recorded for access requests raised with /governax in Slack. Filters combine tool, event type, actor and a date range, and the date range matches when the change happened in Okta, not when Governax recorded it.
Because a baseline snapshot is taken when you connect, the record starts from who already had access, not only from the changes that followed.
Every event is appended to the entity's SHA-256 hash chain, and database triggers reject every update and delete. Anyone given read access to the entity, an auditor included, can re-run verification, which recomputes every hash and checks every link.
Verification proves that what was recorded has not changed. It cannot prove that everything that happened was recorded. Governax records the evidence; it does not map it to controls, perform the audit or export reports.
Questions
Okta integration FAQ
Does Governax need write access to Okta?
Governax asks for two Okta API scopes and nothing else: okta.eventHooks.manage, to create, verify, health-check and remove the one Event Hook it registers, and okta.users.read, for the snapshot of active users at connect. The app also needs an admin role that can manage Event Hooks and view users, because Okta checks the role on every call.
Why an API Services app rather than an Okta API token?
An Okta API token acts with every permission of the admin who created it, stops working if that admin leaves, and is revoked after 30 days unused. An API Services app is limited to the scopes you grant, belongs to no person, and does not expire.
Are Okta sign-ins recorded?
No. Routine authentication and session events are deliberately excluded. Only access and configuration changes are recorded.
What happens if the Event Hook is deleted in Okta?
Ingestion stops, and Governax notices on its next health check, which runs every six hours. Reconnect and Governax registers a new hook. To stop cleanly, disconnect from the Governax side, which removes the hook properly.
How quickly do Okta changes appear?
Okta is a push connector. Changes are delivered through the Event Hook and typically appear within seconds.
Other integrations
- SlackWorkspace membership, channels, external sharing and access requests
- GitHubOrganisation, team and repository access, branch protection
- Google WorkspaceUsers, groups, admin roles and third-party app grants
- AWSIAM users, roles and policies, read from CloudTrail
- Microsoft Entra IDDirectory roles, group membership and app consent
- GitLabGroup and project membership, tokens and deploy keys
Connect Okta and start the record.
Read the Okta setup guide, compare plans, or start free with one entity.