---
title: Okta API Token Created or Enabled
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > OOTB Rules > Okta API Token Created or Enabled
---

# Okta API Token Created or Enabled
Classification:attackTactic:[TA0003-persistence](https://attack.mitre.org/tactics/TA0003)Technique:[T1098-account-manipulation](https://attack.mitre.org/techniques/T1098) 
## Goal{% #goal %}

Detect when a new Okta API token is created.

## Strategy{% #strategy %}

This rule lets you monitor the following Okta event to detect when a new Okta API token is created:

- `system.api_token.create`

## Triage and response{% #triage-and-response %}

Contact the user who created the API token and ensure that the API token is needed.