Workflows Tips #11: Random 6-Digit PIN, Calling Okta API, and Sign-In Based on Location
Tags: nocode, workflows, okta, automation
Published: 2022-08-22 23:16:12

---
title: Workflows Tips #11: Random 6-Digit PIN, Calling Okta API, and Sign-In Based on Location
published: true
date: 2022-08-22 05:45:52 UTC
tags: NoCode,Workflows,Okta, Automation
canonical_url: https://maxkatz.net/2022/03/10/workflows-tips-11-random-6-digit-pin-calling-okta-api-and-sign-in-based-on-location/
---

Welcome to another Okta Workflows Tips post. [Read](https://dev.to/oktaworkflows/okta-workflows-tips-57bj) all other tips.

In this post:

- How to generate a random 6-digit PIN
- Using Custom API Action to create a user without credentials (via Okta API)
- How to monitor sign-in based on geographic location

## How to generate a random 6-digit PIN

_This tip is from [Arek Dreyer](https://www.linkedin.com/in/arekdreyer/). Arek is a Senior Product Engineer at [kandji.io](http://kandji.io), which provides next-generation Apple device management for macOS, iOS, iPadOS, and tvOS. Arek spent over 20 years as an independent trainer, author, and consultant, and in 2021 he joined Kandji. He was super happy to discover the [community of admins](https://www.macadmins.org/) that love helping each other solve problems in the Okta Workflows space._

This tip shows how to generate a 6-digit PIN where the first digits can be zero.

[![Flow to generate a random 6-digit PIN](https://katzmax.files.wordpress.com/2022/03/workflows_tips11_6digit_1.png?w=1014)](https://katzmax.files.wordpress.com/2022/03/workflows_tips11_6digit_1.png)
<figcaption>Flow to generate a random 6-digit PIN</figcaption>

[![Output from running a flow to generate a 6-digit PIN](https://katzmax.files.wordpress.com/2022/03/workflows_tips11_6digit_2.png?w=1024)](https://katzmax.files.wordpress.com/2022/03/workflows_tips11_6digit_2.png)
<figcaption>Output from running a flow to generate a 6-digit PIN</figcaption>

The flow has two steps:

1. Generate a 7-digit random number between using **[Number – Random Integer](https://help.okta.com/wf/en-us/Content/Topics/Workflows/function-reference/Number/number_random.htm)** card
2. Use [**Text – Text Segment**](https://help.okta.com/wf/en-us/Content/Topics/Workflows/function-reference/Text/text_substr.htm) card to leave out the first digit and you end up with a 6-digit PIN where the first digit can be a zero

This is a cool tip (or a hack) for a specific use case.

✨ Thank you to [Gabriel Sroka](https://www.linkedin.com/in/gabrielsroka/) for helping find this solution.

## Using Custom API Action to create a user without credentials (via Okta API)

_This tip is from [Bryan Barrows](https://www.linkedin.com/in/bbarrows89/), Workflows Builder Advocate at Okta._

In this tip, you will learn how to send a POST request to Okta to [Create a user without credentials](https://developer.okta.com/docs/reference/api/users/#create-user-without-credentials).

First, you need to create a **profile** object to include in your request payload – this will contain the information about the user you wish to create.

[![Custom action](https://katzmax.files.wordpress.com/2022/03/workflows_tips11_custom_action.png?w=1024)](https://katzmax.files.wordpress.com/2022/03/workflows_tips11_custom_action.png)<figcaption>Custom API action</figcaption>

You can leverage the **[Object – Construct](https://help.okta.com/wf/en-us/Content/Topics/Workflows/function-reference/Object/object_construct.htm)** function to create the inner object with keys for firstName, lastName, etc. You can then feed the output of this card into another **[Object – Construct](https://help.okta.com/wf/en-us/Content/Topics/Workflows/function-reference/Object/object_construct.htm)** with a key of **profile**. 

The resulting output of our second card is an object that matches what Okta’s API expects for this request and looks like this:

```
{
  "profile": {
    "lastName": "User",
    "email": "example.user@test.com",
    "mobilePhone": "555-415-1337",
    "firstName": "Example",
    "login": "example.user@test.com"
  }
}
```

You can then add the **[Okta – Custom API Action](https://help.okta.com/wf/en-us/Content/Topics/Workflows/connector-reference/okta/actions/httprequest.htm)** card with an action of POST. The full endpoint we want to hit is `https://${yourOktaDomain}/api/v1/users?activate=false`, so the Relative URL for the request will be /api/v1/users?activate=false. 

With your constructed profile object and relative URL, you are now able to use the **Okta – Custom API Action** to POST to Okta’s API. 

## How to monitor sign-in based on geographic location

_This tip is from [Bryan Barrows](https://www.linkedin.com/in/bbarrows89/), Workflows Builder Advocate at Okta._

This tip is based on a real use-case in which a customer wanted to monitor whether users who have a country code of UA in their profile attempt to sign in from outside of Ukraine – however, the logic can easily be customized for many unique scenarios.

[![Geolocation login](https://katzmax.files.wordpress.com/2022/03/workflows_tips11_geolocation_login.png?w=1024)](https://katzmax.files.wordpress.com/2022/03/workflows_tips11_geolocation_login.png)<figcaption>Login based on location</figcaption>

The flow has the following steps:

1. Leverage the [**Okta – User Sign In Attempt**](https://help.okta.com/wf/en-us/Content/Topics/Workflows/connector-reference/okta/events/usersignedinattempt.htm) event to fire a workflow anytime a user attempts to sign in.
2. Add an [**Okta – Read User**](https://help.okta.com/wf/en-us/Content/Topics/Workflows/connector-reference/okta/actions/readuser.htm) card and drag the Actor ID into the input field. We’ll also want to select the **Country Code** as an output field.
3. Add a [**Branching – Continue If**](https://help.okta.com/wf/en-us/Content/Topics/Workflows/function-reference/Branching/branching_continueif.htm) function and check if the user’s country code matches the one that you care about monitoring. If it doesn’t, we don’t need to do anything and the flow will stop.
4. Add an [Object – Get Multiple](https://help.okta.com/wf/en-us/Content/Topics/Workflows/function-reference/Object/object_get.htm) function and retrieve the geographical context of the sign-in event using [dot notation](https://developer.mozilla.org/en-US/docs/Learn/JavaScript/Objects/Basics#dot_notation) by creating an output with a key name of `client.userAgent.geographicalContext.country` 
5. Add a [**Branching – If Else**](https://help.okta.com/wf/en-us/Content/Topics/Workflows/function-reference/Branching/branching_if.htm) function and check that the output of Step 4 is equal to the expected country for the user to sign in from. When that is not the case, the **False** lane will execute, so any actions you want to take like sending a Slack message, etc, can be put here. 

That’s all for now. Let me know if you have any tips you would like to share.

* * *

Two resources to help you learn more:

📌 Try this step-by-step getting started tutorial: [Build Your First Automation With Okta Workflows: Notify When User Is Suspended](https://dev.to/maxkatz/build-your-first-automation-with-okta-workflows-notify-when-user-is-suspended-1l3p-temp-slug-2933517).

📌 All the [Workflows resources](https://dev.to/maxkatz/okta-workflows-resources-1ebi) (docs, tutorial, office hours, templates, office hours and more)