User Grants

The User Grants API provides operations to manage user consent grants in your org.

A consent represents a user's explicit permission to allow an app to access resources protected by scopes. Consent grants are different from tokens because a consent can outlast a token. Also, there can be multiple tokens with varying sets of scopes derived from a single consent. When an app comes back and needs to get a new access token, it may not need to prompt the user for consent. This happens if they've already consented to the specified scopes. Consent grants remain valid until the user manually revokes them, or until the user, app, authorization server, or scope is deactivated or deleted.

Hint: For all grant operations, you can use me instead of the userId in an endpoint that contains /users, in an active session with no SSWS token (API token). For example: https://${yourOktaDomain}/api/v1/users/me/grants returns all the grants for the active session user.

Note: Some browsers have begun blocking third-party cookies by default, disrupting Okta functionality in certain flows. For more information, see FAQ: How Blocking Third Party Cookies Can Potentially Impact Your Okta Environment.