Read-only one-off exporter for Okta-created groups and group memberships.
It writes two CSVs:
okta-groups-YYYYMMDD-HHMMSS.csv: one row per Okta group, including group profile fields such as profile.name and profile.description, source metadata, and member_count.okta-group-memberships-YYYYMMDD-HHMMSS.csv: one row per group-member relationship, including group metadata and user profile fields returned by Okta.By default, the exporter includes only groups whose Okta type is
OKTA_GROUP. That excludes imported app groups such as APP_GROUP.
The script only performs GET requests:
GET /api/v1/groups?search=type eq "OKTA_GROUP"GET /api/v1/groups/{groupId}/usersOkta reference:
cd integrations/okta_group_scrape
cp .env.example .env
Edit .env with the Okta org domain. The token can either go in .env as
OKTA_API_TOKEN=..., or you can leave it blank and paste it into the hidden
terminal prompt when the script runs.
No install step is required; the script uses only built-in Node modules.
SSWS tokens inherit the permissions of the admin who creates them. For a full tenant-wide export, use an admin account that can see all groups and group members. Revoke/deactivate the token when the export is done.
For one-off use, the safer flow is:
cd integrations/okta_group_scrape
OKTA_DOMAIN=schmidtentities.okta.com npm run export
When prompted for Okta API token, paste it once. It will not be written to disk by the script.
npm run export
Optional output directory:
node export-okta-groups.js --output-dir ./exports/intern-export
Groups only:
npm run groups-only
Continue exporting if one group’s membership lookup fails:
node export-okta-groups.js --continue-on-error
Include app/imported groups too:
node export-okta-groups.js --all-group-types
By default, files are written to:
./exports/<timestamp>/
The exports contain employee/group data and should not be committed. The local output directory is gitignored.