Okta returns a 403 Forbidden error when administrators create an OpenID Connect (OIDC) web application via the API or Terraform because the organization has disabled the self-service assignment feature. Administrators can resolve this by enabling self-service application assignment in the Okta Admin Console or by setting the self-service parameter to false in the configuration. When administrators attempt to create an OIDC web application using the Okta API or Terraform, Okta generates the following errors:

Terraform Error

Error: failed to create OAuth application: the API returned an error: Self service application assignment is not enabled..
Causes: errorSummary: Self service application assignment for organization managed apps must be enabled.

API Error

{
    "errorCode": "E0000043",
    "errorSummary": "Self service application assignment is not enabled.",
    "errorLink": "E0000043",
    "errorId": "oaeLTJ3aTngQHCg3_4gY_HvDQ",
    "errorCauses": [
        {
            "errorSummary": "Self service application assignment for organization managed apps must be enabled."
        }
    ]
}

• Okta Identity Engine (OIE)
• Terraform Provider
• Okta API
• OIDC application

Okta generates the error when the application configuration includes the accessibility_self_service parameter when using Terraform (or accessibility.selfService in the Okta API) with its value set to true. Administrators must enable self-service assignment for organization-managed applications as a prerequisite for setting this property. If the organization disables this feature, Okta rejects the creation request with a 403 Forbidden status. 

This issue is not specific to Terraform and occurs in any direct API integration attempting to enable self-service assignment for a new application.

How is the self-service assignment enabled in the Okta Admin Console?

Enable the self-service application assignment settings in the Okta Admin Console so users can add organization-managed applications.

1. Sign in to Admin Console.

2. Navigate to Applications > Self Service.

3. Select the Settings tab.

4. Click Edit.

5. Enable Allow users to add org-managed apps.

6. Click Save.

Modify Application Configuration

If the application does not require self-service assignment, update the request parameters in the Okta API or Terraform configuration to disable the feature.

For API Requests

Locate the accessibility object in the JSON payload and set selfService to false:

"accessibility": { "selfService": false, "errorRedirectUrl": null, "loginRedirectUrl": null }

For Terraform

1. Locate the okta_app_oauth resource in the configuration file.

2. Set the accessibility_self_service parameter to false.

3. Re-run the Terraform plan and apply.

Related References

• How to Capture Debug Logs from Terraform
• Terraform OAuth Resource
• Okta OIDC Application API Reference