Okta_ApiServiceIntegration

An API service integration

Overview

API service integrations in Okta represent OAuth 2.0 service (daemon) applications that can be granted machine-to-machine access to Okta APIs. There are some important differences between API service integrations and regular OIDC service applications in Okta:

Feature	Service Applications	API Service Integrations
Can be created manually:	✅	❌
Can be added from the OIN Catalog:	✅	✅
Require role assignments:	✅	❌
Support authentication using client secrets:	✅	✅
Support authentication using private keys:	✅	❌
Admins can read cleartext client secrets:	✅	❌

API service integrations are represented as Okta_ApiServiceIntegration nodes in BloodHound.

Edges

The tables below list edges defined by the Okta extension only. Additional edges to or from this node may be created by other extensions.

Inbound Edges

Edge Type	Source Node Types	Traversable
Okta_AppAdmin	Okta_User, Okta_Group, Okta_Application	✅
Okta_Contains	Okta_Organization	✅
Okta_CreatorOf	Okta_User, Okta_Application, Okta_ApiServiceIntegration	❌
Okta_ResourceSetContains	Okta_ResourceSet	✅
Okta_ScopedTo	Okta_RoleAssignment	❌
Okta_SecretOf	Okta_ClientSecret	✅

Outbound Edges

Edge Type	Destination Node Types	Traversable
Okta_CreatorOf	Okta_ApiServiceIntegration	❌

Properties

Name	Source	Type	Description
id	service.id	string	Unique API service integration identifier.
name	service.name	string	Name of the API service integration in Okta.
displayName	service.name	string	Display label used in BloodHound.
oktaDomain	Collector context (non-API)	string	Okta organization domain where the integration exists.
appType	service.type	string	Integration/application type identifier.
oauthScopes	service.grantedScopes	string[]	OAuth 2.0 scopes granted to the integration.
createdAt	service.createdAt	datetime	Timestamp when the integration was created.

Sample Property Values

id: 0oaz7jy5f2oXnvtmN697
name: Falcon Shield
displayName: Falcon Shield
oktaDomain: contoso.okta.com
appType: falconshieldapiservice
oauthScopes:
  - okta.users.read
  - okta.oauthIntegrations.read
  - okta.threatInsights.read
  - okta.devices.read
  - okta.apiTokens.read
  - okta.roles.read
  - okta.logs.read
  - okta.groups.read
  - okta.apps.read
  - okta.domains.read
  - okta.factors.read
  - okta.authenticators.read
  - okta.policies.read
  - okta.networkZones.read
  - okta.features.read
createdAt: 2026-01-15T12:25:42.000Z

Integration OAuth 2.0 Scopes

Each API service integration comes with a pre-defined set of OAuth 2.0 scopes to access Okta APIs: