Okta Admin Management API

User Factors

The Factors API provides operations to enroll, manage, and verify factors for multifactor authentication (MFA). Generally, authentication involves verifying a different one-time passcode (OTP). Manage both administration and end-user accounts, or verify an individual factor at any time. Okta supports several different types of factors:

Factor Type	Description
`call`	Software OTP sent using a voice call to a registered phone number
`sms`	Software OTP sent using SMS to a registered phone number
`email`	Software OTP sent using email
`question`	Additional knowledge-based security question
`push`	Out-of-band verification using a push notification to a device and transaction verification with digital signature
`token`	Software or hardware OTP sent to a device
`token:hardware`	Hardware OTP sent to a device
`token:hotp`	Custom TOTP factor that uses an extension of the HMAC (Hash-Based Message Authentication Codes)-based one-time passcode (HOTP) algorithm
`token:software:totp`	Software time-based one-time passcode (TOTP)
`u2f`	Hardware Universal 2nd Factor (U2F) device
`web`	HTML inline frame (iframe) for embedding verification from a third party
`webauthn`	Hardware WebAuthn device
`signed_nonce`	Okta Fastpass (device-bound authentication). This is available for OIE orgs if the org has users that have enrolled with Okta Verify after the org started using OIE. The `signed_nonce` factor type can only be retrieved using GET operations or deleted using the DELETE operation. It cannot be enrolled, activated, or verified through other HTTP methods with the Factors API.

Note: As of the 2026.04.0 release, the FIDO2 (WebAuthn) authenticator is now called Passkey (FIDO2 WebAuthn), and there are new settings and updates to the authenticator page layout. There have been no changes to any existing parameter names, values, or endpoint paths. For example, the factorType for the Passkey (FIDO2 WebAuthn) authenticator is still webauthn.
See Passkeys and WebAuthn.

Languages

Servers

https://{yourOktaDomain}