SSF Receiver

This is a feature of Identity Threat Protection. It's also offered with limited support to orgs with Adaptive MFA enabled, where you must be directly assigned the super admin role to perform tasks.

Okta uses the Shared Signals Framework (SSF) to receive security-related events and other data-subject signals from third-party security vendors. In this scenario, commonly used terms for third-party vendors that send signals are "transmitters", Okta is the "receiver", and the connection between the two entities is referred to as a "stream."

The SSF Receiver API allows you to manage SSF vendor stream configurations between the transmitter and Okta. A stream is configured by creating a Security Events Provider object in your Okta org. You can create a Security Events Provider object in Okta with a published well-known URL or an issuer-and-JWKS combination.

After the Security Events Provider object is created for a transmitter, the provider can use the SSF Security Event Tokens API to publish events to Okta. While the SSF allows ingestion through push and poll-based operations, Okta currently supports only push-based operations.