fix(okta): stop partial updates erasing stored profile data (#6751)

* fix(okta): stop partial updates erasing stored profile data

Post-merge audit of the Okta integration (follows #6741), verified against the
OpenAPI spec bundled in okta-sdk-golang/.generator.

Two updates could silently destroy data:

- `update_group` targets `PUT /api/v1/groups/{groupId}`, which Okta documents as
  `replaceGroup` — it swaps the profile wholesale. Sending only the two fields
  the tool exposes erased the stored description on every rename, and dropped
  every org-defined custom attribute along with it. The tool now reads the group
  and overlays the supplied fields before replacing, matching the read-modify-
  write `salesforce_update_custom_field` already uses for the same hazard.
- `update_user` gated its profile fields on `!== undefined`, so an empty string
  reached Okta and blanked the stored value. The block strips blanks before they
  get there, but the tool is `user-or-llm` and a model routinely emits `""` for a
  field it has nothing to say about, so the guard belongs on the tool.

Also corrected:

- `forgetDevices` defaults to true at Okta, so the unseeded switch rendered off
  while remembered factors were in fact being cleared.
- Group rules take a plain keyword on `search`, not the SCIM-style expression the
  shared Search field's wand generates, so they get their own field.
- `get_logs` dropped `limit=0`, which the spec documents as valid.
- `get_user` emitted an activation timestamp under `activated`, which the block
  declares as the lifecycle boolean; the timestamp is now `activatedAt`.
- Descriptions that overstated what an endpoint does: `list_users` omits
  DEPROVISIONED users, `delete_user` deactivates before it deletes,
  `delete_group_rule` answers 202, and `excludedGroupIds` is always empty because
  Okta does not support group exclusions.

* fix(okta): forward the abort signal through the group read-modify-write

* test(okta): rename the shared body-builder helper

* fix(okta): key the send-email and search mappings off the operation

* docs(okta): use TSDoc for the new block annotations

Author: waleedlatif1

apps/docs/content/docs/en/integrations/okta.mdx

@@ -40,7 +40,7 @@ Integrate Okta identity management into your workflow. Manage users, groups, and
 
 ### List Users from Okta
 
-List all users in your Okta organization with optional search and filtering
+List users in your Okta organization with optional search and filtering. Users with a DEPROVISIONED status are omitted unless a search or filter expression selects them.
 
 #### Input
 
@@ -308,7 +308,7 @@ Permanently delete a user from your Okta organization. Can only be performed on
 | Parameter | Type | Description |
 | --------- | ---- | ----------- |
 | `userId` | string | Deleted user ID |
-| `deleted` | boolean | Whether the user was deleted |
+| `deleted` | boolean | Whether the delete request was accepted. An ACTIVE user is deactivated by the first call and needs a second call to actually be deleted. |
 | `success` | boolean | Operation success status |
 
 ### List Groups from Okta
@@ -396,7 +396,7 @@ Create a new group in your Okta organization
 
 ### Update Group in Okta
 
-Update a group profile in your Okta organization. Only groups of OKTA_GROUP type can be updated. All profile properties must be specified (full replacement).
+Update a group profile in your Okta organization. Only groups of OKTA_GROUP type can be updated. Fields left blank keep their stored value.
 
 #### Input
 
@@ -552,7 +552,7 @@ List the group rules in your Okta organization. Each rule assigns users to group
 |   ↳ `expressionType` | string | Expression language, typically urn:okta:expression:1.0 |
 |   ↳ `assignUserToGroupIds` | array | Groups that matching users are assigned to |
 |   ↳ `excludedUserIds` | array | Users excluded from the rule |
-|   ↳ `excludedGroupIds` | array | Groups excluded from the rule |
+|   ↳ `excludedGroupIds` | array | Groups excluded from the rule. Always empty — Okta does not currently support group exclusions. |
 | `count` | number | Number of rules returned |
 | `nextCursor` | string | Cursor for the next page, or null on the last page |
 | `hasMore` | boolean | Whether more rules are available |
@@ -584,7 +584,7 @@ Retrieve a single Okta group rule by ID, including the expression that decides w
 | `expressionType` | string | Expression language, typically urn:okta:expression:1.0 |
 | `assignUserToGroupIds` | array | Groups that matching users are assigned to |
 | `excludedUserIds` | array | Users excluded from the rule |
-| `excludedGroupIds` | array | Groups excluded from the rule |
+| `excludedGroupIds` | array | Groups excluded from the rule. Always empty — Okta does not currently support group exclusions. |
 | `success` | boolean | Operation success status |
 
 ### Create Group Rule in Okta
@@ -616,7 +616,7 @@ Create a group rule that automatically assigns users matching an Okta expression
 | `expressionType` | string | Expression language, typically urn:okta:expression:1.0 |
 | `assignUserToGroupIds` | array | Groups that matching users are assigned to |
 | `excludedUserIds` | array | Users excluded from the rule |
-| `excludedGroupIds` | array | Groups excluded from the rule |
+| `excludedGroupIds` | array | Groups excluded from the rule. Always empty — Okta does not currently support group exclusions. |
 | `success` | boolean | Operation success status |
 
 ### Activate Group Rule in Okta
@@ -677,7 +677,7 @@ Permanently delete a group rule. Destructive and irreversible. Optionally also r
 | Parameter | Type | Description |
 | --------- | ---- | ----------- |
 | `groupRuleId` | string | Deleted group rule ID |
-| `deleted` | boolean | Whether the rule was deleted |
+| `deleted` | boolean | Whether the deletion was accepted. Okta answers 202 and removes the rule asynchronously. |
 | `success` | boolean | Operation success status |
 
 ### List Factors from Okta

apps/sim/blocks/blocks/okta.ts

@@ -17,6 +17,11 @@ function toFiniteNumber(value: unknown): number | undefined {
   return Number.isFinite(parsed) ? parsed : undefined
 }
 
+/** Operations where Okta sends the notification email unless told otherwise. */
+const SEND_EMAIL_DEFAULT_ON_OPERATIONS = ['okta_activate_user', 'okta_reset_password']
+
+const SEND_EMAIL_DEFAULT_ON = new Set(SEND_EMAIL_DEFAULT_ON_OPERATIONS)
+
 /** Treats a blank subBlock value as absent. */
 function blankToUndefined(value: unknown): unknown {
   return value === null || value === '' ? undefined : value
@@ -157,7 +162,7 @@ export const OktaBlock: BlockConfig<OktaResponse> = {
         ],
         okta_list_group_rules: [
           'List group rules',
-          { text: ', matching', field: 'search' },
+          { text: ', matching', field: 'ruleSearch' },
           { text: ', up to', field: 'limit' },
         ],
         okta_get_group_rule: [{ text: 'Read group rule', field: 'groupRuleId', core: true }],
@@ -252,7 +257,7 @@ export const OktaBlock: BlockConfig<OktaResponse> = {
       placeholder: 'profile.firstName eq "John"',
       condition: {
         field: 'operation',
-        value: ['okta_list_users', 'okta_list_groups', 'okta_list_group_rules'],
+        value: ['okta_list_users', 'okta_list_groups'],
       },
       wandConfig: {
         enabled: true,
@@ -288,6 +293,19 @@ export const OktaBlock: BlockConfig<OktaResponse> = {
         value: ['okta_get_logs', 'okta_list_apps', 'okta_list_app_users', 'okta_list_app_groups'],
       },
     },
+    {
+      /**
+       * Group rules take a plain keyword on `search`, not the SCIM-style
+       * expression the Search field's wand generates, so they get their own
+       * field rather than sharing one that would produce a silently
+       * non-matching query.
+       */
+      id: 'ruleSearch',
+      title: 'Search',
+      type: 'short-input',
+      placeholder: 'Keyword to search rules for',
+      condition: { field: 'operation', value: 'okta_list_group_rules' },
+    },
     // User ID (shared across user operations that need it)
     {
       id: 'userId',
@@ -469,20 +487,30 @@ export const OktaBlock: BlockConfig<OktaResponse> = {
       placeholder: 'Description for the group',
       condition: { field: 'operation', value: ['okta_create_group', 'okta_update_group'] },
     },
-    // Send email option (activate, reset password, delete)
+    /**
+     * Okta's `sendEmail` default is not uniform: activation and password reset
+     * default to sending, deactivation and removal default to not sending. One
+     * shared switch could only be seeded for one of those, so the two groups get
+     * their own field and the params mapper picks by operation.
+     */
     {
       id: 'sendEmail',
       title: 'Send Email',
       type: 'switch',
+      value: () => 'true',
       condition: {
         field: 'operation',
-        value: [
-          'okta_activate_user',
-          'okta_deactivate_user',
-          'okta_reset_password',
-          'okta_delete_user',
-          'okta_remove_user_from_app',
-        ],
+        value: SEND_EMAIL_DEFAULT_ON_OPERATIONS,
+      },
+      mode: 'advanced',
+    },
+    {
+      id: 'sendDeactivationEmail',
+      title: 'Send Email',
+      type: 'switch',
+      condition: {
+        field: 'operation',
+        value: ['okta_deactivate_user', 'okta_delete_user', 'okta_remove_user_from_app'],
       },
       mode: 'advanced',
     },
@@ -658,6 +686,11 @@ export const OktaBlock: BlockConfig<OktaResponse> = {
       id: 'forgetDevices',
       title: 'Forget Devices',
       type: 'switch',
+      /**
+       * Okta defaults this to true, so an unseeded switch would render off while
+       * remembered factors were in fact being cleared.
+       */
+      value: () => 'true',
       condition: { field: 'operation', value: 'okta_clear_user_sessions' },
       mode: 'advanced',
     },
@@ -945,9 +978,23 @@ export const OktaBlock: BlockConfig<OktaResponse> = {
           domain: params.domain,
           limit: toFiniteNumber(params.limit),
           priority: toFiniteNumber(params.priority),
-          // Group-specific UI fields carry the tool's generic param names.
+          /** Group-specific UI fields carry the tool's generic param names. */
           name: blankToUndefined(params.groupName),
           description: blankToUndefined(params.groupDescription),
+          /** Group rules get their own keyword field but the same wire param. */
+          search:
+            params.operation === 'okta_list_group_rules'
+              ? blankToUndefined(params.ruleSearch)
+              : blankToUndefined(params.search),
+          /**
+           * Keyed off the operation rather than `??`: both switches are advanced,
+           * and `shouldSerializeSubBlock` skips `condition` for advanced fields,
+           * so a stale value from a previously selected operation can still be
+           * present here.
+           */
+          sendEmail: SEND_EMAIL_DEFAULT_ON.has(String(params.operation))
+            ? blankToUndefined(params.sendEmail)
+            : blankToUndefined(params.sendDeactivationEmail),
         }
 
         const mappedKeys = new Set([
@@ -958,6 +1005,10 @@ export const OktaBlock: BlockConfig<OktaResponse> = {
           'priority',
           'groupName',
           'groupDescription',
+          'search',
+          'ruleSearch',
+          'sendEmail',
+          'sendDeactivationEmail',
         ])
         for (const [key, value] of Object.entries(params)) {
           if (!mappedKeys.has(key)) result[key] = blankToUndefined(value)
@@ -975,6 +1026,7 @@ export const OktaBlock: BlockConfig<OktaResponse> = {
     userId: { type: 'string', description: 'User ID or login' },
     groupId: { type: 'string', description: 'Group ID' },
     search: { type: 'string', description: 'Search expression' },
+    ruleSearch: { type: 'string', description: 'Keyword to search group rules for' },
     filter: { type: 'string', description: 'Filter expression' },
     limit: { type: 'number', description: 'Max results to return' },
     firstName: { type: 'string', description: 'First name' },
@@ -989,6 +1041,10 @@ export const OktaBlock: BlockConfig<OktaResponse> = {
     groupName: { type: 'string', description: 'Group name' },
     groupDescription: { type: 'string', description: 'Group description' },
     sendEmail: { type: 'boolean', description: 'Whether to send email notification' },
+    sendDeactivationEmail: {
+      type: 'boolean',
+      description: 'Whether to send the deactivation or removal email notification',
+    },
     q: { type: 'string', description: 'Keyword search query' },
     after: { type: 'string', description: 'Cursor for the next page of results' },
     since: { type: 'string', description: 'Start of the System Log time window' },
@@ -1137,7 +1193,11 @@ export const OktaBlock: BlockConfig<OktaResponse> = {
     accessibility: { type: 'json', description: 'Application accessibility settings' },
     assignUserToGroupIds: { type: 'json', description: 'Groups a rule assigns matching users to' },
     excludedUserIds: { type: 'json', description: 'Users excluded from a group rule' },
-    excludedGroupIds: { type: 'json', description: 'Groups excluded from a group rule' },
+    excludedGroupIds: {
+      type: 'json',
+      description:
+        'Groups excluded from a group rule. Always empty — Okta does not currently support group exclusions.',
+    },
     amr: { type: 'json', description: 'Authentication methods used to establish a session' },
     features: { type: 'json', description: 'Provisioning features enabled on an application' },
     label: { type: 'string', description: 'Application or role label' },

apps/sim/lib/integrations/integrations.json

@@ -1,5 +1,5 @@
 {
-  "updatedAt": "2026-08-15",
+  "updatedAt": "2026-08-16",
   "integrations": [
     {
       "type": "onepassword",
@@ -13731,7 +13731,7 @@
       "operations": [
         {
           "name": "List Users",
-          "description": "List all users in your Okta organization with optional search and filtering"
+          "description": "List users in your Okta organization with optional search and filtering. Users with a DEPROVISIONED status are omitted unless a search or filter expression selects them."
         },
         {
           "name": "Get User",
@@ -13783,7 +13783,7 @@
         },
         {
           "name": "Update Group",
-          "description": "Update a group profile in your Okta organization. Only groups of OKTA_GROUP type can be updated. All profile properties must be specified (full replacement)."
+          "description": "Update a group profile in your Okta organization. Only groups of OKTA_GROUP type can be updated. Fields left blank keep their stored value."
         },
         {
           "name": "Delete Group",

apps/sim/tools/generated/tool-metadata.ts

@@ -150,7 +150,8 @@ export const oktaCreateGroupRuleTool: ToolConfig<
     },
     excludedGroupIds: {
       type: 'array',
-      description: 'Groups excluded from the rule',
+      description:
+        'Groups excluded from the rule. Always empty — Okta does not currently support group exclusions.',
       items: { type: 'string', description: 'Group ID' },
     },
     success: { type: 'boolean', description: 'Operation success status' },

apps/sim/tools/generated/tool-outputs.ts

@@ -71,7 +71,11 @@ export const oktaDeleteGroupRuleTool: ToolConfig<
 
   outputs: {
     groupRuleId: { type: 'string', description: 'Deleted group rule ID' },
-    deleted: { type: 'boolean', description: 'Whether the rule was deleted' },
+    deleted: {
+      type: 'boolean',
+      description:
+        'Whether the deletion was accepted. Okta answers 202 and removes the rule asynchronously.',
+    },
     success: { type: 'boolean', description: 'Operation success status' },
   },
 }

apps/sim/tools/okta/create_group_rule.ts

@@ -67,7 +67,11 @@ export const oktaDeleteUserTool: ToolConfig<OktaDeleteUserParams, OktaDeleteUser
 
   outputs: {
     userId: { type: 'string', description: 'Deleted user ID' },
-    deleted: { type: 'boolean', description: 'Whether the user was deleted' },
+    deleted: {
+      type: 'boolean',
+      description:
+        'Whether the delete request was accepted. An ACTIVE user is deactivated by the first call and needs a second call to actually be deleted.',
+    },
     success: { type: 'boolean', description: 'Operation success status' },
   },
 }

apps/sim/tools/okta/delete_group_rule.ts

@@ -92,7 +92,8 @@ export const oktaGetGroupRuleTool: ToolConfig<OktaGetGroupRuleParams, OktaGetGro
     },
     excludedGroupIds: {
       type: 'array',
-      description: 'Groups excluded from the rule',
+      description:
+        'Groups excluded from the rule. Always empty — Okta does not currently support group exclusions.',
       items: { type: 'string', description: 'Group ID' },
     },
     success: { type: 'boolean', description: 'Operation success status' },

apps/sim/tools/okta/delete_user.ts

@@ -84,7 +84,10 @@ export const oktaGetLogsTool: ToolConfig<OktaGetLogsParams, OktaGetLogsResponse>
       if (params.q) queryParams.append('q', params.q)
       if (params.sortOrder) queryParams.append('sortOrder', params.sortOrder)
       if (params.after) queryParams.append('after', params.after)
-      if (params.limit) queryParams.append('limit', params.limit.toString())
+      /** `0` is a documented limit on this endpoint, so it must not read as absent. */
+      if (params.limit !== undefined && params.limit !== null) {
+        queryParams.append('limit', params.limit.toString())
+      }
 
       const queryString = queryParams.toString()
       return queryString