The Assay connector for Okta Workflows

Before you start

You need:

• An Assay workspace on version 5.50 or later. The connector works on the plans that save reports: Pay as you go, Workspace and Enterprise. Start free with Pay as you go.
• The Owner role in that workspace, to create a connector key.
• Access to Okta Workflows in your Okta org.

Create a connector key

1. Sign in to your Assay workspace and open Reports.
2. Under Okta Workflows connector, give the key a label, for example “Okta Workflows — production”. Tick Can assess if your flows will send exports to be assessed (the Assess Folder and Assess Flow cards); leave it off for a key that only reads. Press Create a key.
3. Copy the key. It starts with ack_ and is shown only once. Assay keeps a hash of it, not the key.

A connector key reads reports, and, if it was made with Can assess, sends exports to this workspace to be assessed. It is not a sign-in and not an Assay Lens key. An owner can see each key’s label, whether it can assess, and when it was last used, and revoke it from the same place. Revoking stops it at once.

Create a connection

1. In Okta Workflows, open a flow, choose Add app action, and pick Assay.
2. Choose New Connection and fill in:

   Field	What to enter
   Workspace address	Your workspace’s address without https://, for example acme.app.theassayco.com. It is shown on the Reports page next to the keys.
   API key	The connector key you copied (ack_…).

3. Press Create. Workflows checks the connection by calling GET /api/connector/v1/ping. A wrong address or key fails here, with the reason.

A weekly grade in four cards

One scheduled flow, and from then on your estate is graded every week with nobody exporting or uploading anything by hand:

1. 1Scheduled Flow (event): every Monday at 07:00.
2. 2Okta — Export Folder: your production folder, as a file. (Okta’s export leaves out connection details and table data.)
3. 3Assay — Assess Folder: File ← the File Content from step 2. Assay assesses the file, saves it as a report in your workspace, and returns the grade, the counts and the report link.
4. 4Slack — Send Message (or email, or a ticket): “Production Workflows: grade B, 2 High findings. Open the report.”

Add Assay — List Findings after step 3, with Severity High, to open a ticket for each High finding. Export, assess, act.

Assess Folder

Assess an exported Okta Workflows folder with Assay. The file is the File Content output of Okta’s Export Folder card. Assay assesses it exactly as an upload in the workspace, saves it as a report (shown as “Run by: connector key”), and returns the result.

Inputs

• File (File, required): the File Content from Export Folder (or Export Flow).
• Title (Text, optional): the report’s name in Assay. Left empty, the report is named after the folder.

Options

None. Needs a connection whose key was made with Can assess.

Outputs

The same fields as Get Latest Report below, for the report just made, plus Scope (“whole export” or “one workflow”) and Plan (the workspace’s plan).

Plans

Workspace and Enterprise assess whole folders. Pay as you go assesses one workflow at a time, so use Assess Flow there; a folder with several workflows is refused with a sentence saying so.

Limits

One file per call, up to 25 MB; 10 assessments an hour per key. Okta’s own Export Folder card counts against your org’s export limit, which resets every 15 minutes, so a weekly or daily run is fine.

API POST /api/connector/v1/assess (multipart: file, optional title)

Assess Flow

Assess one exported Okta Workflows flow with Assay. The same as Assess Folder, with the file from Okta’s Export Flow card. On Pay as you go this is the free assessment of one workflow, from inside Okta Workflows.

Inputs, options, outputs and limits: as Assess Folder.

Get Latest Report

Get the newest saved Assay assessment of your Okta Workflows estate, with its grade and finding counts.

Inputs: none. Options: none.

API GET /api/connector/v1/reports/latest

List Reports

List the saved Assay assessments in your workspace, newest first, a page at a time.

Inputs (both optional)

• Limit (Number): reports to return, 1 to 200. Empty means 20.
• After (Text): empty for the first page; for the next page, the Next output of the previous run.

Options: none.

Outputs: Reports, a list in which each report has Report ID, Title, Grade, Score, Workflows, Open Findings, High or Critical, Accepted Findings, Assessed At, Saved At and Report URL, as in Get Latest Report; Count (in this page), Total (in the workspace) and Next (empty on the last page). Loop over Reports with List — For Each.

API GET /api/connector/v1/reports?limit=1–200&after= — next is the after value for the next page, or empty on the last page.

List Findings

List the open findings in an Assay report, most severe first.

Inputs

• Report ID (Text, optional). Leave it empty for the newest report.
• Limit (Number, optional): findings to return, 1 to 200. Empty means 50.
• After (Text, optional): empty for the first page; for the next page, the Next output of the previous run.

Options: Severity: All, Critical, High, Medium or Low.

Outputs: Findings, a list in which each finding has the fields below; Report ID (the report read), Count, Total and Next.

API GET /api/connector/v1/findings?report_id=&severity=&limit=1–200&after=

Custom API Action

Make an authenticated request to the Assay connector API.

Inputs

• Request Type (required): GET. (Assessing is done by the Assess cards, not by this one.)
• Relative URL (required): for example /api/connector/v1/reports/latest.
• Query (optional).
• Headers (optional).

The connection adds the key; you don’t.

Outputs: Status Code, Headers, Body.

Errors and limits

An error is one sentence that says what to do, so a flow can show it as it is. The API returns it as JSON {"error": "…", "status": 400}.

What the connector reads and sends

• It reads what a person with the Viewer role sees on a report: grades, scores, counts, and the names of controls, findings, workflows and cards. The read cards never return an export, a flow’s definition, a value from a card, or anyone’s name.
• It sends an export only through Assess Folder and Assess Flow, only with a key made with Can assess, and only to your own workspace, where it is assessed and stored exactly as an upload is. Okta’s export leaves out connection details and table data; values typed into cards may be in it, as in any export, and Assay’s SEC-002 control flags credential-like values.
• Assessing is Assay’s rules engine in your workspace. Nothing is sent to a language model or to Assay Studio.
• It cannot change anything in Okta. In Assay, a key that can assess creates reports; it cannot read exports back out, delete anything, or build anything.
• Its data stays in your workspace. Okta Workflows calls your workspace directly. The workspace records when each key was last used, and which key made each report. See the privacy policy.
• Plans: Pay as you go, Workspace and Enterprise. On other plans every call answers 403 with a sentence saying so.

Without the connector

Until the connector is in your Okta Workflows catalog, the read calls work from the HTTP — Raw Request card:

Keep the key out of the flow itself. Store it in a Workflows table that only admins can read, or in the HTTP card’s connection.

Support

For the connector, the API or a key, email support@theassayco.com with your workspace address. Include what the card returned, but never the key.

Okta and Okta Workflows are trademarks of Okta, Inc. Assay is not affiliated with, endorsed by, or a reseller of Okta.