Okta

# Enterprise plan. Configure in Settings → Security → SSO.

Cheqpoint SP details:
  Entity ID:    https://app.cheqpoint.co/saml/metadata
  ACS URL:      https://app.cheqpoint.co/saml/callback
  NameID:       EmailAddress

In Okta:
  1. Create a new SAML app for Cheqpoint.
  2. Set ACS URL and Entity ID above.
  3. Attribute statements:
       email      → user.email
       firstName  → user.firstName
       lastName   → user.lastName
  4. Download IdP metadata XML → paste into Cheqpoint SSO settings.

# In Cheqpoint: AI Assistants → <agent> → Review Group

Use Okta group names to map approval requests to the right team:
  • "finance-reviewers"   → Finance AI agent approvals
  • "security-ops"        → High-risk and infrastructure actions
  • "legal-reviewers"     → Contract and compliance actions

When an agent submits a request, Cheqpoint routes it to the
assigned Review Group. Members log in via Okta SSO and see
only requests assigned to their group.

# Okta System Log ingestion via Okta Event Hooks.
# Alternatively, forward Cheqpoint webhook events to a middleware
# (e.g. n8n, Zapier, or a Lambda) that writes to Okta's Event API.

# Okta Event Hook endpoint (add in Cheqpoint as a Notification URL):
POST https://<okta-domain>/api/v1/eventHooks

# Map Cheqpoint event types to Okta event display names:
  request.created  → "cheqpoint.agent.action.requested"
  request.decided  → "cheqpoint.agent.action.decided"

# Okta Workflows trigger on incoming Cheqpoint webhook events.
# Use the HTTP connector as a trigger.

Trigger: HTTP request from Cheqpoint webhook
Condition: riskScore > 0.8

Actions:
  1. Look up reviewer by email (Okta Users connector)
  2. Send Slack DM to security-ops group via Slack connector
  3. Create Jira ticket for audit trail
  4. (optional) Disable the AI agent's Okta service account if repeated