Check out my API script for auditing inactive integrations.

Hey everyone,

I've been neck-deep in Okta's API for a client audit project and kept hitting the same wall: while the admin console is great for a high-level view, getting a clear, actionable list of truly inactive integrations (OAuth 2.0 clients, SWA apps, etc.) felt needlessly manual. The "Last used" metadata is there, but sifting through hundreds of apps to find the ones dormant for, say, over a year was a chore.

So, I built a script to automate it. The goal was to pull a report of all integrations, filter by last authentication activity, and flag the ones that are likely safe to deprovision. It’s a simple Node.js script using the Okta SDK, but the logic for handling different app types and the date filtering might be useful for others.

Here’s the core of it. You'll need an Okta API token with `okta.apps.read` scope.

```javascript
const okta = require('@okta/okta-sdk-nodejs');

const client = new okta.Client({
orgUrl: 'https://your-subdomain.okta.com',
token: 'YOUR_API_TOKEN'
});

async function auditInactiveIntegrations(inactiveDays = 365) {
const cutoffDate = new Date();
cutoffDate.setDate(cutoffDate.getDate() - inactiveDays);

let inactiveApps = [];

for await (let app of client.listApplications()) {
try {
// Focus on relevant types
if (app.signOnMode === 'OPENID_CONNECT' || app.signOnMode === 'BROWSER_PLUGIN') {
const lastUsedStr = app.lastUsedAt;

if (!lastUsedStr) {
// Never used
inactiveApps.push({ name: app.label, id: app.id, lastUsed: 'Never', status: app.status });
} else {
const lastUsed = new Date(lastUsedStr);
if (lastUsed {
console.log(`- ${app.name} (ID: ${app.id})`);
console.log(` Status: ${app.status}, Last Used: ${app.lastUsed}n`);
});

return inactiveApps;
}

// Run with a 180-day threshold
auditInactiveIntegrations(180);
```

A few things I learned and had to work around:

* The `lastUsedAt` field isn't populated for all app types, so the script filters for ones where it's most relevant.
* You need to be careful with the `BROWSER_PLUGIN` (SWA) type, as some might be for internal infrastructure.
* This doesn't automatically deprovision anything—it just gives you a list to review. Always double-check for any dependencies before taking action.
* For a more thorough audit, you could extend the script to also check for unused API tokens or orphaned user assignments.

I've found running this quarterly helps keep the integration sprawl in check and reduces surface area. It's also useful for compliance evidence.

Has anyone else built similar tooling? I'm particularly curious if there's a better way to gauge "activity" for service-to-service OAuth clients that might not have a traditional user login.

api first