# NERM workflow| http Action to Okta using OAuth2 w/private key jwt

**URL:** <https://developer.sailpoint.com/discuss/t/nerm-workflow-http-action-to-okta-using-oauth2-w-private-key-jwt/194131>\
**Category:** SHF Discussion and Questions\
**Tags:** nerm, sailpoint-identity-security\
**Created:** [January 26, 2026, 4:16pm UTC](https://developer.sailpoint.com/discuss/t/nerm-workflow-http-action-to-okta-using-oauth2-w-private-key-jwt/194131 "2026-01-26T16:16:36Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![vbdm](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/vbdm/32/26869_2.png) [@vbdm](https://developer.sailpoint.com/discuss/u/vbdm)\
**Post date:** [January 26, 2026, 4:16pm UTC](https://developer.sailpoint.com/discuss/t/nerm-workflow-http-action-to-okta-using-oauth2-w-private-key-jwt/194131/1 "2026-01-26T16:16:36Z")

</div>

Hi Team,

I am not able to connect to Okta and get a user details from the REST API action as part of a NERM workflow.

Authentication method : OAuth2 w/private key jwt

here is the error:

```auto
21/01/2026 - 16:15:28.06 UTC - :user | Neprofile dashboard - Request Form Action - submitted by Veera Bhamidipati ID (xxxxxxx) - with the following values: {“attribute_name”=>“xxxxxxx”}

21/01/2026 - 16:15:28.18 UTC - :system - Step Manager - Assigned next action RestApiAction ID: xxxxxx

21/01/2026 - 16:15:28.39 UTC - :system - Error - Session could not continue due to exception: REST API Action failure: consent_required: You are not allowed any of the requested scopes. {“error”:“consent_required”,“error_description”:“You are not allowed any of the requested scopes.”}

21/01/2026 - 16:15:28.51 UTC - :system - DashboardRouter - session failed to save, redirecting.

```

Further, we have already used a similar OAuth2 with jwt token way of authenticating to Okta via IDN tenant.

Observing the Okta logs for each of these calls - IDN to Okta vs NERM to Okta

In the IDN call to Okta we can see the requested and granted scopes:

 ![image](https://global.discourse-cdn.com/sailpoint/original/3X/9/9/992fc9c3c11c65fe9c2ad85a0f8e089e62b13c55.png)

where as in the NERM to Okta call we do not see any requested or granted scopes which I think is the issue.

 ![image](https://global.discourse-cdn.com/sailpoint/original/3X/5/2/52dc0bb0a4a6d61013977763aa7ad2804caf2638.png)

I have ensured that private key is working and in the right format(passed beyond this error)

Further,

In the IDN UI, for an Okta direct connector, we see an option to enter the scopes

 ![image](https://global.discourse-cdn.com/sailpoint/original/3X/b/9/b9e2d10756e81091ae09743490ba86834002a65f.png)

where as In the NERM UI of the API call, I dont see an option to include scopes

 ![image](https://global.discourse-cdn.com/sailpoint/original/3X/d/3/d348fabb6927b74b2e42de6de6dbf94abaf7d35b.png)

Any inputs on how to get this to work from NERM to Okta?

Thanks in advance

Veera Bhamidipati

---

<div class="post-metadata">

**Author:** ![David\_Norris](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@David\_Norris](https://developer.sailpoint.com/discuss/u/David_Norris)\
**Post date:** [January 26, 2026, 5:03pm UTC](https://developer.sailpoint.com/discuss/t/nerm-workflow-http-action-to-okta-using-oauth2-w-private-key-jwt/194131/2 "2026-01-26T17:03:43Z")

</div>

You should be able to specify your required scopes as URL param (scope=…):

> **[Implement OAuth for Okta with a service app | Okta Developer](https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/main/)**
>
> Secure, scalable, and highly available authentication and user management for any app.

 ![image](https://global.discourse-cdn.com/sailpoint/original/3X/6/5/659d212e100c8a4fa2b2799e1d8aef1dbb7269e2.png)

---

<div class="post-metadata">

**Author:** ![vbdm](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/vbdm/32/26869_2.png) [@vbdm](https://developer.sailpoint.com/discuss/u/vbdm)\
**Post date:** [January 26, 2026, 7:22pm UTC](https://developer.sailpoint.com/discuss/t/nerm-workflow-http-action-to-okta-using-oauth2-w-private-key-jwt/194131/3 "2026-01-26T19:22:22Z")

</div>

That actually worked, thank you @David_Norris

Further,

the token url should include the scope however, the aud(the url where jwt authenticats) should not have the scope

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [March 27, 2026, 7:23pm UTC](https://developer.sailpoint.com/discuss/t/nerm-workflow-http-action-to-okta-using-oauth2-w-private-key-jwt/194131/4 "2026-03-27T19:23:17Z")

</div>

Closed on March 27, 2026, 7:23pm UTC

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.