| title | Okta Privileged Access API release notes 2026 |
|---|
Subscribe to RSS
Okta Privileged Access (OPA) is available for both Okta Classic Engine and Okta Identity Engine.
| Change | Expected in Preview Orgs | Expected in Production |
|---|---|---|
| Credential version history is GA | August 5, 2026 | August 5, 2026 |
| Okta Privileged Access automated app provisioning is GA in Preview | August 5, 2026 |
Okta Privileged Access users can now retrieve a credential's version history and reveal credential versions for secrets, Active Directory accounts, SaaS app accounts, and Okta Universal Directory accounts. See Secrets, Active Directory Accounts, SaaS Application Accounts, and Okta Universal Directory Accounts.
Okta Privileged Access is now automatically provisioned in your org when your subscription becomes active. You no longer need to manually add the app from the OIN catalog or configure SCIM provisioning. See Set up Okta Privileged Access.
| Change | Expected in Preview Orgs |
|---|---|
| Move secrets is GA | July 9, 2026 |
You can now move a secret to a different folder to better align with your team's organizational structure or security policies. You can move the secrets to a different folder within the same project, across projects within a resource group, or across resource groups. See Secrets API.
| Change | Expected in Preview Orgs |
|---|---|
| Move secrets is EA | July 9, 2026 |
You can now move a secret to a different folder to better align with your team's organizational structure or security policies. You can move the secrets to a different folder within the same project, across projects within a resource group, or across resource groups. See Secrets API.
| Change | Expected in Preview Orgs |
|---|---|
| New configuration option for password generation is GA | June 24, 2026 |
The new exclude_certain_characters parameter in the Projects API allows you to exclude any combination of letters, digits, and punctuation characters from generated passwords.
| Change | Expected in Preview Orgs | Expected in Production |
|---|---|---|
| Bug fixed in 2026.06.2 | June 17, 2026 | June 17, 2026 |
When an end user with only the reveal_password privilege attempted to rotate or update a password for a managed SaaS app account, the request returned the HTTP 204 status code. (OKTA-1198356)
| Change | Expected in Preview Orgs | Expected in Production |
|---|---|---|
| Service accounts is GA in Production | May 6, 2026 | June 3, 2026 |
The new Okta Managed User Accounts API is now available for Okta Privileged Access-enabled orgs. Okta Privileged Access secures SaaS service accounts that allows customers to monitor, manage, and control access to service accounts in their SaaS apps. Okta users designated with privileged access are treated as service accounts that resource admins can assign to resource groups and projects, and security admins can create policies to configure which users can access them. The Okta Managed User Accounts API provides operations to manage these user accounts in Okta Universal Directory with OPA. This feature is available only if you're subscribed to Okta Privileged Access. Ensure that you've set up the Okta Privileged Access app before creating app accounts through the API.
See Okta Managed User Accounts, Service Accounts, and Manage service accounts.
| Change | Expected in Preview Orgs | Expected in Production |
|---|---|---|
| On-demand password rotation for server accounts is GA | May 14, 2026 | May 27, 2026 |
| Database privileged access management is EA | May 29, 2026 |
You can now rotate passwords for server accounts on-demand instead of waiting for the scheduled rotation interval. Use the new Rotate the password for a server account endpoint to initiate rotation, grant access to end users through the new rotate_password security policy privilege, and track the password sync status through the secret_sync_status field on the server account. You can also enable or disable initial password rotation for newly discovered managed accounts through the enable_initial_server_account_password_rotation password policy setting.
See Server Accounts, Projects, and Security Policy.
Okta Privileged Access for databases helps minimize security risks by automatically discovering database user accounts, rotating and vaulting credentials, and enforcing policy-based multifactor authentication or manual approvals for access.The newly introduced APIs lets you discover accounts, manage connections to PostgreSQL and MySQL databases, and configure secure gateway orchestrator connectivity. See Database Accounts, Database Connections, and Infrastructure Orchestrators APIs.
| Change | Expected in Preview Orgs |
|---|---|
| On-demand password rotation for server accounts is EA | May 14, 2026 |
You can now rotate passwords for server accounts on-demand instead of waiting for the scheduled rotation interval. Use the new Rotate the password for a server account endpoint to initiate rotation, grant access to end users through the new rotate_password security policy privilege, and track the password sync status through the secret_sync_status field on the server account. You can also enable or disable initial password rotation for newly discovered managed accounts through the enable_initial_server_account_password_rotation password policy setting.
See Server Accounts, Projects, and Security Policy.
| Change | Expected in Preview Orgs |
|---|---|
| Service accounts is GA | May 6, 2026 |
The new Okta Managed User Accounts API is now available for Okta Privileged Access-enabled orgs. Okta Privileged Access secures SaaS service accounts that allows customers to monitor, manage, and control access to service accounts in their SaaS apps. Okta users designated with privileged access are treated as service accounts that resource admins can assign to resource groups and projects, and security admins can create policies to configure which users can access them. The Okta Managed User Accounts API provides operations to manage these user accounts in Okta Universal Directory with OPA.
This feature is available only if you're subscribed to Okta Privileged Access. Ensure that you've set up the Okta Privileged Access app before creating app accounts through the API.
See Okta Managed User Accounts, Service Accounts and Manage service accounts.
| Change | Expected in Preview Orgs |
|---|---|
| Bug fixed in 2026.04.2 | April 15, 2026 |
The Rotate Password endpoint (POST v1/teams/{team_name}/active_directory/{ad_connection_id}/accounts/{ad_account_id}/rotate_password) for Okta user account credentials returned a success status even when the password rotation failed at the Active Directory level. (OKTA-1140010)
| Change | Expected in Preview Orgs |
|---|---|
| Workload identity for automation is now available in Okta Privileged Access | March 30, 2026 |
Workload identity for automation eliminates the need for hardcoded API keys or service account secrets. It does this by using a workload's native platform identity and a runtime OIDC token to securely authenticate automated workloads. This works with platforms like GitHub Actions, GitLab CI, Google Cloud Platform, and Azure Managed Identity. See Workload Connections and Workload Roles.
| Change | Expected in Preview Orgs | Expected in Production |
|---|---|---|
| Enhancements for SSH connectivity for Active Directory domains | March 26, 2026 | April 8, 2026 |
Security policies now support SSH session connectivity for Linux servers joined to an Active Directory domain. This feature allows you to enable server authentication using Active Directory accounts. See Security Policy API.
| Change | Expected in Preview Orgs | Expected in Production |
|---|---|---|
| New password management options for on-premises SaaS app accounts is GA | February 25, 2026 | March 18, 2026 |
You can now configure password rotation for managed on-premises app accounts that require a current password to rotate. This enhancement also allows authorized users to manually override stored passwords in Okta Privileged Access to resolve out-of-sync credentials. New API endpoints allow you to list, retrieve, and update these strategies:
GET /v1/teams/{team_name}/connections/saas_appsGET /v1/teams/{team_name}/connections/saas_apps/{saas_app_instance_id}PATCH /v1/teams/{team_name}/connections/saas_apps/{saas_app_instance_id}
See the SaaS Application Accounts API.
| Change | Expected in Preview Orgs | Expected in Production |
|---|---|---|
| Enhanced filtering for end-user resource APIs | March 4, 2026 | March 9, 2026 |
You can now use the contains query parameter to filter results by name when listing Universal Directory service accounts, SaaS app instances, and SaaS app service accounts. See List all accessible Universal Directory service accounts, List the end user SaaS app instances, and List all end user SaaS app service accounts.
| Change | Expected in Preview Orgs |
|---|---|
| Developer documentation update in 2026.03.0 | March 4, 2026 |
Okta's API reference pages are undergoing a migration, which started on February 24. While the look and feel may vary across pages during this time, all technical documentation remains accurate and up to date.
| Change | Expected in Preview Orgs | Expected in Production |
|---|---|---|
| New System Log event for password rotation changes | February 25, 2026 | |
| New password management options for on-premises SaaS app accounts is EA | February 25, 2026 |
A new System Log event (pam.app.update) has been added to track changes to the password rotation strategy for apps connected to Okta Privileged Access. You can use this event to track configuration changes that impact the management of credentials for connected app accounts. See Event Types.
You can now configure password rotation for managed on-premises app accounts that require a current password to rotate. This enhancement also allows authorized users to manually override stored passwords in Okta Privileged Access to resolve out-of-sync credentials. New API endpoints allow you to list, retrieve, and update these strategies:
-
GET /v1/teams/{team_name}/connections/saas_apps -
GET /v1/teams/{team_name}/connections/saas_apps/{saas_app_instance_id} -
PATCH /v1/teams/{team_name}/connections/saas_apps/{saas_app_instance_id}
See SaaS Application Accounts.
| Change | Expected in Preview Orgs | Expected in Production |
|---|---|---|
| Enhanced filtering for Sudo Commands API | February 12, 2026 | February 17, 2026 |
| New List Secret Templates endpoint is GA | February 11, 2026 | February 18, 2026 |
| Server Account reveal password configuration is GA | February 19, 2026 | February 25, 2026 |
You can now filter the List all sudo command bundles operation using the new contains parameter. This parameter filters and limits the results to sudo command bundles where the name matches the provided search string.
Okta Privileged Access now provides a new List Secret Templates endpoint in the Secrets API. This endpoint allows teams to list and discover available secret templates.
Authorized end users can now retrieve managed server account passwords through the Server Accounts API. See the Server Account API.
| Change | Expected in Preview Orgs | Expected in Production |
|---|---|---|
| Enhanced filtering for Active Directory domains API is EA | February 4, 2026 | February 11, 2026 |
| Enhanced filtering for Active Directory accounts API is EA | February 4, 2026 | February 10, 2026 |
| New List Secret Templates endpoint is EA | February 5, 2026 | |
| Developer documentation updates in 2026.02.0 | February 4, 2026 |
You can now filter the List all Active Directory domains operation using the new parameter contains. This parameter filters and limits the results to domains where the name matches the provided search string.
You can now filter the List all discovered Active Directory accounts operation using the new contains_account_name_or_assigned_opa_user parameter. This parameter filters and limits the results to AD accounts where the User Principal Name (UPN), Security Account Manager (SAM) name, or assigned user name that matches the provided search string.
Okta Privileged Access now provides a new List Secret Templates endpoint in the Secrets API. This endpoint allows teams to list and discover available secret templates.
The Okta developer portal search results now include the API references.
| Change | Expected in Preview Orgs |
|---|---|
| Service account password rotation | January 28, 2026 |
The Okta Universal Directory Accounts and SaaS Application Accounts APIs now support password rotation for Service and SaaS accounts. Additionally, the new skipRotation parameter in the Staged Service Accounts API allows you to control whether a password rotates immediately upon assignment.
| Change | Expected in Preview Orgs |
|---|---|
| Developer documentation update in 2026.01.0 | January 7, 2026 |
The Okta API release notes now provide an RSS feed for each API release note category: Classic Engine, Identity Engine, Identity Governance, Privileged Access, Access Gateway, and Aerial. Click the RSS icon to subscribe.