unstale

pypi / okta

okta

What changed in okta 2 to 3, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-24.

2 breaking1 security28 new APIs and options3 behavior and defaults2 tooling10 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.2.6 on npm

okta 323 changes

Breaking changes 1

  • The methods enum casing now aligns with the actual API.

    3.4.4release notes

Security 1

New APIs and options 6

  • Adds the UserFactorSignedNonce schema and discriminator mapping for Okta FastPass.

    3.4.4release notes

  • Custom Domain Operations gained support for CAA DNS record types.

    3.4.0release notes

  • A DPoP module was implemented.

    3.4.0release notes

  • Adds FAILED_TO_VERIFY as an enum option for DomainValidationStatus.

    3.3.0release notes

  • Adds the LogUserBehavior model for System Log userBehaviors support.

    3.2.0release notes

  • Adds comprehensive System Log userBehaviors support.

    3.2.0release notes

Behavior and default changes 3

  • The OpenAPI spec no longer applies minLength validation to the secondEmail attribute.

    3.4.0release notes

  • Adds handling for apps with the MFA_AS_SERVICE sign-on mode.

    3.2.0release notes

  • The SDK adds support for the okta-gov.com, okta.mil, okta-miltest.com, and trex-govcloud.com domains.

    3.0.0release notes

Tooling 2

  • The SDK was updated with the latest management YAML specifications, which may affect the available management API surface.

    3.1.0release notes

  • The SDK was upgraded to OAS 3.0, which may affect the SDK API developers use.

    3.0.0release notes

Fixes and other changes 10

  • Required boolean constraints were relaxed on SamlApplicationSettingsSignOn.

    3.4.6release notes

  • Resolved a name collision between UserType and the inline User.type schema.

    3.4.5release notes

  • The types enum casing now aligns with the actual API.

    3.4.4release notes

  • Required constraints were removed from the SamlApplicationSettingsSignOn schema, so those fields are no longer required.

    3.4.3release notes

  • Primitive fallback for oneOf deserialization in Device Assurance Models is fixed.

    3.4.1release notes

  • Multipart file upload handling in the HTTP client was fixed.

    3.4.0release notes

  • Unknown signOnMode values are now handled gracefully.

    3.3.0release notes

  • Corrects field deserialization for the EmailDomain model.

    3.3.0release notes

  • Handles nullable discriminator fields in JWKS models.

    3.3.0release notes

  • Fixes malformed requests for OAuth access tokens.

    3.2.0release notes

okta 223 changes

Breaking changes 1

  • The sign_on_mode attribute is now consistently typed as ApplicationSignOnMode for all applications, which may break custom client code that expects a string.

    2.0.0release notes

New APIs and options 22