# Using Okta API filtering and searching capabilities

If you are using Mindflow to orchestrate your identity management and security operations, the Okta connector is likely one of your most utilized tools. Finding the exact user, group, or system log you need—without pulling massive amounts of unnecessary data—is critical for efficient playbooks.

This guide walks you through how to properly leverage the Okta API’s **Filter**, **Search**, and **Query (`q`)** parameters directly within your Mindflow canvas.

## 1. Understanding the Differences: `filter` vs. `search` vs. `q`

Before configuring your Okta action node in Mindflow, it is important to understand which Okta parameter fits your use case. Okta processes these three parameters differently:

| **Parameter**   | **Best Used For**                                  | **Characteristics**                                                                                                                                                                                       |
| --------------- | -------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **`q` (Query)** | Simple, quick lookups (like an auto-complete box). | Searches across basic profile properties (First Name, Last Name, Email). It is fast but does not support complex logic or pagination. Note: It omits users with a `DEPROVISIONED` status.                 |
| **`filter`**    | Exact matches on specific, supported properties.   | Very fast as it queries the user store directly. Uses standard Okta expression language (e.g., `status eq "ACTIVE"`). It is somewhat rigid and only supports a subset of properties.                      |
| **`search`**    | Advanced, multi-criteria queries.                  | Uses a searching engine under the hood. Supports SCIM filter syntax, logical operators (`and`, `or`, `not`), array searches, and pagination. Highly flexible but can be slightly delayed due to indexing. |

## 2. Step-by-Step: Configuring Okta Queries in Mindflow

To execute a targeted Okta query within a Mindflow playbook, follow these steps:

1. **Add the Okta Node:** Drag and drop the Okta integration from the orchestration toolbox onto your Mindflow canvas.
2. **Select the Action:** Choose the appropriate action for your workflow, such as **List Users**, **List Groups**, or **List System Logs**.
3. **Locate Query Parameters:** In the node configuration panel, look for the input fields labeled `filter`, `search`, or `q`.
4. **Enter your Expression:** Type in your query using the correct Okta syntax (see examples below).
5. **Set Limits:** If you expect a large payload, utilize the `limit` parameter to restrict the number of results per page (Okta recommends a limit of 200 for searches).

:::note
**Important Note on Encoding:** The Okta API requires URL-encoded strings for complex searches and filters. Depending on how your Mindflow variables are parsed, you may need to ensure your spaces and quotation marks are URL-encoded (e.g., `search=status eq "STAGED"` becomes `status%20eq%20%22STAGED%22`).
:::

## 3. Practical Syntax Examples for Mindflow

Here are common queries you can copy and adapt for your Mindflow input fields.

## A. User Queries (List Users)

- **Find a user by email (using `filter`):**

  `profile.login eq "employee@yourdomain.com"`

- **Find users in a specific department (using `search`):**

  `profile.department eq "Engineering"`

- **Find active users created before a specific date (using `search`):**

  `status eq "ACTIVE" and created lt "2025-01-01T00:00:00.000Z"`

## B. Group Queries (List Groups)

- **Find an App Group by name (using `search`):**

  `type eq "APP_GROUP" and profile.name eq "Salesforce Users"`

- **Search groups using a "starts with" operator:**

  `profile.name sw "West Coast"`

## C. System Log Queries (Get Logs)

Mindflow is heavily used for SecOps. Querying Okta logs is vital for investigating suspicious IPs or logins.

- **Filter by a specific Event Type:**

  `eventType eq "user.authentication.sso"`

- **Search for events triggered by a specific IP:**

  `client.ipAddress eq "192.168.1.50"`

## 4. Best Practices & Troubleshooting

- **Avoid Overly Complex Searches:** If a `search` query is too long or complex, the Okta API will return an error and fail your Mindflow node. Break complex logic into smaller queries or handle the filtering downstream using Mindflow's native data-manipulation tools.
- **Dates and Times:** Okta strictly requires the ISO 8601 format for dates (e.g., `YYYY-MM-DDTHH:mm:ss.SSSZ`).
- **Empty Arrays:** If you are searching array properties, remember that Okta returns the entire object if _any_ element in the array matches your search term.