OKTA-1246319 - Document PATCH support for configuring an existing AI agent as a CIMD client - #6375
Open
brentschaus-okta wants to merge 4 commits into
Open
OKTA-1246319 - Document PATCH support for configuring an existing AI agent as a CIMD client#6375brentschaus-okta wants to merge 4 commits into
brentschaus-okta wants to merge 4 commits into
Conversation
brentschaus-okta
requested review from
barbaravo-okta,
emikhasyak-okta,
grahamsmith-okta,
ishan-krishna-okta,
janethu-okta,
paulwallace-okta and
susanharper-okta
as code owners
August 8, 2026 00:00
This comment was marked as outdated.
This comment was marked as outdated.
brentschaus-okta
marked this pull request as draft
August 10, 2026 20:25
…agent as a CIMD client
…MD PATCH section
thomascavanagh-okta
force-pushed
the
tbs-okta-1246319-cimd-patch-support
branch
from
September 11, 2026 16:43
e4e174b to
e9aab92
Compare
This comment was marked as outdated.
This comment was marked as outdated.
Acrolinx scoreA minimum Acrolinx Score of 80 is required. The total score is an average of the subscores.
Successfully checked 1 of 1 documents. Reopen the pull request or push new changes to check again. Depending on the Acrolinx server configuration, the |
thomascavanagh-okta
marked this pull request as ready for review
September 11, 2026 16:57
thomascavanagh-okta
added
the
docs release
| For AI agents, CIMD replaces bring-your-own-key (BYOK) registration. With BYOK, the AI agent operator (either your org's admin or the AI agent's vendor) registers a public key with Okta through the API, and rotating that key requires another Okta API call. With CIMD, the AI agent operator rotates keys on their own infrastructure. Okta picks up the change automatically the next time the AI agent requests a token. The AI agent operator doesn't need to make an Okta API call. | ||
|
|
||
| > **Note:** You set `oauthClient.type` when you create the AI agent, and you can't change it afterward. If you want an existing AI agent to use CIMD instead of BYOK, you need to delete the AI agent record in Okta and recreate it. | ||
| > **Note:** Once you set `oauthClient.type` to `CIMD` on an AI agent, you can't change it to a different type. However, you can configure an existing AI agent that doesn't yet use CIMD (for example, one that uses BYOK) as a CIMD client. See [Configure an existing AI agent as a CIMD client](#configure-an-existing-ai-agent-as-a-cimd-client). |
Contributor
There was a problem hiding this comment.
Suggested change
| > **Note:** Once you set `oauthClient.type` to `CIMD` on an AI agent, you can't change it to a different type. However, you can configure an existing AI agent that doesn't yet use CIMD (for example, one that uses BYOK) as a CIMD client. See [Configure an existing AI agent as a CIMD client](#configure-an-existing-ai-agent-as-a-cimd-client). | |
| > **Note:** After you set `oauthClient.type` to `CIMD` on an AI agent, you can't change it to a different type. However, you can configure an existing AI agent that doesn't yet use CIMD (for example, one that uses BYOK) as a CIMD client. See [Configure an existing AI agent as a CIMD client](#configure-an-existing-ai-agent-as-a-cimd-client). |
|
|
||
| As with registration, Okta processes this request asynchronously. The response is `202 Accepted` with a `Location` header that points to an operation you can poll for completion. | ||
|
|
||
| You can't change a CIMD client's `oauthClient.type` to a different type after you set it. |
Contributor
There was a problem hiding this comment.
Suggested change
| You can't change a CIMD client's `oauthClient.type` to a different type after you set it. | |
| You can't change a CIMD client's `oauthClient.type` after you set it. |
Acrolinx scoreA minimum Acrolinx Score of 80 is required. The total score is an average of the subscores.
Successfully checked 1 of 1 documents. Reopen the pull request or push new changes to check again. Depending on the Acrolinx server configuration, the |
susanharper-okta
approved these changes
Sep 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description:
oauthClientsupport toPATCH /workload-principals/api/v1/ai-agents/{agentId}, so this is no longer accurate. This PR:Resolves:
Vercel Preview Link:
https://developer-docs-jz118rdig-doc-tools-8ec9f365.vercel.app/docs/guides/ai-agent-cimd-registration/main/#configure-an-existing-ai-agent-as-a-cimd-client