OKTA is not able to verify APPIAN using event Hooks.

Did you check the logfile tomcat-access?

@stefan Helzle  We verified the logs but can't see the request /response ,neither able to print the logs.

Did you create an extra API according to the OKTA documentation? I do not have any experience with OKTA, but the documentation seems pretty good.

Yes I Have ,

One is Get Method 

There is another API POST method 

AS Per Okta Documentation 

Since not able to debug , as not able to see the request/response from both end products ..facing challenge .

becasue OKTA is just saying verification value from response  is not correct.

Are both APIs (POST/GET) listening on the same endpoint? How is the security setup? Did you test using Postman?

Yes Both are listening to same endpoint and security we are using API Key .

Also we have verified everything from SoapUI and Postman.

Get

Post

Yes Both are listening to same endpoint and security we are using API Key .

Also we have verified everything from SoapUI and Postman.

Get

Post

OK. That GET does not return the verification value.

Yes OKTA and APPIAN not able verify each other .. even I am trying as per the document.

Any suggestion can help. Any alternative to get the logs may help.

What I mean is that in your Postman screenshot, the GET does not show the validation value in the returned body.

From OKTA request it will be sending the verification code. So for testing i was checking the value and it is working as per the requirement. But not from OKTA .

Is that answered your question.

Okay This i was testing as i have not checked the box .. so it inot giving the value 

But ideally Scenario 

In get call OKTA is going to send the x-okta-verification-challenge :<>

Which needs to be send in the request Body of the Get call .{as per the okta document https://developer.okta.com/docs/concepts/event-hooks/#one-time-verification-request }

Can you change the header name for authentication, OKTA is using to "Appian-API-Key"?

Is there any way to log request in appian ?

I know. Appian is very specific about this. When you use the header "Authorization", you must adhere to this

• Appian-API-Key Header:
  curl example.appian.com/.../endpoint -H "Appian-API-Key: ${API_KEY}"

• Bearer Token Header:
  curl example.appian.com/.../endpoint -H "Authorization: Bearer ${API_KEY}"

• Basic Authentication Header (with null username):
  curl -u :${API_KEY} example.appian.com/.../endpoint

• Basic Authentication Header (with null password):
  curl -u ${API_KEY}: example.appian.com/.../endpoint

I mean the colon before or after the key.