Behavior Rules

The Behavior Rules API provides operations to manage the behavior detection rules for your organization.

List all behavior detection rules
OAuth 2.0: okta.behaviors.read

Lists all behavior detection rules with pagination support

Responses
200

OK

403

Forbidden

429

Too Many Requests

get/api/v1/behaviors
Request samples 
Response samples 
application/json
[
  • {
    • "created": "2019-08-24T14:15:22Z",
    • "id": "string",
    • "lastUpdated": "2019-08-24T14:15:22Z",
    • "name": "string",
    • "status": "ACTIVE",
    • "type": "ANOMALOUS_DEVICE",
    • "_link": {
      }
    }
]
Create a behavior detection rule
OAuth 2.0: okta.behaviors.manage
Creates a new behavior detection rule


Request 
Request Body schema: application/json
required
name
required
string  <= 128 characters 
 
type
required
string (BehaviorRuleType) 
 
status
string (LifecycleStatus) 
 Enum: "ACTIVE" "INACTIVE"  
object (BehaviorRuleSettingsAnomalousLocation) 
 
granularity
required
string (LocationGranularity) 
 Enum: "CITY" "COUNTRY" "LAT_LONG" "SUBDIVISION"  
maxEventsUsedForEvaluation
integer  [ 1 .. 100 ] 
 Default:  20
 
minEventsNeededForEvaluation
integer  [ 0 .. 10 ] 
 Default:  0
 
radiusKilometers
integer
Required when granularity is LAT_LONG. Radius from the provided coordinates in kilometers.


 
Responses 
201
Created


400
Bad Request


403
Forbidden


429
Too Many Requests


post/api/v1/behaviors
Request samples 
application/json
{
  • "name": "My Behavior Rule",
  • "type": "VELOCITY"
}
Response samples 
application/json
{
  • "id": "abcd1234",
  • "name": "My Behavior Rule",
  • "type": "VELOCITY",
  • "settings": {
    • "velocityKph": 805
    },
  • "status": "ACTIVE",
  • "created": "2021-11-09T20:38:10.000Z",
  • "lastUpdated": "2021-11-11T20:38:10.000Z",
  • "_link": {}
}
Retrieve a behavior detection rule
OAuth 2.0: okta.behaviors.read
Retrieves a Behavior Detection Rule by behaviorId


Request 
path Parameters
behaviorId
required
string
id of the Behavior Detection Rule


 
 Example:  abcd1234
Responses 
200
OK


403
Forbidden


404
Not Found


429
Too Many Requests


get/api/v1/behaviors/{behaviorId}
Request samples 
Response samples 
application/json
{
  • "created": "2019-08-24T14:15:22Z",
  • "id": "string",
  • "lastUpdated": "2019-08-24T14:15:22Z",
  • "name": "string",
  • "status": "ACTIVE",
  • "type": "ANOMALOUS_LOCATION",
  • "_link": {
    • "self": {
      }
    },
  • "settings": {
    • "maxEventsUsedForEvaluation": 20,
    • "minEventsNeededForEvaluation": 0,
    • "granularity": "CITY",
    • "radiusKilometers": 0
    }
}
Replace a behavior detection rule
OAuth 2.0: okta.behaviors.manage
Replaces a Behavior Detection Rule by behaviorId


Request 
path Parameters
behaviorId
required
string
id of the Behavior Detection Rule


 
 Example:  abcd1234
Request Body schema: application/json
required
name
required
string  <= 128 characters 
 
type
required
string (BehaviorRuleType) 
 
status
string (LifecycleStatus) 
 Enum: "ACTIVE" "INACTIVE"  
object (BehaviorRuleSettingsAnomalousLocation) 
 
granularity
required
string (LocationGranularity) 
 Enum: "CITY" "COUNTRY" "LAT_LONG" "SUBDIVISION"  
maxEventsUsedForEvaluation
integer  [ 1 .. 100 ] 
 Default:  20
 
minEventsNeededForEvaluation
integer  [ 0 .. 10 ] 
 Default:  0
 
radiusKilometers
integer
Required when granularity is LAT_LONG. Radius from the provided coordinates in kilometers.


 
Responses 
200
Created


400
Bad Request


403
Forbidden


404
Not Found


429
Too Many Requests


put/api/v1/behaviors/{behaviorId}
Request samples 
application/json
{
  • "name": "My Behavior Rule",
  • "type": "VELOCITY"
}
Response samples 
application/json
{
  • "id": "abcd1234",
  • "name": "My Behavior Rule",
  • "type": "VELOCITY",
  • "settings": {
    • "velocityKph": 805
    },
  • "status": "ACTIVE",
  • "created": "2021-11-09T20:38:10.000Z",
  • "lastUpdated": "2021-11-11T20:38:10.000Z",
  • "_link": {}
}
Delete a behavior detection rule
OAuth 2.0: okta.behaviors.manage
Deletes a Behavior Detection Rule by behaviorId


Request 
path Parameters
behaviorId
required
string
id of the Behavior Detection Rule


 
 Example:  abcd1234
Responses 
204
No Content


403
Forbidden


404
Not Found


429
Too Many Requests


delete/api/v1/behaviors/{behaviorId}
Request samples 
Response samples 
application/json
{
  • "errorCode": "E0000006",
  • "errorSummary": "You do not have permission to perform the requested action",
  • "errorLink": "E0000006",
  • "errorId": "sampleNUSD_8fdkFd8fs8SDBK",
  • "errorCauses": [ ]
}
Activate a behavior detection rule
OAuth 2.0: okta.behaviors.manage
Activates a behavior detection rule


Request 
path Parameters
behaviorId
required
string
id of the Behavior Detection Rule


 
 Example:  abcd1234
Responses 
200
Success


403
Forbidden


404
Not Found


429
Too Many Requests


post/api/v1/behaviors/{behaviorId}/lifecycle/activate
Request samples 
Response samples 
application/json
{
  • "id": "abcd1234",
  • "name": "My Behavior Rule",
  • "type": "VELOCITY",
  • "settings": {
    • "velocityKph": 805
    },
  • "status": "ACTIVE",
  • "created": "2021-11-09T20:38:10.000Z",
  • "lastUpdated": "2021-11-11T20:38:10.000Z",
  • "_link": {}
}
Deactivate a behavior detection rule
OAuth 2.0: okta.behaviors.manage
Deactivates a behavior detection rule


Request 
path Parameters
behaviorId
required
string
id of the Behavior Detection Rule


 
 Example:  abcd1234
Responses 
200
Success


403
Forbidden


404
Not Found


429
Too Many Requests


post/api/v1/behaviors/{behaviorId}/lifecycle/deactivate
Request samples 
Response samples 
application/json
{
  • "id": "abcd1234",
  • "name": "My Behavior Rule",
  • "type": "VELOCITY",
  • "settings": {
    • "velocityKph": 805
    },
  • "status": "ACTIVE",
  • "created": "2021-11-09T20:38:10.000Z",
  • "lastUpdated": "2021-11-11T20:38:10.000Z",
  • "_link": {}
}