diff --git a/patches/0001-remove-docs.patch b/patches/0001-remove-docs.patch
new file mode 100644
index 00000000..103f5a71
--- /dev/null
+++ b/patches/0001-remove-docs.patch
@@ -0,0 +1,10849 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Venelin <venelin@pulumi.com>
+Date: Thu, 18 Apr 2024 14:16:16 +0100
+Subject: [PATCH] remove docs
+
+
+diff --git a/docs/data-sources/app.md b/docs/data-sources/app.md
+deleted file mode 100644
+index f362dc21..00000000
+--- a/docs/data-sources/app.md
++++ /dev/null
+@@ -1,46 +0,0 @@
+----
+-page_title: "Data Source: okta_app"
+-description: |-
+-  Get an application of any kind from Okta.
+----
+-
+-# Data Source: okta_app
+-
+-Get an application of any kind from Okta.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_app" "example" {
+-  label = "Example App"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Optional
+-
+-- `active_only` (Boolean) Search only ACTIVE applications.
+-- `id` (String) Id of application to retrieve, conflicts with label and label_prefix.
+-- `label` (String) The label of the app to retrieve, conflicts with
+-				label_prefix and id. Label uses the ?q=<label> query parameter exposed by
+-				Okta's List Apps API. The API will search both name and label using that
+-				query. Therefore similarily named and labeled apps may be returned in the query
+-				and have the unitended result of associating the wrong app with this data
+-				source. See:
+-				https://developer.okta.com/docs/reference/api/apps/#list-applications
+-- `label_prefix` (String) Label prefix of the app to retrieve, conflicts with label and id. This will tell the
+-				provider to do a starts with query as opposed to an equals query.
+-- `skip_groups` (Boolean, Deprecated) Ignore groups sync. This is a temporary solution until 'groups' field is supported in all the app-like resources
+-- `skip_users` (Boolean, Deprecated) Ignore users sync. This is a temporary solution until 'users' field is supported in all the app-like resources
+-
+-### Read-Only
+-
+-- `groups` (Set of String, Deprecated) Groups associated with the application
+-- `links` (String) Discoverable resources related to the app
+-- `name` (String) Name of application.
+-- `status` (String) Status of application.
+-- `users` (Set of String, Deprecated) Users associated with the application
+-
+-
+diff --git a/docs/data-sources/app_group_assignments.md b/docs/data-sources/app_group_assignments.md
+deleted file mode 100644
+index 737e6eeb..00000000
+--- a/docs/data-sources/app_group_assignments.md
++++ /dev/null
+@@ -1,30 +0,0 @@
+----
+-page_title: "Data Source: okta_app_group_assignments"
+-description: |-
+-  Get a set of groups assigned to an Okta application.
+----
+-
+-# Data Source: okta_app_group_assignments
+-
+-Get a set of groups assigned to an Okta application.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_app_group_assignments" "test" {
+-  id = okta_app_oauth.test.id
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `id` (String) ID of the Okta App being queried for groups
+-
+-### Read-Only
+-
+-- `groups` (Set of String) List of groups IDs assigned to the app
+-
+-
+diff --git a/docs/data-sources/app_metadata_saml.md b/docs/data-sources/app_metadata_saml.md
+deleted file mode 100644
+index 1d7a0d23..00000000
+--- a/docs/data-sources/app_metadata_saml.md
++++ /dev/null
+@@ -1,41 +0,0 @@
+----
+-page_title: "Data Source: okta_app_metadata_saml"
+-description: |-
+-  Get a SAML application's metadata from Okta.
+----
+-
+-# Data Source: okta_app_metadata_saml
+-
+-Get a SAML application's metadata from Okta.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_app_metadata_saml" "example" {
+-  app_id = "<app id>"
+-  key_id = "<cert key id>"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `app_id` (String) The application ID.
+-
+-### Optional
+-
+-- `key_id` (String) Certificate Key ID.
+-
+-### Read-Only
+-
+-- `certificate` (String) Public certificate from application metadata.
+-- `entity_id` (String) Entity URL for instance https://www.okta.com/saml2/service-provider/sposcfdmlybtwkdcgtuf
+-- `http_post_binding` (String) urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Post location from the SAML metadata.
+-- `http_redirect_binding` (String) urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect location from the SAML metadata.
+-- `id` (String) The ID of this resource.
+-- `metadata` (String) Raw metadata of application.
+-- `want_authn_requests_signed` (Boolean) Whether authn requests are signed.
+-
+-
+diff --git a/docs/data-sources/app_oauth.md b/docs/data-sources/app_oauth.md
+deleted file mode 100644
+index 2207d3f8..00000000
+--- a/docs/data-sources/app_oauth.md
++++ /dev/null
+@@ -1,61 +0,0 @@
+----
+-page_title: "Data Source: okta_app_oauth"
+-description: |-
+-  Get a OIDC application from Okta.
+----
+-
+-# Data Source: okta_app_oauth
+-
+-Get a OIDC application from Okta.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_app_oauth" "test" {
+-  label = "Example App"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Optional
+-
+-- `active_only` (Boolean) Search only ACTIVE applications.
+-- `id` (String) Id of application to retrieve, conflicts with label and label_prefix.
+-- `label` (String) The label of the app to retrieve, conflicts with
+-				label_prefix and id. Label uses the ?q=<label> query parameter exposed by
+-				Okta's List Apps API. The API will search both name and label using that
+-				query. Therefore similarily named and labeled apps may be returned in the query
+-				and have the unitended result of associating the wrong app with this data
+-				source. See:
+-				https://developer.okta.com/docs/reference/api/apps/#list-applications
+-- `label_prefix` (String) Label prefix of the app to retrieve, conflicts with label and id. This will tell the
+-				provider to do a starts with query as opposed to an equals query.
+-- `skip_groups` (Boolean, Deprecated) Ignore groups sync. This is a temporary solution until 'groups' field is supported in all the app-like resources
+-- `skip_users` (Boolean, Deprecated) Ignore users sync. This is a temporary solution until 'users' field is supported in all the app-like resources
+-
+-### Read-Only
+-
+-- `auto_submit_toolbar` (Boolean) Display auto submit toolbar
+-- `client_id` (String) OAuth client ID
+-- `client_secret` (String, Sensitive) OAuth client secret
+-- `client_uri` (String) URI to a web page providing information about the client.
+-- `grant_types` (Set of String) List of OAuth 2.0 grant types
+-- `hide_ios` (Boolean) Do not display application icon on mobile app
+-- `hide_web` (Boolean) Do not display application icon to users
+-- `links` (String) Discoverable resources related to the app
+-- `login_mode` (String) The type of Idp-Initiated login that the client supports, if any
+-- `login_scopes` (Set of String) List of scopes to use for the request when 'login_mode' == OKTA
+-- `login_uri` (String) URI that initiates login.
+-- `logo_uri` (String) URI that references a logo for the client.
+-- `name` (String) Name of application.
+-- `policy_uri` (String) URI to web page providing client policy document.
+-- `post_logout_redirect_uris` (Set of String) List of URIs for redirection after logout
+-- `redirect_uris` (Set of String) List of URIs for use in the redirect-based flow.
+-- `response_types` (Set of String) List of OAuth 2.0 response type strings.
+-- `status` (String) Status of application.
+-- `type` (String) The type of OAuth application.
+-- `wildcard_redirect` (String) Indicates if the client is allowed to use wildcard matching of redirect_uris
+-
+-
+diff --git a/docs/data-sources/app_saml.md b/docs/data-sources/app_saml.md
+deleted file mode 100644
+index c02786ca..00000000
+--- a/docs/data-sources/app_saml.md
++++ /dev/null
+@@ -1,90 +0,0 @@
+----
+-page_title: "Data Source: okta_app_saml"
+-description: |-
+-  Get a SAML application from Okta.
+----
+-
+-# Data Source: okta_app_saml
+-
+-Get a SAML application from Okta.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_app_saml" "example" {
+-  label = "Example App"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Optional
+-
+-- `active_only` (Boolean) Search only ACTIVE applications.
+-- `id` (String) Id of application to retrieve, conflicts with label and label_prefix.
+-- `label` (String) The label of the app to retrieve, conflicts with label_prefix and id. Label 
+-				uses the ?q=<label> query parameter exposed by Okta's API. It should be noted that at this time 
+-				this searches both name and label. This is used to avoid paginating through all applications.
+-- `label_prefix` (String) Label prefix of the app to retrieve, conflicts with label and id. This will tell the
+-				provider to do a starts with query as opposed to an equals query.
+-- `request_compressed` (Boolean) Denotes whether the request is compressed or not.
+-- `skip_groups` (Boolean, Deprecated) Ignore groups sync. This is a temporary solution until 'groups' field is supported in all the app-like resources
+-- `skip_users` (Boolean, Deprecated) Ignore users sync. This is a temporary solution until 'users' field is supported in all the app-like resources
+-
+-### Read-Only
+-
+-- `accessibility_error_redirect_url` (String) Custom error page URL
+-- `accessibility_login_redirect_url` (String) Custom login page URL
+-- `accessibility_self_service` (Boolean) Enable self service
+-- `acs_endpoints` (Set of String) List of ACS endpoints for this SAML application
+-- `app_settings_json` (String) Application settings in JSON format
+-- `assertion_signed` (Boolean) Determines whether the SAML assertion is digitally signed
+-- `attribute_statements` (List of Object) (see [below for nested schema](#nestedatt--attribute_statements))
+-- `audience` (String) Audience Restriction
+-- `authn_context_class_ref` (String) Identifies the SAML authentication context class for the assertion’s authentication statement
+-- `auto_submit_toolbar` (Boolean) Display auto submit toolbar
+-- `default_relay_state` (String) Identifies a specific application resource in an IDP initiated SSO scenario.
+-- `destination` (String) Identifies the location where the SAML response is intended to be sent inside of the SAML assertion
+-- `digest_algorithm` (String) Determines the digest algorithm used to digitally sign the SAML assertion and response
+-- `features` (Set of String) features to enable
+-- `groups` (Set of String, Deprecated) Groups associated with the application
+-- `hide_ios` (Boolean) Do not display application icon on mobile app
+-- `hide_web` (Boolean) Do not display application icon to users
+-- `honor_force_authn` (Boolean) Prompt user to re-authenticate if SP asks for it
+-- `idp_issuer` (String) SAML issuer ID
+-- `inline_hook_id` (String) Saml Inline Hook setting
+-- `key_id` (String) Certificate ID
+-- `links` (String) Discoverable resources related to the app
+-- `name` (String) Name of application.
+-- `recipient` (String) The location where the app may present the SAML assertion
+-- `response_signed` (Boolean) Determines whether the SAML auth response message is digitally signed
+-- `saml_signed_request_enabled` (Boolean) SAML Signed Request enabled
+-- `signature_algorithm` (String) Signature algorithm used to digitally sign the assertion and response
+-- `single_logout_certificate` (String) x509 encoded certificate that the Service Provider uses to sign Single Logout requests
+-- `single_logout_issuer` (String) The issuer of the Service Provider that generates the Single Logout request
+-- `single_logout_url` (String) The location where the logout response is sent
+-- `sp_issuer` (String) SAML SP issuer ID
+-- `sso_url` (String) Single Sign On URL
+-- `status` (String) Status of application.
+-- `subject_name_id_format` (String) Identifies the SAML processing rules.
+-- `subject_name_id_template` (String) Template for app user's username when a user is assigned to the app
+-- `user_name_template` (String) Username template
+-- `user_name_template_push_status` (String) Push username on update
+-- `user_name_template_suffix` (String) Username template suffix
+-- `user_name_template_type` (String) Username template type
+-- `users` (Set of String, Deprecated) Users associated with the application
+-
+-<a id="nestedatt--attribute_statements"></a>
+-### Nested Schema for `attribute_statements`
+-
+-Read-Only:
+-
+-- `filter_type` (String)
+-- `filter_value` (String)
+-- `name` (String)
+-- `namespace` (String)
+-- `type` (String)
+-- `values` (List of String)
+-
+-
+diff --git a/docs/data-sources/app_signon_policy.md b/docs/data-sources/app_signon_policy.md
+deleted file mode 100644
+index d047b6f6..00000000
+--- a/docs/data-sources/app_signon_policy.md
++++ /dev/null
+@@ -1,39 +0,0 @@
+----
+-page_title: "Data Source: okta_app_signon_policy"
+-description: |-
+-  Get a sign-on policy for the application.
+----
+-
+-# Data Source: okta_app_signon_policy
+-
+-Get a sign-on policy for the application.
+-
+-~> **WARNING:** This feature is only available as a part of the 
+-Identity Engine. [Contact support](mailto:dev-inquiries@okta.com) 
+-for further information.
+-
+--> Inside the product a sign-on policy is referenced as an _authentication
+-policy_, in the public API the policy is of type
+-[`ACCESS_POLICY`](https://developer.okta.com/docs/reference/api/policy/#policy-object).
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_app_signon_policy" "example" {
+-  app_id = "app_id"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `app_id` (String) App ID
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-- `name` (String) Policy name
+-
+-
+diff --git a/docs/data-sources/app_user_assignments.md b/docs/data-sources/app_user_assignments.md
+deleted file mode 100644
+index a193c1b3..00000000
+--- a/docs/data-sources/app_user_assignments.md
++++ /dev/null
+@@ -1,30 +0,0 @@
+----
+-page_title: "Data Source: okta_app_user_assignments"
+-description: |-
+-  Get a set of users assigned to an Okta application.
+----
+-
+-# Data Source: okta_app_user_assignments
+-
+-Get a set of users assigned to an Okta application.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_app_user_assignments" "test" {
+-  id = okta_app_oauth.test.id
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `id` (String) ID of the Okta App being queried for groups
+-
+-### Read-Only
+-
+-- `users` (Set of String) List of user IDs assigned to the app
+-
+-
+diff --git a/docs/data-sources/auth_server.md b/docs/data-sources/auth_server.md
+deleted file mode 100644
+index 10d0375c..00000000
+--- a/docs/data-sources/auth_server.md
++++ /dev/null
+@@ -1,39 +0,0 @@
+----
+-page_title: "Data Source: okta_auth_server"
+-description: |-
+-  Get an auth server from Okta.
+----
+-
+-# Data Source: okta_auth_server
+-
+-Get an auth server from Okta.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_auth_server" "example" {
+-  name = "Example Auth"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `name` (String) The name of the auth server to retrieve.
+-
+-### Read-Only
+-
+-- `audiences` (Set of String) Description of Authorization server.
+-- `credentials_last_rotated` (String) Last time credentials were rotated.
+-- `credentials_next_rotation` (String) Next time credentials will be rotated
+-- `credentials_rotation_mode` (String) Mode of credential rotation, auto or manual.
+-- `description` (String) Description of Authorization server.
+-- `id` (String) The ID of this resource.
+-- `issuer` (String) The complete URL of the authorization server. This becomes the `iss` claim in an access token.
+-- `issuer_mode` (String) Can be set to `CUSTOM_URL` or `ORG_URL`
+-- `kid` (String) Auth server key id.
+-- `status` (String) The activation status of the authorization server.
+-
+-
+diff --git a/docs/data-sources/auth_server_claim.md b/docs/data-sources/auth_server_claim.md
+deleted file mode 100644
+index c50cbe25..00000000
+--- a/docs/data-sources/auth_server_claim.md
++++ /dev/null
+@@ -1,41 +0,0 @@
+----
+-page_title: "Data Source: okta_auth_server_claim"
+-description: |-
+-  Get authorization server claim from Okta.
+----
+-
+-# Data Source: okta_auth_server_claim
+-
+-Get authorization server claim from Okta.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_auth_server_claim" "test" {
+-  auth_server_id = "default"
+-  name           = "birthdate"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `auth_server_id` (String) Auth server ID
+-
+-### Optional
+-
+-- `id` (String) Name of the claim. Conflicts with `name`.
+-- `name` (String) Name of the claim. Conflicts with `id`.
+-
+-### Read-Only
+-
+-- `always_include_in_token` (Boolean) Specifies whether to include Claims in the token.
+-- `claim_type` (String) Specifies whether the Claim is for an access token (`RESOURCE`) or ID token (`IDENTITY`).
+-- `scopes` (Set of String) Auth server claim list of scopes
+-- `status` (String) Status of the claim.
+-- `value` (String) Value of the claim.
+-- `value_type` (String) Specifies whether the Claim is an Okta EL expression (`EXPRESSION`), a set of groups (`GROUPS`), or a system claim (`SYSTEM`)
+-
+-
+diff --git a/docs/data-sources/auth_server_claims.md b/docs/data-sources/auth_server_claims.md
+deleted file mode 100644
+index d91bff39..00000000
+--- a/docs/data-sources/auth_server_claims.md
++++ /dev/null
+@@ -1,45 +0,0 @@
+----
+-page_title: "Data Source: okta_auth_server_claims"
+-description: |-
+-  Get a list of authorization server claims from Okta.
+----
+-
+-# Data Source: okta_auth_server_claims
+-
+-Get a list of authorization server claims from Okta.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_auth_server_claims" "test" {
+-  auth_server_id = "default"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `auth_server_id` (String) Auth server ID
+-
+-### Read-Only
+-
+-- `claims` (List of Object) Collection of authorization server claims retrieved from Okta with the following properties. (see [below for nested schema](#nestedatt--claims))
+-- `id` (String) The ID of this resource.
+-
+-<a id="nestedatt--claims"></a>
+-### Nested Schema for `claims`
+-
+-Read-Only:
+-
+-- `always_include_in_token` (Boolean)
+-- `claim_type` (String)
+-- `id` (String)
+-- `name` (String)
+-- `scopes` (Set of String)
+-- `status` (String)
+-- `value` (String)
+-- `value_type` (String)
+-
+-
+diff --git a/docs/data-sources/auth_server_policy.md b/docs/data-sources/auth_server_policy.md
+deleted file mode 100644
+index 9dcc261b..00000000
+--- a/docs/data-sources/auth_server_policy.md
++++ /dev/null
+@@ -1,35 +0,0 @@
+----
+-page_title: "Data Source: okta_auth_server_policy"
+-description: |-
+-  Get an authorization server policy from Okta.
+----
+-
+-# Data Source: okta_auth_server_policy
+-
+-Get an authorization server policy from Okta.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_auth_server_policy" "example" {
+-  auth_server_id = "<auth server id>"
+-  name           = "staff"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `auth_server_id` (String) Auth server ID
+-- `name` (String) Name of the policy
+-
+-### Read-Only
+-
+-- `assigned_clients` (Set of String) List of clients this policy is assigned to. `[ALL_CLIENTS]` is a special value when policy is assigned to all clients.
+-- `description` (String) Description of authorization server policy.
+-- `id` (String) The ID of this resource.
+-- `priority` (Number) Priority of the auth server policy
+-
+-
+diff --git a/docs/data-sources/auth_server_scopes.md b/docs/data-sources/auth_server_scopes.md
+deleted file mode 100644
+index 230a53d4..00000000
+--- a/docs/data-sources/auth_server_scopes.md
++++ /dev/null
+@@ -1,46 +0,0 @@
+----
+-page_title: "Data Source: okta_auth_server_scopes"
+-description: |-
+-  Get a list of authorization server scopes from Okta.
+----
+-
+-# Data Source: okta_auth_server_scopes
+-
+-Get a list of authorization server scopes from Okta.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_auth_server_scopes" "test" {
+-  auth_server_id = "default"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `auth_server_id` (String) Auth server ID
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-- `scopes` (List of Object) Collection of authorization server scopes retrieved from Okta with the following properties. (see [below for nested schema](#nestedatt--scopes))
+-
+-<a id="nestedatt--scopes"></a>
+-### Nested Schema for `scopes`
+-
+-Read-Only:
+-
+-- `consent` (String)
+-- `default` (Boolean)
+-- `description` (String)
+-- `display_name` (String)
+-- `id` (String)
+-- `metadata_publish` (String)
+-- `name` (String)
+-- `optional` (Boolean)
+-- `system` (Boolean)
+-
+-
+diff --git a/docs/data-sources/authenticator.md b/docs/data-sources/authenticator.md
+deleted file mode 100644
+index 73fb326a..00000000
+--- a/docs/data-sources/authenticator.md
++++ /dev/null
+@@ -1,48 +0,0 @@
+----
+-page_title: "Data Source: okta_authenticator"
+-description: |-
+-  Get an authenticator by key, name of ID.
+----
+-
+-# Data Source: okta_authenticator
+-
+-Get an authenticator by key, name of ID.
+-
+-~> **WARNING:** This feature is only available as a part of the 
+-Identity Engine. [Contact support](mailto:dev-inquiries@okta.com) 
+-for further information.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_authenticator" "test" {
+-  key = "security_question"
+-}
+-
+-data "okta_authenticator" "test_1" {
+-  name = "Okta Verify"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Optional
+-
+-- `id` (String) ID of the authenticator.
+-- `key` (String) A human-readable string that identifies the authenticator.
+-- `name` (String) Name of the authenticator.
+-
+-### Read-Only
+-
+-- `provider_auth_port` (Number) The RADIUS server port (for example 1812). This is defined when the On-Prem RADIUS server is configured
+-- `provider_hostname` (String) Server host name or IP address
+-- `provider_instance_id` (String) (Specific to `security_key`) App Instance ID.
+-- `provider_json` (String) Authenticator Provider in JSON format
+-- `provider_type` (String) Provider type.
+-- `provider_user_name_template` (String) Username template expected by the provider.
+-- `settings` (String) Authenticator settings in JSON format
+-- `status` (String) Status of the Authenticator.
+-- `type` (String) Type of the authenticator
+-
+-
+diff --git a/docs/data-sources/behavior.md b/docs/data-sources/behavior.md
+deleted file mode 100644
+index 30cf79db..00000000
+--- a/docs/data-sources/behavior.md
++++ /dev/null
+@@ -1,33 +0,0 @@
+----
+-page_title: "Data Source: okta_behavior"
+-description: |-
+-  Get a behavior by name or ID.
+----
+-
+-# Data Source: okta_behavior
+-
+-Get a behavior by name or ID.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_behavior" "example" {
+-  label = "New City"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Optional
+-
+-- `id` (String) Behavior ID.
+-- `name` (String) Behavior name.
+-
+-### Read-Only
+-
+-- `settings` (Map of String) Map of behavior settings.
+-- `status` (String) Behavior status.
+-- `type` (String) Behavior type.
+-
+-
+diff --git a/docs/data-sources/behaviors.md b/docs/data-sources/behaviors.md
+deleted file mode 100644
+index a3649560..00000000
+--- a/docs/data-sources/behaviors.md
++++ /dev/null
+@@ -1,42 +0,0 @@
+----
+-page_title: "Data Source: okta_behaviors"
+-description: |-
+-  Get a behaviors by search criteria.
+----
+-
+-# Data Source: okta_behaviors
+-
+-Get a behaviors by search criteria.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_behaviors" "example" {
+-  q = "New"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Optional
+-
+-- `q` (String) Searches the name property of behaviors for matching value
+-
+-### Read-Only
+-
+-- `behaviors` (List of Object) (see [below for nested schema](#nestedatt--behaviors))
+-- `id` (String) The ID of this resource.
+-
+-<a id="nestedatt--behaviors"></a>
+-### Nested Schema for `behaviors`
+-
+-Read-Only:
+-
+-- `id` (String)
+-- `name` (String)
+-- `settings` (Map of String)
+-- `status` (String)
+-- `type` (String)
+-
+-
+diff --git a/docs/data-sources/brand.md b/docs/data-sources/brand.md
+deleted file mode 100644
+index 3eab1804..00000000
+--- a/docs/data-sources/brand.md
++++ /dev/null
+@@ -1,41 +0,0 @@
+----
+-page_title: "Data Source: okta_brand"
+-description: |-
+-  Get a single Brand from Okta.
+----
+-
+-# Data Source: okta_brand
+-
+-Get a single Brand from Okta.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_brands" "test" {
+-}
+-
+-data "okta_brand" "test" {
+-  brand_id = tolist(data.okta_brands.test.brands)[0].id
+-}
+-
+-data "okta_brand" "default" {
+-  brand_id = "default"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `brand_id` (String) Brand ID
+-
+-### Read-Only
+-
+-- `custom_privacy_policy_url` (String) Custom privacy policy URL
+-- `id` (String) The ID of the Brand
+-- `links` (String) Link relations for this object - JSON HAL - Discoverable resources related to the brand
+-- `name` (String) Brand name
+-- `remove_powered_by_okta` (Boolean) Removes "Powered by Okta" from the Okta-hosted sign-in page and "© 2021 Okta, Inc." from the Okta End-User Dashboard
+-
+-
+diff --git a/docs/data-sources/brands.md b/docs/data-sources/brands.md
+deleted file mode 100644
+index 82208304..00000000
+--- a/docs/data-sources/brands.md
++++ /dev/null
+@@ -1,37 +0,0 @@
+----
+-page_title: "Data Source: okta_brands"
+-description: |-
+-  Get the brands belonging to an Okta organization.
+----
+-
+-# Data Source: okta_brands
+-
+-Get the brands belonging to an Okta organization.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_brands" "test" {
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Read-Only
+-
+-- `brands` (Set of Object) List of `okta_brand` belonging to the organization (see [below for nested schema](#nestedatt--brands))
+-- `id` (String) The ID of this resource.
+-
+-<a id="nestedatt--brands"></a>
+-### Nested Schema for `brands`
+-
+-Read-Only:
+-
+-- `custom_privacy_policy_url` (String)
+-- `id` (String)
+-- `links` (String)
+-- `name` (String)
+-- `remove_powered_by_okta` (Boolean)
+-
+-
+diff --git a/docs/data-sources/default_policy.md b/docs/data-sources/default_policy.md
+deleted file mode 100644
+index bf8218c8..00000000
+--- a/docs/data-sources/default_policy.md
++++ /dev/null
+@@ -1,32 +0,0 @@
+----
+-page_title: "Data Source: okta_default_policy"
+-description: |-
+-  Get a Default policy from Okta.
+----
+-
+-# Data Source: okta_default_policy
+-
+-Use this data source to retrieve a default policy from Okta. This 
+-same thing can be achieved using the `okta_policy` with default 
+-names, this is simply a shortcut.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_default_policy" "example" {
+-  type = "PASSWORD"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `type` (String) Policy type: OKTA_SIGN_ON, PASSWORD, MFA_ENROLL, or IDP_DISCOVERY
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-
+diff --git a/docs/data-sources/default_signin_page.md b/docs/data-sources/default_signin_page.md
+deleted file mode 100644
+index 063a38eb..00000000
+--- a/docs/data-sources/default_signin_page.md
++++ /dev/null
+@@ -1,65 +0,0 @@
+----
+-page_title: "Data Source: okta_default_signin_page"
+-description: |-
+-  Retrieve the default signin page of a brand
+----
+-
+-# Data Source: okta_default_signin_page
+-
+-Retrieve the default signin page of a brand
+-
+-
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `brand_id` (String) brand id of the preview signin page
+-
+-### Read-Only
+-
+-- `content_security_policy_setting` (Block, Read-only) (see [below for nested schema](#nestedblock--content_security_policy_setting))
+-- `id` (String) placeholder id
+-- `page_content` (String) page content of the preview signin page
+-- `widget_customizations` (Block, Read-only) (see [below for nested schema](#nestedblock--widget_customizations))
+-- `widget_version` (String) widget version specified as a Semver
+-
+-<a id="nestedblock--content_security_policy_setting"></a>
+-### Nested Schema for `content_security_policy_setting`
+-
+-Read-Only:
+-
+-- `mode` (String) enforced or report_only
+-- `report_uri` (String)
+-- `src_list` (List of String)
+-
+-
+-<a id="nestedblock--widget_customizations"></a>
+-### Nested Schema for `widget_customizations`
+-
+-Read-Only:
+-
+-- `authenticator_page_custom_link_label` (String)
+-- `authenticator_page_custom_link_url` (String)
+-- `classic_recovery_flow_email_or_username_label` (String)
+-- `custom_link_1_label` (String)
+-- `custom_link_1_url` (String)
+-- `custom_link_2_label` (String)
+-- `custom_link_2_url` (String)
+-- `forgot_password_label` (String)
+-- `forgot_password_url` (String)
+-- `help_label` (String)
+-- `help_url` (String)
+-- `password_info_tip` (String)
+-- `password_label` (String)
+-- `show_password_visibility_toggle` (Boolean)
+-- `show_user_identifier` (Boolean)
+-- `sign_in_label` (String)
+-- `unlock_account_label` (String)
+-- `unlock_account_url` (String)
+-- `username_info_tip` (String)
+-- `username_label` (String)
+-- `widget_generation` (String)
+-
+-
+diff --git a/docs/data-sources/domain.md b/docs/data-sources/domain.md
+deleted file mode 100644
+index 4a222866..00000000
+--- a/docs/data-sources/domain.md
++++ /dev/null
+@@ -1,57 +0,0 @@
+----
+-page_title: "Data Source: okta_domain"
+-description: |-
+-  Get a domain from Okta.
+----
+-
+-# Data Source: okta_domain
+-
+-Get a domain from Okta.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_domain" "example" {
+-  name = "www.example.com"
+-}
+-
+-data "okta_domain" "by-name" {
+-  domain_id_or_name = "www.example.com"
+-
+-  depends_on = [
+-    okta_domain.example
+-  ]
+-}
+-
+-data "okta_domain" "by-id" {
+-  domain_id_or_name = okta_domain.example.id
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `domain_id_or_name` (String) Brand ID
+-
+-### Read-Only
+-
+-- `certificate_source_type` (String) Certificate source type that indicates whether the certificate is provided by the user or Okta. Values: MANUAL, OKTA_MANAGED
+-- `dns_records` (List of Object) TXT and CNAME records to be registered for the Domain (see [below for nested schema](#nestedatt--dns_records))
+-- `domain` (String) Domain name
+-- `id` (String) The ID of the Domain
+-- `public_certificate` (Map of String) Certificate metadata for the Domain
+-- `validation_status` (String) Status of the domain. Values: NOT_STARTED, IN_PROGRESS, VERIFIED, COMPLETED
+-
+-<a id="nestedatt--dns_records"></a>
+-### Nested Schema for `dns_records`
+-
+-Read-Only:
+-
+-- `expiration` (String)
+-- `fqdn` (String)
+-- `record_type` (String)
+-- `values` (List of String)
+-
+-
+diff --git a/docs/data-sources/email_customization.md b/docs/data-sources/email_customization.md
+deleted file mode 100644
+index 319d4cb2..00000000
+--- a/docs/data-sources/email_customization.md
++++ /dev/null
+@@ -1,47 +0,0 @@
+----
+-page_title: "Data Source: okta_email_customization"
+-description: |-
+-  Get the email customization of an email template belonging to a brand in an Okta organization.
+----
+-
+-# Data Source: okta_email_customization
+-
+-Get the email customization of an email template belonging to a brand in an Okta organization.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_brands" "test" {
+-}
+-
+-data "okta_email_customizations" "forgot_password" {
+-  brand_id      = tolist(data.okta_brands.test.brands)[0].id
+-  template_name = "ForgotPassword"
+-}
+-
+-data "okta_email_customization" "forgot_password_en" {
+-  brand_id         = tolist(data.okta_brands.test.brands)[0].id
+-  template_name    = "ForgotPassword"
+-  customization_id = tolist(data.okta_email_customizations.forgot_password.email_customizations)[0].id
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `brand_id` (String) Brand ID
+-- `customization_id` (String) The ID of the customization
+-- `template_name` (String) Template Name
+-
+-### Read-Only
+-
+-- `body` (String) The body of the customization
+-- `id` (String) The ID of the customization
+-- `is_default` (Boolean) Whether the customization is the default
+-- `language` (String) The language supported by the customization
+-- `links` (String) Link relations for this object - JSON HAL - Discoverable resources related to the email template
+-- `subject` (String) The subject of the customization
+-
+-
+diff --git a/docs/data-sources/email_customizations.md b/docs/data-sources/email_customizations.md
+deleted file mode 100644
+index afa6bc6a..00000000
+--- a/docs/data-sources/email_customizations.md
++++ /dev/null
+@@ -1,48 +0,0 @@
+----
+-page_title: "Data Source: okta_email_customizations"
+-description: |-
+-  Get the email customizations of an email template belonging to a brand in an Okta organization.
+----
+-
+-# Data Source: okta_email_customizations
+-
+-Get the email customizations of an email template belonging to a brand in an Okta organization.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_brands" "test" {
+-}
+-
+-data "okta_email_customizations" "forgot_password" {
+-  brand_id      = tolist(data.okta_brands.test.brands)[0].id
+-  template_name = "ForgotPassword"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `brand_id` (String) Brand ID
+-- `template_name` (String) Template Name
+-
+-### Read-Only
+-
+-- `email_customizations` (Set of Object) List of `okta_email_customization` belonging to the named email template of the brand in the organization (see [below for nested schema](#nestedatt--email_customizations))
+-- `id` (String) The ID of this resource.
+-
+-<a id="nestedatt--email_customizations"></a>
+-### Nested Schema for `email_customizations`
+-
+-Read-Only:
+-
+-- `body` (String)
+-- `id` (String)
+-- `is_default` (Boolean)
+-- `language` (String)
+-- `links` (String)
+-- `subject` (String)
+-
+-
+diff --git a/docs/data-sources/email_template.md b/docs/data-sources/email_template.md
+deleted file mode 100644
+index bbac5e0f..00000000
+--- a/docs/data-sources/email_template.md
++++ /dev/null
+@@ -1,36 +0,0 @@
+----
+-page_title: "Data Source: okta_email_template"
+-description: |-
+-  Get a single Email Template for a Brand belonging to an Okta organization.
+----
+-
+-# Data Source: okta_email_template
+-
+-Get a single Email Template for a Brand belonging to an Okta organization.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_brands" "test" {
+-}
+-
+-data "okta_email_template" "forgot_password" {
+-  brand_id = tolist(data.okta_brands.test.brands)[0].id
+-  name     = "ForgotPassword"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `brand_id` (String) Brand ID
+-- `name` (String) The name of the email template
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-- `links` (String) Link relations for this object - JSON HAL - Discoverable resources related to the email template
+-
+-
+diff --git a/docs/data-sources/email_templates.md b/docs/data-sources/email_templates.md
+deleted file mode 100644
+index 620f7496..00000000
+--- a/docs/data-sources/email_templates.md
++++ /dev/null
+@@ -1,42 +0,0 @@
+----
+-page_title: "Data Source: okta_email_templates"
+-description: |-
+-  Get the email templates belonging to a brand in an Okta organization.
+----
+-
+-# Data Source: okta_email_templates
+-
+-Get the email templates belonging to a brand in an Okta organization.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_brands" "test" {
+-}
+-
+-data "okta_email_templates" "test" {
+-  brand_id = tolist(data.okta_brands.test.brands)[0].id
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `brand_id` (String) Brand ID
+-
+-### Read-Only
+-
+-- `email_templates` (Set of Object) List of `okta_email_template` belonging to a brand in the organization (see [below for nested schema](#nestedatt--email_templates))
+-- `id` (String) The ID of this resource.
+-
+-<a id="nestedatt--email_templates"></a>
+-### Nested Schema for `email_templates`
+-
+-Read-Only:
+-
+-- `links` (String)
+-- `name` (String)
+-
+-
+diff --git a/docs/data-sources/everyone_group.md b/docs/data-sources/everyone_group.md
+deleted file mode 100644
+index 00a4eba9..00000000
+--- a/docs/data-sources/everyone_group.md
++++ /dev/null
+@@ -1,31 +0,0 @@
+----
+-page_title: "Data Source: okta_everyone_group"
+-description: |-
+-  Get the Everyone group from Okta.
+----
+-
+-# Data Source: okta_everyone_group
+-
+-Use this data source to retrieve the `Everyone` group from Okta. The 
+-same can be achieved with the `okta_group` data
+-source with `name = "Everyone"`. This is simply a shortcut.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_everyone_group" "example" {}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Optional
+-
+-- `include_users` (Boolean) Fetch group users, having default off cuts down on API calls.
+-
+-### Read-Only
+-
+-- `description` (String) Description of group.
+-- `id` (String) The ID of this resource.
+-
+-
+diff --git a/docs/data-sources/group.md b/docs/data-sources/group.md
+deleted file mode 100644
+index 5e5cf2db..00000000
+--- a/docs/data-sources/group.md
++++ /dev/null
+@@ -1,35 +0,0 @@
+----
+-page_title: "Data Source: okta_group"
+-description: |-
+-  Get a group from Okta.
+----
+-
+-# Data Source: okta_group
+-
+-Get a group from Okta.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_group" "example" {
+-  name = "Example App"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Optional
+-
+-- `delay_read_seconds` (String) Force delay of the group read by N seconds. Useful when eventual consistency of group information needs to be allowed for; for instance, when group rules are known to have been applied.
+-- `id` (String) ID of group.
+-- `include_users` (Boolean) Fetch group users, having default off cuts down on API calls.
+-- `name` (String) Name of group.
+-- `type` (String) Type of the group. When specified in the terraform resource, will act as a filter when searching for the group
+-
+-### Read-Only
+-
+-- `description` (String) Description of group.
+-- `users` (Set of String) Users associated with the group. This can also be done per user.
+-
+-
+diff --git a/docs/data-sources/group_rule.md b/docs/data-sources/group_rule.md
+deleted file mode 100644
+index f548128b..00000000
+--- a/docs/data-sources/group_rule.md
++++ /dev/null
+@@ -1,35 +0,0 @@
+----
+-page_title: "Data Source: okta_group_rule"
+-description: |-
+-  Get a group rule from Okta.
+----
+-
+-# Data Source: okta_group_rule
+-
+-Get a group rule from Okta.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_group_rule" "test" {
+-  id = okta_group_rule.example.id
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Optional
+-
+-- `id` (String) The ID of the Group Rule.
+-- `name` (String) The name of the Group Rule.
+-- `status` (String) Default to `ACTIVE`
+-
+-### Read-Only
+-
+-- `expression_type` (String) The expression type to use to invoke the rule.
+-- `expression_value` (String) The expression value.
+-- `group_assignments` (Set of String) The list of group ids to assign the users to.
+-- `users_excluded` (Set of String) The list of user IDs that would be excluded when rules are processed.
+-
+-
+diff --git a/docs/data-sources/groups.md b/docs/data-sources/groups.md
+deleted file mode 100644
+index 601054a0..00000000
+--- a/docs/data-sources/groups.md
++++ /dev/null
+@@ -1,44 +0,0 @@
+----
+-page_title: "Data Source: okta_groups"
+-description: |-
+-  Get a list of groups from Okta.
+----
+-
+-# Data Source: okta_groups
+-
+-Get a list of groups from Okta.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_groups" "example" {
+-  q = "Engineering - "
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Optional
+-
+-- `q` (String) Searches the name property of groups for matching value
+-- `search` (String) Searches for groups with a supported filtering expression for all attributes except for '_embedded', '_links', and 'objectClass'
+-- `type` (String) Type of the group. When specified in the terraform resource, will act as a filter when searching for the groups
+-
+-### Read-Only
+-
+-- `groups` (List of Object) (see [below for nested schema](#nestedatt--groups))
+-- `id` (String) The ID of this resource.
+-
+-<a id="nestedatt--groups"></a>
+-### Nested Schema for `groups`
+-
+-Read-Only:
+-
+-- `custom_profile_attributes` (String)
+-- `description` (String)
+-- `id` (String)
+-- `name` (String)
+-- `type` (String)
+-
+-
+diff --git a/docs/data-sources/idp_metadata_saml.md b/docs/data-sources/idp_metadata_saml.md
+deleted file mode 100644
+index 6bd46f7d..00000000
+--- a/docs/data-sources/idp_metadata_saml.md
++++ /dev/null
+@@ -1,38 +0,0 @@
+----
+-page_title: "Data Source: okta_idp_metadata_saml"
+-description: |-
+-  Get SAML IdP metadata from Okta.
+----
+-
+-# Data Source: okta_idp_metadata_saml
+-
+-Get SAML IdP metadata from Okta.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_idp_metadata_saml" "example" {
+-  idp_id = "<idp id>"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Optional
+-
+-- `idp_id` (String) The id of the IdP to retrieve metadata for.
+-
+-### Read-Only
+-
+-- `assertions_signed` (Boolean) Whether assertions are signed.
+-- `authn_request_signed` (Boolean) Whether authn requests are signed.
+-- `encryption_certificate` (String) SAML request encryption certificate.
+-- `entity_id` (String) Entity URL for instance https://www.okta.com/saml2/service-provider/sposcfdmlybtwkdcgtuf
+-- `http_post_binding` (String) urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Post location from the SAML metadata.
+-- `http_redirect_binding` (String) urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect location from the SAML metadata.
+-- `id` (String) The ID of this resource.
+-- `metadata` (String) Raw IdP metadata.
+-- `signing_certificate` (String) SAML request signing certificate.
+-
+-
+diff --git a/docs/data-sources/idp_oidc.md b/docs/data-sources/idp_oidc.md
+deleted file mode 100644
+index 71a25324..00000000
+--- a/docs/data-sources/idp_oidc.md
++++ /dev/null
+@@ -1,46 +0,0 @@
+----
+-page_title: "Data Source: okta_idp_oidc"
+-description: |-
+-  Get a OIDC IdP from Okta.
+----
+-
+-# Data Source: okta_idp_oidc
+-
+-Get a OIDC IdP from Okta.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_idp_oidc" "example" {
+-  name = "Example Provider"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Optional
+-
+-- `id` (String) Id of idp.
+-- `name` (String) Name of the idp.
+-
+-### Read-Only
+-
+-- `authorization_binding` (String) The method of making an authorization request.
+-- `authorization_url` (String) IdP Authorization Server (AS) endpoint to request consent from the user and obtain an authorization code grant.
+-- `client_id` (String) Unique identifier issued by AS for the Okta IdP instance.
+-- `client_secret` (String, Sensitive) Client secret issued by AS for the Okta IdP instance.
+-- `issuer_mode` (String) Indicates whether Okta uses the original Okta org domain URL, a custom domain URL, or dynamic.
+-- `issuer_url` (String) URI that identifies the issuer.
+-- `jwks_binding` (String) The method of making a request for the OIDC JWKS.
+-- `jwks_url` (String) Endpoint where the keys signer publishes its keys in a JWK Set.
+-- `max_clock_skew` (Number) Maximum allowable clock-skew when processing messages from the IdP.
+-- `protocol_type` (String) The type of protocol to use.
+-- `scopes` (Set of String) The scopes of the IdP.
+-- `token_binding` (String) The method of making a token request.
+-- `token_url` (String) IdP Authorization Server (AS) endpoint to exchange the authorization code grant for an access token.
+-- `type` (String) Type of idp.
+-- `user_info_binding` (String) The method of making a user info request.
+-- `user_info_url` (String) Protected resource endpoint that returns claims about the authenticated user.
+-
+-
+diff --git a/docs/data-sources/idp_saml.md b/docs/data-sources/idp_saml.md
+deleted file mode 100644
+index a4bff2f3..00000000
+--- a/docs/data-sources/idp_saml.md
++++ /dev/null
+@@ -1,42 +0,0 @@
+----
+-page_title: "Data Source: okta_idp_saml"
+-description: |-
+-  Get a SAML IdP from Okta.
+----
+-
+-# Data Source: okta_idp_saml
+-
+-Get a SAML IdP from Okta.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_idp_saml" "example" {
+-  name = "Example App"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Optional
+-
+-- `id` (String) Id of idp.
+-- `name` (String) Name of the idp.
+-
+-### Read-Only
+-
+-- `acs_binding` (String) ACS binding
+-- `acs_type` (String) Determines whether to publish an instance-specific (trust) or organization (shared) ACS endpoint in the SAML metadata.
+-- `audience` (String) URI that identifies the target Okta IdP instance (SP)
+-- `issuer` (String) URI that identifies the issuer (IdP).
+-- `issuer_mode` (String) Indicates whether Okta uses the original Okta org domain URL, or a custom domain URL in the request to the IdP.
+-- `kid` (String) Key ID reference to the IdP's X.509 signature certificate.
+-- `sso_binding` (String) Single sign-on binding.
+-- `sso_destination` (String) SSO request binding, HTTP-POST or HTTP-REDIRECT.
+-- `sso_url` (String) Single sign-on url.
+-- `subject_filter` (String) Regular expression pattern used to filter untrusted IdP usernames.
+-- `subject_format` (Set of String) Expression to generate or transform a unique username for the IdP user.
+-- `type` (String) Type of idp.
+-
+-
+diff --git a/docs/data-sources/idp_social.md b/docs/data-sources/idp_social.md
+deleted file mode 100644
+index 24a222a1..00000000
+--- a/docs/data-sources/idp_social.md
++++ /dev/null
+@@ -1,55 +0,0 @@
+----
+-page_title: "Data Source: okta_idp_social"
+-description: |-
+-  Get a social IdP from Okta.
+----
+-
+-# Data Source: okta_idp_social
+-
+-Get a social IdP from Okta.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_idp_social" "example" {
+-  name = "My Facebook IdP"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Optional
+-
+-- `id` (String) The id of the social idp to retrieve, conflicts with `name`.
+-- `name` (String) The name of the social idp to retrieve, conflicts with `id`.
+-
+-### Read-Only
+-
+-- `account_link_action` (String) Specifies the account linking action for an IdP user.
+-- `account_link_group_include` (Set of String) Group memberships to determine link candidates.
+-- `authorization_binding` (String) The method of making an authorization request.
+-- `authorization_url` (String) IdP Authorization Server (AS) endpoint to request consent from the user and obtain an authorization code grant.
+-- `client_id` (String) Unique identifier issued by AS for the Okta IdP instance.
+-- `client_secret` (String, Sensitive) Client secret issued by AS for the Okta IdP instance.
+-- `deprovisioned_action` (String) Action for a previously deprovisioned IdP user during authentication.
+-- `groups_action` (String) Provisioning action for IdP user's group memberships.
+-- `groups_assignment` (Set of String) List of Okta Group IDs.
+-- `groups_attribute` (String) IdP user profile attribute name for an array value that contains group memberships.
+-- `groups_filter` (Set of String) Whitelist of Okta Group identifiers.
+-- `issuer_mode` (String) Indicates whether Okta uses the original Okta org domain URL, or a custom domain URL.
+-- `max_clock_skew` (Number) Maximum allowable clock-skew when processing messages from the IdP.
+-- `profile_master` (Boolean) Determines if the IdP should act as a source of truth for user profile attributes.
+-- `protocol_type` (String) The type of protocol to use.
+-- `provisioning_action` (String) Provisioning action for an IdP user during authentication.
+-- `scopes` (Set of String) The scopes of the IdP.
+-- `status` (String) Status of the IdP.
+-- `subject_match_attribute` (String) Okta user profile attribute for matching transformed IdP username.
+-- `subject_match_type` (String) Determines the Okta user profile attribute match conditions for account linking and authentication of the transformed IdP username.
+-- `suspended_action` (String) Action for a previously suspended IdP user during authentication.
+-- `token_binding` (String) The method of making a token request.
+-- `token_url` (String) IdP Authorization Server (AS) endpoint to exchange the authorization code grant for an access token.
+-- `type` (String) The type of Social IdP. See API docs [Identity Provider Type](https://developer.okta.com/docs/reference/api/idps/#identity-provider-type)
+-- `username_template` (String) Okta EL Expression to generate or transform a unique username for the IdP user.
+-
+-
+diff --git a/docs/data-sources/log_stream.md b/docs/data-sources/log_stream.md
+deleted file mode 100644
+index e3772676..00000000
+--- a/docs/data-sources/log_stream.md
++++ /dev/null
+@@ -1,39 +0,0 @@
+----
+-page_title: "Data Source: okta_log_stream"
+-description: |-
+-  Log Streams
+----
+-
+-# Data Source: okta_log_stream
+-
+-Log Streams
+-
+-
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Optional
+-
+-- `id` (String) ID of the log stream to retrieve, conflicts with `name`.
+-- `name` (String) Unique name for the Log Stream object, conflicts with `id`.
+-
+-### Read-Only
+-
+-- `settings` (Block, Read-only) (see [below for nested schema](#nestedblock--settings))
+-- `status` (String) Log Stream Status - can either be ACTIVE or INACTIVE only
+-- `type` (String) Streaming provider used - aws_eventbridge or splunk_cloud_logstreaming
+-
+-<a id="nestedblock--settings"></a>
+-### Nested Schema for `settings`
+-
+-Read-Only:
+-
+-- `account_id` (String) AWS account ID. Required only for 'aws_eventbridge' type
+-- `edition` (String) Edition of the Splunk Cloud instance. Could be one of: 'aws', 'aws_govcloud', 'gcp'. Required only for 'splunk_cloud_logstreaming' type
+-- `event_source_name` (String) An alphanumeric name (no spaces) to identify this event source in AWS EventBridge. Required only for 'aws_eventbridge' type
+-- `host` (String) The domain name for Splunk Cloud instance. Don't include http or https in the string. For example: 'acme.splunkcloud.com'. Required only for 'splunk_cloud_logstreaming' type
+-- `region` (String) The destination AWS region where event source is located. Required only for 'aws_eventbridge' type
+-- `token` (String) The HEC token for your Splunk Cloud HTTP Event Collector. Required only for 'splunk_cloud_logstreaming' type
+-
+-
+diff --git a/docs/data-sources/network_zone.md b/docs/data-sources/network_zone.md
+deleted file mode 100644
+index 7960f9a2..00000000
+--- a/docs/data-sources/network_zone.md
++++ /dev/null
+@@ -1,38 +0,0 @@
+----
+-page_title: "Data Source: okta_network_zone"
+-description: |-
+-  Gets Okta Network Zone.
+----
+-
+-# Data Source: okta_network_zone
+-
+-Gets Okta Network Zone.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_network_zone" "example" {
+-  name = "Block Antarctica"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Optional
+-
+-- `id` (String) ID of the network zone to retrieve, conflicts with `name`.
+-- `name` (String) Name of the network zone to retrieve, conflicts with `id`.
+-
+-### Read-Only
+-
+-- `asns` (Set of String) Format of each array value: a string representation of an ASN numeric value
+-- `dynamic_locations` (Set of String) Array of locations ISO-3166-1(2). Format code: countryCode OR countryCode-regionCode
+-- `dynamic_proxy_type` (String) Type of proxy being controlled by this network zone
+-- `gateways` (Set of String) Array of values in CIDR/range form depending on the way it's been declared (i.e. CIDR will contain /suffix). Please check API docs for examples
+-- `proxies` (Set of String) Array of values in CIDR/range form depending on the way it's been declared (i.e. CIDR will contain /suffix). Please check API docs for examples
+-- `status` (String) Network Status - can either be ACTIVE or INACTIVE only
+-- `type` (String) Type of the Network Zone - can either be IP or DYNAMIC only
+-- `usage` (String) Zone's purpose: POLICY or BLOCKLIST
+-
+-
+diff --git a/docs/data-sources/org_metadata.md b/docs/data-sources/org_metadata.md
+deleted file mode 100644
+index f4a2c1fc..00000000
+--- a/docs/data-sources/org_metadata.md
++++ /dev/null
+@@ -1,41 +0,0 @@
+----
+-page_title: "Data Source: okta_org_metadata"
+-description: |-
+-  Retrieves the well-known org metadata, which includes the id, configured custom domains, authentication pipeline, and various other org settings.
+----
+-
+-# Data Source: okta_org_metadata
+-
+-Retrieves the well-known org metadata, which includes the id, configured custom domains, authentication pipeline, and various other org settings.
+-
+-
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Read-Only
+-
+-- `domains` (Block, Read-only) The URIs for the org's configured domains. (see [below for nested schema](#nestedblock--domains))
+-- `id` (String) The unique identifier of the Org.
+-- `pipeline` (String) The authentication pipeline of the org. idx means the org is using the Identity Engine, while v1 means the org is using the Classic authentication pipeline.
+-- `settings` (Block, Read-only) The wellknown org settings (safe for public consumption). (see [below for nested schema](#nestedblock--settings))
+-
+-<a id="nestedblock--domains"></a>
+-### Nested Schema for `domains`
+-
+-Read-Only:
+-
+-- `alternate` (String) Custom Domain Org URI
+-- `organization` (String) Standard Org URI
+-
+-
+-<a id="nestedblock--settings"></a>
+-### Nested Schema for `settings`
+-
+-Read-Only:
+-
+-- `analytics_collection_enabled` (Boolean)
+-- `bug_reporting_enabled` (Boolean)
+-- `om_enabled` (Boolean) Whether the legacy Okta Mobile application is enabled for the org
+-
+-
+diff --git a/docs/data-sources/policy.md b/docs/data-sources/policy.md
+deleted file mode 100644
+index 3cd3c4de..00000000
+--- a/docs/data-sources/policy.md
++++ /dev/null
+@@ -1,33 +0,0 @@
+----
+-page_title: "Data Source: okta_policy"
+-description: |-
+-  Get a policy from Okta.
+----
+-
+-# Data Source: okta_policy
+-
+-Get a policy from Okta.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_policy" "example" {
+-  name = "Password Policy Example"
+-  type = "PASSWORD"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `name` (String) Name of the policy
+-- `type` (String) Policy type, see https://developer.okta.com/docs/reference/api/policy/#policy-object
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-- `status` (String) Status of the policy
+-
+-
+diff --git a/docs/data-sources/role_subscription.md b/docs/data-sources/role_subscription.md
+deleted file mode 100644
+index 5a06fa53..00000000
+--- a/docs/data-sources/role_subscription.md
++++ /dev/null
+@@ -1,33 +0,0 @@
+----
+-page_title: "Data Source: okta_role_subscription"
+-description: |-
+-  Get subscriptions of a Role with a specific type
+----
+-
+-# Data Source: okta_role_subscription
+-
+-Get subscriptions of a Role with a specific type
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_role_subscription" "example" {
+-  notification_type = "APP_IMPORT"
+-  role_type         = "SUPER_ADMIN"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `notification_type` (String) Type of the notification
+-- `role_type` (String) Type of the role
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-- `status` (String) Status of subscription
+-
+-
+diff --git a/docs/data-sources/theme.md b/docs/data-sources/theme.md
+deleted file mode 100644
+index b5eaab6c..00000000
+--- a/docs/data-sources/theme.md
++++ /dev/null
+@@ -1,47 +0,0 @@
+----
+-page_title: "Data Source: okta_theme"
+-description: |-
+-  Get a single Theme of a Brand of an Okta Organization.
+----
+-
+-# Data Source: okta_theme
+-
+-Get a single Theme of a Brand of an Okta Organization.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_brands" "test" {
+-}
+-
+-data "okta_theme" "test" {
+-  brand_id = tolist(data.okta_brands.test.brands)[0].id
+-  theme_id = tolist(data.okta_themes.test.themes)[0].id
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `brand_id` (String) Brand ID
+-- `theme_id` (String) Theme ID
+-
+-### Read-Only
+-
+-- `background_image_url` (String) Background image URL
+-- `email_template_touch_point_variant` (String) Variant for email templates (`OKTA_DEFAULT`, `FULL_THEME`)
+-- `end_user_dashboard_touch_point_variant` (String) Variant for the Okta End-User Dashboard (`OKTA_DEFAULT`, `WHITE_LOGO_BACKGROUND`, `FULL_THEME`, `LOGO_ON_FULL_WHITE_BACKGROUND`)
+-- `error_page_touch_point_variant` (String) Variant for the error page (`OKTA_DEFAULT`, `BACKGROUND_SECONDARY_COLOR`, `BACKGROUND_IMAGE`)
+-- `favicon_url` (String) Favicon URL
+-- `id` (String) The ID of the theme
+-- `links` (String) Link relations for this object - JSON HAL - Discoverable resources related to the email template
+-- `logo_url` (String) Logo URL
+-- `primary_color_contrast_hex` (String) Primary color contrast hex code
+-- `primary_color_hex` (String) Primary color hex code
+-- `secondary_color_contrast_hex` (String) Secondary color contrast hex code
+-- `secondary_color_hex` (String) Secondary color hex code
+-- `sign_in_page_touch_point_variant` (String) Variant for the Okta Sign-In Page (`OKTA_DEFAULT`, `BACKGROUND_SECONDARY_COLOR`, `BACKGROUND_IMAGE`)
+-
+-
+diff --git a/docs/data-sources/themes.md b/docs/data-sources/themes.md
+deleted file mode 100644
+index 431fa452..00000000
+--- a/docs/data-sources/themes.md
++++ /dev/null
+@@ -1,53 +0,0 @@
+----
+-page_title: "Data Source: okta_themes"
+-description: |-
+-  Get Themes of a Brand of an Okta Organization.
+----
+-
+-# Data Source: okta_themes
+-
+-Get Themes of a Brand of an Okta Organization.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_brands" "test" {
+-}
+-
+-data "okta_themes" "example" {
+-  brand_id = tolist(data.okta_brands.test.brands)[0].id
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `brand_id` (String) Brand ID
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-- `themes` (Set of Object) List of `okta_them` belonging to the brand in the organization (see [below for nested schema](#nestedatt--themes))
+-
+-<a id="nestedatt--themes"></a>
+-### Nested Schema for `themes`
+-
+-Read-Only:
+-
+-- `background_image_url` (String)
+-- `email_template_touch_point_variant` (String)
+-- `end_user_dashboard_touch_point_variant` (String)
+-- `error_page_touch_point_variant` (String)
+-- `favicon_url` (String)
+-- `id` (String)
+-- `links` (String)
+-- `logo_url` (String)
+-- `primary_color_contrast_hex` (String)
+-- `primary_color_hex` (String)
+-- `secondary_color_contrast_hex` (String)
+-- `secondary_color_hex` (String)
+-- `sign_in_page_touch_point_variant` (String)
+-
+-
+diff --git a/docs/data-sources/trusted_origins.md b/docs/data-sources/trusted_origins.md
+deleted file mode 100644
+index d7b62def..00000000
+--- a/docs/data-sources/trusted_origins.md
++++ /dev/null
+@@ -1,41 +0,0 @@
+----
+-page_title: "Data Source: okta_trusted_origins"
+-description: |-
+-  Get List of Trusted Origins using filters.
+----
+-
+-# Data Source: okta_trusted_origins
+-
+-Get List of Trusted Origins using filters.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_trusted_origins" "all" {
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Optional
+-
+-- `filter` (String) Filter criteria. Filter value will be URL-encoded by the provider
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-- `trusted_origins` (List of Object) (see [below for nested schema](#nestedatt--trusted_origins))
+-
+-<a id="nestedatt--trusted_origins"></a>
+-### Nested Schema for `trusted_origins`
+-
+-Read-Only:
+-
+-- `active` (Boolean)
+-- `id` (String)
+-- `name` (String)
+-- `origin` (String)
+-- `scopes` (List of String)
+-
+-
+diff --git a/docs/data-sources/user.md b/docs/data-sources/user.md
+deleted file mode 100644
+index 86306788..00000000
+--- a/docs/data-sources/user.md
++++ /dev/null
+@@ -1,102 +0,0 @@
+----
+-page_title: "Data Source: okta_user"
+-description: |-
+-  Get a single users from Okta.
+----
+-
+-# Data Source: okta_user
+-
+-Get a single users from Okta.
+-
+-## Example Usage
+-
+-```terraform
+-# Get a single user by their id value
+-data "okta_user" "example" {
+-  user_id = "00u22mtxlrJ8YkzXQ357"
+-}
+-
+-# Search for a single user based on supported profile properties
+-data "okta_user" "example" {
+-  search {
+-    name  = "profile.firstName"
+-    value = "John"
+-  }
+-
+-  search {
+-    name  = "profile.lastName"
+-    value = "Doe"
+-  }
+-}
+-
+-# Search for a single user based on a raw search expression string
+-data "okta_user" "example" {
+-  search {
+-    expression = "profile.firstName eq \"John\""
+-  }
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Optional
+-
+-- `compound_search_operator` (String) Search operator used when joining multiple search clauses
+-- `delay_read_seconds` (String) Force delay of the user read by N seconds. Useful when eventual consistency of user information needs to be allowed for.
+-- `search` (Block Set) Filter to find user/users. Each filter will be concatenated with the compound search operator. Please be aware profile properties must match what is in Okta, which is likely camel case. Expression is a free form expression filter https://developer.okta.com/docs/reference/core-okta-api/#filter . The set name/value/comparison properties will be ignored if expression is present (see [below for nested schema](#nestedblock--search))
+-- `skip_groups` (Boolean) Do not populate user groups information (prevents additional API call)
+-- `skip_roles` (Boolean) Do not populate user roles information (prevents additional API call)
+-- `user_id` (String) Retrieve a single user based on their id
+-
+-### Read-Only
+-
+-- `admin_roles` (Set of String)
+-- `city` (String)
+-- `cost_center` (String)
+-- `country_code` (String)
+-- `custom_profile_attributes` (String)
+-- `department` (String)
+-- `display_name` (String)
+-- `division` (String)
+-- `email` (String)
+-- `employee_number` (String)
+-- `first_name` (String)
+-- `group_memberships` (Set of String)
+-- `honorific_prefix` (String)
+-- `honorific_suffix` (String)
+-- `id` (String) The ID of this resource.
+-- `last_name` (String)
+-- `locale` (String)
+-- `login` (String)
+-- `manager` (String)
+-- `manager_id` (String)
+-- `middle_name` (String)
+-- `mobile_phone` (String)
+-- `nick_name` (String)
+-- `organization` (String)
+-- `postal_address` (String)
+-- `preferred_language` (String)
+-- `primary_phone` (String)
+-- `profile_url` (String)
+-- `roles` (Set of String)
+-- `second_email` (String)
+-- `state` (String)
+-- `status` (String)
+-- `street_address` (String)
+-- `timezone` (String)
+-- `title` (String)
+-- `user_type` (String)
+-- `zip_code` (String)
+-
+-<a id="nestedblock--search"></a>
+-### Nested Schema for `search`
+-
+-Optional:
+-
+-- `comparison` (String)
+-- `expression` (String) A raw search expression string. This requires the search feature be on. Please see Okta documentation on their filter API for users. https://developer.okta.com/docs/api/resources/users#list-users-with-search
+-- `name` (String) Property name to search for. This requires the search feature be on. Please see Okta documentation on their filter API for users. https://developer.okta.com/docs/api/resources/users#list-users-with-search
+-- `value` (String)
+-
+-
+diff --git a/docs/data-sources/user_profile_mapping_source.md b/docs/data-sources/user_profile_mapping_source.md
+deleted file mode 100644
+index 677a8937..00000000
+--- a/docs/data-sources/user_profile_mapping_source.md
++++ /dev/null
+@@ -1,29 +0,0 @@
+----
+-page_title: "Data Source: okta_user_profile_mapping_source"
+-description: |-
+-  Get the base user Profile Mapping source or target from Okta.
+----
+-
+-# Data Source: okta_user_profile_mapping_source
+-
+-Get the base user Profile Mapping source or target from Okta.
+-
+--> **NOTE:** If using this resource with OAuth2 scopes, this resource 
+-requires `okta.profileMappings.read` scope.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_user_profile_mapping_source" "example" {}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Read-Only
+-
+-- `id` (String) ID of the source
+-- `name` (String) Name of source.
+-- `type` (String) Type of source.
+-
+-
+diff --git a/docs/data-sources/user_security_questions.md b/docs/data-sources/user_security_questions.md
+deleted file mode 100644
+index fb4e1708..00000000
+--- a/docs/data-sources/user_security_questions.md
++++ /dev/null
+@@ -1,48 +0,0 @@
+----
+-page_title: "Data Source: okta_user_security_questions"
+-description: |-
+-  
+----
+-
+-# Data Source: okta_user_security_questions
+-
+-
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_user" "example" {
+-  first_name = "John"
+-  last_name  = "Smith"
+-  login      = "john.smith@example.com"
+-  email      = "john.smith@example.com"
+-}
+-
+-data "okta_user_security_questions" "example" {
+-  user_id = okta_user.example.id
+-}
+-
+-// TODU
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `user_id` (String) ID of a Okta User
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-- `questions` (List of Object) (see [below for nested schema](#nestedatt--questions))
+-
+-<a id="nestedatt--questions"></a>
+-### Nested Schema for `questions`
+-
+-Read-Only:
+-
+-- `key` (String)
+-- `text` (String)
+-
+-
+diff --git a/docs/data-sources/user_type.md b/docs/data-sources/user_type.md
+deleted file mode 100644
+index 1cde9123..00000000
+--- a/docs/data-sources/user_type.md
++++ /dev/null
+@@ -1,32 +0,0 @@
+----
+-page_title: "Data Source: okta_user_type"
+-description: |-
+-  Get a user type from Okta.
+----
+-
+-# Data Source: okta_user_type
+-
+-Get a user type from Okta.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_user_type" "example" {
+-  name = "example"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `name` (String) Name of user type to retrieve.
+-
+-### Read-Only
+-
+-- `description` (String) Description of user type.
+-- `display_name` (String) Display name of user type.
+-- `id` (String) The ID of this resource.
+-
+-
+diff --git a/docs/data-sources/users.md b/docs/data-sources/users.md
+deleted file mode 100644
+index a18f05fe..00000000
+--- a/docs/data-sources/users.md
++++ /dev/null
+@@ -1,119 +0,0 @@
+----
+-page_title: "Data Source: okta_users"
+-description: |-
+-  Get a list of users from Okta.
+----
+-
+-# Data Source: okta_users
+-
+-Get a list of users from Okta.
+-
+-## Example Usage
+-
+-```terraform
+-### Lookup Users by Search Criteria
+-
+-data "okta_users" "example" {
+-  search {
+-    name       = "profile.company"
+-    value      = "Articulate"
+-    comparison = "sw"
+-  }
+-}
+-
+-# Search for multiple users based on a raw search expression string
+-data "okta_users" "example" {
+-  search {
+-    expression = "profile.department eq \"Engineering\" and (created lt \"2014-01-01T00:00:00.000Z\" or status eq \"ACTIVE\")"
+-  }
+-}
+-
+-### Lookup Users by Group Membership
+-
+-resource "okta_group" "example" {
+-  name = "example-group"
+-}
+-
+-data "okta_users" "example" {
+-  group_id = okta_group.example.id
+-
+-  # optionally include each user's group membership
+-  include_groups = true
+-
+-  # optionally include each user's administrator roles
+-  include_roles = true
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Optional
+-
+-- `compound_search_operator` (String) Search operator used when joining multiple search clauses
+-- `delay_read_seconds` (String) Force delay of the users read by N seconds. Useful when eventual consistency of users information needs to be allowed for.
+-- `group_id` (String) Find users based on group membership using the id of the group.
+-- `include_groups` (Boolean) Fetch group memberships for each user
+-- `include_roles` (Boolean) Fetch user roles for each user
+-- `search` (Block Set) Filter to find user/users. Each filter will be concatenated with the compound search operator. Please be aware profile properties must match what is in Okta, which is likely camel case. Expression is a free form expression filter https://developer.okta.com/docs/reference/core-okta-api/#filter . The set name/value/comparison properties will be ignored if expression is present (see [below for nested schema](#nestedblock--search))
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-- `users` (List of Object) collection of users retrieved from Okta. (see [below for nested schema](#nestedatt--users))
+-
+-<a id="nestedblock--search"></a>
+-### Nested Schema for `search`
+-
+-Optional:
+-
+-- `comparison` (String)
+-- `expression` (String) A raw search expression string. This requires the search feature be on. Please see Okta documentation on their filter API for users. https://developer.okta.com/docs/api/resources/users#list-users-with-search
+-- `name` (String) Property name to search for. This requires the search feature be on. Please see Okta documentation on their filter API for users. https://developer.okta.com/docs/api/resources/users#list-users-with-search
+-- `value` (String)
+-
+-
+-<a id="nestedatt--users"></a>
+-### Nested Schema for `users`
+-
+-Read-Only:
+-
+-- `admin_roles` (Set of String)
+-- `city` (String)
+-- `cost_center` (String)
+-- `country_code` (String)
+-- `custom_profile_attributes` (String)
+-- `department` (String)
+-- `display_name` (String)
+-- `division` (String)
+-- `email` (String)
+-- `employee_number` (String)
+-- `first_name` (String)
+-- `group_memberships` (Set of String)
+-- `honorific_prefix` (String)
+-- `honorific_suffix` (String)
+-- `id` (String)
+-- `last_name` (String)
+-- `locale` (String)
+-- `login` (String)
+-- `manager` (String)
+-- `manager_id` (String)
+-- `middle_name` (String)
+-- `mobile_phone` (String)
+-- `nick_name` (String)
+-- `organization` (String)
+-- `postal_address` (String)
+-- `preferred_language` (String)
+-- `primary_phone` (String)
+-- `profile_url` (String)
+-- `roles` (Set of String)
+-- `second_email` (String)
+-- `state` (String)
+-- `status` (String)
+-- `street_address` (String)
+-- `timezone` (String)
+-- `title` (String)
+-- `user_type` (String)
+-- `zip_code` (String)
+-
+-
+diff --git a/docs/index.md b/docs/index.md
+deleted file mode 100644
+index 97b09c5d..00000000
+--- a/docs/index.md
++++ /dev/null
+@@ -1,138 +0,0 @@
+----
+-layout: "okta"
+-page_title: "Provider: Okta"
+-sidebar_current: "docs-okta-index"
+-description: |-
+-  The Okta provider is used to interact with the resources supported by Okta. The provider needs to be configured with the proper credentials before it can be used.
+----
+-
+-# Okta Provider
+-
+-The Okta provider is used to interact with the resources supported by Okta. The provider needs to be configured with the proper credentials before it can be used.
+-
+-Use the navigation to the left to read about the available resources and data sources.
+-
+-In case the provider configuration is still using old `"oktadeveloper/okta"` source, please change it to `"okta/okta"` and run
+-`terraform state replace-provider oktadeveloper/okta okta/okta`. Okta no longer supports `"oktadeveloper/okta"`.
+-
+-## Example Usage
+-
+-Terraform 0.14 and later:
+-
+-```hcl
+-terraform {
+-  required_providers {
+-    okta = {
+-      source = "okta/okta"
+-      version = "~> 4.8.1"
+-    }
+-  }
+-}
+-# Configure the Okta Provider
+-#
+-# NOTE: Change place holder values denoted by brackets to real values, including
+-# the brackets.
+-#
+-# NOTE: If environment variables are utilized for provider settings the
+-# corresponding variable name does not need to be set in the provider config
+-# block.
+-provider "okta" {
+-  org_name = "[ORG NAME e.g. dev-123456]"
+-  base_url = "[okta.com|oktapreview.com]"
+-  client_id = "[APP CLIENT_ID]"
+-  private_key_id = "[PRIVATE KEY ID - KID]"
+-  private_key = "[PRIVATE KEY]"
+-  scopes = "[COMMA,SEPARATED,SCOPE,VALUES]"
+-}
+-```
+-
+-For the resources and data sources examples, please check the [examples](https://github.com/okta/terraform-provider-okta/tree/master/examples) directory.
+-
+-## Authentication
+-
+-The Okta provider offers a flexible means of providing credentials for
+-authentication. The following methods are supported, in this order, and
+-explained below:
+-
+-- Environment variables
+-- Provider Config
+-
+-### Environment variables
+-
+-You can provide your credentials via the `OKTA_ORG_NAME`, `OKTA_BASE_URL`,
+-`OKTA_ACCESS_TOKEN`, `OKTA_API_TOKEN`, `OKTA_API_CLIENT_ID`, `OKTA_API_SCOPES`,
+-`OKTA_API_PRIVATE_KEY_ID`, and `OKTA_API_PRIVATE_KEY` environment variables,
+-representing your Okta Organization Name, Okta Base URL (i.e. `"okta.com"` or
+-`"oktapreview.com"`), Okta Access Token, Okta API Token, Okta Client ID, Okta
+-API scopes and Okta API private key respectively.
+-
+-```hcl
+-# provider settings established with values from environment variables
+-provider "okta" {}
+-```
+-
+-Usage:
+-
+-```sh
+-# Change place holder values denoted by brackets to real values, including the
+-# brackets.
+-
+-$ export OKTA_ORG_NAME="[ORG NAME e.g. dev-123456]"
+-$ export OKTA_BASE_URL="[okta.com|oktapreview.com]"
+-$ export OKTA_API_CLIENT_ID="[APP CLIENT_ID]"
+-$ export OKTA_API_PRIVATE_KEY_ID="[PRIVATE KEY ID - KID]"
+-$ export OKTA_API_PRIVATE_KEY="[PRIVATE KEY]"
+-$ export OKTA_API_SCOPES="[COMMA,SEPARATED,SCOPE,VALUES]"
+-
+-$ terraform plan
+-```
+-
+-## Argument Reference
+-
+-Note: `api_token` is mutually exclusive of the set `access_token`, `client_id`,
+-`private_key_id`, `private_key`, and `scopes`. `client_id`, `private_key_id`,
+-`private_key`, and `scopes` are for [OAuth 2.0
+-client](https://developer.okta.com/docs/reference/api/apps/#add-oauth-2-0-client-application)
+-authentication for application operations. `access_token` is used in situations
+-where the caller has already performed the OAuth 2.0 client authentication
+-process. Okta recommend using OAuth2 for authorizing your Terraform modules. `api_token` is utilized for
+-Okta's [SSWS Authorization
+-Scheme](https://developer.okta.com/docs/reference/core-okta-api/#authentication)
+-and applies to org level operations. This is a legacy authorization scheme.
+-
+-In addition to [generic `provider`
+-arguments](https://www.terraform.io/docs/configuration/providers.html) (e.g.
+-`alias` and `version`), the following arguments are supported in the Okta
+-`provider` block:
+-
+-- `org_name` - (Optional) This is the org name of your Okta account, for example `dev-123456.oktapreview.com` would have an org name of `dev-123456`. It must be provided, but it can also be sourced from the `OKTA_ORG_NAME` environment variable.
+-
+-- `base_url` - (Optional) This is the domain of your Okta account, for example `dev-123456.oktapreview.com` would have a base url of `oktapreview.com`. It must be provided, but it can also be sourced from the `OKTA_BASE_URL` environment variable.
+-
+-- `http_proxy` - (Optional) This is a custom URL endpoint that can be used for unit testing or local caching proxies. Can also be sourced from the `OKTA_HTTP_PROXY` environment variable.
+-
+-- `access_token` - (Optional) This is an OAuth 2.0 access token to interact with your Okta org. It can be sourced from the `OKTA_ACCESS_TOKEN` environment variable. `access_token` conflicts with `api_token`, `client_id`, `scopes` and `private_key`.
+-
+-- `api_token` - (Optional) This is the API token to interact with your Okta org. It can also be sourced from the `OKTA_API_TOKEN` environment variable. `api_token` conflicts with `access_token`, `client_id`, `scopes` and `private_key`.
+-
+-- `client_id` - (Optional) This is the client ID for obtaining the API token. It can also be sourced from the `OKTA_API_CLIENT_ID` environment variable. `client_id` conflicts with `access_token` and `api_token`.
+-
+-- `scopes` - (Optional) These are scopes for obtaining the API token in form of a comma separated list. It can also be sourced from the `OKTA_API_SCOPES` environment variable. `scopes` conflicts with `access_token` and `api_token`.
+-
+-- `private_key` - (Optional) This is the private key for obtaining the API token (can be represented by a filepath, or the key itself). It can also be sourced from the `OKTA_API_PRIVATE_KEY` environment variable. `private_key` conflicts with `access_token` and `api_token`. The format of the PK is PKCS#1 unencrypted (header starts with `-----BEGIN RSA PRIVATE KEY-----` or PKCS#8 unencrypted (header starts with `-----BEGIN PRIVATE KEY-----`).
+-
+-- `private_key_id` - (Optional) This is the private key ID (kid) for obtaining the API token. It can also be sourced from `OKTA_API_PRIVATE_KEY_ID` environmental variable. `private_key_id` conflicts with `api_token`.
+-
+-- `backoff` - (Optional) Whether to use exponential back off strategy for rate limits, the default is `true`.
+-
+-- `min_wait_seconds` - (Optional) Minimum seconds to wait when rate limit is hit, the default is `30`.
+-
+-- `max_wait_seconds` - (Optional) Maximum seconds to wait when rate limit is hit, the default is `300`.
+-
+-- `max_retries` - (Optional) Maximum number of retries to attempt before returning an error, the default is `5`.
+-
+-- `request_timeout` - (Optional) Timeout for single request (in seconds) which is made to Okta, the default is `0` (means no limit is set). The maximum value can be `300`.
+-
+-- `max_api_capacity` - (Optional, experimental) sets what percentage of capacity the provider can use of the total
+-  rate limit capacity while making calls to the Okta management API endpoints. Okta API operates in one minute buckets.
+-  See Okta Management API Rate Limits: https://developer.okta.com/docs/reference/rl-global-mgmt. Can be set to a value between 1 and 100.
+\ No newline at end of file
+diff --git a/docs/resources/admin_role_custom.md b/docs/resources/admin_role_custom.md
+deleted file mode 100644
+index f39007a9..00000000
+--- a/docs/resources/admin_role_custom.md
++++ /dev/null
+@@ -1,81 +0,0 @@
+----
+-page_title: "Resource: okta_admin_role_custom"
+-description: |-
+-  Resource to manage administrative Role assignments for a User
+-  These operations allow the creation and manipulation of custom roles as custom collections of permissions.
+-  ~> NOTE: This an Early Access feature.
+----
+-
+-# Resource: okta_admin_role_custom
+-
+-Resource to manage administrative Role assignments for a User
+-
+-These operations allow the creation and manipulation of custom roles as custom collections of permissions.
+-
+-~> **NOTE:** This an Early Access feature.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_admin_role_custom" "example" {
+-  label       = "AppAssignmentManager"
+-  description = "This role allows app assignment management"
+-  permissions = ["okta.apps.assignment.manage"]
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `description` (String) A human-readable description of the new Role
+-- `label` (String) The name given to the new Role
+-
+-### Optional
+-
+-- `permissions` (Set of String) The permissions that the new Role grants. At least one
+-				permission must be specified when creating custom role. Valid values: "okta.authzServers.manage",
+-			  "okta.authzServers.read",
+-			  "okta.apps.assignment.manage",
+-			  "okta.apps.manage",
+-			  "okta.apps.read",
+-			  "okta.customizations.manage",
+-			  "okta.customizations.read",
+-			  "okta.groups.appAssignment.manage",
+-			  "okta.groups.create",
+-			  "okta.groups.manage",
+-			  "okta.groups.members.manage",
+-			  "okta.groups.read",
+-			  "okta.profilesources.import.run",
+-			  "okta.users.appAssignment.manage",
+-			  "okta.users.create",
+-			  "okta.users.credentials.expirePassword",
+-			  "okta.users.credentials.manage",
+-			  "okta.users.credentials.resetFactors",
+-			  "okta.users.credentials.resetPassword",
+-			  "okta.users.groupMembership.manage",
+-			  "okta.users.lifecycle.activate",
+-			  "okta.users.lifecycle.clearSessions",
+-			  "okta.users.lifecycle.deactivate",
+-			  "okta.users.lifecycle.delete",
+-			  "okta.users.lifecycle.manage",
+-			  "okta.users.lifecycle.suspend",
+-			  "okta.users.lifecycle.unlock",
+-			  "okta.users.lifecycle.unsuspend",
+-			  "okta.users.manage",
+-			  "okta.users.read",
+-			  "okta.users.userprofile.manage",
+-			  "okta.workflows.invoke".,
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_admin_role_custom.example &#60;custom role id&#62
+-```
+diff --git a/docs/resources/admin_role_custom_assignments.md b/docs/resources/admin_role_custom_assignments.md
+deleted file mode 100644
+index f872c2c1..00000000
+--- a/docs/resources/admin_role_custom_assignments.md
++++ /dev/null
+@@ -1,93 +0,0 @@
+----
+-page_title: "Resource: okta_admin_role_custom_assignments"
+-description: |-
+-  Resource to manage the assignment and unassignment of Custom Roles
+-  These operations allow the creation and manipulation of custom roles as custom collections of permissions.
+-  ~> NOTE: This an Early Access feature.
+----
+-
+-# Resource: okta_admin_role_custom_assignments
+-
+-Resource to manage the assignment and unassignment of Custom Roles
+-These operations allow the creation and manipulation of custom roles as custom collections of permissions.
+-		
+-~> **NOTE:** This an Early Access feature.
+-
+-## Example Usage
+-
+-```terraform
+-locals {
+-  org_url = "https://mycompany.okta.com"
+-}
+-
+-resource "okta_admin_role_custom" "test" {
+-  label       = "SomeUsersAndApps"
+-  description = "Manage apps assignments and users"
+-  permissions = ["okta.apps.assignment.manage", "okta.users.manage", "okta.apps.manage"]
+-}
+-
+-resource "okta_resource_set" "test" {
+-  label       = "UsersWithApp"
+-  description = "All the users and SWA app"
+-  resources = [
+-    format("%s/api/v1/users", local.org_url),
+-    format("%s/api/v1/apps/%s", local.org_url, okta_app_swa.test.id)
+-  ]
+-}
+-
+-// this user and group will manage the set of resources based on the permissions specified in the custom role
+-resource "okta_admin_role_custom_assignments" "test" {
+-  resource_set_id = okta_resource_set.test.id
+-  custom_role_id  = okta_admin_role_custom.test.id
+-  members = [
+-    format("%s/api/v1/users/%s", local.org_url, okta_user.test.id),
+-    format("%s/api/v1/groups/%s", local.org_url, okta_group.test.id)
+-  ]
+-}
+-
+-// this user will have `CUSTOM` role assigned, but it won't appear in the `admin_roles` for that user,
+-// since direct assignment of custom roles is not allowed
+-resource "okta_user" "test" {
+-  first_name = "Paul"
+-  last_name  = "Atreides"
+-  login      = "no-reply@caladan.planet"
+-  email      = "no-reply@caladan.planet"
+-}
+-
+-resource "okta_app_swa" "test" {
+-  label          = "My SWA App"
+-  button_field   = "btn-login"
+-  password_field = "txtbox-password"
+-  username_field = "txtbox-username"
+-  url            = "https://example.com/login.html"
+-}
+-
+-resource "okta_group" "test" {
+-  name        = "General"
+-  description = "General Group"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `custom_role_id` (String) ID of the Custom Role
+-- `resource_set_id` (String) ID of the target Resource Set
+-
+-### Optional
+-
+-- `members` (Set of String) The hrefs that point to User(s) and/or Group(s) that receive the Role
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_admin_role_custom_assignments.example &#60;resource_set_id&#62;/&#60;custom_role_id&#62;
+-```
+diff --git a/docs/resources/admin_role_targets.md b/docs/resources/admin_role_targets.md
+deleted file mode 100644
+index 9892b01e..00000000
+--- a/docs/resources/admin_role_targets.md
++++ /dev/null
+@@ -1,59 +0,0 @@
+----
+-page_title: "Resource: okta_admin_role_targets"
+-description: |-
+-  
+----
+-
+-# Resource: okta_admin_role_targets
+-
+-
+-
+-Manages targets for administrator roles.
+-
+-This resource allows you to define permissions for admin roles into a smaller subset of Groups or Apps within your org.
+-You can define admin roles to target Groups, Applications, and Application Instances.
+-
+-```
+-Note 1: you have to assign a role to a user before creating this resource.
+-
+-Note 2: You can target a mixture of both App and App Instance targets, but can't assign permissions to manage all
+-        instances of an App and then a subset of that same App. For example, you can't specify that an admin has access
+-        to manage all instances of a Salesforce app and then also specific configurations of the Salesforce app.
+-```
+-
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_admin_role_targets" "example" {
+-  user_id   = "<user_id>"
+-  role_type = "APP_ADMIN"
+-  apps      = ["oidc_client.<app_id>", "facebook"]
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `role_type` (String) Type of the role that is assigned to the user and supports optional targets. See [API Docs](https://developer.okta.com/docs/reference/api/roles/#role-types)
+-- `user_id` (String) User associated with the role
+-
+-### Optional
+-
+-- `apps` (Set of String) List of app names (name represents set of app instances) or a combination of app name and app instance ID (like 'salesforce' or 'facebook.0oapsqQ6dv19pqyEo0g3')
+-- `groups` (Set of String) List of group IDs. Conflicts with apps
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-- `role_id` (String) ID of a role
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_admin_role_targets.example &#60;user id&#62;/&#60;role type&#62;
+-```
+\ No newline at end of file
+diff --git a/docs/resources/app_access_policy_assignment.md b/docs/resources/app_access_policy_assignment.md
+deleted file mode 100644
+index 15a7b518..00000000
+--- a/docs/resources/app_access_policy_assignment.md
++++ /dev/null
+@@ -1,61 +0,0 @@
+----
+-page_title: "Resource: okta_app_access_policy_assignment"
+-description: |-
+-  Manages assignment of Access Policy to an Application
+----
+-
+-# Resource: okta_app_access_policy_assignment
+-
+-Manages assignment of Access Policy to an Application
+-
+-Assigns an access policy (colloquially known as a sign-on policy and/or an
+-authentication policy) to an application. This resource does not perform true
+-delete as it will not delete an application and the app's access policy can't be
+-removed; it can only be changed to a different access policy. This resource is
+-only logical within the context of an application therefore `app_id` is
+-immutable once set. Use this resource to manage assigning an access policy to an
+-application. It will assign the given `policy_id` to the application at creation
+-and during update.
+-
+--> Inside the product a sign-on policy is referenced as an _authentication
+-policy_, in the public API the policy is of type
+-[`ACCESS_POLICY`](https://developer.okta.com/docs/reference/api/policy/#policy-object).
+-
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_policy" "access" {
+-  name = "Any two factors"
+-  type = "ACCESS_POLICY"
+-}
+-
+-data "okta_app" "example" {
+-  label = "Example App"
+-}
+-
+-resource "okta_app_access_policy_assignment" "assignment" {
+-  app_id    = data.okta_app.example.id
+-  policy_id = data.okta_policy.access.id
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `app_id` (String) The application ID; this value is immutable and can not be updated.
+-- `policy_id` (String) The access policy ID.
+-
+-### Read-Only
+-
+-- `id` (String) The ID of the resource. This ID is simply the application ID.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_app_access_policy_assignment.example &#60;app id&#62;
+-```
+\ No newline at end of file
+diff --git a/docs/resources/app_auto_login.md b/docs/resources/app_auto_login.md
+deleted file mode 100644
+index 770f3fd7..00000000
+--- a/docs/resources/app_auto_login.md
++++ /dev/null
+@@ -1,98 +0,0 @@
+----
+-page_title: "Resource: okta_app_auto_login"
+-description: |-
+-  This resource allows you to create and configure an Auto Login Okta Application.
+-  -> During an apply if there is change in status the app will first be
+-  activated or deactivated in accordance with the status change. Then, all
+-  other arguments that changed will be applied.
+----
+-
+-# Resource: okta_app_auto_login
+-
+-This resource allows you to create and configure an Auto Login Okta Application.
+-		
+--> During an apply if there is change in status the app will first be
+-activated or deactivated in accordance with the status change. Then, all
+-other arguments that changed will be applied.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_app_auto_login" "example" {
+-  label                = "Example App"
+-  sign_on_url          = "https://example.com/login.html"
+-  sign_on_redirect_url = "https://example.com"
+-  reveal_password      = true
+-  credentials_scheme   = "EDIT_USERNAME_AND_PASSWORD"
+-}
+-
+-resource "okta_app_auto_login" "example" {
+-  label             = "Google Example App"
+-  status            = "ACTIVE"
+-  preconfigured_app = "google"
+-  app_settings_json = <<JSON
+-{
+-    "domain": "okta",
+-    "afwOnly": false
+-}
+-JSON
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `label` (String) The Application's display name.
+-
+-### Optional
+-
+-- `accessibility_error_redirect_url` (String) Custom error page URL
+-- `accessibility_login_redirect_url` (String) Custom login page URL
+-- `accessibility_self_service` (Boolean) Enable self service. Default is `false`
+-- `admin_note` (String) Application notes for admins.
+-- `app_links_json` (String) Displays specific appLinks for the app. The value for each application link should be boolean.
+-- `app_settings_json` (String) Application settings in JSON format
+-- `auto_submit_toolbar` (Boolean) Display auto submit toolbar
+-- `credentials_scheme` (String) Application credentials scheme. One of: `EDIT_USERNAME_AND_PASSWORD`, `ADMIN_SETS_CREDENTIALS`, `EDIT_PASSWORD_ONLY`, `EXTERNAL_PASSWORD_SYNC`, or `SHARED_USERNAME_AND_PASSWORD`
+-- `enduser_note` (String) Application notes for end users.
+-- `hide_ios` (Boolean) Do not display application icon on mobile app
+-- `hide_web` (Boolean) Do not display application icon to users
+-- `logo` (String) Local file path to the logo. The file must be in PNG, JPG, or GIF format, and less than 1 MB in size.
+-- `preconfigured_app` (String) Tells Okta to use an existing application in their application catalog, as opposed to a custom application.
+-- `reveal_password` (Boolean) Allow user to reveal password. Default is false. It can not be set to true if credentials_scheme is "ADMIN_SETS_CREDENTIALS", "SHARED_USERNAME_AND_PASSWORD" or "EXTERNAL_PASSWORD_SYNC".
+-- `shared_password` (String) Shared password, required for certain schemes.
+-- `shared_username` (String) Shared username, required for certain schemes.
+-- `sign_on_redirect_url` (String) Post login redirect URL
+-- `sign_on_url` (String) Login URL
+-- `status` (String) Status of application. By default, it is `ACTIVE`
+-- `timeouts` (Block, Optional) (see [below for nested schema](#nestedblock--timeouts))
+-- `user_name_template` (String) Username template. Default: `${source.login}`
+-- `user_name_template_push_status` (String) Push username on update. Valid values: `PUSH` and `DONT_PUSH`
+-- `user_name_template_suffix` (String) Username template suffix
+-- `user_name_template_type` (String) Username template type. Default: `BUILT_IN`
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-- `logo_url` (String) URL of the application's logo
+-- `name` (String) Name of the app.
+-- `sign_on_mode` (String) Sign on mode of application.
+-
+-<a id="nestedblock--timeouts"></a>
+-### Nested Schema for `timeouts`
+-
+-Optional:
+-
+-- `create` (String)
+-- `read` (String)
+-- `update` (String)
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_app_auto_login.example &#60;app id&#62
+-```
+diff --git a/docs/resources/app_basic_auth.md b/docs/resources/app_basic_auth.md
+deleted file mode 100644
+index a173b393..00000000
+--- a/docs/resources/app_basic_auth.md
++++ /dev/null
+@@ -1,73 +0,0 @@
+----
+-page_title: "Resource: okta_app_basic_auth"
+-description: |-
+-  This resource allows you to create and configure an Auto Login Okta Application.
+-  -> During an apply if there is change in status the app will first be
+-  activated or deactivated in accordance with the status change. Then, all
+-  other arguments that changed will be applied.
+----
+-
+-# Resource: okta_app_basic_auth
+-
+-This resource allows you to create and configure an Auto Login Okta Application.
+--> During an apply if there is change in status the app will first be
+-activated or deactivated in accordance with the status change. Then, all
+-other arguments that changed will be applied.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_app_basic_auth" "example" {
+-  label    = "Example"
+-  url      = "https://example.com/login.html"
+-  auth_url = "https://example.com/auth.html"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `auth_url` (String) The URL of the authenticating site for this app.
+-- `label` (String) The Application's display name.
+-- `url` (String) The URL of the sign-in page for this app.
+-
+-### Optional
+-
+-- `accessibility_error_redirect_url` (String) Custom error page URL
+-- `accessibility_login_redirect_url` (String) Custom login page URL
+-- `accessibility_self_service` (Boolean) Enable self service. Default is `false`
+-- `admin_note` (String) Application notes for admins.
+-- `app_links_json` (String) Displays specific appLinks for the app. The value for each application link should be boolean.
+-- `auto_submit_toolbar` (Boolean) Display auto submit toolbar
+-- `enduser_note` (String) Application notes for end users.
+-- `hide_ios` (Boolean) Do not display application icon on mobile app
+-- `hide_web` (Boolean) Do not display application icon to users
+-- `logo` (String) Local file path to the logo. The file must be in PNG, JPG, or GIF format, and less than 1 MB in size.
+-- `status` (String) Status of application. By default, it is `ACTIVE`
+-- `timeouts` (Block, Optional) (see [below for nested schema](#nestedblock--timeouts))
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-- `logo_url` (String) URL of the application's logo
+-- `name` (String) Name of the app.
+-- `sign_on_mode` (String) Sign on mode of application.
+-
+-<a id="nestedblock--timeouts"></a>
+-### Nested Schema for `timeouts`
+-
+-Optional:
+-
+-- `create` (String)
+-- `read` (String)
+-- `update` (String)
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_app_basic_auth.example &#60;app id&#62
+-```
+diff --git a/docs/resources/app_bookmark.md b/docs/resources/app_bookmark.md
+deleted file mode 100644
+index f0ae1cf1..00000000
+--- a/docs/resources/app_bookmark.md
++++ /dev/null
+@@ -1,73 +0,0 @@
+----
+-page_title: "Resource: okta_app_bookmark"
+-description: |-
+-  This resource allows you to create and configure a Bookmark Application.
+-  -> During an apply if there is change in status the app will first be
+-  activated or deactivated in accordance with the status change. Then, all
+-  other arguments that changed will be applied.
+----
+-
+-# Resource: okta_app_bookmark
+-
+-This resource allows you to create and configure a Bookmark Application.
+--> During an apply if there is change in status the app will first be
+-activated or deactivated in accordance with the status change. Then, all
+-other arguments that changed will be applied.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_app_bookmark" "example" {
+-  label = "Example"
+-  url   = "https://example.com"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `label` (String) The Application's display name.
+-- `url` (String) The URL of the bookmark.
+-
+-### Optional
+-
+-- `accessibility_error_redirect_url` (String) Custom error page URL
+-- `accessibility_login_redirect_url` (String) Custom login page URL
+-- `accessibility_self_service` (Boolean) Enable self service. Default is `false`
+-- `admin_note` (String) Application notes for admins.
+-- `app_links_json` (String) Displays specific appLinks for the app. The value for each application link should be boolean.
+-- `authentication_policy` (String) The ID of the associated app_signon_policy. If this property is removed from the application the default sign-on-policy will be associated with this application.
+-- `auto_submit_toolbar` (Boolean) Display auto submit toolbar
+-- `enduser_note` (String) Application notes for end users.
+-- `hide_ios` (Boolean) Do not display application icon on mobile app
+-- `hide_web` (Boolean) Do not display application icon to users
+-- `logo` (String) Local file path to the logo. The file must be in PNG, JPG, or GIF format, and less than 1 MB in size.
+-- `request_integration` (Boolean) Would you like Okta to add an integration for this app?
+-- `status` (String) Status of application. By default, it is `ACTIVE`
+-- `timeouts` (Block, Optional) (see [below for nested schema](#nestedblock--timeouts))
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-- `logo_url` (String) URL of the application's logo
+-- `name` (String) Name of the app.
+-- `sign_on_mode` (String) Sign on mode of application.
+-
+-<a id="nestedblock--timeouts"></a>
+-### Nested Schema for `timeouts`
+-
+-Optional:
+-
+-- `create` (String)
+-- `read` (String)
+-- `update` (String)
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_app_bookmark.example &#60;app id&#62t
+-```
+diff --git a/docs/resources/app_group_assignment.md b/docs/resources/app_group_assignment.md
+deleted file mode 100644
+index 697b4fc1..00000000
+--- a/docs/resources/app_group_assignment.md
++++ /dev/null
+@@ -1,67 +0,0 @@
+----
+-page_title: "Resource: okta_app_group_assignment"
+-description: |-
+-  Assigns a group to an application. This resource allows you to create an App Group assignment.
+----
+-
+-# Resource: okta_app_group_assignment
+-
+-Assigns a group to an application. This resource allows you to create an App Group assignment.
+-
+-~> **IMPORTANT:** When the `app_group_assignment` is retained, by 
+-setting `retain_assignment` to `true`, it is no longer managed by 
+-Terraform after it is destroyed. To truly delete the assignment, 
+-you will need to remove it either through the Okta Console or API. 
+-This argument exists for the use case where the same group is 
+-assigned in multiple places in order to prevent a single 
+-destruction removing all of them.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_app_group_assignment" "example" {
+-  app_id   = "<app id>"
+-  group_id = "<group id>"
+-  profile  = <<JSON
+-{
+-  "<app_profile_field>": "<value>"
+-}
+-JSON
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `app_id` (String) App to associate group with
+-- `group_id` (String) Group associated with the application
+-
+-### Optional
+-
+-- `priority` (Number) Priority of group assignment.
+-- `profile` (String) JSON document containing [application profile](https://developer.okta.com/docs/reference/api/apps/#profile-object)
+-- `retain_assignment` (Boolean) Retain the group assignment on destroy. If set to true, the resource will be removed from state but not from the Okta app.
+-- `timeouts` (Block, Optional) (see [below for nested schema](#nestedblock--timeouts))
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-<a id="nestedblock--timeouts"></a>
+-### Nested Schema for `timeouts`
+-
+-Optional:
+-
+-- `create` (String)
+-- `read` (String)
+-- `update` (String)
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_app_group_assignment.example &#60;app_id&#62;/&#60;group_id&#62
+-```
+\ No newline at end of file
+diff --git a/docs/resources/app_group_assignments.md b/docs/resources/app_group_assignments.md
+deleted file mode 100644
+index 6e19d4bd..00000000
+--- a/docs/resources/app_group_assignments.md
++++ /dev/null
+@@ -1,58 +0,0 @@
+----
+-page_title: "Resource: okta_app_group_assignments"
+-description: |-
+-  Assigns groups to an application. This resource allows you to create multiple App Group assignments.
+----
+-
+-# Resource: okta_app_group_assignments
+-
+-Assigns groups to an application. This resource allows you to create multiple App Group assignments.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_app_group_assignments" "example" {
+-  app_id = "<app id>"
+-  group {
+-    id       = "<group id>"
+-    priority = 1
+-  }
+-  group {
+-    id       = "<another group id>"
+-    priority = 2
+-    profile  = jsonencode({ "application profile field" : "application profile value" })
+-  }
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `app_id` (String) The ID of the application to assign a group to.
+-- `group` (Block List, Min: 1) A group to assign to this application (see [below for nested schema](#nestedblock--group))
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-<a id="nestedblock--group"></a>
+-### Nested Schema for `group`
+-
+-Required:
+-
+-- `id` (String) A group to associate with the application
+-
+-Optional:
+-
+-- `priority` (Number) Priority of group assignment
+-- `profile` (String) JSON document containing [application profile](https://developer.okta.com/docs/reference/api/apps/#profile-object)
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_app_group_assignments.example &#60;app_id&#62
+-```
+diff --git a/docs/resources/app_oauth.md b/docs/resources/app_oauth.md
+deleted file mode 100644
+index e6c2fae4..00000000
+--- a/docs/resources/app_oauth.md
++++ /dev/null
+@@ -1,279 +0,0 @@
+----
+-page_title: "Resource: okta_app_oauth"
+-description: |-
+-  This resource allows you to create and configure an OIDC Application.
+-  -> During an apply if there is change in status the app will first be
+-  activated or deactivated in accordance with the status change. Then, all
+-  other arguments that changed will be applied.
+----
+-
+-# Resource: okta_app_oauth
+-
+-This resource allows you to create and configure an OIDC Application.
+--> During an apply if there is change in status the app will first be
+-activated or deactivated in accordance with the status change. Then, all
+-other arguments that changed will be applied.
+-
+-~> `okta_app_oauth_redirect_uri` has been marked deprecated and will be removed
+-in the v5 release of the provider. Operators should manage the redirect URIs for
+-an oauth app directly on that resource.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_app_oauth" "example" {
+-  label          = "example"
+-  type           = "web"
+-  grant_types    = ["authorization_code"]
+-  redirect_uris  = ["https://example.com/"]
+-  response_types = ["code"]
+-}
+-
+-### With JWKS value
+-### See also [Advanced PEM secrets and JWKS example](#advanced-pem-and-jwks-example).
+-
+-resource "okta_app_oauth" "example" {
+-  label                      = "example"
+-  type                       = "service"
+-  response_types             = ["token"]
+-  grant_types                = ["client_credentials"]
+-  token_endpoint_auth_method = "private_key_jwt"
+-
+-  jwks {
+-    kty = "RSA"
+-    kid = "SIGNING_KEY_RSA"
+-    e   = "AQAB"
+-    n   = "xyz"
+-  }
+-
+-  jwks {
+-    kty = "EC"
+-    kid = "SIGNING_KEY_EC"
+-    x   = "K37X78mXJHHldZYMzrwipjKR-YZUS2SMye0KindHp6I"
+-    y   = "8IfvsvXWzbFWOZoVOMwgF5p46mUj3kbOVf9Fk0vVVHo"
+-  }
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `label` (String) The Application's display name.
+-- `type` (String) The type of client application.
+-
+-### Optional
+-
+-- `accessibility_error_redirect_url` (String) Custom error page URL
+-- `accessibility_login_redirect_url` (String) Custom login page URL
+-- `accessibility_self_service` (Boolean) Enable self service. Default is `false`
+-- `admin_note` (String) Application notes for admins.
+-- `app_links_json` (String) Displays specific appLinks for the app. The value for each application link should be boolean.
+-- `app_settings_json` (String) Application settings in JSON format
+-- `authentication_policy` (String) The ID of the associated app_signon_policy. If this property is removed from the application the default sign-on-policy will be associated with this application.
+-- `auto_key_rotation` (Boolean) Requested key rotation mode. If
+-				auto_key_rotation isn't specified, the client automatically opts in for Okta's
+-				key rotation. You can update this property via the API or via the administrator
+-				UI.
+-				See: https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object"
+-- `auto_submit_toolbar` (Boolean) Display auto submit toolbar
+-- `client_basic_secret` (String, Sensitive) The user provided OAuth client secret key value, this can be set when token_endpoint_auth_method is client_secret_basic. This does nothing when `omit_secret is set to true.
+-- `client_id` (String) OAuth client ID. If set during creation, app is created with this id.
+-- `client_uri` (String) URI to a web page providing information about the client.
+-- `consent_method` (String) *Early Access Property*. Indicates whether user consent is required or implicit. Valid values: REQUIRED, TRUSTED. Default value is TRUSTED
+-- `enduser_note` (String) Application notes for end users.
+-- `grant_types` (Set of String) List of OAuth 2.0 grant types. Conditional validation params found here https://developer.okta.com/docs/api/resources/apps#credentials-settings-details. Defaults to minimum requirements per app type.
+-- `groups_claim` (Block Set, Max: 1) Groups claim for an OpenID Connect client application (argument is ignored when API auth is done with OAuth 2.0 credentials) (see [below for nested schema](#nestedblock--groups_claim))
+-- `hide_ios` (Boolean) Do not display application icon on mobile app
+-- `hide_web` (Boolean) Do not display application icon to users
+-- `implicit_assignment` (Boolean) *Early Access Property*. Enable Federation Broker Mode.
+-- `issuer_mode` (String) *Early Access Property*. Indicates whether the Okta Authorization Server uses the original Okta org domain URL or a custom domain URL as the issuer of ID token for this client.
+-- `jwks` (Block List) (see [below for nested schema](#nestedblock--jwks))
+-- `jwks_uri` (String) URL reference to JWKS
+-- `login_mode` (String) The type of Idp-Initiated login that the client supports, if any
+-- `login_scopes` (Set of String) List of scopes to use for the request
+-- `login_uri` (String) URI that initiates login.
+-- `logo` (String) Local file path to the logo. The file must be in PNG, JPG, or GIF format, and less than 1 MB in size.
+-- `logo_uri` (String) URI that references a logo for the client.
+-- `omit_secret` (Boolean) This tells the provider not manage the client_secret value in state. When this is false (the default), it will cause the auto-generated client_secret to be persisted in the client_secret attribute in state. This also means that every time an update to this app is run, this value is also set on the API. If this changes from false => true, the `client_secret` is dropped from state and the secret at the time of the apply is what remains. If this is ever changes from true => false your app will be recreated, due to the need to regenerate a secret we can store in state.
+-- `pkce_required` (Boolean) Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See: https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
+-- `policy_uri` (String) URI to web page providing client policy document.
+-- `post_logout_redirect_uris` (Set of String) List of URIs for redirection after logout. Note: see okta_app_oauth_post_logout_redirect_uri for appending to this list in a decentralized way.
+-- `profile` (String) Custom JSON that represents an OAuth application's profile
+-- `redirect_uris` (List of String) List of URIs for use in the redirect-based flow. This is required for all application types except service. Note: see okta_app_oauth_redirect_uri for appending to this list in a decentralized way.
+-- `refresh_token_leeway` (Number) *Early Access Property* Grace period for token rotation, required with grant types refresh_token
+-- `refresh_token_rotation` (String) *Early Access Property* Refresh token rotation behavior, required with grant types refresh_token
+-- `response_types` (Set of String) List of OAuth 2.0 response type strings.
+-- `status` (String) Status of application. By default, it is `ACTIVE`
+-- `timeouts` (Block, Optional) (see [below for nested schema](#nestedblock--timeouts))
+-- `token_endpoint_auth_method` (String) Requested authentication method for the token endpoint.
+-- `tos_uri` (String) URI to web page providing client tos (terms of service).
+-- `user_name_template` (String) Username template. Default: `${source.login}`
+-- `user_name_template_push_status` (String) Push username on update. Valid values: `PUSH` and `DONT_PUSH`
+-- `user_name_template_suffix` (String) Username template suffix
+-- `user_name_template_type` (String) Username template type. Default: `BUILT_IN`
+-- `wildcard_redirect` (String) *Early Access Property*. Indicates if the client is allowed to use wildcard matching of redirect_uris
+-
+-### Read-Only
+-
+-- `client_secret` (String, Sensitive) OAuth client secret value, this is output only. This will be in plain text in your statefile unless you set omit_secret above.
+-- `id` (String) The ID of this resource.
+-- `logo_url` (String) URL of the application's logo
+-- `name` (String) Name of the app.
+-- `sign_on_mode` (String) Sign on mode of application.
+-
+-<a id="nestedblock--groups_claim"></a>
+-### Nested Schema for `groups_claim`
+-
+-Required:
+-
+-- `name` (String) Name of the claim that will be used in the token.
+-- `type` (String) Groups claim type.
+-- `value` (String) Value of the claim. Can be an Okta Expression Language statement that evaluates at the time the token is minted.
+-
+-Optional:
+-
+-- `filter_type` (String) Groups claim filter. Can only be set if type is FILTER.
+-
+-Read-Only:
+-
+-- `issuer_mode` (String) Issuer mode inherited from OAuth App
+-
+-
+-<a id="nestedblock--jwks"></a>
+-### Nested Schema for `jwks`
+-
+-Required:
+-
+-- `kid` (String) Key ID
+-- `kty` (String) Key type
+-
+-Optional:
+-
+-- `e` (String) RSA Exponent
+-- `n` (String) RSA Modulus
+-- `x` (String) X coordinate of the elliptic curve point
+-- `y` (String) Y coordinate of the elliptic curve point
+-
+-
+-<a id="nestedblock--timeouts"></a>
+-### Nested Schema for `timeouts`
+-
+-Optional:
+-
+-- `create` (String)
+-- `read` (String)
+-- `update` (String)
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_app_oauth.example &#60;app id&#62
+-```
+-
+-
+-## Etc.
+-
+-### Resetting client secret
+-
+-If the client secret needs to be reset run an apply with `omit_secret` set to
+-true in the resource. This causes `client_secret` to be set to blank. Remove
+-`omit_secret` and run apply again. The resource will set a new `client_secret`
+-for the app.
+-
+-### Private Keys
+-
+-The private key format that an Okta OAuth app expects is PKCS#8 (unencrypted).
+-The operator either uploads their own private key or Okta can generate one in
+-the Admin UI Panel under the apps Client Credentials. PKCS#8 format can be
+-identified by a header that starts with `-----BEGIN PRIVATE KEY-----`. If the
+-operator has a PKCS#1 (unencrypted) format private key (the header starts with
+-`-----BEGIN RSA PRIVATE KEY-----`) they can generate a PKCS#8 format
+-key with `openssl`:
+-
+-```
+- openssl rsa -in pkcs1.pem -out pkcs8-example.pem
+-```
+-
+-### Advanced PEM and JWKS example
+-
+-```hcl
+-# This example config illustrates how Terraform can be used to generate a
+-# private keys PEM file and valid JWKS to be used as part of an Okta OAuth
+-# app's creation.
+-#
+-terraform {
+-  required_providers {
+-    okta = {
+-      source = "okta/okta"
+-    }
+-    tls = {
+-      source = "hashicorp/tls"
+-    }
+-    jwks = {
+-      source = "iwarapter/jwks"
+-    }
+-  }
+-}
+-
+-# NOTE: Example to generate a PEM easily as a tool. These secrets will be saved
+-# to the state file and shouldn't be persisted. Instead, save the secrets into
+-# a secrets manager to be reused.
+-# https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/private_key
+-#
+-# NOTE: Even though tls is a Hashicorp provider you should still audit its code
+-# to be satisfied with its security.
+-# https://github.com/hashicorp/terraform-provider-tls
+-#
+-resource "tls_private_key" "rsa" {
+-  algorithm = "RSA"
+-  rsa_bits  = 4096
+-}
+-#
+-# Pretty print a PEM with TF show and jq
+-# terraform show -json | jq -r '.values.root_module.resources[] | select(.address == "tls_private_key.rsa").values.private_key_pem'
+-#
+-# Delete the secrets explicitly or just remove them from the config and run
+-# apply again.
+-# terraform apply -destroy -auto-approve -target=tls_private_key.rsa
+-
+-# NOTE: Even though the iwarapter/jwks is listed in the registry you should
+-# still audit its code to be satisfied with its security.
+-# https://registry.terraform.io/providers/iwarapter/jwks/latest/docs/data-sources/from_key
+-# https://github.com/iwarapter/terraform-provider-jwks
+-#
+-data "jwks_from_key" "jwks" {
+-  key = tls_private_key.rsa.private_key_pem
+-  kid = "my-kid"
+-}
+-#
+-# Pretty print the jwks
+-# terraform show -json | jq -r '.values.root_module.resources[] | select(.address == "data.jwks_from_key.jwks").values.jwks' | jq .
+-
+-# Feed values into Okta OAuth app's jwks
+-locals {
+-  jwks = jsondecode(data.jwks_from_key.jwks.jwks)
+-}
+-
+-# https://registry.terraform.io/providers/okta/okta/latest/docs/resources/app_oauth
+-resource "okta_app_oauth" "app" {
+-  label                      = "My OAuth App"
+-  type                       = "service"
+-  response_types             = ["token"]
+-  grant_types                = ["client_credentials"]
+-  token_endpoint_auth_method = "private_key_jwt"
+-
+-  jwks {
+-    kty = local.jwks.kty
+-    kid = local.jwks.kid
+-    e   = local.jwks.e
+-    n   = local.jwks.n
+-  }
+-}
+-#
+-# Pretty print OAuth app Client ID
+-# terraform show -json | jq -r '.values.root_module.resources[] | select(.address == "okta_app_oauth.app").values.id'
+-```
+\ No newline at end of file
+diff --git a/docs/resources/app_oauth_api_scope.md b/docs/resources/app_oauth_api_scope.md
+deleted file mode 100644
+index 29b33259..00000000
+--- a/docs/resources/app_oauth_api_scope.md
++++ /dev/null
+@@ -1,44 +0,0 @@
+----
+-page_title: "Resource: okta_app_oauth_api_scope"
+-description: |-
+-  Manages API scopes for OAuth applications.
+-  This resource allows you to grant or revoke API scopes for OAuth2 applications within your organization.
+-  Note: you have to create an application before using this resource.
+----
+-
+-# Resource: okta_app_oauth_api_scope
+-
+-Manages API scopes for OAuth applications. 
+-This resource allows you to grant or revoke API scopes for OAuth2 applications within your organization.
+-Note: you have to create an application before using this resource.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_app_oauth_api_scope" "example" {
+-  app_id = "<application_id>"
+-  issuer = "<your org domain>"
+-  scopes = ["okta.users.read", "okta.users.manage"]
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `app_id` (String) ID of the application.
+-- `issuer` (String) The issuer of your Org Authorization Server, your Org URL.
+-- `scopes` (Set of String) Scopes of the application for which consent is granted.
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_app_oauth_api_scope.example &#60;app id&#62
+-```
+diff --git a/docs/resources/app_oauth_post_logout_redirect_uri.md b/docs/resources/app_oauth_post_logout_redirect_uri.md
+deleted file mode 100644
+index 60fa92e5..00000000
+--- a/docs/resources/app_oauth_post_logout_redirect_uri.md
++++ /dev/null
+@@ -1,59 +0,0 @@
+----
+-page_title: "Resource: okta_app_oauth_post_logout_redirect_uri"
+-description: |-
+-  This resource allows you to manage post logout redirection URI for use in redirect-based flows.
+----
+-
+-# Resource: okta_app_oauth_post_logout_redirect_uri
+-
+-This resource allows you to manage post logout redirection URI for use in redirect-based flows.
+-
+-~> `okta_app_oauth_post_logout_redirect_uri` has been marked deprecated and will
+-be removed in the v5 release of the provider. Operators should manage the post
+-logout redirect URIs for an oauth app directly on that resource.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_app_oauth" "test" {
+-  label          = "testAcc_replace_with_uuid"
+-  type           = "web"
+-  grant_types    = ["authorization_code"]
+-  response_types = ["code"]
+-
+-  // Okta requires at least one redirect URI to create an app
+-  redirect_uris = ["myapp://callback"]
+-
+-  post_logout_redirect_uris = ["https://www.example.com"]
+-
+-  // Since Okta forces us to create it with a redirect URI we have to ignore future changes, they will be detected as config drift.
+-  lifecycle {
+-    ignore_changes = [redirect_uris]
+-  }
+-}
+-
+-resource "okta_app_oauth_post_logout_redirect_uri" "test" {
+-  app_id = okta_app_oauth.test.id
+-  uri    = "https://www.example.com"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `app_id` (String) OAuth application ID.
+-- `uri` (String) Post Logout Redirect URI to append to Okta OIDC application.
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_app_oauth_post_logout_redirect_uri.example &#60;app id&#62;/&#60;uri&#62
+-```
+\ No newline at end of file
+diff --git a/docs/resources/app_oauth_redirect_uri.md b/docs/resources/app_oauth_redirect_uri.md
+deleted file mode 100644
+index e2bd9dfd..00000000
+--- a/docs/resources/app_oauth_redirect_uri.md
++++ /dev/null
+@@ -1,57 +0,0 @@
+----
+-page_title: "Resource: okta_app_oauth_redirect_uri"
+-description: |-
+-  This resource allows you to manage redirection URI for use in redirect-based flows.
+----
+-
+-# Resource: okta_app_oauth_redirect_uri
+-
+-This resource allows you to manage redirection URI for use in redirect-based flows.
+-
+-~> `okta_app_oauth_redirect_uri` has been marked deprecated and will be removed
+-in the v5 release of the provider. Operators should manage the redirect URIs for
+-an oauth app directly on that resource.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_app_oauth" "test" {
+-  label          = "testAcc_replace_with_uuid"
+-  type           = "web"
+-  grant_types    = ["authorization_code"]
+-  response_types = ["code"]
+-
+-  // Okta requires at least one redirect URI to create an app
+-  redirect_uris = ["myapp://callback"]
+-
+-  // Since Okta forces us to create it with a redirect URI we have to ignore future changes, they will be detected as config drift.
+-  lifecycle {
+-    ignore_changes = [redirect_uris]
+-  }
+-}
+-
+-resource "okta_app_oauth_redirect_uri" "test" {
+-  app_id = okta_app_oauth.test.id
+-  uri    = "http://google.com"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `app_id` (String) OAuth application ID.
+-- `uri` (String) Redirect URI to append to Okta OIDC application.
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_app_oauth_redirect_uri.example &#60;app id&#62;/&#60;uri&#62
+-```
+\ No newline at end of file
+diff --git a/docs/resources/app_oauth_role_assignment.md b/docs/resources/app_oauth_role_assignment.md
+deleted file mode 100644
+index e4fe2a47..00000000
+--- a/docs/resources/app_oauth_role_assignment.md
++++ /dev/null
+@@ -1,91 +0,0 @@
+----
+-page_title: "Resource: okta_app_oauth_role_assignment"
+-description: |-
+-  Manages assignment of an admin role to an OAuth application
+-          This resource allows you to assign an Okta admin role to a OAuth
+-          service application. This requires the Okta tenant feature flag for this function to be enabled.
+----
+-
+-# Resource: okta_app_oauth_role_assignment
+-
+-Manages assignment of an admin role to an OAuth application
+-		This resource allows you to assign an Okta admin role to a OAuth 
+-		service application. This requires the Okta tenant feature flag for this function to be enabled.
+-
+-## Example Usage
+-
+-```terraform
+-# Standard Role:
+-
+-resource "okta_app_oauth" "test" {
+-  label          = "test"
+-  type           = "service"
+-  response_types = ["token"]
+-  grant_types    = ["client_credentials"]
+-  jwks_uri       = "https://example.com"
+-}
+-
+-resource "okta_app_oauth_role_assignment" "test" {
+-  client_id = okta_app_oauth.test.client_id
+-  type      = "HELP_DESK_ADMIN"
+-}
+-
+-# Custom Role:
+-
+-resource "okta_app_oauth" "test" {
+-  label          = "test"
+-  type           = "service"
+-  response_types = ["token"]
+-  grant_types    = ["client_credentials"]
+-  jwks_uri       = "https://example.com"
+-}
+-
+-resource "okta_admin_role_custom" "test" {
+-  label       = "test"
+-  description = "testing, testing"
+-  permissions = ["okta.apps.assignment.manage", "okta.users.manage", "okta.apps.manage"]
+-}
+-
+-resource "okta_resource_set" "test" {
+-  label       = "test"
+-  description = "testing, testing"
+-  resources = [
+-    format("%s/api/v1/users", "https://example.okta.com"),
+-    format("%s/api/v1/apps", "https://example.okta.com")
+-  ]
+-}
+-
+-resource "okta_app_oauth_role_assignment" "test" {
+-  client_id    = okta_app_oauth.test.client_id
+-  type         = "CUSTOM"
+-  role         = okta_admin_role_custom.test.id
+-  resource_set = okta_resource_set.test.id
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `client_id` (String) Client ID for the role to be assigned to
+-- `type` (String) Role type to assign. This can be one of the standard Okta roles, such as `HELP_DESK_ADMIN`, or `CUSTOM`. Using custom requires the `resource_set` and `role` attributes to be set.
+-
+-### Optional
+-
+-- `resource_set` (String) Resource set for the custom role to assign, must be the ID of the created resource set.
+-- `role` (String) Custom Role ID
+-
+-### Read-Only
+-
+-- `id` (String) Role Assignment ID
+-- `label` (String) Label of the role assignment
+-- `status` (String) Status of the role assignment
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_app_oauth_role_assignment.test <clientID>/<roleAssignmentID>
+-```
+diff --git a/docs/resources/app_saml.md b/docs/resources/app_saml.md
+deleted file mode 100644
+index 8ccd6226..00000000
+--- a/docs/resources/app_saml.md
++++ /dev/null
+@@ -1,285 +0,0 @@
+----
+-page_title: "Resource: okta_app_saml"
+-description: |-
+-  This resource allows you to create and configure a SAML Application.
+-  -> During an apply if there is change in 'status' the app will first be
+-  activated or deactivated in accordance with the 'status' change. Then, all
+-  other arguments that changed will be applied.
+-  -> If you receive the error 'You do not have permission to access the feature
+-  you are requesting' contact support mailto:dev-inquiries@okta.com and
+-  request feature flag 'ADVANCED_SSO' be applied to your org.
+----
+-
+-# Resource: okta_app_saml
+-
+-This resource allows you to create and configure a SAML Application.
+--> During an apply if there is change in 'status' the app will first be
+-activated or deactivated in accordance with the 'status' change. Then, all
+-other arguments that changed will be applied.
+-		
+--> If you receive the error 'You do not have permission to access the feature
+-you are requesting' [contact support](mailto:dev-inquiries@okta.com) and
+-request feature flag 'ADVANCED_SSO' be applied to your org.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_app_saml" "example" {
+-  label                    = "example"
+-  sso_url                  = "https://example.com"
+-  recipient                = "https://example.com"
+-  destination              = "https://example.com"
+-  audience                 = "https://example.com/audience"
+-  subject_name_id_template = "$${user.userName}"
+-  subject_name_id_format   = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
+-  response_signed          = true
+-  signature_algorithm      = "RSA_SHA256"
+-  digest_algorithm         = "SHA256"
+-  honor_force_authn        = false
+-  authn_context_class_ref  = "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
+-
+-  attribute_statements {
+-    type         = "GROUP"
+-    name         = "groups"
+-    filter_type  = "REGEX"
+-    filter_value = ".*"
+-  }
+-}
+-
+-### With inline hook
+-resource "okta_inline_hook" "test" {
+-  name    = "testAcc_replace_with_uuid"
+-  status  = "ACTIVE"
+-  type    = "com.okta.saml.tokens.transform"
+-  version = "1.0.2"
+-
+-  channel = {
+-    type    = "HTTP"
+-    version = "1.0.0"
+-    uri     = "https://example.com/test1"
+-    method  = "POST"
+-  }
+-  auth = {
+-    key   = "Authorization"
+-    type  = "HEADER"
+-    value = "secret"
+-  }
+-}
+-
+-resource "okta_app_saml" "test" {
+-  label                    = "testAcc_replace_with_uuid"
+-  sso_url                  = "https://google.com"
+-  recipient                = "https://here.com"
+-  destination              = "https://its-about-the-journey.com"
+-  audience                 = "https://audience.com"
+-  subject_name_id_template = "$${user.userName}"
+-  subject_name_id_format   = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
+-  response_signed          = true
+-  signature_algorithm      = "RSA_SHA256"
+-  digest_algorithm         = "SHA256"
+-  honor_force_authn        = false
+-  authn_context_class_ref  = "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
+-  inline_hook_id           = okta_inline_hook.test.id
+-
+-  depends_on = [
+-    okta_inline_hook.test
+-  ]
+-  attribute_statements {
+-    type         = "GROUP"
+-    name         = "groups"
+-    filter_type  = "REGEX"
+-    filter_value = ".*"
+-  }
+-}
+-
+-### Pre-configured app with SAML 1.1 sign-on mode
+-resource "okta_app_saml" "test" {
+-  app_settings_json       = <<JSON
+-{
+-    "groupFilter": "app1.*",
+-    "siteURL": "https://www.okta.com"
+-}
+-JSON
+-  label                   = "SharePoint (On-Premise)"
+-  preconfigured_app       = "sharepoint_onpremise"
+-  saml_version            = "1.1"
+-  status                  = "ACTIVE"
+-  user_name_template      = "$${source.login}"
+-  user_name_template_type = "BUILT_IN"
+-}
+-
+-### Pre-configured app with SAML 1.1 sign-on mode, `app_settings_json` and `app_links_json`
+-resource "okta_app_saml" "office365" {
+-  preconfigured_app = "office365"
+-  label             = "Microsoft Office 365"
+-  status            = "ACTIVE"
+-  saml_version      = "1.1"
+-  app_settings_json = <<JSON
+-    {
+-       "wsFedConfigureType": "AUTO",
+-       "windowsTransportEnabled": false,
+-       "domain": "okta.com",
+-       "msftTenant": "okta",
+-       "domains": [],
+-       "requireAdminConsent": false
+-    }
+-JSON
+-  app_links_json    = <<JSON
+-  {
+-      "calendar": false,
+-      "crm": false,
+-      "delve": false,
+-      "excel": false,
+-      "forms": false,
+-      "mail": false,
+-      "newsfeed": false,
+-      "onedrive": false,
+-      "people": false,
+-      "planner": false,
+-      "powerbi": false,
+-      "powerpoint": false,
+-      "sites": false,
+-      "sway": false,
+-      "tasks": false,
+-      "teams": false,
+-      "video": false,
+-      "word": false,
+-      "yammer": false,
+-      "login": true
+-  }
+-JSON
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `label` (String) The Application's display name.
+-
+-### Optional
+-
+-- `accessibility_error_redirect_url` (String) Custom error page URL
+-- `accessibility_login_redirect_url` (String) Custom login page URL
+-- `accessibility_self_service` (Boolean) Enable self service. Default is `false`
+-- `acs_endpoints` (Set of String) An array of ACS endpoints. You can configure a maximum of 100 endpoints.
+-- `admin_note` (String) Application notes for admins.
+-- `app_links_json` (String) Displays specific appLinks for the app. The value for each application link should be boolean.
+-- `app_settings_json` (String) Application settings in JSON format
+-- `assertion_signed` (Boolean) Determines whether the SAML assertion is digitally signed
+-- `attribute_statements` (Block List) (see [below for nested schema](#nestedblock--attribute_statements))
+-- `audience` (String) Audience Restriction
+-- `authentication_policy` (String) The ID of the associated `app_signon_policy`. If this property is removed from the application the `default` sign-on-policy will be associated with this application.y
+-- `authn_context_class_ref` (String) Identifies the SAML authentication context class for the assertion’s authentication statement
+-- `auto_submit_toolbar` (Boolean) Display auto submit toolbar. Default is: `false`
+-- `default_relay_state` (String) Identifies a specific application resource in an IDP initiated SSO scenario.
+-- `destination` (String) Identifies the location where the SAML response is intended to be sent inside of the SAML assertion
+-- `digest_algorithm` (String) Determines the digest algorithm used to digitally sign the SAML assertion and response
+-- `enduser_note` (String) Application notes for end users.
+-- `hide_ios` (Boolean) Do not display application icon on mobile app
+-- `hide_web` (Boolean) Do not display application icon to users
+-- `honor_force_authn` (Boolean) Prompt user to re-authenticate if SP asks for it. Default is: `false`
+-- `idp_issuer` (String) SAML issuer ID
+-- `implicit_assignment` (Boolean) *Early Access Property*. Enable Federation Broker Mode.
+-- `inline_hook_id` (String) Saml Inline Hook setting
+-- `key_name` (String) Certificate name. This modulates the rotation of keys. New name == new key. Required to be set with `key_years_valid`
+-- `key_years_valid` (Number) Number of years the certificate is valid (2 - 10 years).
+-- `logo` (String) Local file path to the logo. The file must be in PNG, JPG, or GIF format, and less than 1 MB in size.
+-- `preconfigured_app` (String) Name of application from the Okta Integration Network. For instance 'slack'. If not included a custom app will be created.  If not provided the following arguments are required:
+-'sso_url'
+-'recipient'
+-'destination'
+-'audience'
+-'subject_name_id_template'
+-'subject_name_id_format'
+-'signature_algorithm'
+-'digest_algorithm'
+-'authn_context_class_ref'
+-- `recipient` (String) The location where the app may present the SAML assertion
+-- `request_compressed` (Boolean) Denotes whether the request is compressed or not.
+-- `response_signed` (Boolean) Determines whether the SAML auth response message is digitally signed
+-- `saml_signed_request_enabled` (Boolean) SAML Signed Request enabled
+-- `saml_version` (String) SAML version for the app's sign-on mode. Valid values are: `2.0` or `1.1`. Default is `2.0`
+-- `signature_algorithm` (String) Signature algorithm used to digitally sign the assertion and response
+-- `single_logout_certificate` (String) x509 encoded certificate that the Service Provider uses to sign Single Logout requests. Note: should be provided without `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----`, see [official documentation](https://developer.okta.com/docs/reference/api/apps/#service-provider-certificate).
+-- `single_logout_issuer` (String) The issuer of the Service Provider that generates the Single Logout request
+-- `single_logout_url` (String) The location where the logout response is sent
+-- `sp_issuer` (String) SAML SP issuer ID
+-- `sso_url` (String) Single Sign On URL
+-- `status` (String) Status of application. By default, it is `ACTIVE`
+-- `subject_name_id_format` (String) Identifies the SAML processing rules.
+-- `subject_name_id_template` (String) Template for app user's username when a user is assigned to the app
+-- `timeouts` (Block, Optional) (see [below for nested schema](#nestedblock--timeouts))
+-- `user_name_template` (String) Username template. Default: `${source.login}`
+-- `user_name_template_push_status` (String) Push username on update. Valid values: `PUSH` and `DONT_PUSH`
+-- `user_name_template_suffix` (String) Username template suffix
+-- `user_name_template_type` (String) Username template type. Default: `BUILT_IN`
+-
+-### Read-Only
+-
+-- `certificate` (String) cert from SAML XML metadata payload
+-- `embed_url` (String) The url that can be used to embed this application in other portals.
+-- `entity_key` (String) Entity ID, the ID portion of the entity_url
+-- `entity_url` (String) Entity URL for instance http://www.okta.com/exk1fcia6d6EMsf331d8
+-- `features` (Set of String) features to enable
+-- `http_post_binding` (String) urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Post location from the SAML metadata.
+-- `http_redirect_binding` (String) urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect location from the SAML metadata.
+-- `id` (String) The ID of this resource.
+-- `key_id` (String) Certificate ID
+-- `keys` (List of Object) Application keys (see [below for nested schema](#nestedatt--keys))
+-- `logo_url` (String) URL of the application's logo
+-- `metadata` (String) SAML xml metadata payload
+-- `metadata_url` (String) SAML xml metadata URL
+-- `name` (String) Name of the app.
+-- `sign_on_mode` (String) Sign on mode of application.
+-
+-<a id="nestedblock--attribute_statements"></a>
+-### Nested Schema for `attribute_statements`
+-
+-Required:
+-
+-- `name` (String) The reference name of the attribute statement
+-
+-Optional:
+-
+-- `filter_type` (String) Type of group attribute filter. Valid values are: `STARTS_WITH`, `EQUALS`, `CONTAINS`, or `REGEX`
+-- `filter_value` (String) Filter value to use
+-- `namespace` (String) The attribute namespace. It can be set to `urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified`, `urn:oasis:names:tc:SAML:2.0:attrname-format:uri`, or `urn:oasis:names:tc:SAML:2.0:attrname-format:basic`
+-- `type` (String) The type of attribute statements object
+-- `values` (List of String)
+-
+-
+-<a id="nestedblock--timeouts"></a>
+-### Nested Schema for `timeouts`
+-
+-Optional:
+-
+-- `create` (String)
+-- `read` (String)
+-- `update` (String)
+-
+-
+-<a id="nestedatt--keys"></a>
+-### Nested Schema for `keys`
+-
+-Read-Only:
+-
+-- `created` (String)
+-- `e` (String)
+-- `expires_at` (String)
+-- `kid` (String)
+-- `kty` (String)
+-- `last_updated` (String)
+-- `n` (String)
+-- `use` (String)
+-- `x5c` (List of String)
+-- `x5t_s256` (String)
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_app_saml.example &#60;app id&#62
+-```
+diff --git a/docs/resources/app_saml_app_settings.md b/docs/resources/app_saml_app_settings.md
+deleted file mode 100644
+index 5b3a6436..00000000
+--- a/docs/resources/app_saml_app_settings.md
++++ /dev/null
+@@ -1,59 +0,0 @@
+----
+-page_title: "Resource: okta_app_saml_app_settings"
+-description: |-
+-  Manages app settings of the SAML application.
+-  This resource allows you to manage app settings of the SAML Application . It's basically the same as
+-  appsettingsjson field in oktaappsaml resource and can be used in cases where settings require to be managed separately.
+----
+-
+-# Resource: okta_app_saml_app_settings
+-
+-Manages app settings of the SAML application.
+-This resource allows you to manage app settings of the SAML Application . It's basically the same as
+-app_settings_json field in okta_app_saml resource and can be used in cases where settings require to be managed separately.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_app_saml" "test" {
+-  preconfigured_app = "amazon_aws"
+-  label             = "Amazon AWS"
+-  status            = "ACTIVE"
+-}
+-
+-resource "okta_app_saml_app_settings" "test" {
+-  app_id = okta_app_saml.test.id
+-  settings = jsonencode(
+-    {
+-      "appFilter" : "okta",
+-      "awsEnvironmentType" : "aws.amazon",
+-      "groupFilter" : "aws_(?{{accountid}}\\\\d+)_(?{{role}}[a-zA-Z0-9+=,.@\\\\-_]+)",
+-      "joinAllRoles" : false,
+-      "loginURL" : "https://console.aws.amazon.com/ec2/home",
+-      "roleValuePattern" : "arn:aws:iam::$${accountid}:saml-provider/OKTA,arn:aws:iam::$${accountid}:role/$${role}",
+-      "sessionDuration" : 3200,
+-      "useGroupMapping" : false
+-    }
+-  )
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `app_id` (String) ID of the application.
+-- `settings` (String) Application settings in JSON format
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_app_saml_app_settings.example &#60;app id&#62
+-```
+diff --git a/docs/resources/app_secure_password_store.md b/docs/resources/app_secure_password_store.md
+deleted file mode 100644
+index 0de73289..00000000
+--- a/docs/resources/app_secure_password_store.md
++++ /dev/null
+@@ -1,93 +0,0 @@
+----
+-page_title: "Resource: okta_app_secure_password_store"
+-description: |-
+-  Creates a Secure Password Store Application.
+-      This resource allows you to create and configure a Secure Password Store Application.
+-      -> During an apply if there is change in 'status' the app will first be
+-      activated or deactivated in accordance with the 'status' change. Then, all
+-      other arguments that changed will be applied.
+----
+-
+-# Resource: okta_app_secure_password_store
+-
+-Creates a Secure Password Store Application.
+-	
+-		This resource allows you to create and configure a Secure Password Store Application.
+-		-> During an apply if there is change in 'status' the app will first be
+-		activated or deactivated in accordance with the 'status' change. Then, all
+-		other arguments that changed will be applied.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_app_secure_password_store" "example" {
+-  label              = "example"
+-  username_field     = "user"
+-  password_field     = "pass"
+-  url                = "https://test.com"
+-  credentials_scheme = "ADMIN_SETS_CREDENTIALS"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `label` (String) The Application's display name.
+-- `password_field` (String) Login password field
+-- `url` (String) Login URL
+-- `username_field` (String) Login username field
+-
+-### Optional
+-
+-- `accessibility_error_redirect_url` (String) Custom error page URL
+-- `accessibility_login_redirect_url` (String) Custom login page URL
+-- `accessibility_self_service` (Boolean) Enable self service. Default is `false`
+-- `admin_note` (String) Application notes for admins.
+-- `app_links_json` (String) Displays specific appLinks for the app. The value for each application link should be boolean.
+-- `auto_submit_toolbar` (Boolean) Display auto submit toolbar
+-- `credentials_scheme` (String) Application credentials scheme. One of: `EDIT_USERNAME_AND_PASSWORD`, `ADMIN_SETS_CREDENTIALS`, `EDIT_PASSWORD_ONLY`, `EXTERNAL_PASSWORD_SYNC`, or `SHARED_USERNAME_AND_PASSWORD`
+-- `enduser_note` (String) Application notes for end users.
+-- `hide_ios` (Boolean) Do not display application icon on mobile app
+-- `hide_web` (Boolean) Do not display application icon to users
+-- `logo` (String) Local file path to the logo. The file must be in PNG, JPG, or GIF format, and less than 1 MB in size.
+-- `optional_field1` (String) Name of optional param in the login form
+-- `optional_field1_value` (String) Name of optional value in login form
+-- `optional_field2` (String) Name of optional param in the login form
+-- `optional_field2_value` (String) Name of optional value in login form
+-- `optional_field3` (String) Name of optional param in the login form
+-- `optional_field3_value` (String) Name of optional value in login form
+-- `reveal_password` (Boolean) Allow user to reveal password. It can not be set to `true` if `credentials_scheme` is `ADMIN_SETS_CREDENTIALS`, `SHARED_USERNAME_AND_PASSWORD` or `EXTERNAL_PASSWORD_SYNC`.
+-- `shared_password` (String) Shared password, required for certain schemes.
+-- `shared_username` (String) Shared username, required for certain schemes.
+-- `status` (String) Status of application. By default, it is `ACTIVE`
+-- `timeouts` (Block, Optional) (see [below for nested schema](#nestedblock--timeouts))
+-- `user_name_template` (String) Username template. Default: `${source.login}`
+-- `user_name_template_push_status` (String) Push username on update. Valid values: `PUSH` and `DONT_PUSH`
+-- `user_name_template_suffix` (String) Username template suffix
+-- `user_name_template_type` (String) Username template type. Default: `BUILT_IN`
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-- `logo_url` (String) URL of the application's logo
+-- `name` (String) Name of the app.
+-- `sign_on_mode` (String) Sign on mode of application.
+-
+-<a id="nestedblock--timeouts"></a>
+-### Nested Schema for `timeouts`
+-
+-Optional:
+-
+-- `create` (String)
+-- `read` (String)
+-- `update` (String)
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_app_secure_password_store.example &#60;app id&#62
+-```
+diff --git a/docs/resources/app_shared_credentials.md b/docs/resources/app_shared_credentials.md
+deleted file mode 100644
+index 037a9cae..00000000
+--- a/docs/resources/app_shared_credentials.md
++++ /dev/null
+@@ -1,102 +0,0 @@
+----
+-page_title: "Resource: okta_app_shared_credentials"
+-description: |-
+-  Creates a SWA shared credentials app.
+-  This resource allows you to create and configure SWA shared credentials app.
+-  -> During an apply if there is change in 'status' the app will first be
+-  activated or deactivated in accordance with the 'status' change. Then, all
+-  other arguments that changed will be applied.
+----
+-
+-# Resource: okta_app_shared_credentials
+-
+-Creates a SWA shared credentials app.
+-This resource allows you to create and configure SWA shared credentials app.
+--> During an apply if there is change in 'status' the app will first be
+-activated or deactivated in accordance with the 'status' change. Then, all
+-other arguments that changed will be applied.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_app_shared_credentials" "example" {
+-  label                            = "Example App"
+-  status                           = "ACTIVE"
+-  button_field                     = "btn-login"
+-  username_field                   = "txtbox-username"
+-  password_field                   = "txtbox-password"
+-  url                              = "https://example.com/login.html"
+-  redirect_url                     = "https://example.com/redirect_url"
+-  checkbox                         = "checkbox_red"
+-  user_name_template               = "user.firstName"
+-  user_name_template_type          = "CUSTOM"
+-  user_name_template_suffix        = "hello"
+-  shared_password                  = "sharedpass"
+-  shared_username                  = "sharedusername"
+-  accessibility_self_service       = true
+-  accessibility_error_redirect_url = "https://example.com/redirect_url_1"
+-  accessibility_login_redirect_url = "https://example.com/redirect_url_2"
+-  auto_submit_toolbar              = true
+-  hide_ios                         = true
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `label` (String) The Application's display name.
+-
+-### Optional
+-
+-- `accessibility_error_redirect_url` (String) Custom error page URL
+-- `accessibility_login_redirect_url` (String) Custom login page URL
+-- `accessibility_self_service` (Boolean) Enable self service. Default is `false`
+-- `admin_note` (String) Application notes for admins.
+-- `app_links_json` (String) Displays specific appLinks for the app. The value for each application link should be boolean.
+-- `auto_submit_toolbar` (Boolean) Display auto submit toolbar
+-- `button_field` (String) Login button field
+-- `checkbox` (String) CSS selector for the checkbox
+-- `enduser_note` (String) Application notes for end users.
+-- `hide_ios` (Boolean) Do not display application icon on mobile app
+-- `hide_web` (Boolean) Do not display application icon to users
+-- `logo` (String) Local file path to the logo. The file must be in PNG, JPG, or GIF format, and less than 1 MB in size.
+-- `password_field` (String) Login password field
+-- `preconfigured_app` (String) Name of application from the Okta Integration Network, if not included a custom app will be created.
+-- `redirect_url` (String) Secondary URL of the sign-in page for this app
+-- `shared_password` (String) Shared password, required for certain schemes.
+-- `shared_username` (String) Shared username, required for certain schemes.
+-- `status` (String) Status of application. By default, it is `ACTIVE`
+-- `timeouts` (Block, Optional) (see [below for nested schema](#nestedblock--timeouts))
+-- `url` (String) The URL of the sign-in page for this app.
+-- `url_regex` (String) A regular expression that further restricts url to the specified regular expression.
+-- `user_name_template` (String) Username template. Default: `${source.login}`
+-- `user_name_template_push_status` (String) Push username on update. Valid values: `PUSH` and `DONT_PUSH`
+-- `user_name_template_suffix` (String) Username template suffix
+-- `user_name_template_type` (String) Username template type. Default: `BUILT_IN`
+-- `username_field` (String) Login username field
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-- `logo_url` (String) URL of the application's logo
+-- `name` (String) Name of the app.
+-- `sign_on_mode` (String) Sign on mode of application.
+-
+-<a id="nestedblock--timeouts"></a>
+-### Nested Schema for `timeouts`
+-
+-Optional:
+-
+-- `create` (String)
+-- `read` (String)
+-- `update` (String)
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_app_shared_credentials.example &#60;app id&#62
+-```
+diff --git a/docs/resources/app_signon_policy.md b/docs/resources/app_signon_policy.md
+deleted file mode 100644
+index 9460fc9e..00000000
+--- a/docs/resources/app_signon_policy.md
++++ /dev/null
+@@ -1,105 +0,0 @@
+----
+-page_title: "Resource: okta_app_signon_policy"
+-description: |-
+-  Manages a sign-on policy.
+-  ~> WARNING: This feature is only available as a part of the Okta Identity
+-  Engine (OIE) and is not compatible with Classic orgs. Authentication
+-  policies for applications in a Classic org can only be modified in the Admin UI,
+-  there isn't a public API for this. Therefore the Okta Terraform Provider does
+-  not support this resource for Classic orgs. Contact
+-  support mailto:dev-inquiries@okta.com for further information.
+-  This resource allows you to create and configure a sign-on policy for the
+-  application. Inside the product a sign-on policy is referenced as an
+-  authentication policy, in the public API the policy is of type
+-  'ACCESS_POLICY' https://developer.okta.com/docs/reference/api/policy/#policy-object.
+-  A newly created app's sign-on policy will always contain the default
+-  authentication policy unless one is assigned via 'authentication_policy' in the
+-  app resource. At the API level the default policy has system property value of
+-  true.
+-  ~> WARNING: When this policy is destroyed any other applications that
+-  associate the policy as their authentication policy will be reassigned to the
+-  default/system access policy.
+----
+-
+-# Resource: okta_app_signon_policy
+-
+-Manages a sign-on policy.
+-		
+-~> **WARNING:** This feature is only available as a part of the Okta Identity
+-Engine (OIE) and ***is not*** compatible with Classic orgs. Authentication
+-policies for applications in a Classic org can only be modified in the Admin UI,
+-there isn't a public API for this. Therefore the Okta Terraform Provider does
+-not support this resource for Classic orgs. [Contact
+-support](mailto:dev-inquiries@okta.com) for further information.
+-This resource allows you to create and configure a sign-on policy for the
+-application. Inside the product a sign-on policy is referenced as an
+-_authentication policy_, in the public API the policy is of type
+-['ACCESS_POLICY'](https://developer.okta.com/docs/reference/api/policy/#policy-object).
+-A newly created app's sign-on policy will always contain the default
+-authentication policy unless one is assigned via 'authentication_policy' in the
+-app resource. At the API level the default policy has system property value of
+-true.
+-~> **WARNING:** When this policy is destroyed any other applications that
+-associate the policy as their authentication policy will be reassigned to the
+-default/system access policy.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_app_oauth" "my_app" {
+-  label                     = "My App"
+-  type                      = "web"
+-  grant_types               = ["authorization_code"]
+-  redirect_uris             = ["http://localhost:3000"]
+-  post_logout_redirect_uris = ["http://localhost:3000"]
+-  response_types            = ["code"]
+-  // this is needed to associate the application with the policy
+-  authentication_policy = okta_app_signon_policy.my_app_policy.id
+-}
+-
+-resource "okta_app_signon_policy" "my_app_policy" {
+-  name        = "My App Sign-On Policy"
+-  description = "Authentication Policy to be used on my app."
+-}
+-
+-### The created policy can be extended using `app_signon_policy_rules`.
+-
+-resource "okta_app_signon_policy" "my_app_policy" {
+-  name        = "My App Sign-On Policy"
+-  description = "Authentication Policy to be used on my app."
+-}
+-
+-resource "okta_app_signon_policy_rule" "some_rule" {
+-  policy_id                   = resource.okta_app_signon_policy.my_app_policy.id
+-  name                        = "Some Rule"
+-  factor_mode                 = "1FA"
+-  re_authentication_frequency = "PT43800H"
+-  constraints = [
+-    jsonencode({
+-      "knowledge" : {
+-        "types" : ["password"]
+-      }
+-    })
+-  ]
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `description` (String) Description of the policy.
+-- `name` (String) Name of the policy.
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_app_signon_policy_rule.example &#60;policy_id&#62;
+-```
+diff --git a/docs/resources/app_signon_policy_rule.md b/docs/resources/app_signon_policy_rule.md
+deleted file mode 100644
+index b961b537..00000000
+--- a/docs/resources/app_signon_policy_rule.md
++++ /dev/null
+@@ -1,329 +0,0 @@
+----
+-page_title: "Resource: okta_app_signon_policy_rule"
+-description: |-
+-  Manages a sign-on policy rules for the application.
+-  ~> WARNING: This feature is only available as a part of the Identity Engine. Contact support mailto:dev-inquiries@okta.com for further information.
+-  This resource allows you to create and configure a sign-on policy rule for the application.
+-  A default or 'Catch-all Rule' sign-on policy rule can be imported and managed as a custom rule.
+-  The only difference is that these fields are immutable and can not be managed: 'networkconnection', 'networkexcludes',
+-  'networkincludes', 'platforminclude', 'customexpression', 'deviceisregistered', 'deviceismanaged', 'usersexcluded',
+-  'usersincluded', 'groupsexcluded', 'groupsincluded', 'usertypesexcluded' and 'usertypes_included'.
+----
+-
+-# Resource: okta_app_signon_policy_rule
+-
+-Manages a sign-on policy rules for the application.
+-~> **WARNING:** This feature is only available as a part of the Identity Engine. [Contact support](mailto:dev-inquiries@okta.com) for further information.
+-This resource allows you to create and configure a sign-on policy rule for the application.
+-A default or 'Catch-all Rule' sign-on policy rule can be imported and managed as a custom rule.
+-The only difference is that these fields are immutable and can not be managed: 'network_connection', 'network_excludes', 
+-'network_includes', 'platform_include', 'custom_expression', 'device_is_registered', 'device_is_managed', 'users_excluded',
+-'users_included', 'groups_excluded', 'groups_included', 'user_types_excluded' and 'user_types_included'.
+-
+-## Example Usage
+-
+-```terraform
+-### Simple usage
+-
+-resource "okta_app_saml" "test" {
+-  label                    = "My App"
+-  sso_url                  = "https://google.com"
+-  recipient                = "https://here.com"
+-  destination              = "https://its-about-the-journey.com"
+-  audience                 = "https://audience.com"
+-  status                   = "ACTIVE"
+-  subject_name_id_template = "$${user.userName}"
+-  subject_name_id_format   = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
+-  signature_algorithm      = "RSA_SHA256"
+-  response_signed          = true
+-  digest_algorithm         = "SHA256"
+-  honor_force_authn        = false
+-  authn_context_class_ref  = "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
+-}
+-
+-data "okta_app_signon_policy" "test" {
+-  app_id = okta_app_saml.test.id
+-}
+-
+-resource "okta_app_signon_policy_rule" "test" {
+-  policy_id = data.okta_app_signon_policy.test.id
+-  name      = "testAcc_replace_with_uuid"
+-}
+-
+-#### This will create an app sign-on policy rule with the following `THEN` block:
+-
+-#### THEN Access is 'Allowed after successful authentication'
+-#### AND User must authenticate with 'Any 2 fator types'
+-#### AND Possession factor constraints are '-'
+-#### AND Access with Okta FastPass is granted 'If the user approves a prompt in Okta Verify or provides biometrics (meets NIST AAL2 requirements)'
+-
+-### Rule with Constraints
+-
+-#### Example 1:
+-
+-resource "okta_app_signon_policy_rule" "test" {
+-  policy_id = data.okta_app_signon_policy.test.id
+-  name      = "testAcc_replace_with_uuid"
+-  constraints = [
+-    jsonencode({
+-      "knowledge" : {
+-        "types" : ["password"]
+-      },
+-    })
+-  ]
+-}
+-
+-#### This will create an app sign-on policy rule with the following `THEN` block:
+-
+-
+-#### THEN Access is 'Allowed after successful authentication'
+-#### AND User must authenticate with 'Password + Another factor'
+-#### AND Possession factor constraints are '-'
+-#### AND Access with Okta FastPass is granted 'If the user approves a prompt in Okta Verify or provides biometrics (meets NIST AAL2 requirements)'
+-
+-#### Example 2:
+-
+-resource "okta_app_signon_policy_rule" "test" {
+-  policy_id = data.okta_app_signon_policy.test.id
+-  name      = "testAcc_replace_with_uuid"
+-  constraints = [
+-    jsonencode(
+-      {
+-        knowledge = {
+-          reauthenticateIn = "PT2H"
+-          types = [
+-            "password",
+-          ]
+-        }
+-        possession = {
+-          deviceBound        = "REQUIRED"
+-          hardwareProtection = "REQUIRED"
+-        }
+-      }
+-    )
+-  ]
+-}
+-
+-
+-#### This will create an app sign-on policy rule with the following `THEN` block:
+-
+-
+-#### THEN Access is 'Allowed after successful authentication'
+-#### AND User must authenticate with 'Password + Another factor'
+-#### AND Possession factor constraints are 'Hardware protected' and 'Device Bound (excludes phone and email)'
+-#### AND Access with Okta FastPass is granted 'Without the user approving a prompt in Okta Verify or providing biometrics'
+-
+-
+-#### More examples can be
+-#### found [here](https://developer.okta.com/docs/reference/api/policy/#verification-method-json-examples).
+-
+-### Complex example
+-
+-resource "okta_app_saml" "test" {
+-  label                     = "testAcc_replace_with_uuid"
+-  sso_url                   = "https://google.com"
+-  recipient                 = "https://here.com"
+-  destination               = "https://its-about-the-journey.com"
+-  audience                  = "https://audience.com"
+-  subject_name_id_template  = "$${user.userName}"
+-  subject_name_id_format    = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
+-  response_signed           = true
+-  signature_algorithm       = "RSA_SHA256"
+-  digest_algorithm          = "SHA256"
+-  honor_force_authn         = false
+-  authn_context_class_ref   = "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
+-  single_logout_issuer      = "https://dunshire.okta.com"
+-  single_logout_url         = "https://dunshire.okta.com/logout"
+-  single_logout_certificate = "MIIFnDCCA4QCCQDBSLbiON2T1zANBgkqhkiG9w0BAQsFADCBjzELMAkGA1UEBhMCVVMxDjAMBgNV\r\nBAgMBU1haW5lMRAwDgYDVQQHDAdDYXJpYm91MRcwFQYDVQQKDA5Tbm93bWFrZXJzIEluYzEUMBIG\r\nA1UECwwLRW5naW5lZXJpbmcxDTALBgNVBAMMBFNub3cxIDAeBgkqhkiG9w0BCQEWEWVtYWlsQGV4\r\nYW1wbGUuY29tMB4XDTIwMTIwMzIyNDY0M1oXDTMwMTIwMTIyNDY0M1owgY8xCzAJBgNVBAYTAlVT\r\nMQ4wDAYDVQQIDAVNYWluZTEQMA4GA1UEBwwHQ2FyaWJvdTEXMBUGA1UECgwOU25vd21ha2VycyBJ\r\nbmMxFDASBgNVBAsMC0VuZ2luZWVyaW5nMQ0wCwYDVQQDDARTbm93MSAwHgYJKoZIhvcNAQkBFhFl\r\nbWFpbEBleGFtcGxlLmNvbTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANMmWDjXPdoa\r\nPyzIENqeY9njLan2FqCbQPSestWUUcb6NhDsJVGSQ7XR+ozQA5TaJzbP7cAJUj8vCcbqMZsgOQAu\r\nO/pzYyQEKptLmrGvPn7xkJ1A1xLkp2NY18cpDTeUPueJUoidZ9EJwEuyUZIktzxNNU1pA1lGijiu\r\n2XNxs9d9JR/hm3tCu9Im8qLVB4JtX80YUa6QtlRjWR/H8a373AYCOASdoB3c57fIPD8ATDNy2w/c\r\nfCVGiyKDMFB+GA/WTsZpOP3iohRp8ltAncSuzypcztb2iE+jijtTsiC9kUA2abAJqqpoCJubNShi\r\nVff4822czpziS44MV2guC9wANi8u3Uyl5MKsU95j01jzadKRP5S+2f0K+n8n4UoV9fnqZFyuGAKd\r\nCJi9K6NlSAP+TgPe/JP9FOSuxQOHWJfmdLHdJD+evoKi9E55sr5lRFK0xU1Fj5Ld7zjC0pXPhtJf\r\nsgjEZzD433AsHnRzvRT1KSNCPkLYomznZo5n9rWYgCQ8HcytlQDTesmKE+s05E/VSWNtH84XdDrt\r\nieXwfwhHfaABSu+WjZYxi9CXdFCSvXhsgufUcK4FbYAHl/ga/cJxZc52yFC7Pcq0u9O2BSCjYPdQ\r\nDAHs9dhT1RhwVLM8RmoAzgxyyzau0gxnAlgSBD9FMW6dXqIHIp8yAAg9cRXhYRTNAgMBAAEwDQYJ\r\nKoZIhvcNAQELBQADggIBADofEC1SvG8qa7pmKCjB/E9Sxhk3mvUO9Gq43xzwVb721Ng3VYf4vGU3\r\nwLUwJeLt0wggnj26NJweN5T3q9T8UMxZhHSWvttEU3+S1nArRB0beti716HSlOCDx4wTmBu/D1MG\r\nt/kZYFJw+zuzvAcbYct2pK69AQhD8xAIbQvqADJI7cCK3yRry+aWtppc58P81KYabUlCfFXfhJ9E\r\nP72ffN4jVHpX3lxxYh7FKAdiKbY2FYzjsc7RdgKI1R3iAAZUCGBTvezNzaetGzTUjjl/g1tcVYij\r\nltH9ZOQBPlUMI88lxUxqgRTerpPmAJH00CACx4JFiZrweLM1trZyy06wNDQgLrqHr3EOagBF/O2h\r\nhfTehNdVr6iq3YhKWBo4/+RL0RCzHMh4u86VbDDnDn4Y6HzLuyIAtBFoikoKM6UHTOa0Pqv2bBr5\r\nwbkRkVUxl9yJJw/HmTCdfnsM9dTOJUKzEglnGF2184Gg+qJDZB6fSf0EAO1F6sTqiSswl+uHQZiy\r\nDaZzyU7Gg5seKOZ20zTRaX3Ihj9Zij/ORnrARE7eM/usKMECp+7syUwAUKxDCZkGiUdskmOhhBGL\r\nJtbyK3F2UvoJoLsm3pIcvMak9KwMjSTGJB47ABUP1+w+zGcNk0D5Co3IJ6QekiLfWJyQ+kKsWLKt\r\nzOYQQatrnBagM7MI2/T4\r\n"
+-
+-  attribute_statements {
+-    type         = "GROUP"
+-    name         = "groups"
+-    filter_type  = "REGEX"
+-    filter_value = ".*"
+-  }
+-}
+-
+-data "okta_app_signon_policy" "test" {
+-  app_id = okta_app_saml.test.id
+-}
+-
+-resource "okta_user" "test" {
+-  count      = 5
+-  first_name = "TestAcc"
+-  last_name  = "Smith"
+-  login      = "testAcc_${count.index}@example.com"
+-  email      = "testAcc_${count.index}@example.com"
+-}
+-
+-resource "okta_group" "this" {
+-  count       = 5
+-  name        = "testAcc_${count.index}"
+-  description = "testAcc_${count.index}"
+-}
+-
+-resource "okta_user_type" "test" {
+-  name         = "testAcc_replace_with_uuid"
+-  display_name = "Terraform Acceptance Test User Type Updated"
+-  description  = "Terraform Acceptance Test User Type Updated"
+-}
+-
+-resource "okta_network_zone" "test" {
+-  name     = "testAcc_replace_with_uuid"
+-  type     = "IP"
+-  gateways = ["1.2.3.4/24", "2.3.4.5-2.3.4.15"]
+-  proxies  = ["2.2.3.4/24", "3.3.4.5-3.3.4.15"]
+-}
+-
+-data "okta_user_type" "default" {
+-  name = "user"
+-}
+-
+-resource "okta_policy_device_assurance_android" "test" {
+-  name       = "test"
+-  os_version = "12"
+-  jailbreak  = false
+-}
+-
+-resource "okta_app_signon_policy_rule" "test" {
+-  name                 = "testAcc_replace_with_uuid"
+-  policy_id            = data.okta_app_signon_policy.test.id
+-  access               = "ALLOW"
+-  custom_expression    = "user.status == \"ACTIVE\""
+-  device_is_managed    = false
+-  device_is_registered = true
+-  factor_mode          = "2FA"
+-  groups_excluded = [
+-    okta_group.this[2].id,
+-    okta_group.this[3].id,
+-    okta_group.this[4].id
+-  ]
+-  groups_included = [
+-    okta_group.this[0].id,
+-    okta_group.this[1].id
+-  ]
+-  device_assurances_included = [
+-    okta_policy_device_assurance_android.test.id
+-  ]
+-  network_connection = "ZONE"
+-  network_includes = [
+-    okta_network_zone.test.id
+-  ]
+-  platform_include {
+-    os_type = "ANDROID"
+-    type    = "MOBILE"
+-  }
+-  platform_include {
+-    os_type = "IOS"
+-    type    = "MOBILE"
+-  }
+-  platform_include {
+-    os_type = "MACOS"
+-    type    = "DESKTOP"
+-  }
+-  platform_include {
+-    os_type = "OTHER"
+-    type    = "DESKTOP"
+-  }
+-  platform_include {
+-    os_type = "OTHER"
+-    type    = "MOBILE"
+-  }
+-  platform_include {
+-    os_type = "WINDOWS"
+-    type    = "DESKTOP"
+-  }
+-  priority                    = 98
+-  re_authentication_frequency = "PT43800H"
+-  type                        = "ASSURANCE"
+-  user_types_excluded = [
+-    okta_user_type.test.id
+-  ]
+-  user_types_included = [
+-    data.okta_user_type.default.id
+-  ]
+-  users_excluded = [
+-    okta_user.test[2].id,
+-    okta_user.test[3].id,
+-    okta_user.test[4].id
+-  ]
+-  users_included = [
+-    okta_user.test[0].id,
+-    okta_user.test[1].id
+-  ]
+-  constraints = [
+-    jsonencode({
+-      "knowledge" : {
+-        "reauthenticateIn" : "PT2H",
+-        "types" : ["password"]
+-      },
+-      "possession" : {
+-        "deviceBound" : "REQUIRED"
+-      }
+-    }),
+-    jsonencode({
+-      "possession" : {
+-        "deviceBound" : "REQUIRED",
+-        "hardwareProtection" : "REQUIRED",
+-        "userPresence" : "OPTIONAL"
+-      }
+-    })
+-  ]
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `name` (String) Policy Rule Name
+-- `policy_id` (String) ID of the policy
+-
+-### Optional
+-
+-- `access` (String) Allow or deny access based on the rule conditions: ALLOW or DENY
+-- `constraints` (List of String) An array that contains nested Authenticator Constraint objects that are organized by the Authenticator class
+-- `custom_expression` (String) This is an optional advanced setting. If the expression is formatted incorrectly or conflicts with conditions set above, the rule may not match any users.
+-- `device_assurances_included` (Set of String) List of device assurance IDs to include
+-- `device_is_managed` (Boolean) If the device is managed. A device is managed if it's managed by a device management system. When managed is passed, registered must also be included and must be set to true.
+-- `device_is_registered` (Boolean) If the device is registered. A device is registered if the User enrolls with Okta Verify that is installed on the device.
+-- `factor_mode` (String) The number of factors required to satisfy this assurance level
+-- `groups_excluded` (Set of String) List of group IDs to exclude
+-- `groups_included` (Set of String) List of group IDs to include
+-- `inactivity_period` (String) The inactivity duration after which the end user must re-authenticate. Use the ISO 8601 Period format for recurring time intervals.
+-- `network_connection` (String) Network selection mode: ANYWHERE, ZONE, ON_NETWORK, or OFF_NETWORK.
+-- `network_excludes` (List of String) The zones to exclude
+-- `network_includes` (List of String) The zones to include
+-- `platform_include` (Block Set) (see [below for nested schema](#nestedblock--platform_include))
+-- `priority` (Number) Priority of the rule.
+-- `re_authentication_frequency` (String) The duration after which the end user must re-authenticate, regardless of user activity. Use the ISO 8601 Period format for recurring time intervals. PT0S - Every sign-in attempt, PT43800H - Once per session
+-- `risk_score` (String) The risk score specifies a particular level of risk to match on: ANY, LOW, MEDIUM, HIGH
+-- `status` (String) Status of the rule
+-- `type` (String) The Verification Method type
+-- `user_types_excluded` (Set of String) Set of User Type IDs to exclude
+-- `user_types_included` (Set of String) Set of User Type IDs to include
+-- `users_excluded` (Set of String) Set of User IDs to exclude
+-- `users_included` (Set of String) Set of User IDs to include
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-- `system` (Boolean) Often the `Catch-all Rule` this rule is the system (default) rule for its associated policy
+-
+-<a id="nestedblock--platform_include"></a>
+-### Nested Schema for `platform_include`
+-
+-Optional:
+-
+-- `os_expression` (String) Only available with OTHER OS type
+-- `os_type` (String)
+-- `type` (String)
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_app_signon_policy_rule.example &#60;policy_id&#62;/&#60;rule_id&#62
+-```
+diff --git a/docs/resources/app_swa.md b/docs/resources/app_swa.md
+deleted file mode 100644
+index c5c37c31..00000000
+--- a/docs/resources/app_swa.md
++++ /dev/null
+@@ -1,88 +0,0 @@
+----
+-page_title: "Resource: okta_app_swa"
+-description: |-
+-  Creates a SWA Application.
+-  This resource allows you to create and configure a SWA Application.
+-  -> During an apply if there is change in 'status' the app will first be
+-  activated or deactivated in accordance with the 'status' change. Then, all
+-  other arguments that changed will be applied.
+----
+-
+-# Resource: okta_app_swa
+-
+-Creates a SWA Application.
+-		
+-This resource allows you to create and configure a SWA Application.
+--> During an apply if there is change in 'status' the app will first be
+-activated or deactivated in accordance with the 'status' change. Then, all
+-other arguments that changed will be applied.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_app_swa" "example" {
+-  label          = "example"
+-  button_field   = "btn-login"
+-  password_field = "txtbox-password"
+-  username_field = "txtbox-username"
+-  url            = "https://example.com/login.html"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `label` (String) The Application's display name.
+-
+-### Optional
+-
+-- `accessibility_error_redirect_url` (String) Custom error page URL
+-- `accessibility_login_redirect_url` (String) Custom login page URL
+-- `accessibility_self_service` (Boolean) Enable self service. Default is `false`
+-- `admin_note` (String) Application notes for admins.
+-- `app_links_json` (String) Displays specific appLinks for the app. The value for each application link should be boolean.
+-- `auto_submit_toolbar` (Boolean) Display auto submit toolbar
+-- `button_field` (String) Login button field
+-- `checkbox` (String) CSS selector for the checkbox
+-- `enduser_note` (String) Application notes for end users.
+-- `hide_ios` (Boolean) Do not display application icon on mobile app
+-- `hide_web` (Boolean) Do not display application icon to users
+-- `logo` (String) Local file path to the logo. The file must be in PNG, JPG, or GIF format, and less than 1 MB in size.
+-- `password_field` (String) Login password field
+-- `preconfigured_app` (String) Preconfigured app name
+-- `redirect_url` (String) If going to the login page URL redirects to another page, then enter that URL here
+-- `status` (String) Status of application. By default, it is `ACTIVE`
+-- `timeouts` (Block, Optional) (see [below for nested schema](#nestedblock--timeouts))
+-- `url` (String) Login URL
+-- `url_regex` (String) A regex that further restricts URL to the specified regex
+-- `user_name_template` (String) Username template. Default: `${source.login}`
+-- `user_name_template_push_status` (String) Push username on update. Valid values: `PUSH` and `DONT_PUSH`
+-- `user_name_template_suffix` (String) Username template suffix
+-- `user_name_template_type` (String) Username template type. Default: `BUILT_IN`
+-- `username_field` (String) Login username field
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-- `logo_url` (String) URL of the application's logo
+-- `name` (String) Name of the app.
+-- `sign_on_mode` (String) Sign on mode of application.
+-
+-<a id="nestedblock--timeouts"></a>
+-### Nested Schema for `timeouts`
+-
+-Optional:
+-
+-- `create` (String)
+-- `read` (String)
+-- `update` (String)
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_app_swa.example &#60;app id&#62;
+-```
+diff --git a/docs/resources/app_three_field.md b/docs/resources/app_three_field.md
+deleted file mode 100644
+index 4b1023be..00000000
+--- a/docs/resources/app_three_field.md
++++ /dev/null
+@@ -1,90 +0,0 @@
+----
+-page_title: "Resource: okta_app_three_field"
+-description: |-
+-  Creates a Three Field Application.
+-          This resource allows you to create and configure a Three Field Application.
+-          -> During an apply if there is change in 'status' the app will first be
+-          activated or deactivated in accordance with the 'status' change. Then, all
+-          other arguments that changed will be applied.
+----
+-
+-# Resource: okta_app_three_field
+-
+-Creates a Three Field Application.
+-		This resource allows you to create and configure a Three Field Application.
+-		-> During an apply if there is change in 'status' the app will first be
+-		activated or deactivated in accordance with the 'status' change. Then, all
+-		other arguments that changed will be applied.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_app_three_field" "example" {
+-  label                = "Example App"
+-  sign_on_url          = "https://example.com/login.html"
+-  sign_on_redirect_url = "https://example.com"
+-  reveal_password      = true
+-  credentials_scheme   = "EDIT_USERNAME_AND_PASSWORD"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `button_selector` (String) Login button field CSS selector
+-- `extra_field_selector` (String) Extra field CSS selector
+-- `extra_field_value` (String) Value for extra form field
+-- `label` (String) The Application's display name.
+-- `password_selector` (String) Login password field CSS selector
+-- `url` (String) Login URL
+-- `username_selector` (String) Login username field CSS selector
+-
+-### Optional
+-
+-- `accessibility_error_redirect_url` (String) Custom error page URL
+-- `accessibility_login_redirect_url` (String) Custom login page URL
+-- `accessibility_self_service` (Boolean) Enable self service. Default is `false`
+-- `admin_note` (String) Application notes for admins.
+-- `app_links_json` (String) Displays specific appLinks for the app. The value for each application link should be boolean.
+-- `auto_submit_toolbar` (Boolean) Display auto submit toolbar
+-- `credentials_scheme` (String) Application credentials scheme. One of: `EDIT_USERNAME_AND_PASSWORD`, `ADMIN_SETS_CREDENTIALS`, `EDIT_PASSWORD_ONLY`, `EXTERNAL_PASSWORD_SYNC`, or `SHARED_USERNAME_AND_PASSWORD`
+-- `enduser_note` (String) Application notes for end users.
+-- `hide_ios` (Boolean) Do not display application icon on mobile app
+-- `hide_web` (Boolean) Do not display application icon to users
+-- `logo` (String) Local file path to the logo. The file must be in PNG, JPG, or GIF format, and less than 1 MB in size.
+-- `reveal_password` (Boolean) Allow user to reveal password. It can not be set to `true` if `credentials_scheme` is `ADMIN_SETS_CREDENTIALS`, `SHARED_USERNAME_AND_PASSWORD` or `EXTERNAL_PASSWORD_SYNC`.
+-- `shared_password` (String) Shared password, required for certain schemes.
+-- `shared_username` (String) Shared username, required for certain schemes.
+-- `status` (String) Status of application. By default, it is `ACTIVE`
+-- `timeouts` (Block, Optional) (see [below for nested schema](#nestedblock--timeouts))
+-- `url_regex` (String) A regex that further restricts URL to the specified regex
+-- `user_name_template` (String) Username template. Default: `${source.login}`
+-- `user_name_template_push_status` (String) Push username on update. Valid values: `PUSH` and `DONT_PUSH`
+-- `user_name_template_suffix` (String) Username template suffix
+-- `user_name_template_type` (String) Username template type. Default: `BUILT_IN`
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-- `logo_url` (String) URL of the application's logo
+-- `name` (String) Name of the app.
+-- `sign_on_mode` (String) Sign on mode of application.
+-
+-<a id="nestedblock--timeouts"></a>
+-### Nested Schema for `timeouts`
+-
+-Optional:
+-
+-- `create` (String)
+-- `read` (String)
+-- `update` (String)
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_app_three_field.example &#60;app id&#62;
+-```
+diff --git a/docs/resources/app_user.md b/docs/resources/app_user.md
+deleted file mode 100644
+index 896332a9..00000000
+--- a/docs/resources/app_user.md
++++ /dev/null
+@@ -1,51 +0,0 @@
+----
+-page_title: "Resource: okta_app_user"
+-description: |-
+-  Creates an Application User.
+-          This resource allows you to create and configure an Application User.
+-          ~> IMPORTANT: When the 'oktaappuser' is retained, by setting 'retain_assignment' to 'true', it is no longer managed by Terraform after it is destroyed. To truly delete the assignment, you will need to remove it either through the Okta Console or API. This argument exists for the use case where the same user is assigned in multiple places in order to prevent a single destruction removing all of them.
+----
+-
+-# Resource: okta_app_user
+-
+-Creates an Application User.
+-		This resource allows you to create and configure an Application User.
+-		~> **IMPORTANT:** When the 'okta_app_user' is retained, by setting 'retain_assignment' to 'true', it is no longer managed by Terraform after it is destroyed. To truly delete the assignment, you will need to remove it either through the Okta Console or API. This argument exists for the use case where the same user is assigned in multiple places in order to prevent a single destruction removing all of them.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_app_user" "example" {
+-  app_id   = "<app_id>"
+-  user_id  = "<user id>"
+-  username = "example"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `app_id` (String) App to associate user with
+-- `user_id` (String) User associated with the application
+-
+-### Optional
+-
+-- `password` (String, Sensitive) The password to use.
+-- `profile` (String) The JSON profile of the App User.
+-- `retain_assignment` (Boolean) Retain the user assignment on destroy. If set to true, the resource will be removed from state but not from the Okta app.
+-- `username` (String) The username to use for the app user. In case the user is assigned to the app with `SHARED_USERNAME_AND_PASSWORD` credentials scheme, this field will be computed and should not be set.
+-
+-### Read-Only
+-
+-- `has_shared_username` (Boolean)
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_app_user.example &#60;app id&#62;/&#60;user id&#62;
+-```
+diff --git a/docs/resources/app_user_base_schema_property.md b/docs/resources/app_user_base_schema_property.md
+deleted file mode 100644
+index a1f02ff7..00000000
+--- a/docs/resources/app_user_base_schema_property.md
++++ /dev/null
+@@ -1,51 +0,0 @@
+----
+-page_title: "Resource: okta_app_user_base_schema_property"
+-description: |-
+-  Manages an Application User Base Schema property. This resource allows you to configure a base app user schema property.
+----
+-
+-# Resource: okta_app_user_base_schema_property
+-
+-Manages an Application User Base Schema property. This resource allows you to configure a base app user schema property.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_app_user_base_schema_property" "example" {
+-  app_id = "<app id>"
+-  index  = "customPropertyName"
+-  title  = "customPropertyName"
+-  type   = "string"
+-  master = "OKTA"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `app_id` (String) The Application's ID the user schema property should be assigned to.
+-- `index` (String) Subschema unique string identifier
+-- `title` (String) Subschema title (display name)
+-- `type` (String) The type of the schema property. It can be `string`, `boolean`, `number`, `integer`, `array`, or `object`
+-
+-### Optional
+-
+-- `master` (String) Master priority for the user schema property. It can be set to `PROFILE_MASTER` or `OKTA`. Default: `PROFILE_MASTER`
+-- `pattern` (String) The validation pattern to use for the subschema. Must be in form of '.+', or '[<pattern>]+' if present.'
+-- `permissions` (String) Access control permissions for the property. It can be set to `READ_WRITE`, `READ_ONLY`, `HIDE`. Default: `READ_ONLY`
+-- `required` (Boolean) Whether the subschema is required
+-- `user_type` (String) User type ID. By default, it is `default`
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_app_user_base_schema_property.example &#60;app id&#62;/&#60;property name&#62;
+-```
+diff --git a/docs/resources/app_user_schema_property.md b/docs/resources/app_user_schema_property.md
+deleted file mode 100644
+index f0a47ef4..00000000
+--- a/docs/resources/app_user_schema_property.md
++++ /dev/null
+@@ -1,100 +0,0 @@
+----
+-page_title: "Resource: okta_app_user_schema_property"
+-description: |-
+-  Creates an Application User Schema property.
+-  This resource allows you to create and configure a custom user schema property and associate it with an application.
+-  Make sure that the app instance is 'active' before creating the schema property, because in some cases API might return '404' error.
+-  IMPORTANT: With 'enum', list its values as strings even though the 'type'
+-  may be something other than string. This is a limitation of the schema defintion
+-  in the Terraform Plugin SDK runtime and we juggle the type correctly when making
+-  Okta API calls. Same holds for the 'const' value of 'oneof' as well as the
+-  'array*' variation of 'enum' and 'one_of'
+----
+-
+-# Resource: okta_app_user_schema_property
+-
+-Creates an Application User Schema property.
+-This resource allows you to create and configure a custom user schema property and associate it with an application.
+-Make sure that the app instance is 'active' before creating the schema property, because in some cases API might return '404' error.
+-**IMPORTANT:** With 'enum', list its values as strings even though the 'type'
+-may be something other than string. This is a limitation of the schema defintion
+-in the Terraform Plugin SDK runtime and we juggle the type correctly when making
+-Okta API calls. Same holds for the 'const' value of 'one_of' as well as the
+-'array_*' variation of 'enum' and 'one_of'
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_app_user_schema_property" "example" {
+-  app_id      = "<app id>"
+-  index       = "customPropertyName"
+-  title       = "customPropertyName"
+-  type        = "string"
+-  description = "My custom property name"
+-  master      = "OKTA"
+-  scope       = "SELF"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `app_id` (String) The Application's ID the user custom schema property should be assigned to.
+-- `index` (String) Subschema unique string identifier
+-- `title` (String) Subschema title (display name)
+-- `type` (String) The type of the schema property. It can be `string`, `boolean`, `number`, `integer`, `array`, or `object`
+-
+-### Optional
+-
+-- `array_enum` (List of String) Array of values that an array property's items can be set to.
+-- `array_one_of` (Block List) Display name and value an enum array can be set to.
+-	- 'const' - (Required) value mapping to member of 'enum'.
+-	- 'title' - (Required) display name for the enum value. (see [below for nested schema](#nestedblock--array_one_of))
+-- `array_type` (String) The type of the array elements if `type` is set to `array`
+-- `description` (String) The description of the user schema property.
+-- `enum` (List of String) Array of values a primitive property can be set to. See `array_enum` for arrays.
+-- `external_name` (String) External name of the user schema property.
+-- `external_namespace` (String) External namespace of the user schema property.
+-- `master` (String) Master priority for the user schema property. It can be set to `PROFILE_MASTER` or `OKTA`
+-- `max_length` (Number) The maximum length of the user property value. Only applies to type `string`
+-- `min_length` (Number) The minimum length of the user property value. Only applies to type `string`
+-- `one_of` (Block List) Array of maps containing a mapping for display name to enum value.
+-	- 'const' - (Required) value mapping to member of 'enum'.
+-	- 'title' - (Required) display name for the enum value. (see [below for nested schema](#nestedblock--one_of))
+-- `permissions` (String) Access control permissions for the property. It can be set to `READ_WRITE`, `READ_ONLY`, `HIDE`. Default: `READ_ONLY`
+-- `required` (Boolean) Whether the subschema is required
+-- `scope` (String) determines whether an app user attribute can be set at the Personal `SELF` or Group `NONE` level. Default value is `NONE`.
+-- `union` (Boolean) If `type` is set to `array`, used to set whether attribute value is determined by group priority `false`, or combine values across groups `true`. Can not be set to `true` if `scope` is set to `SELF`.
+-- `unique` (String) Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.
+-- `user_type` (String) User type ID. By default, it is `default`
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-<a id="nestedblock--array_one_of"></a>
+-### Nested Schema for `array_one_of`
+-
+-Required:
+-
+-- `const` (String) Value mapping to member of `array_enum`
+-- `title` (String) Display name for the enum value.
+-
+-
+-<a id="nestedblock--one_of"></a>
+-### Nested Schema for `one_of`
+-
+-Required:
+-
+-- `const` (String) Enum value
+-- `title` (String) Enum title
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_app_user_schema_property.example &#60;app id&#62;/&#60;property name&#62;
+-```
+diff --git a/docs/resources/auth_server.md b/docs/resources/auth_server.md
+deleted file mode 100644
+index ae3cd907..00000000
+--- a/docs/resources/auth_server.md
++++ /dev/null
+@@ -1,52 +0,0 @@
+----
+-page_title: "Resource: okta_auth_server"
+-description: |-
+-  Creates an Authorization Server. This resource allows you to create and configure an Authorization Server.
+----
+-
+-# Resource: okta_auth_server
+-
+-Creates an Authorization Server. This resource allows you to create and configure an Authorization Server.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_auth_server" "example" {
+-  audiences   = ["api://example"]
+-  description = "My Example Auth Server"
+-  name        = "example"
+-  issuer_mode = "CUSTOM_URL"
+-  status      = "ACTIVE"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `audiences` (Set of String) The recipients that the tokens are intended for. This becomes the `aud` claim in an access token. Currently Okta only supports a single value here.
+-- `name` (String) The name of the authorization server.
+-
+-### Optional
+-
+-- `credentials_rotation_mode` (String) The key rotation mode for the authorization server. Can be `AUTO` or `MANUAL`. Default: `AUTO`
+-- `description` (String) The description of the authorization server.
+-- `issuer_mode` (String) *Early Access Property*. Allows you to use a custom issuer URL. It can be set to `CUSTOM_URL`, `ORG_URL`, or `DYNAMIC`. Default: `ORG_URL`
+-- `status` (String) Default to `ACTIVE`
+-
+-### Read-Only
+-
+-- `credentials_last_rotated` (String) The timestamp when the authorization server started to use the `kid` for signing tokens.
+-- `credentials_next_rotation` (String) The timestamp when the authorization server changes the key for signing tokens. Only returned when `credentials_rotation_mode` is `AUTO`.
+-- `id` (String) The ID of this resource.
+-- `issuer` (String) The complete URL for a Custom Authorization Server. This becomes the `iss` claim in an access token.
+-- `kid` (String) The ID of the JSON Web Key used for signing tokens issued by the authorization server.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_auth_server.example &#60;auth server id&#62;
+-```
+diff --git a/docs/resources/auth_server_claim.md b/docs/resources/auth_server_claim.md
+deleted file mode 100644
+index 92ef6b5d..00000000
+--- a/docs/resources/auth_server_claim.md
++++ /dev/null
+@@ -1,51 +0,0 @@
+----
+-page_title: "Resource: okta_auth_server_claim"
+-description: |-
+-  Creates an Authorization Server Claim. This resource allows you to create and configure an Authorization Server Claim.
+----
+-
+-# Resource: okta_auth_server_claim
+-
+-Creates an Authorization Server Claim. This resource allows you to create and configure an Authorization Server Claim.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_auth_server_claim" "example" {
+-  auth_server_id = "<auth server id>"
+-  name           = "staff"
+-  value          = "String.substringAfter(user.email, \"@\") == \"example.com\""
+-  scopes         = ["${okta_auth_server_scope.example.name}"]
+-  claim_type     = "IDENTITY"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `auth_server_id` (String) ID of the authorization server.
+-- `claim_type` (String) Specifies whether the claim is for an access token `RESOURCE` or ID token `IDENTITY`.
+-- `name` (String) The name of the claim.
+-- `value` (String) The value of the claim.
+-
+-### Optional
+-
+-- `always_include_in_token` (Boolean) Specifies whether to include claims in token, by default it is set to `true`.
+-- `group_filter_type` (String) Specifies the type of group filter if `value_type` is `GROUPS`. Can be set to one of the following `STARTS_WITH`, `EQUALS`, `CONTAINS`, `REGEX`.
+-- `scopes` (Set of String) The list of scopes the auth server claim is tied to.
+-- `status` (String) Default to `ACTIVE`
+-- `value_type` (String) The type of value of the claim. It can be set to `EXPRESSION` or `GROUPS`. It defaults to `EXPRESSION`.
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_auth_server_claim.example &#60;auth server id&#62;/&#60;claim id&#62;
+-```
+diff --git a/docs/resources/auth_server_claim_default.md b/docs/resources/auth_server_claim_default.md
+deleted file mode 100644
+index 4bdf4925..00000000
+--- a/docs/resources/auth_server_claim_default.md
++++ /dev/null
+@@ -1,50 +0,0 @@
+----
+-page_title: "Resource: okta_auth_server_claim_default"
+-description: |-
+-  Configures Default Authorization Server Claim.
+-  This resource allows you to configure Default Authorization Server Claims.
+----
+-
+-# Resource: okta_auth_server_claim_default
+-
+-Configures Default Authorization Server Claim.
+-This resource allows you to configure Default Authorization Server Claims.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_auth_server_claim_default" "example" {
+-  auth_server_id = "<auth server id>"
+-  name           = "sub"
+-  value          = "(appuser != null) ? appuser.userName : app.clientId"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `auth_server_id` (String) ID of the authorization server.
+-- `name` (String) The name of the claim. Can be set to `sub`, `address`, `birthdate`, `email`,`email_verified`, `family_name`, `gender`, `given_name`, `locale`, `middle_name`, `name`, `nickname`,`phone_number`, `picture`, `preferred_username`, `profile`, `updated_at`, `website`, `zoneinfo`
+-
+-### Optional
+-
+-- `always_include_in_token` (Boolean) Specifies whether to include claims in token.
+-- `value` (String) The value of the claim. Only required for `sub` claim.
+-
+-### Read-Only
+-
+-- `claim_type` (String) Specifies whether the claim is for an access token `RESOURCE` or ID token `IDENTITY`.
+-- `id` (String) The ID of this resource.
+-- `scopes` (Set of String) Auth server claim list of scopes
+-- `status` (String) The status of the application.
+-- `value_type` (String) The type of value of the claim.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_auth_server_claim_default.example &#60;auth server id&#62;/&#60;claim name&#62;
+-```
+diff --git a/docs/resources/auth_server_default.md b/docs/resources/auth_server_default.md
+deleted file mode 100644
+index 76c38eb3..00000000
+--- a/docs/resources/auth_server_default.md
++++ /dev/null
+@@ -1,46 +0,0 @@
+----
+-page_title: "Resource: okta_auth_server_default"
+-description: |-
+-  Configures Default Authorization Server. This resource allows you to configure Default Authorization Server.
+----
+-
+-# Resource: okta_auth_server_default
+-
+-Configures Default Authorization Server. This resource allows you to configure Default Authorization Server.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_auth_server_default" "example" {
+-  audiences   = ["api://default"]
+-  description = "Default Authorization Server for your Applications"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Optional
+-
+-- `audiences` (Set of String) The recipients that the tokens are intended for. This becomes the `aud` claim in an access token. Currently Okta only supports a single value here.
+-- `credentials_rotation_mode` (String) The key rotation mode for the authorization server. Can be `AUTO` or `MANUAL`. Default: `MANUAL`.Credential rotation mode, in many cases you cannot set this to MANUAL, the API will ignore the value and you will get a perpetual diff. This should rarely be used.
+-- `description` (String) The description of the authorization server.
+-- `issuer_mode` (String) *Early Access Property*. Allows you to use a custom issuer URL. It can be set to `CUSTOM_URL`, `ORG_URL`, or `DYNAMIC`. Default: `ORG_URL`
+-- `name` (String) The name of the authorization server. Not necessary but left for backwards capacity with legacy implementation.
+-- `status` (String) Default to `ACTIVE`
+-
+-### Read-Only
+-
+-- `credentials_last_rotated` (String) The timestamp when the authorization server started to use the `kid` for signing tokens.
+-- `credentials_next_rotation` (String) The timestamp when the authorization server changes the key for signing tokens. Only returned when `credentials_rotation_mode` is `AUTO`.
+-- `id` (String) The ID of this resource.
+-- `issuer` (String) The complete URL for a Custom Authorization Server. This becomes the `iss` claim in an access token.
+-- `kid` (String) The ID of the JSON Web Key used for signing tokens issued by the authorization server.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_auth_server_default.example &#60;default&#62;
+-```
+diff --git a/docs/resources/auth_server_policy.md b/docs/resources/auth_server_policy.md
+deleted file mode 100644
+index 98bb090a..00000000
+--- a/docs/resources/auth_server_policy.md
++++ /dev/null
+@@ -1,49 +0,0 @@
+----
+-page_title: "Resource: okta_auth_server_policy"
+-description: |-
+-  Creates an Authorization Server Policy. This resource allows you to create and configure an Authorization Server Policy.
+----
+-
+-# Resource: okta_auth_server_policy
+-
+-Creates an Authorization Server Policy. This resource allows you to create and configure an Authorization Server Policy.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_auth_server_policy" "example" {
+-  auth_server_id   = "<auth server id>"
+-  status           = "ACTIVE"
+-  name             = "example"
+-  description      = "example"
+-  priority         = 1
+-  client_whitelist = ["ALL_CLIENTS"]
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `auth_server_id` (String) The ID of the Auth Server.
+-- `client_whitelist` (Set of String) The clients to whitelist the policy for. `[ALL_CLIENTS]` is a special value that can be used to whitelist all clients, otherwise it is a list of client ids.
+-- `description` (String) The description of the Auth Server Policy.
+-- `name` (String) The name of the Auth Server Policy.
+-- `priority` (Number) Priority of the auth server policy
+-
+-### Optional
+-
+-- `status` (String) Default to `ACTIVE`
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_auth_server_policy.example &#60;auth server id&#62;/&#60;policy id&#62;
+-```
+diff --git a/docs/resources/auth_server_policy_rule.md b/docs/resources/auth_server_policy_rule.md
+deleted file mode 100644
+index b26fac78..00000000
+--- a/docs/resources/auth_server_policy_rule.md
++++ /dev/null
+@@ -1,73 +0,0 @@
+----
+-page_title: "Resource: okta_auth_server_policy_rule"
+-description: |-
+-  Creates an Authorization Server Policy Rule.
+-  This resource allows you to create and configure an Authorization Server Policy Rule.
+-  -> This resource is concurrency safe. However, when creating/updating/deleting
+-  multiple rules belonging to a policy, the Terraform meta argument
+-  'depends_on' https://www.terraform.io/language/meta-arguments/depends_on
+-  should be added to each rule chaining them all in sequence. Base the sequence on
+-  the 'priority' property in ascending value.
+----
+-
+-# Resource: okta_auth_server_policy_rule
+-
+-Creates an Authorization Server Policy Rule.
+-This resource allows you to create and configure an Authorization Server Policy Rule.
+--> This resource is concurrency safe. However, when creating/updating/deleting
+-multiple rules belonging to a policy, the Terraform meta argument
+-['depends_on'](https://www.terraform.io/language/meta-arguments/depends_on)
+-should be added to each rule chaining them all in sequence. Base the sequence on
+-the 'priority' property in ascending value.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_auth_server_policy_rule" "example" {
+-  auth_server_id       = "<auth server id>"
+-  policy_id            = "<auth server policy id>"
+-  status               = "ACTIVE"
+-  name                 = "example"
+-  priority             = 1
+-  group_whitelist      = ["<group ids>"]
+-  grant_type_whitelist = ["implicit"]
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `auth_server_id` (String) Auth server ID
+-- `grant_type_whitelist` (Set of String) Accepted grant type values, `authorization_code`, `implicit`, `password`, `client_credentials`, `urn:ietf:params:oauth:grant-type:saml2-bearer` (*Early Access Property*), `urn:ietf:params:oauth:grant-type:token-exchange` (*Early Access Property*),`urn:ietf:params:oauth:grant-type:device_code` (*Early Access Property*), `interaction_code` (*OIE only*). For `implicit` value either `user_whitelist` or `group_whitelist` should be set.
+-- `name` (String) Auth server policy rule name
+-- `policy_id` (String) Auth server policy ID
+-- `priority` (Number) Priority of the auth server policy rule
+-
+-### Optional
+-
+-- `access_token_lifetime_minutes` (Number) Lifetime of access token. Can be set to a value between 5 and 1440 minutes. Default is `60`.
+-- `group_blacklist` (Set of String) Specifies a set of Groups whose Users are to be excluded.
+-- `group_whitelist` (Set of String) Specifies a set of Groups whose Users are to be included. Can be set to Group ID or to the following: `EVERYONE`.
+-- `inline_hook_id` (String) The ID of the inline token to trigger.
+-- `refresh_token_lifetime_minutes` (Number) Lifetime of refresh token.
+-- `refresh_token_window_minutes` (Number) Window in which a refresh token can be used. It can be a value between 5 and 2628000 (5 years) minutes. Default is `10080` (7 days).`refresh_token_window_minutes` must be between `access_token_lifetime_minutes` and `refresh_token_lifetime_minutes`.
+-- `scope_whitelist` (Set of String) Scopes allowed for this policy rule. They can be whitelisted by name or all can be whitelisted with ` * `
+-- `status` (String) Default to `ACTIVE`
+-- `type` (String) Auth server policy rule type, unlikely this will be anything other then the default
+-- `user_blacklist` (Set of String) Specifies a set of Users to be excluded.
+-- `user_whitelist` (Set of String) Specifies a set of Users to be included.
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-- `system` (Boolean) The rule is the system (default) rule for its associated policy
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_auth_server_policy_rule.example &#60;auth server id&#62;/&#60;policy id&#62;/&#60;policy rule id&#62;
+-```
+diff --git a/docs/resources/auth_server_scope.md b/docs/resources/auth_server_scope.md
+deleted file mode 100644
+index 43391c1c..00000000
+--- a/docs/resources/auth_server_scope.md
++++ /dev/null
+@@ -1,50 +0,0 @@
+----
+-page_title: "Resource: okta_auth_server_scope"
+-description: |-
+-  Creates an Authorization Server Scope. This resource allows you to create and configure an Authorization Server Scope.
+----
+-
+-# Resource: okta_auth_server_scope
+-
+-Creates an Authorization Server Scope. This resource allows you to create and configure an Authorization Server Scope.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_auth_server_scope" "example" {
+-  auth_server_id   = "<auth server id>"
+-  metadata_publish = "NO_CLIENTS"
+-  name             = "example"
+-  consent          = "IMPLICIT"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `auth_server_id` (String) Auth server ID
+-- `name` (String) Auth server scope name
+-
+-### Optional
+-
+-- `consent` (String) Indicates whether a consent dialog is needed for the scope. It can be set to `REQUIRED` or `IMPLICIT`. Default: `IMPLICIT`
+-- `default` (Boolean) A default scope will be returned in an access token when the client omits the scope parameter in a token request, provided this scope is allowed as part of the access policy rule.
+-- `description` (String) Description of the Auth Server Scope.
+-- `display_name` (String) Name of the end user displayed in a consent dialog box
+-- `metadata_publish` (String) Whether to publish metadata or not. It can be set to `ALL_CLIENTS` or `NO_CLIENTS`. Default: `ALL_CLIENTS`
+-- `optional` (Boolean) Whether the scope optional
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-- `system` (Boolean) Whether Okta created the Scope
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_auth_server_scope.example &#60;auth server id&#62;/&#60;scope id&#62;
+-```
+diff --git a/docs/resources/authenticator.md b/docs/resources/authenticator.md
+deleted file mode 100644
+index 9cbf3eed..00000000
+--- a/docs/resources/authenticator.md
++++ /dev/null
+@@ -1,88 +0,0 @@
+----
+-page_title: "Resource: okta_authenticator"
+-description: |-
+-  ~> WARNING: This feature is only available as a part of the Identity Engine. Contact support mailto:dev-inquiries@okta.com for further information.
+-  This resource allows you to configure different authenticators.
+-  -> Create: The Okta API has an odd notion of create for authenticators. If
+-  the authenticator doesn't exist then a one time 'POST /api/v1/authenticators' to
+-  create the authenticator (hard create) will be performed. Thereafter, that
+-  authenticator is never deleted, it is only deactivated (soft delete). Therefore,
+-  if the authenticator already exists create is just a soft import of an existing
+-  authenticator. This does not apply to customotp authenticator. There can be
+-  multiple customotp authenticator. To create new customotp authenticator, a new
+-  name and key = customotp is required. If an old name is used, it will simply
+-  reactivate the old custom_otp authenticator
+-  -> Delete: Authenticators can not be truly deleted therefore delete is soft.
+-  Delete will attempt to deativate the authenticator. An authenticator can only be
+-  deactivated if it's not in use by any other policy.
+----
+-
+-# Resource: okta_authenticator
+-
+-~> **WARNING:** This feature is only available as a part of the Identity Engine. [Contact support](mailto:dev-inquiries@okta.com) for further information.
+-
+-This resource allows you to configure different authenticators.
+-
+--> **Create:** The Okta API has an odd notion of create for authenticators. If
+-the authenticator doesn't exist then a one time 'POST /api/v1/authenticators' to
+-create the authenticator (hard create) will be performed. Thereafter, that
+-authenticator is never deleted, it is only deactivated (soft delete). Therefore,
+-if the authenticator already exists create is just a soft import of an existing
+-authenticator. This does not apply to custom_otp authenticator. There can be 
+-multiple custom_otp authenticator. To create new custom_otp authenticator, a new 
+-name and key = custom_otp is required. If an old name is used, it will simply 
+-reactivate the old custom_otp authenticator
+-
+--> **Delete:** Authenticators can not be truly deleted therefore delete is soft.
+-Delete will attempt to deativate the authenticator. An authenticator can only be
+-deactivated if it's not in use by any other policy.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_authenticator" "test" {
+-  name = "Security Question"
+-  key  = "security_question"
+-  settings = jsonencode(
+-    {
+-      "allowedFor" : "recovery"
+-    }
+-  )
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `key` (String) A human-readable string that identifies the authenticator. Some authenticators are available by feature flag on the organization. Possible values inclue: `duo`, `external_idp`, `google_otp`, `okta_email`, `okta_password`, `okta_verify`, `onprem_mfa`, `phone_number`, `rsa_token`, `security_question`, `webauthn`
+-- `name` (String) Display name of the Authenticator
+-
+-### Optional
+-
+-- `provider_auth_port` (Number) The RADIUS server port (for example 1812). This is defined when the On-Prem RADIUS server is configured. Used only for authenticators with type `security_key`.  Conflicts with `provider_json` argument.
+-- `provider_host` (String) (DUO specific) - The Duo Security API hostname. Conflicts with `provider_json` argument.
+-- `provider_hostname` (String) Server host name or IP address. Default is `localhost`. Used only for authenticators with type `security_key`. Conflicts with `provider_json` argument.
+-- `provider_integration_key` (String) (DUO specific) - The Duo Security integration key.  Conflicts with `provider_json` argument.
+-- `provider_json` (String) Provider JSON allows for expressive providervalues. This argument conflicts with the other 'provider_xxx' arguments. The [CreateProvider](https://developer.okta.com/docs/reference/api/authenticators-admin/#request) illustrates detailed provider values for a Duo authenticator. [Provider values](https://developer.okta.com/docs/reference/api/authenticators-admin/#authenticators-administration-api-object)are listed in Okta API.
+-- `provider_secret_key` (String) (DUO specific) - The Duo Security secret key.  Conflicts with `provider_json` argument.
+-- `provider_shared_secret` (String, Sensitive) An authentication key that must be defined when the RADIUS server is configured, and must be the same on both the RADIUS client and server. Used only for authenticators with type `security_key`. Conflicts with `provider_json` argument.
+-- `provider_user_name_template` (String) Username template expected by the provider. Used only for authenticators with type `security_key`.  Conflicts with `provider_json` argument.
+-- `settings` (String) Settings for the authenticator. The settings JSON contains values based on Authenticator key. It is not used for authenticators with type `security_key`
+-- `status` (String) Authenticator status: `ACTIVE` or `INACTIVE`. Default: `ACTIVE`
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-- `provider_instance_id` (String) App Instance ID.
+-- `provider_type` (String) Provider type. Supported value for Duo: `DUO`. Supported value for Custom App: `PUSH`
+-- `type` (String) he type of Authenticator. Values include: `password`, `security_question`, `phone`, `email`, `app`, `federated`, and `security_key`.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_authenticator.example &#60;authenticator_id&#62;
+-```
+diff --git a/docs/resources/behavior.md b/docs/resources/behavior.md
+deleted file mode 100644
+index 7824cb77..00000000
+--- a/docs/resources/behavior.md
++++ /dev/null
+@@ -1,74 +0,0 @@
+----
+-page_title: "Resource: okta_behavior"
+-description: |-
+-  This resource allows you to create and configure a behavior.
+----
+-
+-# Resource: okta_behavior
+-
+-This resource allows you to create and configure a behavior.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_behavior" "my_location" {
+-  name                      = "My Location"
+-  type                      = "ANOMALOUS_LOCATION"
+-  number_of_authentications = 50
+-  location_granularity_type = "LAT_LONG"
+-  radius_from_location      = 20
+-}
+-
+-resource "okta_behavior" "my_city" {
+-  name                      = "My City"
+-  type                      = "ANOMALOUS_LOCATION"
+-  number_of_authentications = 50
+-  location_granularity_type = "CITY"
+-}
+-
+-resource "okta_behavior" "my_device" {
+-  name                      = "My Device"
+-  type                      = "ANOMALOUS_DEVICE"
+-  number_of_authentications = 50
+-}
+-
+-resource "okta_behavior" "my_ip" {
+-  name                      = "My IP"
+-  type                      = "ANOMALOUS_IP"
+-  number_of_authentications = 50
+-}
+-
+-resource "okta_behavior" "my_velocity" {
+-  name     = "My Velocity"
+-  type     = "VELOCITY"
+-  velocity = 25
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `name` (String) Name of the behavior
+-- `type` (String) Type of the behavior. Can be set to `ANOMALOUS_LOCATION`, `ANOMALOUS_DEVICE`, `ANOMALOUS_IP` or `VELOCITY`. Resource will be recreated when the type changes.e
+-
+-### Optional
+-
+-- `location_granularity_type` (String) Determines the method and level of detail used to evaluate the behavior. Required for `ANOMALOUS_LOCATION` behavior type. Can be set to `LAT_LONG`, `CITY`, `COUNTRY` or `SUBDIVISION`.
+-- `number_of_authentications` (Number) The number of recent authentications used to evaluate the behavior. Required for `ANOMALOUS_LOCATION`, `ANOMALOUS_DEVICE` and `ANOMALOUS_IP` behavior types.
+-- `radius_from_location` (Number) Radius from location (in kilometers). Should be at least 5. Required when `location_granularity_type` is set to `LAT_LONG`.
+-- `status` (String) Behavior status: ACTIVE or INACTIVE. Default: `ACTIVE`
+-- `velocity` (Number) Velocity (in kilometers per hour). Should be at least 1. Required for `VELOCITY` behavior
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_behavior.example &#60;behavior id&#62;
+-```
+diff --git a/docs/resources/brand.md b/docs/resources/brand.md
+deleted file mode 100644
+index d3042bae..00000000
+--- a/docs/resources/brand.md
++++ /dev/null
+@@ -1,50 +0,0 @@
+----
+-page_title: "Resource: okta_brand"
+-description: |-
+-  Manages brand. This resource allows you to create and configure an Okta Brand https://developer.okta.com/docs/reference/api/brands/#brand-object.
+----
+-
+-# Resource: okta_brand
+-
+-Manages brand. This resource allows you to create and configure an Okta [Brand](https://developer.okta.com/docs/reference/api/brands/#brand-object).
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_brand" "example" {
+-  name = "example"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `name` (String) Name of the brand
+-
+-### Optional
+-
+-- `agree_to_custom_privacy_policy` (Boolean) Is a required input flag with when changing custom_privacy_url, shouldn't be considered as a readable property
+-- `brand_id` (String, Deprecated) Brand ID - Note: Okta API for brands only reads and updates therefore the okta_brand resource needs to act as a quasi data source. Do this by setting brand_id. `DEPRECATED`: Okta has fully support brand creation, this attribute is a no op and will be removed
+-- `custom_privacy_policy_url` (String) Custom privacy policy URL
+-- `default_app_app_instance_id` (String) Default app app instance id
+-- `default_app_app_link_name` (String) Default app app link name
+-- `default_app_classic_application_uri` (String) Default app classic application uri
+-- `locale` (String) The language specified as an IETF BCP 47 language tag
+-- `remove_powered_by_okta` (Boolean) Removes "Powered by Okta" from the Okta-hosted sign-in page and "© 2021 Okta, Inc." from the Okta End-User Dashboard
+-
+-### Read-Only
+-
+-- `email_domain_id` (String) Email Domain ID tied to this brand
+-- `id` (String) Brand id
+-- `is_default` (Boolean) Is this the default brand
+-- `links` (String) Link relations for this object - JSON HAL - Discoverable resources related to the brand
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_brand.example &#60;brand id&#62;
+-```
+diff --git a/docs/resources/captcha.md b/docs/resources/captcha.md
+deleted file mode 100644
+index bfc5b80d..00000000
+--- a/docs/resources/captcha.md
++++ /dev/null
+@@ -1,46 +0,0 @@
+----
+-page_title: "Resource: okta_captcha"
+-description: |-
+-  Creates different types of captcha.
+-          ~> WARNING: This feature is only available as a part of the Identity Engine. Contact support mailto:dev-inquiries@okta.com for further information.
+-          This resource allows you to create and configure a CAPTCHA.
+----
+-
+-# Resource: okta_captcha
+-
+-Creates different types of captcha.
+-		~> **WARNING:** This feature is only available as a part of the Identity Engine. [Contact support](mailto:dev-inquiries@okta.com) for further information.
+-		This resource allows you to create and configure a CAPTCHA.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_captcha" "example" {
+-  name       = "My CAPTCHA"
+-  type       = "HCAPTCHA"
+-  site_key   = "some_key"
+-  secret_key = "some_secret_key"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `name` (String) Name of the CAPTCHA
+-- `secret_key` (String, Sensitive) Secret key issued from the CAPTCHA vendor to perform server-side validation for a CAPTCHA token
+-- `site_key` (String) Site key issued from the CAPTCHA vendor to render a CAPTCHA on a page
+-- `type` (String) Type of the captcha. Valid values: `HCAPTCHA`, `RECAPTCHA_V2`
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_captcha.example &#60;captcha id&#62;
+-```
+diff --git a/docs/resources/captcha_org_wide_settings.md b/docs/resources/captcha_org_wide_settings.md
+deleted file mode 100644
+index d9ea8d7f..00000000
+--- a/docs/resources/captcha_org_wide_settings.md
++++ /dev/null
+@@ -1,63 +0,0 @@
+----
+-page_title: "Resource: okta_captcha_org_wide_settings"
+-description: |-
+-  Manages Org-Wide CAPTCHA settings
+-  ~> WARNING: This feature is only available as a part of the Identity Engine. Contact support mailto:dev-inquiries@okta.com for further information.
+-  This resource allows you to configure which parts of the authentication flow requires users to pass the CAPTCHA logic.
+-  CAPTCHA org-wide settings can be disabled by unsetting 'captchaid' and 'enabledfor'.
+----
+-
+-# Resource: okta_captcha_org_wide_settings
+-
+-Manages Org-Wide CAPTCHA settings
+-~> **WARNING:** This feature is only available as a part of the Identity Engine. [Contact support](mailto:dev-inquiries@okta.com) for further information.
+-This resource allows you to configure which parts of the authentication flow requires users to pass the CAPTCHA logic.
+-CAPTCHA org-wide settings can be disabled by unsetting 'captcha_id' and 'enabled_for'.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_captcha" "example" {
+-  name       = "My CAPTCHA"
+-  type       = "HCAPTCHA"
+-  site_key   = "some_key"
+-  secret_key = "some_secret_key"
+-}
+-
+-resource "okta_captcha_org_wide_settings" "example" {
+-  captcha_id  = okta_captcha.test.id
+-  enabled_for = ["SSR"]
+-}
+-
+-### The following example disables org-wide CAPTCHA.
+-
+-resource "okta_captcha" "example" {
+-  name       = "My CAPTCHA"
+-  type       = "HCAPTCHA"
+-  site_key   = "some_key"
+-  secret_key = "some_secret_key"
+-}
+-
+-resource "okta_captcha_org_wide_settings" "example" {
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Optional
+-
+-- `captcha_id` (String) Array of pages that have CAPTCHA enabled. Valid values: `SSR`, `SSPR` and `SIGN_IN`.
+-- `enabled_for` (Set of String) Set of pages that have CAPTCHA enabled
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_captcha_org_wide_settings.example _
+-```
+diff --git a/docs/resources/customized_signin_page.md b/docs/resources/customized_signin_page.md
+deleted file mode 100644
+index a79b5a54..00000000
+--- a/docs/resources/customized_signin_page.md
++++ /dev/null
+@@ -1,98 +0,0 @@
+----
+-page_title: "Resource: okta_customized_signin_page"
+-description: |-
+-  Manage the customized signin page of a brand
+----
+-
+-# Resource: okta_customized_signin_page
+-
+-Manage the customized signin page of a brand
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_brand" "test" {
+-  name   = "testBrand"
+-  locale = "en"
+-}
+-
+-resource "okta_customized_signin_page" "test" {
+-  brand_id       = resource.okta_brand.test.id
+-  page_content   = "<!DOCTYPE html PUBLIC \"-//W3C//DTD HTML 4.01//EN\" \"http://www.w3.org/TR/html4/strict.dtd\">\n<html>\n<head>\n    <meta http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-8\">\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />\n    <meta name=\"robots\" content=\"noindex,nofollow\" />\n    <!-- Styles generated from theme -->\n    <link href=\"{{themedStylesUrl}}\" rel=\"stylesheet\" type=\"text/css\">\n    <!-- Favicon from theme -->\n    <link rel=\"shortcut icon\" href=\"{{faviconUrl}}\" type=\"image/x-icon\"/>\n\n    <title>{{pageTitle}}</title>\n    {{{SignInWidgetResources}}}\n\n    <style nonce=\"{{nonceValue}}\">\n        #login-bg-image-id {\n            background-image: {{bgImageUrl}}\n        }\n    </style>\n</head>\n<body>\n    <div id=\"login-bg-image-id\" class=\"login-bg-image tb--background\"></div>\n    <div id=\"okta-login-container\"></div>\n\n    <!--\n        \"OktaUtil\" defines a global OktaUtil object\n        that contains methods used to complete the Okta login flow.\n     -->\n    {{{OktaUtil}}}\n\n    <script type=\"text/javascript\" nonce=\"{{nonceValue}}\">\n        // \"config\" object contains default widget configuration\n        // with any custom overrides defined in your admin settings.\n        var config = OktaUtil.getSignInWidgetConfig();\n\n        // Render the Okta Sign-In Widget\n        var oktaSignIn = new OktaSignIn(config);\n        oktaSignIn.renderEl({ el: '#okta-login-container' },\n            OktaUtil.completeLogin,\n            function(error) {\n                // Logs errors that occur when configuring the widget.\n                // Remove or replace this with your own custom error handler.\n                console.log(error.message, error);\n            }\n        );\n    </script>\n</body>\n</html>\n"
+-  widget_version = "^6"
+-  widget_customizations {
+-    widget_generation = "G3"
+-  }
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `brand_id` (String) brand id of the preview signin page
+-- `page_content` (String) page content of the preview signin page
+-- `widget_version` (String) widget version specified as a Semver. The following are currently supported
+-			*, ^1, ^2, ^3, ^4, ^5, ^6, ^7, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11, 1.12, 1.13, 2.1, 2.2, 2.3, 2.4, 
+-			2.5, 2.6, 2.7, 2.8, 2.9, 2.10, 2.11, 2.12, 2.13, 2.14, 2.15, 2.16, 2.17, 2.18, 2.19, 2.20, 2.21, 
+-			3.0, 3.1, 3.2, 3.3, 3.4, 3.5, 3.6, 3.7, 3.8, 3.9, 4.0, 4.1, 4.2, 4.3, 4.4, 4.5, 5.0, 5.1, 5.2, 5.3, 
+-			5.4, 5.5, 5.6, 5.7, 5.8, 5.9, 5.10, 5.11, 5.12, 5.13, 5.14, 5.15, 5.16, 6.0, 6.1, 6.2, 6.3, 6.4, 6.5, 
+-			6.6, 6.7, 6.8, 6.9, 7.0, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.7, 7.8, 7.9, 7.10, 7.11, 7.12, 7.13.
+-
+-### Optional
+-
+-- `content_security_policy_setting` (Block, Optional) (see [below for nested schema](#nestedblock--content_security_policy_setting))
+-- `widget_customizations` (Block, Optional) (see [below for nested schema](#nestedblock--widget_customizations))
+-
+-### Read-Only
+-
+-- `id` (String) placeholder id
+-
+-<a id="nestedblock--content_security_policy_setting"></a>
+-### Nested Schema for `content_security_policy_setting`
+-
+-Optional:
+-
+-- `mode` (String) enforced or report_only
+-- `report_uri` (String)
+-- `src_list` (List of String)
+-
+-
+-<a id="nestedblock--widget_customizations"></a>
+-### Nested Schema for `widget_customizations`
+-
+-Required:
+-
+-- `widget_generation` (String)
+-
+-Optional:
+-
+-- `authenticator_page_custom_link_label` (String)
+-- `authenticator_page_custom_link_url` (String)
+-- `classic_recovery_flow_email_or_username_label` (String)
+-- `custom_link_1_label` (String)
+-- `custom_link_1_url` (String)
+-- `custom_link_2_label` (String)
+-- `custom_link_2_url` (String)
+-- `forgot_password_label` (String)
+-- `forgot_password_url` (String)
+-- `help_label` (String)
+-- `help_url` (String)
+-- `password_info_tip` (String)
+-- `password_label` (String)
+-- `show_password_visibility_toggle` (Boolean)
+-- `show_user_identifier` (Boolean)
+-- `sign_in_label` (String)
+-- `unlock_account_label` (String)
+-- `unlock_account_url` (String)
+-- `username_info_tip` (String)
+-- `username_label` (String)
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_customized_signin_page.example &#60;customized_signin_page_id&#62;
+-```
+diff --git a/docs/resources/domain.md b/docs/resources/domain.md
+deleted file mode 100644
+index bd8d3066..00000000
+--- a/docs/resources/domain.md
++++ /dev/null
+@@ -1,53 +0,0 @@
+----
+-page_title: "Resource: okta_domain"
+-description: |-
+-  Manages custom domain for your organization.
+----
+-
+-# Resource: okta_domain
+-
+-Manages custom domain for your organization.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_domain" "example" {
+-  name = "www.example.com"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `name` (String) Custom Domain name
+-
+-### Optional
+-
+-- `brand_id` (String) Brand id of the domain
+-- `certificate_source_type` (String) Certificate source type that indicates whether the certificate is provided by the user or Okta. Accepted values: `MANUAL`, `OKTA_MANAGED`. Warning: Use of OKTA_MANAGED requires a feature flag to be enabled. Default value = MANUAL
+-
+-### Read-Only
+-
+-- `dns_records` (List of Object) TXT and CNAME records to be registered for the Domain (see [below for nested schema](#nestedatt--dns_records))
+-- `id` (String) The ID of this resource.
+-- `validation_status` (String) Status of the domain
+-
+-<a id="nestedatt--dns_records"></a>
+-### Nested Schema for `dns_records`
+-
+-Read-Only:
+-
+-- `expiration` (String)
+-- `fqdn` (String)
+-- `record_type` (String)
+-- `values` (List of String)
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_domain.example &#60;domain_id&#62;
+-```
+diff --git a/docs/resources/domain_certificate.md b/docs/resources/domain_certificate.md
+deleted file mode 100644
+index 89f91442..00000000
+--- a/docs/resources/domain_certificate.md
++++ /dev/null
+@@ -1,103 +0,0 @@
+----
+-page_title: "Resource: okta_domain_certificate"
+-description: |-
+-  Manages certificate for the domain.
+-  This resource's 'certificate', 'privatekey', and 'certificatechain' attributes
+-  hold actual PEM values and can be referred to by other configs requiring
+-  certificate and private key inputs. This is inline with TF's best
+-  practices https://developer.hashicorp.com/terraform/plugin/sdkv2/best-practices/sensitive-state#don-t-encrypt-state
+-  of not encrypting state.
+-  See Let's Encrypt Certbot notes at the end of this
+-  documentation for notes on how to generate a domain certificate with Let's Encrypt Certbot
+----
+-
+-# Resource: okta_domain_certificate
+-
+-Manages certificate for the domain.
+-This resource's 'certificate', 'private_key', and 'certificate_chain' attributes
+-hold actual PEM values and can be referred to by other configs requiring
+-certificate and private key inputs. This is inline with TF's [best
+-practices](https://developer.hashicorp.com/terraform/plugin/sdkv2/best-practices/sensitive-state#don-t-encrypt-state)
+-of not encrypting state.
+-See [Let's Encrypt Certbot notes](#lets-encrypt-certbot) at the end of this
+-documentation for notes on how to generate a domain certificate with Let's Encrypt Certbot
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_domain" "example" {
+-  name = "www.example.com"
+-}
+-
+-resource "okta_domain_certificate" "test" {
+-  domain_id = okta_domain.test.id
+-  type      = "PEM"
+-
+-
+-  #certificate = file("www.example.com/cert.pem")
+-  certificate = <<CERT
+------BEGIN CERTIFICATE-----
+-MIIFNzCCBB+gAwIBAgISBAXomJWRama3ypu8TIxdA9wzMA0GCSqGSIb3DQEBCwUA
+-...
+-NSgRtSXq11j8O4JONi8EXe7cEtvzUiLR5PL3itsK2svtrZ9jIwQ95wOPaA==
+------END CERTIFICATE-----
+-CERT
+-
+-  #certificate_chain = file("www.example.com/chain.pem")
+-  certificate_chain = <<CHAIN
+------BEGIN CERTIFICATE-----
+-MIIFFjCCAv6gAwIBAgIRAJErCErPDBinU/bWLiWnX1owDQYJKoZIhvcNAQELBQAw
+-...
+-Dfvp7OOGAN6dEOM4+qR9sdjoSYKEBpsr6GtPAQw4dy753ec5
+------END CERTIFICATE-----
+-CHAIN
+-
+-  #private_key = file("www.example.com/privkey.pem")
+-  private_key = <<PK
+------BEGIN PRIVATE KEY-----
+-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC5cyk6x63iBJSW
+-...
+-nUFLNE8pXSnsqb0eOL74f3uQ
+------END PRIVATE KEY-----
+-PK
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `certificate` (String) Certificate content
+-- `certificate_chain` (String) Certificate chain
+-- `domain_id` (String) Domain's ID
+-- `private_key` (String) Certificate private key
+-
+-### Optional
+-
+-- `type` (String) Certificate type. Valid value is `PEM`
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-
+-
+-## Let's Encrypt Certbot
+-
+-This example demonstrates generatoring a domain certificate with letsencrypt
+-certbot https://letsencrypt.org/getting-started/
+-
+-```
+-$ certbot certonly --manual --preferred-challenges dns --key-type rsa -d [DOMAIN]
+-```
+-
+-Use letsencrypt's certbot to generate domain certificates in RSA output mode.
+-The generator's output corresponds to `okta_domain_certificate` fields in the
+-following manner.
+-
+-Okta Field          | Certbot file
+---------------------|--------------
+-`certificate`       | `cert.pem`
+-`certificate_chain` | `chain.pem`
+-`private_key`       | `privkey.pem`
+\ No newline at end of file
+diff --git a/docs/resources/domain_verification.md b/docs/resources/domain_verification.md
+deleted file mode 100644
+index 347eae27..00000000
+--- a/docs/resources/domain_verification.md
++++ /dev/null
+@@ -1,34 +0,0 @@
+----
+-page_title: "Resource: okta_domain_verification"
+-description: |-
+-  Verifies the Domain. This is replacement for the verify field from the okta_domain resource. The resource won't be created if the domain could not be verified. The provider will make several requests to verify the domain until the API returns VERIFIED verification status.
+----
+-
+-# Resource: okta_domain_verification
+-
+-Verifies the Domain. This is replacement for the `verify` field from the `okta_domain` resource. The resource won't be created if the domain could not be verified. The provider will make several requests to verify the domain until the API returns `VERIFIED` verification status.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_domain" "example" {
+-  name = "www.example.com"
+-}
+-
+-resource "okta_domain_verification" "example" {
+-  domain_id = okta_domain.test.id
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `domain_id` (String) Domain's ID
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-
+diff --git a/docs/resources/email_customization.md b/docs/resources/email_customization.md
+deleted file mode 100644
+index 84ebc07a..00000000
+--- a/docs/resources/email_customization.md
++++ /dev/null
+@@ -1,127 +0,0 @@
+----
+-page_title: "Resource: okta_email_customization"
+-description: |-
+-  Create an email customization of an email template belonging to a brand in an Okta organization.
+-          Use this resource to create an email
+-          customization https://developer.okta.com/docs/reference/api/brands/#create-email-customization
+-          of an email template belonging to a brand in an Okta organization.
+-          ~> Okta's public API is strict regarding the behavior of the 'isdefault'
+-          property in an email
+-          customization https://developer.okta.com/docs/reference/api/brands/#email-customization.
+-          Make use of 'dependson' meta argument to ensure the provider navigates email customization
+-          language versions seamlessly. Have all secondary customizations depend on the primary
+-          customization that is marked default. See Example Usage.
+-          ~> Caveats for creating an email
+-          customization https://developer.okta.com/docs/reference/api/brands/#response-body-19.
+-          If this is the first customization being created for the email template, and
+-          'isdefault' is not set for the customization in its resource configuration, the
+-          API will respond with the created customization marked as default. The API will
+-          400 if the language parameter is not one of the supported languages or the body
+-          parameter does not contain a required variable reference. The API will error 409
+-          if 'isdefault' is true and a default customization exists. The API will 404 for
+-          an invalid 'brandid' or 'templatename'.
+-          ~> Caveats for updating an email
+-          customization https://developer.okta.com/docs/reference/api/brands/#response-body-22.
+-          If the 'isdefault' parameter is true, the previous default email customization
+-          has its 'isdefault' set to false (see previous note about mitigating this with
+-          'dependson' meta argument). The API will 409 if there’s already another email
+-          customization for the specified language or the 'isdefault' parameter is false
+-          and the email customization being updated is the default. The API will 400 if
+-          the language parameter is not one of the supported locales or the body parameter
+-          does not contain a required variable reference.  The API will 404 for an invalid
+-          'brandid' or 'templatename'.
+----
+-
+-# Resource: okta_email_customization
+-
+-Create an email customization of an email template belonging to a brand in an Okta organization.
+-		Use this resource to create an [email
+-		customization](https://developer.okta.com/docs/reference/api/brands/#create-email-customization)
+-		of an email template belonging to a brand in an Okta organization.
+-		~> Okta's public API is strict regarding the behavior of the 'is_default'
+-		property in [an email
+-		customization](https://developer.okta.com/docs/reference/api/brands/#email-customization).
+-		Make use of 'depends_on' meta argument to ensure the provider navigates email customization
+-		language versions seamlessly. Have all secondary customizations depend on the primary
+-		customization that is marked default. See [Example Usage](#example-usage).
+-		~> Caveats for [creating an email
+-		customization](https://developer.okta.com/docs/reference/api/brands/#response-body-19).
+-		If this is the first customization being created for the email template, and
+-		'is_default' is not set for the customization in its resource configuration, the
+-		API will respond with the created customization marked as default. The API will
+-		400 if the language parameter is not one of the supported languages or the body
+-		parameter does not contain a required variable reference. The API will error 409
+-		if 'is_default' is true and a default customization exists. The API will 404 for
+-		an invalid 'brand_id' or 'template_name'.
+-		~> Caveats for [updating an email
+-		customization](https://developer.okta.com/docs/reference/api/brands/#response-body-22).
+-		If the 'is_default' parameter is true, the previous default email customization
+-		has its 'is_default' set to false (see previous note about mitigating this with
+-		'depends_on' meta argument). The API will 409 if there’s already another email
+-		customization for the specified language or the 'is_default' parameter is false
+-		and the email customization being updated is the default. The API will 400 if
+-		the language parameter is not one of the supported locales or the body parameter
+-		does not contain a required variable reference.  The API will 404 for an invalid
+-		'brand_id' or 'template_name'.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_brands" "test" {
+-}
+-
+-data "okta_email_customizations" "forgot_password" {
+-  brand_id      = tolist(data.okta_brands.test.brands)[0].id
+-  template_name = "ForgotPassword"
+-}
+-
+-resource "okta_email_customization" "forgot_password_en" {
+-  brand_id      = tolist(data.okta_brands.test.brands)[0].id
+-  template_name = "ForgotPassword"
+-  language      = "en"
+-  is_default    = true
+-  subject       = "Account password reset"
+-  body          = "Hi $$user.firstName,<br/><br/>Click this link to reset your password: $$resetPasswordLink"
+-}
+-
+-resource "okta_email_customization" "forgot_password_es" {
+-  brand_id      = tolist(data.okta_brands.test.brands)[0].id
+-  template_name = "ForgotPassword"
+-  language      = "es"
+-  subject       = "Restablecimiento de contraseña de cuenta"
+-  body          = "Hola $$user.firstName,<br/><br/>Haga clic en este enlace para restablecer tu contraseña: $$resetPasswordLink"
+-
+-  depends_on = [
+-    okta_email_customization.forgot_password_en
+-  ]
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `brand_id` (String) Brand ID
+-- `template_name` (String) Template Name - Example values: `AccountLockout`,`ADForgotPassword`,`ADForgotPasswordDenied`,`ADSelfServiceUnlock`,`ADUserActivation`,`AuthenticatorEnrolled`,`AuthenticatorReset`,`ChangeEmailConfirmation`,`EmailChallenge`,`EmailChangeConfirmation`,`EmailFactorVerification`,`ForgotPassword`,`ForgotPasswordDenied`,`IGAReviewerEndNotification`,`IGAReviewerNotification`,`IGAReviewerPendingNotification`,`IGAReviewerReassigned`,`LDAPForgotPassword`,`LDAPForgotPasswordDenied`,`LDAPSelfServiceUnlock`,`LDAPUserActivation`,`MyAccountChangeConfirmation`,`NewSignOnNotification`,`OktaVerifyActivation`,`PasswordChanged`,`PasswordResetByAdmin`,`PendingEmailChange`,`RegistrationActivation`,`RegistrationEmailVerification`,`SelfServiceUnlock`,`SelfServiceUnlockOnUnlockedAccount`,`UserActivation`
+-
+-### Optional
+-
+-- `body` (String) The body of the customization
+-- `force_is_default` (String, Deprecated) Force is_default on the create and delete by deleting all email customizations. Comma separated string with values of 'create' or 'destroy' or both `create,destroy'.
+-- `is_default` (Boolean) Whether the customization is the default
+-- `language` (String) The language supported by the customization - Example values from [supported languages](https://developer.okta.com/docs/reference/api/brands/#supported-languages)
+-- `subject` (String) The subject of the customization
+-
+-### Read-Only
+-
+-- `id` (String) The ID of the customization
+-- `links` (String) Link relations for this object - JSON HAL - Discoverable resources related to the email template
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_email_customization.example &#60;customization_id&#62;/&#60;brand_id&#62;/&#60;template_name&#62;
+-```
+diff --git a/docs/resources/email_domain.md b/docs/resources/email_domain.md
+deleted file mode 100644
+index b74add11..00000000
+--- a/docs/resources/email_domain.md
++++ /dev/null
+@@ -1,54 +0,0 @@
+----
+-page_title: "Resource: okta_email_domain"
+-description: |-
+-  Creates email domain. This resource allows you to create and configure an email domain.
+----
+-
+-# Resource: okta_email_domain
+-
+-Creates email domain. This resource allows you to create and configure an email domain.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_email_domain" "example" {
+-  brand_id     = "abc123"
+-  domain       = "example.com"
+-  display_name = "test"
+-  user_name    = "paul_atreides"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `brand_id` (String) Brand id of the email domain.
+-- `display_name` (String) Display name of the email domain.
+-- `domain` (String) Mail domain to send from.
+-- `user_name` (String) User name of the email domain.
+-
+-### Read-Only
+-
+-- `dns_validation_records` (List of Object) TXT and cname records to be registered for the email Domain (see [below for nested schema](#nestedatt--dns_validation_records))
+-- `id` (String) The ID of this resource.
+-- `validation_status` (String) Status of the email domain. Values: NOT_STARTED, IN_PROGRESS, VERIFIED, COMPLETED
+-
+-<a id="nestedatt--dns_validation_records"></a>
+-### Nested Schema for `dns_validation_records`
+-
+-Read-Only:
+-
+-- `expiration` (String)
+-- `fqdn` (String)
+-- `record_type` (String)
+-- `value` (String)
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_email_domain.example &#60;domain id&#62;
+-```
+diff --git a/docs/resources/email_domain_verification.md b/docs/resources/email_domain_verification.md
+deleted file mode 100644
+index a7da883d..00000000
+--- a/docs/resources/email_domain_verification.md
++++ /dev/null
+@@ -1,37 +0,0 @@
+----
+-page_title: "Resource: okta_email_domain_verification"
+-description: |-
+-  Verifies the email domain. The resource won't be created if the email domain could not be verified.
+----
+-
+-# Resource: okta_email_domain_verification
+-
+-Verifies the email domain. The resource won't be created if the email domain could not be verified.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_email_domain" "example" {
+-  brand_id     = "abc123"
+-  domain       = "example.com"
+-  display_name = "test"
+-  user_name    = "paul_atreides"
+-}
+-
+-resource "okta_email_domain_verification" "example" {
+-  email_domain_id = okta_email_domain.valid.id
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `email_domain_id` (String) Email domain ID
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-
+diff --git a/docs/resources/email_sender.md b/docs/resources/email_sender.md
+deleted file mode 100644
+index a1629741..00000000
+--- a/docs/resources/email_sender.md
++++ /dev/null
+@@ -1,53 +0,0 @@
+----
+-page_title: "Resource: okta_email_sender"
+-description: |-
+-  Creates custom email sender. This resource allows you to create and configure a custom email sender.
+----
+-
+-# Resource: okta_email_sender
+-
+-Creates custom email sender. This resource allows you to create and configure a custom email sender.
+-
+-~> **DEPRECATED** The api for this resource has been deprecated. Please use `okta_email_domain` instead.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_email_sender" "example" {
+-  from_name    = "Paul Atreides"
+-  from_address = "no-reply@caladan.planet"
+-  subdomain    = "mail"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `from_address` (String) Email address to send from
+-- `from_name` (String) Name of sender
+-- `subdomain` (String) Mail domain to send from
+-
+-### Read-Only
+-
+-- `dns_records` (List of Object) TXT and CNAME records to be registered for the Domain (see [below for nested schema](#nestedatt--dns_records))
+-- `id` (String) The ID of this resource.
+-- `status` (String) Verification status
+-
+-<a id="nestedatt--dns_records"></a>
+-### Nested Schema for `dns_records`
+-
+-Read-Only:
+-
+-- `fqdn` (String)
+-- `record_type` (String)
+-- `value` (String)
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_email_sender.example &#60;sender id&#62;
+-```
+\ No newline at end of file
+diff --git a/docs/resources/email_sender_verification.md b/docs/resources/email_sender_verification.md
+deleted file mode 100644
+index b7f2d77c..00000000
+--- a/docs/resources/email_sender_verification.md
++++ /dev/null
+@@ -1,37 +0,0 @@
+----
+-page_title: "Resource: okta_email_sender_verification"
+-description: |-
+-  Verifies the email sender. The resource won't be created if the email sender could not be verified.
+----
+-
+-# Resource: okta_email_sender_verification
+-
+-Verifies the email sender. The resource won't be created if the email sender could not be verified.
+-
+-~> **DEPRECATED** The api for this resource has been deprecated. Please use `okta_email_domain_verification` instead.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_email_sender" "example" {
+-  from_name    = "Paul Atreides"
+-  from_address = "no-reply@caladan.planet"
+-  subdomain    = "mail"
+-}
+-
+-resource "okta_email_sender_verification" "example" {
+-  sender_id = okta_email_sender.valid.id
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `sender_id` (String) Email sender ID
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+diff --git a/docs/resources/event_hook.md b/docs/resources/event_hook.md
+deleted file mode 100644
+index ee02ffeb..00000000
+--- a/docs/resources/event_hook.md
++++ /dev/null
+@@ -1,71 +0,0 @@
+----
+-page_title: "Resource: okta_event_hook"
+-description: |-
+-  Creates an event hook. This resource allows you to create and configure an event hook.
+----
+-
+-# Resource: okta_event_hook
+-
+-Creates an event hook. This resource allows you to create and configure an event hook.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_event_hook" "example" {
+-  name = "example"
+-  events = [
+-    "user.lifecycle.create",
+-    "user.lifecycle.delete.initiated",
+-  ]
+-
+-  channel = {
+-    type    = "HTTP"
+-    version = "1.0.0"
+-    uri     = "https://example.com/test"
+-  }
+-
+-  auth = {
+-    type  = "HEADER"
+-    key   = "Authorization"
+-    value = "123"
+-  }
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `channel` (Map of String) Details of the endpoint the event hook will hit.
+-- `events` (Set of String) The events that will be delivered to this hook. [See here for a list of supported events](https://developer.okta.com/docs/reference/api/event-types/?q=event-hook-eligible).
+-- `name` (String) The event hook display name.
+-
+-### Optional
+-
+-- `auth` (Map of String) Details of the endpoint the event hook will hit.   
+-	- 'version' - (Required) The version of the channel. The currently-supported version is '1.0.0'.
+-	- 'uri' - (Required) The URI the hook will hit.
+-	- 'type' - (Optional) The type of hook to trigger. Currently, the only supported type is 'HTTP'.
+-- `headers` (Block Set) Map of headers to send along in event hook request. (see [below for nested schema](#nestedblock--headers))
+-- `status` (String) Default to `ACTIVE`
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-<a id="nestedblock--headers"></a>
+-### Nested Schema for `headers`
+-
+-Optional:
+-
+-- `key` (String)
+-- `value` (String)
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_event_hook.example &#60;hook id&#62;
+-```
+diff --git a/docs/resources/event_hook_verification.md b/docs/resources/event_hook_verification.md
+deleted file mode 100644
+index d2b610a4..00000000
+--- a/docs/resources/event_hook_verification.md
++++ /dev/null
+@@ -1,50 +0,0 @@
+----
+-page_title: "Resource: okta_event_hook_verification"
+-description: |-
+-  Verifies the Event Hook. The resource won't be created unless the URI provided in the event hook returns a valid JSON object with verification. See Event Hooks https://developer.okta.com/docs/concepts/event-hooks/#one-time-verification-request documentation for details.
+----
+-
+-# Resource: okta_event_hook_verification
+-
+-Verifies the Event Hook. The resource won't be created unless the URI provided in the event hook returns a valid JSON object with verification. See [Event Hooks](https://developer.okta.com/docs/concepts/event-hooks/#one-time-verification-request) documentation for details.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_event_hook" "example" {
+-  name = "example"
+-  events = [
+-    "user.lifecycle.create",
+-    "user.lifecycle.delete.initiated",
+-  ]
+-
+-  channel = {
+-    type    = "HTTP"
+-    version = "1.0.0"
+-    uri     = "https://example.com/test"
+-  }
+-
+-  auth = {
+-    type  = "HEADER"
+-    key   = "Authorization"
+-    value = "123"
+-  }
+-}
+-
+-resource "okta_event_hook_verification" "example" {
+-  event_hook_id = okta_event_hook.example.id
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `event_hook_id` (String) Event hook ID
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-
+diff --git a/docs/resources/factor.md b/docs/resources/factor.md
+deleted file mode 100644
+index ed4a41c1..00000000
+--- a/docs/resources/factor.md
++++ /dev/null
+@@ -1,34 +0,0 @@
+----
+-page_title: "Resource: okta_factor"
+-description: |-
+-  Allows you to manage the activation of Okta MFA methods. This resource allows you to manage Okta MFA methods.
+----
+-
+-# Resource: okta_factor
+-
+-Allows you to manage the activation of Okta MFA methods. This resource allows you to manage Okta MFA methods.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_factor" "example" {
+-  provider_id = "google_otp"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `provider_id` (String) The MFA provider name. Allowed values are `duo`, `fido_u2f`, `fido_webauthn`, `google_otp`, `okta_call`, `okta_otp`, `okta_password`, `okta_push`, `okta_question`, `okta_sms`, `okta_email`, `rsa_token`, `symantec_vip`, `yubikey_token`, or `hotp`.
+-
+-### Optional
+-
+-- `active` (Boolean) Whether to activate the provider, by default, it is set to `true`.
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-
+diff --git a/docs/resources/factor_totp.md b/docs/resources/factor_totp.md
+deleted file mode 100644
+index c21cc2b9..00000000
+--- a/docs/resources/factor_totp.md
++++ /dev/null
+@@ -1,52 +0,0 @@
+----
+-page_title: "Resource: okta_factor_totp"
+-description: |-
+-  Allows you to manage the time-based one-time password (TOTP) factors. A time-based one-time password (TOTP) is a
+-          temporary passcode that is generated for user authentication. Examples of TOTP include hardware authenticators and
+-          mobile app authenticators.
+-  Once saved, the settings cannot be changed (except for the 'name' field). Any other change would force resource
+-  recreation.
+----
+-
+-# Resource: okta_factor_totp
+-
+-Allows you to manage the time-based one-time password (TOTP) factors. A time-based one-time password (TOTP) is a
+-		temporary passcode that is generated for user authentication. Examples of TOTP include hardware authenticators and
+-		mobile app authenticators.
+-		
+-Once saved, the settings cannot be changed (except for the 'name' field). Any other change would force resource
+-recreation.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_factor_totp" "example" {
+-  name                   = "example"
+-  otp_length             = 10
+-  hmac_algorithm         = "HMacSHA256"
+-  time_step              = 30
+-  clock_drift_interval   = 10
+-  shared_secret_encoding = "hexadecimal"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `name` (String) The TOTP name.
+-
+-### Optional
+-
+-- `clock_drift_interval` (Number) Clock drift interval. This setting allows you to build in tolerance for any drift between the token's current time and the server's current time. Valid values: `3`, `5`, `10`. Default is `3`.
+-- `hmac_algorithm` (String) HMAC Algorithm. Valid values: `HMacSHA1`, `HMacSHA256`, `HMacSHA512`. Default is `HMacSHA512`.
+-- `otp_length` (Number) Length of the password. Default is `6`.
+-- `shared_secret_encoding` (String) Shared secret encoding. Valid values: `base32`, `base64`, `hexadecimal`. Default is `base32`.
+-- `time_step` (Number) Time step in seconds. Valid values: `15`, `30`, `60`. Default is `15`.
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-
+diff --git a/docs/resources/group.md b/docs/resources/group.md
+deleted file mode 100644
+index 850e8c35..00000000
+--- a/docs/resources/group.md
++++ /dev/null
+@@ -1,54 +0,0 @@
+----
+-page_title: "Resource: okta_group"
+-description: |-
+-  Creates an Okta Group. This resource allows you to create and configure an Okta Group.
+----
+-
+-# Resource: okta_group
+-
+-Creates an Okta Group. This resource allows you to create and configure an Okta Group.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_group" "example" {
+-  name        = "Example"
+-  description = "My Example Group"
+-}
+-
+-# Custom profile attributes
+-resource "okta_group" "example" {
+-  name        = "Example"
+-  description = "My Example Group"
+-  custom_profile_attributes = jsonencode({
+-    "example1" = "testing1234",
+-    "example2" = true,
+-    "example3" = 54321
+-  })
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `name` (String) The name of the Okta Group.
+-
+-### Optional
+-
+-- `custom_profile_attributes` (String) JSON formatted custom attributes for a group. It must be JSON due to various types Okta allows.
+-- `description` (String) The description of the Okta Group.
+-- `skip_users` (Boolean, Deprecated) Ignore users sync. This is a temporary solution until 'users' field is supported in all the app-like resources
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_group.example &#60;group id&#62;
+-```
+diff --git a/docs/resources/group_memberships.md b/docs/resources/group_memberships.md
+deleted file mode 100644
+index bd304756..00000000
+--- a/docs/resources/group_memberships.md
++++ /dev/null
+@@ -1,72 +0,0 @@
+----
+-page_title: "Resource: okta_group_memberships"
+-description: |-
+-  Resource to manage a set of memberships for a specific group.
+-  This resource will allow you to bulk manage group membership in Okta for a given
+-  group. This offers an interface to pass multiple users into a single resource
+-  call, for better API resource usage. If you need a relationship of a single
+-  user to many groups, please use the 'oktausergroupmemberships' resource.
+-  Important: The default behavior of the resource is to only maintain the
+-  state of user ids that are assigned it. This behavior will signal drift only if
+-  those users stop being part of the group. If the desired behavior is track all
+-  users that are added/removed from the group make use of the 'trackall_users'
+-  argument with this resource.
+----
+-
+-# Resource: okta_group_memberships
+-
+-Resource to manage a set of memberships for a specific group.
+-This resource will allow you to bulk manage group membership in Okta for a given
+-group. This offers an interface to pass multiple users into a single resource
+-call, for better API resource usage. If you need a relationship of a single 
+-user to many groups, please use the 'okta_user_group_memberships' resource.
+-**Important**: The default behavior of the resource is to only maintain the
+-state of user ids that are assigned it. This behavior will signal drift only if
+-those users stop being part of the group. If the desired behavior is track all
+-users that are added/removed from the group make use of the 'track_all_users'
+-argument with this resource.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_group" "test" {
+-  name        = "testAcc_replace_with_uuid"
+-  description = "testing, testing"
+-}
+-
+-resource "okta_group_memberships" "test" {
+-  group_id = okta_group.test.id
+-  users = [
+-    okta_user.test1.id,
+-    okta_user.test2.id,
+-  ]
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `group_id` (String) ID of a Okta group.
+-- `users` (Set of String) The list of Okta user IDs which the group should have membership managed for.
+-
+-### Optional
+-
+-- `track_all_users` (Boolean) The resource concerns itself with all users added/deleted to the group; even those managed outside of the resource.
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-# an Okta Group's memberships can be imported via the Okta group ID.
+-terraform import okta_group_memberships.test &#60;group id&#62;
+-
+-# optional parameter track all users will also import all user id currently assigned to the group
+-terraform import okta_group_memberships.test &#60;group id&#62;/&#60;true&#62;
+-```
+diff --git a/docs/resources/group_role.md b/docs/resources/group_role.md
+deleted file mode 100644
+index 249bb3e8..00000000
+--- a/docs/resources/group_role.md
++++ /dev/null
+@@ -1,57 +0,0 @@
+----
+-page_title: "Resource: okta_group_role"
+-description: |-
+-  Assigns Admin roles to Okta Groups. This resource allows you to assign Okta administrator roles to Okta Groups. This resource provides a one-to-one interface between the Okta group and the admin role.
+----
+-
+-# Resource: okta_group_role
+-
+-Assigns Admin roles to Okta Groups. This resource allows you to assign Okta administrator roles to Okta Groups. This resource provides a one-to-one interface between the Okta group and the admin role.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_group_role" "example" {
+-  group_id  = "<group id>"
+-  role_type = "READ_ONLY_ADMIN"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `group_id` (String) ID of group to attach admin roles to
+-- `role_type` (String) Admin role assigned to the group. It can be any one of the following values:
+-	"API_ADMIN",
+-	"APP_ADMIN",
+-	"CUSTOM",
+-	"GROUP_MEMBERSHIP_ADMIN",
+-	"HELP_DESK_ADMIN",
+-	"MOBILE_ADMIN",
+-	"ORG_ADMIN",
+-	"READ_ONLY_ADMIN",
+-	"REPORT_ADMIN",
+-	"SUPER_ADMIN",
+-	"USER_ADMIN"
+-	. See [API Docs](https://developer.okta.com/docs/reference/api/roles/#role-types).
+-	- "USER_ADMIN" is the Group Administrator.
+-
+-### Optional
+-
+-- `disable_notifications` (Boolean) When this setting is enabled, the admins won't receive any of the default Okta administrator emails. These admins also won't have access to contact Okta Support and open support cases on behalf of your org.
+-- `target_app_list` (Set of String) A list of app names (name represents set of app instances, like 'salesforce' or 'facebook'), or a combination of app name and app instance ID (like 'facebook.0oapsqQ6dv19pqyEo0g3') you would like as the targets of the admin role. - Only supported when used with the role type `APP_ADMIN`.
+-- `target_group_list` (Set of String) A list of group IDs you would like as the targets of the admin role. - Only supported when used with the role types: `GROUP_MEMBERSHIP_ADMIN`, `HELP_DESK_ADMIN`, or `USER_ADMIN`.
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_group_role.example &#60;group id&#62;/&#60;role id&#62;
+-```
+diff --git a/docs/resources/group_rule.md b/docs/resources/group_rule.md
+deleted file mode 100644
+index 47c15f85..00000000
+--- a/docs/resources/group_rule.md
++++ /dev/null
+@@ -1,58 +0,0 @@
+----
+-page_title: "Resource: okta_group_rule"
+-description: |-
+-  Creates an Okta Group Rule.
+-  This resource allows you to create and configure an Okta Group Rule.
+-  -> If the Okta API marks the 'status' of the rule as 'INVALID' the Okta
+-  Terraform Provider will act in a force/replace manner and call the API to delete
+-  the underlying rule resource and create a new rule resource.
+----
+-
+-# Resource: okta_group_rule
+-
+-Creates an Okta Group Rule.
+-This resource allows you to create and configure an Okta Group Rule.
+--> If the Okta API marks the 'status' of the rule as 'INVALID' the Okta
+-Terraform Provider will act in a force/replace manner and call the API to delete
+-the underlying rule resource and create a new rule resource.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_group_rule" "example" {
+-  name   = "example"
+-  status = "ACTIVE"
+-  group_assignments = [
+-  "<group id>"]
+-  expression_type  = "urn:okta:expression:1.0"
+-  expression_value = "String.startsWith(user.firstName,\"andy\")"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `expression_value` (String) The expression value.
+-- `group_assignments` (Set of String) The list of group ids to assign the users to.
+-- `name` (String) The name of the Group Rule (min character 1; max characters 50).
+-
+-### Optional
+-
+-- `expression_type` (String) The expression type to use to invoke the rule. The default is `urn:okta:expression:1.0`.
+-- `remove_assigned_users` (Boolean) Remove users added by this rule from the assigned group after deleting this resource. Default is `false`
+-- `status` (String) Default to `ACTIVE`
+-- `users_excluded` (Set of String) The list of user IDs that would be excluded when rules are processed
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_group_rule.example &#60;group rule id&#62;
+-```
+diff --git a/docs/resources/group_schema_property.md b/docs/resources/group_schema_property.md
+deleted file mode 100644
+index a2063e59..00000000
+--- a/docs/resources/group_schema_property.md
++++ /dev/null
+@@ -1,107 +0,0 @@
+----
+-page_title: "Resource: okta_group_schema_property"
+-description: |-
+-  Creates a Group Schema property.
+-  This resource allows you to create and configure a custom group schema property.
+-  IMPORTANT: With 'enum', list its values as strings even though the 'type'
+-  may be something other than string. This is a limitation of the schema defintion
+-  in the Terraform Plugin SDK runtime and we juggle the type correctly when making
+-  Okta API calls. Same holds for the 'const' value of 'oneof' as well as the
+-  'array*' variation of 'enum' and 'one_of'.
+----
+-
+-# Resource: okta_group_schema_property
+-
+-Creates a Group Schema property.
+-This resource allows you to create and configure a custom group schema property.
+-**IMPORTANT:** With 'enum', list its values as strings even though the 'type'
+-may be something other than string. This is a limitation of the schema defintion
+-in the Terraform Plugin SDK runtime and we juggle the type correctly when making
+-Okta API calls. Same holds for the 'const' value of 'one_of' as well as the
+-'array_*' variation of 'enum' and 'one_of'.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_group_schema_property" "example" {
+-  index       = "customPropertyName"
+-  title       = "customPropertyName"
+-  type        = "string"
+-  description = "My custom property name"
+-  master      = "OKTA"
+-  scope       = "SELF"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `index` (String) Subschema unique string identifier
+-- `title` (String) Subschema title (display name)
+-- `type` (String) The type of the schema property. It can be `string`, `boolean`, `number`, `integer`, `array`, or `object`
+-
+-### Optional
+-
+-- `array_enum` (List of String) Array of values that an array property's items can be set to.
+-- `array_one_of` (Block List) Display name and value an enum array can be set to.
+-	- 'const' - (Required) value mapping to member of 'enum'.
+-	- 'title' - (Required) display name for the enum value. (see [below for nested schema](#nestedblock--array_one_of))
+-- `array_type` (String) The type of the array elements if `type` is set to `array`
+-- `description` (String) The description of the user schema property.
+-- `enum` (List of String) Array of values a primitive property can be set to. See `array_enum` for arrays.
+-- `external_name` (String) External name of the user schema property.
+-- `external_namespace` (String) External namespace of the user schema property.
+-- `master` (String) Master priority for the group schema property. It can be set to `PROFILE_MASTER`, `OVERRIDE` or `OKTA`. Default: `PROFILE_MASTER`
+-- `master_override_priority` (Block List) Prioritized list of profile sources (required when `master` is `OVERRIDE`). (see [below for nested schema](#nestedblock--master_override_priority))
+-- `max_length` (Number) The maximum length of the user property value. Only applies to type `string`
+-- `min_length` (Number) The minimum length of the user property value. Only applies to type `string`
+-- `one_of` (Block List) Array of maps containing a mapping for display name to enum value.
+-	- 'const' - (Required) value mapping to member of 'enum'.
+-	- 'title' - (Required) display name for the enum value. (see [below for nested schema](#nestedblock--one_of))
+-- `permissions` (String) Access control permissions for the property. It can be set to `READ_WRITE`, `READ_ONLY`, `HIDE`. Default: `READ_ONLY`
+-- `required` (Boolean) Whether the subschema is required
+-- `scope` (String)
+-- `unique` (String) Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-<a id="nestedblock--array_one_of"></a>
+-### Nested Schema for `array_one_of`
+-
+-Required:
+-
+-- `const` (String) Value mapping to member of `array_enum`
+-- `title` (String) Display name for the enum value.
+-
+-
+-<a id="nestedblock--master_override_priority"></a>
+-### Nested Schema for `master_override_priority`
+-
+-Required:
+-
+-- `value` (String)
+-
+-Optional:
+-
+-- `type` (String)
+-
+-
+-<a id="nestedblock--one_of"></a>
+-### Nested Schema for `one_of`
+-
+-Required:
+-
+-- `const` (String) Enum value
+-- `title` (String) Enum title
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_group_schema_property.example &#60;index&#62;
+-```
+diff --git a/docs/resources/idp_oidc.md b/docs/resources/idp_oidc.md
+deleted file mode 100644
+index f9683428..00000000
+--- a/docs/resources/idp_oidc.md
++++ /dev/null
+@@ -1,85 +0,0 @@
+----
+-page_title: "Resource: okta_idp_oidc"
+-description: |-
+-  Creates an OIDC Identity Provider. This resource allows you to create and configure an OIDC Identity Provider.
+----
+-
+-# Resource: okta_idp_oidc
+-
+-Creates an OIDC Identity Provider. This resource allows you to create and configure an OIDC Identity Provider.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_idp_oidc" "example" {
+-  name                  = "example"
+-  authorization_url     = "https://idp.example.com/authorize"
+-  authorization_binding = "HTTP-REDIRECT"
+-  token_url             = "https://idp.example.com/token"
+-  token_binding         = "HTTP-POST"
+-  user_info_url         = "https://idp.example.com/userinfo"
+-  user_info_binding     = "HTTP-REDIRECT"
+-  jwks_url              = "https://idp.example.com/keys"
+-  jwks_binding          = "HTTP-REDIRECT"
+-  scopes                = ["openid"]
+-  client_id             = "efg456"
+-  client_secret         = "efg456"
+-  issuer_url            = "https://id.example.com"
+-  username_template     = "idpuser.email"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `authorization_binding` (String) The method of making an authorization request. It can be set to `HTTP-POST` or `HTTP-REDIRECT`.
+-- `authorization_url` (String) IdP Authorization Server (AS) endpoint to request consent from the user and obtain an authorization code grant.
+-- `client_id` (String) Unique identifier issued by AS for the Okta IdP instance.
+-- `client_secret` (String, Sensitive) Client secret issued by AS for the Okta IdP instance.
+-- `issuer_url` (String) URI that identifies the issuer.
+-- `jwks_binding` (String) The method of making a request for the OIDC JWKS. It can be set to `HTTP-POST` or `HTTP-REDIRECT`
+-- `jwks_url` (String) Endpoint where the keys signer publishes its keys in a JWK Set.
+-- `name` (String) Name of the IdP
+-- `scopes` (Set of String) The scopes of the IdP.
+-- `token_binding` (String) The method of making a token request. It can be set to `HTTP-POST` or `HTTP-REDIRECT`.
+-- `token_url` (String) IdP Authorization Server (AS) endpoint to exchange the authorization code grant for an access token.
+-
+-### Optional
+-
+-- `account_link_action` (String) Specifies the account linking action for an IdP user. Default: `AUTO`
+-- `account_link_group_include` (Set of String) Group memberships to determine link candidates.
+-- `deprovisioned_action` (String) Action for a previously deprovisioned IdP user during authentication. Can be `NONE` or `REACTIVATE`. Default: `NONE`
+-- `groups_action` (String) Provisioning action for IdP user's group memberships. It can be `NONE`, `SYNC`, `APPEND`, or `ASSIGN`. Default: `NONE`
+-- `groups_assignment` (Set of String) List of Okta Group IDs to add an IdP user as a member with the `ASSIGN` `groups_action`.
+-- `groups_attribute` (String) IdP user profile attribute name (case-insensitive) for an array value that contains group memberships.
+-- `groups_filter` (Set of String) Whitelist of Okta Group identifiers that are allowed for the `APPEND` or `SYNC` `groups_action`.
+-- `issuer_mode` (String) Indicates whether Okta uses the original Okta org domain URL, a custom domain URL, or dynamic. It can be `ORG_URL`, `CUSTOM_URL`, or `DYNAMIC`. Default: `ORG_URL`
+-- `max_clock_skew` (Number) Maximum allowable clock-skew when processing messages from the IdP.
+-- `profile_master` (Boolean) Determines if the IdP should act as a source of truth for user profile attributes.
+-- `protocol_type` (String) The type of protocol to use. It can be `OIDC` or `OAUTH2`. Default: `OIDC`
+-- `provisioning_action` (String) Provisioning action for an IdP user during authentication. Default: `AUTO`
+-- `request_signature_algorithm` (String) The HMAC Signature Algorithm used when signing an authorization request. Defaults to `HS256`. It can be `HS256`, `HS384`, `HS512`, `SHA-256`. `RS256`, `RS384`, or `RS512`. NOTE: `SHA-256` an undocumented legacy value and not continue to be valid. See API docs https://developer.okta.com/docs/reference/api/idps/#oidc-request-signature-algorithm-object
+-- `request_signature_scope` (String) Specifies whether to digitally sign an AuthnRequest messages to the IdP. Defaults to `REQUEST`. It can be `REQUEST` or `NONE`.
+-- `status` (String) Default to `ACTIVE`
+-- `subject_match_attribute` (String) Okta user profile attribute for matching transformed IdP username. Only for matchType `CUSTOM_ATTRIBUTE`.
+-- `subject_match_type` (String) Determines the Okta user profile attribute match conditions for account linking and authentication of the transformed IdP username. By default, it is set to `USERNAME`. It can be set to `USERNAME`, `EMAIL`, `USERNAME_OR_EMAIL` or `CUSTOM_ATTRIBUTE`.
+-- `suspended_action` (String) Action for a previously suspended IdP user during authentication. Can be `NONE` or `REACTIVATE`. Default: `NONE`
+-- `user_info_binding` (String)
+-- `user_info_url` (String) Protected resource endpoint that returns claims about the authenticated user.
+-- `username_template` (String) Okta EL Expression to generate or transform a unique username for the IdP user. Default: `idpuser.email`
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-- `type` (String) Type of OIDC IdP.
+-- `user_type_id` (String) User type ID. Can be used as `target_id` in the `okta_profile_mapping` resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_idp_oidc.example &#60;idp id&#62;
+-```
+diff --git a/docs/resources/idp_saml.md b/docs/resources/idp_saml.md
+deleted file mode 100644
+index ed09f1d9..00000000
+--- a/docs/resources/idp_saml.md
++++ /dev/null
+@@ -1,81 +0,0 @@
+----
+-page_title: "Resource: okta_idp_saml"
+-description: |-
+-  Creates a SAML Identity Provider. This resource allows you to create and configure a SAML Identity Provider.
+----
+-
+-# Resource: okta_idp_saml
+-
+-Creates a SAML Identity Provider. This resource allows you to create and configure a SAML Identity Provider.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_idp_saml" "example" {
+-  name                     = "testAcc_replace_with_uuid"
+-  acs_type                 = "INSTANCE"
+-  sso_url                  = "https://idp.example.com"
+-  sso_destination          = "https://idp.example.com"
+-  sso_binding              = "HTTP-POST"
+-  username_template        = "idpuser.email"
+-  kid                      = okta_idp_saml_key.test.id
+-  issuer                   = "https://idp.example.com"
+-  request_signature_scope  = "REQUEST"
+-  response_signature_scope = "ANY"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `issuer` (String) URI that identifies the issuer.
+-- `kid` (String) The ID of the signing key.
+-- `name` (String) Name of the IdP
+-- `sso_url` (String) URL of binding-specific endpoint to send an AuthnRequest message to IdP.
+-
+-### Optional
+-
+-- `account_link_action` (String) Specifies the account linking action for an IdP user. Default: `AUTO`
+-- `account_link_group_include` (Set of String) Group memberships to determine link candidates.
+-- `acs_type` (String) The type of ACS. It can be `INSTANCE` or `ORG`. Default: `INSTANCE`
+-- `deprovisioned_action` (String) Action for a previously deprovisioned IdP user during authentication. Can be `NONE` or `REACTIVATE`. Default: `NONE`
+-- `groups_action` (String) Provisioning action for IdP user's group memberships. It can be `NONE`, `SYNC`, `APPEND`, or `ASSIGN`. Default: `NONE`
+-- `groups_assignment` (Set of String) List of Okta Group IDs to add an IdP user as a member with the `ASSIGN` `groups_action`.
+-- `groups_attribute` (String) IdP user profile attribute name (case-insensitive) for an array value that contains group memberships.
+-- `groups_filter` (Set of String) Whitelist of Okta Group identifiers that are allowed for the `APPEND` or `SYNC` `groups_action`.
+-- `issuer_mode` (String) Indicates whether Okta uses the original Okta org domain URL, or a custom domain URL
+-- `max_clock_skew` (Number) Maximum allowable clock-skew when processing messages from the IdP.
+-- `name_format` (String) The name identifier format to use. By default `urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified`.
+-- `profile_master` (Boolean) Determines if the IdP should act as a source of truth for user profile attributes.
+-- `provisioning_action` (String) Provisioning action for an IdP user during authentication. Default: `AUTO`
+-- `request_signature_algorithm` (String) The XML digital Signature Algorithm used when signing an `AuthnRequest` message. It can be `SHA-256` or `SHA-1`. Default: `SHA-256`
+-- `request_signature_scope` (String) Specifies whether to digitally sign an AuthnRequest messages to the IdP. It can be `REQUEST` or `NONE`. Default: `REQUEST`
+-- `response_signature_algorithm` (String) The minimum XML digital signature algorithm allowed when verifying a `SAMLResponse` message or Assertion element. It can be `SHA-256` or `SHA-1`. Default: `SHA-256`
+-- `response_signature_scope` (String) Specifies whether to verify a `SAMLResponse` message or Assertion element XML digital signature. It can be `RESPONSE`, `ASSERTION`, or `ANY`. Default: `ANY`
+-- `sso_binding` (String) The method of making an SSO request. It can be set to `HTTP-POST` or `HTTP-REDIRECT`. Default: `HTTP-POST`
+-- `sso_destination` (String) URI reference indicating the address to which the AuthnRequest message is sent.
+-- `status` (String) Default to `ACTIVE`
+-- `subject_filter` (String) Optional regular expression pattern used to filter untrusted IdP usernames.
+-- `subject_format` (Set of String) The name format.
+-- `subject_match_attribute` (String) Okta user profile attribute for matching transformed IdP username. Only for matchType `CUSTOM_ATTRIBUTE`.
+-- `subject_match_type` (String) Determines the Okta user profile attribute match conditions for account linking and authentication of the transformed IdP username. By default, it is set to `USERNAME`. It can be set to `USERNAME`, `EMAIL`, `USERNAME_OR_EMAIL` or `CUSTOM_ATTRIBUTE`.
+-- `suspended_action` (String) Action for a previously suspended IdP user during authentication. Can be `NONE` or `REACTIVATE`. Default: `NONE`
+-- `username_template` (String) Okta EL Expression to generate or transform a unique username for the IdP user. Default: `idpuser.email`
+-
+-### Read-Only
+-
+-- `acs_binding` (String)
+-- `audience` (String)
+-- `id` (String) The ID of this resource.
+-- `type` (String)
+-- `user_type_id` (String)
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_idp_saml.example &#60;idp id&#62;
+-```
+diff --git a/docs/resources/idp_saml_key.md b/docs/resources/idp_saml_key.md
+deleted file mode 100644
+index ce4d0376..00000000
+--- a/docs/resources/idp_saml_key.md
++++ /dev/null
+@@ -1,58 +0,0 @@
+----
+-page_title: "Resource: okta_idp_saml_key"
+-description: |-
+-  This resource allows you to create and configure a SAML Identity Provider Signing Key.
+----
+-
+-# Resource: okta_idp_saml_key
+-
+-This resource allows you to create and configure a SAML Identity Provider Signing Key.
+-
+-Identity Provider Signing Key can not be updated, it can only be created or removed. Thus, in situation
+-where Identity Provider Signing Key should be updated, one can not simply change `x5c` and apply the changes.
+-This will cause the error, because the key can not be removed if it's used by the provider. To avoid this situation,
+-the behavior of the resource update process is as follows:
+-
+-- create a new identity provider key
+-- list all identity providers that are using the old key (**even the ones that are managed outside terraform!**)
+-- assign a new key to these identity providers
+-- remove old identity provider key
+-
+-For more details, please refer to the [original issue](https://github.com/okta/terraform-provider-okta/issues/672). 
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_idp_saml_key" "example_1" {
+-  x5c = ["${okta_app_saml.example.certificate}"]
+-}
+-
+-resource "okta_idp_saml_key" "example_2" {
+-  x5c = ["MIIDnjCCAoagAwIBAgIGAVG3MN+PMA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5p\nYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMM\nB2V4YW1wbGUxHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMTUxMjE4MjIyMjMyWhcNMjUxMjE4MjIyMzMyWjCB\njzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9r\ndGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdleGFtcGxlMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29t\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtcnyvuVCrsFEKCwHDenS3Ocjed8eWDv3zLtD2K/iZfE8BMj2wpTf\nn6Ry8zCYey3mWlKdxIybnV9amrujGRnE0ab6Q16v9D6RlFQLOG6dwqoRKuZy33Uyg8PGdEudZjGbWuKCqqXEp+UKALJHV+k4\nwWeVH8g5d1n3KyR2TVajVJpCrPhLFmq1Il4G/IUnPe4MvjXqB6CpKkog1+ThWsItPRJPAM+RweFHXq7KfChXsYE7Mmfuly8s\nDQlvBmQyxZnFHVuiPfCvGHJjpvHy11YlHdOjfgqHRvZbmo30+y0X/oY/yV4YEJ00LL6eJWU4wi7ViY3HP6/VCdRjHoRdr5L/\nDwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQCzzhOFkvyYLNFj2WDcq1YqD4sBy1iCia9QpRH3rjQvMKDwQDYWbi6EdOX0TQ/I\nYR7UWGj+2pXd6v0t33lYtoKocp/4lUvT3tfBnWZ5KnObi+J2uY2teUqoYkASN7F+GRPVOuMVoVgm05ss8tuMb2dLc9vsx93s\nDt+XlMTv/2qi5VPwaDtqduKkzwW9lUfn4xIMkTiVvCpe0X2HneD2Bpuao3/U8Rk0uiPfq6TooWaoW3kjsmErhEAs9bA7xuqo\n1KKY9CdHcFhkSsMhoeaZylZHtzbnoipUlQKSLMdJQiiYZQ0bYL83/Ta9fulr1EERICMFt3GUmtYaZZKHpWSfdJp9"]
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `x5c` (Set of String) base64-encoded X.509 certificate chain with DER encoding
+-
+-### Read-Only
+-
+-- `created` (String) Date created.
+-- `expires_at` (String) Date the cert expires.
+-- `id` (String) The ID of this resource.
+-- `kid` (String) Key ID.
+-- `kty` (String) Identifies the cryptographic algorithm family used with the key.
+-- `use` (String) Intended use of the public key.
+-- `x5t_s256` (String) base64url-encoded SHA-256 thumbprint of the DER encoding of an X.509 certificate.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_idp_saml_key.example &#60;key id&#62;
+-```
+\ No newline at end of file
+diff --git a/docs/resources/idp_social.md b/docs/resources/idp_social.md
+deleted file mode 100644
+index 031c380f..00000000
+--- a/docs/resources/idp_social.md
++++ /dev/null
+@@ -1,78 +0,0 @@
+----
+-page_title: "Resource: okta_idp_social"
+-description: |-
+-  Creates a Social Identity Provider. This resource allows you to create and configure a Social Identity Provider.
+----
+-
+-# Resource: okta_idp_social
+-
+-Creates a Social Identity Provider. This resource allows you to create and configure a Social Identity Provider.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_idp_social" "example" {
+-  type          = "FACEBOOK"
+-  protocol_type = "OAUTH2"
+-  name          = "testAcc_facebook_replace_with_uuid"
+-
+-  scopes = [
+-    "public_profile",
+-    "email",
+-  ]
+-
+-  client_id         = "abcd123"
+-  client_secret     = "abcd123"
+-  username_template = "idpuser.email"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `name` (String) Name of the IdP
+-- `scopes` (Set of String) The scopes of the IdP.
+-- `type` (String) Identity Provider Types: https://developer.okta.com/docs/reference/api/idps/#identity-provider-type
+-
+-### Optional
+-
+-- `account_link_action` (String) Specifies the account linking action for an IdP user. Default: `AUTO`
+-- `account_link_group_include` (Set of String) Group memberships to determine link candidates.
+-- `apple_kid` (String) The Key ID that you obtained from Apple when you created the private key for the client
+-- `apple_private_key` (String, Sensitive) The Key ID that you obtained from Apple when you created the private key for the client. PrivateKey is required when resource is first created. For all consecutive updates, it can be empty/omitted and keeps the existing value if it is empty/omitted. PrivateKey isn't returned when importing this resource.
+-- `apple_team_id` (String) The Team ID associated with your Apple developer account
+-- `client_id` (String) Unique identifier issued by AS for the Okta IdP instance.
+-- `client_secret` (String, Sensitive) Client secret issued by AS for the Okta IdP instance.
+-- `deprovisioned_action` (String) Action for a previously deprovisioned IdP user during authentication. Can be `NONE` or `REACTIVATE`. Default: `NONE`
+-- `groups_action` (String) Provisioning action for IdP user's group memberships. It can be `NONE`, `SYNC`, `APPEND`, or `ASSIGN`. Default: `NONE`
+-- `groups_assignment` (Set of String) List of Okta Group IDs to add an IdP user as a member with the `ASSIGN` `groups_action`.
+-- `groups_attribute` (String) IdP user profile attribute name (case-insensitive) for an array value that contains group memberships.
+-- `groups_filter` (Set of String) Whitelist of Okta Group identifiers that are allowed for the `APPEND` or `SYNC` `groups_action`.
+-- `issuer_mode` (String) Indicates whether Okta uses the original Okta org domain URL, or a custom domain URL. It can be `ORG_URL` or `CUSTOM_URL`. Default: `ORG_URL`
+-- `max_clock_skew` (Number) Maximum allowable clock-skew when processing messages from the IdP.
+-- `profile_master` (Boolean) Determines if the IdP should act as a source of truth for user profile attributes.
+-- `protocol_type` (String) The type of protocol to use. It can be `OIDC` or `OAUTH2`. Default: `OAUTH2`
+-- `provisioning_action` (String) Provisioning action for an IdP user during authentication. Default: `AUTO`
+-- `status` (String) Default to `ACTIVE`
+-- `subject_match_attribute` (String) Okta user profile attribute for matching transformed IdP username. Only for matchType `CUSTOM_ATTRIBUTE`.
+-- `subject_match_type` (String) Determines the Okta user profile attribute match conditions for account linking and authentication of the transformed IdP username. By default, it is set to `USERNAME`. It can be set to `USERNAME`, `EMAIL`, `USERNAME_OR_EMAIL` or `CUSTOM_ATTRIBUTE`.
+-- `suspended_action` (String) Action for a previously suspended IdP user during authentication. Can be `NONE` or `REACTIVATE`. Default: `NONE`
+-- `username_template` (String) Okta EL Expression to generate or transform a unique username for the IdP user. Default: `idpuser.email`
+-
+-### Read-Only
+-
+-- `authorization_binding` (String) The method of making an authorization request. It can be set to `HTTP-POST` or `HTTP-REDIRECT`.
+-- `authorization_url` (String) IdP Authorization Server (AS) endpoint to request consent from the user and obtain an authorization code grant.
+-- `id` (String) The ID of this resource.
+-- `token_binding` (String) The method of making a token request. It can be set to `HTTP-POST` or `HTTP-REDIRECT`.
+-- `token_url` (String) IdP Authorization Server (AS) endpoint to exchange the authorization code grant for an access token.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_idp_social.example &#60;idp id&#62;
+-```
+diff --git a/docs/resources/inline_hook.md b/docs/resources/inline_hook.md
+deleted file mode 100644
+index 519ce5ef..00000000
+--- a/docs/resources/inline_hook.md
++++ /dev/null
+@@ -1,67 +0,0 @@
+----
+-page_title: "Resource: okta_inline_hook"
+-description: |-
+-  Creates an inline hook. This resource allows you to create and configure an inline hook.
+----
+-
+-# Resource: okta_inline_hook
+-
+-Creates an inline hook. This resource allows you to create and configure an inline hook.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_inline_hook" "example" {
+-  name    = "example"
+-  version = "1.0.0"
+-  type    = "com.okta.oauth2.tokens.transform"
+-
+-  channel = {
+-    version = "1.0.0"
+-    uri     = "https://example.com/test"
+-    method  = "POST"
+-  }
+-
+-  auth = {
+-    key   = "Authorization"
+-    type  = "HEADER"
+-    value = "secret"
+-  }
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `channel` (Map of String)
+-- `name` (String) The inline hook display name.
+-- `type` (String) The type of hook to create. [See here for supported types](https://developer.okta.com/docs/reference/api/inline-hooks/#supported-inline-hook-types).
+-- `version` (String) The version of the hook. The currently-supported version is `1.0.0`.
+-
+-### Optional
+-
+-- `auth` (Map of String)
+-- `headers` (Block Set) Map of headers to send along in inline hook request. (see [below for nested schema](#nestedblock--headers))
+-- `status` (String) Default to `ACTIVE`
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-<a id="nestedblock--headers"></a>
+-### Nested Schema for `headers`
+-
+-Optional:
+-
+-- `key` (String)
+-- `value` (String)
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_inline_hook.example &#60;hook id&#62;
+-```
+diff --git a/docs/resources/link_definition.md b/docs/resources/link_definition.md
+deleted file mode 100644
+index e1dc6062..00000000
+--- a/docs/resources/link_definition.md
++++ /dev/null
+@@ -1,53 +0,0 @@
+----
+-page_title: "Resource: okta_link_definition"
+-description: |-
+-  Manages the creation and removal of the link definitions.
+-  Link definition operations allow you to manage the creation and removal of the link definitions. If you remove a link
+-  definition, links based on that definition are unavailable. Note that this resource is immutable, thus can not be modified.
+-  ~> NOTE: Links reappear if you recreate the definition. However, Okta is likely to change this behavior so that links don't reappear. Don't rely on this behavior in production environments.
+----
+-
+-# Resource: okta_link_definition
+-
+-Manages the creation and removal of the link definitions.
+-		
+-Link definition operations allow you to manage the creation and removal of the link definitions. If you remove a link 
+-definition, links based on that definition are unavailable. Note that this resource is immutable, thus can not be modified.
+-~> **NOTE:** Links reappear if you recreate the definition. However, Okta is likely to change this behavior so that links don't reappear. Don't rely on this behavior in production environments.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_link_definition" "example" {
+-  primary_name           = "emperor"
+-  primary_title          = "Emperor"
+-  primary_description    = "Hereditary ruler of the Imperium and the Known Universe"
+-  associated_name        = "sardaukar"
+-  associated_title       = "Sardaukar"
+-  associated_description = "Elite military force member"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `associated_description` (String) Description of the associated relationship.
+-- `associated_name` (String) API name of the associated link.
+-- `associated_title` (String) Display name of the associated link.
+-- `primary_description` (String) Description of the primary relationship.
+-- `primary_name` (String) API name of the primary link.
+-- `primary_title` (String) Display name of the primary link.
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_link_definition.example &#60;primary_name&#62;
+-```
+diff --git a/docs/resources/link_value.md b/docs/resources/link_value.md
+deleted file mode 100644
+index 7f35e0ca..00000000
+--- a/docs/resources/link_value.md
++++ /dev/null
+@@ -1,73 +0,0 @@
+----
+-page_title: "Resource: okta_link_value"
+-description: |-
+-  Manages users relationships. Link value operations allow you to create relationships between primary and associated users.
+----
+-
+-# Resource: okta_link_value
+-
+-Manages users relationships. Link value operations allow you to create relationships between primary and associated users.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_link_definition" "padishah" {
+-  primary_name           = "emperor"
+-  primary_title          = "Emperor"
+-  primary_description    = "Hereditary ruler of the Imperium and the Known Universe"
+-  associated_name        = "sardaukar"
+-  associated_title       = "Sardaukar"
+-  associated_description = "Elite military force member"
+-}
+-
+-resource "okta_user" "emperor" {
+-  first_name = "Shaddam"
+-  last_name  = "Corrino IV"
+-  login      = "shaddam.corrino.iv@salusa-secundus.planet"
+-  email      = "shaddam.corrino.iv@salusa-secundus.planet"
+-}
+-
+-resource "okta_user" "sardaukars" {
+-  count      = 5
+-  first_name = "Amrit"
+-  last_name  = "Sardaukar_${count.index}"
+-  login      = "amritsardaukar_${count.index}@salusa-secundus.planet"
+-  email      = "amritsardaukar_${count.index}@salusa-secundus.planet"
+-}
+-
+-resource "okta_link_value" "example" {
+-  primary_name    = okta_link_definition.padishah.primary_name
+-  primary_user_id = okta_user.emperor.id
+-  associated_user_ids = [
+-    okta_user.sardaukars[0].id,
+-    okta_user.sardaukars[1].id,
+-    okta_user.sardaukars[2].id,
+-    okta_user.sardaukars[3].id,
+-    okta_user.sardaukars[4].id,
+-  ]
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `primary_name` (String) Name of the `primary` relationship being assigned.
+-- `primary_user_id` (String) User ID to be assigned to `primary` for the 'associated' user in the specified relationship.
+-
+-### Optional
+-
+-- `associated_user_ids` (Set of String) Set of User IDs or login values of the users to be assigned the `associated` relationship.
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_link_value.example &#60;primary_name&#62;/&#60;primary_user_id&#62;
+-```
+diff --git a/docs/resources/log_stream.md b/docs/resources/log_stream.md
+deleted file mode 100644
+index 95edaed1..00000000
+--- a/docs/resources/log_stream.md
++++ /dev/null
+@@ -1,74 +0,0 @@
+----
+-page_title: "Resource: okta_log_stream"
+-description: |-
+-  Manages log streams
+----
+-
+-# Resource: okta_log_stream
+-
+-Manages log streams
+-
+-## Example Usage
+-
+-```terraform
+-### AWS EventBridge
+-resource "okta_log_stream" "example" {
+-  name   = "EventBridge Log Stream"
+-  type   = "aws_eventbridge"
+-  status = "ACTIVE"
+-  settings {
+-    account_id        = "123456789012"
+-    region            = "us-north-1"
+-    event_source_name = "okta_log_stream"
+-  }
+-}
+-
+-### Splunk Event Collector
+-resource "okta_log_stream" "example" {
+-  name   = "Splunk log Stream"
+-  type   = "splunk_cloud_logstreaming"
+-  status = "ACTIVE"
+-  settings {
+-    host    = "acme.splunkcloud.com"
+-    edition = "gcp"
+-    token   = "YOUR_HEC_TOKEN"
+-  }
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `name` (String) Unique name for the Log Stream object
+-- `type` (String) Streaming provider used - 'aws_eventbridge' or 'splunk_cloud_logstreaming'
+-
+-### Optional
+-
+-- `settings` (Block, Optional) (see [below for nested schema](#nestedblock--settings))
+-- `status` (String) Stream status
+-
+-### Read-Only
+-
+-- `id` (String) Log Stream ID
+-
+-<a id="nestedblock--settings"></a>
+-### Nested Schema for `settings`
+-
+-Optional:
+-
+-- `account_id` (String) AWS account ID. Required only for 'aws_eventbridge' type
+-- `edition` (String) Edition of the Splunk Cloud instance. Could be one of: 'aws', 'aws_govcloud', 'gcp'. Required only for 'splunk_cloud_logstreaming' type
+-- `event_source_name` (String) An alphanumeric name (no spaces) to identify this event source in AWS EventBridge. Required only for 'aws_eventbridge' type
+-- `host` (String) The domain name for Splunk Cloud instance. Don't include http or https in the string. For example: 'acme.splunkcloud.com'. Required only for 'splunk_cloud_logstreaming' type
+-- `region` (String) The destination AWS region where event source is located. Required only for 'aws_eventbridge' type
+-- `token` (String, Sensitive) The HEC token for your Splunk Cloud HTTP Event Collector. Required only for 'splunk_cloud_logstreaming' type
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_log_stream.example &#60;strema id&#62;
+-```
+diff --git a/docs/resources/network_zone.md b/docs/resources/network_zone.md
+deleted file mode 100644
+index 23f5b1e2..00000000
+--- a/docs/resources/network_zone.md
++++ /dev/null
+@@ -1,59 +0,0 @@
+----
+-page_title: "Resource: okta_network_zone"
+-description: |-
+-  Creates an Okta Network Zone. This resource allows you to create and configure an Okta Network Zone.
+----
+-
+-# Resource: okta_network_zone
+-
+-Creates an Okta Network Zone. This resource allows you to create and configure an Okta Network Zone.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_network_zone" "example" {
+-  name     = "example"
+-  type     = "IP"
+-  gateways = ["1.2.3.4/24", "2.3.4.5-2.3.4.15"]
+-  proxies  = ["2.2.3.4/24", "3.3.4.5-3.3.4.15"]
+-}
+-
+-## Example Usage - Dynamic Tor Blocker
+-
+-resource "okta_network_zone" "example" {
+-  name               = "TOR Blocker"
+-  type               = "DYNAMIC"
+-  usage              = "BLOCKLIST"
+-  dynamic_proxy_type = "TorAnonymizer"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `name` (String) Name of the Network Zone Resource
+-- `type` (String) Type of the Network Zone - can either be `IP` or `DYNAMIC` only
+-
+-### Optional
+-
+-- `asns` (Set of String) Format of each array value: a string representation of an ASN numeric value
+-- `dynamic_locations` (Set of String) Array of locations ISO-3166-1(2). Format code: countryCode OR countryCode-regionCode
+-- `dynamic_proxy_type` (String) Type of proxy being controlled by this dynamic network zone - can be one of `Any`, `TorAnonymizer` or `NotTorAnonymizer`.
+-- `gateways` (Set of String) Array of values in CIDR/range form depending on the way it's been declared (i.e. CIDR will contain /suffix). Please check API docs for examples
+-- `proxies` (Set of String) Array of values in CIDR/range form depending on the way it's been declared (i.e. CIDR will contain /suffix). Please check API docs for examples. Can not be set if `usage` is set to `BLOCKLIST`
+-- `status` (String) Network Status - can either be `ACTIVE` or `INACTIVE` only
+-- `usage` (String) Usage of the Network Zone - can be either `POLICY` or `BLOCKLIST`. By default, it is `POLICY`
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_network_zone.example &#60;zone id&#62;
+-```
+diff --git a/docs/resources/org_configuration.md b/docs/resources/org_configuration.md
+deleted file mode 100644
+index b73218a8..00000000
+--- a/docs/resources/org_configuration.md
++++ /dev/null
+@@ -1,59 +0,0 @@
+----
+-page_title: "Resource: okta_org_configuration"
+-description: |-
+-  Manages org settings, logo, support and communication.
+-  ~> IMPORTANT: You must specify all Org Setting properties when you update an org's profile. Any property not specified in the script will be deleted.
+----
+-
+-# Resource: okta_org_configuration
+-
+-Manages org settings, logo, support and communication.
+-		
+-~> **IMPORTANT:** You must specify all Org Setting properties when you update an org's profile. Any property not specified in the script will be deleted.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_org_configuration" "example" {
+-  company_name = "Umbrella Corporation"
+-  website      = "https://terraform.io"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `company_name` (String) Name of org
+-
+-### Optional
+-
+-- `address_1` (String) Primary address of org
+-- `address_2` (String) Secondary address of org
+-- `billing_contact_user` (String) User ID representing the billing contact
+-- `city` (String) City of org
+-- `country` (String) Country of org
+-- `end_user_support_help_url` (String) Support link of org
+-- `logo` (String) Logo of org. The file must be in PNG, JPG, or GIF format and less than 1 MB in size. For best results use landscape orientation, a transparent background, and a minimum size of 420px by 120px to prevent upscaling.
+-- `opt_out_communication_emails` (Boolean) Indicates whether the org's users receive Okta Communication emails
+-- `phone_number` (String) Support help phone of org
+-- `postal_code` (String) Postal code of org
+-- `state` (String) State of org
+-- `support_phone_number` (String) Support help phone of org
+-- `technical_contact_user` (String) User ID representing the technical contact
+-- `website` (String) The org's website
+-
+-### Read-Only
+-
+-- `expires_at` (String) Expiration of org
+-- `id` (String) The ID of this resource.
+-- `subdomain` (String) Subdomain of org
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_org_configuration.example _
+-```
+diff --git a/docs/resources/org_support.md b/docs/resources/org_support.md
+deleted file mode 100644
+index d66eb07c..00000000
+--- a/docs/resources/org_support.md
++++ /dev/null
+@@ -1,36 +0,0 @@
+----
+-page_title: "Resource: okta_org_support"
+-description: |-
+-  Manages Okta Support access your org
+-  This resource allows you to temporarily allow Okta Support to access your org as an administrator. By default,
+-  access will be granted for eight hours. Removing this resource will revoke Okta Support access to your org.
+----
+-
+-# Resource: okta_org_support
+-
+-Manages Okta Support access your org
+-This resource allows you to temporarily allow Okta Support to access your org as an administrator. By default,
+-access will be granted for eight hours. Removing this resource will revoke Okta Support access to your org.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_org_support" "example" {
+-  extend_by = 1
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Optional
+-
+-- `extend_by` (Number) Number of days the support should be extended by
+-
+-### Read-Only
+-
+-- `expiration` (String) Expiration of Okta Support
+-- `id` (String) The ID of this resource.
+-- `status` (String) Status of Okta Support
+-
+-
+diff --git a/docs/resources/policy_device_assurance_android.md b/docs/resources/policy_device_assurance_android.md
+deleted file mode 100644
+index 889271aa..00000000
+--- a/docs/resources/policy_device_assurance_android.md
++++ /dev/null
+@@ -1,54 +0,0 @@
+----
+-page_title: "Resource: okta_policy_device_assurance_android"
+-description: |-
+-  Manages a device assurance policy for android.
+----
+-
+-# Resource: okta_policy_device_assurance_android
+-
+-Manages a device assurance policy for android.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_policy_device_assurance_android" "example" {
+-  name                    = "example"
+-  os_version              = "12"
+-  disk_encryption_type    = toset(["FULL", "USER"])
+-  jailbreak               = false
+-  secure_hardware_present = true
+-  screenlock_type         = toset(["BIOMETRIC"])
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `name` (String) Policy device assurance name
+-
+-### Optional
+-
+-- `disk_encryption_type` (Set of String) List of disk encryption type, can be `FULL`, `USER`
+-- `jailbreak` (Boolean) Is the device jailbroken in the device assurance policy.
+-- `os_version` (String) Minimum os version of the device in the device assurance policy.
+-- `screenlock_type` (Set of String) List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
+-- `secure_hardware_present` (Boolean) Indicates if the device contains a secure hardware functionality
+-
+-### Read-Only
+-
+-- `created_by` (String) Created by
+-- `created_date` (String) Created date
+-- `id` (String) Policy assurance id
+-- `last_update` (String) Last update
+-- `last_updated_by` (String) Last updated by
+-- `platform` (String) Policy device assurance platform
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_policy_device_assurance_android.example &#60;device assurance id&#62;
+-```
+diff --git a/docs/resources/policy_device_assurance_chromeos.md b/docs/resources/policy_device_assurance_chromeos.md
+deleted file mode 100644
+index e566f3af..00000000
+--- a/docs/resources/policy_device_assurance_chromeos.md
++++ /dev/null
+@@ -1,72 +0,0 @@
+----
+-page_title: "Resource: okta_policy_device_assurance_chromeos"
+-description: |-
+-  Manages a device assurance policy for chromeos.
+----
+-
+-# Resource: okta_policy_device_assurance_chromeos
+-
+-Manages a device assurance policy for chromeos.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_policy_device_assurance_chromeos" "example" {
+-  name                                      = "example"
+-  tpsp_allow_screen_lock                    = true
+-  tpsp_browser_version                      = "15393.27.0"
+-  tpsp_builtin_dns_client_enabled           = true
+-  tpsp_chrome_remote_desktop_app_blocked    = true
+-  tpsp_device_enrollment_domain             = "exampleDomain"
+-  tpsp_disk_encrypted                       = true
+-  tpsp_key_trust_level                      = "CHROME_OS_VERIFIED_MODE"
+-  tpsp_os_firewall                          = true
+-  tpsp_os_version                           = "10.0.19041.1110"
+-  tpsp_password_proctection_warning_trigger = "PASSWORD_PROTECTION_OFF"
+-  tpsp_realtime_url_check_mode              = true
+-  tpsp_safe_browsing_protection_level       = "ENHANCED_PROTECTION"
+-  tpsp_screen_lock_secured                  = true
+-  tpsp_site_isolation_enabled               = true
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `name` (String) Name of the device assurance policy.
+-
+-### Optional
+-
+-- `tpsp_allow_screen_lock` (Boolean) Third party signal provider allow screen lock
+-- `tpsp_browser_version` (String) Third party signal provider minimum browser version
+-- `tpsp_builtin_dns_client_enabled` (Boolean) Third party signal provider builtin dns client enabled
+-- `tpsp_chrome_remote_desktop_app_blocked` (Boolean) Third party signal provider chrome remote desktop app blocked
+-- `tpsp_device_enrollment_domain` (String) Third party signal provider device enrollment domain
+-- `tpsp_disk_encrypted` (Boolean) Third party signal provider disk encrypted
+-- `tpsp_key_trust_level` (String) Third party signal provider key trust level
+-- `tpsp_os_firewall` (Boolean) Third party signal provider os firewall
+-- `tpsp_os_version` (String) Third party signal provider minimum os version
+-- `tpsp_password_proctection_warning_trigger` (String) Third party signal provider password protection warning trigger
+-- `tpsp_realtime_url_check_mode` (Boolean) Third party signal provider realtime url check mode
+-- `tpsp_safe_browsing_protection_level` (String) Third party signal provider safe browsing protection level
+-- `tpsp_screen_lock_secured` (Boolean) Third party signal provider screen lock secure
+-- `tpsp_site_isolation_enabled` (Boolean) Third party signal provider site isolation enabled
+-
+-### Read-Only
+-
+-- `created_by` (String) Created by
+-- `created_date` (String) Created date
+-- `id` (String) Policy assurance id
+-- `last_update` (String) Last update
+-- `last_updated_by` (String) Last updated by
+-- `platform` (String) Policy device assurance platform
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_policy_device_assurance_chromeos.example &#60;device assurance id&#62;
+-```
+diff --git a/docs/resources/policy_device_assurance_ios.md b/docs/resources/policy_device_assurance_ios.md
+deleted file mode 100644
+index a49258bb..00000000
+--- a/docs/resources/policy_device_assurance_ios.md
++++ /dev/null
+@@ -1,50 +0,0 @@
+----
+-page_title: "Resource: okta_policy_device_assurance_ios"
+-description: |-
+-  Manages a device assurance policy for ios.
+----
+-
+-# Resource: okta_policy_device_assurance_ios
+-
+-Manages a device assurance policy for ios.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_policy_device_assurance_ios" "example" {
+-  name            = "example"
+-  os_version      = "12.4.5"
+-  jailbreak       = false
+-  screenlock_type = toset(["BIOMETRIC"])
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `name` (String) Name of the device assurance policy.
+-
+-### Optional
+-
+-- `jailbreak` (Boolean) Is the device jailbroken in the device assurance policy.
+-- `os_version` (String) Minimum os version of the device in the device assurance policy.
+-- `screenlock_type` (Set of String) List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
+-
+-### Read-Only
+-
+-- `created_by` (String) Created by of the device assurance polic
+-- `created_date` (String) Created date of the device assurance polic
+-- `id` (String) Policy assurance id
+-- `last_update` (String) Last update of the device assurance polic
+-- `last_updated_by` (String) Last updated by of the device assurance polic
+-- `platform` (String) Policy device assurance platform
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_policy_device_assurance_ios.example &#60;device assurance id&#62;
+-```
+diff --git a/docs/resources/policy_device_assurance_macos.md b/docs/resources/policy_device_assurance_macos.md
+deleted file mode 100644
+index 9a176134..00000000
+--- a/docs/resources/policy_device_assurance_macos.md
++++ /dev/null
+@@ -1,80 +0,0 @@
+----
+-page_title: "Resource: okta_policy_device_assurance_macos"
+-description: |-
+-  Manages a device assurance policy for macos.
+----
+-
+-# Resource: okta_policy_device_assurance_macos
+-
+-Manages a device assurance policy for macos.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_policy_device_assurance_macos" "example" {
+-  name                                      = "example"
+-  os_version                                = "12.4.6"
+-  disk_encryption_type                      = toset(["ALL_INTERNAL_VOLUMES"])
+-  secure_hardware_present                   = true
+-  screenlock_type                           = toset(["BIOMETRIC", "PASSCODE"])
+-  third_party_signal_providers              = true
+-  tpsp_browser_version                      = "15393.27.0"
+-  tpsp_builtin_dns_client_enabled           = true
+-  tpsp_chrome_remote_desktop_app_blocked    = true
+-  tpsp_device_enrollment_domain             = "exampleDomain"
+-  tpsp_disk_encrypted                       = true
+-  tpsp_key_trust_level                      = "CHROME_BROWSER_HW_KEY"
+-  tpsp_os_firewall                          = true
+-  tpsp_os_version                           = "10.0.19041"
+-  tpsp_password_proctection_warning_trigger = "PASSWORD_PROTECTION_OFF"
+-  tpsp_realtime_url_check_mode              = true
+-  tpsp_safe_browsing_protection_level       = "ENHANCED_PROTECTION"
+-  tpsp_screen_lock_secured                  = true
+-  tpsp_site_isolation_enabled               = true
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `name` (String) Name of the device assurance policy.
+-
+-### Optional
+-
+-- `disk_encryption_type` (Set of String) List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
+-- `os_version` (String) Minimum os version of the device in the device assurance policy.
+-- `screenlock_type` (Set of String) List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
+-- `secure_hardware_present` (Boolean) Is the device secure with hardware in the device assurance policy.
+-- `third_party_signal_providers` (Boolean) Check to include third party signal provider
+-- `tpsp_browser_version` (String) Third party signal provider minimum browser version
+-- `tpsp_builtin_dns_client_enabled` (Boolean) Third party signal provider builtin dns client enable
+-- `tpsp_chrome_remote_desktop_app_blocked` (Boolean) Third party signal provider chrome remote desktop app blocked
+-- `tpsp_device_enrollment_domain` (String) Third party signal provider device enrollment domain
+-- `tpsp_disk_encrypted` (Boolean) Third party signal provider disk encrypted
+-- `tpsp_key_trust_level` (String) Third party signal provider key trust level
+-- `tpsp_os_firewall` (Boolean) Third party signal provider os firewall
+-- `tpsp_os_version` (String) Third party signal provider minimum os version
+-- `tpsp_password_proctection_warning_trigger` (String) Third party signal provider password protection warning trigger
+-- `tpsp_realtime_url_check_mode` (Boolean) Third party signal provider realtime url check mode
+-- `tpsp_safe_browsing_protection_level` (String) Third party signal provider safe browsing protection level
+-- `tpsp_screen_lock_secured` (Boolean) Third party signal provider screen lock secure
+-- `tpsp_site_isolation_enabled` (Boolean) Third party signal provider site isolation enabled
+-
+-### Read-Only
+-
+-- `created_by` (String) Created by
+-- `created_date` (String) Created date
+-- `id` (String) Policy assurance id
+-- `last_update` (String) Last update
+-- `last_updated_by` (String) Last updated by
+-- `platform` (String) Policy device assurance platform
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_policy_device_assurance_macos.example &#60;device assurance id&#62;
+-```
+diff --git a/docs/resources/policy_device_assurance_windows.md b/docs/resources/policy_device_assurance_windows.md
+deleted file mode 100644
+index d01991b1..00000000
+--- a/docs/resources/policy_device_assurance_windows.md
++++ /dev/null
+@@ -1,92 +0,0 @@
+----
+-page_title: "Resource: okta_policy_device_assurance_windows"
+-description: |-
+-  Manages a device assurance policy for windows.
+----
+-
+-# Resource: okta_policy_device_assurance_windows
+-
+-Manages a device assurance policy for windows.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_policy_device_assurance_windows" "example" {
+-  name                                      = "example"
+-  os_version                                = "12.4.6"
+-  disk_encryption_type                      = toset(["ALL_INTERNAL_VOLUMES"])
+-  secure_hardware_present                   = true
+-  screenlock_type                           = toset(["BIOMETRIC", "PASSCODE"])
+-  third_party_signal_providers              = true
+-  tpsp_browser_version                      = "15393.27.0"
+-  tpsp_builtin_dns_client_enabled           = true
+-  tpsp_chrome_remote_desktop_app_blocked    = true
+-  tpsp_crowd_strike_agent_id                = "exampleAgentId"
+-  tpsp_crowd_strike_customer_id             = "exampleCustomerId"
+-  tpsp_device_enrollment_domain             = "exampleDomain"
+-  tpsp_disk_encrypted                       = true
+-  tpsp_key_trust_level                      = "CHROME_BROWSER_HW_KEY"
+-  tpsp_os_firewall                          = true
+-  tpsp_os_version                           = "10.0.19041"
+-  tpsp_password_proctection_warning_trigger = "PASSWORD_PROTECTION_OFF"
+-  tpsp_realtime_url_check_mode              = true
+-  tpsp_safe_browsing_protection_level       = "ENHANCED_PROTECTION"
+-  tpsp_screen_lock_secured                  = true
+-  tpsp_secure_boot_enabled                  = true
+-  tpsp_site_isolation_enabled               = true
+-  tpsp_third_party_blocking_enabled         = true
+-  tpsp_windows_machine_domain               = "exampleMachineDomain"
+-  tpsp_windows_user_domain                  = "exampleUserDomain"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `name` (String) Name of the device assurance policy.
+-
+-### Optional
+-
+-- `disk_encryption_type` (Set of String) List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
+-- `os_version` (String) Minimum os version of the device in the device assurance policy.
+-- `screenlock_type` (Set of String) List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
+-- `secure_hardware_present` (Boolean) Is the device secure with hardware in the device assurance policy.
+-- `third_party_signal_providers` (Boolean) Check to include third party signal provider
+-- `tpsp_browser_version` (String) Third party signal provider minimum browser version
+-- `tpsp_builtin_dns_client_enabled` (Boolean) Third party signal provider builtin dns client enable
+-- `tpsp_chrome_remote_desktop_app_blocked` (Boolean) Third party signal provider chrome remote desktop app blocked
+-- `tpsp_crowd_strike_agent_id` (String) Third party signal provider crowdstrike agent id
+-- `tpsp_crowd_strike_customer_id` (String) Third party signal provider crowdstrike user id
+-- `tpsp_device_enrollment_domain` (String) Third party signal provider device enrollment domain
+-- `tpsp_disk_encrypted` (Boolean) Third party signal provider disk encrypted
+-- `tpsp_key_trust_level` (String) Third party signal provider key trust level
+-- `tpsp_os_firewall` (Boolean) Third party signal provider os firewall
+-- `tpsp_os_version` (String) Third party signal provider minimum os version
+-- `tpsp_password_proctection_warning_trigger` (String) Third party signal provider password protection warning trigger
+-- `tpsp_realtime_url_check_mode` (Boolean) Third party signal provider realtime url check mode
+-- `tpsp_safe_browsing_protection_level` (String) Third party signal provider safe browsing protection level
+-- `tpsp_screen_lock_secured` (Boolean) Third party signal provider screen lock secure
+-- `tpsp_secure_boot_enabled` (Boolean) Third party signal provider secure boot enabled
+-- `tpsp_site_isolation_enabled` (Boolean) Third party signal provider site isolation enabled
+-- `tpsp_third_party_blocking_enabled` (Boolean) Third party signal provider third party blocking enabled
+-- `tpsp_windows_machine_domain` (String) Third party signal provider windows machine domain
+-- `tpsp_windows_user_domain` (String) Third party signal provider windows user domain
+-
+-### Read-Only
+-
+-- `created_by` (String) Created by
+-- `created_date` (String) Created date
+-- `id` (String) Policy assurance id
+-- `last_update` (String) Last update
+-- `last_updated_by` (String) Last updated by
+-- `platform` (String) Policy device assurance platform
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_policy_device_assurance_windows.example &#60;device assurance id&#62;
+-```
+diff --git a/docs/resources/policy_mfa.md b/docs/resources/policy_mfa.md
+deleted file mode 100644
+index c336d46a..00000000
+--- a/docs/resources/policy_mfa.md
++++ /dev/null
+@@ -1,96 +0,0 @@
+----
+-page_title: "Resource: okta_policy_mfa"
+-description: |-
+-  
+----
+-
+-# Resource: okta_policy_mfa
+-
+-
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_policy_mfa" "classic_example" {
+-  name        = "MFA Policy Classic"
+-  status      = "ACTIVE"
+-  description = "Example MFA policy using Okta Classic engine with factors."
+-  is_oie      = false
+-
+-  okta_password = {
+-    enroll = "REQUIRED"
+-  }
+-
+-  okta_otp = {
+-    enroll = "REQUIRED"
+-  }
+-
+-  groups_included = ["${data.okta_group.everyone.id}"]
+-}
+-
+-resource "okta_policy_mfa" "oie_example" {
+-  name        = "MFA Policy OIE"
+-  status      = "ACTIVE"
+-  description = "Example MFA policy that uses Okta Identity Engine (OIE) with authenticators"
+-  is_oie      = true
+-
+-  okta_password = {
+-    enroll = "REQUIRED"
+-  }
+-
+-  # The following authenticator can only be used when `is_oie` is set to true
+-  okta_verify = {
+-    enroll = "REQUIRED"
+-  }
+-
+-  groups_included = ["${data.okta_group.everyone.id}"]
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `name` (String) Policy Name
+-
+-### Optional
+-
+-- `description` (String) Policy Description
+-- `duo` (Map of String)
+-- `external_idp` (Map of String)
+-- `fido_u2f` (Map of String)
+-- `fido_webauthn` (Map of String)
+-- `google_otp` (Map of String)
+-- `groups_included` (Set of String) List of Group IDs to Include
+-- `hotp` (Map of String)
+-- `is_oie` (Boolean) Is the policy using Okta Identity Engine (OIE) with authenticators instead of factors?
+-- `okta_call` (Map of String)
+-- `okta_email` (Map of String)
+-- `okta_otp` (Map of String)
+-- `okta_password` (Map of String)
+-- `okta_push` (Map of String)
+-- `okta_question` (Map of String)
+-- `okta_sms` (Map of String)
+-- `okta_verify` (Map of String)
+-- `onprem_mfa` (Map of String)
+-- `phone_number` (Map of String)
+-- `priority` (Number) Policy Priority, this attribute can be set to a valid priority. To avoid endless diff situation we error if an invalid priority is provided. API defaults it to the last (lowest) if not there.
+-- `rsa_token` (Map of String)
+-- `security_question` (Map of String)
+-- `status` (String) Policy Status: `ACTIVE` or `INACTIVE`. Default: `ACTIVE`
+-- `symantec_vip` (Map of String)
+-- `webauthn` (Map of String)
+-- `yubikey_token` (Map of String)
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-$ terraform import okta_policy_mfa.example &#60;policy id&#62;
+-```
+diff --git a/docs/resources/policy_mfa_default.md b/docs/resources/policy_mfa_default.md
+deleted file mode 100644
+index 506a74c1..00000000
+--- a/docs/resources/policy_mfa_default.md
++++ /dev/null
+@@ -1,91 +0,0 @@
+----
+-page_title: "Resource: okta_policy_mfa_default"
+-description: |-
+-  Configures default MFA Policy.
+-  This resource allows you to configure default MFA Policy.
+-  ~> Requires Org Feature Flag 'OKTAMFAPOLICY'. Contact support mailto:dev-inquiries@okta.com to have this feature flag enabled.
+-  ~> Unless Org Feature Flag 'ENGENABLEOPTIONALPASSWORDENROLLMENT' is disabled 'oktapassword' or 'oktaemail' must be present and its 'enroll' value set to 'REQUIRED'. Contact support mailto:dev-inquiries@okta.com to have this feature flag disabled.
+----
+-
+-# Resource: okta_policy_mfa_default
+-
+-Configures default MFA Policy.
+-This resource allows you to configure default MFA Policy.
+-~> Requires Org Feature Flag 'OKTA_MFA_POLICY'. [Contact support](mailto:dev-inquiries@okta.com) to have this feature flag ***enabled***.
+-~> Unless Org Feature Flag 'ENG_ENABLE_OPTIONAL_PASSWORD_ENROLLMENT' is ***disabled*** 'okta_password' or 'okta_email' must be present and its 'enroll' value set to 'REQUIRED'. [Contact support](mailto:dev-inquiries@okta.com) to have this feature flag ***disabled***.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_policy_mfa_default" "classic_example" {
+-  is_oie = false
+-
+-  okta_password = {
+-    enroll = "REQUIRED"
+-  }
+-
+-  okta_otp = {
+-    enroll = "REQUIRED"
+-  }
+-}
+-
+-resource "okta_policy_mfa_default" "oie_example" {
+-  is_oie = true
+-
+-  okta_password = {
+-    enroll = "REQUIRED"
+-  }
+-
+-  # The following authenticator can only be used when `is_oie` is set to true
+-  okta_verify = {
+-    enroll = "REQUIRED"
+-  }
+-}
+-
+-### -> If the `okta_policy_mfa_default` is used in conjunction with `okta_policy_mfa` resources, ensure to use a `depends_on` attribute for the default policy to ensure that all other policies are created/updated first such that the `priority` field can be appropriately computed on the first plan/apply.
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Optional
+-
+-- `duo` (Map of String)
+-- `external_idp` (Map of String)
+-- `fido_u2f` (Map of String)
+-- `fido_webauthn` (Map of String)
+-- `google_otp` (Map of String)
+-- `hotp` (Map of String)
+-- `is_oie` (Boolean) Is the policy using Okta Identity Engine (OIE) with authenticators instead of factors?
+-- `okta_call` (Map of String)
+-- `okta_email` (Map of String)
+-- `okta_otp` (Map of String)
+-- `okta_password` (Map of String)
+-- `okta_push` (Map of String)
+-- `okta_question` (Map of String)
+-- `okta_sms` (Map of String)
+-- `okta_verify` (Map of String)
+-- `onprem_mfa` (Map of String)
+-- `phone_number` (Map of String)
+-- `rsa_token` (Map of String)
+-- `security_question` (Map of String)
+-- `symantec_vip` (Map of String)
+-- `webauthn` (Map of String)
+-- `yubikey_token` (Map of String)
+-
+-### Read-Only
+-
+-- `default_included_group_id` (String) Default group ID (always included)
+-- `description` (String) Default policy description
+-- `id` (String) The ID of this resource.
+-- `name` (String) Default policy name
+-- `priority` (Number) Default policy priority
+-- `status` (String) Default policy status
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_policy_mfa_default.example .
+-```
+diff --git a/docs/resources/policy_password.md b/docs/resources/policy_password.md
+deleted file mode 100644
+index fc75d249..00000000
+--- a/docs/resources/policy_password.md
++++ /dev/null
+@@ -1,72 +0,0 @@
+----
+-page_title: "Resource: okta_policy_password"
+-description: |-
+-  Creates a Password Policy. This resource allows you to create and configure a Password Policy.
+----
+-
+-# Resource: okta_policy_password
+-
+-Creates a Password Policy. This resource allows you to create and configure a Password Policy.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_policy_password" "example" {
+-  name                   = "example"
+-  status                 = "ACTIVE"
+-  description            = "Example"
+-  password_history_count = 4
+-  groups_included        = ["${data.okta_group.everyone.id}"]
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `name` (String) Policy Name
+-
+-### Optional
+-
+-- `auth_provider` (String) Authentication Provider: `OKTA`, `ACTIVE_DIRECTORY` or `LDAP`. Default: `OKTA`
+-- `call_recovery` (String) Enable or disable voice call recovery: `ACTIVE` or `INACTIVE`. Default: `INACTIVE`
+-- `description` (String) Policy Description
+-- `email_recovery` (String) Enable or disable email password recovery: `ACTIVE` or `INACTIVE`. Default: `ACTIVE`
+-- `groups_included` (Set of String) List of Group IDs to Include
+-- `password_auto_unlock_minutes` (Number) Number of minutes before a locked account is unlocked: 0 = no limit. Default: `0`
+-- `password_dictionary_lookup` (Boolean) Check Passwords Against Common Password Dictionary. Default: `false`
+-- `password_exclude_first_name` (Boolean) User firstName attribute must be excluded from the password
+-- `password_exclude_last_name` (Boolean) User lastName attribute must be excluded from the password
+-- `password_exclude_username` (Boolean) If the user name must be excluded from the password. Default: `true`
+-- `password_expire_warn_days` (Number) Length in days a user will be warned before password expiry: 0 = no warning. Default: `0`
+-- `password_history_count` (Number) Number of distinct passwords that must be created before they can be reused: 0 = none. Default: `0`
+-- `password_lockout_notification_channels` (Set of String) Notification channels to use to notify a user when their account has been locked.
+-- `password_max_age_days` (Number) Length in days a password is valid before expiry: 0 = no limit. Default: `0`
+-- `password_max_lockout_attempts` (Number) Number of unsuccessful login attempts allowed before lockout: 0 = no limit. Default: `10`
+-- `password_min_age_minutes` (Number) Minimum time interval in minutes between password changes: 0 = no limit. Default: `0`
+-- `password_min_length` (Number) Minimum password length. Default: `8`
+-- `password_min_lowercase` (Number) If a password must contain at least one lower case letter: 0 = no, 1 = yes. Default: `1`
+-- `password_min_number` (Number) If a password must contain at least one number: 0 = no, 1 = yes. Default: `1`
+-- `password_min_symbol` (Number) If a password must contain at least one symbol (!@#$%^&*): 0 = no, 1 = yes. Default: `0`
+-- `password_min_uppercase` (Number) If a password must contain at least one upper case letter: 0 = no, 1 = yes. Default: `1`
+-- `password_show_lockout_failures` (Boolean) If a user should be informed when their account is locked. Default: `false`
+-- `priority` (Number) Policy Priority, this attribute can be set to a valid priority. To avoid endless diff situation we error if an invalid priority is provided. API defaults it to the last (lowest) if not there.
+-- `question_min_length` (Number) Min length of the password recovery question answer. Default: `4`
+-- `question_recovery` (String) Enable or disable security question password recovery: `ACTIVE` or `INACTIVE`. Default: `ACTIVE`
+-- `recovery_email_token` (Number) Lifetime in minutes of the recovery email token. Default: `60`
+-- `skip_unlock` (Boolean) When an Active Directory user is locked out of Okta, the Okta unlock operation should also attempt to unlock the user's Windows account. Default: `false`
+-- `sms_recovery` (String) Enable or disable SMS password recovery: `ACTIVE` or `INACTIVE`. Default: `INACTIVE`
+-- `status` (String) Policy Status: `ACTIVE` or `INACTIVE`. Default: `ACTIVE`
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_policy_password.example &#60;policy id&#62;
+-```
+diff --git a/docs/resources/policy_password_default.md b/docs/resources/policy_password_default.md
+deleted file mode 100644
+index 2e91808b..00000000
+--- a/docs/resources/policy_password_default.md
++++ /dev/null
+@@ -1,65 +0,0 @@
+----
+-page_title: "Resource: okta_policy_password_default"
+-description: |-
+-  Configures default password policy. This resource allows you to configure default password policy.
+----
+-
+-# Resource: okta_policy_password_default
+-
+-Configures default password policy. This resource allows you to configure default password policy.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_policy_password_default" "default" {
+-
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Optional
+-
+-- `call_recovery` (String) Enable or disable voice call recovery: ACTIVE or INACTIVE. Default: `INACTIVE`
+-- `email_recovery` (String) Enable or disable email password recovery: ACTIVE or INACTIVE. Default: `ACTIVE`
+-- `password_auto_unlock_minutes` (Number) Number of minutes before a locked account is unlocked: 0 = no limit. Default: `0`
+-- `password_dictionary_lookup` (Boolean) Check Passwords Against Common Password Dictionary. Default: `false`
+-- `password_exclude_first_name` (Boolean) User firstName attribute must be excluded from the password
+-- `password_exclude_last_name` (Boolean) User lastName attribute must be excluded from the password
+-- `password_exclude_username` (Boolean) If the user name must be excluded from the password. Default: `true`
+-- `password_expire_warn_days` (Number) Length in days a user will be warned before password expiry: 0 = no warning. Default: `0`
+-- `password_history_count` (Number) Number of distinct passwords that must be created before they can be reused: 0 = none. Default: `4`
+-- `password_lockout_notification_channels` (Set of String) Notification channels to use to notify a user when their account has been locked.
+-- `password_max_age_days` (Number) Length in days a password is valid before expiry: 0 = no limit. Default: `0`
+-- `password_max_lockout_attempts` (Number) Number of unsuccessful login attempts allowed before lockout: 0 = no limit. Default: `10`
+-- `password_min_age_minutes` (Number) Minimum time interval in minutes between password changes: 0 = no limit. Default: `0`
+-- `password_min_length` (Number) Minimum password length. Default is `8`.
+-- `password_min_lowercase` (Number) If a password must contain at least one lower case letter: 0 = no, 1 = yes. Default = 1
+-- `password_min_number` (Number) If a password must contain at least one number: 0 = no, 1 = yes. Default = `1`
+-- `password_min_symbol` (Number) If a password must contain at least one symbol (!@#$%^&*): 0 = no, 1 = yes. Default = `0`
+-- `password_min_uppercase` (Number) If a password must contain at least one upper case letter: 0 = no, 1 = yes. Default = 1
+-- `password_show_lockout_failures` (Boolean) If a user should be informed when their account is locked. Default: `false`
+-- `question_min_length` (Number) Min length of the password recovery question answer. Default: `4`
+-- `question_recovery` (String) Enable or disable security question password recovery: ACTIVE or INACTIVE. Default: `ACTIVE`
+-- `recovery_email_token` (Number) Lifetime in minutes of the recovery email token. Default: `60`
+-- `skip_unlock` (Boolean) When an Active Directory user is locked out of Okta, the Okta unlock operation should also attempt to unlock the user's Windows account. Default: `false`
+-- `sms_recovery` (String) Enable or disable SMS password recovery: ACTIVE or INACTIVE. Default: `INACTIVE`
+-
+-### Read-Only
+-
+-- `default_auth_provider` (String) Default Authentication Provider
+-- `default_included_group_id` (String) Default group ID (always included)
+-- `description` (String) Default policy description
+-- `id` (String) The ID of this resource.
+-- `name` (String) Default policy name
+-- `priority` (Number) Default policy priority
+-- `status` (String) Default policy status
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_policy_password_default.example .
+-```
+diff --git a/docs/resources/policy_profile_enrollment.md b/docs/resources/policy_profile_enrollment.md
+deleted file mode 100644
+index 2da91c39..00000000
+--- a/docs/resources/policy_profile_enrollment.md
++++ /dev/null
+@@ -1,46 +0,0 @@
+----
+-page_title: "Resource: okta_policy_profile_enrollment"
+-description: |-
+-  Creates a Profile Enrollment Policy
+-  ~> WARNING: This feature is only available as a part of the Identity Engine. Contact support mailto:dev-inquiries@okta.com for further information.
+-  This resource allows you to create and configure a Profile Enrollment Policy.
+----
+-
+-# Resource: okta_policy_profile_enrollment
+-
+-Creates a Profile Enrollment Policy
+-		
+-~> **WARNING:** This feature is only available as a part of the Identity Engine. [Contact support](mailto:dev-inquiries@okta.com) for further information.
+-This resource allows you to create and configure a Profile Enrollment Policy.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_policy_profile_enrollment" "example" {
+-  name   = "example"
+-  status = "ACTIVE"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `name` (String) Name of the policy
+-
+-### Optional
+-
+-- `status` (String) Status of the policy
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_policy_profile_enrollment.example &#60;policy id&#62;
+-```
+diff --git a/docs/resources/policy_profile_enrollment_apps.md b/docs/resources/policy_profile_enrollment_apps.md
+deleted file mode 100644
+index e13b534e..00000000
+--- a/docs/resources/policy_profile_enrollment_apps.md
++++ /dev/null
+@@ -1,63 +0,0 @@
+----
+-page_title: "Resource: okta_policy_profile_enrollment_apps"
+-description: |-
+-  Manages Profile Enrollment Policy Apps
+-  ~> WARNING: This feature is only available as a part of the Identity Engine. Contact support mailto:dev-inquiries@okta.com for further information.
+-  This resource allows you to manage the apps in the Profile Enrollment Policy.
+-  Important Notes:
+-   - Default Enrollment Policy can not be used in this resource since it is used as a policy to re-assign apps to when they are unassigned from this one.
+-   - When re-assigning the app to another policy, please use 'depends_on' in the policy to which the app will be assigned. This is necessary to avoid
+-    unexpected behavior, since if the app is unassigned from the policy it is just assigned to the 'Default' one.
+----
+-
+-# Resource: okta_policy_profile_enrollment_apps
+-
+-Manages Profile Enrollment Policy Apps
+-~> **WARNING:** This feature is only available as a part of the Identity Engine. [Contact support](mailto:dev-inquiries@okta.com) for further information.
+-This resource allows you to manage the apps in the Profile Enrollment Policy. 
+-**Important Notes:** 
+- - Default Enrollment Policy can not be used in this resource since it is used as a policy to re-assign apps to when they are unassigned from this one.
+- - When re-assigning the app to another policy, please use 'depends_on' in the policy to which the app will be assigned. This is necessary to avoid 
+-  unexpected behavior, since if the app is unassigned from the policy it is just assigned to the 'Default' one.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_policy" "example" {
+-  name = "My Policy"
+-  type = "PROFILE_ENROLLMENT"
+-}
+-
+-data "okta_app" "test" {
+-  label = "My App"
+-}
+-
+-resource "okta_policy_profile_enrollment_apps" "example" {
+-  policy_id = okta_policy.example.id
+-  apps      = [data.okta_app.id]
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `policy_id` (String) ID of the enrollment policy.
+-
+-### Optional
+-
+-- `apps` (Set of String) List of app IDs to be added to this policy
+-
+-### Read-Only
+-
+-- `default_policy_id` (String) ID of the Default Enrollment Policy. This policy is used as a policy to re-assign apps to when they are unassigned from this one
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_policy_profile_enrollment_apps.example &#60;policy id&#62;
+-```
+diff --git a/docs/resources/policy_rule_idp_discovery.md b/docs/resources/policy_rule_idp_discovery.md
+deleted file mode 100644
+index 6cbef6f4..00000000
+--- a/docs/resources/policy_rule_idp_discovery.md
++++ /dev/null
+@@ -1,164 +0,0 @@
+----
+-page_title: "Resource: okta_policy_rule_idp_discovery"
+-description: |-
+-  Creates an IdP Discovery Policy Rule.
+-  This resource allows you to create and configure an IdP Discovery Policy Rule.
+-  -> If you receive the error 'You do not have permission to access the feature
+-  you are requesting' contact support mailto:dev-inquiries@okta.com and
+-  request feature flag 'ADVANCED_SSO' be applied to your org.
+----
+-
+-# Resource: okta_policy_rule_idp_discovery
+-
+-Creates an IdP Discovery Policy Rule.
+-		
+-This resource allows you to create and configure an IdP Discovery Policy Rule.
+--> If you receive the error 'You do not have permission to access the feature
+-you are requesting' [contact support](mailto:dev-inquiries@okta.com) and
+-request feature flag 'ADVANCED_SSO' be applied to your org.
+-
+-## Example Usage
+-
+-```terraform
+-### All Okta orgs contain only one IdP Discovery Policy
+-data "okta_policy" "idp_discovery_policy" {
+-  name = "Idp Discovery Policy"
+-  type = "IDP_DISCOVERY"
+-}
+-
+-resource "okta_policy_rule_idp_discovery" "example" {
+-  policy_id                 = data.okta_policy.idp_discovery_policy.id
+-  name                      = "example"
+-  idp_id                    = "<idp id>"
+-  idp_type                  = "OIDC"
+-  network_connection        = "ANYWHERE"
+-  priority                  = 1
+-  status                    = "ACTIVE"
+-  user_identifier_type      = "ATTRIBUTE"
+-  user_identifier_attribute = "company"
+-
+-  app_exclude {
+-    id   = "<app id>"
+-    type = "APP"
+-  }
+-
+-  app_exclude {
+-    name = "yahoo_mail"
+-    type = "APP_TYPE"
+-  }
+-
+-  app_include {
+-    id   = "<app id>"
+-    type = "APP"
+-  }
+-
+-  app_include {
+-    name = "<app type name>"
+-    type = "APP_TYPE"
+-  }
+-
+-  platform_include {
+-    type    = "MOBILE"
+-    os_type = "OSX"
+-  }
+-
+-  user_identifier_patterns {
+-    match_type = "EQUALS"
+-    value      = "Articulate"
+-  }
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `name` (String) Policy Rule Name
+-
+-### Optional
+-
+-- `app_exclude` (Block Set) Applications to exclude in discovery. See `app_include` for details. (see [below for nested schema](#nestedblock--app_exclude))
+-- `app_include` (Block Set) Applications to include in discovery rule.
+-- 'id' - (Optional) Use if 'type' is 'APP' to indicate the application id to include.
+-- 'name' - (Optional) Use if the 'type' is 'APP_TYPE' to indicate the type of application(s) to include in instances where an entire group (i.e. 'yahoo_mail') of applications should be included.
+-- 'type' - (Required) One of: 'APP', 'APP_TYPE' (see [below for nested schema](#nestedblock--app_include))
+-- `idp_id` (String) The identifier for the Idp the rule should route to if all conditions are met.
+-- `idp_type` (String) Type of Idp. One of: `SAML2`, `IWA`, `AgentlessDSSO`, `X509`, `FACEBOOK`, `GOOGLE`, `LINKEDIN`, `MICROSOFT`, `OIDC`. Default: `OKTA`
+-- `network_connection` (String) Network selection mode: `ANYWHERE`, `ZONE`, `ON_NETWORK`, or `OFF_NETWORK`. Default: `ANYWHERE`
+-- `network_excludes` (List of String) Required if `network_connection` = `ZONE`. Indicates the network zones to exclude.
+-- `network_includes` (List of String) Required if `network_connection` = `ZONE`. Indicates the network zones to include.
+-- `platform_include` (Block Set) Platform to include in discovery rule.
+-- 'type' - (Optional) One of: 'ANY', 'MOBILE', 'DESKTOP'
+-- 'os_expression - (Optional) Only available when using os_type = 'OTHER'
+-- 'os_type' - (Optional) One of: 'ANY', 'IOS', 'WINDOWS', 'ANDROID', 'OTHER', 'OSX' (see [below for nested schema](#nestedblock--platform_include))
+-- `policy_id` (String) Policy ID of the Rule
+-- `priority` (Number) Rule priority. This attribute can be set to a valid priority. To avoid an endless diff situation an error is thrown if an invalid property is provided. The Okta API defaults to the last (lowest) if not provided.
+-- `status` (String) Policy Rule Status: `ACTIVE` or `INACTIVE`. Default: `ACTIVE`
+-- `user_identifier_attribute` (String) Profile attribute matching can only have a single value that describes the type indicated in `user_identifier_type`. This is the attribute or identifier that the `user_identifier_patterns` are checked against.
+-- `user_identifier_patterns` (Block Set) Specifies a User Identifier pattern condition to match against. If 'match_type' of 'EXPRESSION' is used, only a *single* element can be set, otherwise multiple elements of matching patterns may be provided.
+-- 'match_type' - (Optional) The kind of pattern. For regex, use 'EXPRESSION'. For simple string matches, use one of the following: 'SUFFIX', 'EQUALS', 'STARTS_WITH', 'CONTAINS'
+-- 'value' - (Optional) The regex or simple match string to match against. (see [below for nested schema](#nestedblock--user_identifier_patterns))
+-- `user_identifier_type` (String) One of: `IDENTIFIER`, `ATTRIBUTE`
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-<a id="nestedblock--app_exclude"></a>
+-### Nested Schema for `app_exclude`
+-
+-Required:
+-
+-- `type` (String)
+-
+-Optional:
+-
+-- `name` (String)
+-
+-Read-Only:
+-
+-- `id` (String) The ID of this resource.
+-
+-
+-<a id="nestedblock--app_include"></a>
+-### Nested Schema for `app_include`
+-
+-Required:
+-
+-- `type` (String)
+-
+-Optional:
+-
+-- `name` (String)
+-
+-Read-Only:
+-
+-- `id` (String) The ID of this resource.
+-
+-
+-<a id="nestedblock--platform_include"></a>
+-### Nested Schema for `platform_include`
+-
+-Optional:
+-
+-- `os_expression` (String) Only available with OTHER OS type
+-- `os_type` (String)
+-- `type` (String)
+-
+-
+-<a id="nestedblock--user_identifier_patterns"></a>
+-### Nested Schema for `user_identifier_patterns`
+-
+-Optional:
+-
+-- `match_type` (String)
+-- `value` (String)
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_policy_rule_idp_discovery.example &#60;policy id&#62;/&#60;rule id&#62;
+-```
+diff --git a/docs/resources/policy_rule_mfa.md b/docs/resources/policy_rule_mfa.md
+deleted file mode 100644
+index c0aae5d0..00000000
+--- a/docs/resources/policy_rule_mfa.md
++++ /dev/null
+@@ -1,193 +0,0 @@
+----
+-page_title: "Resource: okta_policy_rule_mfa"
+-description: |-
+-  Creates an MFA Policy Rule. This resource allows you to create and configure an MFA Policy Rule.
+----
+-
+-# Resource: okta_policy_rule_mfa
+-
+-Creates an MFA Policy Rule. This resource allows you to create and configure an MFA Policy Rule.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_default_policy" "example" {
+-  type = "MFA_ENROLL"
+-}
+-
+-resource "okta_policy_rule_mfa" "example" {
+-  policy_id = data.okta_default_policy.example.id
+-  name      = "My Rule"
+-  status    = "ACTIVE"
+-  enroll    = "LOGIN"
+-  app_include {
+-    id   = okta_app_oauth.example.id
+-    type = "APP"
+-  }
+-  app_include {
+-    type = "APP_TYPE"
+-    name = "yahoo_mail"
+-  }
+-}
+-
+-resource "okta_app_oauth" "example" {
+-  label          = "My App"
+-  type           = "web"
+-  grant_types    = ["authorization_code"]
+-  redirect_uris  = ["http://localhost:8000"]
+-  response_types = ["code"]
+-}
+-### Unchecked `Okta` and checked `Applications` (with `Any application that supports MFA enrollment` option) checkboxes in the `User is accessing` section corresponds to the following config:
+-
+-data "okta_default_policy" "example" {
+-  type = "MFA_ENROLL"
+-}
+-
+-resource "okta_policy_rule_mfa" "example" {
+-  name      = "Some policy rule"
+-  policy_id = data.okta_default_policy.example.id
+-
+-  app_exclude {
+-    name = "okta"
+-    type = "APP_TYPE"
+-  }
+-}
+-
+-### Unchecked `Okta` and checked `Applications` (with `Specific applications` option) checkboxes in the `User is accessing` section corresponds to the following config:
+-
+-data "okta_default_policy" "example" {
+-  type = "MFA_ENROLL"
+-}
+-
+-resource "okta_policy_rule_mfa" "example" {
+-  name      = "Some policy rule"
+-  policy_id = data.okta_default_policy.example.id
+-
+-  app_exclude {
+-    name = "okta"
+-    type = "APP_TYPE"
+-  }
+-
+-  app_include {
+-    id   = "some_app_id"
+-    type = "APP"
+-  }
+-}
+-
+-### Checked `Okta` and unchecked `Applications` checkboxes in the `User is accessing` section corresponds to the following config:
+-
+-data "okta_default_policy" "example" {
+-  type = "MFA_ENROLL"
+-}
+-
+-resource "okta_policy_rule_mfa" "example" {
+-  name      = "Some policy rule"
+-  policy_id = data.okta_default_policy.example.id
+-
+-  app_include {
+-    name = "okta"
+-    type = "APP_TYPE"
+-  }
+-}
+-
+-### Checked `Okta` and checked `Applications` (with `Any application that supports MFA enrollment` option) checkboxes in the `User is accessing` section corresponds to the following config:
+-
+-data "okta_default_policy" "example" {
+-  type = "MFA_ENROLL"
+-}
+-
+-resource "okta_policy_rule_mfa" "example" {
+-  name      = "Some policy rule"
+-  policy_id = data.okta_default_policy.example.id
+-}
+-
+-### Checked `Okta` and checked `Applications` (with `Specific applications` option) checkboxes in the `User is accessing` section corresponds to the following config:
+-
+-data "okta_default_policy" "example" {
+-  type = "MFA_ENROLL"
+-}
+-
+-resource "okta_policy_rule_mfa" "example" {
+-  name      = "Some policy rule"
+-  policy_id = data.okta_default_policy.example.id
+-
+-  app_include {
+-    name = "okta"
+-    type = "APP_TYPE"
+-  }
+-
+-  app_include {
+-    id   = "some_app_id"
+-    type = "APP"
+-  }
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `name` (String) Policy Rule Name
+-
+-### Optional
+-
+-- `app_exclude` (Block Set) Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations.
+-	- 'id' - (Optional) Use if 'type' is 'APP' to indicate the application id to include.
+-	- 'name' - (Optional) Use if the 'type' is 'APP_TYPE' to indicate the type of application(s) to include in instances where an entire group (i.e. 'yahoo_mail') of applications should be included.
+-	- 'type' - (Required) One of: 'APP', 'APP_TYPE' (see [below for nested schema](#nestedblock--app_exclude))
+-- `app_include` (Block Set) Applications to include in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations.
+-	- 'id' - (Optional) Use if 'type' is 'APP' to indicate the application id to include.
+-	- 'name' - (Optional) Use if the 'type' is 'APP_TYPE' to indicate the type of application(s) to include in instances where an entire group (i.e. 'yahoo_mail') of applications should be included.
+-	- 'type' - (Required) One of: 'APP', 'APP_TYPE' (see [below for nested schema](#nestedblock--app_include))
+-- `enroll` (String) When a user should be prompted for MFA. It can be `CHALLENGE`, `LOGIN`, or `NEVER`.
+-- `network_connection` (String) Network selection mode: `ANYWHERE`, `ZONE`, `ON_NETWORK`, or `OFF_NETWORK`. Default: `ANYWHERE`
+-- `network_excludes` (List of String) Required if `network_connection` = `ZONE`. Indicates the network zones to exclude.
+-- `network_includes` (List of String) Required if `network_connection` = `ZONE`. Indicates the network zones to include.
+-- `policy_id` (String) Policy ID of the Rule
+-- `priority` (Number) Rule priority. This attribute can be set to a valid priority. To avoid an endless diff situation an error is thrown if an invalid property is provided. The Okta API defaults to the last (lowest) if not provided.
+-- `status` (String) Policy Rule Status: `ACTIVE` or `INACTIVE`. Default: `ACTIVE`
+-- `users_excluded` (Set of String) Set of User IDs to Exclude
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-<a id="nestedblock--app_exclude"></a>
+-### Nested Schema for `app_exclude`
+-
+-Required:
+-
+-- `type` (String)
+-
+-Optional:
+-
+-- `name` (String)
+-
+-Read-Only:
+-
+-- `id` (String) The ID of this resource.
+-
+-
+-<a id="nestedblock--app_include"></a>
+-### Nested Schema for `app_include`
+-
+-Required:
+-
+-- `type` (String)
+-
+-Optional:
+-
+-- `name` (String)
+-
+-Read-Only:
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_policy_rule_mfa.example &#60;policy id&#62;/&#60;rule id&#62;
+-```
+diff --git a/docs/resources/policy_rule_password.md b/docs/resources/policy_rule_password.md
+deleted file mode 100644
+index 7d01a6ea..00000000
+--- a/docs/resources/policy_rule_password.md
++++ /dev/null
+@@ -1,43 +0,0 @@
+----
+-page_title: "Resource: okta_policy_rule_password"
+-description: |-
+-  Creates a Password Policy Rule. This resource allows you to create and configure a Password Policy Rule.
+----
+-
+-# Resource: okta_policy_rule_password
+-
+-Creates a Password Policy Rule. This resource allows you to create and configure a Password Policy Rule.
+-
+-
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `name` (String) Policy Rule Name
+-
+-### Optional
+-
+-- `network_connection` (String) Network selection mode: `ANYWHERE`, `ZONE`, `ON_NETWORK`, or `OFF_NETWORK`. Default: `ANYWHERE`
+-- `network_excludes` (List of String) Required if `network_connection` = `ZONE`. Indicates the network zones to exclude.
+-- `network_includes` (List of String) Required if `network_connection` = `ZONE`. Indicates the network zones to include.
+-- `password_change` (String) Allow or deny a user to change their password: `ALLOW` or `DENY`. Default: `ALLOW`
+-- `password_reset` (String) Allow or deny a user to reset their password: `ALLOW` or `DENY`. Default: `ALLOW`
+-- `password_unlock` (String) Allow or deny a user to unlock. Default: `DENY`
+-- `policy_id` (String) Policy ID of the Rule
+-- `priority` (Number) Rule priority. This attribute can be set to a valid priority. To avoid an endless diff situation an error is thrown if an invalid property is provided. The Okta API defaults to the last (lowest) if not provided.
+-- `status` (String) Policy Rule Status: `ACTIVE` or `INACTIVE`. Default: `ACTIVE`
+-- `users_excluded` (Set of String) Set of User IDs to Exclude
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-$ terraform import okta_policy_rule_password.example &#60;policy id&#62;/&#60;rule id&#62;
+-```
+diff --git a/docs/resources/policy_rule_profile_enrollment.md b/docs/resources/policy_rule_profile_enrollment.md
+deleted file mode 100644
+index 81ac4059..00000000
+--- a/docs/resources/policy_rule_profile_enrollment.md
++++ /dev/null
+@@ -1,118 +0,0 @@
+----
+-page_title: "Resource: okta_policy_rule_profile_enrollment"
+-description: |-
+-  Creates a Profile Enrollment Policy Rule.
+-  ~> WARNING: This feature is only available as a part of the Identity Engine. Contact support mailto:dev-inquiries@okta.com for further information.
+-  A profile enrollment
+-  policy https://developer.okta.com/docs/reference/api/policy/#profile-enrollment-policy
+-  is limited to one default rule. This resource does not create a rule for an
+-  enrollment policy, it allows the default policy rule to be updated.
+----
+-
+-# Resource: okta_policy_rule_profile_enrollment
+-
+-Creates a Profile Enrollment Policy Rule.
+-		
+-~> **WARNING:** This feature is only available as a part of the Identity Engine. [Contact support](mailto:dev-inquiries@okta.com) for further information.
+-A [profile enrollment
+-policy](https://developer.okta.com/docs/reference/api/policy/#profile-enrollment-policy)
+-is limited to one default rule. This resource does not create a rule for an
+-enrollment policy, it allows the default policy rule to be updated.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_policy_profile_enrollment" "example" {
+-  name = "My Enrollment Policy"
+-}
+-
+-resource "okta_inline_hook" "example" {
+-  name    = "My Inline Hook"
+-  status  = "ACTIVE"
+-  type    = "com.okta.user.pre-registration"
+-  version = "1.0.3"
+-
+-  channel = {
+-    type    = "HTTP"
+-    version = "1.0.0"
+-    uri     = "https://example.com/test2"
+-    method  = "POST"
+-  }
+-}
+-
+-resource "okta_group" "example" {
+-  name        = "My Group"
+-  description = "Group of some users"
+-}
+-
+-resource "okta_policy_rule_profile_enrollment" "example" {
+-  policy_id           = okta_policy_profile_enrollment.example.id
+-  inline_hook_id      = okta_inline_hook.example.id
+-  target_group_id     = okta_group.example.id
+-  unknown_user_action = "REGISTER"
+-  email_verification  = true
+-  access              = "ALLOW"
+-  profile_attributes {
+-    name     = "email"
+-    label    = "Email"
+-    required = true
+-  }
+-  profile_attributes {
+-    name     = "name"
+-    label    = "Name"
+-    required = true
+-  }
+-  profile_attributes {
+-    name     = "t-shirt"
+-    label    = "T-Shirt Size"
+-    required = false
+-  }
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `policy_id` (String) ID of the policy
+-- `unknown_user_action` (String) Which action should be taken if this User is new. Valid values are: `DENY`, `REGISTER`
+-
+-### Optional
+-
+-- `access` (String) Allow or deny access based on the rule conditions. Valid values are: `ALLOW`, `DENY`. Default: `ALLOW`.
+-- `email_verification` (Boolean) Indicates whether email verification should occur before access is granted. Default: `true`.
+-- `inline_hook_id` (String) ID of a Registration Inline Hook
+-- `profile_attributes` (Block List) A list of attributes to prompt the user during registration or progressive profiling. Where defined on the User schema, these attributes are persisted in the User profile. Non-schema attributes may also be added, which aren't persisted to the User's profile, but are included in requests to the registration inline hook. A maximum of 10 Profile properties is supported.
+-	- 'label' - (Required) A display-friendly label for this property
+-	- 'name' - (Required) The name of a User Profile property
+-	- 'required' - (Required) Indicates if this property is required for enrollment. Default is 'false'. (see [below for nested schema](#nestedblock--profile_attributes))
+-- `progressive_profiling_action` (String) Enabled or disabled progressive profiling action rule conditions: `ENABLED` or `DISABLED`. Default: `DISABLED`
+-- `target_group_id` (String) The ID of a Group that this User should be added to
+-- `ui_schema_id` (String) Value created by the backend. If present all policy updates must include this attribute/value.
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-- `name` (String) Name of the rule
+-- `status` (String) Status of the rule
+-
+-<a id="nestedblock--profile_attributes"></a>
+-### Nested Schema for `profile_attributes`
+-
+-Required:
+-
+-- `label` (String) A display-friendly label for this property
+-- `name` (String) The name of a User Profile property
+-
+-Optional:
+-
+-- `required` (Boolean) Indicates if this property is required for enrollment
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_policy_rule_profile_enrollment.example &#60;policy id&#62;/&#60;rule id&#62;
+-```
+diff --git a/docs/resources/policy_rule_signon.md b/docs/resources/policy_rule_signon.md
+deleted file mode 100644
+index 0d19cbf7..00000000
+--- a/docs/resources/policy_rule_signon.md
++++ /dev/null
+@@ -1,156 +0,0 @@
+----
+-page_title: "Resource: okta_policy_rule_signon"
+-description: |-
+-  Creates a Sign On Policy Rule. In case Invalid condition type specified: riskScore. error is thrown, set risc_level to an empty string, since this feature is not enabled.
+----
+-
+-# Resource: okta_policy_rule_signon
+-
+-Creates a Sign On Policy Rule. In case `Invalid condition type specified: riskScore.` error is thrown, set `risc_level` to an empty string, since this feature is not enabled.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_policy_signon" "test" {
+-  name        = "Example Policy"
+-  status      = "ACTIVE"
+-  description = "Example Policy"
+-}
+-
+-data "okta_behavior" "new_city" {
+-  name = "New City"
+-}
+-
+-resource "okta_policy_rule_signon" "example" {
+-  access             = "CHALLENGE"
+-  authtype           = "RADIUS"
+-  name               = "Example Policy Rule"
+-  network_connection = "ANYWHERE"
+-  policy_id          = okta_policy_signon.example.id
+-  status             = "ACTIVE"
+-  risc_level         = "HIGH"
+-  behaviors          = [data.okta_behavior.new_city.id]
+-  factor_sequence {
+-    primary_criteria_factor_type = "token:hotp" // TOTP
+-    primary_criteria_provider    = "CUSTOM"
+-    secondary_criteria {
+-      factor_type = "token:software:totp" // Okta Verify
+-      provider    = "OKTA"
+-    }
+-    secondary_criteria { // Okta Verify Push
+-      factor_type = "push"
+-      provider    = "OKTA"
+-    }
+-    secondary_criteria { // Password
+-      factor_type = "password"
+-      provider    = "OKTA"
+-    }
+-    secondary_criteria { // Security Question
+-      factor_type = "question"
+-      provider    = "OKTA"
+-    }
+-    secondary_criteria { // SMS
+-      factor_type = "sms"
+-      provider    = "OKTA"
+-    }
+-    secondary_criteria { // Google Auth
+-      factor_type = "token:software:totp"
+-      provider    = "GOOGLE"
+-    }
+-    secondary_criteria { // Email
+-      factor_type = "email"
+-      provider    = "OKTA"
+-    }
+-    secondary_criteria { // Voice Call
+-      factor_type = "call"
+-      provider    = "OKTA"
+-    }
+-    secondary_criteria { // FIDO2 (WebAuthn)
+-      factor_type = "webauthn"
+-      provider    = "FIDO"
+-    }
+-    secondary_criteria { // RSA
+-      factor_type = "token"
+-      provider    = "RSA"
+-    }
+-    secondary_criteria { // Symantec VIP
+-      factor_type = "token"
+-      provider    = "SYMANTEC"
+-    }
+-  }
+-  factor_sequence {
+-    primary_criteria_factor_type = "token:software:totp" // Okta Verify
+-    primary_criteria_provider    = "OKTA"
+-  }
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `name` (String) Policy Rule Name
+-
+-### Optional
+-
+-- `access` (String) Allow or deny access based on the rule conditions: `ALLOW`, `DENY` or `CHALLENGE`. Default: `ALLOW`
+-- `authtype` (String) Authentication entrypoint: `ANY`, `RADIUS` or `LDAP_INTERFACE`. Default: `ANY`
+-- `behaviors` (Set of String) List of behavior IDs
+-- `factor_sequence` (Block List) Auth factor sequences. Should be set if 'access = "CHALLENGE"'.
+-	- 'primary_criteria_provider' - (Required) Primary provider of the auth section.
+-	- 'primary_criteria_factor_type' - (Required) Primary factor type of the auth section.
+-	- 'secondary_criteria' - (Optional) Additional authentication steps.
+-	- 'provider' - (Required) Provider of the additional authentication step.
+-	- 'factor_type' - (Required) Factor type of the additional authentication step. (see [below for nested schema](#nestedblock--factor_sequence))
+-- `identity_provider` (String) Apply rule based on the IdP used: `ANY`, `OKTA` or `SPECIFIC_IDP`. Default: `ANY`. ~> **WARNING**: Use of `identity_provider` requires a feature flag to be enabled.
+-- `identity_provider_ids` (List of String) When identity_provider is `SPECIFIC_IDP` then this is the list of IdP IDs to apply the rule on
+-- `mfa_lifetime` (Number) Elapsed time before the next MFA challenge
+-- `mfa_prompt` (String) Prompt for MFA based on the device used, a factor session lifetime, or every sign-on attempt: `DEVICE`, `SESSION` or`ALWAYS`.
+-- `mfa_remember_device` (Boolean) Remember MFA device. Default: `false`
+-- `mfa_required` (Boolean) Require MFA. Default: `false`
+-- `network_connection` (String) Network selection mode: `ANYWHERE`, `ZONE`, `ON_NETWORK`, or `OFF_NETWORK`. Default: `ANYWHERE`
+-- `network_excludes` (List of String) Required if `network_connection` = `ZONE`. Indicates the network zones to exclude.
+-- `network_includes` (List of String) Required if `network_connection` = `ZONE`. Indicates the network zones to include.
+-- `policy_id` (String) Policy ID of the Rule
+-- `primary_factor` (String) Rule's primary factor. **WARNING** Ony works as a part of the Identity Engine. Valid values: `PASSWORD_IDP_ANY_FACTOR`, `PASSWORD_IDP`.
+-- `priority` (Number) Rule priority. This attribute can be set to a valid priority. To avoid an endless diff situation an error is thrown if an invalid property is provided. The Okta API defaults to the last (lowest) if not provided.
+-- `risc_level` (String, Deprecated) Risc level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
+-- `risk_level` (String) Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
+-- `session_idle` (Number) Max minutes a session can be idle. Default: `120`
+-- `session_lifetime` (Number) Max minutes a session is active: Disable = 0. Default: `120`
+-- `session_persistent` (Boolean) Whether session cookies will last across browser sessions. Okta Administrators can never have persistent session cookies. Default: `false`
+-- `status` (String) Policy Rule Status: `ACTIVE` or `INACTIVE`. Default: `ACTIVE`
+-- `users_excluded` (Set of String) Set of User IDs to Exclude
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-<a id="nestedblock--factor_sequence"></a>
+-### Nested Schema for `factor_sequence`
+-
+-Required:
+-
+-- `primary_criteria_factor_type` (String) Type of a Factor
+-- `primary_criteria_provider` (String) Factor provider
+-
+-Optional:
+-
+-- `secondary_criteria` (Block List) (see [below for nested schema](#nestedblock--factor_sequence--secondary_criteria))
+-
+-<a id="nestedblock--factor_sequence--secondary_criteria"></a>
+-### Nested Schema for `factor_sequence.secondary_criteria`
+-
+-Required:
+-
+-- `factor_type` (String) Type of a Factor
+-- `provider` (String) Factor provider
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_policy_rule_signon.example &#60;policy id&#62;/&#60;rule id&#62;
+-```
+diff --git a/docs/resources/policy_signon.md b/docs/resources/policy_signon.md
+deleted file mode 100644
+index 58d6116d..00000000
+--- a/docs/resources/policy_signon.md
++++ /dev/null
+@@ -1,46 +0,0 @@
+----
+-page_title: "Resource: okta_policy_signon"
+-description: |-
+-  Creates a Sign On Policy. This resource allows you to create and configure a Sign On Policy.
+----
+-
+-# Resource: okta_policy_signon
+-
+-Creates a Sign On Policy. This resource allows you to create and configure a Sign On Policy.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_policy_signon" "example" {
+-  name            = "example"
+-  status          = "ACTIVE"
+-  description     = "Example"
+-  groups_included = ["${data.okta_group.everyone.id}"]
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `name` (String) Policy Name
+-
+-### Optional
+-
+-- `description` (String) Policy Description
+-- `groups_included` (Set of String) List of Group IDs to Include
+-- `priority` (Number) Policy Priority, this attribute can be set to a valid priority. To avoid endless diff situation we error if an invalid priority is provided. API defaults it to the last (lowest) if not there.
+-- `status` (String) Policy Status: `ACTIVE` or `INACTIVE`. Default: `ACTIVE`
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_policy_signon.example &#60;policy id&#62;
+-```
+diff --git a/docs/resources/preview_signin_page.md b/docs/resources/preview_signin_page.md
+deleted file mode 100644
+index 1e85f7c9..00000000
+--- a/docs/resources/preview_signin_page.md
++++ /dev/null
+@@ -1,92 +0,0 @@
+----
+-page_title: "Resource: okta_preview_signin_page"
+-description: |-
+-  Manage the preview signin page of a brand
+----
+-
+-# Resource: okta_preview_signin_page
+-
+-Manage the preview signin page of a brand
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_brand" "test" {
+-  name   = "testBrand"
+-  locale = "en"
+-}
+-
+-resource "okta_preview_signin_page" "test" {
+-  brand_id       = resource.okta_brand.test.id
+-  page_content   = "<!DOCTYPE html PUBLIC \"-//W3C//DTD HTML 4.01//EN\" \"http://www.w3.org/TR/html4/strict.dtd\">\n<html>\n<head>\n    <meta http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-8\">\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />\n    <meta name=\"robots\" content=\"noindex,nofollow\" />\n    <!-- Styles generated from theme -->\n    <link href=\"{{themedStylesUrl}}\" rel=\"stylesheet\" type=\"text/css\">\n    <!-- Favicon from theme -->\n    <link rel=\"shortcut icon\" href=\"{{faviconUrl}}\" type=\"image/x-icon\"/>\n\n    <title>{{pageTitle}}</title>\n    {{{SignInWidgetResources}}}\n\n    <style nonce=\"{{nonceValue}}\">\n        #login-bg-image-id {\n            background-image: {{bgImageUrl}}\n        }\n    </style>\n</head>\n<body>\n    <div id=\"login-bg-image-id\" class=\"login-bg-image tb--background\"></div>\n    <div id=\"okta-login-container\"></div>\n\n    <!--\n        \"OktaUtil\" defines a global OktaUtil object\n        that contains methods used to complete the Okta login flow.\n     -->\n    {{{OktaUtil}}}\n\n    <script type=\"text/javascript\" nonce=\"{{nonceValue}}\">\n        // \"config\" object contains default widget configuration\n        // with any custom overrides defined in your admin settings.\n        var config = OktaUtil.getSignInWidgetConfig();\n\n        // Render the Okta Sign-In Widget\n        var oktaSignIn = new OktaSignIn(config);\n        oktaSignIn.renderEl({ el: '#okta-login-container' },\n            OktaUtil.completeLogin,\n            function(error) {\n                // Logs errors that occur when configuring the widget.\n                // Remove or replace this with your own custom error handler.\n                console.log(error.message, error);\n            }\n        );\n    </script>\n</body>\n</html>\n"
+-  widget_version = "^6"
+-  widget_customizations {
+-    widget_generation = "G3"
+-  }
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `brand_id` (String) brand id of the preview signin page
+-- `page_content` (String) page content of the preview signin page
+-- `widget_version` (String) widget version specified as a Semver. The following are currently supported
+-			*, ^1, ^2, ^3, ^4, ^5, ^6, ^7, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11, 1.12, 1.13, 2.1, 2.2, 2.3, 2.4, 
+-			2.5, 2.6, 2.7, 2.8, 2.9, 2.10, 2.11, 2.12, 2.13, 2.14, 2.15, 2.16, 2.17, 2.18, 2.19, 2.20, 2.21, 
+-			3.0, 3.1, 3.2, 3.3, 3.4, 3.5, 3.6, 3.7, 3.8, 3.9, 4.0, 4.1, 4.2, 4.3, 4.4, 4.5, 5.0, 5.1, 5.2, 5.3, 
+-			5.4, 5.5, 5.6, 5.7, 5.8, 5.9, 5.10, 5.11, 5.12, 5.13, 5.14, 5.15, 5.16, 6.0, 6.1, 6.2, 6.3, 6.4, 6.5, 
+-			6.6, 6.7, 6.8, 6.9, 7.0, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.7, 7.8, 7.9, 7.10, 7.11, 7.12, 7.13.
+-
+-### Optional
+-
+-- `content_security_policy_setting` (Block, Optional) (see [below for nested schema](#nestedblock--content_security_policy_setting))
+-- `widget_customizations` (Block, Optional) (see [below for nested schema](#nestedblock--widget_customizations))
+-
+-### Read-Only
+-
+-- `id` (String) placeholder id
+-
+-<a id="nestedblock--content_security_policy_setting"></a>
+-### Nested Schema for `content_security_policy_setting`
+-
+-Optional:
+-
+-- `mode` (String) enforced or report_only
+-- `report_uri` (String)
+-- `src_list` (List of String)
+-
+-
+-<a id="nestedblock--widget_customizations"></a>
+-### Nested Schema for `widget_customizations`
+-
+-Required:
+-
+-- `widget_generation` (String)
+-
+-Optional:
+-
+-- `authenticator_page_custom_link_label` (String)
+-- `authenticator_page_custom_link_url` (String)
+-- `classic_recovery_flow_email_or_username_label` (String)
+-- `custom_link_1_label` (String)
+-- `custom_link_1_url` (String)
+-- `custom_link_2_label` (String)
+-- `custom_link_2_url` (String)
+-- `forgot_password_label` (String)
+-- `forgot_password_url` (String)
+-- `help_label` (String)
+-- `help_url` (String)
+-- `password_info_tip` (String)
+-- `password_label` (String)
+-- `show_password_visibility_toggle` (Boolean)
+-- `show_user_identifier` (Boolean)
+-- `sign_in_label` (String)
+-- `unlock_account_label` (String)
+-- `unlock_account_url` (String)
+-- `username_info_tip` (String)
+-- `username_label` (String)
+-
+-
+diff --git a/docs/resources/profile_mapping.md b/docs/resources/profile_mapping.md
+deleted file mode 100644
+index 0a9bd45e..00000000
+--- a/docs/resources/profile_mapping.md
++++ /dev/null
+@@ -1,79 +0,0 @@
+----
+-page_title: "Resource: okta_profile_mapping"
+-description: |-
+-  Manages a profile mapping. This resource allows you to manage a profile mapping by source and target IDs. -> NOTE: If using this resource with OAuth2 scopes, this resource requires okta.profileMappings.manage scope.
+----
+-
+-# Resource: okta_profile_mapping
+-
+-Manages a profile mapping. This resource allows you to manage a profile mapping by source and target IDs. -> **NOTE:** If using this resource with OAuth2 scopes, this resource requires `okta.profileMappings.manage` scope.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_user_profile_mapping_source" "user" {}
+-
+-resource "okta_profile_mapping" "example" {
+-  source_id          = "<source id>"
+-  target_id          = data.okta_user_profile_mapping_source.user.id
+-  delete_when_absent = true
+-
+-  mappings {
+-    id         = "firstName"
+-    expression = "appuser.firstName"
+-  }
+-
+-  mappings {
+-    id         = "lastName"
+-    expression = "appuser.lastName"
+-  }
+-
+-  mappings {
+-    id         = "email"
+-    expression = "appuser.email"
+-  }
+-
+-  mappings {
+-    id         = "login"
+-    expression = "appuser.email"
+-  }
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `source_id` (String) The source id of the mapping to manage.
+-- `target_id` (String) The target id of the mapping to manage.
+-
+-### Optional
+-
+-- `always_apply` (Boolean) Whether apply the changes to all users with this profile after updating or creating the these mappings. 
+-	~> **WARNING:**: 'always_apply' is incompatible with OAuth 2.0 authentication and will be ignored when using that type of authentication.
+-	~> **WARNING:** 'always_apply' makes use of an internal/private Okta API endpoint that could change without notice rendering this resource inoperable.
+-- `delete_when_absent` (Boolean) When turned on this flag will trigger the provider to delete mapping properties that are not defined in config. By default, we do not delete missing properties.
+-- `mappings` (Block Set) (see [below for nested schema](#nestedblock--mappings))
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-- `source_name` (String) Name of the mapping source.
+-- `source_type` (String) ID of the mapping source.
+-- `target_name` (String) Name of the mapping target.
+-- `target_type` (String) ID of the mapping target.
+-
+-<a id="nestedblock--mappings"></a>
+-### Nested Schema for `mappings`
+-
+-Required:
+-
+-- `expression` (String)
+-- `id` (String) The mapping property key.
+-
+-Optional:
+-
+-- `push_status` (String)
+-
+-
+diff --git a/docs/resources/rate_limiting.md b/docs/resources/rate_limiting.md
+deleted file mode 100644
+index 010936e0..00000000
+--- a/docs/resources/rate_limiting.md
++++ /dev/null
+@@ -1,49 +0,0 @@
+----
+-page_title: "Resource: okta_rate_limiting"
+-description: |-
+-  Manages rate limiting.
+-  This resource allows you to configure the client-based rate limit and rate limiting communications settings.
+-  ~> WARNING: This resource is available only when using a SSWS API token in the provider config, it is incompatible with OAuth 2.0 authentication.
+-  ~> WARNING: This resource makes use of an internal/private Okta API endpoint that could change without notice rendering this resource inoperable.
+----
+-
+-# Resource: okta_rate_limiting
+-
+-Manages rate limiting.
+-This resource allows you to configure the client-based rate limit and rate limiting communications settings.
+-~> **WARNING:** This resource is available only when using a SSWS API token in the provider config, it is incompatible with OAuth 2.0 authentication.
+-~> **WARNING:** This resource makes use of an internal/private Okta API endpoint that could change without notice rendering this resource inoperable.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_rate_limiting" "example" {
+-  login                  = "ENFORCE"
+-  authorize              = "ENFORCE"
+-  communications_enabled = true
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `authorize` (String) Called during authentication. Valid values: `ENFORCE` _(Enforce limit and log per client (recommended))_, `DISABLE` _(Do nothing (not recommended))_, `PREVIEW` _(Log per client)_.
+-- `login` (String) Called when accessing the Okta hosted login page. Valid values: `ENFORCE` _(Enforce limit and log per client (recommended))_, `DISABLE` _(Do nothing (not recommended))_, `PREVIEW` _(Log per client)_.
+-
+-### Optional
+-
+-- `communications_enabled` (Boolean) Enable or disable rate limiting communications. By default, it is `true`.
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_rate_limiting.example .
+-```
+diff --git a/docs/resources/resource_set.md b/docs/resources/resource_set.md
+deleted file mode 100644
+index d6826d8b..00000000
+--- a/docs/resources/resource_set.md
++++ /dev/null
+@@ -1,67 +0,0 @@
+----
+-page_title: "Resource: okta_resource_set"
+-description: |-
+-  Manages Resource Sets as custom collections of resources. This resource allows the creation and manipulation of Okta Resource Sets as custom collections of Okta resources. You can use Okta Resource Sets to assign Custom Roles to administrators who are scoped to the designated resources.
+-  The 'resources' field supports the following:
+-      - Apps
+-      - Groups
+-      - All Users within a Group
+-      - All Users within the org
+-      - All Groups within the org
+-      - All Apps within the org
+-      - All Apps of the same type
+----
+-
+-# Resource: okta_resource_set
+-
+-Manages Resource Sets as custom collections of resources. This resource allows the creation and manipulation of Okta Resource Sets as custom collections of Okta resources. You can use Okta Resource Sets to assign Custom Roles to administrators who are scoped to the designated resources. 
+-The 'resources' field supports the following:
+-	- Apps
+-	- Groups
+-	- All Users within a Group
+-	- All Users within the org
+-	- All Groups within the org
+-	- All Apps within the org
+-	- All Apps of the same type
+-
+-## Example Usage
+-
+-```terraform
+-locals {
+-  org_url = "https://mycompany.okta.com"
+-}
+-
+-resource "okta_resource_set" "test" {
+-  label       = "UsersAppsAndGroups"
+-  description = "All the users, app and groups"
+-  resources = [
+-    format("%s/api/v1/users", local.org_url),
+-    format("%s/api/v1/apps", local.org_url),
+-    format("%s/api/v1/groups", local.org_url)
+-  ]
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `description` (String) A description of the Resource Set
+-- `label` (String) Unique name given to the Resource Set
+-
+-### Optional
+-
+-- `resources` (Set of String) The endpoints that reference the resources to be included in the new Resource Set. At least one endpoint must be specified when creating resource set.
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_resource_set.example &#60;resource_set_id&#62;
+-```
+diff --git a/docs/resources/role_subscription.md b/docs/resources/role_subscription.md
+deleted file mode 100644
+index 88bc4d36..00000000
+--- a/docs/resources/role_subscription.md
++++ /dev/null
+@@ -1,75 +0,0 @@
+----
+-page_title: "Resource: okta_role_subscription"
+-description: |-
+-  Manages group subscription.
+-  This resource allows you to configure subscriptions of a Role with a specific type.
+-  Check configure email notifications https://help.okta.com/oie/en-us/Content/Topics/Security/custom-admin-role/administrator-email-settings.htm
+-  page regarding what notifications are available for specific admin roles.
+----
+-
+-# Resource: okta_role_subscription
+-
+-Manages group subscription.
+-		
+-This resource allows you to configure subscriptions of a Role with a specific type. 
+-Check [configure email notifications](https://help.okta.com/oie/en-us/Content/Topics/Security/custom-admin-role/administrator-email-settings.htm) 
+-page regarding what notifications are available for specific admin roles.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_role_subscription" "test" {
+-  role_type         = "SUPER_ADMIN"
+-  notification_type = "APP_IMPORT"
+-  status            = "unsubscribed"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `notification_type` (String) Type of the notification. Valid values: 
+-	- 'CONNECTOR_AGENT' -  Disconnects and reconnects: On-prem provisioning, on-prem MFA agents, and RADIUS server agent.
+-	- 'USER_LOCKED_OUT' - User lockouts.
+-	- 'APP_IMPORT' - App user import status.
+-	- 'LDAP_AGENT' - Disconnects and reconnects: LDAP agent.
+-	- 'AD_AGENT' - Disconnects and reconnects: AD agent.
+-	- 'OKTA_ANNOUNCEMENT' - Okta release notes and announcements.
+-	- 'OKTA_ISSUE' - Trust incidents and updates.
+-	- 'OKTA_UPDATE' - Scheduled system updates.
+-	- 'IWA_AGENT' - Disconnects and reconnects: IWA agent.
+-	- 'USER_DEPROVISION' - User deprovisions.
+-	- 'REPORT_SUSPICIOUS_ACTIVITY' - User reporting of suspicious activity.
+-	- 'RATELIMIT_NOTIFICATION' - Rate limit warning and violation.
+-	- 'AGENT_AUTO_UPDATE_NOTIFICATION' - Agent auto-update notifications: AD Agent.
+-- `role_type` (String) Type of the role. Valid values:
+-	'API_ADMIN',
+-	'APP_ADMIN',
+-	'CUSTOM',
+-	'GROUP_MEMBERSHIP_ADMIN',
+-	'HELP_DESK_ADMIN',
+-	'MOBILE_ADMIN',
+-	'ORG_ADMIN',
+-	'READ_ONLY_ADMIN',
+-	'REPORT_ADMIN',
+-	'SUPER_ADMIN',
+-	'USER_ADMIN'
+-	. See [API docs](https://developer.okta.com/docs/reference/api/admin-notifications/#role-types).
+-
+-### Optional
+-
+-- `status` (String) Subscription status. Valid values: `subscribed`, `unsubscribed`.
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_role_subscription.example &#60;role_type&#62;/&#60;notification_type&#62;
+-```
+diff --git a/docs/resources/security_notification_emails.md b/docs/resources/security_notification_emails.md
+deleted file mode 100644
+index e874bb0e..00000000
+--- a/docs/resources/security_notification_emails.md
++++ /dev/null
+@@ -1,50 +0,0 @@
+----
+-page_title: "Resource: okta_security_notification_emails"
+-description: |-
+-  Manages Security Notification Emails
+-          This resource allows you to configure Security Notification Emails.
+-          ~> WARNING: This resource is available only when using a SSWS API token in the provider config, it is incompatible with OAuth 2.0 authentication.
+-          ~> WARNING: This resource makes use of an internal/private Okta API endpoint that could change without notice rendering this resource inoperable.
+----
+-
+-# Resource: okta_security_notification_emails
+-
+-Manages Security Notification Emails
+-		This resource allows you to configure Security Notification Emails.
+-		~> **WARNING:** This resource is available only when using a SSWS API token in the provider config, it is incompatible with OAuth 2.0 authentication.
+-		~> **WARNING:** This resource makes use of an internal/private Okta API endpoint that could change without notice rendering this resource inoperable.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_security_notification_emails" "example" {
+-  report_suspicious_activity_enabled       = true
+-  send_email_for_factor_enrollment_enabled = true
+-  send_email_for_factor_reset_enabled      = true
+-  send_email_for_new_device_enabled        = true
+-  send_email_for_password_changed_enabled  = true
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Optional
+-
+-- `report_suspicious_activity_enabled` (Boolean) Notifies end users about suspicious or unrecognized activity from their account. Default is `true`.
+-- `send_email_for_factor_enrollment_enabled` (Boolean) Notifies end users of any activity on their account related to MFA factor enrollment. Default is `true`.
+-- `send_email_for_factor_reset_enabled` (Boolean) Notifies end users that one or more factors have been reset for their account. Default is `true`.
+-- `send_email_for_new_device_enabled` (Boolean) Notifies end users about new sign-on activity. Default is `true`.
+-- `send_email_for_password_changed_enabled` (Boolean) Notifies end users that the password for their account has changed. Default is `true`.
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_security_notification_emails.example _
+-```
+diff --git a/docs/resources/template_sms.md b/docs/resources/template_sms.md
+deleted file mode 100644
+index 2f0284e6..00000000
+--- a/docs/resources/template_sms.md
++++ /dev/null
+@@ -1,59 +0,0 @@
+----
+-page_title: "Resource: okta_template_sms"
+-description: |-
+-  Creates an Okta SMS Template. This resource allows you to create and configure an Okta SMS Template.
+----
+-
+-# Resource: okta_template_sms
+-
+-Creates an Okta SMS Template. This resource allows you to create and configure an Okta SMS Template.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_template_sms" "example" {
+-  type     = "SMS_VERIFY_CODE"
+-  template = "Your $${org.name} code is: $${code}"
+-  translations {
+-    language = "en"
+-    template = "Your $${org.name} code is: $${code}"
+-  }
+-
+-  translations {
+-    language = "es"
+-    template = "Tu código de $${org.name} es: $${code}."
+-  }
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `template` (String) SMS default template
+-- `type` (String) SMS template type
+-
+-### Optional
+-
+-- `translations` (Block Set) Set of translations for a particular template. (see [below for nested schema](#nestedblock--translations))
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-<a id="nestedblock--translations"></a>
+-### Nested Schema for `translations`
+-
+-Required:
+-
+-- `language` (String) The language to map the template to.
+-- `template` (String) The SMS message.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_template_sms.example &#60;template type&#62;
+-```
+diff --git a/docs/resources/theme.md b/docs/resources/theme.md
+deleted file mode 100644
+index 079dfec2..00000000
+--- a/docs/resources/theme.md
++++ /dev/null
+@@ -1,92 +0,0 @@
+----
+-page_title: "Resource: okta_theme"
+-description: |-
+-  Gets, updates, a single Theme of a Brand of an Okta Organization.
+----
+-
+-# Resource: okta_theme
+-
+-Gets, updates, a single Theme of a Brand of an Okta Organization.
+-
+-This resource allows you to get and update an Okta
+-[Theme](https://developer.okta.com/docs/reference/api/brands/#theme-object).
+-
+-The Okta Management API does not have a true Create or Delete for a theme. Therefore, the theme resource must be imported
+-first into the terraform state before updates can be applied to the theme.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_brands" "test" {
+-}
+-
+-# resource has been imported into current state:
+-# $ terraform import okta_theme.example <theme id>
+-resource "okta_theme" "example" {
+-  brand_id                               = tolist(data.okta_brands.test.brands)[0].id
+-  logo                                   = "path/to/logo.png"
+-  favicon                                = "path/to/favicon.png"
+-  background_image                       = "path/to/background.png"
+-  primary_color_hex                      = "#1662dd"
+-  secondary_color_hex                    = "#ebebed"
+-  sign_in_page_touch_point_variant       = "OKTA_DEFAULT"
+-  end_user_dashboard_touch_point_variant = "OKTA_DEFAULT"
+-  error_page_touch_point_variant         = "OKTA_DEFAULT"
+-  email_template_touch_point_variant     = "OKTA_DEFAULT"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `brand_id` (String) Brand ID
+-
+-### Optional
+-
+-- `background_image` (String) Path to local file
+-- `email_template_touch_point_variant` (String) Variant for email templates (`OKTA_DEFAULT`, `FULL_THEME`)
+-- `end_user_dashboard_touch_point_variant` (String) Variant for the Okta End-User Dashboard (`OKTA_DEFAULT`, `WHITE_LOGO_BACKGROUND`, `FULL_THEME`, `LOGO_ON_FULL_WHITE_BACKGROUND`)
+-- `error_page_touch_point_variant` (String) Variant for the error page (`OKTA_DEFAULT`, `BACKGROUND_SECONDARY_COLOR`, `BACKGROUND_IMAGE`)
+-- `favicon` (String) Path to local file
+-- `logo` (String) Path to local file
+-- `primary_color_contrast_hex` (String) Primary color contrast hex code
+-- `primary_color_hex` (String) Primary color hex code
+-- `secondary_color_contrast_hex` (String) Secondary color contrast hex code
+-- `secondary_color_hex` (String) Secondary color hex code
+-- `sign_in_page_touch_point_variant` (String) Variant for the Okta Sign-In Page (`OKTA_DEFAULT`, `BACKGROUND_SECONDARY_COLOR`, `BACKGROUND_IMAGE`)
+-- `theme_id` (String) Theme ID - Note: Okta API for theme only reads and updates therefore the okta_theme resource needs to act as a quasi data source. Do this by setting theme_id.
+-
+-### Read-Only
+-
+-- `background_image_url` (String) Background image URL
+-- `favicon_url` (String) Favicon URL
+-- `id` (String) Brand ID
+-- `links` (String) Link relations for this object - JSON HAL - Discoverable resources related to the email template
+-- `logo_url` (String) Logo URL
+-
+-[Variants for the Okta Sign-In Page](https://developer.okta.com/docs/reference/api/brands/#variants-for-the-okta-sign-in-page):
+-
+-| Enum Value  |  Description  |
+-| ----------- | ------------- |
+-| OKTA_DEFAULT | Use the Okta logo, Okta favicon with no background image, and the Okta colors on the Okta Sign-In Page. |
+-| BACKGROUND_SECONDARY_COLOR | Use the logo and favicon from Theme with the secondaryColorHex as the background color for the Okta Sign-In Page. |
+-| BACKGROUND_IMAGE | Use the logo, favicon, and background image from Theme. |
+-
+-[Variants for the Okta End-User Dashboard](https://developer.okta.com/docs/reference/api/brands/#variants-for-the-okta-end-user-dashboard):
+-
+-| Enum Value  | Description   |
+-| ----------- | ------------- |
+-| OKTA_DEFAULT | Use the Okta logo and Okta favicon with a white background color for the logo and the side navigation bar background color. |
+-| WHITE_LOGO_BACKGROUND | Use the logo from Theme with a white background color for the logo, use favicon from Theme, and use primaryColorHex for the side navigation bar background color. |
+-| FULL_THEME | Use the logo from Theme, primaryColorHex for the logo and the side navigation bar background color, and use favicon from Theme |
+-| LOGO_ON_FULL_WHITE_BACKGROUND | Use the logo from Theme, white background color for the logo and the side navigation bar background color, and use favicon from Theme |
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_theme.example &#60;brand id&#62;/&#60;theme id&#62;
+-```
+\ No newline at end of file
+diff --git a/docs/resources/threat_insight_settings.md b/docs/resources/threat_insight_settings.md
+deleted file mode 100644
+index 7d15cc6a..00000000
+--- a/docs/resources/threat_insight_settings.md
++++ /dev/null
+@@ -1,48 +0,0 @@
+----
+-page_title: "Resource: okta_threat_insight_settings"
+-description: |-
+-  Manages Okta Threat Insight Settings. This resource allows you to configure Threat Insight Settings.
+----
+-
+-# Resource: okta_threat_insight_settings
+-
+-Manages Okta Threat Insight Settings. This resource allows you to configure Threat Insight Settings.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_network_zone" "ip_network_zone_example" {
+-  name     = "example"
+-  type     = "IP"
+-  gateways = ["1.2.3.4/24", "2.3.4.5-2.3.4.15"]
+-  proxies  = ["2.2.3.4/24", "3.3.4.5-3.3.4.15"]
+-}
+-
+-resource "okta_threat_insight_settings" "example" {
+-  action           = "block"
+-  network_excludes = [okta_network_zone.ip_network_zone_example.id]
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `action` (String) Specifies how Okta responds to authentication requests from suspicious IPs. Valid values are `none`, `audit`, or `block`. A value of `none` indicates that ThreatInsight is disabled. A value of `audit` indicates that Okta logs suspicious requests in the System Log. A value of `block` indicates that Okta logs suspicious requests in the System Log and blocks the requests.
+-
+-### Optional
+-
+-- `network_excludes` (List of String) Accepts a list of Network Zone IDs. Can only accept zones of `IP` type. IPs in the excluded Network Zones aren't logged or blocked by Okta ThreatInsight and proceed to Sign On rules evaluation. This ensures that traffic from known, trusted IPs isn't accidentally logged or blocked. The ordering of the network zone is not guarantee from the API sides
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_threat_insight_settings.example _
+-```
+diff --git a/docs/resources/trusted_origin.md b/docs/resources/trusted_origin.md
+deleted file mode 100644
+index d388981e..00000000
+--- a/docs/resources/trusted_origin.md
++++ /dev/null
+@@ -1,44 +0,0 @@
+----
+-page_title: "Resource: okta_trusted_origin"
+-description: |-
+-  Creates a Trusted Origin. This resource allows you to create and configure a Trusted Origin.
+----
+-
+-# Resource: okta_trusted_origin
+-
+-Creates a Trusted Origin. This resource allows you to create and configure a Trusted Origin.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_trusted_origin" "example" {
+-  name   = "example"
+-  origin = "https://example.com"
+-  scopes = ["CORS"]
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `name` (String) Unique name for this trusted origin
+-- `origin` (String) Unique origin URL for this trusted origin
+-- `scopes` (List of String) Scopes of the Trusted Origin - can either be `CORS` and/or `REDIRECT`
+-
+-### Optional
+-
+-- `active` (Boolean) Whether the Trusted Origin is active or not - can only be issued post-creation. By default, it is `true`.
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_trusted_origin.example &#60;trusted origin id&#62;
+-```
+diff --git a/docs/resources/user.md b/docs/resources/user.md
+deleted file mode 100644
+index 68077d00..00000000
+--- a/docs/resources/user.md
++++ /dev/null
+@@ -1,135 +0,0 @@
+----
+-page_title: "Resource: okta_user"
+-description: |-
+-  Creates an Okta User. This resource allows you to create and configure an Okta User.
+----
+-
+-# Resource: okta_user
+-
+-Creates an Okta User. This resource allows you to create and configure an Okta User.
+-
+-## Example Usage
+-
+-```terraform
+-### Full profile:
+-resource "okta_user" "example" {
+-  first_name         = "John"
+-  last_name          = "Smith"
+-  login              = "john.smith@example.com"
+-  email              = "john.smith@example.com"
+-  city               = "New York"
+-  cost_center        = "10"
+-  country_code       = "US"
+-  department         = "IT"
+-  display_name       = "Dr. John Smith"
+-  division           = "Acquisitions"
+-  employee_number    = "111111"
+-  honorific_prefix   = "Dr."
+-  honorific_suffix   = "Jr."
+-  locale             = "en_US"
+-  manager            = "Jimbo"
+-  manager_id         = "222222"
+-  middle_name        = "John"
+-  mobile_phone       = "1112223333"
+-  nick_name          = "Johnny"
+-  organization       = "Testing Inc."
+-  postal_address     = "1234 Testing St."
+-  preferred_language = "en-us"
+-  primary_phone      = "4445556666"
+-  profile_url        = "https://www.example.com/profile"
+-  second_email       = "john.smith.fun@example.com"
+-  state              = "NY"
+-  street_address     = "5678 Testing Ave."
+-  timezone           = "America/New_York"
+-  title              = "Director"
+-  user_type          = "Employee"
+-  zip_code           = "11111"
+-}
+-
+-### With Password Inline Hook:
+-resource "okta_user" "test2" {
+-  first_name           = "John"
+-  last_name            = "Smith"
+-  login                = "example@example.com"
+-  email                = "example@example.com"
+-  password_inline_hook = "default"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `email` (String) User primary email address
+-- `first_name` (String) User first name
+-- `last_name` (String) User last name
+-- `login` (String) User Okta login
+-
+-### Optional
+-
+-- `city` (String) User city
+-- `cost_center` (String) User cost center
+-- `country_code` (String) User country code
+-- `custom_profile_attributes` (String) JSON formatted custom attributes for a user. It must be JSON due to various types Okta allows.
+-- `custom_profile_attributes_to_ignore` (Set of String) List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in situations where specific custom fields may contain sensitive information and should be managed outside of Terraform.
+-- `department` (String) User department
+-- `display_name` (String) User display name, suitable to show end users
+-- `division` (String) User division
+-- `employee_number` (String) User employee number
+-- `expire_password_on_create` (Boolean) If set to `true`, the user will have to change the password at the next login. This property will be used when user is being created and works only when `password` field is set. Default: `false`
+-- `honorific_prefix` (String) User honorific prefix
+-- `honorific_suffix` (String) User honorific suffix
+-- `locale` (String) User default location
+-- `manager` (String) Manager of User
+-- `manager_id` (String) Manager ID of User
+-- `middle_name` (String) User middle name
+-- `mobile_phone` (String) User mobile phone number
+-- `nick_name` (String) User nickname
+-- `old_password` (String, Sensitive) Old User Password. Should be only set in case the password was not changed using the provider. fter successful password change this field should be removed and `password` field should be used for further changes.
+-- `organization` (String) User organization
+-- `password` (String, Sensitive) User Password
+-- `password_hash` (Block Set, Max: 1) Specifies a hashed password to import into Okta. (see [below for nested schema](#nestedblock--password_hash))
+-- `password_inline_hook` (String) Specifies that a Password Import Inline Hook should be triggered to handle verification of the user's password the first time the user logs in. This allows an existing password to be imported into Okta directly from some other store. When updating a user with a password hook the user must be in the `STAGED` status. The `password` field should not be specified when using Password Import Inline Hook.
+-- `postal_address` (String) User mailing address
+-- `preferred_language` (String) User preferred language
+-- `primary_phone` (String) User primary phone number
+-- `profile_url` (String) User online profile (web page)
+-- `recovery_answer` (String, Sensitive) User Password Recovery Answer
+-- `recovery_question` (String) User Password Recovery Question
+-- `second_email` (String) User secondary email address, used for account recovery
+-- `skip_roles` (Boolean, Deprecated) Do not populate user roles information (prevents additional API call)
+-- `state` (String) User state or region
+-- `status` (String) User profile property. Valid values are `ACTIVE`, `DEPROVISIONED`, `STAGED`, `SUSPENDED`. Default: `ACTIVE`
+-- `street_address` (String) User street address
+-- `timezone` (String) User default timezone
+-- `title` (String) User title
+-- `user_type` (String) User employee type
+-- `zip_code` (String) User zipcode or postal code
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-- `raw_status` (String) The raw status of the User in Okta - (status is mapped)
+-
+-<a id="nestedblock--password_hash"></a>
+-### Nested Schema for `password_hash`
+-
+-Required:
+-
+-- `algorithm` (String) The algorithm used to generate the hash using the password
+-- `value` (String) For SHA-512, SHA-256, SHA-1, MD5, This is the actual base64-encoded hash of the password (and salt, if used). This is the Base64 encoded value of the SHA-512/SHA-256/SHA-1/MD5 digest that was computed by either pre-fixing or post-fixing the salt to the password, depending on the saltOrder. If a salt was not used in the source system, then this should just be the the Base64 encoded value of the password's SHA-512/SHA-256/SHA-1/MD5 digest. For BCRYPT, This is the actual radix64-encoded hashed password.
+-
+-Optional:
+-
+-- `salt` (String) Only required for salted hashes
+-- `salt_order` (String) Specifies whether salt was pre- or postfixed to the password before hashing
+-- `work_factor` (Number) Governs the strength of the hash and the time required to compute it. Only required for BCRYPT algorithm
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_user.example &#60;user id&#62;
+-```
+diff --git a/docs/resources/user_admin_roles.md b/docs/resources/user_admin_roles.md
+deleted file mode 100644
+index ac4bf37e..00000000
+--- a/docs/resources/user_admin_roles.md
++++ /dev/null
+@@ -1,51 +0,0 @@
+----
+-page_title: "Resource: okta_user_admin_roles"
+-description: |-
+-  Resource to manage a set of administrator roles for a specific user. This resource allows you to manage admin roles for a single user, independent of the user schema itself.
+----
+-
+-# Resource: okta_user_admin_roles
+-
+-Resource to manage a set of administrator roles for a specific user. This resource allows you to manage admin roles for a single user, independent of the user schema itself.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_user" "test" {
+-  first_name = "TestAcc"
+-  last_name  = "Smith"
+-  login      = "testAcc-replace_with_uuid@example.com"
+-  email      = "testAcc-replace_with_uuid@example.com"
+-}
+-
+-resource "okta_user_admin_roles" "test" {
+-  user_id = okta_user.test.id
+-  admin_roles = [
+-    "APP_ADMIN",
+-  ]
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `admin_roles` (Set of String) The list of Okta user admin roles, e.g. `['APP_ADMIN', 'USER_ADMIN']` See [API Docs](https://developer.okta.com/docs/reference/api/roles/#role-types).
+-- `user_id` (String) ID of a Okta User
+-
+-### Optional
+-
+-- `disable_notifications` (Boolean) When this setting is enabled, the admins won't receive any of the default Okta administrator emails. These admins also won't have access to contact Okta Support and open support cases on behalf of your org.
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_user_admin_roles.example &#60;user id&#62;
+-```
+diff --git a/docs/resources/user_base_schema_property.md b/docs/resources/user_base_schema_property.md
+deleted file mode 100644
+index 104b6784..00000000
+--- a/docs/resources/user_base_schema_property.md
++++ /dev/null
+@@ -1,63 +0,0 @@
+----
+-page_title: "Resource: okta_user_base_schema_property"
+-description: |-
+-  Manages a User Base Schema property. This resource allows you to configure a base user schema property.
+----
+-
+-# Resource: okta_user_base_schema_property
+-
+-Manages a User Base Schema property. This resource allows you to configure a base user schema property.
+-
+-## IMPORTANT NOTE: 
+-
+-Based on the [official documentation](https://developer.okta.com/docs/reference/api/schemas/#user-profile-base-subschema)
+-base properties can not be modified, except to update permissions, to change the nullability of `firstName` and 
+-`lastName` (`required` property) or to specify a `pattern` for `login`. Currently, `title` and `type` are required, so
+-they should be set to the current values of the base property. This will be fixed in the future releases, as this is 
+-a breaking change.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_user_base_schema_property" "example" {
+-  index     = "firstName"
+-  title     = "First name"
+-  type      = "string"
+-  required  = true
+-  master    = "OKTA"
+-  user_type = data.okta_user_type.example.id
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `index` (String) Subschema unique string identifier
+-- `title` (String) Subschema title (display name)
+-- `type` (String) The type of the schema property. It can be `string`, `boolean`, `number`, `integer`, `array`, or `object`
+-
+-### Optional
+-
+-- `master` (String) Master priority for the user schema property. It can be set to `PROFILE_MASTER` or `OKTA`. Default: `PROFILE_MASTER`
+-- `pattern` (String) The validation pattern to use for the subschema. Must be in form of '.+', or '[<pattern>]+' if present.'
+-- `permissions` (String) Access control permissions for the property. It can be set to `READ_WRITE`, `READ_ONLY`, `HIDE`. Default: `READ_ONLY`
+-- `required` (Boolean) Whether the subschema is required
+-- `user_type` (String) User type ID. By default, it is `default`
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-### User schema property of default user type can be imported via the property index.
+-terraform import okta_user_base_schema_property.example &#60;property name&#62;
+-
+-### User schema property of custom user type can be imported via user type id and property index
+-terraform import okta_user_base_schema_property.example &#60;user type id&#62;.&#60;property name&#62;
+-```
+\ No newline at end of file
+diff --git a/docs/resources/user_factor_question.md b/docs/resources/user_factor_question.md
+deleted file mode 100644
+index 9533aab5..00000000
+--- a/docs/resources/user_factor_question.md
++++ /dev/null
+@@ -1,60 +0,0 @@
+----
+-page_title: "Resource: okta_user_factor_question"
+-description: |-
+-  Creates security question factor for a user. This resource allows you to create and configure security question factor for a user.
+----
+-
+-# Resource: okta_user_factor_question
+-
+-Creates security question factor for a user. This resource allows you to create and configure security question factor for a user.
+-
+-## Example Usage
+-
+-```terraform
+-data "okta_user_security_questions" "example" {
+-  user_id = okta_user.example.id
+-}
+-
+-resource "okta_user" "example" {
+-  first_name = "John"
+-  last_name  = "Smith"
+-  login      = "john.smith@example.com"
+-  email      = "john.smith@example.com"
+-}
+-
+-resource "okta_factor" "example" {
+-  provider_id = "okta_question"
+-  active      = true
+-}
+-
+-resource "okta_user_factor_question" "example" {
+-  user_id = okta_user.example.id
+-  key     = data.okta_user_security_questions.example.questions[0].key
+-  answer  = "meatball"
+-  depends_on = [
+-  okta_factor.example]
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `answer` (String, Sensitive) Security question answer. Note here that answer won't be set during the resource import.
+-- `key` (String) Security question unique key.
+-- `user_id` (String) ID of the user. Resource will be recreated when `user_id` changes.
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-- `status` (String) The status of the security question factor.
+-- `text` (String) Display text for security question.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_user_factor_question.example &#60;user id&#62;/&#60;question factor id&#62;
+-```
+diff --git a/docs/resources/user_group_memberships.md b/docs/resources/user_group_memberships.md
+deleted file mode 100644
+index 3ee1a701..00000000
+--- a/docs/resources/user_group_memberships.md
++++ /dev/null
+@@ -1,42 +0,0 @@
+----
+-page_title: "Resource: okta_user_group_memberships"
+-description: |-
+-  Resource to manage a set of group memberships for a specific user. This resource allows you to bulk manage groups for a single user, independent of the user schema itself. This allows you to manage group membership in terraform without overriding other automatic membership operations performed by group rules and other non-managed actions.
+----
+-
+-# Resource: okta_user_group_memberships
+-
+-Resource to manage a set of group memberships for a specific user. This resource allows you to bulk manage groups for a single user, independent of the user schema itself. This allows you to manage group membership in terraform without overriding other automatic membership operations performed by group rules and other non-managed actions.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_user" "test" {
+-  first_name = "TestAcc"
+-  last_name  = "Smith"
+-  login      = "testAcc-replace_with_uuid@example.com"
+-  email      = "testAcc-replace_with_uuid@example.com"
+-}
+-
+-resource "okta_user_group_memberships" "test" {
+-  user_id = okta_user.test.id
+-  groups = [
+-    okta_group.test_1.id,
+-    okta_group.test_2.id,
+-  ]
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `groups` (Set of String) The list of Okta group IDs which the user should have membership managed for.
+-- `user_id` (String) ID of a Okta User
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-
+diff --git a/docs/resources/user_schema_property.md b/docs/resources/user_schema_property.md
+deleted file mode 100644
+index af8ca6e5..00000000
+--- a/docs/resources/user_schema_property.md
++++ /dev/null
+@@ -1,105 +0,0 @@
+----
+-page_title: "Resource: okta_user_schema_property"
+-description: |-
+-  Creates a User Schema property. This resource allows you to create and configure a custom user schema property.
+----
+-
+-# Resource: okta_user_schema_property
+-
+-Creates a User Schema property. This resource allows you to create and configure a custom user schema property.
+-
+-**IMPORTANT:** With `enum`, list its values as strings even though the `type`
+-may be something other than string. This is a limitation of the schema defintion
+-in the Terraform Plugin SDK runtime and we juggle the type correctly when making
+-Okta API calls. Same holds for the `const` value of `one_of` as well as the
+-`array_*` variation of `enum` and `one_of`.
+-## Example Usage
+-
+-```terraform
+-resource "okta_user_schema_property" "example" {
+-  index       = "customPropertyName"
+-  title       = "customPropertyName"
+-  type        = "string"
+-  description = "My custom property name"
+-  master      = "OKTA"
+-  scope       = "SELF"
+-  user_type   = data.okta_user_type.example.id
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `index` (String) Subschema unique string identifier
+-- `title` (String) Subschema title (display name)
+-- `type` (String) The type of the schema property. It can be `string`, `boolean`, `number`, `integer`, `array`, or `object`
+-
+-### Optional
+-
+-- `array_enum` (List of String) Array of values that an array property's items can be set to.
+-- `array_one_of` (Block List) Display name and value an enum array can be set to.
+-	- 'const' - (Required) value mapping to member of 'enum'.
+-	- 'title' - (Required) display name for the enum value. (see [below for nested schema](#nestedblock--array_one_of))
+-- `array_type` (String) The type of the array elements if `type` is set to `array`
+-- `description` (String) The description of the user schema property.
+-- `enum` (List of String) Array of values a primitive property can be set to. See `array_enum` for arrays.
+-- `external_name` (String) External name of the user schema property.
+-- `external_namespace` (String) External namespace of the user schema property.
+-- `master` (String) Master priority for the user schema property. It can be set to `PROFILE_MASTER`, `OVERRIDE` or `OKTA`.
+-- `master_override_priority` (Block List) Prioritized list of profile sources (required when 'master' is 'OVERRIDE').
+-	- 'type' - (Optional) - Type of profile source.
+-	- 'value' - (Required) - ID of profile source. (see [below for nested schema](#nestedblock--master_override_priority))
+-- `max_length` (Number) The maximum length of the user property value. Only applies to type `string`
+-- `min_length` (Number) The minimum length of the user property value. Only applies to type `string`
+-- `one_of` (Block List) Array of maps containing a mapping for display name to enum value.
+-	- 'const' - (Required) value mapping to member of 'enum'.
+-	- 'title' - (Required) display name for the enum value. (see [below for nested schema](#nestedblock--one_of))
+-- `pattern` (String) The validation pattern to use for the subschema. Must be in form of '.+', or '[<pattern>]+' if present.'
+-- `permissions` (String) Access control permissions for the property. It can be set to `READ_WRITE`, `READ_ONLY`, `HIDE`. Default: `READ_ONLY`
+-- `required` (Boolean) Whether the subschema is required
+-- `scope` (String) determines whether an app user attribute can be set at the Individual or Group Level. Default: `NONE`
+-- `unique` (String) Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.
+-- `user_type` (String) User type ID. By default, it is `default`
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-<a id="nestedblock--array_one_of"></a>
+-### Nested Schema for `array_one_of`
+-
+-Required:
+-
+-- `const` (String) Value mapping to member of `array_enum`
+-- `title` (String) Display name for the enum value.
+-
+-
+-<a id="nestedblock--master_override_priority"></a>
+-### Nested Schema for `master_override_priority`
+-
+-Required:
+-
+-- `value` (String)
+-
+-Optional:
+-
+-- `type` (String)
+-
+-
+-<a id="nestedblock--one_of"></a>
+-### Nested Schema for `one_of`
+-
+-Required:
+-
+-- `const` (String) Enum value
+-- `title` (String) Enum title
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_user_schema_property.example &#60;user type id&#62;.&#60;index&#62;
+-```
+\ No newline at end of file
+diff --git a/docs/resources/user_type.md b/docs/resources/user_type.md
+deleted file mode 100644
+index 8fcfba01..00000000
+--- a/docs/resources/user_type.md
++++ /dev/null
+@@ -1,40 +0,0 @@
+----
+-page_title: "Resource: okta_user_type"
+-description: |-
+-  Creates a User type. This resource allows you to create and configure a User Type.
+----
+-
+-# Resource: okta_user_type
+-
+-Creates a User type. This resource allows you to create and configure a User Type.
+-
+-## Example Usage
+-
+-```terraform
+-resource "okta_user_type" "example" {
+-  name         = "example"
+-  display_name = "example"
+-  description  = "example"
+-}
+-```
+-
+-<!-- schema generated by tfplugindocs -->
+-## Schema
+-
+-### Required
+-
+-- `description` (String) Description of the User Type.
+-- `display_name` (String) Display Name of the User Type.
+-- `name` (String) Name of the User Type.
+-
+-### Read-Only
+-
+-- `id` (String) The ID of this resource.
+-
+-## Import
+-
+-Import is supported using the following syntax:
+-
+-```shell
+-terraform import okta_user_type.example &#60;user type id&#62;
+-```
diff --git a/patches/0002-delete-docs.patch b/patches/0002-delete-docs.patch
deleted file mode 100644
index b6e51aa1..00000000
--- a/patches/0002-delete-docs.patch
+++ /dev/null
@@ -1,6803 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Ian Wahbe <ian@wahbe.com>
-Date: Tue, 2 Jan 2024 18:03:44 +0100
-Subject: [PATCH 2/2] delete docs
-
-
-diff --git a/docs/data-sources/app.md b/docs/data-sources/app.md
-deleted file mode 100644
-index f362dc21..00000000
---- a/docs/data-sources/app.md
-+++ /dev/null
-@@ -1,46 +0,0 @@
-----
--page_title: "Data Source: okta_app"
--description: |-
--  Get an application of any kind from Okta.
-----
--
--# Data Source: okta_app
--
--Get an application of any kind from Okta.
--
--## Example Usage
--
--```terraform
--data "okta_app" "example" {
--  label = "Example App"
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Optional
--
--- `active_only` (Boolean) Search only ACTIVE applications.
--- `id` (String) Id of application to retrieve, conflicts with label and label_prefix.
--- `label` (String) The label of the app to retrieve, conflicts with
--				label_prefix and id. Label uses the ?q=<label> query parameter exposed by
--				Okta's List Apps API. The API will search both name and label using that
--				query. Therefore similarily named and labeled apps may be returned in the query
--				and have the unitended result of associating the wrong app with this data
--				source. See:
--				https://developer.okta.com/docs/reference/api/apps/#list-applications
--- `label_prefix` (String) Label prefix of the app to retrieve, conflicts with label and id. This will tell the
--				provider to do a starts with query as opposed to an equals query.
--- `skip_groups` (Boolean, Deprecated) Ignore groups sync. This is a temporary solution until 'groups' field is supported in all the app-like resources
--- `skip_users` (Boolean, Deprecated) Ignore users sync. This is a temporary solution until 'users' field is supported in all the app-like resources
--
--### Read-Only
--
--- `groups` (Set of String, Deprecated) Groups associated with the application
--- `links` (String) Discoverable resources related to the app
--- `name` (String) Name of application.
--- `status` (String) Status of application.
--- `users` (Set of String, Deprecated) Users associated with the application
--
--
-diff --git a/docs/data-sources/app_group_assignments.md b/docs/data-sources/app_group_assignments.md
-deleted file mode 100644
-index 737e6eeb..00000000
---- a/docs/data-sources/app_group_assignments.md
-+++ /dev/null
-@@ -1,30 +0,0 @@
-----
--page_title: "Data Source: okta_app_group_assignments"
--description: |-
--  Get a set of groups assigned to an Okta application.
-----
--
--# Data Source: okta_app_group_assignments
--
--Get a set of groups assigned to an Okta application.
--
--## Example Usage
--
--```terraform
--data "okta_app_group_assignments" "test" {
--  id = okta_app_oauth.test.id
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `id` (String) ID of the Okta App being queried for groups
--
--### Read-Only
--
--- `groups` (Set of String) List of groups IDs assigned to the app
--
--
-diff --git a/docs/data-sources/app_metadata_saml.md b/docs/data-sources/app_metadata_saml.md
-deleted file mode 100644
-index 1d7a0d23..00000000
---- a/docs/data-sources/app_metadata_saml.md
-+++ /dev/null
-@@ -1,41 +0,0 @@
-----
--page_title: "Data Source: okta_app_metadata_saml"
--description: |-
--  Get a SAML application's metadata from Okta.
-----
--
--# Data Source: okta_app_metadata_saml
--
--Get a SAML application's metadata from Okta.
--
--## Example Usage
--
--```terraform
--data "okta_app_metadata_saml" "example" {
--  app_id = "<app id>"
--  key_id = "<cert key id>"
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `app_id` (String) The application ID.
--
--### Optional
--
--- `key_id` (String) Certificate Key ID.
--
--### Read-Only
--
--- `certificate` (String) Public certificate from application metadata.
--- `entity_id` (String) Entity URL for instance https://www.okta.com/saml2/service-provider/sposcfdmlybtwkdcgtuf
--- `http_post_binding` (String) urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Post location from the SAML metadata.
--- `http_redirect_binding` (String) urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect location from the SAML metadata.
--- `id` (String) The ID of this resource.
--- `metadata` (String) Raw metadata of application.
--- `want_authn_requests_signed` (Boolean) Whether authn requests are signed.
--
--
-diff --git a/docs/data-sources/app_oauth.md b/docs/data-sources/app_oauth.md
-deleted file mode 100644
-index 2207d3f8..00000000
---- a/docs/data-sources/app_oauth.md
-+++ /dev/null
-@@ -1,61 +0,0 @@
-----
--page_title: "Data Source: okta_app_oauth"
--description: |-
--  Get a OIDC application from Okta.
-----
--
--# Data Source: okta_app_oauth
--
--Get a OIDC application from Okta.
--
--## Example Usage
--
--```terraform
--data "okta_app_oauth" "test" {
--  label = "Example App"
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Optional
--
--- `active_only` (Boolean) Search only ACTIVE applications.
--- `id` (String) Id of application to retrieve, conflicts with label and label_prefix.
--- `label` (String) The label of the app to retrieve, conflicts with
--				label_prefix and id. Label uses the ?q=<label> query parameter exposed by
--				Okta's List Apps API. The API will search both name and label using that
--				query. Therefore similarily named and labeled apps may be returned in the query
--				and have the unitended result of associating the wrong app with this data
--				source. See:
--				https://developer.okta.com/docs/reference/api/apps/#list-applications
--- `label_prefix` (String) Label prefix of the app to retrieve, conflicts with label and id. This will tell the
--				provider to do a starts with query as opposed to an equals query.
--- `skip_groups` (Boolean, Deprecated) Ignore groups sync. This is a temporary solution until 'groups' field is supported in all the app-like resources
--- `skip_users` (Boolean, Deprecated) Ignore users sync. This is a temporary solution until 'users' field is supported in all the app-like resources
--
--### Read-Only
--
--- `auto_submit_toolbar` (Boolean) Display auto submit toolbar
--- `client_id` (String) OAuth client ID
--- `client_secret` (String, Sensitive) OAuth client secret
--- `client_uri` (String) URI to a web page providing information about the client.
--- `grant_types` (Set of String) List of OAuth 2.0 grant types
--- `hide_ios` (Boolean) Do not display application icon on mobile app
--- `hide_web` (Boolean) Do not display application icon to users
--- `links` (String) Discoverable resources related to the app
--- `login_mode` (String) The type of Idp-Initiated login that the client supports, if any
--- `login_scopes` (Set of String) List of scopes to use for the request when 'login_mode' == OKTA
--- `login_uri` (String) URI that initiates login.
--- `logo_uri` (String) URI that references a logo for the client.
--- `name` (String) Name of application.
--- `policy_uri` (String) URI to web page providing client policy document.
--- `post_logout_redirect_uris` (Set of String) List of URIs for redirection after logout
--- `redirect_uris` (Set of String) List of URIs for use in the redirect-based flow.
--- `response_types` (Set of String) List of OAuth 2.0 response type strings.
--- `status` (String) Status of application.
--- `type` (String) The type of OAuth application.
--- `wildcard_redirect` (String) Indicates if the client is allowed to use wildcard matching of redirect_uris
--
--
-diff --git a/docs/data-sources/app_saml.md b/docs/data-sources/app_saml.md
-deleted file mode 100644
-index 9acaf5ed..00000000
---- a/docs/data-sources/app_saml.md
-+++ /dev/null
-@@ -1,90 +0,0 @@
-----
--page_title: "Data Source: okta_app_saml"
--description: |-
--  Get a SAML application from Okta.
-----
--
--# Data Source: okta_app_saml
--
--Get a SAML application from Okta.
--
--## Example Usage
--
--```terraform
--data "okta_app_saml" "example" {
--  label = "Example App"
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Optional
--
--- `active_only` (Boolean) Search only ACTIVE applications.
--- `id` (String) Id of application to retrieve, conflicts with label and label_prefix.
--- `label` (String) The label of the app to retrieve, conflicts with label_prefix and id. Label 
--				uses the ?q=<label> query parameter exposed by Okta's API. It should be noted that at this time 
--				this searches both name and label. This is used to avoid paginating through all applications.
--- `label_prefix` (String) Label prefix of the app to retrieve, conflicts with label and id. This will tell the
--				provider to do a starts with query as opposed to an equals query.
--- `request_compressed` (Boolean) Denotes whether the request is compressed or not.
--- `skip_groups` (Boolean, Deprecated) Ignore groups sync. This is a temporary solution until 'groups' field is supported in all the app-like resources
--- `skip_users` (Boolean, Deprecated) Ignore users sync. This is a temporary solution until 'users' field is supported in all the app-like resources
--
--### Read-Only
--
--- `accessibility_error_redirect_url` (String) Custom error page URL
--- `accessibility_login_redirect_url` (String) Custom login page URL
--- `accessibility_self_service` (Boolean) Enable self service
--- `acs_endpoints` (Set of String) List of ACS endpoints for this SAML application
--- `app_settings_json` (String) Application settings in JSON format
--- `assertion_signed` (Boolean) Determines whether the SAML assertion is digitally signed
--- `attribute_statements` (List of Object) (see [below for nested schema](#nestedatt--attribute_statements))
--- `audience` (String) Audience Restriction
--- `authn_context_class_ref` (String) Identifies the SAML authentication context class for the assertion’s authentication statement
--- `auto_submit_toolbar` (Boolean) Display auto submit toolbar
--- `default_relay_state` (String) Identifies a specific application resource in an IDP initiated SSO scenario.
--- `destination` (String) Identifies the location where the SAML response is intended to be sent inside of the SAML assertion
--- `digest_algorithm` (String) Determines the digest algorithm used to digitally sign the SAML assertion and response
--- `features` (Set of String) features to enable
--- `groups` (Set of String, Deprecated) Groups associated with the application
--- `hide_ios` (Boolean) Do not display application icon on mobile app
--- `hide_web` (Boolean) Do not display application icon to users
--- `honor_force_authn` (Boolean) Prompt user to re-authenticate if SP asks for it
--- `idp_issuer` (String) SAML issuer ID
--- `inline_hook_id` (String) Saml Inline Hook setting
--- `key_id` (String) Certificate ID
--- `links` (String) Discoverable resources related to the app
--- `name` (String) Name of application.
--- `recipient` (String) The location where the app may present the SAML assertion
--- `response_signed` (Boolean) Determines whether the SAML auth response message is digitally signed
--- `saml_signed_request_enabled` (Boolean) SAML Signed Request enabled
--- `signature_algorithm` (String) Signature algorithm used ot digitally sign the assertion and response
--- `single_logout_certificate` (String) x509 encoded certificate that the Service Provider uses to sign Single Logout requests
--- `single_logout_issuer` (String) The issuer of the Service Provider that generates the Single Logout request
--- `single_logout_url` (String) The location where the logout response is sent
--- `sp_issuer` (String) SAML SP issuer ID
--- `sso_url` (String) Single Sign On URL
--- `status` (String) Status of application.
--- `subject_name_id_format` (String) Identifies the SAML processing rules.
--- `subject_name_id_template` (String) Template for app user's username when a user is assigned to the app
--- `user_name_template` (String) Username template
--- `user_name_template_push_status` (String) Push username on update
--- `user_name_template_suffix` (String) Username template suffix
--- `user_name_template_type` (String) Username template type
--- `users` (Set of String, Deprecated) Users associated with the application
--
--<a id="nestedatt--attribute_statements"></a>
--### Nested Schema for `attribute_statements`
--
--Read-Only:
--
--- `filter_type` (String)
--- `filter_value` (String)
--- `name` (String)
--- `namespace` (String)
--- `type` (String)
--- `values` (List of String)
--
--
-diff --git a/docs/data-sources/app_signon_policy.md b/docs/data-sources/app_signon_policy.md
-deleted file mode 100644
-index d047b6f6..00000000
---- a/docs/data-sources/app_signon_policy.md
-+++ /dev/null
-@@ -1,39 +0,0 @@
-----
--page_title: "Data Source: okta_app_signon_policy"
--description: |-
--  Get a sign-on policy for the application.
-----
--
--# Data Source: okta_app_signon_policy
--
--Get a sign-on policy for the application.
--
--~> **WARNING:** This feature is only available as a part of the 
--Identity Engine. [Contact support](mailto:dev-inquiries@okta.com) 
--for further information.
--
---> Inside the product a sign-on policy is referenced as an _authentication
--policy_, in the public API the policy is of type
--[`ACCESS_POLICY`](https://developer.okta.com/docs/reference/api/policy/#policy-object).
--
--## Example Usage
--
--```terraform
--data "okta_app_signon_policy" "example" {
--  app_id = "app_id"
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `app_id` (String) App ID
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--- `name` (String) Policy name
--
--
-diff --git a/docs/data-sources/app_user_assignments.md b/docs/data-sources/app_user_assignments.md
-deleted file mode 100644
-index a193c1b3..00000000
---- a/docs/data-sources/app_user_assignments.md
-+++ /dev/null
-@@ -1,30 +0,0 @@
-----
--page_title: "Data Source: okta_app_user_assignments"
--description: |-
--  Get a set of users assigned to an Okta application.
-----
--
--# Data Source: okta_app_user_assignments
--
--Get a set of users assigned to an Okta application.
--
--## Example Usage
--
--```terraform
--data "okta_app_user_assignments" "test" {
--  id = okta_app_oauth.test.id
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `id` (String) ID of the Okta App being queried for groups
--
--### Read-Only
--
--- `users` (Set of String) List of user IDs assigned to the app
--
--
-diff --git a/docs/data-sources/auth_server.md b/docs/data-sources/auth_server.md
-deleted file mode 100644
-index 10d0375c..00000000
---- a/docs/data-sources/auth_server.md
-+++ /dev/null
-@@ -1,39 +0,0 @@
-----
--page_title: "Data Source: okta_auth_server"
--description: |-
--  Get an auth server from Okta.
-----
--
--# Data Source: okta_auth_server
--
--Get an auth server from Okta.
--
--## Example Usage
--
--```terraform
--data "okta_auth_server" "example" {
--  name = "Example Auth"
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `name` (String) The name of the auth server to retrieve.
--
--### Read-Only
--
--- `audiences` (Set of String) Description of Authorization server.
--- `credentials_last_rotated` (String) Last time credentials were rotated.
--- `credentials_next_rotation` (String) Next time credentials will be rotated
--- `credentials_rotation_mode` (String) Mode of credential rotation, auto or manual.
--- `description` (String) Description of Authorization server.
--- `id` (String) The ID of this resource.
--- `issuer` (String) The complete URL of the authorization server. This becomes the `iss` claim in an access token.
--- `issuer_mode` (String) Can be set to `CUSTOM_URL` or `ORG_URL`
--- `kid` (String) Auth server key id.
--- `status` (String) The activation status of the authorization server.
--
--
-diff --git a/docs/data-sources/auth_server_claim.md b/docs/data-sources/auth_server_claim.md
-deleted file mode 100644
-index c50cbe25..00000000
---- a/docs/data-sources/auth_server_claim.md
-+++ /dev/null
-@@ -1,41 +0,0 @@
-----
--page_title: "Data Source: okta_auth_server_claim"
--description: |-
--  Get authorization server claim from Okta.
-----
--
--# Data Source: okta_auth_server_claim
--
--Get authorization server claim from Okta.
--
--## Example Usage
--
--```terraform
--data "okta_auth_server_claim" "test" {
--  auth_server_id = "default"
--  name           = "birthdate"
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `auth_server_id` (String) Auth server ID
--
--### Optional
--
--- `id` (String) Name of the claim. Conflicts with `name`.
--- `name` (String) Name of the claim. Conflicts with `id`.
--
--### Read-Only
--
--- `always_include_in_token` (Boolean) Specifies whether to include Claims in the token.
--- `claim_type` (String) Specifies whether the Claim is for an access token (`RESOURCE`) or ID token (`IDENTITY`).
--- `scopes` (Set of String) Auth server claim list of scopes
--- `status` (String) Status of the claim.
--- `value` (String) Value of the claim.
--- `value_type` (String) Specifies whether the Claim is an Okta EL expression (`EXPRESSION`), a set of groups (`GROUPS`), or a system claim (`SYSTEM`)
--
--
-diff --git a/docs/data-sources/auth_server_claims.md b/docs/data-sources/auth_server_claims.md
-deleted file mode 100644
-index d91bff39..00000000
---- a/docs/data-sources/auth_server_claims.md
-+++ /dev/null
-@@ -1,45 +0,0 @@
-----
--page_title: "Data Source: okta_auth_server_claims"
--description: |-
--  Get a list of authorization server claims from Okta.
-----
--
--# Data Source: okta_auth_server_claims
--
--Get a list of authorization server claims from Okta.
--
--## Example Usage
--
--```terraform
--data "okta_auth_server_claims" "test" {
--  auth_server_id = "default"
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `auth_server_id` (String) Auth server ID
--
--### Read-Only
--
--- `claims` (List of Object) Collection of authorization server claims retrieved from Okta with the following properties. (see [below for nested schema](#nestedatt--claims))
--- `id` (String) The ID of this resource.
--
--<a id="nestedatt--claims"></a>
--### Nested Schema for `claims`
--
--Read-Only:
--
--- `always_include_in_token` (Boolean)
--- `claim_type` (String)
--- `id` (String)
--- `name` (String)
--- `scopes` (Set of String)
--- `status` (String)
--- `value` (String)
--- `value_type` (String)
--
--
-diff --git a/docs/data-sources/auth_server_policy.md b/docs/data-sources/auth_server_policy.md
-deleted file mode 100644
-index 9dcc261b..00000000
---- a/docs/data-sources/auth_server_policy.md
-+++ /dev/null
-@@ -1,35 +0,0 @@
-----
--page_title: "Data Source: okta_auth_server_policy"
--description: |-
--  Get an authorization server policy from Okta.
-----
--
--# Data Source: okta_auth_server_policy
--
--Get an authorization server policy from Okta.
--
--## Example Usage
--
--```terraform
--data "okta_auth_server_policy" "example" {
--  auth_server_id = "<auth server id>"
--  name           = "staff"
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `auth_server_id` (String) Auth server ID
--- `name` (String) Name of the policy
--
--### Read-Only
--
--- `assigned_clients` (Set of String) List of clients this policy is assigned to. `[ALL_CLIENTS]` is a special value when policy is assigned to all clients.
--- `description` (String) Description of authorization server policy.
--- `id` (String) The ID of this resource.
--- `priority` (Number) Priority of the auth server policy
--
--
-diff --git a/docs/data-sources/auth_server_scopes.md b/docs/data-sources/auth_server_scopes.md
-deleted file mode 100644
-index 230a53d4..00000000
---- a/docs/data-sources/auth_server_scopes.md
-+++ /dev/null
-@@ -1,46 +0,0 @@
-----
--page_title: "Data Source: okta_auth_server_scopes"
--description: |-
--  Get a list of authorization server scopes from Okta.
-----
--
--# Data Source: okta_auth_server_scopes
--
--Get a list of authorization server scopes from Okta.
--
--## Example Usage
--
--```terraform
--data "okta_auth_server_scopes" "test" {
--  auth_server_id = "default"
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `auth_server_id` (String) Auth server ID
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--- `scopes` (List of Object) Collection of authorization server scopes retrieved from Okta with the following properties. (see [below for nested schema](#nestedatt--scopes))
--
--<a id="nestedatt--scopes"></a>
--### Nested Schema for `scopes`
--
--Read-Only:
--
--- `consent` (String)
--- `default` (Boolean)
--- `description` (String)
--- `display_name` (String)
--- `id` (String)
--- `metadata_publish` (String)
--- `name` (String)
--- `optional` (Boolean)
--- `system` (Boolean)
--
--
-diff --git a/docs/data-sources/authenticator.md b/docs/data-sources/authenticator.md
-deleted file mode 100644
-index 73fb326a..00000000
---- a/docs/data-sources/authenticator.md
-+++ /dev/null
-@@ -1,48 +0,0 @@
-----
--page_title: "Data Source: okta_authenticator"
--description: |-
--  Get an authenticator by key, name of ID.
-----
--
--# Data Source: okta_authenticator
--
--Get an authenticator by key, name of ID.
--
--~> **WARNING:** This feature is only available as a part of the 
--Identity Engine. [Contact support](mailto:dev-inquiries@okta.com) 
--for further information.
--
--## Example Usage
--
--```terraform
--data "okta_authenticator" "test" {
--  key = "security_question"
--}
--
--data "okta_authenticator" "test_1" {
--  name = "Okta Verify"
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Optional
--
--- `id` (String) ID of the authenticator.
--- `key` (String) A human-readable string that identifies the authenticator.
--- `name` (String) Name of the authenticator.
--
--### Read-Only
--
--- `provider_auth_port` (Number) The RADIUS server port (for example 1812). This is defined when the On-Prem RADIUS server is configured
--- `provider_hostname` (String) Server host name or IP address
--- `provider_instance_id` (String) (Specific to `security_key`) App Instance ID.
--- `provider_json` (String) Authenticator Provider in JSON format
--- `provider_type` (String) Provider type.
--- `provider_user_name_template` (String) Username template expected by the provider.
--- `settings` (String) Authenticator settings in JSON format
--- `status` (String) Status of the Authenticator.
--- `type` (String) Type of the authenticator
--
--
-diff --git a/docs/data-sources/behavior.md b/docs/data-sources/behavior.md
-deleted file mode 100644
-index 30cf79db..00000000
---- a/docs/data-sources/behavior.md
-+++ /dev/null
-@@ -1,33 +0,0 @@
-----
--page_title: "Data Source: okta_behavior"
--description: |-
--  Get a behavior by name or ID.
-----
--
--# Data Source: okta_behavior
--
--Get a behavior by name or ID.
--
--## Example Usage
--
--```terraform
--data "okta_behavior" "example" {
--  label = "New City"
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Optional
--
--- `id` (String) Behavior ID.
--- `name` (String) Behavior name.
--
--### Read-Only
--
--- `settings` (Map of String) Map of behavior settings.
--- `status` (String) Behavior status.
--- `type` (String) Behavior type.
--
--
-diff --git a/docs/data-sources/behaviors.md b/docs/data-sources/behaviors.md
-deleted file mode 100644
-index a3649560..00000000
---- a/docs/data-sources/behaviors.md
-+++ /dev/null
-@@ -1,42 +0,0 @@
-----
--page_title: "Data Source: okta_behaviors"
--description: |-
--  Get a behaviors by search criteria.
-----
--
--# Data Source: okta_behaviors
--
--Get a behaviors by search criteria.
--
--## Example Usage
--
--```terraform
--data "okta_behaviors" "example" {
--  q = "New"
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Optional
--
--- `q` (String) Searches the name property of behaviors for matching value
--
--### Read-Only
--
--- `behaviors` (List of Object) (see [below for nested schema](#nestedatt--behaviors))
--- `id` (String) The ID of this resource.
--
--<a id="nestedatt--behaviors"></a>
--### Nested Schema for `behaviors`
--
--Read-Only:
--
--- `id` (String)
--- `name` (String)
--- `settings` (Map of String)
--- `status` (String)
--- `type` (String)
--
--
-diff --git a/docs/data-sources/brand.md b/docs/data-sources/brand.md
-deleted file mode 100644
-index 3eab1804..00000000
---- a/docs/data-sources/brand.md
-+++ /dev/null
-@@ -1,41 +0,0 @@
-----
--page_title: "Data Source: okta_brand"
--description: |-
--  Get a single Brand from Okta.
-----
--
--# Data Source: okta_brand
--
--Get a single Brand from Okta.
--
--## Example Usage
--
--```terraform
--data "okta_brands" "test" {
--}
--
--data "okta_brand" "test" {
--  brand_id = tolist(data.okta_brands.test.brands)[0].id
--}
--
--data "okta_brand" "default" {
--  brand_id = "default"
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `brand_id` (String) Brand ID
--
--### Read-Only
--
--- `custom_privacy_policy_url` (String) Custom privacy policy URL
--- `id` (String) The ID of the Brand
--- `links` (String) Link relations for this object - JSON HAL - Discoverable resources related to the brand
--- `name` (String) Brand name
--- `remove_powered_by_okta` (Boolean) Removes "Powered by Okta" from the Okta-hosted sign-in page and "© 2021 Okta, Inc." from the Okta End-User Dashboard
--
--
-diff --git a/docs/data-sources/brands.md b/docs/data-sources/brands.md
-deleted file mode 100644
-index 82208304..00000000
---- a/docs/data-sources/brands.md
-+++ /dev/null
-@@ -1,37 +0,0 @@
-----
--page_title: "Data Source: okta_brands"
--description: |-
--  Get the brands belonging to an Okta organization.
-----
--
--# Data Source: okta_brands
--
--Get the brands belonging to an Okta organization.
--
--## Example Usage
--
--```terraform
--data "okta_brands" "test" {
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Read-Only
--
--- `brands` (Set of Object) List of `okta_brand` belonging to the organization (see [below for nested schema](#nestedatt--brands))
--- `id` (String) The ID of this resource.
--
--<a id="nestedatt--brands"></a>
--### Nested Schema for `brands`
--
--Read-Only:
--
--- `custom_privacy_policy_url` (String)
--- `id` (String)
--- `links` (String)
--- `name` (String)
--- `remove_powered_by_okta` (Boolean)
--
--
-diff --git a/docs/data-sources/default_policy.md b/docs/data-sources/default_policy.md
-deleted file mode 100644
-index bf8218c8..00000000
---- a/docs/data-sources/default_policy.md
-+++ /dev/null
-@@ -1,32 +0,0 @@
-----
--page_title: "Data Source: okta_default_policy"
--description: |-
--  Get a Default policy from Okta.
-----
--
--# Data Source: okta_default_policy
--
--Use this data source to retrieve a default policy from Okta. This 
--same thing can be achieved using the `okta_policy` with default 
--names, this is simply a shortcut.
--
--## Example Usage
--
--```terraform
--data "okta_default_policy" "example" {
--  type = "PASSWORD"
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `type` (String) Policy type: OKTA_SIGN_ON, PASSWORD, MFA_ENROLL, or IDP_DISCOVERY
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/data-sources/domain.md b/docs/data-sources/domain.md
-deleted file mode 100644
-index 4a222866..00000000
---- a/docs/data-sources/domain.md
-+++ /dev/null
-@@ -1,57 +0,0 @@
-----
--page_title: "Data Source: okta_domain"
--description: |-
--  Get a domain from Okta.
-----
--
--# Data Source: okta_domain
--
--Get a domain from Okta.
--
--## Example Usage
--
--```terraform
--resource "okta_domain" "example" {
--  name = "www.example.com"
--}
--
--data "okta_domain" "by-name" {
--  domain_id_or_name = "www.example.com"
--
--  depends_on = [
--    okta_domain.example
--  ]
--}
--
--data "okta_domain" "by-id" {
--  domain_id_or_name = okta_domain.example.id
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `domain_id_or_name` (String) Brand ID
--
--### Read-Only
--
--- `certificate_source_type` (String) Certificate source type that indicates whether the certificate is provided by the user or Okta. Values: MANUAL, OKTA_MANAGED
--- `dns_records` (List of Object) TXT and CNAME records to be registered for the Domain (see [below for nested schema](#nestedatt--dns_records))
--- `domain` (String) Domain name
--- `id` (String) The ID of the Domain
--- `public_certificate` (Map of String) Certificate metadata for the Domain
--- `validation_status` (String) Status of the domain. Values: NOT_STARTED, IN_PROGRESS, VERIFIED, COMPLETED
--
--<a id="nestedatt--dns_records"></a>
--### Nested Schema for `dns_records`
--
--Read-Only:
--
--- `expiration` (String)
--- `fqdn` (String)
--- `record_type` (String)
--- `values` (List of String)
--
--
-diff --git a/docs/data-sources/email_customization.md b/docs/data-sources/email_customization.md
-deleted file mode 100644
-index 319d4cb2..00000000
---- a/docs/data-sources/email_customization.md
-+++ /dev/null
-@@ -1,47 +0,0 @@
-----
--page_title: "Data Source: okta_email_customization"
--description: |-
--  Get the email customization of an email template belonging to a brand in an Okta organization.
-----
--
--# Data Source: okta_email_customization
--
--Get the email customization of an email template belonging to a brand in an Okta organization.
--
--## Example Usage
--
--```terraform
--data "okta_brands" "test" {
--}
--
--data "okta_email_customizations" "forgot_password" {
--  brand_id      = tolist(data.okta_brands.test.brands)[0].id
--  template_name = "ForgotPassword"
--}
--
--data "okta_email_customization" "forgot_password_en" {
--  brand_id         = tolist(data.okta_brands.test.brands)[0].id
--  template_name    = "ForgotPassword"
--  customization_id = tolist(data.okta_email_customizations.forgot_password.email_customizations)[0].id
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `brand_id` (String) Brand ID
--- `customization_id` (String) The ID of the customization
--- `template_name` (String) Template Name
--
--### Read-Only
--
--- `body` (String) The body of the customization
--- `id` (String) The ID of the customization
--- `is_default` (Boolean) Whether the customization is the default
--- `language` (String) The language supported by the customization
--- `links` (String) Link relations for this object - JSON HAL - Discoverable resources related to the email template
--- `subject` (String) The subject of the customization
--
--
-diff --git a/docs/data-sources/email_customizations.md b/docs/data-sources/email_customizations.md
-deleted file mode 100644
-index afa6bc6a..00000000
---- a/docs/data-sources/email_customizations.md
-+++ /dev/null
-@@ -1,48 +0,0 @@
-----
--page_title: "Data Source: okta_email_customizations"
--description: |-
--  Get the email customizations of an email template belonging to a brand in an Okta organization.
-----
--
--# Data Source: okta_email_customizations
--
--Get the email customizations of an email template belonging to a brand in an Okta organization.
--
--## Example Usage
--
--```terraform
--data "okta_brands" "test" {
--}
--
--data "okta_email_customizations" "forgot_password" {
--  brand_id      = tolist(data.okta_brands.test.brands)[0].id
--  template_name = "ForgotPassword"
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `brand_id` (String) Brand ID
--- `template_name` (String) Template Name
--
--### Read-Only
--
--- `email_customizations` (Set of Object) List of `okta_email_customization` belonging to the named email template of the brand in the organization (see [below for nested schema](#nestedatt--email_customizations))
--- `id` (String) The ID of this resource.
--
--<a id="nestedatt--email_customizations"></a>
--### Nested Schema for `email_customizations`
--
--Read-Only:
--
--- `body` (String)
--- `id` (String)
--- `is_default` (Boolean)
--- `language` (String)
--- `links` (String)
--- `subject` (String)
--
--
-diff --git a/docs/data-sources/email_template.md b/docs/data-sources/email_template.md
-deleted file mode 100644
-index bbac5e0f..00000000
---- a/docs/data-sources/email_template.md
-+++ /dev/null
-@@ -1,36 +0,0 @@
-----
--page_title: "Data Source: okta_email_template"
--description: |-
--  Get a single Email Template for a Brand belonging to an Okta organization.
-----
--
--# Data Source: okta_email_template
--
--Get a single Email Template for a Brand belonging to an Okta organization.
--
--## Example Usage
--
--```terraform
--data "okta_brands" "test" {
--}
--
--data "okta_email_template" "forgot_password" {
--  brand_id = tolist(data.okta_brands.test.brands)[0].id
--  name     = "ForgotPassword"
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `brand_id` (String) Brand ID
--- `name` (String) The name of the email template
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--- `links` (String) Link relations for this object - JSON HAL - Discoverable resources related to the email template
--
--
-diff --git a/docs/data-sources/email_templates.md b/docs/data-sources/email_templates.md
-deleted file mode 100644
-index 620f7496..00000000
---- a/docs/data-sources/email_templates.md
-+++ /dev/null
-@@ -1,42 +0,0 @@
-----
--page_title: "Data Source: okta_email_templates"
--description: |-
--  Get the email templates belonging to a brand in an Okta organization.
-----
--
--# Data Source: okta_email_templates
--
--Get the email templates belonging to a brand in an Okta organization.
--
--## Example Usage
--
--```terraform
--data "okta_brands" "test" {
--}
--
--data "okta_email_templates" "test" {
--  brand_id = tolist(data.okta_brands.test.brands)[0].id
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `brand_id` (String) Brand ID
--
--### Read-Only
--
--- `email_templates` (Set of Object) List of `okta_email_template` belonging to a brand in the organization (see [below for nested schema](#nestedatt--email_templates))
--- `id` (String) The ID of this resource.
--
--<a id="nestedatt--email_templates"></a>
--### Nested Schema for `email_templates`
--
--Read-Only:
--
--- `links` (String)
--- `name` (String)
--
--
-diff --git a/docs/data-sources/everyone_group.md b/docs/data-sources/everyone_group.md
-deleted file mode 100644
-index 00a4eba9..00000000
---- a/docs/data-sources/everyone_group.md
-+++ /dev/null
-@@ -1,31 +0,0 @@
-----
--page_title: "Data Source: okta_everyone_group"
--description: |-
--  Get the Everyone group from Okta.
-----
--
--# Data Source: okta_everyone_group
--
--Use this data source to retrieve the `Everyone` group from Okta. The 
--same can be achieved with the `okta_group` data
--source with `name = "Everyone"`. This is simply a shortcut.
--
--## Example Usage
--
--```terraform
--data "okta_everyone_group" "example" {}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Optional
--
--- `include_users` (Boolean) Fetch group users, having default off cuts down on API calls.
--
--### Read-Only
--
--- `description` (String) Description of group.
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/data-sources/group.md b/docs/data-sources/group.md
-deleted file mode 100644
-index 5e5cf2db..00000000
---- a/docs/data-sources/group.md
-+++ /dev/null
-@@ -1,35 +0,0 @@
-----
--page_title: "Data Source: okta_group"
--description: |-
--  Get a group from Okta.
-----
--
--# Data Source: okta_group
--
--Get a group from Okta.
--
--## Example Usage
--
--```terraform
--data "okta_group" "example" {
--  name = "Example App"
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Optional
--
--- `delay_read_seconds` (String) Force delay of the group read by N seconds. Useful when eventual consistency of group information needs to be allowed for; for instance, when group rules are known to have been applied.
--- `id` (String) ID of group.
--- `include_users` (Boolean) Fetch group users, having default off cuts down on API calls.
--- `name` (String) Name of group.
--- `type` (String) Type of the group. When specified in the terraform resource, will act as a filter when searching for the group
--
--### Read-Only
--
--- `description` (String) Description of group.
--- `users` (Set of String) Users associated with the group. This can also be done per user.
--
--
-diff --git a/docs/data-sources/group_rule.md b/docs/data-sources/group_rule.md
-deleted file mode 100644
-index 959c63d0..00000000
---- a/docs/data-sources/group_rule.md
-+++ /dev/null
-@@ -1,35 +0,0 @@
-----
--page_title: "Data Source: okta_group_rule"
--description: |-
--  Get a group rule from Okta.
-----
--
--# Data Source: okta_group_rule
--
--Get a group rule from Okta.
--
--## Example Usage
--
--```terraform
--data "okta_group_rule" "test" {
--  id = okta_group_rule.example.id
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Optional
--
--- `id` (String) The ID of the Group Rule.
--- `name` (String) The name of the Group Rule.
--- `status` (String)
--
--### Read-Only
--
--- `expression_type` (String) The expression type to use to invoke the rule.
--- `expression_value` (String) The expression value.
--- `group_assignments` (Set of String) The list of group ids to assign the users to.
--- `users_excluded` (Set of String) The list of user IDs that would be excluded when rules are processed.
--
--
-diff --git a/docs/data-sources/groups.md b/docs/data-sources/groups.md
-deleted file mode 100644
-index 601054a0..00000000
---- a/docs/data-sources/groups.md
-+++ /dev/null
-@@ -1,44 +0,0 @@
-----
--page_title: "Data Source: okta_groups"
--description: |-
--  Get a list of groups from Okta.
-----
--
--# Data Source: okta_groups
--
--Get a list of groups from Okta.
--
--## Example Usage
--
--```terraform
--data "okta_groups" "example" {
--  q = "Engineering - "
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Optional
--
--- `q` (String) Searches the name property of groups for matching value
--- `search` (String) Searches for groups with a supported filtering expression for all attributes except for '_embedded', '_links', and 'objectClass'
--- `type` (String) Type of the group. When specified in the terraform resource, will act as a filter when searching for the groups
--
--### Read-Only
--
--- `groups` (List of Object) (see [below for nested schema](#nestedatt--groups))
--- `id` (String) The ID of this resource.
--
--<a id="nestedatt--groups"></a>
--### Nested Schema for `groups`
--
--Read-Only:
--
--- `custom_profile_attributes` (String)
--- `description` (String)
--- `id` (String)
--- `name` (String)
--- `type` (String)
--
--
-diff --git a/docs/data-sources/idp_metadata_saml.md b/docs/data-sources/idp_metadata_saml.md
-deleted file mode 100644
-index 6bd46f7d..00000000
---- a/docs/data-sources/idp_metadata_saml.md
-+++ /dev/null
-@@ -1,38 +0,0 @@
-----
--page_title: "Data Source: okta_idp_metadata_saml"
--description: |-
--  Get SAML IdP metadata from Okta.
-----
--
--# Data Source: okta_idp_metadata_saml
--
--Get SAML IdP metadata from Okta.
--
--## Example Usage
--
--```terraform
--data "okta_idp_metadata_saml" "example" {
--  idp_id = "<idp id>"
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Optional
--
--- `idp_id` (String) The id of the IdP to retrieve metadata for.
--
--### Read-Only
--
--- `assertions_signed` (Boolean) Whether assertions are signed.
--- `authn_request_signed` (Boolean) Whether authn requests are signed.
--- `encryption_certificate` (String) SAML request encryption certificate.
--- `entity_id` (String) Entity URL for instance https://www.okta.com/saml2/service-provider/sposcfdmlybtwkdcgtuf
--- `http_post_binding` (String) urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Post location from the SAML metadata.
--- `http_redirect_binding` (String) urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect location from the SAML metadata.
--- `id` (String) The ID of this resource.
--- `metadata` (String) Raw IdP metadata.
--- `signing_certificate` (String) SAML request signing certificate.
--
--
-diff --git a/docs/data-sources/idp_oidc.md b/docs/data-sources/idp_oidc.md
-deleted file mode 100644
-index 71a25324..00000000
---- a/docs/data-sources/idp_oidc.md
-+++ /dev/null
-@@ -1,46 +0,0 @@
-----
--page_title: "Data Source: okta_idp_oidc"
--description: |-
--  Get a OIDC IdP from Okta.
-----
--
--# Data Source: okta_idp_oidc
--
--Get a OIDC IdP from Okta.
--
--## Example Usage
--
--```terraform
--data "okta_idp_oidc" "example" {
--  name = "Example Provider"
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Optional
--
--- `id` (String) Id of idp.
--- `name` (String) Name of the idp.
--
--### Read-Only
--
--- `authorization_binding` (String) The method of making an authorization request.
--- `authorization_url` (String) IdP Authorization Server (AS) endpoint to request consent from the user and obtain an authorization code grant.
--- `client_id` (String) Unique identifier issued by AS for the Okta IdP instance.
--- `client_secret` (String, Sensitive) Client secret issued by AS for the Okta IdP instance.
--- `issuer_mode` (String) Indicates whether Okta uses the original Okta org domain URL, a custom domain URL, or dynamic.
--- `issuer_url` (String) URI that identifies the issuer.
--- `jwks_binding` (String) The method of making a request for the OIDC JWKS.
--- `jwks_url` (String) Endpoint where the keys signer publishes its keys in a JWK Set.
--- `max_clock_skew` (Number) Maximum allowable clock-skew when processing messages from the IdP.
--- `protocol_type` (String) The type of protocol to use.
--- `scopes` (Set of String) The scopes of the IdP.
--- `token_binding` (String) The method of making a token request.
--- `token_url` (String) IdP Authorization Server (AS) endpoint to exchange the authorization code grant for an access token.
--- `type` (String) Type of idp.
--- `user_info_binding` (String) The method of making a user info request.
--- `user_info_url` (String) Protected resource endpoint that returns claims about the authenticated user.
--
--
-diff --git a/docs/data-sources/idp_saml.md b/docs/data-sources/idp_saml.md
-deleted file mode 100644
-index a4bff2f3..00000000
---- a/docs/data-sources/idp_saml.md
-+++ /dev/null
-@@ -1,42 +0,0 @@
-----
--page_title: "Data Source: okta_idp_saml"
--description: |-
--  Get a SAML IdP from Okta.
-----
--
--# Data Source: okta_idp_saml
--
--Get a SAML IdP from Okta.
--
--## Example Usage
--
--```terraform
--data "okta_idp_saml" "example" {
--  name = "Example App"
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Optional
--
--- `id` (String) Id of idp.
--- `name` (String) Name of the idp.
--
--### Read-Only
--
--- `acs_binding` (String) ACS binding
--- `acs_type` (String) Determines whether to publish an instance-specific (trust) or organization (shared) ACS endpoint in the SAML metadata.
--- `audience` (String) URI that identifies the target Okta IdP instance (SP)
--- `issuer` (String) URI that identifies the issuer (IdP).
--- `issuer_mode` (String) Indicates whether Okta uses the original Okta org domain URL, or a custom domain URL in the request to the IdP.
--- `kid` (String) Key ID reference to the IdP's X.509 signature certificate.
--- `sso_binding` (String) Single sign-on binding.
--- `sso_destination` (String) SSO request binding, HTTP-POST or HTTP-REDIRECT.
--- `sso_url` (String) Single sign-on url.
--- `subject_filter` (String) Regular expression pattern used to filter untrusted IdP usernames.
--- `subject_format` (Set of String) Expression to generate or transform a unique username for the IdP user.
--- `type` (String) Type of idp.
--
--
-diff --git a/docs/data-sources/idp_social.md b/docs/data-sources/idp_social.md
-deleted file mode 100644
-index 24a222a1..00000000
---- a/docs/data-sources/idp_social.md
-+++ /dev/null
-@@ -1,55 +0,0 @@
-----
--page_title: "Data Source: okta_idp_social"
--description: |-
--  Get a social IdP from Okta.
-----
--
--# Data Source: okta_idp_social
--
--Get a social IdP from Okta.
--
--## Example Usage
--
--```terraform
--data "okta_idp_social" "example" {
--  name = "My Facebook IdP"
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Optional
--
--- `id` (String) The id of the social idp to retrieve, conflicts with `name`.
--- `name` (String) The name of the social idp to retrieve, conflicts with `id`.
--
--### Read-Only
--
--- `account_link_action` (String) Specifies the account linking action for an IdP user.
--- `account_link_group_include` (Set of String) Group memberships to determine link candidates.
--- `authorization_binding` (String) The method of making an authorization request.
--- `authorization_url` (String) IdP Authorization Server (AS) endpoint to request consent from the user and obtain an authorization code grant.
--- `client_id` (String) Unique identifier issued by AS for the Okta IdP instance.
--- `client_secret` (String, Sensitive) Client secret issued by AS for the Okta IdP instance.
--- `deprovisioned_action` (String) Action for a previously deprovisioned IdP user during authentication.
--- `groups_action` (String) Provisioning action for IdP user's group memberships.
--- `groups_assignment` (Set of String) List of Okta Group IDs.
--- `groups_attribute` (String) IdP user profile attribute name for an array value that contains group memberships.
--- `groups_filter` (Set of String) Whitelist of Okta Group identifiers.
--- `issuer_mode` (String) Indicates whether Okta uses the original Okta org domain URL, or a custom domain URL.
--- `max_clock_skew` (Number) Maximum allowable clock-skew when processing messages from the IdP.
--- `profile_master` (Boolean) Determines if the IdP should act as a source of truth for user profile attributes.
--- `protocol_type` (String) The type of protocol to use.
--- `provisioning_action` (String) Provisioning action for an IdP user during authentication.
--- `scopes` (Set of String) The scopes of the IdP.
--- `status` (String) Status of the IdP.
--- `subject_match_attribute` (String) Okta user profile attribute for matching transformed IdP username.
--- `subject_match_type` (String) Determines the Okta user profile attribute match conditions for account linking and authentication of the transformed IdP username.
--- `suspended_action` (String) Action for a previously suspended IdP user during authentication.
--- `token_binding` (String) The method of making a token request.
--- `token_url` (String) IdP Authorization Server (AS) endpoint to exchange the authorization code grant for an access token.
--- `type` (String) The type of Social IdP. See API docs [Identity Provider Type](https://developer.okta.com/docs/reference/api/idps/#identity-provider-type)
--- `username_template` (String) Okta EL Expression to generate or transform a unique username for the IdP user.
--
--
-diff --git a/docs/data-sources/network_zone.md b/docs/data-sources/network_zone.md
-deleted file mode 100644
-index 7960f9a2..00000000
---- a/docs/data-sources/network_zone.md
-+++ /dev/null
-@@ -1,38 +0,0 @@
-----
--page_title: "Data Source: okta_network_zone"
--description: |-
--  Gets Okta Network Zone.
-----
--
--# Data Source: okta_network_zone
--
--Gets Okta Network Zone.
--
--## Example Usage
--
--```terraform
--data "okta_network_zone" "example" {
--  name = "Block Antarctica"
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Optional
--
--- `id` (String) ID of the network zone to retrieve, conflicts with `name`.
--- `name` (String) Name of the network zone to retrieve, conflicts with `id`.
--
--### Read-Only
--
--- `asns` (Set of String) Format of each array value: a string representation of an ASN numeric value
--- `dynamic_locations` (Set of String) Array of locations ISO-3166-1(2). Format code: countryCode OR countryCode-regionCode
--- `dynamic_proxy_type` (String) Type of proxy being controlled by this network zone
--- `gateways` (Set of String) Array of values in CIDR/range form depending on the way it's been declared (i.e. CIDR will contain /suffix). Please check API docs for examples
--- `proxies` (Set of String) Array of values in CIDR/range form depending on the way it's been declared (i.e. CIDR will contain /suffix). Please check API docs for examples
--- `status` (String) Network Status - can either be ACTIVE or INACTIVE only
--- `type` (String) Type of the Network Zone - can either be IP or DYNAMIC only
--- `usage` (String) Zone's purpose: POLICY or BLOCKLIST
--
--
-diff --git a/docs/data-sources/policy.md b/docs/data-sources/policy.md
-deleted file mode 100644
-index 3cd3c4de..00000000
---- a/docs/data-sources/policy.md
-+++ /dev/null
-@@ -1,33 +0,0 @@
-----
--page_title: "Data Source: okta_policy"
--description: |-
--  Get a policy from Okta.
-----
--
--# Data Source: okta_policy
--
--Get a policy from Okta.
--
--## Example Usage
--
--```terraform
--data "okta_policy" "example" {
--  name = "Password Policy Example"
--  type = "PASSWORD"
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `name` (String) Name of the policy
--- `type` (String) Policy type, see https://developer.okta.com/docs/reference/api/policy/#policy-object
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--- `status` (String) Status of the policy
--
--
-diff --git a/docs/data-sources/role_subscription.md b/docs/data-sources/role_subscription.md
-deleted file mode 100644
-index 5a06fa53..00000000
---- a/docs/data-sources/role_subscription.md
-+++ /dev/null
-@@ -1,33 +0,0 @@
-----
--page_title: "Data Source: okta_role_subscription"
--description: |-
--  Get subscriptions of a Role with a specific type
-----
--
--# Data Source: okta_role_subscription
--
--Get subscriptions of a Role with a specific type
--
--## Example Usage
--
--```terraform
--data "okta_role_subscription" "example" {
--  notification_type = "APP_IMPORT"
--  role_type         = "SUPER_ADMIN"
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `notification_type` (String) Type of the notification
--- `role_type` (String) Type of the role
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--- `status` (String) Status of subscription
--
--
-diff --git a/docs/data-sources/theme.md b/docs/data-sources/theme.md
-deleted file mode 100644
-index b5eaab6c..00000000
---- a/docs/data-sources/theme.md
-+++ /dev/null
-@@ -1,47 +0,0 @@
-----
--page_title: "Data Source: okta_theme"
--description: |-
--  Get a single Theme of a Brand of an Okta Organization.
-----
--
--# Data Source: okta_theme
--
--Get a single Theme of a Brand of an Okta Organization.
--
--## Example Usage
--
--```terraform
--data "okta_brands" "test" {
--}
--
--data "okta_theme" "test" {
--  brand_id = tolist(data.okta_brands.test.brands)[0].id
--  theme_id = tolist(data.okta_themes.test.themes)[0].id
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `brand_id` (String) Brand ID
--- `theme_id` (String) Theme ID
--
--### Read-Only
--
--- `background_image_url` (String) Background image URL
--- `email_template_touch_point_variant` (String) Variant for email templates (`OKTA_DEFAULT`, `FULL_THEME`)
--- `end_user_dashboard_touch_point_variant` (String) Variant for the Okta End-User Dashboard (`OKTA_DEFAULT`, `WHITE_LOGO_BACKGROUND`, `FULL_THEME`, `LOGO_ON_FULL_WHITE_BACKGROUND`)
--- `error_page_touch_point_variant` (String) Variant for the error page (`OKTA_DEFAULT`, `BACKGROUND_SECONDARY_COLOR`, `BACKGROUND_IMAGE`)
--- `favicon_url` (String) Favicon URL
--- `id` (String) The ID of the theme
--- `links` (String) Link relations for this object - JSON HAL - Discoverable resources related to the email template
--- `logo_url` (String) Logo URL
--- `primary_color_contrast_hex` (String) Primary color contrast hex code
--- `primary_color_hex` (String) Primary color hex code
--- `secondary_color_contrast_hex` (String) Secondary color contrast hex code
--- `secondary_color_hex` (String) Secondary color hex code
--- `sign_in_page_touch_point_variant` (String) Variant for the Okta Sign-In Page (`OKTA_DEFAULT`, `BACKGROUND_SECONDARY_COLOR`, `BACKGROUND_IMAGE`)
--
--
-diff --git a/docs/data-sources/themes.md b/docs/data-sources/themes.md
-deleted file mode 100644
-index 431fa452..00000000
---- a/docs/data-sources/themes.md
-+++ /dev/null
-@@ -1,53 +0,0 @@
-----
--page_title: "Data Source: okta_themes"
--description: |-
--  Get Themes of a Brand of an Okta Organization.
-----
--
--# Data Source: okta_themes
--
--Get Themes of a Brand of an Okta Organization.
--
--## Example Usage
--
--```terraform
--data "okta_brands" "test" {
--}
--
--data "okta_themes" "example" {
--  brand_id = tolist(data.okta_brands.test.brands)[0].id
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `brand_id` (String) Brand ID
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--- `themes` (Set of Object) List of `okta_them` belonging to the brand in the organization (see [below for nested schema](#nestedatt--themes))
--
--<a id="nestedatt--themes"></a>
--### Nested Schema for `themes`
--
--Read-Only:
--
--- `background_image_url` (String)
--- `email_template_touch_point_variant` (String)
--- `end_user_dashboard_touch_point_variant` (String)
--- `error_page_touch_point_variant` (String)
--- `favicon_url` (String)
--- `id` (String)
--- `links` (String)
--- `logo_url` (String)
--- `primary_color_contrast_hex` (String)
--- `primary_color_hex` (String)
--- `secondary_color_contrast_hex` (String)
--- `secondary_color_hex` (String)
--- `sign_in_page_touch_point_variant` (String)
--
--
-diff --git a/docs/data-sources/trusted_origins.md b/docs/data-sources/trusted_origins.md
-deleted file mode 100644
-index d7b62def..00000000
---- a/docs/data-sources/trusted_origins.md
-+++ /dev/null
-@@ -1,41 +0,0 @@
-----
--page_title: "Data Source: okta_trusted_origins"
--description: |-
--  Get List of Trusted Origins using filters.
-----
--
--# Data Source: okta_trusted_origins
--
--Get List of Trusted Origins using filters.
--
--## Example Usage
--
--```terraform
--data "okta_trusted_origins" "all" {
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Optional
--
--- `filter` (String) Filter criteria. Filter value will be URL-encoded by the provider
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--- `trusted_origins` (List of Object) (see [below for nested schema](#nestedatt--trusted_origins))
--
--<a id="nestedatt--trusted_origins"></a>
--### Nested Schema for `trusted_origins`
--
--Read-Only:
--
--- `active` (Boolean)
--- `id` (String)
--- `name` (String)
--- `origin` (String)
--- `scopes` (List of String)
--
--
-diff --git a/docs/data-sources/user.md b/docs/data-sources/user.md
-deleted file mode 100644
-index 2c5d99c7..00000000
---- a/docs/data-sources/user.md
-+++ /dev/null
-@@ -1,102 +0,0 @@
-----
--page_title: "Data Source: okta_user"
--description: |-
--  Get a single users from Okta.
-----
--
--# Data Source: okta_user
--
--Get a single users from Okta.
--
--## Example Usage
--
--```terraform
--# Get a single user by their id value
--data "okta_user" "example" {
--  user_id = "00u22mtxlrJ8YkzXQ357"
--}
--
--# Search for a single user based on supported profile properties
--data "okta_user" "example" {
--  search {
--    name  = "profile.firstName"
--    value = "John"
--  }
--
--  search {
--    name  = "profile.lastName"
--    value = "Doe"
--  }
--}
--
--# Search for a single user based on a raw search expression string
--data "okta_user" "example" {
--  search {
--    expression = "profile.firstName eq \"John\""
--  }
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Optional
--
--- `compound_search_operator` (String) Search operator used when joining mulitple search clauses
--- `delay_read_seconds` (String) Force delay of the user read by N seconds. Useful when eventual consistency of user information needs to be allowed for.
--- `search` (Block Set) Filter to find user/users. Each filter will be concatenated with the compound search operator. Please be aware profile properties must match what is in Okta, which is likely camel case. Expression is a free form expression filter https://developer.okta.com/docs/reference/core-okta-api/#filter . The set name/value/comparison properties will be ignored if expression is present (see [below for nested schema](#nestedblock--search))
--- `skip_groups` (Boolean) Do not populate user groups information (prevents additional API call)
--- `skip_roles` (Boolean) Do not populate user roles information (prevents additional API call)
--- `user_id` (String) Retrieve a single user based on their id
--
--### Read-Only
--
--- `admin_roles` (Set of String)
--- `city` (String)
--- `cost_center` (String)
--- `country_code` (String)
--- `custom_profile_attributes` (String)
--- `department` (String)
--- `display_name` (String)
--- `division` (String)
--- `email` (String)
--- `employee_number` (String)
--- `first_name` (String)
--- `group_memberships` (Set of String)
--- `honorific_prefix` (String)
--- `honorific_suffix` (String)
--- `id` (String) The ID of this resource.
--- `last_name` (String)
--- `locale` (String)
--- `login` (String)
--- `manager` (String)
--- `manager_id` (String)
--- `middle_name` (String)
--- `mobile_phone` (String)
--- `nick_name` (String)
--- `organization` (String)
--- `postal_address` (String)
--- `preferred_language` (String)
--- `primary_phone` (String)
--- `profile_url` (String)
--- `roles` (Set of String)
--- `second_email` (String)
--- `state` (String)
--- `status` (String)
--- `street_address` (String)
--- `timezone` (String)
--- `title` (String)
--- `user_type` (String)
--- `zip_code` (String)
--
--<a id="nestedblock--search"></a>
--### Nested Schema for `search`
--
--Optional:
--
--- `comparison` (String)
--- `expression` (String) A raw search expression string. This requires the search feature be on. Please see Okta documentation on their filter API for users. https://developer.okta.com/docs/api/resources/users#list-users-with-search
--- `name` (String) Property name to search for. This requires the search feature be on. Please see Okta documentation on their filter API for users. https://developer.okta.com/docs/api/resources/users#list-users-with-search
--- `value` (String)
--
--
-diff --git a/docs/data-sources/user_profile_mapping_source.md b/docs/data-sources/user_profile_mapping_source.md
-deleted file mode 100644
-index 677a8937..00000000
---- a/docs/data-sources/user_profile_mapping_source.md
-+++ /dev/null
-@@ -1,29 +0,0 @@
-----
--page_title: "Data Source: okta_user_profile_mapping_source"
--description: |-
--  Get the base user Profile Mapping source or target from Okta.
-----
--
--# Data Source: okta_user_profile_mapping_source
--
--Get the base user Profile Mapping source or target from Okta.
--
---> **NOTE:** If using this resource with OAuth2 scopes, this resource 
--requires `okta.profileMappings.read` scope.
--
--## Example Usage
--
--```terraform
--data "okta_user_profile_mapping_source" "example" {}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Read-Only
--
--- `id` (String) ID of the source
--- `name` (String) Name of source.
--- `type` (String) Type of source.
--
--
-diff --git a/docs/data-sources/user_security_questions.md b/docs/data-sources/user_security_questions.md
-deleted file mode 100644
-index fb4e1708..00000000
---- a/docs/data-sources/user_security_questions.md
-+++ /dev/null
-@@ -1,48 +0,0 @@
-----
--page_title: "Data Source: okta_user_security_questions"
--description: |-
--  
-----
--
--# Data Source: okta_user_security_questions
--
--
--
--## Example Usage
--
--```terraform
--resource "okta_user" "example" {
--  first_name = "John"
--  last_name  = "Smith"
--  login      = "john.smith@example.com"
--  email      = "john.smith@example.com"
--}
--
--data "okta_user_security_questions" "example" {
--  user_id = okta_user.example.id
--}
--
--// TODU
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `user_id` (String) ID of a Okta User
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--- `questions` (List of Object) (see [below for nested schema](#nestedatt--questions))
--
--<a id="nestedatt--questions"></a>
--### Nested Schema for `questions`
--
--Read-Only:
--
--- `key` (String)
--- `text` (String)
--
--
-diff --git a/docs/data-sources/user_type.md b/docs/data-sources/user_type.md
-deleted file mode 100644
-index 1cde9123..00000000
---- a/docs/data-sources/user_type.md
-+++ /dev/null
-@@ -1,32 +0,0 @@
-----
--page_title: "Data Source: okta_user_type"
--description: |-
--  Get a user type from Okta.
-----
--
--# Data Source: okta_user_type
--
--Get a user type from Okta.
--
--## Example Usage
--
--```terraform
--data "okta_user_type" "example" {
--  name = "example"
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `name` (String) Name of user type to retrieve.
--
--### Read-Only
--
--- `description` (String) Description of user type.
--- `display_name` (String) Display name of user type.
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/data-sources/users.md b/docs/data-sources/users.md
-deleted file mode 100644
-index 838a7e7b..00000000
---- a/docs/data-sources/users.md
-+++ /dev/null
-@@ -1,119 +0,0 @@
-----
--page_title: "Data Source: okta_users"
--description: |-
--  Get a list of users from Okta.
-----
--
--# Data Source: okta_users
--
--Get a list of users from Okta.
--
--## Example Usage
--
--```terraform
--### Lookup Users by Search Criteria
--
--data "okta_users" "example" {
--  search {
--    name       = "profile.company"
--    value      = "Articulate"
--    comparison = "sw"
--  }
--}
--
--# Search for multiple users based on a raw search expression string
--data "okta_users" "example" {
--  search {
--    expression = "profile.department eq \"Engineering\" and (created lt \"2014-01-01T00:00:00.000Z\" or status eq \"ACTIVE\")"
--  }
--}
--
--### Lookup Users by Group Membership
--
--resource "okta_group" "example" {
--  name = "example-group"
--}
--
--data "okta_users" "example" {
--  group_id = okta_group.example.id
--
--  # optionally include each user's group membership
--  include_groups = true
--
--  # optionally include each user's administrator roles
--  include_roles = true
--}
--```
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Optional
--
--- `compound_search_operator` (String) Search operator used when joining mulitple search clauses
--- `delay_read_seconds` (String) Force delay of the users read by N seconds. Useful when eventual consistency of users information needs to be allowed for.
--- `group_id` (String) Find users based on group membership using the id of the group.
--- `include_groups` (Boolean) Fetch group memberships for each user
--- `include_roles` (Boolean) Fetch user roles for each user
--- `search` (Block Set) Filter to find user/users. Each filter will be concatenated with the compound search operator. Please be aware profile properties must match what is in Okta, which is likely camel case. Expression is a free form expression filter https://developer.okta.com/docs/reference/core-okta-api/#filter . The set name/value/comparison properties will be ignored if expression is present (see [below for nested schema](#nestedblock--search))
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--- `users` (List of Object) collection of users retrieved from Okta. (see [below for nested schema](#nestedatt--users))
--
--<a id="nestedblock--search"></a>
--### Nested Schema for `search`
--
--Optional:
--
--- `comparison` (String)
--- `expression` (String) A raw search expression string. This requires the search feature be on. Please see Okta documentation on their filter API for users. https://developer.okta.com/docs/api/resources/users#list-users-with-search
--- `name` (String) Property name to search for. This requires the search feature be on. Please see Okta documentation on their filter API for users. https://developer.okta.com/docs/api/resources/users#list-users-with-search
--- `value` (String)
--
--
--<a id="nestedatt--users"></a>
--### Nested Schema for `users`
--
--Read-Only:
--
--- `admin_roles` (Set of String)
--- `city` (String)
--- `cost_center` (String)
--- `country_code` (String)
--- `custom_profile_attributes` (String)
--- `department` (String)
--- `display_name` (String)
--- `division` (String)
--- `email` (String)
--- `employee_number` (String)
--- `first_name` (String)
--- `group_memberships` (Set of String)
--- `honorific_prefix` (String)
--- `honorific_suffix` (String)
--- `id` (String)
--- `last_name` (String)
--- `locale` (String)
--- `login` (String)
--- `manager` (String)
--- `manager_id` (String)
--- `middle_name` (String)
--- `mobile_phone` (String)
--- `nick_name` (String)
--- `organization` (String)
--- `postal_address` (String)
--- `preferred_language` (String)
--- `primary_phone` (String)
--- `profile_url` (String)
--- `roles` (Set of String)
--- `second_email` (String)
--- `state` (String)
--- `status` (String)
--- `street_address` (String)
--- `timezone` (String)
--- `title` (String)
--- `user_type` (String)
--- `zip_code` (String)
--
--
-diff --git a/docs/index.md b/docs/index.md
-deleted file mode 100644
-index c110e405..00000000
---- a/docs/index.md
-+++ /dev/null
-@@ -1,36 +0,0 @@
-----
--# generated by https://github.com/hashicorp/terraform-plugin-docs
--page_title: "okta Provider"
--subcategory: ""
--description: |-
--  
-----
--
--# okta Provider
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Optional
--
--- `access_token` (String) Bearer token granting privileges to Okta API.
--- `api_token` (String) API Token granting privileges to Okta API.
--- `backoff` (Boolean) Use exponential back off strategy for rate limits.
--- `base_url` (String) The Okta url. (Use 'oktapreview.com' for Okta testing)
--- `client_id` (String) API Token granting privileges to Okta API.
--- `http_proxy` (String) Alternate HTTP proxy of scheme://hostname or scheme://hostname:port format
--- `log_level` (Number) providers log level. Minimum is 1 (TRACE), and maximum is 5 (ERROR)
--- `max_api_capacity` (Number) (Experimental) sets what percentage of capacity the provider can use of the total rate limit capacity while making calls to the Okta management API endpoints. Okta API operates in one minute buckets. See Okta Management API Rate Limits: https://developer.okta.com/docs/reference/rl-global-mgmt/
--- `max_retries` (Number) maximum number of retries to attempt before erroring out.
--- `max_wait_seconds` (Number) maximum seconds to wait when rate limit is hit. We use exponential backoffs when backoff is enabled.
--- `min_wait_seconds` (Number) minimum seconds to wait when rate limit is hit. We use exponential backoffs when backoff is enabled.
--- `org_name` (String) The organization to manage in Okta.
--- `parallelism` (Number) Number of concurrent requests to make within a resource where bulk operations are not possible. Take note of https://developer.okta.com/docs/api/getting_started/rate-limits.
--- `private_key` (String) API Token granting privileges to Okta API.
--- `private_key_id` (String) API Token Id granting privileges to Okta API.
--- `request_timeout` (Number) Timeout for single request (in seconds) which is made to Okta, the default is `0` (means no limit is set). The maximum value can be `300`.
--- `scopes` (Set of String) API Token granting privileges to Okta API.
-diff --git a/docs/resources/admin_role_custom.md b/docs/resources/admin_role_custom.md
-deleted file mode 100644
-index bf37a297..00000000
---- a/docs/resources/admin_role_custom.md
-+++ /dev/null
-@@ -1,29 +0,0 @@
-----
--page_title: "Resource: okta_admin_role_custom"
--description: |-
--  Resource to manage administrative Role assignments for a User
-----
--
--# Resource: okta_admin_role_custom
--
--Resource to manage administrative Role assignments for a User
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `description` (String) A human-readable description of the new Role
--- `label` (String) The name given to the new Role
--
--### Optional
--
--- `permissions` (Set of String) The permissions that the new Role grants.
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/admin_role_custom_assignments.md b/docs/resources/admin_role_custom_assignments.md
-deleted file mode 100644
-index 9fe46bf0..00000000
---- a/docs/resources/admin_role_custom_assignments.md
-+++ /dev/null
-@@ -1,29 +0,0 @@
-----
--page_title: "Resource: okta_admin_role_custom_assignments"
--description: |-
--  Resource to manage the assignment and unassignment of Custom Roles
-----
--
--# Resource: okta_admin_role_custom_assignments
--
--Resource to manage the assignment and unassignment of Custom Roles
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `custom_role_id` (String) ID of the Custom Role
--- `resource_set_id` (String) ID of the target Resource Set
--
--### Optional
--
--- `members` (Set of String) The hrefs that point to User(s) and/or Group(s) that receive the Role
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/admin_role_targets.md b/docs/resources/admin_role_targets.md
-deleted file mode 100644
-index ea1fffe3..00000000
---- a/docs/resources/admin_role_targets.md
-+++ /dev/null
-@@ -1,31 +0,0 @@
-----
--page_title: "Resource: okta_admin_role_targets"
--description: |-
--  
-----
--
--# Resource: okta_admin_role_targets
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `role_type` (String) Type of the role that is assigned to the user and supports optional targets
--- `user_id` (String) User associated with the role
--
--### Optional
--
--- `apps` (Set of String) List of app names (name represents set of app instances) or a combination of app name and app instance ID (like 'salesforce' or 'facebook.0oapsqQ6dv19pqyEo0g3')
--- `groups` (Set of String) List of group IDs
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--- `role_id` (String) ID of a role
--
--
-diff --git a/docs/resources/app_access_policy_assignment.md b/docs/resources/app_access_policy_assignment.md
-deleted file mode 100644
-index c6fd58a9..00000000
---- a/docs/resources/app_access_policy_assignment.md
-+++ /dev/null
-@@ -1,25 +0,0 @@
-----
--page_title: "Resource: okta_app_access_policy_assignment"
--description: |-
--  Manages assignment of Access Policy to an Application
-----
--
--# Resource: okta_app_access_policy_assignment
--
--Manages assignment of Access Policy to an Application
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `app_id` (String) The application ID; this value is immutable and can not be updated.
--- `policy_id` (String) The access policy ID.
--
--### Read-Only
--
--- `id` (String) The ID of the resource. This ID is simply the application ID.
--
--
-diff --git a/docs/resources/app_auto_login.md b/docs/resources/app_auto_login.md
-deleted file mode 100644
-index 65da7d47..00000000
---- a/docs/resources/app_auto_login.md
-+++ /dev/null
-@@ -1,63 +0,0 @@
-----
--page_title: "Resource: okta_app_auto_login"
--description: |-
--  
-----
--
--# Resource: okta_app_auto_login
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `label` (String) Pretty name of app.
--
--### Optional
--
--- `accessibility_error_redirect_url` (String) Custom error page URL
--- `accessibility_login_redirect_url` (String) Custom login page URL
--- `accessibility_self_service` (Boolean) Enable self service
--- `admin_note` (String) Application notes for admins.
--- `app_links_json` (String) Displays specific appLinks for the app
--- `app_settings_json` (String) Application settings in JSON format
--- `auto_submit_toolbar` (Boolean) Display auto submit toolbar
--- `credentials_scheme` (String) Application credentials scheme
--- `enduser_note` (String) Application notes for end users.
--- `hide_ios` (Boolean) Do not display application icon on mobile app
--- `hide_web` (Boolean) Do not display application icon to users
--- `logo` (String) Local path to logo of the application.
--- `preconfigured_app` (String) Preconfigured app name
--- `reveal_password` (Boolean) Allow user to reveal password
--- `shared_password` (String) Shared password, required for certain schemes.
--- `shared_username` (String) Shared username, required for certain schemes.
--- `sign_on_redirect_url` (String) Post login redirect URL
--- `sign_on_url` (String) Login URL
--- `status` (String) Status of application.
--- `timeouts` (Block, Optional) (see [below for nested schema](#nestedblock--timeouts))
--- `user_name_template` (String) Username template
--- `user_name_template_push_status` (String) Push username on update
--- `user_name_template_suffix` (String) Username template suffix
--- `user_name_template_type` (String) Username template type
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--- `logo_url` (String) URL of the application's logo
--- `name` (String) Name of the app.
--- `sign_on_mode` (String) Sign on mode of application.
--
--<a id="nestedblock--timeouts"></a>
--### Nested Schema for `timeouts`
--
--Optional:
--
--- `create` (String)
--- `read` (String)
--- `update` (String)
--
--
-diff --git a/docs/resources/app_basic_auth.md b/docs/resources/app_basic_auth.md
-deleted file mode 100644
-index 4bd25180..00000000
---- a/docs/resources/app_basic_auth.md
-+++ /dev/null
-@@ -1,53 +0,0 @@
-----
--page_title: "Resource: okta_app_basic_auth"
--description: |-
--  
-----
--
--# Resource: okta_app_basic_auth
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `auth_url` (String) Login button field
--- `label` (String) Pretty name of app.
--- `url` (String) Login password field
--
--### Optional
--
--- `accessibility_error_redirect_url` (String) Custom error page URL
--- `accessibility_login_redirect_url` (String) Custom login page URL
--- `accessibility_self_service` (Boolean) Enable self service
--- `admin_note` (String) Application notes for admins.
--- `app_links_json` (String) Displays specific appLinks for the app
--- `auto_submit_toolbar` (Boolean) Display auto submit toolbar
--- `enduser_note` (String) Application notes for end users.
--- `hide_ios` (Boolean) Do not display application icon on mobile app
--- `hide_web` (Boolean) Do not display application icon to users
--- `logo` (String) Local path to logo of the application.
--- `status` (String) Status of application.
--- `timeouts` (Block, Optional) (see [below for nested schema](#nestedblock--timeouts))
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--- `logo_url` (String) URL of the application's logo
--- `name` (String) Name of the app.
--- `sign_on_mode` (String) Sign on mode of application.
--
--<a id="nestedblock--timeouts"></a>
--### Nested Schema for `timeouts`
--
--Optional:
--
--- `create` (String)
--- `read` (String)
--- `update` (String)
--
--
-diff --git a/docs/resources/app_bookmark.md b/docs/resources/app_bookmark.md
-deleted file mode 100644
-index 1ac2078e..00000000
---- a/docs/resources/app_bookmark.md
-+++ /dev/null
-@@ -1,54 +0,0 @@
-----
--page_title: "Resource: okta_app_bookmark"
--description: |-
--  
-----
--
--# Resource: okta_app_bookmark
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `label` (String) Pretty name of app.
--- `url` (String)
--
--### Optional
--
--- `accessibility_error_redirect_url` (String) Custom error page URL
--- `accessibility_login_redirect_url` (String) Custom login page URL
--- `accessibility_self_service` (Boolean) Enable self service
--- `admin_note` (String) Application notes for admins.
--- `app_links_json` (String) Displays specific appLinks for the app
--- `authentication_policy` (String) Id of this apps authentication policy
--- `auto_submit_toolbar` (Boolean) Display auto submit toolbar
--- `enduser_note` (String) Application notes for end users.
--- `hide_ios` (Boolean) Do not display application icon on mobile app
--- `hide_web` (Boolean) Do not display application icon to users
--- `logo` (String) Local path to logo of the application.
--- `request_integration` (Boolean) Would you like Okta to add an integration for this app?
--- `status` (String) Status of application.
--- `timeouts` (Block, Optional) (see [below for nested schema](#nestedblock--timeouts))
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--- `logo_url` (String) URL of the application's logo
--- `name` (String) Name of the app.
--- `sign_on_mode` (String) Sign on mode of application.
--
--<a id="nestedblock--timeouts"></a>
--### Nested Schema for `timeouts`
--
--Optional:
--
--- `create` (String)
--- `read` (String)
--- `update` (String)
--
--
-diff --git a/docs/resources/app_group_assignment.md b/docs/resources/app_group_assignment.md
-deleted file mode 100644
-index 176ac6ff..00000000
---- a/docs/resources/app_group_assignment.md
-+++ /dev/null
-@@ -1,41 +0,0 @@
-----
--page_title: "Resource: okta_app_group_assignment"
--description: |-
--  
-----
--
--# Resource: okta_app_group_assignment
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `app_id` (String) App to associate group with
--- `group_id` (String) Group associated with the application
--
--### Optional
--
--- `priority` (Number) Priority of group assignment.
--- `profile` (String) JSON document containing [application profile](https://developer.okta.com/docs/reference/api/apps/#profile-object)
--- `retain_assignment` (Boolean) Retain the group assignment on destroy. If set to true, the resource will be removed from state but not from the Okta app.
--- `timeouts` (Block, Optional) (see [below for nested schema](#nestedblock--timeouts))
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--<a id="nestedblock--timeouts"></a>
--### Nested Schema for `timeouts`
--
--Optional:
--
--- `create` (String)
--- `read` (String)
--- `update` (String)
--
--
-diff --git a/docs/resources/app_group_assignments.md b/docs/resources/app_group_assignments.md
-deleted file mode 100644
-index 00603c21..00000000
---- a/docs/resources/app_group_assignments.md
-+++ /dev/null
-@@ -1,37 +0,0 @@
-----
--page_title: "Resource: okta_app_group_assignments"
--description: |-
--  
-----
--
--# Resource: okta_app_group_assignments
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `app_id` (String) The ID of the application to assign a group to.
--- `group` (Block List, Min: 1) A group to assign to this application (see [below for nested schema](#nestedblock--group))
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--<a id="nestedblock--group"></a>
--### Nested Schema for `group`
--
--Required:
--
--- `id` (String) A group to associate with the application
--
--Optional:
--
--- `priority` (Number) Priority of group assignment
--- `profile` (String) JSON document containing [application profile](https://developer.okta.com/docs/reference/api/apps/#profile-object)
--
--
-diff --git a/docs/resources/app_oauth.md b/docs/resources/app_oauth.md
-deleted file mode 100644
-index c77beefe..00000000
---- a/docs/resources/app_oauth.md
-+++ /dev/null
-@@ -1,118 +0,0 @@
-----
--page_title: "Resource: okta_app_oauth"
--description: |-
--  
-----
--
--# Resource: okta_app_oauth
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `label` (String) Pretty name of app.
--- `type` (String) The type of client application.
--
--### Optional
--
--- `accessibility_error_redirect_url` (String) Custom error page URL
--- `accessibility_login_redirect_url` (String) Custom login page URL
--- `accessibility_self_service` (Boolean) Enable self service
--- `admin_note` (String) Application notes for admins.
--- `app_links_json` (String) Displays specific appLinks for the app
--- `app_settings_json` (String) Application settings in JSON format
--- `authentication_policy` (String) Id of this apps authentication policy
--- `auto_key_rotation` (Boolean) Requested key rotation mode.
--- `auto_submit_toolbar` (Boolean) Display auto submit toolbar
--- `client_basic_secret` (String, Sensitive) OAuth client secret key, this can be set when token_endpoint_auth_method is client_secret_basic.
--- `client_id` (String) OAuth client ID. If set during creation, app is created with this id.
--- `client_uri` (String) URI to a web page providing information about the client.
--- `consent_method` (String) *Early Access Property*. Indicates whether user consent is required or implicit. Valid values: REQUIRED, TRUSTED. Default value is TRUSTED
--- `enduser_note` (String) Application notes for end users.
--- `grant_types` (Set of String) List of OAuth 2.0 grant types. Conditional validation params found here https://developer.okta.com/docs/api/resources/apps#credentials-settings-details. Defaults to minimum requirements per app type.
--- `groups_claim` (Block Set, Max: 1) Groups claim for an OpenID Connect client application (argument is ignored when API auth is done with OAuth 2.0 credentials) (see [below for nested schema](#nestedblock--groups_claim))
--- `hide_ios` (Boolean) Do not display application icon on mobile app
--- `hide_web` (Boolean) Do not display application icon to users
--- `implicit_assignment` (Boolean) *Early Access Property*. Enable Federation Broker Mode.
--- `issuer_mode` (String) *Early Access Property*. Indicates whether the Okta Authorization Server uses the original Okta org domain URL or a custom domain URL as the issuer of ID token for this client.
--- `jwks` (Block List) (see [below for nested schema](#nestedblock--jwks))
--- `jwks_uri` (String) URL reference to JWKS
--- `login_mode` (String) The type of Idp-Initiated login that the client supports, if any
--- `login_scopes` (Set of String) List of scopes to use for the request
--- `login_uri` (String) URI that initiates login.
--- `logo` (String) Local path to logo of the application.
--- `logo_uri` (String) URI that references a logo for the client.
--- `omit_secret` (Boolean) This tells the provider not to persist the application's secret to state. If this is ever changes from true => false your app will be recreated.
--- `pkce_required` (Boolean) Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See: https://developer.okta.com/docs/reference/api/apps/#oauth-credential-object
--- `policy_uri` (String) URI to web page providing client policy document.
--- `post_logout_redirect_uris` (Set of String) List of URIs for redirection after logout. Note: see okta_app_oauth_post_logout_redirect_uri for appending to this list in a decentralized way.
--- `profile` (String) Custom JSON that represents an OAuth application's profile
--- `redirect_uris` (List of String) List of URIs for use in the redirect-based flow. This is required for all application types except service. Note: see okta_app_oauth_redirect_uri for appending to this list in a decentralized way.
--- `refresh_token_leeway` (Number) *Early Access Property* Grace period for token rotation
--- `refresh_token_rotation` (String) *Early Access Property* Refresh token rotation behavior
--- `response_types` (Set of String) List of OAuth 2.0 response type strings.
--- `status` (String) Status of application.
--- `timeouts` (Block, Optional) (see [below for nested schema](#nestedblock--timeouts))
--- `token_endpoint_auth_method` (String) Requested authentication method for the token endpoint.
--- `tos_uri` (String) URI to web page providing client tos (terms of service).
--- `user_name_template` (String) Username template
--- `user_name_template_push_status` (String) Push username on update
--- `user_name_template_suffix` (String) Username template suffix
--- `user_name_template_type` (String) Username template type
--- `wildcard_redirect` (String) *Early Access Property*. Indicates if the client is allowed to use wildcard matching of redirect_uris
--
--### Read-Only
--
--- `client_secret` (String, Sensitive) OAuth client secret key. This will be in plain text in your statefile unless you set omit_secret above.
--- `id` (String) The ID of this resource.
--- `logo_url` (String) URL of the application's logo
--- `name` (String) Name of the app.
--- `sign_on_mode` (String) Sign on mode of application.
--
--<a id="nestedblock--groups_claim"></a>
--### Nested Schema for `groups_claim`
--
--Required:
--
--- `name` (String) Name of the claim that will be used in the token.
--- `type` (String) Groups claim type.
--- `value` (String) Value of the claim. Can be an Okta Expression Language statement that evaluates at the time the token is minted.
--
--Optional:
--
--- `filter_type` (String) Groups claim filter. Can only be set if type is FILTER.
--
--Read-Only:
--
--- `issuer_mode` (String) Issuer mode inherited from OAuth App
--
--
--<a id="nestedblock--jwks"></a>
--### Nested Schema for `jwks`
--
--Required:
--
--- `kid` (String) Key ID
--- `kty` (String) Key type
--
--Optional:
--
--- `e` (String) RSA Exponent
--- `n` (String) RSA Modulus
--
--
--<a id="nestedblock--timeouts"></a>
--### Nested Schema for `timeouts`
--
--Optional:
--
--- `create` (String)
--- `read` (String)
--- `update` (String)
--
--
-diff --git a/docs/resources/app_oauth_api_scope.md b/docs/resources/app_oauth_api_scope.md
-deleted file mode 100644
-index d594e0c4..00000000
---- a/docs/resources/app_oauth_api_scope.md
-+++ /dev/null
-@@ -1,26 +0,0 @@
-----
--page_title: "Resource: okta_app_oauth_api_scope"
--description: |-
--  
-----
--
--# Resource: okta_app_oauth_api_scope
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `app_id` (String) ID of the application.
--- `issuer` (String) The issuer of your Org Authorization Server, your Org URL.
--- `scopes` (Set of String) Scopes of the application for which consent is granted.
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/app_oauth_post_logout_redirect_uri.md b/docs/resources/app_oauth_post_logout_redirect_uri.md
-deleted file mode 100644
-index e37ddd2f..00000000
---- a/docs/resources/app_oauth_post_logout_redirect_uri.md
-+++ /dev/null
-@@ -1,25 +0,0 @@
-----
--page_title: "Resource: okta_app_oauth_post_logout_redirect_uri"
--description: |-
--  
-----
--
--# Resource: okta_app_oauth_post_logout_redirect_uri
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `app_id` (String) OAuth application ID.
--- `uri` (String) Post Logout Redirect URI to append to Okta OIDC application.
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/app_oauth_redirect_uri.md b/docs/resources/app_oauth_redirect_uri.md
-deleted file mode 100644
-index 0bf6d4cf..00000000
---- a/docs/resources/app_oauth_redirect_uri.md
-+++ /dev/null
-@@ -1,25 +0,0 @@
-----
--page_title: "Resource: okta_app_oauth_redirect_uri"
--description: |-
--  
-----
--
--# Resource: okta_app_oauth_redirect_uri
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `app_id` (String) OAuth application ID.
--- `uri` (String) Redirect URI to append to Okta OIDC application.
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/app_saml.md b/docs/resources/app_saml.md
-deleted file mode 100644
-index f7d4a71b..00000000
---- a/docs/resources/app_saml.md
-+++ /dev/null
-@@ -1,129 +0,0 @@
-----
--page_title: "Resource: okta_app_saml"
--description: |-
--  
-----
--
--# Resource: okta_app_saml
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `label` (String) Pretty name of app.
--
--### Optional
--
--- `accessibility_error_redirect_url` (String) Custom error page URL
--- `accessibility_login_redirect_url` (String) Custom login page URL
--- `accessibility_self_service` (Boolean) Enable self service
--- `acs_endpoints` (Set of String) List of ACS endpoints for this SAML application
--- `admin_note` (String) Application notes for admins.
--- `app_links_json` (String) Displays specific appLinks for the app
--- `app_settings_json` (String) Application settings in JSON format
--- `assertion_signed` (Boolean) Determines whether the SAML assertion is digitally signed
--- `attribute_statements` (Block List) (see [below for nested schema](#nestedblock--attribute_statements))
--- `audience` (String) Audience Restriction
--- `authentication_policy` (String) Id of this apps authentication policy
--- `authn_context_class_ref` (String) Identifies the SAML authentication context class for the assertion’s authentication statement
--- `auto_submit_toolbar` (Boolean) Display auto submit toolbar
--- `default_relay_state` (String) Identifies a specific application resource in an IDP initiated SSO scenario.
--- `destination` (String) Identifies the location where the SAML response is intended to be sent inside of the SAML assertion
--- `digest_algorithm` (String) Determines the digest algorithm used to digitally sign the SAML assertion and response
--- `enduser_note` (String) Application notes for end users.
--- `hide_ios` (Boolean) Do not display application icon on mobile app
--- `hide_web` (Boolean) Do not display application icon to users
--- `honor_force_authn` (Boolean) Prompt user to re-authenticate if SP asks for it
--- `idp_issuer` (String) SAML issuer ID
--- `implicit_assignment` (Boolean) *Early Access Property*. Enable Federation Broker Mode.
--- `inline_hook_id` (String) Saml Inline Hook setting
--- `key_name` (String) Certificate name. This modulates the rotation of keys. New name == new key.
--- `key_years_valid` (Number) Number of years the certificate is valid.
--- `logo` (String) Local path to logo of the application.
--- `preconfigured_app` (String) Name of preexisting SAML application. For instance 'slack'
--- `recipient` (String) The location where the app may present the SAML assertion
--- `request_compressed` (Boolean) Denotes whether the request is compressed or not.
--- `response_signed` (Boolean) Determines whether the SAML auth response message is digitally signed
--- `saml_signed_request_enabled` (Boolean) SAML Signed Request enabled
--- `saml_version` (String) SAML version for the app's sign-on mode
--- `signature_algorithm` (String) Signature algorithm used ot digitally sign the assertion and response
--- `single_logout_certificate` (String) x509 encoded certificate that the Service Provider uses to sign Single Logout requests
--- `single_logout_issuer` (String) The issuer of the Service Provider that generates the Single Logout request
--- `single_logout_url` (String) The location where the logout response is sent
--- `sp_issuer` (String) SAML SP issuer ID
--- `sso_url` (String) Single Sign On URL
--- `status` (String) Status of application.
--- `subject_name_id_format` (String) Identifies the SAML processing rules.
--- `subject_name_id_template` (String) Template for app user's username when a user is assigned to the app
--- `timeouts` (Block, Optional) (see [below for nested schema](#nestedblock--timeouts))
--- `user_name_template` (String) Username template
--- `user_name_template_push_status` (String) Push username on update
--- `user_name_template_suffix` (String) Username template suffix
--- `user_name_template_type` (String) Username template type
--
--### Read-Only
--
--- `certificate` (String) cert from SAML XML metadata payload
--- `embed_url` (String) The url that can be used to embed this application in other portals.
--- `entity_key` (String) Entity ID, the ID portion of the entity_url
--- `entity_url` (String) Entity URL for instance http://www.okta.com/exk1fcia6d6EMsf331d8
--- `features` (Set of String) features to enable
--- `http_post_binding` (String) urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Post location from the SAML metadata.
--- `http_redirect_binding` (String) urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect location from the SAML metadata.
--- `id` (String) The ID of this resource.
--- `key_id` (String) Certificate ID
--- `keys` (List of Object) Application keys (see [below for nested schema](#nestedatt--keys))
--- `logo_url` (String) URL of the application's logo
--- `metadata` (String) SAML xml metadata payload
--- `metadata_url` (String) SAML xml metadata URL
--- `name` (String) Name of the app.
--- `sign_on_mode` (String) Sign on mode of application.
--
--<a id="nestedblock--attribute_statements"></a>
--### Nested Schema for `attribute_statements`
--
--Required:
--
--- `name` (String) The reference name of the attribute statement
--
--Optional:
--
--- `filter_type` (String) Type of group attribute filter
--- `filter_value` (String) Filter value to use
--- `namespace` (String) The name format of the attribute
--- `type` (String) The type of attribute statements object
--- `values` (List of String)
--
--
--<a id="nestedblock--timeouts"></a>
--### Nested Schema for `timeouts`
--
--Optional:
--
--- `create` (String)
--- `read` (String)
--- `update` (String)
--
--
--<a id="nestedatt--keys"></a>
--### Nested Schema for `keys`
--
--Read-Only:
--
--- `created` (String)
--- `e` (String)
--- `expires_at` (String)
--- `kid` (String)
--- `kty` (String)
--- `last_updated` (String)
--- `n` (String)
--- `use` (String)
--- `x5c` (List of String)
--- `x5t_s256` (String)
--
--
-diff --git a/docs/resources/app_saml_app_settings.md b/docs/resources/app_saml_app_settings.md
-deleted file mode 100644
-index 4aecd14b..00000000
---- a/docs/resources/app_saml_app_settings.md
-+++ /dev/null
-@@ -1,25 +0,0 @@
-----
--page_title: "Resource: okta_app_saml_app_settings"
--description: |-
--  
-----
--
--# Resource: okta_app_saml_app_settings
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `app_id` (String) Application ID
--- `settings` (String) Application settings in JSON format
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/app_secure_password_store.md b/docs/resources/app_secure_password_store.md
-deleted file mode 100644
-index 4d08a70d..00000000
---- a/docs/resources/app_secure_password_store.md
-+++ /dev/null
-@@ -1,68 +0,0 @@
-----
--page_title: "Resource: okta_app_secure_password_store"
--description: |-
--  
-----
--
--# Resource: okta_app_secure_password_store
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `label` (String) Pretty name of app.
--- `password_field` (String) Login password field
--- `url` (String) Login URL
--- `username_field` (String) Login username field
--
--### Optional
--
--- `accessibility_error_redirect_url` (String) Custom error page URL
--- `accessibility_login_redirect_url` (String) Custom login page URL
--- `accessibility_self_service` (Boolean) Enable self service
--- `admin_note` (String) Application notes for admins.
--- `app_links_json` (String) Displays specific appLinks for the app
--- `auto_submit_toolbar` (Boolean) Display auto submit toolbar
--- `credentials_scheme` (String) Application credentials scheme
--- `enduser_note` (String) Application notes for end users.
--- `hide_ios` (Boolean) Do not display application icon on mobile app
--- `hide_web` (Boolean) Do not display application icon to users
--- `logo` (String) Local path to logo of the application.
--- `optional_field1` (String) Name of optional param in the login form
--- `optional_field1_value` (String) Name of optional value in login form
--- `optional_field2` (String) Name of optional param in the login form
--- `optional_field2_value` (String) Name of optional value in login form
--- `optional_field3` (String) Name of optional param in the login form
--- `optional_field3_value` (String) Name of optional value in login form
--- `reveal_password` (Boolean) Allow user to reveal password
--- `shared_password` (String) Shared password, required for certain schemes.
--- `shared_username` (String) Shared username, required for certain schemes.
--- `status` (String) Status of application.
--- `timeouts` (Block, Optional) (see [below for nested schema](#nestedblock--timeouts))
--- `user_name_template` (String) Username template
--- `user_name_template_push_status` (String) Push username on update
--- `user_name_template_suffix` (String) Username template suffix
--- `user_name_template_type` (String) Username template type
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--- `logo_url` (String) URL of the application's logo
--- `name` (String) Name of the app.
--- `sign_on_mode` (String) Sign on mode of application.
--
--<a id="nestedblock--timeouts"></a>
--### Nested Schema for `timeouts`
--
--Optional:
--
--- `create` (String)
--- `read` (String)
--- `update` (String)
--
--
-diff --git a/docs/resources/app_shared_credentials.md b/docs/resources/app_shared_credentials.md
-deleted file mode 100644
-index 2d249053..00000000
---- a/docs/resources/app_shared_credentials.md
-+++ /dev/null
-@@ -1,65 +0,0 @@
-----
--page_title: "Resource: okta_app_shared_credentials"
--description: |-
--  
-----
--
--# Resource: okta_app_shared_credentials
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `label` (String) Pretty name of app.
--
--### Optional
--
--- `accessibility_error_redirect_url` (String) Custom error page URL
--- `accessibility_login_redirect_url` (String) Custom login page URL
--- `accessibility_self_service` (Boolean) Enable self service
--- `admin_note` (String) Application notes for admins.
--- `app_links_json` (String) Displays specific appLinks for the app
--- `auto_submit_toolbar` (Boolean) Display auto submit toolbar
--- `button_field` (String) Login button field
--- `checkbox` (String) CSS selector for the checkbox
--- `enduser_note` (String) Application notes for end users.
--- `hide_ios` (Boolean) Do not display application icon on mobile app
--- `hide_web` (Boolean) Do not display application icon to users
--- `logo` (String) Local path to logo of the application.
--- `password_field` (String) Login password field
--- `preconfigured_app` (String) Preconfigured app name
--- `redirect_url` (String) Secondary URL of the sign-in page for this app
--- `shared_password` (String) Shared password, required for certain schemes.
--- `shared_username` (String) Shared username, required for certain schemes.
--- `status` (String) Status of application.
--- `timeouts` (Block, Optional) (see [below for nested schema](#nestedblock--timeouts))
--- `url` (String) Login URL
--- `url_regex` (String) A regex that further restricts URL to the specified regex
--- `user_name_template` (String) Username template
--- `user_name_template_push_status` (String) Push username on update
--- `user_name_template_suffix` (String) Username template suffix
--- `user_name_template_type` (String) Username template type
--- `username_field` (String) Login username field
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--- `logo_url` (String) URL of the application's logo
--- `name` (String) Name of the app.
--- `sign_on_mode` (String) Sign on mode of application.
--
--<a id="nestedblock--timeouts"></a>
--### Nested Schema for `timeouts`
--
--Optional:
--
--- `create` (String)
--- `read` (String)
--- `update` (String)
--
--
-diff --git a/docs/resources/app_signon_policy.md b/docs/resources/app_signon_policy.md
-deleted file mode 100644
-index 87409bda..00000000
---- a/docs/resources/app_signon_policy.md
-+++ /dev/null
-@@ -1,25 +0,0 @@
-----
--page_title: "Resource: okta_app_signon_policy"
--description: |-
--  
-----
--
--# Resource: okta_app_signon_policy
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `description` (String) Policy Description
--- `name` (String) Policy Name
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/app_signon_policy_rule.md b/docs/resources/app_signon_policy_rule.md
-deleted file mode 100644
-index c377ee2e..00000000
---- a/docs/resources/app_signon_policy_rule.md
-+++ /dev/null
-@@ -1,59 +0,0 @@
-----
--page_title: "Resource: okta_app_signon_policy_rule"
--description: |-
--  
-----
--
--# Resource: okta_app_signon_policy_rule
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `name` (String) Policy Rule Name
--- `policy_id` (String) ID of the policy
--
--### Optional
--
--- `access` (String) Allow or deny access based on the rule conditions: ALLOW or DENY
--- `constraints` (List of String) An array that contains nested Authenticator Constraint objects that are organized by the Authenticator class
--- `custom_expression` (String) This is an optional advanced setting. If the expression is formatted incorrectly or conflicts with conditions set above, the rule may not match any users.
--- `device_assurances_included` (Set of String) List of device assurance IDs to include
--- `device_is_managed` (Boolean) If the device is managed. A device is managed if it's managed by a device management system. When managed is passed, registered must also be included and must be set to true.
--- `device_is_registered` (Boolean) If the device is registered. A device is registered if the User enrolls with Okta Verify that is installed on the device.
--- `factor_mode` (String) The number of factors required to satisfy this assurance level
--- `groups_excluded` (Set of String) List of group IDs to exclude
--- `groups_included` (Set of String) List of group IDs to include
--- `inactivity_period` (String) The inactivity duration after which the end user must re-authenticate. Use the ISO 8601 Period format for recurring time intervals.
--- `network_connection` (String) Network selection mode: ANYWHERE, ZONE, ON_NETWORK, or OFF_NETWORK.
--- `network_excludes` (List of String) The zones to exclude
--- `network_includes` (List of String) The zones to include
--- `platform_include` (Block Set) (see [below for nested schema](#nestedblock--platform_include))
--- `priority` (Number) Priority of the rule.
--- `re_authentication_frequency` (String) The duration after which the end user must re-authenticate, regardless of user activity. Use the ISO 8601 Period format for recurring time intervals. PT0S - Every sign-in attempt, PT43800H - Once per session
--- `status` (String) Status of the rule
--- `type` (String) The Verification Method type
--- `user_types_excluded` (Set of String) Set of User Type IDs to exclude
--- `user_types_included` (Set of String) Set of User Type IDs to include
--- `users_excluded` (Set of String) Set of User IDs to exclude
--- `users_included` (Set of String) Set of User IDs to include
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--<a id="nestedblock--platform_include"></a>
--### Nested Schema for `platform_include`
--
--Optional:
--
--- `os_expression` (String) Only available with OTHER OS type
--- `os_type` (String)
--- `type` (String)
--
--
-diff --git a/docs/resources/app_swa.md b/docs/resources/app_swa.md
-deleted file mode 100644
-index 70a797a4..00000000
---- a/docs/resources/app_swa.md
-+++ /dev/null
-@@ -1,63 +0,0 @@
-----
--page_title: "Resource: okta_app_swa"
--description: |-
--  
-----
--
--# Resource: okta_app_swa
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `label` (String) Pretty name of app.
--
--### Optional
--
--- `accessibility_error_redirect_url` (String) Custom error page URL
--- `accessibility_login_redirect_url` (String) Custom login page URL
--- `accessibility_self_service` (Boolean) Enable self service
--- `admin_note` (String) Application notes for admins.
--- `app_links_json` (String) Displays specific appLinks for the app
--- `auto_submit_toolbar` (Boolean) Display auto submit toolbar
--- `button_field` (String) Login button field
--- `checkbox` (String) CSS selector for the checkbox
--- `enduser_note` (String) Application notes for end users.
--- `hide_ios` (Boolean) Do not display application icon on mobile app
--- `hide_web` (Boolean) Do not display application icon to users
--- `logo` (String) Local path to logo of the application.
--- `password_field` (String) Login password field
--- `preconfigured_app` (String) Preconfigured app name
--- `redirect_url` (String) If going to the login page URL redirects to another page, then enter that URL here
--- `status` (String) Status of application.
--- `timeouts` (Block, Optional) (see [below for nested schema](#nestedblock--timeouts))
--- `url` (String) Login URL
--- `url_regex` (String) A regex that further restricts URL to the specified regex
--- `user_name_template` (String) Username template
--- `user_name_template_push_status` (String) Push username on update
--- `user_name_template_suffix` (String) Username template suffix
--- `user_name_template_type` (String) Username template type
--- `username_field` (String) Login username field
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--- `logo_url` (String) URL of the application's logo
--- `name` (String) Name of the app.
--- `sign_on_mode` (String) Sign on mode of application.
--
--<a id="nestedblock--timeouts"></a>
--### Nested Schema for `timeouts`
--
--Optional:
--
--- `create` (String)
--- `read` (String)
--- `update` (String)
--
--
-diff --git a/docs/resources/app_three_field.md b/docs/resources/app_three_field.md
-deleted file mode 100644
-index 15f6f2c3..00000000
---- a/docs/resources/app_three_field.md
-+++ /dev/null
-@@ -1,66 +0,0 @@
-----
--page_title: "Resource: okta_app_three_field"
--description: |-
--  
-----
--
--# Resource: okta_app_three_field
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `button_selector` (String) Login button field CSS selector
--- `extra_field_selector` (String) Extra field CSS selector
--- `extra_field_value` (String) Value for extra form field
--- `label` (String) Pretty name of app.
--- `password_selector` (String) Login password field CSS selector
--- `url` (String) Login URL
--- `username_selector` (String) Login username field CSS selector
--
--### Optional
--
--- `accessibility_error_redirect_url` (String) Custom error page URL
--- `accessibility_login_redirect_url` (String) Custom login page URL
--- `accessibility_self_service` (Boolean) Enable self service
--- `admin_note` (String) Application notes for admins.
--- `app_links_json` (String) Displays specific appLinks for the app
--- `auto_submit_toolbar` (Boolean) Display auto submit toolbar
--- `credentials_scheme` (String) Application credentials scheme
--- `enduser_note` (String) Application notes for end users.
--- `hide_ios` (Boolean) Do not display application icon on mobile app
--- `hide_web` (Boolean) Do not display application icon to users
--- `logo` (String) Local path to logo of the application.
--- `reveal_password` (Boolean) Allow user to reveal password
--- `shared_password` (String) Shared password, required for certain schemes.
--- `shared_username` (String) Shared username, required for certain schemes.
--- `status` (String) Status of application.
--- `timeouts` (Block, Optional) (see [below for nested schema](#nestedblock--timeouts))
--- `url_regex` (String) A regex that further restricts URL to the specified regex
--- `user_name_template` (String) Username template
--- `user_name_template_push_status` (String) Push username on update
--- `user_name_template_suffix` (String) Username template suffix
--- `user_name_template_type` (String) Username template type
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--- `logo_url` (String) URL of the application's logo
--- `name` (String) Name of the app.
--- `sign_on_mode` (String) Sign on mode of application.
--
--<a id="nestedblock--timeouts"></a>
--### Nested Schema for `timeouts`
--
--Optional:
--
--- `create` (String)
--- `read` (String)
--- `update` (String)
--
--
-diff --git a/docs/resources/app_user.md b/docs/resources/app_user.md
-deleted file mode 100644
-index ee697a60..00000000
---- a/docs/resources/app_user.md
-+++ /dev/null
-@@ -1,33 +0,0 @@
-----
--page_title: "Resource: okta_app_user"
--description: |-
--  
-----
--
--# Resource: okta_app_user
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `app_id` (String) App to associate user with
--- `user_id` (String) User associated with the application
--
--### Optional
--
--- `password` (String, Sensitive) The password to use.
--- `profile` (String) The JSON profile of the App User.
--- `retain_assignment` (Boolean) Retain the user assignment on destroy. If set to true, the resource will be removed from state but not from the Okta app.
--- `username` (String) The username to use for the app user. In case the user is assigned to the app with `SHARED_USERNAME_AND_PASSWORD` credentials scheme, this field will be computed and should not be set.
--
--### Read-Only
--
--- `has_shared_username` (Boolean)
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/app_user_base_schema_property.md b/docs/resources/app_user_base_schema_property.md
-deleted file mode 100644
-index 4a5742d5..00000000
---- a/docs/resources/app_user_base_schema_property.md
-+++ /dev/null
-@@ -1,35 +0,0 @@
-----
--page_title: "Resource: okta_app_user_base_schema_property"
--description: |-
--  
-----
--
--# Resource: okta_app_user_base_schema_property
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `app_id` (String) The Application's ID the user schema property should be assigned to.
--- `index` (String) Subschema unique string identifier
--- `title` (String) Subschema title (display name)
--- `type` (String) Subschema type: string, boolean, number, integer, array, or object
--
--### Optional
--
--- `master` (String) SubSchema profile manager, if not set it will inherit its setting.
--- `pattern` (String) The validation pattern to use for the subschema. Must be in form of '.+', or '[<pattern>]+' if present.'
--- `permissions` (String) SubSchema permissions: HIDE, READ_ONLY, or READ_WRITE.
--- `required` (Boolean) Whether the subschema is required
--- `user_type` (String) Custom subschema user type
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/app_user_schema_property.md b/docs/resources/app_user_schema_property.md
-deleted file mode 100644
-index 8689443b..00000000
---- a/docs/resources/app_user_schema_property.md
-+++ /dev/null
-@@ -1,64 +0,0 @@
-----
--page_title: "Resource: okta_app_user_schema_property"
--description: |-
--  
-----
--
--# Resource: okta_app_user_schema_property
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `app_id` (String) The Application's ID the user custom schema property should be assigned to.
--- `index` (String) Subschema unique string identifier
--- `title` (String) Subschema title (display name)
--- `type` (String) Subschema type: string, boolean, number, integer, array, or object
--
--### Optional
--
--- `array_enum` (List of String) Custom Subschema enumerated value of a property of type array.
--- `array_one_of` (Block List) array of valid JSON schemas for property type array. (see [below for nested schema](#nestedblock--array_one_of))
--- `array_type` (String) Subschema array type: string, number, integer, reference. Type field must be an array.
--- `description` (String) Custom Subschema description
--- `enum` (List of String) Custom Subschema enumerated value of the property. see: developer.okta.com/docs/api/resources/schemas#user-profile-schema-property-object
--- `external_name` (String) Subschema external name
--- `external_namespace` (String) Subschema external namespace
--- `master` (String) SubSchema profile manager, if not set it will inherit its setting.
--- `max_length` (Number) Subschema of type string maximum length
--- `min_length` (Number) Subschema of type string minimum length
--- `one_of` (Block List) Custom Subschema json schemas. see: developer.okta.com/docs/api/resources/schemas#user-profile-schema-property-object (see [below for nested schema](#nestedblock--one_of))
--- `permissions` (String) SubSchema permissions: HIDE, READ_ONLY, or READ_WRITE.
--- `required` (Boolean) Whether the subschema is required
--- `scope` (String) determines whether an app user attribute can be set at the Personal `SELF` or Group `NONE` level. Default value is `NONE`.
--- `union` (Boolean) Allows to assign attribute's group priority
--- `unique` (String) Subschema unique restriction
--- `user_type` (String) Custom subschema user type
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--<a id="nestedblock--array_one_of"></a>
--### Nested Schema for `array_one_of`
--
--Required:
--
--- `const` (String) Enum value
--- `title` (String) Enum title
--
--
--<a id="nestedblock--one_of"></a>
--### Nested Schema for `one_of`
--
--Required:
--
--- `const` (String) Enum value
--- `title` (String) Enum title
--
--
-diff --git a/docs/resources/auth_server.md b/docs/resources/auth_server.md
-deleted file mode 100644
-index 241a1706..00000000
---- a/docs/resources/auth_server.md
-+++ /dev/null
-@@ -1,36 +0,0 @@
-----
--page_title: "Resource: okta_auth_server"
--description: |-
--  
-----
--
--# Resource: okta_auth_server
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `audiences` (Set of String) Currently Okta only supports a single value here
--- `name` (String) The name of the authorization server.
--
--### Optional
--
--- `credentials_rotation_mode` (String) Credential rotation mode, in many cases you cannot set this to MANUAL, the API will ignore the value and you will get a perpetual diff. This should rarely be used.
--- `description` (String) The description of the authorization server.
--- `issuer_mode` (String) *Early Access Property*. Indicates which value is specified in the issuer of the tokens that a Custom Authorization Server returns: the original Okta org domain URL or a custom domain URL
--- `status` (String)
--
--### Read-Only
--
--- `credentials_last_rotated` (String) The timestamp when the authorization server started to use the `kid` for signing tokens.
--- `credentials_next_rotation` (String) The timestamp when the authorization server changes the key for signing tokens. Only returned when `credentials_rotation_mode` is `AUTO`.
--- `id` (String) The ID of this resource.
--- `issuer` (String) allows you to use a custom issuer URL
--- `kid` (String) The ID of the JSON Web Key used for signing tokens issued by the authorization server.
--
--
-diff --git a/docs/resources/auth_server_claim.md b/docs/resources/auth_server_claim.md
-deleted file mode 100644
-index 390fa4d9..00000000
---- a/docs/resources/auth_server_claim.md
-+++ /dev/null
-@@ -1,35 +0,0 @@
-----
--page_title: "Resource: okta_auth_server_claim"
--description: |-
--  
-----
--
--# Resource: okta_auth_server_claim
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `auth_server_id` (String) Auth server ID
--- `claim_type` (String) Specifies whether the claim is for an access token `RESOURCE` or ID token `IDENTITY`.
--- `name` (String) Auth server claim name
--- `value` (String) The value of the claim.
--
--### Optional
--
--- `always_include_in_token` (Boolean) Specifies whether to include claims in token, by default it is set to `true`.
--- `group_filter_type` (String) Specifies the type of group filter if `value_type` is `GROUPS`. Can be set to one of the following `STARTS_WITH`, `EQUALS`, `CONTAINS`, `REGEX`.
--- `scopes` (Set of String) Auth server claim list of scopes
--- `status` (String)
--- `value_type` (String) The type of value of the claim. It can be set to `EXPRESSION` or `GROUPS`. It defaults to `EXPRESSION`.
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/auth_server_claim_default.md b/docs/resources/auth_server_claim_default.md
-deleted file mode 100644
-index d63bd1d5..00000000
---- a/docs/resources/auth_server_claim_default.md
-+++ /dev/null
-@@ -1,34 +0,0 @@
-----
--page_title: "Resource: okta_auth_server_claim_default"
--description: |-
--  
-----
--
--# Resource: okta_auth_server_claim_default
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `auth_server_id` (String) Auth server ID
--- `name` (String) Default auth server claim name
--
--### Optional
--
--- `always_include_in_token` (Boolean) Specifies whether to include claims in token.
--- `value` (String) The value of the claim.
--
--### Read-Only
--
--- `claim_type` (String) Specifies whether the claim is for an access token `RESOURCE` or ID token `IDENTITY`.
--- `id` (String) The ID of this resource.
--- `scopes` (Set of String) Auth server claim list of scopes
--- `status` (String) The status of the application.
--- `value_type` (String) The type of value of the claim.
--
--
-diff --git a/docs/resources/auth_server_default.md b/docs/resources/auth_server_default.md
-deleted file mode 100644
-index 66a44dd1..00000000
---- a/docs/resources/auth_server_default.md
-+++ /dev/null
-@@ -1,33 +0,0 @@
-----
--page_title: "Resource: okta_auth_server_default"
--description: |-
--  
-----
--
--# Resource: okta_auth_server_default
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Optional
--
--- `audiences` (Set of String) Currently Okta only supports a single value here
--- `credentials_rotation_mode` (String) Credential rotation mode, in many cases you cannot set this to MANUAL, the API will ignore the value and you will get a perpetual diff. This should rarely be used.
--- `description` (String) The description of the authorization server.
--- `issuer_mode` (String) *Early Access Property*. Indicates which value is specified in the issuer of the tokens that a Custom Authorization Server returns: the original Okta org domain URL or a custom domain URL
--- `name` (String) The name of the authorization server. Not necessary but left for backwards capacity with legacy implementation.
--- `status` (String)
--
--### Read-Only
--
--- `credentials_last_rotated` (String) The timestamp when the authorization server started to use the `kid` for signing tokens.
--- `credentials_next_rotation` (String) The timestamp when the authorization server changes the key for signing tokens. Only returned when `credentials_rotation_mode` is `AUTO`.
--- `id` (String) The ID of this resource.
--- `issuer` (String) allows you to use a custom issuer URL
--- `kid` (String) The ID of the JSON Web Key used for signing tokens issued by the authorization server.
--
--
-diff --git a/docs/resources/auth_server_policy.md b/docs/resources/auth_server_policy.md
-deleted file mode 100644
-index 86af3807..00000000
---- a/docs/resources/auth_server_policy.md
-+++ /dev/null
-@@ -1,32 +0,0 @@
-----
--page_title: "Resource: okta_auth_server_policy"
--description: |-
--  
-----
--
--# Resource: okta_auth_server_policy
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `auth_server_id` (String) The ID of the Auth Server.
--- `client_whitelist` (Set of String) The clients to whitelist the policy for. `[ALL_CLIENTS]` is a special value that can be used to whitelist all clients, otherwise it is a list of client ids.
--- `description` (String) The description of the Auth Server Policy.
--- `name` (String) The name of the Auth Server Policy.
--- `priority` (Number) Priority of the auth server policy
--
--### Optional
--
--- `status` (String)
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/auth_server_policy_rule.md b/docs/resources/auth_server_policy_rule.md
-deleted file mode 100644
-index 7fd7b181..00000000
---- a/docs/resources/auth_server_policy_rule.md
-+++ /dev/null
-@@ -1,42 +0,0 @@
-----
--page_title: "Resource: okta_auth_server_policy_rule"
--description: |-
--  
-----
--
--# Resource: okta_auth_server_policy_rule
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `auth_server_id` (String) Auth server ID
--- `grant_type_whitelist` (Set of String) Accepted grant type values: authorization_code, implicit, password, client_credentials
--- `name` (String) Auth server policy rule name
--- `policy_id` (String) Auth server policy ID
--- `priority` (Number) Priority of the auth server policy rule
--
--### Optional
--
--- `access_token_lifetime_minutes` (Number) Lifetime of access token. Can be set to a value between 5 and 1440 minutes. Default is `60`.
--- `group_blacklist` (Set of String) Specifies a set of Groups whose Users are to be excluded.
--- `group_whitelist` (Set of String) Specifies a set of Groups whose Users are to be included. Can be set to Group ID or to the following: `EVERYONE`.
--- `inline_hook_id` (String) The ID of the inline token to trigger.
--- `refresh_token_lifetime_minutes` (Number) Lifetime of refresh token.
--- `refresh_token_window_minutes` (Number) Window in which a refresh token can be used. It can be a value between 5 and 2628000 (5 years) minutes. Default is `10080` (7 days).`refresh_token_window_minutes` must be between `access_token_lifetime_minutes` and `refresh_token_lifetime_minutes`.
--- `scope_whitelist` (Set of String) Scopes allowed for this policy rule. They can be whitelisted by name or all can be whitelisted with ` * `
--- `status` (String)
--- `type` (String) Auth server policy rule type, unlikely this will be anything other then the default
--- `user_blacklist` (Set of String) Specifies a set of Users to be excluded.
--- `user_whitelist` (Set of String) Specifies a set of Users to be included.
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/auth_server_scope.md b/docs/resources/auth_server_scope.md
-deleted file mode 100644
-index de94371b..00000000
---- a/docs/resources/auth_server_scope.md
-+++ /dev/null
-@@ -1,35 +0,0 @@
-----
--page_title: "Resource: okta_auth_server_scope"
--description: |-
--  
-----
--
--# Resource: okta_auth_server_scope
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `auth_server_id` (String) Auth server ID
--- `name` (String) Auth server scope name
--
--### Optional
--
--- `consent` (String) EA Feature and thus it is simply ignored if the feature is off
--- `default` (Boolean) A default scope will be returned in an access token when the client omits the scope parameter in a token request, provided this scope is allowed as part of the access policy rule.
--- `description` (String) Description of the Auth Server Scope.
--- `display_name` (String) Name of the end user displayed in a consent dialog box
--- `metadata_publish` (String) Whether to publish metadata or not, matching API type despite the fact it could just be a boolean
--- `optional` (Boolean) Whether the scope optional
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--- `system` (Boolean) Whether Okta created the Scope
--
--
-diff --git a/docs/resources/authenticator.md b/docs/resources/authenticator.md
-deleted file mode 100644
-index 7d143099..00000000
---- a/docs/resources/authenticator.md
-+++ /dev/null
-@@ -1,41 +0,0 @@
-----
--page_title: "Resource: okta_authenticator"
--description: |-
--  
-----
--
--# Resource: okta_authenticator
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `key` (String) A human-readable string that identifies the Authenticator
--- `name` (String) Display name of the Authenticator
--
--### Optional
--
--- `provider_auth_port` (Number) The RADIUS server port (for example 1812). This is defined when the On-Prem RADIUS server is configured
--- `provider_host` (String) The Duo Security API hostname
--- `provider_hostname` (String) Server host name or IP address
--- `provider_integration_key` (String) The Duo Security integration key
--- `provider_json` (String) Provider in JSON format
--- `provider_secret_key` (String) The Duo Security secret key
--- `provider_shared_secret` (String, Sensitive) An authentication key that must be defined when the RADIUS server is configured, and must be the same on both the RADIUS client and server.
--- `provider_user_name_template` (String) Format expected by the provider
--- `settings` (String) Authenticator settings in JSON format
--- `status` (String) Authenticator status: ACTIVE or INACTIVE
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--- `provider_instance_id` (String) App Instance ID.
--- `provider_type` (String) Provider type. Supported value for Duo: `DUO`. Supported value for Custom App: `PUSH`
--- `type` (String) The type of Authenticator
--
--
-diff --git a/docs/resources/behavior.md b/docs/resources/behavior.md
-deleted file mode 100644
-index 28c82247..00000000
---- a/docs/resources/behavior.md
-+++ /dev/null
-@@ -1,33 +0,0 @@
-----
--page_title: "Resource: okta_behavior"
--description: |-
--  
-----
--
--# Resource: okta_behavior
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `name` (String) Name of the behavior
--- `type` (String) Behavior type
--
--### Optional
--
--- `location_granularity_type` (String) Determines the method and level of detail used to evaluate the behavior.
--- `number_of_authentications` (Number) The number of recent authentications used to evaluate the behavior.
--- `radius_from_location` (Number) Radius from location (in kilometers)
--- `status` (String) Behavior status: ACTIVE or INACTIVE.
--- `velocity` (Number) Velocity (in kilometers per hour).
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/brand.md b/docs/resources/brand.md
-deleted file mode 100644
-index b9112c38..00000000
---- a/docs/resources/brand.md
-+++ /dev/null
-@@ -1,38 +0,0 @@
-----
--page_title: "Resource: okta_brand"
--description: |-
--  Manages brand
-----
--
--# Resource: okta_brand
--
--Manages brand
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `name` (String) Brand name
--
--### Optional
--
--- `agree_to_custom_privacy_policy` (Boolean) Consent for updating the custom privacy policy URL.
--- `brand_id` (String, Deprecated) Brand ID - Note: Okta API for brands only reads and updates therefore the okta_brand resource needs to act as a quasi data source. Do this by setting brand_id.
--- `custom_privacy_policy_url` (String) Custom privacy policy URL
--- `default_app_app_instance_id` (String) Default app app instance id
--- `default_app_app_link_name` (String) Default app app link name
--- `default_app_classic_application_uri` (String) Default app classic application uri
--- `email_domain_id` (String) Email Domain ID tied to this brand
--- `locale` (String) The language specified as an IETF BCP 47 language tag
--- `remove_powered_by_okta` (Boolean) Removes "Powered by Okta" from the Okta-hosted sign-in page and "© 2021 Okta, Inc." from the Okta End-User Dashboard
--
--### Read-Only
--
--- `id` (String) Brand id
--- `is_default` (Boolean) Is this the default brand
--- `links` (String) Link relations for this object - JSON HAL - Discoverable resources related to the brand
--
--
-diff --git a/docs/resources/captcha.md b/docs/resources/captcha.md
-deleted file mode 100644
-index 64e03f1c..00000000
---- a/docs/resources/captcha.md
-+++ /dev/null
-@@ -1,27 +0,0 @@
-----
--page_title: "Resource: okta_captcha"
--description: |-
--  
-----
--
--# Resource: okta_captcha
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `name` (String) Name of the CAPTCHA
--- `secret_key` (String, Sensitive) Secret key issued from the CAPTCHA vendor to perform server-side validation for a CAPTCHA token
--- `site_key` (String) Site key issued from the CAPTCHA vendor to render a CAPTCHA on a page
--- `type` (String) Captcha type
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/captcha_org_wide_settings.md b/docs/resources/captcha_org_wide_settings.md
-deleted file mode 100644
-index b8c473c8..00000000
---- a/docs/resources/captcha_org_wide_settings.md
-+++ /dev/null
-@@ -1,25 +0,0 @@
-----
--page_title: "Resource: okta_captcha_org_wide_settings"
--description: |-
--  
-----
--
--# Resource: okta_captcha_org_wide_settings
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Optional
--
--- `captcha_id` (String) ID of the CAPTCHA
--- `enabled_for` (Set of String) Set of pages that have CAPTCHA enabled
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/domain.md b/docs/resources/domain.md
-deleted file mode 100644
-index 0531d70d..00000000
---- a/docs/resources/domain.md
-+++ /dev/null
-@@ -1,41 +0,0 @@
-----
--page_title: "Resource: okta_domain"
--description: |-
--  
-----
--
--# Resource: okta_domain
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `name` (String) Custom Domain name
--
--### Optional
--
--- `brand_id` (String) Brand id of the domain
--- `certificate_source_type` (String) Optional. Certificate source type that indicates whether the certificate is provided by the user or Okta. Accepted values: MANUAL, OKTA_MANAGED. Warning: Use of OKTA_MANAGED requires a feature flag to be enabled. Default value = MANUAL
--
--### Read-Only
--
--- `dns_records` (List of Object) TXT and CNAME records to be registered for the Domain (see [below for nested schema](#nestedatt--dns_records))
--- `id` (String) The ID of this resource.
--- `validation_status` (String) Status of the domain
--
--<a id="nestedatt--dns_records"></a>
--### Nested Schema for `dns_records`
--
--Read-Only:
--
--- `expiration` (String)
--- `fqdn` (String)
--- `record_type` (String)
--- `values` (List of String)
--
--
-diff --git a/docs/resources/domain_certificate.md b/docs/resources/domain_certificate.md
-deleted file mode 100644
-index fe0b5a18..00000000
---- a/docs/resources/domain_certificate.md
-+++ /dev/null
-@@ -1,31 +0,0 @@
-----
--page_title: "Resource: okta_domain_certificate"
--description: |-
--  
-----
--
--# Resource: okta_domain_certificate
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `certificate` (String) Certificate content
--- `certificate_chain` (String) Certificate chain
--- `domain_id` (String) Domain's ID
--- `private_key` (String) Certificate private key
--
--### Optional
--
--- `type` (String) Certificate type
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/domain_verification.md b/docs/resources/domain_verification.md
-deleted file mode 100644
-index 66822cc8..00000000
---- a/docs/resources/domain_verification.md
-+++ /dev/null
-@@ -1,24 +0,0 @@
-----
--page_title: "Resource: okta_domain_verification"
--description: |-
--  
-----
--
--# Resource: okta_domain_verification
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `domain_id` (String) Domain's ID
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/email_customization.md b/docs/resources/email_customization.md
-deleted file mode 100644
-index 1a975385..00000000
---- a/docs/resources/email_customization.md
-+++ /dev/null
-@@ -1,34 +0,0 @@
-----
--page_title: "Resource: okta_email_customization"
--description: |-
--  
-----
--
--# Resource: okta_email_customization
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `brand_id` (String) Brand ID
--- `template_name` (String) Template Name
--
--### Optional
--
--- `body` (String) The body of the customization
--- `force_is_default` (String, Deprecated) Force is_default on the create and delete by deleting all email customizations. Comma separated string with values of 'create' or 'destroy' or both `create,destroy'.
--- `is_default` (Boolean) Whether the customization is the default
--- `language` (String) The language supported by the customization
--- `subject` (String) The subject of the customization
--
--### Read-Only
--
--- `id` (String) The ID of the customization
--- `links` (String) Link relations for this object - JSON HAL - Discoverable resources related to the email template
--
--
-diff --git a/docs/resources/email_domain.md b/docs/resources/email_domain.md
-deleted file mode 100644
-index 5a0866f6..00000000
---- a/docs/resources/email_domain.md
-+++ /dev/null
-@@ -1,39 +0,0 @@
-----
--page_title: "Resource: okta_email_domain"
--description: |-
--  
-----
--
--# Resource: okta_email_domain
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `brand_id` (String) Brand id
--- `display_name` (String) Display name
--- `domain` (String) Domain name
--- `user_name` (String) User name
--
--### Read-Only
--
--- `dns_validation_records` (List of Object) TXT and cname records to be registered for the email Domain (see [below for nested schema](#nestedatt--dns_validation_records))
--- `id` (String) The ID of this resource.
--- `validation_status` (String) Status of the email domain. Values: NOT_STARTED, IN_PROGRESS, VERIFIED, COMPLETED
--
--<a id="nestedatt--dns_validation_records"></a>
--### Nested Schema for `dns_validation_records`
--
--Read-Only:
--
--- `expiration` (String)
--- `fqdn` (String)
--- `record_type` (String)
--- `value` (String)
--
--
-diff --git a/docs/resources/email_domain_verification.md b/docs/resources/email_domain_verification.md
-deleted file mode 100644
-index 78383381..00000000
---- a/docs/resources/email_domain_verification.md
-+++ /dev/null
-@@ -1,24 +0,0 @@
-----
--page_title: "Resource: okta_email_domain_verification"
--description: |-
--  
-----
--
--# Resource: okta_email_domain_verification
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `email_domain_id` (String) Email domain ID
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/email_sender.md b/docs/resources/email_sender.md
-deleted file mode 100644
-index 523c3ad6..00000000
---- a/docs/resources/email_sender.md
-+++ /dev/null
-@@ -1,37 +0,0 @@
-----
--page_title: "Resource: okta_email_sender"
--description: |-
--  
-----
--
--# Resource: okta_email_sender
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `from_address` (String) Email address to send from
--- `from_name` (String) Name of sender
--- `subdomain` (String) Mail domain to send from
--
--### Read-Only
--
--- `dns_records` (List of Object) TXT and CNAME records to be registered for the Domain (see [below for nested schema](#nestedatt--dns_records))
--- `id` (String) The ID of this resource.
--- `status` (String) Verification status
--
--<a id="nestedatt--dns_records"></a>
--### Nested Schema for `dns_records`
--
--Read-Only:
--
--- `fqdn` (String)
--- `record_type` (String)
--- `value` (String)
--
--
-diff --git a/docs/resources/email_sender_verification.md b/docs/resources/email_sender_verification.md
-deleted file mode 100644
-index f99341f5..00000000
---- a/docs/resources/email_sender_verification.md
-+++ /dev/null
-@@ -1,24 +0,0 @@
-----
--page_title: "Resource: okta_email_sender_verification"
--description: |-
--  
-----
--
--# Resource: okta_email_sender_verification
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `sender_id` (String) Email sender ID
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/event_hook.md b/docs/resources/event_hook.md
-deleted file mode 100644
-index b5781a49..00000000
---- a/docs/resources/event_hook.md
-+++ /dev/null
-@@ -1,40 +0,0 @@
-----
--page_title: "Resource: okta_event_hook"
--description: |-
--  
-----
--
--# Resource: okta_event_hook
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `channel` (Map of String) Details of the endpoint the event hook will hit.
--- `events` (Set of String) The events that will be delivered to this hook. [See here for a list of supported events](https://developer.okta.com/docs/reference/api/event-types/?q=event-hook-eligible).
--- `name` (String) The event hook display name.
--
--### Optional
--
--- `auth` (Map of String) Authentication required for event hook request.
--- `headers` (Block Set) Map of headers to send along in event hook request. (see [below for nested schema](#nestedblock--headers))
--- `status` (String)
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--<a id="nestedblock--headers"></a>
--### Nested Schema for `headers`
--
--Optional:
--
--- `key` (String)
--- `value` (String)
--
--
-diff --git a/docs/resources/event_hook_verification.md b/docs/resources/event_hook_verification.md
-deleted file mode 100644
-index 2c708247..00000000
---- a/docs/resources/event_hook_verification.md
-+++ /dev/null
-@@ -1,24 +0,0 @@
-----
--page_title: "Resource: okta_event_hook_verification"
--description: |-
--  
-----
--
--# Resource: okta_event_hook_verification
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `event_hook_id` (String) Event hook ID
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/factor.md b/docs/resources/factor.md
-deleted file mode 100644
-index 9e49dc2d..00000000
---- a/docs/resources/factor.md
-+++ /dev/null
-@@ -1,28 +0,0 @@
-----
--page_title: "Resource: okta_factor"
--description: |-
--  
-----
--
--# Resource: okta_factor
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `provider_id` (String) Factor provider ID
--
--### Optional
--
--- `active` (Boolean) Is this provider active?
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/factor_totp.md b/docs/resources/factor_totp.md
-deleted file mode 100644
-index dac15d1f..00000000
---- a/docs/resources/factor_totp.md
-+++ /dev/null
-@@ -1,32 +0,0 @@
-----
--page_title: "Resource: okta_factor_totp"
--description: |-
--  
-----
--
--# Resource: okta_factor_totp
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `name` (String) The TOTP name.
--
--### Optional
--
--- `clock_drift_interval` (Number) Clock drift interval
--- `hmac_algorithm` (String) Hash-based message authentication code algorithm
--- `otp_length` (Number) Length of the password. Default is `6`.
--- `shared_secret_encoding` (String) Shared secret encoding
--- `time_step` (Number) Time step in seconds
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/group.md b/docs/resources/group.md
-deleted file mode 100644
-index 3f25201c..00000000
---- a/docs/resources/group.md
-+++ /dev/null
-@@ -1,30 +0,0 @@
-----
--page_title: "Resource: okta_group"
--description: |-
--  
-----
--
--# Resource: okta_group
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `name` (String) Group name
--
--### Optional
--
--- `custom_profile_attributes` (String) JSON formatted custom attributes for a group. It must be JSON due to various types Okta allows.
--- `description` (String) Group description
--- `skip_users` (Boolean, Deprecated) Ignore users sync. This is a temporary solution until 'users' field is supported in all the app-like resources
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/group_memberships.md b/docs/resources/group_memberships.md
-deleted file mode 100644
-index d57c1ae5..00000000
---- a/docs/resources/group_memberships.md
-+++ /dev/null
-@@ -1,29 +0,0 @@
-----
--page_title: "Resource: okta_group_memberships"
--description: |-
--  Resource to manage a set of group memberships for a specific group.
-----
--
--# Resource: okta_group_memberships
--
--Resource to manage a set of group memberships for a specific group.
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `group_id` (String) ID of a Okta group.
--- `users` (Set of String) The list of Okta user IDs which the group should have membership managed for.
--
--### Optional
--
--- `track_all_users` (Boolean) The resource concerns itself with all users added/deleted to the group; even those managed outside of the resource.
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/group_role.md b/docs/resources/group_role.md
-deleted file mode 100644
-index e2588d06..00000000
---- a/docs/resources/group_role.md
-+++ /dev/null
-@@ -1,31 +0,0 @@
-----
--page_title: "Resource: okta_group_role"
--description: |-
--  
-----
--
--# Resource: okta_group_role
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `group_id` (String) ID of group to attach admin roles to
--- `role_type` (String) Type of Role to assign
--
--### Optional
--
--- `disable_notifications` (Boolean) When this setting is enabled, the admins won't receive any of the default Okta administrator emails
--- `target_app_list` (Set of String) List of apps ids for the targets of the admin role.
--- `target_group_list` (Set of String) List of groups ids for the targets of the admin role.
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/group_rule.md b/docs/resources/group_rule.md
-deleted file mode 100644
-index be22d0cc..00000000
---- a/docs/resources/group_rule.md
-+++ /dev/null
-@@ -1,33 +0,0 @@
-----
--page_title: "Resource: okta_group_rule"
--description: |-
--  
-----
--
--# Resource: okta_group_rule
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `expression_value` (String)
--- `group_assignments` (Set of String)
--- `name` (String)
--
--### Optional
--
--- `expression_type` (String)
--- `remove_assigned_users` (Boolean) Remove users added by this rule from the assigned group after deleting this resource
--- `status` (String)
--- `users_excluded` (Set of String) The list of user IDs that would be excluded when rules are processed
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/group_schema_property.md b/docs/resources/group_schema_property.md
-deleted file mode 100644
-index 45299db5..00000000
---- a/docs/resources/group_schema_property.md
-+++ /dev/null
-@@ -1,74 +0,0 @@
-----
--page_title: "Resource: okta_group_schema_property"
--description: |-
--  
-----
--
--# Resource: okta_group_schema_property
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `index` (String) Subschema unique string identifier
--- `title` (String) Subschema title (display name)
--- `type` (String) Subschema type: string, boolean, number, integer, array, or object
--
--### Optional
--
--- `array_enum` (List of String) Custom Subschema enumerated value of a property of type array.
--- `array_one_of` (Block List) array of valid JSON schemas for property type array. (see [below for nested schema](#nestedblock--array_one_of))
--- `array_type` (String) Subschema array type: string, number, integer, reference. Type field must be an array.
--- `description` (String) Custom Subschema description
--- `enum` (List of String) Custom Subschema enumerated value of the property. see: developer.okta.com/docs/api/resources/schemas#user-profile-schema-property-object
--- `external_name` (String) Subschema external name
--- `external_namespace` (String) Subschema external namespace
--- `master` (String) SubSchema profile manager, if not set it will inherit its setting.
--- `master_override_priority` (Block List) (see [below for nested schema](#nestedblock--master_override_priority))
--- `max_length` (Number) Subschema of type string maximum length
--- `min_length` (Number) Subschema of type string minimum length
--- `one_of` (Block List) Custom Subschema json schemas. see: developer.okta.com/docs/api/resources/schemas#user-profile-schema-property-object (see [below for nested schema](#nestedblock--one_of))
--- `permissions` (String) SubSchema permissions: HIDE, READ_ONLY, or READ_WRITE.
--- `required` (Boolean) Whether the subschema is required
--- `scope` (String)
--- `unique` (String) Subschema unique restriction
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--<a id="nestedblock--array_one_of"></a>
--### Nested Schema for `array_one_of`
--
--Required:
--
--- `const` (String) Enum value
--- `title` (String) Enum title
--
--
--<a id="nestedblock--master_override_priority"></a>
--### Nested Schema for `master_override_priority`
--
--Required:
--
--- `value` (String)
--
--Optional:
--
--- `type` (String)
--
--
--<a id="nestedblock--one_of"></a>
--### Nested Schema for `one_of`
--
--Required:
--
--- `const` (String) Enum value
--- `title` (String) Enum title
--
--
-diff --git a/docs/resources/idp_oidc.md b/docs/resources/idp_oidc.md
-deleted file mode 100644
-index 43d45cfe..00000000
---- a/docs/resources/idp_oidc.md
-+++ /dev/null
-@@ -1,60 +0,0 @@
-----
--page_title: "Resource: okta_idp_oidc"
--description: |-
--  
-----
--
--# Resource: okta_idp_oidc
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `authorization_binding` (String)
--- `authorization_url` (String)
--- `client_id` (String)
--- `client_secret` (String, Sensitive)
--- `issuer_url` (String)
--- `jwks_binding` (String)
--- `jwks_url` (String)
--- `name` (String) Name of the IdP
--- `scopes` (Set of String)
--- `token_binding` (String)
--- `token_url` (String)
--
--### Optional
--
--- `account_link_action` (String)
--- `account_link_group_include` (Set of String)
--- `deprovisioned_action` (String)
--- `groups_action` (String)
--- `groups_assignment` (Set of String)
--- `groups_attribute` (String)
--- `groups_filter` (Set of String)
--- `issuer_mode` (String) Indicates whether Okta uses the original Okta org domain URL, custom domain URL, or dynamic. See Identity Provider attributes - issuerMode - https://developer.okta.com/docs/reference/api/idps/#identity-provider-attributes
--- `max_clock_skew` (Number)
--- `profile_master` (Boolean)
--- `protocol_type` (String)
--- `provisioning_action` (String)
--- `request_signature_algorithm` (String) The HMAC Signature Algorithm used when signing an authorization request
--- `request_signature_scope` (String) Specifies whether to digitally sign an authorization request to the IdP
--- `status` (String)
--- `subject_match_attribute` (String)
--- `subject_match_type` (String)
--- `suspended_action` (String)
--- `user_info_binding` (String)
--- `user_info_url` (String)
--- `username_template` (String)
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--- `type` (String) Type of OIDC IdP.
--- `user_type_id` (String)
--
--
-diff --git a/docs/resources/idp_saml.md b/docs/resources/idp_saml.md
-deleted file mode 100644
-index 9e32d8b7..00000000
---- a/docs/resources/idp_saml.md
-+++ /dev/null
-@@ -1,60 +0,0 @@
-----
--page_title: "Resource: okta_idp_saml"
--description: |-
--  
-----
--
--# Resource: okta_idp_saml
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `issuer` (String)
--- `kid` (String)
--- `name` (String) Name of the IdP
--- `sso_url` (String)
--
--### Optional
--
--- `account_link_action` (String)
--- `account_link_group_include` (Set of String)
--- `acs_type` (String)
--- `deprovisioned_action` (String)
--- `groups_action` (String)
--- `groups_assignment` (Set of String)
--- `groups_attribute` (String)
--- `groups_filter` (Set of String)
--- `issuer_mode` (String) Indicates whether Okta uses the original Okta org domain URL, or a custom domain URL
--- `max_clock_skew` (Number)
--- `name_format` (String)
--- `profile_master` (Boolean)
--- `provisioning_action` (String)
--- `request_signature_algorithm` (String) The XML digital Signature Algorithm used when signing an <AuthnRequest> message
--- `request_signature_scope` (String) Specifies whether to digitally sign <AuthnRequest> messages to the IdP
--- `response_signature_algorithm` (String) The minimum XML digital Signature Algorithm allowed when verifying a <SAMLResponse> message or <Assertion> element
--- `response_signature_scope` (String) Specifies whether to verify a <SAMLResponse> message or <Assertion> element XML digital signature
--- `sso_binding` (String)
--- `sso_destination` (String)
--- `status` (String)
--- `subject_filter` (String)
--- `subject_format` (Set of String)
--- `subject_match_attribute` (String)
--- `subject_match_type` (String)
--- `suspended_action` (String)
--- `username_template` (String)
--
--### Read-Only
--
--- `acs_binding` (String)
--- `audience` (String)
--- `id` (String) The ID of this resource.
--- `type` (String)
--- `user_type_id` (String)
--
--
-diff --git a/docs/resources/idp_saml_key.md b/docs/resources/idp_saml_key.md
-deleted file mode 100644
-index 702585a6..00000000
---- a/docs/resources/idp_saml_key.md
-+++ /dev/null
-@@ -1,30 +0,0 @@
-----
--page_title: "Resource: okta_idp_saml_key"
--description: |-
--  
-----
--
--# Resource: okta_idp_saml_key
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `x5c` (Set of String) base64-encoded X.509 certificate chain with DER encoding
--
--### Read-Only
--
--- `created` (String)
--- `expires_at` (String)
--- `id` (String) The ID of this resource.
--- `kid` (String)
--- `kty` (String)
--- `use` (String)
--- `x5t_s256` (String)
--
--
-diff --git a/docs/resources/idp_social.md b/docs/resources/idp_social.md
-deleted file mode 100644
-index b5dec860..00000000
---- a/docs/resources/idp_social.md
-+++ /dev/null
-@@ -1,55 +0,0 @@
-----
--page_title: "Resource: okta_idp_social"
--description: |-
--  
-----
--
--# Resource: okta_idp_social
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `name` (String) Name of the IdP
--- `scopes` (Set of String)
--- `type` (String) Identity Provider Types: https://developer.okta.com/docs/reference/api/idps/#identity-provider-type
--
--### Optional
--
--- `account_link_action` (String)
--- `account_link_group_include` (Set of String)
--- `apple_kid` (String) The Key ID that you obtained from Apple when you created the private key for the client
--- `apple_private_key` (String, Sensitive) The PKCS #8 encoded private key that you created for the client and downloaded from Apple
--- `apple_team_id` (String) The Team ID associated with your Apple developer account
--- `client_id` (String)
--- `client_secret` (String, Sensitive)
--- `deprovisioned_action` (String)
--- `groups_action` (String)
--- `groups_assignment` (Set of String)
--- `groups_attribute` (String)
--- `groups_filter` (Set of String)
--- `issuer_mode` (String) Indicates whether Okta uses the original Okta org domain URL, or a custom domain URL
--- `max_clock_skew` (Number)
--- `profile_master` (Boolean)
--- `protocol_type` (String)
--- `provisioning_action` (String)
--- `status` (String)
--- `subject_match_attribute` (String)
--- `subject_match_type` (String)
--- `suspended_action` (String)
--- `username_template` (String)
--
--### Read-Only
--
--- `authorization_binding` (String)
--- `authorization_url` (String)
--- `id` (String) The ID of this resource.
--- `token_binding` (String)
--- `token_url` (String)
--
--
-diff --git a/docs/resources/inline_hook.md b/docs/resources/inline_hook.md
-deleted file mode 100644
-index 58e43ce5..00000000
---- a/docs/resources/inline_hook.md
-+++ /dev/null
-@@ -1,41 +0,0 @@
-----
--page_title: "Resource: okta_inline_hook"
--description: |-
--  
-----
--
--# Resource: okta_inline_hook
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `channel` (Map of String)
--- `name` (String)
--- `type` (String)
--- `version` (String)
--
--### Optional
--
--- `auth` (Map of String)
--- `headers` (Block Set) (see [below for nested schema](#nestedblock--headers))
--- `status` (String)
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--<a id="nestedblock--headers"></a>
--### Nested Schema for `headers`
--
--Optional:
--
--- `key` (String)
--- `value` (String)
--
--
-diff --git a/docs/resources/link_definition.md b/docs/resources/link_definition.md
-deleted file mode 100644
-index 598e3130..00000000
---- a/docs/resources/link_definition.md
-+++ /dev/null
-@@ -1,29 +0,0 @@
-----
--page_title: "Resource: okta_link_definition"
--description: |-
--  
-----
--
--# Resource: okta_link_definition
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `associated_description` (String) Description of the associated relationship.
--- `associated_name` (String) API name of the associated link.
--- `associated_title` (String) Display name of the associated link.
--- `primary_description` (String) Description of the primary relationship.
--- `primary_name` (String) API name of the primary link.
--- `primary_title` (String) Display name of the primary link.
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/link_value.md b/docs/resources/link_value.md
-deleted file mode 100644
-index 81c6a4fe..00000000
---- a/docs/resources/link_value.md
-+++ /dev/null
-@@ -1,29 +0,0 @@
-----
--page_title: "Resource: okta_link_value"
--description: |-
--  
-----
--
--# Resource: okta_link_value
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `primary_name` (String) Name of the 'primary' relationship being assigned.
--- `primary_user_id` (String) User ID to be assigned to 'primary' for the 'associated' user in the specified relationship.
--
--### Optional
--
--- `associated_user_ids` (Set of String) Set of User IDs or login values of the users to be assigned the 'associated' relationship.
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/network_zone.md b/docs/resources/network_zone.md
-deleted file mode 100644
-index 1e872cb3..00000000
---- a/docs/resources/network_zone.md
-+++ /dev/null
-@@ -1,35 +0,0 @@
-----
--page_title: "Resource: okta_network_zone"
--description: |-
--  
-----
--
--# Resource: okta_network_zone
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `name` (String) Name of the Network Zone Resource
--- `type` (String) Type of the Network Zone - can either be IP or DYNAMIC only
--
--### Optional
--
--- `asns` (Set of String) Format of each array value: a string representation of an ASN numeric value
--- `dynamic_locations` (Set of String) Array of locations ISO-3166-1(2). Format code: countryCode OR countryCode-regionCode
--- `dynamic_proxy_type` (String) Type of proxy being controlled by this network zone
--- `gateways` (Set of String) Array of values in CIDR/range form depending on the way it's been declared (i.e. CIDR will contain /suffix). Please check API docs for examples
--- `proxies` (Set of String) Array of values in CIDR/range form depending on the way it's been declared (i.e. CIDR will contain /suffix). Please check API docs for examples
--- `status` (String) Network Status - can either be ACTIVE or INACTIVE only
--- `usage` (String) Zone's purpose: POLICY or BLOCKLIST
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/org_configuration.md b/docs/resources/org_configuration.md
-deleted file mode 100644
-index 99b7007d..00000000
---- a/docs/resources/org_configuration.md
-+++ /dev/null
-@@ -1,43 +0,0 @@
-----
--page_title: "Resource: okta_org_configuration"
--description: |-
--  
-----
--
--# Resource: okta_org_configuration
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `company_name` (String) Name of org
--
--### Optional
--
--- `address_1` (String) Primary address of org
--- `address_2` (String) Secondary address of org
--- `billing_contact_user` (String) User ID representing the billing contact
--- `city` (String) City of org
--- `country` (String) Country of org
--- `end_user_support_help_url` (String) Support link of org
--- `logo` (String) Local path to logo of the org.
--- `opt_out_communication_emails` (Boolean) Indicates whether the org's users receive Okta Communication emails
--- `phone_number` (String) Support help phone of org
--- `postal_code` (String) Postal code of org
--- `state` (String) State of org
--- `support_phone_number` (String) Support help phone of org
--- `technical_contact_user` (String) User ID representing the technical contact
--- `website` (String) The org's website
--
--### Read-Only
--
--- `expires_at` (String) Expiration of org
--- `id` (String) The ID of this resource.
--- `subdomain` (String) Subdomain of org
--
--
-diff --git a/docs/resources/org_support.md b/docs/resources/org_support.md
-deleted file mode 100644
-index 8ddb026d..00000000
---- a/docs/resources/org_support.md
-+++ /dev/null
-@@ -1,26 +0,0 @@
-----
--page_title: "Resource: okta_org_support"
--description: |-
--  
-----
--
--# Resource: okta_org_support
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Optional
--
--- `extend_by` (Number) Number of days the support should be extended by
--
--### Read-Only
--
--- `expiration` (String) Expiration of Okta Support
--- `id` (String) The ID of this resource.
--- `status` (String) Status of Okta Support
--
--
-diff --git a/docs/resources/policy_device_assurance_android.md b/docs/resources/policy_device_assurance_android.md
-deleted file mode 100644
-index e5121e3d..00000000
---- a/docs/resources/policy_device_assurance_android.md
-+++ /dev/null
-@@ -1,37 +0,0 @@
-----
--page_title: "Resource: okta_policy_device_assurance_android"
--description: |-
--  Manages device assurance on policy
-----
--
--# Resource: okta_policy_device_assurance_android
--
--Manages device assurance on policy
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `name` (String) Policy device assurance name
--
--### Optional
--
--- `disk_encryption_type` (Set of String) List of disk encryption type, can be FULL, USER
--- `jailbreak` (Boolean) The device jailbreak. Only for android and iOS platform
--- `os_version` (String) The device os minimum version
--- `screenlock_type` (Set of String) List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
--- `secure_hardware_present` (Boolean) Indicates if the device constains a secure hardware functionality
--
--### Read-Only
--
--- `created_by` (String) Created by
--- `created_date` (String) Created date
--- `id` (String) Policy assurance id
--- `last_update` (String) Last update
--- `last_updated_by` (String) Last updated by
--- `platform` (String) Policy device assurance platform
--
--
-diff --git a/docs/resources/policy_device_assurance_chromeos.md b/docs/resources/policy_device_assurance_chromeos.md
-deleted file mode 100644
-index 64fd7c06..00000000
---- a/docs/resources/policy_device_assurance_chromeos.md
-+++ /dev/null
-@@ -1,46 +0,0 @@
-----
--page_title: "Resource: okta_policy_device_assurance_chromeos"
--description: |-
--  Manages device assurance on policy
-----
--
--# Resource: okta_policy_device_assurance_chromeos
--
--Manages device assurance on policy
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `name` (String) Policy device assurance name
--
--### Optional
--
--- `tpsp_allow_screen_lock` (Boolean) Third party signal provider allow screen lock
--- `tpsp_browser_version` (String) Third party signal provider minimum browser version
--- `tpsp_builtin_dns_client_enabled` (Boolean) Third party signal provider builtin dns client enabled
--- `tpsp_chrome_remote_desktop_app_blocked` (Boolean) Third party signal provider chrome remote desktop app blocked
--- `tpsp_device_enrollment_domain` (String) Third party signal provider device enrollment domain
--- `tpsp_disk_encrypted` (Boolean) Third party signal provider disk encrypted
--- `tpsp_key_trust_level` (String) Third party signal provider key trust level
--- `tpsp_os_firewall` (Boolean) Third party signal provider os firewall
--- `tpsp_os_version` (String) Third party signal provider minimum os version
--- `tpsp_password_proctection_warning_trigger` (String) Third party signal provider password protection warning trigger
--- `tpsp_realtime_url_check_mode` (Boolean) Third party signal provider realtime url check mode
--- `tpsp_safe_browsing_protection_level` (String) Third party signal provider safe browsing protection level
--- `tpsp_screen_lock_secured` (Boolean) Third party signal provider screen lock secure
--- `tpsp_site_isolation_enabled` (Boolean) Third party signal provider site isolation enabled
--
--### Read-Only
--
--- `created_by` (String) Created by
--- `created_date` (String) Created date
--- `id` (String) Policy assurance id
--- `last_update` (String) Last update
--- `last_updated_by` (String) Last updated by
--- `platform` (String) Policy device assurance platform
--
--
-diff --git a/docs/resources/policy_device_assurance_ios.md b/docs/resources/policy_device_assurance_ios.md
-deleted file mode 100644
-index b7866b82..00000000
---- a/docs/resources/policy_device_assurance_ios.md
-+++ /dev/null
-@@ -1,35 +0,0 @@
-----
--page_title: "Resource: okta_policy_device_assurance_ios"
--description: |-
--  Manages device assurance on policy
-----
--
--# Resource: okta_policy_device_assurance_ios
--
--Manages device assurance on policy
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `name` (String) Policy device assurance name
--
--### Optional
--
--- `jailbreak` (Boolean) The device jailbreak. Only for android and iOS platform
--- `os_version` (String) The device os minimum version
--- `screenlock_type` (Set of String) List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
--
--### Read-Only
--
--- `created_by` (String) Created by
--- `created_date` (String) Created date
--- `id` (String) Policy assurance id
--- `last_update` (String) Last update
--- `last_updated_by` (String) Last updated by
--- `platform` (String) Policy device assurance platform
--
--
-diff --git a/docs/resources/policy_device_assurance_macos.md b/docs/resources/policy_device_assurance_macos.md
-deleted file mode 100644
-index 3dff6566..00000000
---- a/docs/resources/policy_device_assurance_macos.md
-+++ /dev/null
-@@ -1,50 +0,0 @@
-----
--page_title: "Resource: okta_policy_device_assurance_macos"
--description: |-
--  Manages device assurance on policy
-----
--
--# Resource: okta_policy_device_assurance_macos
--
--Manages device assurance on policy
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `name` (String) Policy device assurance name
--
--### Optional
--
--- `disk_encryption_type` (Set of String) List of disk encryption type, can be ALL_INTERNAL_VOLUMES
--- `os_version` (String) The device os minimum version
--- `screenlock_type` (Set of String) List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
--- `secure_hardware_present` (Boolean) Indicates if the device constains a secure hardware functionality
--- `third_party_signal_providers` (Boolean) Check to include third party signal provider
--- `tpsp_browser_version` (String) Third party signal provider minimum browser version
--- `tpsp_builtin_dns_client_enabled` (Boolean) Third party signal provider builtin dns client enable
--- `tpsp_chrome_remote_desktop_app_blocked` (Boolean) Third party signal provider chrome remote desktop app blocked
--- `tpsp_device_enrollment_domain` (String) Third party signal provider device enrollment domain
--- `tpsp_disk_encrypted` (Boolean) Third party signal provider disk encrypted
--- `tpsp_key_trust_level` (String) Third party signal provider key trust level
--- `tpsp_os_firewall` (Boolean) Third party signal provider os firewall
--- `tpsp_os_version` (String) Third party signal provider minimum os version
--- `tpsp_password_proctection_warning_trigger` (String) Third party signal provider password protection warning trigger
--- `tpsp_realtime_url_check_mode` (Boolean) Third party signal provider realtime url check mode
--- `tpsp_safe_browsing_protection_level` (String) Third party signal provider safe browsing protection level
--- `tpsp_screen_lock_secured` (Boolean) Third party signal provider screen lock secure
--- `tpsp_site_isolation_enabled` (Boolean) Third party signal provider site isolation enabled
--
--### Read-Only
--
--- `created_by` (String) Created by
--- `created_date` (String) Created date
--- `id` (String) Policy assurance id
--- `last_update` (String) Last update
--- `last_updated_by` (String) Last updated by
--- `platform` (String) Policy device assurance platform
--
--
-diff --git a/docs/resources/policy_device_assurance_windows.md b/docs/resources/policy_device_assurance_windows.md
-deleted file mode 100644
-index 1f4d91ba..00000000
---- a/docs/resources/policy_device_assurance_windows.md
-+++ /dev/null
-@@ -1,56 +0,0 @@
-----
--page_title: "Resource: okta_policy_device_assurance_windows"
--description: |-
--  Manages device assurance on policy
-----
--
--# Resource: okta_policy_device_assurance_windows
--
--Manages device assurance on policy
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `name` (String) Policy device assurance name
--
--### Optional
--
--- `disk_encryption_type` (Set of String) List of disk encryption type, can be ALL_INTERNAL_VOLUMES
--- `os_version` (String) The device os minimum version
--- `screenlock_type` (Set of String) List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
--- `secure_hardware_present` (Boolean) Indicates if the device constains a secure hardware functionality
--- `third_party_signal_providers` (Boolean) Check to include third party signal provider
--- `tpsp_browser_version` (String) Third party signal provider minimum browser version
--- `tpsp_builtin_dns_client_enabled` (Boolean) Third party signal provider builtin dns client enable
--- `tpsp_chrome_remote_desktop_app_blocked` (Boolean) Third party signal provider chrome remote desktop app blocked
--- `tpsp_crowd_strike_agent_id` (String) Third party signal provider crowdstrike agent id
--- `tpsp_crowd_strike_customer_id` (String) Third party signal provider crowdstrike user id
--- `tpsp_device_enrollment_domain` (String) Third party signal provider device enrollment domain
--- `tpsp_disk_encrypted` (Boolean) Third party signal provider disk encrypted
--- `tpsp_key_trust_level` (String) Third party signal provider key trust level
--- `tpsp_os_firewall` (Boolean) Third party signal provider os firewall
--- `tpsp_os_version` (String) Third party signal provider minimum os version
--- `tpsp_password_proctection_warning_trigger` (String) Third party signal provider password protection warning trigger
--- `tpsp_realtime_url_check_mode` (Boolean) Third party signal provider realtime url check mode
--- `tpsp_safe_browsing_protection_level` (String) Third party signal provider safe browsing protection level
--- `tpsp_screen_lock_secured` (Boolean) Third party signal provider screen lock secure
--- `tpsp_secure_boot_enabled` (Boolean) Third party signal provider secure boot enabled
--- `tpsp_site_isolation_enabled` (Boolean) Third party signal provider site isolation enabled
--- `tpsp_third_party_blocking_enabled` (Boolean) Third party signal provider third party blocking enabled
--- `tpsp_windows_machine_domain` (String) Third party signal provider windows machine domain
--- `tpsp_windows_user_domain` (String) Third party signal provider windows user domain
--
--### Read-Only
--
--- `created_by` (String) Created by
--- `created_date` (String) Created date
--- `id` (String) Policy assurance id
--- `last_update` (String) Last update
--- `last_updated_by` (String) Last updated by
--- `platform` (String) Policy device assurance platform
--
--
-diff --git a/docs/resources/policy_mfa.md b/docs/resources/policy_mfa.md
-deleted file mode 100644
-index e2486c7e..00000000
---- a/docs/resources/policy_mfa.md
-+++ /dev/null
-@@ -1,53 +0,0 @@
-----
--page_title: "Resource: okta_policy_mfa"
--description: |-
--  
-----
--
--# Resource: okta_policy_mfa
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `name` (String) Policy Name
--
--### Optional
--
--- `description` (String) Policy Description
--- `duo` (Map of String)
--- `external_idp` (Map of String)
--- `fido_u2f` (Map of String)
--- `fido_webauthn` (Map of String)
--- `google_otp` (Map of String)
--- `groups_included` (Set of String) List of Group IDs to Include
--- `hotp` (Map of String)
--- `is_oie` (Boolean) Is the policy using Okta Identity Engine (OIE) with authenticators instead of factors?
--- `okta_call` (Map of String)
--- `okta_email` (Map of String)
--- `okta_otp` (Map of String)
--- `okta_password` (Map of String)
--- `okta_push` (Map of String)
--- `okta_question` (Map of String)
--- `okta_sms` (Map of String)
--- `okta_verify` (Map of String)
--- `onprem_mfa` (Map of String)
--- `phone_number` (Map of String)
--- `priority` (Number) Policy Priority, this attribute can be set to a valid priority. To avoid endless diff situation we error if an invalid priority is provided. API defaults it to the last (lowest) if not there.
--- `rsa_token` (Map of String)
--- `security_question` (Map of String)
--- `status` (String) Policy Status: ACTIVE or INACTIVE.
--- `symantec_vip` (Map of String)
--- `webauthn` (Map of String)
--- `yubikey_token` (Map of String)
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/policy_mfa_default.md b/docs/resources/policy_mfa_default.md
-deleted file mode 100644
-index 4aef5017..00000000
---- a/docs/resources/policy_mfa_default.md
-+++ /dev/null
-@@ -1,50 +0,0 @@
-----
--page_title: "Resource: okta_policy_mfa_default"
--description: |-
--  
-----
--
--# Resource: okta_policy_mfa_default
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Optional
--
--- `duo` (Map of String)
--- `external_idp` (Map of String)
--- `fido_u2f` (Map of String)
--- `fido_webauthn` (Map of String)
--- `google_otp` (Map of String)
--- `hotp` (Map of String)
--- `is_oie` (Boolean) Is the policy using Okta Identity Engine (OIE) with authenticators instead of factors?
--- `okta_call` (Map of String)
--- `okta_email` (Map of String)
--- `okta_otp` (Map of String)
--- `okta_password` (Map of String)
--- `okta_push` (Map of String)
--- `okta_question` (Map of String)
--- `okta_sms` (Map of String)
--- `okta_verify` (Map of String)
--- `onprem_mfa` (Map of String)
--- `phone_number` (Map of String)
--- `rsa_token` (Map of String)
--- `security_question` (Map of String)
--- `symantec_vip` (Map of String)
--- `webauthn` (Map of String)
--- `yubikey_token` (Map of String)
--
--### Read-Only
--
--- `default_included_group_id` (String) Default group ID (always included)
--- `description` (String) Default policy description
--- `id` (String) The ID of this resource.
--- `name` (String) Default policy name
--- `priority` (Number) Default policy priority
--- `status` (String) Default policy status
--
--
-diff --git a/docs/resources/policy_password.md b/docs/resources/policy_password.md
-deleted file mode 100644
-index 1ee27ba4..00000000
---- a/docs/resources/policy_password.md
-+++ /dev/null
-@@ -1,56 +0,0 @@
-----
--page_title: "Resource: okta_policy_password"
--description: |-
--  
-----
--
--# Resource: okta_policy_password
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `name` (String) Policy Name
--
--### Optional
--
--- `auth_provider` (String) Authentication Provider: OKTA, ACTIVE_DIRECTORY or LDAP
--- `call_recovery` (String) Enable or disable voice call recovery: ACTIVE or INACTIVE.
--- `description` (String) Policy Description
--- `email_recovery` (String) Enable or disable email password recovery: ACTIVE or INACTIVE.
--- `groups_included` (Set of String) List of Group IDs to Include
--- `password_auto_unlock_minutes` (Number) Number of minutes before a locked account is unlocked: 0 = no limit.
--- `password_dictionary_lookup` (Boolean) Check Passwords Against Common Password Dictionary.
--- `password_exclude_first_name` (Boolean) User firstName attribute must be excluded from the password
--- `password_exclude_last_name` (Boolean) User lastName attribute must be excluded from the password
--- `password_exclude_username` (Boolean) If the user name must be excluded from the password.
--- `password_expire_warn_days` (Number) Length in days a user will be warned before password expiry: 0 = no warning.
--- `password_history_count` (Number) Number of distinct passwords that must be created before they can be reused: 0 = none.
--- `password_lockout_notification_channels` (Set of String) Notification channels to use to notify a user when their account has been locked.
--- `password_max_age_days` (Number) Length in days a password is valid before expiry: 0 = no limit.
--- `password_max_lockout_attempts` (Number) Number of unsuccessful login attempts allowed before lockout: 0 = no limit.
--- `password_min_age_minutes` (Number) Minimum time interval in minutes between password changes: 0 = no limit.
--- `password_min_length` (Number) Minimum password length.
--- `password_min_lowercase` (Number) If a password must contain at least one lower case letter: 0 = no, 1 = yes. Default = 1
--- `password_min_number` (Number) If a password must contain at least one number: 0 = no, 1 = yes. Default = 1
--- `password_min_symbol` (Number) If a password must contain at least one symbol (!@#$%^&*): 0 = no, 1 = yes. Default = 1
--- `password_min_uppercase` (Number) If a password must contain at least one upper case letter: 0 = no, 1 = yes. Default = 1
--- `password_show_lockout_failures` (Boolean) If a user should be informed when their account is locked.
--- `priority` (Number) Policy Priority, this attribute can be set to a valid priority. To avoid endless diff situation we error if an invalid priority is provided. API defaults it to the last (lowest) if not there.
--- `question_min_length` (Number) Min length of the password recovery question answer.
--- `question_recovery` (String) Enable or disable security question password recovery: ACTIVE or INACTIVE.
--- `recovery_email_token` (Number) Lifetime in minutes of the recovery email token.
--- `skip_unlock` (Boolean) When an Active Directory user is locked out of Okta, the Okta unlock operation should also attempt to unlock the user's Windows account.
--- `sms_recovery` (String) Enable or disable SMS password recovery: ACTIVE or INACTIVE.
--- `status` (String) Policy Status: ACTIVE or INACTIVE.
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/policy_password_default.md b/docs/resources/policy_password_default.md
-deleted file mode 100644
-index 93bb0922..00000000
---- a/docs/resources/policy_password_default.md
-+++ /dev/null
-@@ -1,53 +0,0 @@
-----
--page_title: "Resource: okta_policy_password_default"
--description: |-
--  
-----
--
--# Resource: okta_policy_password_default
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Optional
--
--- `call_recovery` (String) Enable or disable voice call recovery: ACTIVE or INACTIVE.
--- `email_recovery` (String) Enable or disable email password recovery: ACTIVE or INACTIVE.
--- `password_auto_unlock_minutes` (Number) Number of minutes before a locked account is unlocked: 0 = no limit.
--- `password_dictionary_lookup` (Boolean) Check Passwords Against Common Password Dictionary.
--- `password_exclude_first_name` (Boolean) User firstName attribute must be excluded from the password
--- `password_exclude_last_name` (Boolean) User lastName attribute must be excluded from the password
--- `password_exclude_username` (Boolean) If the user name must be excluded from the password.
--- `password_expire_warn_days` (Number) Length in days a user will be warned before password expiry: 0 = no warning.
--- `password_history_count` (Number) Number of distinct passwords that must be created before they can be reused: 0 = none.
--- `password_lockout_notification_channels` (Set of String) Notification channels to use to notify a user when their account has been locked.
--- `password_max_age_days` (Number) Length in days a password is valid before expiry: 0 = no limit.
--- `password_max_lockout_attempts` (Number) Number of unsuccessful login attempts allowed before lockout: 0 = no limit.
--- `password_min_age_minutes` (Number) Minimum time interval in minutes between password changes: 0 = no limit.
--- `password_min_length` (Number) Minimum password length.
--- `password_min_lowercase` (Number) If a password must contain at least one lower case letter: 0 = no, 1 = yes. Default = 1
--- `password_min_number` (Number) If a password must contain at least one number: 0 = no, 1 = yes. Default = 1
--- `password_min_symbol` (Number) If a password must contain at least one symbol (!@#$%^&*): 0 = no, 1 = yes. Default = 1
--- `password_min_uppercase` (Number) If a password must contain at least one upper case letter: 0 = no, 1 = yes. Default = 1
--- `password_show_lockout_failures` (Boolean) If a user should be informed when their account is locked.
--- `question_min_length` (Number) Min length of the password recovery question answer.
--- `question_recovery` (String) Enable or disable security question password recovery: ACTIVE or INACTIVE.
--- `recovery_email_token` (Number) Lifetime in minutes of the recovery email token.
--- `skip_unlock` (Boolean) When an Active Directory user is locked out of Okta, the Okta unlock operation should also attempt to unlock the user's Windows account.
--- `sms_recovery` (String) Enable or disable SMS password recovery: ACTIVE or INACTIVE.
--
--### Read-Only
--
--- `default_auth_provider` (String) Default Authentication Provider
--- `default_included_group_id` (String) Default group ID (always included)
--- `description` (String) Default policy description
--- `id` (String) The ID of this resource.
--- `name` (String) Default policy name
--- `priority` (Number) Default policy priority
--- `status` (String) Default policy status
--
--
-diff --git a/docs/resources/policy_profile_enrollment.md b/docs/resources/policy_profile_enrollment.md
-deleted file mode 100644
-index ec657221..00000000
---- a/docs/resources/policy_profile_enrollment.md
-+++ /dev/null
-@@ -1,28 +0,0 @@
-----
--page_title: "Resource: okta_policy_profile_enrollment"
--description: |-
--  
-----
--
--# Resource: okta_policy_profile_enrollment
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `name` (String) Name of the policy
--
--### Optional
--
--- `status` (String) Status of the policy
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/policy_profile_enrollment_apps.md b/docs/resources/policy_profile_enrollment_apps.md
-deleted file mode 100644
-index 9877261e..00000000
---- a/docs/resources/policy_profile_enrollment_apps.md
-+++ /dev/null
-@@ -1,29 +0,0 @@
-----
--page_title: "Resource: okta_policy_profile_enrollment_apps"
--description: |-
--  
-----
--
--# Resource: okta_policy_profile_enrollment_apps
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `policy_id` (String) ID of the enrollment policy.
--
--### Optional
--
--- `apps` (Set of String) List of app IDs to be added to this policy
--
--### Read-Only
--
--- `default_policy_id` (String) ID of the Default Enrollment Policy. This policy is used as a policy to re-assign apps to when they are unassigned from this one
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/policy_rule_idp_discovery.md b/docs/resources/policy_rule_idp_discovery.md
-deleted file mode 100644
-index cc9fc4c1..00000000
---- a/docs/resources/policy_rule_idp_discovery.md
-+++ /dev/null
-@@ -1,91 +0,0 @@
-----
--page_title: "Resource: okta_policy_rule_idp_discovery"
--description: |-
--  
-----
--
--# Resource: okta_policy_rule_idp_discovery
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `name` (String) Policy Rule Name
--
--### Optional
--
--- `app_exclude` (Block Set) Applications to exclude in discovery rule (see [below for nested schema](#nestedblock--app_exclude))
--- `app_include` (Block Set) Applications to include in discovery rule (see [below for nested schema](#nestedblock--app_include))
--- `idp_id` (String)
--- `idp_type` (String)
--- `network_connection` (String) Network selection mode: ANYWHERE, ZONE, ON_NETWORK, or OFF_NETWORK.
--- `network_excludes` (List of String) The zones to exclude
--- `network_includes` (List of String) The zones to include
--- `platform_include` (Block Set) (see [below for nested schema](#nestedblock--platform_include))
--- `policy_id` (String) Policy ID of the Rule
--- `priority` (Number) Policy Rule Priority, this attribute can be set to a valid priority. To avoid endless diff situation we error if an invalid priority is provided. API defaults it to the last (lowest) if not there.
--- `status` (String) Policy Rule Status: ACTIVE or INACTIVE.
--- `user_identifier_attribute` (String)
--- `user_identifier_patterns` (Block Set) (see [below for nested schema](#nestedblock--user_identifier_patterns))
--- `user_identifier_type` (String)
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--<a id="nestedblock--app_exclude"></a>
--### Nested Schema for `app_exclude`
--
--Required:
--
--- `type` (String)
--
--Optional:
--
--- `name` (String)
--
--Read-Only:
--
--- `id` (String) The ID of this resource.
--
--
--<a id="nestedblock--app_include"></a>
--### Nested Schema for `app_include`
--
--Required:
--
--- `type` (String)
--
--Optional:
--
--- `name` (String)
--
--Read-Only:
--
--- `id` (String) The ID of this resource.
--
--
--<a id="nestedblock--platform_include"></a>
--### Nested Schema for `platform_include`
--
--Optional:
--
--- `os_expression` (String) Only available with OTHER OS type
--- `os_type` (String)
--- `type` (String)
--
--
--<a id="nestedblock--user_identifier_patterns"></a>
--### Nested Schema for `user_identifier_patterns`
--
--Optional:
--
--- `match_type` (String)
--- `value` (String)
--
--
-diff --git a/docs/resources/policy_rule_mfa.md b/docs/resources/policy_rule_mfa.md
-deleted file mode 100644
-index fe88199d..00000000
---- a/docs/resources/policy_rule_mfa.md
-+++ /dev/null
-@@ -1,68 +0,0 @@
-----
--page_title: "Resource: okta_policy_rule_mfa"
--description: |-
--  
-----
--
--# Resource: okta_policy_rule_mfa
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `name` (String) Policy Rule Name
--
--### Optional
--
--- `app_exclude` (Block Set) Applications to exclude (see [below for nested schema](#nestedblock--app_exclude))
--- `app_include` (Block Set) Applications to include (see [below for nested schema](#nestedblock--app_include))
--- `enroll` (String) Should the user be enrolled the first time they LOGIN, the next time they are CHALLENGED, or NEVER?
--- `network_connection` (String) Network selection mode: ANYWHERE, ZONE, ON_NETWORK, or OFF_NETWORK.
--- `network_excludes` (List of String) The zones to exclude
--- `network_includes` (List of String) The zones to include
--- `policy_id` (String) Policy ID of the Rule
--- `priority` (Number) Policy Rule Priority, this attribute can be set to a valid priority. To avoid endless diff situation we error if an invalid priority is provided. API defaults it to the last (lowest) if not there.
--- `status` (String) Policy Rule Status: ACTIVE or INACTIVE.
--- `users_excluded` (Set of String) Set of User IDs to Exclude
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--<a id="nestedblock--app_exclude"></a>
--### Nested Schema for `app_exclude`
--
--Required:
--
--- `type` (String)
--
--Optional:
--
--- `name` (String)
--
--Read-Only:
--
--- `id` (String) The ID of this resource.
--
--
--<a id="nestedblock--app_include"></a>
--### Nested Schema for `app_include`
--
--Required:
--
--- `type` (String)
--
--Optional:
--
--- `name` (String)
--
--Read-Only:
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/policy_rule_password.md b/docs/resources/policy_rule_password.md
-deleted file mode 100644
-index cc99c24e..00000000
---- a/docs/resources/policy_rule_password.md
-+++ /dev/null
-@@ -1,37 +0,0 @@
-----
--page_title: "Resource: okta_policy_rule_password"
--description: |-
--  
-----
--
--# Resource: okta_policy_rule_password
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `name` (String) Policy Rule Name
--
--### Optional
--
--- `network_connection` (String) Network selection mode: ANYWHERE, ZONE, ON_NETWORK, or OFF_NETWORK.
--- `network_excludes` (List of String) The zones to exclude
--- `network_includes` (List of String) The zones to include
--- `password_change` (String) Allow or deny a user to change their password: ALLOW or DENY. Default = ALLOW
--- `password_reset` (String) Allow or deny a user to reset their password: ALLOW or DENY. Default = ALLOW
--- `password_unlock` (String) Allow or deny a user to unlock. Default = DENY
--- `policy_id` (String) Policy ID of the Rule
--- `priority` (Number) Policy Rule Priority, this attribute can be set to a valid priority. To avoid endless diff situation we error if an invalid priority is provided. API defaults it to the last (lowest) if not there.
--- `status` (String) Policy Rule Status: ACTIVE or INACTIVE.
--- `users_excluded` (Set of String) Set of User IDs to Exclude
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/policy_rule_profile_enrollment.md b/docs/resources/policy_rule_profile_enrollment.md
-deleted file mode 100644
-index a94adf68..00000000
---- a/docs/resources/policy_rule_profile_enrollment.md
-+++ /dev/null
-@@ -1,48 +0,0 @@
-----
--page_title: "Resource: okta_policy_rule_profile_enrollment"
--description: |-
--  
-----
--
--# Resource: okta_policy_rule_profile_enrollment
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `policy_id` (String) ID of the policy
--- `unknown_user_action` (String) Which action should be taken if this User is new
--
--### Optional
--
--- `access` (String) Allow or deny access based on the rule conditions: ALLOW or DENY
--- `email_verification` (Boolean) Indicates whether email verification should occur before access is granted
--- `inline_hook_id` (String) ID of a Registration Inline Hook
--- `profile_attributes` (Block List) A list of attributes to prompt the user during registration or progressive profiling (see [below for nested schema](#nestedblock--profile_attributes))
--- `target_group_id` (String) The ID of a Group that this User should be added to
--- `ui_schema_id` (String) Value created by the backend. If present all policy updates must include this attribute/value.
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--- `name` (String) Name of the rule
--- `status` (String) Status of the rule
--
--<a id="nestedblock--profile_attributes"></a>
--### Nested Schema for `profile_attributes`
--
--Required:
--
--- `label` (String) A display-friendly label for this property
--- `name` (String) The name of a User Profile property
--
--Optional:
--
--- `required` (Boolean) Indicates if this property is required for enrollment
--
--
-diff --git a/docs/resources/policy_rule_signon.md b/docs/resources/policy_rule_signon.md
-deleted file mode 100644
-index 0478ead5..00000000
---- a/docs/resources/policy_rule_signon.md
-+++ /dev/null
-@@ -1,69 +0,0 @@
-----
--page_title: "Resource: okta_policy_rule_signon"
--description: |-
--  
-----
--
--# Resource: okta_policy_rule_signon
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `name` (String) Policy Rule Name
--
--### Optional
--
--- `access` (String) Allow or deny access based on the rule conditions: ALLOW, DENY or CHALLENGE.
--- `authtype` (String) Authentication entrypoint: ANY, RADIUS or LDAP_INTERFACE
--- `behaviors` (Set of String) List of behavior IDs
--- `factor_sequence` (Block List) (see [below for nested schema](#nestedblock--factor_sequence))
--- `identity_provider` (String) Apply rule based on the IdP used: ANY, OKTA or SPECIFIC_IDP.
--- `identity_provider_ids` (List of String) When identity_provider is SPECIFIC_IDP then this is the list of IdP IDs to apply the rule on
--- `mfa_lifetime` (Number) Elapsed time before the next MFA challenge
--- `mfa_prompt` (String) Prompt for MFA based on the device used, a factor session lifetime, or every sign-on attempt: DEVICE, SESSION or ALWAYS
--- `mfa_remember_device` (Boolean) Remember MFA device.
--- `mfa_required` (Boolean) Require MFA.
--- `network_connection` (String) Network selection mode: ANYWHERE, ZONE, ON_NETWORK, or OFF_NETWORK.
--- `network_excludes` (List of String) The zones to exclude
--- `network_includes` (List of String) The zones to include
--- `policy_id` (String) Policy ID of the Rule
--- `primary_factor` (String) Primary factor.
--- `priority` (Number) Policy Rule Priority, this attribute can be set to a valid priority. To avoid endless diff situation we error if an invalid priority is provided. API defaults it to the last (lowest) if not there.
--- `risc_level` (String) Risc level: ANY, LOW, MEDIUM or HIGH
--- `session_idle` (Number) Max minutes a session can be idle.
--- `session_lifetime` (Number) Max minutes a session is active: Disable = 0.
--- `session_persistent` (Boolean) Whether session cookies will last across browser sessions. Okta Administrators can never have persistent session cookies.
--- `status` (String) Policy Rule Status: ACTIVE or INACTIVE.
--- `users_excluded` (Set of String) Set of User IDs to Exclude
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--<a id="nestedblock--factor_sequence"></a>
--### Nested Schema for `factor_sequence`
--
--Required:
--
--- `primary_criteria_factor_type` (String) Type of a Factor
--- `primary_criteria_provider` (String) Factor provider
--
--Optional:
--
--- `secondary_criteria` (Block List) (see [below for nested schema](#nestedblock--factor_sequence--secondary_criteria))
--
--<a id="nestedblock--factor_sequence--secondary_criteria"></a>
--### Nested Schema for `factor_sequence.secondary_criteria`
--
--Required:
--
--- `factor_type` (String) Type of a Factor
--- `provider` (String) Factor provider
--
--
-diff --git a/docs/resources/policy_signon.md b/docs/resources/policy_signon.md
-deleted file mode 100644
-index 53735c73..00000000
---- a/docs/resources/policy_signon.md
-+++ /dev/null
-@@ -1,31 +0,0 @@
-----
--page_title: "Resource: okta_policy_signon"
--description: |-
--  
-----
--
--# Resource: okta_policy_signon
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `name` (String) Policy Name
--
--### Optional
--
--- `description` (String) Policy Description
--- `groups_included` (Set of String) List of Group IDs to Include
--- `priority` (Number) Policy Priority, this attribute can be set to a valid priority. To avoid endless diff situation we error if an invalid priority is provided. API defaults it to the last (lowest) if not there.
--- `status` (String) Policy Status: ACTIVE or INACTIVE.
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/profile_mapping.md b/docs/resources/profile_mapping.md
-deleted file mode 100644
-index f53f93cc..00000000
---- a/docs/resources/profile_mapping.md
-+++ /dev/null
-@@ -1,47 +0,0 @@
-----
--page_title: "Resource: okta_profile_mapping"
--description: |-
--  
-----
--
--# Resource: okta_profile_mapping
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `source_id` (String) The source id of the mapping to manage.
--- `target_id` (String) The target id of the mapping to manage.
--
--### Optional
--
--- `always_apply` (Boolean) Whether apply the changes to all users with this profile after updating or creating the these mappings.
--- `delete_when_absent` (Boolean) When turned on this flag will trigger the provider to delete mapping properties that are not defined in config. By default, we do not delete missing properties.
--- `mappings` (Block Set) (see [below for nested schema](#nestedblock--mappings))
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--- `source_name` (String)
--- `source_type` (String)
--- `target_name` (String)
--- `target_type` (String)
--
--<a id="nestedblock--mappings"></a>
--### Nested Schema for `mappings`
--
--Required:
--
--- `expression` (String)
--- `id` (String) The mapping property key.
--
--Optional:
--
--- `push_status` (String)
--
--
-diff --git a/docs/resources/rate_limiting.md b/docs/resources/rate_limiting.md
-deleted file mode 100644
-index 79a4b003..00000000
---- a/docs/resources/rate_limiting.md
-+++ /dev/null
-@@ -1,29 +0,0 @@
-----
--page_title: "Resource: okta_rate_limiting"
--description: |-
--  
-----
--
--# Resource: okta_rate_limiting
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `authorize` (String) Called during authentication.
--- `login` (String) Called when accessing the Okta hosted login page.
--
--### Optional
--
--- `communications_enabled` (Boolean) Enables rate limit warning, violation, notification emails and banners when this org meets rate limits.
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/resource_set.md b/docs/resources/resource_set.md
-deleted file mode 100644
-index 6418487d..00000000
---- a/docs/resources/resource_set.md
-+++ /dev/null
-@@ -1,29 +0,0 @@
-----
--page_title: "Resource: okta_resource_set"
--description: |-
--  Resource to manage administrative Role assignments for a User
-----
--
--# Resource: okta_resource_set
--
--Resource to manage administrative Role assignments for a User
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `description` (String) A description of the Resource Set
--- `label` (String) Unique name given to the Resource Set
--
--### Optional
--
--- `resources` (Set of String) The endpoints that reference the resources to be included in the new Resource Set
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/role_subscription.md b/docs/resources/role_subscription.md
-deleted file mode 100644
-index f43af702..00000000
---- a/docs/resources/role_subscription.md
-+++ /dev/null
-@@ -1,29 +0,0 @@
-----
--page_title: "Resource: okta_role_subscription"
--description: |-
--  
-----
--
--# Resource: okta_role_subscription
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `notification_type` (String) Type of the notification
--- `role_type` (String) Type of the role
--
--### Optional
--
--- `status` (String) Status of subscription
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/security_notification_emails.md b/docs/resources/security_notification_emails.md
-deleted file mode 100644
-index 256f0d6e..00000000
---- a/docs/resources/security_notification_emails.md
-+++ /dev/null
-@@ -1,28 +0,0 @@
-----
--page_title: "Resource: okta_security_notification_emails"
--description: |-
--  
-----
--
--# Resource: okta_security_notification_emails
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Optional
--
--- `report_suspicious_activity_enabled` (Boolean) Notifies end users about suspicious or unrecognized activity from their account
--- `send_email_for_factor_enrollment_enabled` (Boolean) Notifies end users of any activity on their account related to MFA factor enrollment
--- `send_email_for_factor_reset_enabled` (Boolean) Notifies end users that one or more factors have been reset for their account
--- `send_email_for_new_device_enabled` (Boolean) Notifies end users about new sign-on activity
--- `send_email_for_password_changed_enabled` (Boolean) Notifies end users that the password for their account has changed
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/template_sms.md b/docs/resources/template_sms.md
-deleted file mode 100644
-index ea14143a..00000000
---- a/docs/resources/template_sms.md
-+++ /dev/null
-@@ -1,37 +0,0 @@
-----
--page_title: "Resource: okta_template_sms"
--description: |-
--  
-----
--
--# Resource: okta_template_sms
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `template` (String) SMS default template
--- `type` (String) SMS template type
--
--### Optional
--
--- `translations` (Block Set) (see [below for nested schema](#nestedblock--translations))
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--<a id="nestedblock--translations"></a>
--### Nested Schema for `translations`
--
--Required:
--
--- `language` (String)
--- `template` (String)
--
--
-diff --git a/docs/resources/theme.md b/docs/resources/theme.md
-deleted file mode 100644
-index 6d2c51e4..00000000
---- a/docs/resources/theme.md
-+++ /dev/null
-@@ -1,43 +0,0 @@
-----
--page_title: "Resource: okta_theme"
--description: |-
--  
-----
--
--# Resource: okta_theme
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `brand_id` (String) Brand ID
--
--### Optional
--
--- `background_image` (String) Path to local file
--- `email_template_touch_point_variant` (String) Variant for email templates (`OKTA_DEFAULT`, `FULL_THEME`)
--- `end_user_dashboard_touch_point_variant` (String) Variant for the Okta End-User Dashboard (`OKTA_DEFAULT`, `WHITE_LOGO_BACKGROUND`, `FULL_THEME`, `LOGO_ON_FULL_WHITE_BACKGROUND`)
--- `error_page_touch_point_variant` (String) Variant for the error page (`OKTA_DEFAULT`, `BACKGROUND_SECONDARY_COLOR`, `BACKGROUND_IMAGE`)
--- `favicon` (String) Path to local file
--- `logo` (String) Path to local file
--- `primary_color_contrast_hex` (String) Primary color contrast hex code
--- `primary_color_hex` (String) Primary color hex code
--- `secondary_color_contrast_hex` (String) Secondary color contrast hex code
--- `secondary_color_hex` (String) Secondary color hex code
--- `sign_in_page_touch_point_variant` (String) Variant for the Okta Sign-In Page (`OKTA_DEFAULT`, `BACKGROUND_SECONDARY_COLOR`, `BACKGROUND_IMAGE`)
--- `theme_id` (String) Theme ID - Note: Okta API for theme only reads and updates therefore the okta_theme resource needs to act as a quasi data source. Do this by setting theme_id.
--
--### Read-Only
--
--- `background_image_url` (String) Background image URL
--- `favicon_url` (String) Favicon URL
--- `id` (String) Brand ID
--- `links` (String) Link relations for this object - JSON HAL - Discoverable resources related to the email template
--- `logo_url` (String) Logo URL
--
--
-diff --git a/docs/resources/threat_insight_settings.md b/docs/resources/threat_insight_settings.md
-deleted file mode 100644
-index 623e0c93..00000000
---- a/docs/resources/threat_insight_settings.md
-+++ /dev/null
-@@ -1,28 +0,0 @@
-----
--page_title: "Resource: okta_threat_insight_settings"
--description: |-
--  
-----
--
--# Resource: okta_threat_insight_settings
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `action` (String) Specifies how Okta responds to authentication requests from suspicious IPs
--
--### Optional
--
--- `network_excludes` (List of String) List of Network Zone IDs to exclude to be not logged or blocked by Okta ThreatInsight and proceed to Sign On rules evaluation
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/trusted_origin.md b/docs/resources/trusted_origin.md
-deleted file mode 100644
-index bdc6b6aa..00000000
---- a/docs/resources/trusted_origin.md
-+++ /dev/null
-@@ -1,30 +0,0 @@
-----
--page_title: "Resource: okta_trusted_origin"
--description: |-
--  
-----
--
--# Resource: okta_trusted_origin
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `name` (String) Unique name for this trusted origin
--- `origin` (String) Unique origin URL for this trusted origin
--- `scopes` (List of String) Scopes of the Trusted Origin - can either be CORS or REDIRECT only
--
--### Optional
--
--- `active` (Boolean) Whether the Trusted Origin is active or not - can only be issued post-creation
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/user.md b/docs/resources/user.md
-deleted file mode 100644
-index 4e75fae2..00000000
---- a/docs/resources/user.md
-+++ /dev/null
-@@ -1,83 +0,0 @@
-----
--page_title: "Resource: okta_user"
--description: |-
--  
-----
--
--# Resource: okta_user
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `email` (String) User primary email address
--- `first_name` (String) User first name
--- `last_name` (String) User last name
--- `login` (String) User Okta login
--
--### Optional
--
--- `city` (String) User city
--- `cost_center` (String) User cost center
--- `country_code` (String) User country code
--- `custom_profile_attributes` (String) JSON formatted custom attributes for a user. It must be JSON due to various types Okta allows.
--- `custom_profile_attributes_to_ignore` (Set of String) List of custom_profile_attribute keys that should be excluded from being managed by Terraform.
--- `department` (String) User department
--- `display_name` (String) User display name, suitable to show end users
--- `division` (String) User division
--- `employee_number` (String) User employee number
--- `expire_password_on_create` (Boolean) If set to `true`, the user will have to change the password at the next login. This property will be used when user is being created and works only when `password` field is set
--- `honorific_prefix` (String) User honorific prefix
--- `honorific_suffix` (String) User honorific suffix
--- `locale` (String) User default location
--- `manager` (String) Manager of User
--- `manager_id` (String) Manager ID of User
--- `middle_name` (String) User middle name
--- `mobile_phone` (String) User mobile phone number
--- `nick_name` (String) User nickname
--- `old_password` (String, Sensitive) Old User Password. Should be only set in case the password was not changed using the provider
--- `organization` (String) User organization
--- `password` (String, Sensitive) User Password
--- `password_hash` (Block Set, Max: 1) Specifies a hashed password to import into Okta. (see [below for nested schema](#nestedblock--password_hash))
--- `password_inline_hook` (String) When specified, the Password Inline Hook is triggered to handle verification of the end user's password the first time the user tries to sign in
--- `postal_address` (String) User mailing address
--- `preferred_language` (String) User preferred language
--- `primary_phone` (String) User primary phone number
--- `profile_url` (String) User online profile (web page)
--- `recovery_answer` (String, Sensitive) User Password Recovery Answer
--- `recovery_question` (String) User Password Recovery Question
--- `second_email` (String) User secondary email address, used for account recovery
--- `skip_roles` (Boolean, Deprecated) Do not populate user roles information (prevents additional API call)
--- `state` (String) User state or region
--- `status` (String) The status of the User in Okta - remove to set user back to active/provisioned
--- `street_address` (String) User street address
--- `timezone` (String) User default timezone
--- `title` (String) User title
--- `user_type` (String) User employee type
--- `zip_code` (String) User zipcode or postal code
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--- `raw_status` (String) The raw status of the User in Okta - (status is mapped)
--
--<a id="nestedblock--password_hash"></a>
--### Nested Schema for `password_hash`
--
--Required:
--
--- `algorithm` (String) The algorithm used to generate the hash using the password
--- `value` (String) For SHA-512, SHA-256, SHA-1, MD5, This is the actual base64-encoded hash of the password (and salt, if used). This is the Base64 encoded value of the SHA-512/SHA-256/SHA-1/MD5 digest that was computed by either pre-fixing or post-fixing the salt to the password, depending on the saltOrder. If a salt was not used in the source system, then this should just be the the Base64 encoded value of the password's SHA-512/SHA-256/SHA-1/MD5 digest. For BCRYPT, This is the actual radix64-encoded hashed password.
--
--Optional:
--
--- `salt` (String) Only required for salted hashes
--- `salt_order` (String) Specifies whether salt was pre- or postfixed to the password before hashing
--- `work_factor` (Number) Governs the strength of the hash and the time required to compute it. Only required for BCRYPT algorithm
--
--
-diff --git a/docs/resources/user_admin_roles.md b/docs/resources/user_admin_roles.md
-deleted file mode 100644
-index a9f740b6..00000000
---- a/docs/resources/user_admin_roles.md
-+++ /dev/null
-@@ -1,29 +0,0 @@
-----
--page_title: "Resource: okta_user_admin_roles"
--description: |-
--  Resource to manage a set of administrator roles for a specific user.
-----
--
--# Resource: okta_user_admin_roles
--
--Resource to manage a set of administrator roles for a specific user.
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `admin_roles` (Set of String) User Okta admin roles - ie. ['APP_ADMIN', 'USER_ADMIN']
--- `user_id` (String) ID of a Okta User
--
--### Optional
--
--- `disable_notifications` (Boolean) When this setting is enabled, the admins won't receive any of the default Okta administrator emails
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/user_base_schema_property.md b/docs/resources/user_base_schema_property.md
-deleted file mode 100644
-index a364c265..00000000
---- a/docs/resources/user_base_schema_property.md
-+++ /dev/null
-@@ -1,34 +0,0 @@
-----
--page_title: "Resource: okta_user_base_schema_property"
--description: |-
--  
-----
--
--# Resource: okta_user_base_schema_property
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `index` (String) Subschema unique string identifier
--- `title` (String) Subschema title (display name)
--- `type` (String) Subschema type: string, boolean, number, integer, array, or object
--
--### Optional
--
--- `master` (String) SubSchema profile manager, if not set it will inherit its setting.
--- `pattern` (String) The validation pattern to use for the subschema. Must be in form of '.+', or '[<pattern>]+' if present.'
--- `permissions` (String) SubSchema permissions: HIDE, READ_ONLY, or READ_WRITE.
--- `required` (Boolean) Whether the subschema is required
--- `user_type` (String) Custom subschema user type
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/user_factor_question.md b/docs/resources/user_factor_question.md
-deleted file mode 100644
-index deba8978..00000000
---- a/docs/resources/user_factor_question.md
-+++ /dev/null
-@@ -1,28 +0,0 @@
-----
--page_title: "Resource: okta_user_factor_question"
--description: |-
--  Resource to manage a question factor for a user
-----
--
--# Resource: okta_user_factor_question
--
--Resource to manage a question factor for a user
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `answer` (String, Sensitive) User password security answer
--- `key` (String) Unique key for question
--- `user_id` (String) ID of a Okta User
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--- `status` (String) User factor status.
--- `text` (String) Display text for question
--
--
-diff --git a/docs/resources/user_group_memberships.md b/docs/resources/user_group_memberships.md
-deleted file mode 100644
-index e7ba42c4..00000000
---- a/docs/resources/user_group_memberships.md
-+++ /dev/null
-@@ -1,25 +0,0 @@
-----
--page_title: "Resource: okta_user_group_memberships"
--description: |-
--  Resource to manage a set of group memberships for a specific user.
-----
--
--# Resource: okta_user_group_memberships
--
--Resource to manage a set of group memberships for a specific user.
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `groups` (Set of String) The list of Okta group IDs which the user should have membership managed for.
--- `user_id` (String) ID of a Okta User
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
-diff --git a/docs/resources/user_schema_property.md b/docs/resources/user_schema_property.md
-deleted file mode 100644
-index 9916acc4..00000000
---- a/docs/resources/user_schema_property.md
-+++ /dev/null
-@@ -1,76 +0,0 @@
-----
--page_title: "Resource: okta_user_schema_property"
--description: |-
--  
-----
--
--# Resource: okta_user_schema_property
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `index` (String) Subschema unique string identifier
--- `title` (String) Subschema title (display name)
--- `type` (String) Subschema type: string, boolean, number, integer, array, or object
--
--### Optional
--
--- `array_enum` (List of String) Custom Subschema enumerated value of a property of type array.
--- `array_one_of` (Block List) array of valid JSON schemas for property type array. (see [below for nested schema](#nestedblock--array_one_of))
--- `array_type` (String) Subschema array type: string, number, integer, reference. Type field must be an array.
--- `description` (String) Custom Subschema description
--- `enum` (List of String) Custom Subschema enumerated value of the property. see: developer.okta.com/docs/api/resources/schemas#user-profile-schema-property-object
--- `external_name` (String) Subschema external name
--- `external_namespace` (String) Subschema external namespace
--- `master` (String) SubSchema profile manager, if not set it will inherit its setting.
--- `master_override_priority` (Block List) (see [below for nested schema](#nestedblock--master_override_priority))
--- `max_length` (Number) Subschema of type string maximum length
--- `min_length` (Number) Subschema of type string minimum length
--- `one_of` (Block List) Custom Subschema json schemas. see: developer.okta.com/docs/api/resources/schemas#user-profile-schema-property-object (see [below for nested schema](#nestedblock--one_of))
--- `pattern` (String) The validation pattern to use for the subschema. Must be in form of '.+', or '[<pattern>]+' if present.'
--- `permissions` (String) SubSchema permissions: HIDE, READ_ONLY, or READ_WRITE.
--- `required` (Boolean) Whether the subschema is required
--- `scope` (String)
--- `unique` (String) Subschema unique restriction
--- `user_type` (String) Custom subschema user type
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--<a id="nestedblock--array_one_of"></a>
--### Nested Schema for `array_one_of`
--
--Required:
--
--- `const` (String) Enum value
--- `title` (String) Enum title
--
--
--<a id="nestedblock--master_override_priority"></a>
--### Nested Schema for `master_override_priority`
--
--Required:
--
--- `value` (String)
--
--Optional:
--
--- `type` (String)
--
--
--<a id="nestedblock--one_of"></a>
--### Nested Schema for `one_of`
--
--Required:
--
--- `const` (String) Enum value
--- `title` (String) Enum title
--
--
-diff --git a/docs/resources/user_type.md b/docs/resources/user_type.md
-deleted file mode 100644
-index 13bd775f..00000000
---- a/docs/resources/user_type.md
-+++ /dev/null
-@@ -1,26 +0,0 @@
-----
--page_title: "Resource: okta_user_type"
--description: |-
--  
-----
--
--# Resource: okta_user_type
--
--
--
--
--
--<!-- schema generated by tfplugindocs -->
--## Schema
--
--### Required
--
--- `description` (String) A human-readable description of the User type
--- `display_name` (String) The display name of the user type
--- `name` (String) Name of the user type
--
--### Read-Only
--
--- `id` (String) The ID of this resource.
--
--
diff --git a/provider/cmd/pulumi-resource-okta/schema.json b/provider/cmd/pulumi-resource-okta/schema.json
index c93e339e..d873e92f 100644
--- a/provider/cmd/pulumi-resource-okta/schema.json
+++ b/provider/cmd/pulumi-resource-okta/schema.json
@@ -40,7 +40,7 @@
             "generateExtraInputTypes": true
         },
         "nodejs": {
-            "packageDescription": "A Pulumi package for creating and managing okta resources.. Based on terraform-provider-okta: version v4.8.0",
+            "packageDescription": "A Pulumi package for creating and managing okta resources.. Based on terraform-provider-okta: version v4.8.1",
             "readme": "\u003e This provider is a derived work of the [Terraform Provider](https://github.com/okta/terraform-provider-okta)\n\u003e distributed under [MPL 2.0](https://www.mozilla.org/en-US/MPL/2.0/). If you encounter a bug or missing feature,\n\u003e first check the [`pulumi-okta` repo](https://github.com/pulumi/pulumi-okta/issues); however, if that doesn't turn up anything,\n\u003e please consult the source [`terraform-provider-okta` repo](https://github.com/okta/terraform-provider-okta/issues).",
             "dependencies": {
                 "@pulumi/pulumi": "^3.0.0"
@@ -4505,7 +4505,7 @@
                 },
                 "signatureAlgorithm": {
                     "type": "string",
-                    "description": "Signature algorithm used ot digitally sign the assertion and response.\n"
+                    "description": "Signature algorithm used to digitally sign the assertion and response.\n"
                 },
                 "singleLogoutCertificate": {
                     "type": "string",
@@ -4715,7 +4715,7 @@
                 },
                 "signatureAlgorithm": {
                     "type": "string",
-                    "description": "Signature algorithm used ot digitally sign the assertion and response.\n"
+                    "description": "Signature algorithm used to digitally sign the assertion and response.\n"
                 },
                 "singleLogoutCertificate": {
                     "type": "string",
@@ -4975,7 +4975,7 @@
                     },
                     "signatureAlgorithm": {
                         "type": "string",
-                        "description": "Signature algorithm used ot digitally sign the assertion and response.\n"
+                        "description": "Signature algorithm used to digitally sign the assertion and response.\n"
                     },
                     "singleLogoutCertificate": {
                         "type": "string",
@@ -5784,7 +5784,7 @@
                 },
                 "appLinksJson": {
                     "type": "string",
-                    "description": "Displays specific appLinks for the app\n"
+                    "description": "Displays specific appLinks for the app. The value for each application link should be boolean.\n"
                 },
                 "autoSubmitToolbar": {
                     "type": "boolean",
@@ -5918,7 +5918,7 @@
                 },
                 "appLinksJson": {
                     "type": "string",
-                    "description": "Displays specific appLinks for the app\n"
+                    "description": "Displays specific appLinks for the app. The value for each application link should be boolean.\n"
                 },
                 "autoSubmitToolbar": {
                     "type": "boolean",
@@ -6039,7 +6039,7 @@
                     },
                     "appLinksJson": {
                         "type": "string",
-                        "description": "Displays specific appLinks for the app\n"
+                        "description": "Displays specific appLinks for the app. The value for each application link should be boolean.\n"
                     },
                     "autoSubmitToolbar": {
                         "type": "boolean",
@@ -7451,7 +7451,7 @@
                 },
                 "roleType": {
                     "type": "string",
-                    "description": "Admin role assigned to the group. It can be any one of the following values:\n`\"API_ADMIN\"`,\n`\"APP_ADMIN\"`,\n`\"CUSTOM\"`,\n`\"GROUP_MEMBERSHIP_ADMIN\"`,\n`\"HELP_DESK_ADMIN\"`,\n`\"MOBILE_ADMIN\"`,\n`\"ORG_ADMIN\"`,\n`\"READ_ONLY_ADMIN\"`,\n`\"REPORT_ADMIN\"`,\n`\"SUPER_ADMIN\"`,\n`\"USER_ADMIN\"`\n. See [API Docs](https://developer.okta.com/docs/reference/api/roles/#role-types).\n\n\n- `\"USER_ADMIN\"` is the Group Administrator.\n"
+                    "description": "Admin role assigned to the group. It can be any one of the following values:\n`\"API_ACCESS_MANAGEMENT_ADMIN\"`,\n`\"APP_ADMIN\"`,\n`\"CUSTOM\"`,\n`\"GROUP_MEMBERSHIP_ADMIN\"`,\n`\"HELP_DESK_ADMIN\"`,\n`\"MOBILE_ADMIN\"`,\n`\"ORG_ADMIN\"`,\n`\"READ_ONLY_ADMIN\"`,\n`\"REPORT_ADMIN\"`,\n`\"SUPER_ADMIN\"`,\n`\"USER_ADMIN\"`\n. See [API Docs](https://developer.okta.com/docs/reference/api/roles/#role-types).\n\n\n- `\"USER_ADMIN\"` is the Group Administrator.\n"
                 },
                 "targetAppLists": {
                     "type": "array",
@@ -7484,7 +7484,7 @@
                 },
                 "roleType": {
                     "type": "string",
-                    "description": "Admin role assigned to the group. It can be any one of the following values:\n`\"API_ADMIN\"`,\n`\"APP_ADMIN\"`,\n`\"CUSTOM\"`,\n`\"GROUP_MEMBERSHIP_ADMIN\"`,\n`\"HELP_DESK_ADMIN\"`,\n`\"MOBILE_ADMIN\"`,\n`\"ORG_ADMIN\"`,\n`\"READ_ONLY_ADMIN\"`,\n`\"REPORT_ADMIN\"`,\n`\"SUPER_ADMIN\"`,\n`\"USER_ADMIN\"`\n. See [API Docs](https://developer.okta.com/docs/reference/api/roles/#role-types).\n\n\n- `\"USER_ADMIN\"` is the Group Administrator.\n",
+                    "description": "Admin role assigned to the group. It can be any one of the following values:\n`\"API_ACCESS_MANAGEMENT_ADMIN\"`,\n`\"APP_ADMIN\"`,\n`\"CUSTOM\"`,\n`\"GROUP_MEMBERSHIP_ADMIN\"`,\n`\"HELP_DESK_ADMIN\"`,\n`\"MOBILE_ADMIN\"`,\n`\"ORG_ADMIN\"`,\n`\"READ_ONLY_ADMIN\"`,\n`\"REPORT_ADMIN\"`,\n`\"SUPER_ADMIN\"`,\n`\"USER_ADMIN\"`\n. See [API Docs](https://developer.okta.com/docs/reference/api/roles/#role-types).\n\n\n- `\"USER_ADMIN\"` is the Group Administrator.\n",
                     "willReplaceOnChanges": true
                 },
                 "targetAppLists": {
@@ -7520,7 +7520,7 @@
                     },
                     "roleType": {
                         "type": "string",
-                        "description": "Admin role assigned to the group. It can be any one of the following values:\n`\"API_ADMIN\"`,\n`\"APP_ADMIN\"`,\n`\"CUSTOM\"`,\n`\"GROUP_MEMBERSHIP_ADMIN\"`,\n`\"HELP_DESK_ADMIN\"`,\n`\"MOBILE_ADMIN\"`,\n`\"ORG_ADMIN\"`,\n`\"READ_ONLY_ADMIN\"`,\n`\"REPORT_ADMIN\"`,\n`\"SUPER_ADMIN\"`,\n`\"USER_ADMIN\"`\n. See [API Docs](https://developer.okta.com/docs/reference/api/roles/#role-types).\n\n\n- `\"USER_ADMIN\"` is the Group Administrator.\n",
+                        "description": "Admin role assigned to the group. It can be any one of the following values:\n`\"API_ACCESS_MANAGEMENT_ADMIN\"`,\n`\"APP_ADMIN\"`,\n`\"CUSTOM\"`,\n`\"GROUP_MEMBERSHIP_ADMIN\"`,\n`\"HELP_DESK_ADMIN\"`,\n`\"MOBILE_ADMIN\"`,\n`\"ORG_ADMIN\"`,\n`\"READ_ONLY_ADMIN\"`,\n`\"REPORT_ADMIN\"`,\n`\"SUPER_ADMIN\"`,\n`\"USER_ADMIN\"`\n. See [API Docs](https://developer.okta.com/docs/reference/api/roles/#role-types).\n\n\n- `\"USER_ADMIN\"` is the Group Administrator.\n",
                         "willReplaceOnChanges": true
                     },
                     "targetAppLists": {
@@ -7748,10 +7748,6 @@
                     "type": "string",
                     "description": "The Application's display name.\n"
                 },
-                "pkceRequired": {
-                    "type": "boolean",
-                    "description": "Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See:\nhttps://developer.okta.com/docs/reference/api/idps/#oauth-2-0-and-openid-connect-client-object\n"
-                },
                 "profileMaster": {
                     "type": "boolean",
                     "description": "Determines if the IdP should act as a source of truth for user profile attributes.\n"
@@ -7917,10 +7913,6 @@
                     "type": "string",
                     "description": "The Application's display name.\n"
                 },
-                "pkceRequired": {
-                    "type": "boolean",
-                    "description": "Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See:\nhttps://developer.okta.com/docs/reference/api/idps/#oauth-2-0-and-openid-connect-client-object\n"
-                },
                 "profileMaster": {
                     "type": "boolean",
                     "description": "Determines if the IdP should act as a source of truth for user profile attributes.\n"
@@ -8077,10 +8069,6 @@
                         "type": "string",
                         "description": "The Application's display name.\n"
                     },
-                    "pkceRequired": {
-                        "type": "boolean",
-                        "description": "Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See:\nhttps://developer.okta.com/docs/reference/api/idps/#oauth-2-0-and-openid-connect-client-object\n"
-                    },
                     "profileMaster": {
                         "type": "boolean",
                         "description": "Determines if the IdP should act as a source of truth for user profile attributes.\n"
@@ -10577,11 +10565,11 @@
                 },
                 "unique": {
                     "type": "string",
-                    "description": "Subschema unique restriction\n"
+                    "description": "Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.\n"
                 },
                 "userType": {
                     "type": "string",
-                    "description": "Custom subschema user type\n"
+                    "description": "User type ID. By default, it is `default`\n"
                 }
             },
             "required": [
@@ -10687,12 +10675,12 @@
                 },
                 "unique": {
                     "type": "string",
-                    "description": "Subschema unique restriction\n",
+                    "description": "Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.\n",
                     "willReplaceOnChanges": true
                 },
                 "userType": {
                     "type": "string",
-                    "description": "Custom subschema user type\n"
+                    "description": "User type ID. By default, it is `default`\n"
                 }
             },
             "requiredInputs": [
@@ -10800,12 +10788,12 @@
                     },
                     "unique": {
                         "type": "string",
-                        "description": "Subschema unique restriction\n",
+                        "description": "Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.\n",
                         "willReplaceOnChanges": true
                     },
                     "userType": {
                         "type": "string",
-                        "description": "Custom subschema user type\n"
+                        "description": "User type ID. By default, it is `default`\n"
                     }
                 },
                 "type": "object"
@@ -12112,7 +12100,8 @@
                     "description": "The event hook display name.\n"
                 },
                 "status": {
-                    "type": "string"
+                    "type": "string",
+                    "description": "Default to `ACTIVE`\n"
                 }
             },
             "required": [
@@ -12154,7 +12143,8 @@
                     "description": "The event hook display name.\n"
                 },
                 "status": {
-                    "type": "string"
+                    "type": "string",
+                    "description": "Default to `ACTIVE`\n"
                 }
             },
             "requiredInputs": [
@@ -12197,7 +12187,8 @@
                         "description": "The event hook display name.\n"
                     },
                     "status": {
-                        "type": "string"
+                        "type": "string",
+                        "description": "Default to `ACTIVE`\n"
                     }
                 },
                 "type": "object"
@@ -12930,7 +12921,7 @@
                 },
                 "logo": {
                     "type": "string",
-                    "description": "Local path to logo of the org.\n"
+                    "description": "Logo of org. The file must be in PNG, JPG, or GIF format and less than 1 MB in size. For best results use landscape\norientation, a transparent background, and a minimum size of 420px by 120px to prevent upscaling.\n"
                 },
                 "optOutCommunicationEmails": {
                     "type": "boolean",
@@ -13001,7 +12992,7 @@
                 },
                 "logo": {
                     "type": "string",
-                    "description": "Local path to logo of the org.\n"
+                    "description": "Logo of org. The file must be in PNG, JPG, or GIF format and less than 1 MB in size. For best results use landscape\norientation, a transparent background, and a minimum size of 420px by 120px to prevent upscaling.\n"
                 },
                 "optOutCommunicationEmails": {
                     "type": "boolean",
@@ -13072,7 +13063,7 @@
                     },
                     "logo": {
                         "type": "string",
-                        "description": "Local path to logo of the org.\n"
+                        "description": "Logo of org. The file must be in PNG, JPG, or GIF format and less than 1 MB in size. For best results use landscape\norientation, a transparent background, and a minimum size of 420px by 120px to prevent upscaling.\n"
                     },
                     "optOutCommunicationEmails": {
                         "type": "boolean",
@@ -14429,7 +14420,7 @@
                 },
                 "roleType": {
                     "type": "string",
-                    "description": "Type of the role. Valid values:\n`\"API_ADMIN\"`,\n`\"APP_ADMIN\"`,\n`\"CUSTOM\"`,\n`\"GROUP_MEMBERSHIP_ADMIN\"`,\n`\"HELP_DESK_ADMIN\"`,\n`\"MOBILE_ADMIN\"`,\n`\"ORG_ADMIN\"`,\n`\"READ_ONLY_ADMIN\"`,\n`\"REPORT_ADMIN\"`,\n`\"SUPER_ADMIN\"`,\n`\"USER_ADMIN\"`\n. See [API docs](https://developer.okta.com/docs/reference/api/admin-notifications/#role-types)\n"
+                    "description": "Type of the role. Valid values:\n`\"API_ACCESS_MANAGEMENT_ADMIN\"`,\n`\"APP_ADMIN\"`,\n`\"CUSTOM\"`,\n`\"GROUP_MEMBERSHIP_ADMIN\"`,\n`\"HELP_DESK_ADMIN\"`,\n`\"MOBILE_ADMIN\"`,\n`\"ORG_ADMIN\"`,\n`\"READ_ONLY_ADMIN\"`,\n`\"REPORT_ADMIN\"`,\n`\"SUPER_ADMIN\"`,\n`\"USER_ADMIN\"`\n. See [API docs](https://developer.okta.com/docs/reference/api/admin-notifications/#role-types)\n"
                 },
                 "status": {
                     "type": "string",
@@ -14448,7 +14439,7 @@
                 },
                 "roleType": {
                     "type": "string",
-                    "description": "Type of the role. Valid values:\n`\"API_ADMIN\"`,\n`\"APP_ADMIN\"`,\n`\"CUSTOM\"`,\n`\"GROUP_MEMBERSHIP_ADMIN\"`,\n`\"HELP_DESK_ADMIN\"`,\n`\"MOBILE_ADMIN\"`,\n`\"ORG_ADMIN\"`,\n`\"READ_ONLY_ADMIN\"`,\n`\"REPORT_ADMIN\"`,\n`\"SUPER_ADMIN\"`,\n`\"USER_ADMIN\"`\n. See [API docs](https://developer.okta.com/docs/reference/api/admin-notifications/#role-types)\n",
+                    "description": "Type of the role. Valid values:\n`\"API_ACCESS_MANAGEMENT_ADMIN\"`,\n`\"APP_ADMIN\"`,\n`\"CUSTOM\"`,\n`\"GROUP_MEMBERSHIP_ADMIN\"`,\n`\"HELP_DESK_ADMIN\"`,\n`\"MOBILE_ADMIN\"`,\n`\"ORG_ADMIN\"`,\n`\"READ_ONLY_ADMIN\"`,\n`\"REPORT_ADMIN\"`,\n`\"SUPER_ADMIN\"`,\n`\"USER_ADMIN\"`\n. See [API docs](https://developer.okta.com/docs/reference/api/admin-notifications/#role-types)\n",
                     "willReplaceOnChanges": true
                 },
                 "status": {
@@ -14470,7 +14461,7 @@
                     },
                     "roleType": {
                         "type": "string",
-                        "description": "Type of the role. Valid values:\n`\"API_ADMIN\"`,\n`\"APP_ADMIN\"`,\n`\"CUSTOM\"`,\n`\"GROUP_MEMBERSHIP_ADMIN\"`,\n`\"HELP_DESK_ADMIN\"`,\n`\"MOBILE_ADMIN\"`,\n`\"ORG_ADMIN\"`,\n`\"READ_ONLY_ADMIN\"`,\n`\"REPORT_ADMIN\"`,\n`\"SUPER_ADMIN\"`,\n`\"USER_ADMIN\"`\n. See [API docs](https://developer.okta.com/docs/reference/api/admin-notifications/#role-types)\n",
+                        "description": "Type of the role. Valid values:\n`\"API_ACCESS_MANAGEMENT_ADMIN\"`,\n`\"APP_ADMIN\"`,\n`\"CUSTOM\"`,\n`\"GROUP_MEMBERSHIP_ADMIN\"`,\n`\"HELP_DESK_ADMIN\"`,\n`\"MOBILE_ADMIN\"`,\n`\"ORG_ADMIN\"`,\n`\"READ_ONLY_ADMIN\"`,\n`\"REPORT_ADMIN\"`,\n`\"SUPER_ADMIN\"`,\n`\"USER_ADMIN\"`\n. See [API docs](https://developer.okta.com/docs/reference/api/admin-notifications/#role-types)\n",
                         "willReplaceOnChanges": true
                     },
                     "status": {
@@ -15573,7 +15564,8 @@
                     "description": "The inline hook display name.\n"
                 },
                 "status": {
-                    "type": "string"
+                    "type": "string",
+                    "description": "Default to `ACTIVE`\n"
                 },
                 "type": {
                     "type": "string",
@@ -15617,7 +15609,8 @@
                     "description": "The inline hook display name.\n"
                 },
                 "status": {
-                    "type": "string"
+                    "type": "string",
+                    "description": "Default to `ACTIVE`\n"
                 },
                 "type": {
                     "type": "string",
@@ -15663,7 +15656,8 @@
                         "description": "The inline hook display name.\n"
                     },
                     "status": {
-                        "type": "string"
+                        "type": "string",
+                        "description": "Default to `ACTIVE`\n"
                     },
                     "type": {
                         "type": "string",
@@ -15857,11 +15851,11 @@
                     "items": {
                         "type": "string"
                     },
-                    "description": "List of disk encryption type, can be FULL, USER\n"
+                    "description": "List of disk encryption type, can be `FULL`, `USER`\n"
                 },
                 "jailbreak": {
                     "type": "boolean",
-                    "description": "The device jailbreak. Only for android and iOS platform\n"
+                    "description": "Is the device jailbroken in the device assurance policy.\n"
                 },
                 "lastUpdate": {
                     "type": "string",
@@ -15877,7 +15871,7 @@
                 },
                 "osVersion": {
                     "type": "string",
-                    "description": "The device os minimum version\n"
+                    "description": "Minimum os version of the device in the device assurance policy.\n"
                 },
                 "platform": {
                     "type": "string",
@@ -15888,11 +15882,11 @@
                     "items": {
                         "type": "string"
                     },
-                    "description": "List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE\n"
+                    "description": "List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`\n"
                 },
                 "secureHardwarePresent": {
                     "type": "boolean",
-                    "description": "Indicates if the device constains a secure hardware functionality\n"
+                    "description": "Indicates if the device contains a secure hardware functionality\n"
                 }
             },
             "required": [
@@ -15909,11 +15903,11 @@
                     "items": {
                         "type": "string"
                     },
-                    "description": "List of disk encryption type, can be FULL, USER\n"
+                    "description": "List of disk encryption type, can be `FULL`, `USER`\n"
                 },
                 "jailbreak": {
                     "type": "boolean",
-                    "description": "The device jailbreak. Only for android and iOS platform\n"
+                    "description": "Is the device jailbroken in the device assurance policy.\n"
                 },
                 "name": {
                     "type": "string",
@@ -15921,18 +15915,18 @@
                 },
                 "osVersion": {
                     "type": "string",
-                    "description": "The device os minimum version\n"
+                    "description": "Minimum os version of the device in the device assurance policy.\n"
                 },
                 "screenlockTypes": {
                     "type": "array",
                     "items": {
                         "type": "string"
                     },
-                    "description": "List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE\n"
+                    "description": "List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`\n"
                 },
                 "secureHardwarePresent": {
                     "type": "boolean",
-                    "description": "Indicates if the device constains a secure hardware functionality\n"
+                    "description": "Indicates if the device contains a secure hardware functionality\n"
                 }
             },
             "stateInputs": {
@@ -15951,11 +15945,11 @@
                         "items": {
                             "type": "string"
                         },
-                        "description": "List of disk encryption type, can be FULL, USER\n"
+                        "description": "List of disk encryption type, can be `FULL`, `USER`\n"
                     },
                     "jailbreak": {
                         "type": "boolean",
-                        "description": "The device jailbreak. Only for android and iOS platform\n"
+                        "description": "Is the device jailbroken in the device assurance policy.\n"
                     },
                     "lastUpdate": {
                         "type": "string",
@@ -15971,7 +15965,7 @@
                     },
                     "osVersion": {
                         "type": "string",
-                        "description": "The device os minimum version\n"
+                        "description": "Minimum os version of the device in the device assurance policy.\n"
                     },
                     "platform": {
                         "type": "string",
@@ -15982,11 +15976,11 @@
                         "items": {
                             "type": "string"
                         },
-                        "description": "List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE\n"
+                        "description": "List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`\n"
                     },
                     "secureHardwarePresent": {
                         "type": "boolean",
-                        "description": "Indicates if the device constains a secure hardware functionality\n"
+                        "description": "Indicates if the device contains a secure hardware functionality\n"
                     }
                 },
                 "type": "object"
@@ -16012,7 +16006,7 @@
                 },
                 "name": {
                     "type": "string",
-                    "description": "Policy device assurance name\n"
+                    "description": "Name of the device assurance policy.\n"
                 },
                 "platform": {
                     "type": "string",
@@ -16086,7 +16080,7 @@
             "inputProperties": {
                 "name": {
                     "type": "string",
-                    "description": "Policy device assurance name\n"
+                    "description": "Name of the device assurance policy.\n"
                 },
                 "tpspAllowScreenLock": {
                     "type": "boolean",
@@ -16166,7 +16160,7 @@
                     },
                     "name": {
                         "type": "string",
-                        "description": "Policy device assurance name\n"
+                        "description": "Name of the device assurance policy.\n"
                     },
                     "platform": {
                         "type": "string",
@@ -16236,31 +16230,31 @@
             "properties": {
                 "createdBy": {
                     "type": "string",
-                    "description": "Created by\n"
+                    "description": "Created by of the device assurance polic\n"
                 },
                 "createdDate": {
                     "type": "string",
-                    "description": "Created date\n"
+                    "description": "Created date of the device assurance polic\n"
                 },
                 "jailbreak": {
                     "type": "boolean",
-                    "description": "The device jailbreak. Only for android and iOS platform\n"
+                    "description": "Is the device jailbroken in the device assurance policy.\n"
                 },
                 "lastUpdate": {
                     "type": "string",
-                    "description": "Last update\n"
+                    "description": "Last update of the device assurance polic\n"
                 },
                 "lastUpdatedBy": {
                     "type": "string",
-                    "description": "Last updated by\n"
+                    "description": "Last updated by of the device assurance polic\n"
                 },
                 "name": {
                     "type": "string",
-                    "description": "Policy device assurance name\n"
+                    "description": "Name of the device assurance policy.\n"
                 },
                 "osVersion": {
                     "type": "string",
-                    "description": "The device os minimum version\n"
+                    "description": "Minimum os version of the device in the device assurance policy.\n"
                 },
                 "platform": {
                     "type": "string",
@@ -16271,7 +16265,7 @@
                     "items": {
                         "type": "string"
                     },
-                    "description": "List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE\n"
+                    "description": "List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`\n"
                 }
             },
             "required": [
@@ -16285,22 +16279,22 @@
             "inputProperties": {
                 "jailbreak": {
                     "type": "boolean",
-                    "description": "The device jailbreak. Only for android and iOS platform\n"
+                    "description": "Is the device jailbroken in the device assurance policy.\n"
                 },
                 "name": {
                     "type": "string",
-                    "description": "Policy device assurance name\n"
+                    "description": "Name of the device assurance policy.\n"
                 },
                 "osVersion": {
                     "type": "string",
-                    "description": "The device os minimum version\n"
+                    "description": "Minimum os version of the device in the device assurance policy.\n"
                 },
                 "screenlockTypes": {
                     "type": "array",
                     "items": {
                         "type": "string"
                     },
-                    "description": "List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE\n"
+                    "description": "List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`\n"
                 }
             },
             "stateInputs": {
@@ -16308,31 +16302,31 @@
                 "properties": {
                     "createdBy": {
                         "type": "string",
-                        "description": "Created by\n"
+                        "description": "Created by of the device assurance polic\n"
                     },
                     "createdDate": {
                         "type": "string",
-                        "description": "Created date\n"
+                        "description": "Created date of the device assurance polic\n"
                     },
                     "jailbreak": {
                         "type": "boolean",
-                        "description": "The device jailbreak. Only for android and iOS platform\n"
+                        "description": "Is the device jailbroken in the device assurance policy.\n"
                     },
                     "lastUpdate": {
                         "type": "string",
-                        "description": "Last update\n"
+                        "description": "Last update of the device assurance polic\n"
                     },
                     "lastUpdatedBy": {
                         "type": "string",
-                        "description": "Last updated by\n"
+                        "description": "Last updated by of the device assurance polic\n"
                     },
                     "name": {
                         "type": "string",
-                        "description": "Policy device assurance name\n"
+                        "description": "Name of the device assurance policy.\n"
                     },
                     "osVersion": {
                         "type": "string",
-                        "description": "The device os minimum version\n"
+                        "description": "Minimum os version of the device in the device assurance policy.\n"
                     },
                     "platform": {
                         "type": "string",
@@ -16343,7 +16337,7 @@
                         "items": {
                             "type": "string"
                         },
-                        "description": "List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE\n"
+                        "description": "List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`\n"
                     }
                 },
                 "type": "object"
@@ -16364,7 +16358,7 @@
                     "items": {
                         "type": "string"
                     },
-                    "description": "List of disk encryption type, can be ALL_INTERNAL_VOLUMES\n"
+                    "description": "List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`\n"
                 },
                 "lastUpdate": {
                     "type": "string",
@@ -16376,11 +16370,11 @@
                 },
                 "name": {
                     "type": "string",
-                    "description": "Policy device assurance name\n"
+                    "description": "Name of the device assurance policy.\n"
                 },
                 "osVersion": {
                     "type": "string",
-                    "description": "The device os minimum version\n"
+                    "description": "Minimum os version of the device in the device assurance policy.\n"
                 },
                 "platform": {
                     "type": "string",
@@ -16391,11 +16385,11 @@
                     "items": {
                         "type": "string"
                     },
-                    "description": "List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE\n"
+                    "description": "List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`\n"
                 },
                 "secureHardwarePresent": {
                     "type": "boolean",
-                    "description": "Indicates if the device constains a secure hardware functionality\n"
+                    "description": "Is the device secure with hardware in the device assurance policy.\n"
                 },
                 "thirdPartySignalProviders": {
                     "type": "boolean",
@@ -16468,26 +16462,26 @@
                     "items": {
                         "type": "string"
                     },
-                    "description": "List of disk encryption type, can be ALL_INTERNAL_VOLUMES\n"
+                    "description": "List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`\n"
                 },
                 "name": {
                     "type": "string",
-                    "description": "Policy device assurance name\n"
+                    "description": "Name of the device assurance policy.\n"
                 },
                 "osVersion": {
                     "type": "string",
-                    "description": "The device os minimum version\n"
+                    "description": "Minimum os version of the device in the device assurance policy.\n"
                 },
                 "screenlockTypes": {
                     "type": "array",
                     "items": {
                         "type": "string"
                     },
-                    "description": "List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE\n"
+                    "description": "List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`\n"
                 },
                 "secureHardwarePresent": {
                     "type": "boolean",
-                    "description": "Indicates if the device constains a secure hardware functionality\n"
+                    "description": "Is the device secure with hardware in the device assurance policy.\n"
                 },
                 "thirdPartySignalProviders": {
                     "type": "boolean",
@@ -16562,7 +16556,7 @@
                         "items": {
                             "type": "string"
                         },
-                        "description": "List of disk encryption type, can be ALL_INTERNAL_VOLUMES\n"
+                        "description": "List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`\n"
                     },
                     "lastUpdate": {
                         "type": "string",
@@ -16574,11 +16568,11 @@
                     },
                     "name": {
                         "type": "string",
-                        "description": "Policy device assurance name\n"
+                        "description": "Name of the device assurance policy.\n"
                     },
                     "osVersion": {
                         "type": "string",
-                        "description": "The device os minimum version\n"
+                        "description": "Minimum os version of the device in the device assurance policy.\n"
                     },
                     "platform": {
                         "type": "string",
@@ -16589,11 +16583,11 @@
                         "items": {
                             "type": "string"
                         },
-                        "description": "List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE\n"
+                        "description": "List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`\n"
                     },
                     "secureHardwarePresent": {
                         "type": "boolean",
-                        "description": "Indicates if the device constains a secure hardware functionality\n"
+                        "description": "Is the device secure with hardware in the device assurance policy.\n"
                     },
                     "thirdPartySignalProviders": {
                         "type": "boolean",
@@ -16670,7 +16664,7 @@
                     "items": {
                         "type": "string"
                     },
-                    "description": "List of disk encryption type, can be ALL_INTERNAL_VOLUMES\n"
+                    "description": "List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`\n"
                 },
                 "lastUpdate": {
                     "type": "string",
@@ -16682,11 +16676,11 @@
                 },
                 "name": {
                     "type": "string",
-                    "description": "Policy device assurance name\n"
+                    "description": "Name of the device assurance policy.\n"
                 },
                 "osVersion": {
                     "type": "string",
-                    "description": "The device os minimum version\n"
+                    "description": "Minimum os version of the device in the device assurance policy.\n"
                 },
                 "platform": {
                     "type": "string",
@@ -16697,11 +16691,11 @@
                     "items": {
                         "type": "string"
                     },
-                    "description": "List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE\n"
+                    "description": "List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`\n"
                 },
                 "secureHardwarePresent": {
                     "type": "boolean",
-                    "description": "Indicates if the device constains a secure hardware functionality\n"
+                    "description": "Is the device secure with hardware in the device assurance policy.\n"
                 },
                 "thirdPartySignalProviders": {
                     "type": "boolean",
@@ -16798,26 +16792,26 @@
                     "items": {
                         "type": "string"
                     },
-                    "description": "List of disk encryption type, can be ALL_INTERNAL_VOLUMES\n"
+                    "description": "List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`\n"
                 },
                 "name": {
                     "type": "string",
-                    "description": "Policy device assurance name\n"
+                    "description": "Name of the device assurance policy.\n"
                 },
                 "osVersion": {
                     "type": "string",
-                    "description": "The device os minimum version\n"
+                    "description": "Minimum os version of the device in the device assurance policy.\n"
                 },
                 "screenlockTypes": {
                     "type": "array",
                     "items": {
                         "type": "string"
                     },
-                    "description": "List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE\n"
+                    "description": "List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`\n"
                 },
                 "secureHardwarePresent": {
                     "type": "boolean",
-                    "description": "Indicates if the device constains a secure hardware functionality\n"
+                    "description": "Is the device secure with hardware in the device assurance policy.\n"
                 },
                 "thirdPartySignalProviders": {
                     "type": "boolean",
@@ -16916,7 +16910,7 @@
                         "items": {
                             "type": "string"
                         },
-                        "description": "List of disk encryption type, can be ALL_INTERNAL_VOLUMES\n"
+                        "description": "List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`\n"
                     },
                     "lastUpdate": {
                         "type": "string",
@@ -16928,11 +16922,11 @@
                     },
                     "name": {
                         "type": "string",
-                        "description": "Policy device assurance name\n"
+                        "description": "Name of the device assurance policy.\n"
                     },
                     "osVersion": {
                         "type": "string",
-                        "description": "The device os minimum version\n"
+                        "description": "Minimum os version of the device in the device assurance policy.\n"
                     },
                     "platform": {
                         "type": "string",
@@ -16943,11 +16937,11 @@
                         "items": {
                             "type": "string"
                         },
-                        "description": "List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE\n"
+                        "description": "List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`\n"
                     },
                     "secureHardwarePresent": {
                         "type": "boolean",
-                        "description": "Indicates if the device constains a secure hardware functionality\n"
+                        "description": "Is the device secure with hardware in the device assurance policy.\n"
                     },
                     "thirdPartySignalProviders": {
                         "type": "boolean",
@@ -18016,7 +18010,8 @@
                     "type": "array",
                     "items": {
                         "$ref": "#/types/okta:policy/RuleIdpDiscoveryPlatformInclude:RuleIdpDiscoveryPlatformInclude"
-                    }
+                    },
+                    "description": "Platform to include in discovery rule. - 'type' - (Optional) One of: 'ANY', 'MOBILE', 'DESKTOP' - 'os_expression -\n(Optional) Only available when using os_type = 'OTHER' - 'os_type' - (Optional) One of: 'ANY', 'IOS', 'WINDOWS',\n'ANDROID', 'OTHER', 'OSX'\n"
                 },
                 "policyId": {
                     "type": "string",
@@ -18099,7 +18094,8 @@
                     "type": "array",
                     "items": {
                         "$ref": "#/types/okta:policy/RuleIdpDiscoveryPlatformInclude:RuleIdpDiscoveryPlatformInclude"
-                    }
+                    },
+                    "description": "Platform to include in discovery rule. - 'type' - (Optional) One of: 'ANY', 'MOBILE', 'DESKTOP' - 'os_expression -\n(Optional) Only available when using os_type = 'OTHER' - 'os_type' - (Optional) One of: 'ANY', 'IOS', 'WINDOWS',\n'ANDROID', 'OTHER', 'OSX'\n"
                 },
                 "policyId": {
                     "type": "string",
@@ -18182,7 +18178,8 @@
                         "type": "array",
                         "items": {
                             "$ref": "#/types/okta:policy/RuleIdpDiscoveryPlatformInclude:RuleIdpDiscoveryPlatformInclude"
-                        }
+                        },
+                        "description": "Platform to include in discovery rule. - 'type' - (Optional) One of: 'ANY', 'MOBILE', 'DESKTOP' - 'os_expression -\n(Optional) Only available when using os_type = 'OTHER' - 'os_type' - (Optional) One of: 'ANY', 'IOS', 'WINDOWS',\n'ANDROID', 'OTHER', 'OSX'\n"
                     },
                     "policyId": {
                         "type": "string",
@@ -18224,7 +18221,7 @@
                     "items": {
                         "$ref": "#/types/okta:policy/RuleMfaAppExclude:RuleMfaAppExclude"
                     },
-                    "description": "Applications to exclude\n"
+                    "description": "Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations. - 'id'\n- (Optional) Use if 'type' is 'APP' to indicate the application id to include. - 'name' - (Optional) Use if the 'type'\nis 'APP_TYPE' to indicate the type of application(s) to include in instances where an entire group (i.e. 'yahoo_mail')\nof applications should be included. - 'type' - (Required) One of: 'APP', 'APP_TYPE'\n"
                 },
                 "appIncludes": {
                     "type": "array",
@@ -18288,7 +18285,7 @@
                     "items": {
                         "$ref": "#/types/okta:policy/RuleMfaAppExclude:RuleMfaAppExclude"
                     },
-                    "description": "Applications to exclude\n"
+                    "description": "Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations. - 'id'\n- (Optional) Use if 'type' is 'APP' to indicate the application id to include. - 'name' - (Optional) Use if the 'type'\nis 'APP_TYPE' to indicate the type of application(s) to include in instances where an entire group (i.e. 'yahoo_mail')\nof applications should be included. - 'type' - (Required) One of: 'APP', 'APP_TYPE'\n"
                 },
                 "appIncludes": {
                     "type": "array",
@@ -18353,7 +18350,7 @@
                         "items": {
                             "$ref": "#/types/okta:policy/RuleMfaAppExclude:RuleMfaAppExclude"
                         },
-                        "description": "Applications to exclude\n"
+                        "description": "Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations. - 'id'\n- (Optional) Use if 'type' is 'APP' to indicate the application id to include. - 'name' - (Optional) Use if the 'type'\nis 'APP_TYPE' to indicate the type of application(s) to include in instances where an entire group (i.e. 'yahoo_mail')\nof applications should be included. - 'type' - (Required) One of: 'APP', 'APP_TYPE'\n"
                     },
                     "appIncludes": {
                         "type": "array",
@@ -18680,7 +18677,12 @@
                 },
                 "riscLevel": {
                     "type": "string",
-                    "description": "Risc level: `\"ANY\"`, `\"LOW\"`, `\"MEDIUM\"` or `\"HIGH\"`. Default is `\"ANY\"`. It can be also \nset to an empty string in case `RISC_SCORING` org feature flag is disabled.\n"
+                    "description": "Risc level: `\"ANY\"`, `\"LOW\"`, `\"MEDIUM\"` or `\"HIGH\"`. Default is `\"ANY\"`. It can be also \nset to an empty string in case `RISC_SCORING` org feature flag is disabled.\n",
+                    "deprecationMessage": "Attribute typo, switch to risk_level instead. Default: `ANY`"
+                },
+                "riskLevel": {
+                    "type": "string",
+                    "description": "Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`\n"
                 },
                 "sessionIdle": {
                     "type": "integer",
@@ -18798,7 +18800,12 @@
                 },
                 "riscLevel": {
                     "type": "string",
-                    "description": "Risc level: `\"ANY\"`, `\"LOW\"`, `\"MEDIUM\"` or `\"HIGH\"`. Default is `\"ANY\"`. It can be also \nset to an empty string in case `RISC_SCORING` org feature flag is disabled.\n"
+                    "description": "Risc level: `\"ANY\"`, `\"LOW\"`, `\"MEDIUM\"` or `\"HIGH\"`. Default is `\"ANY\"`. It can be also \nset to an empty string in case `RISC_SCORING` org feature flag is disabled.\n",
+                    "deprecationMessage": "Attribute typo, switch to risk_level instead. Default: `ANY`"
+                },
+                "riskLevel": {
+                    "type": "string",
+                    "description": "Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`\n"
                 },
                 "sessionIdle": {
                     "type": "integer",
@@ -18914,7 +18921,12 @@
                     },
                     "riscLevel": {
                         "type": "string",
-                        "description": "Risc level: `\"ANY\"`, `\"LOW\"`, `\"MEDIUM\"` or `\"HIGH\"`. Default is `\"ANY\"`. It can be also \nset to an empty string in case `RISC_SCORING` org feature flag is disabled.\n"
+                        "description": "Risc level: `\"ANY\"`, `\"LOW\"`, `\"MEDIUM\"` or `\"HIGH\"`. Default is `\"ANY\"`. It can be also \nset to an empty string in case `RISC_SCORING` org feature flag is disabled.\n",
+                        "deprecationMessage": "Attribute typo, switch to risk_level instead. Default: `ANY`"
+                    },
+                    "riskLevel": {
+                        "type": "string",
+                        "description": "Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`\n"
                     },
                     "sessionIdle": {
                         "type": "integer",
@@ -19272,7 +19284,7 @@
                     "items": {
                         "type": "string"
                     },
-                    "description": "List of custom_profile_attribute keys that should be excluded from being managed by Terraform.\n"
+                    "description": "List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in\nsituations where specific custom fields may contain sensitive information and should be managed outside of Terraform.\n"
                 },
                 "department": {
                     "type": "string",
@@ -19461,7 +19473,7 @@
                     "items": {
                         "type": "string"
                     },
-                    "description": "List of custom_profile_attribute keys that should be excluded from being managed by Terraform.\n"
+                    "description": "List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in\nsituations where specific custom fields may contain sensitive information and should be managed outside of Terraform.\n"
                 },
                 "department": {
                     "type": "string",
@@ -19646,7 +19658,7 @@
                         "items": {
                             "type": "string"
                         },
-                        "description": "List of custom_profile_attribute keys that should be excluded from being managed by Terraform.\n"
+                        "description": "List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in\nsituations where specific custom fields may contain sensitive information and should be managed outside of Terraform.\n"
                     },
                     "department": {
                         "type": "string",
@@ -20594,7 +20606,7 @@
                     },
                     "signatureAlgorithm": {
                         "type": "string",
-                        "description": "Signature algorithm used ot digitally sign the assertion and response.\n"
+                        "description": "Signature algorithm used to digitally sign the assertion and response.\n"
                     },
                     "singleLogoutCertificate": {
                         "type": "string",
@@ -22263,7 +22275,7 @@
                     },
                     "roleType": {
                         "type": "string",
-                        "description": "Type of the role. Valid values:\n`\"API_ADMIN\"`,\n`\"APP_ADMIN\"`,\n`\"CUSTOM\"`,\n`\"GROUP_MEMBERSHIP_ADMIN\"`,\n`\"HELP_DESK_ADMIN\"`,\n`\"MOBILE_ADMIN\"`,\n`\"ORG_ADMIN\"`,\n`\"READ_ONLY_ADMIN\"`,\n`\"REPORT_ADMIN\"`,\n`\"SUPER_ADMIN\"`,\n`\"USER_ADMIN\"`\n.\n"
+                        "description": "Type of the role. Valid values:\n`\"API_ACCESS_MANAGEMENT_ADMIN\"`,\n`\"APP_ADMIN\"`,\n`\"CUSTOM\"`,\n`\"GROUP_MEMBERSHIP_ADMIN\"`,\n`\"HELP_DESK_ADMIN\"`,\n`\"MOBILE_ADMIN\"`,\n`\"ORG_ADMIN\"`,\n`\"READ_ONLY_ADMIN\"`,\n`\"REPORT_ADMIN\"`,\n`\"SUPER_ADMIN\"`,\n`\"USER_ADMIN\"`\n.\n"
                     }
                 },
                 "type": "object",
diff --git a/sdk/dotnet/App/GetSaml.cs b/sdk/dotnet/App/GetSaml.cs
index 0dabe312..d7bb35d4 100644
--- a/sdk/dotnet/App/GetSaml.cs
+++ b/sdk/dotnet/App/GetSaml.cs
@@ -282,7 +282,7 @@ public sealed class GetSamlResult
         /// </summary>
         public readonly bool SamlSignedRequestEnabled;
         /// <summary>
-        /// Signature algorithm used ot digitally sign the assertion and response.
+        /// Signature algorithm used to digitally sign the assertion and response.
         /// </summary>
         public readonly string SignatureAlgorithm;
         /// <summary>
diff --git a/sdk/dotnet/App/Saml.cs b/sdk/dotnet/App/Saml.cs
index fb9c4a37..8c911092 100644
--- a/sdk/dotnet/App/Saml.cs
+++ b/sdk/dotnet/App/Saml.cs
@@ -511,7 +511,7 @@ public partial class Saml : global::Pulumi.CustomResource
         public Output<string> SignOnMode { get; private set; } = null!;
 
         /// <summary>
-        /// Signature algorithm used ot digitally sign the assertion and response.
+        /// Signature algorithm used to digitally sign the assertion and response.
         /// </summary>
         [Output("signatureAlgorithm")]
         public Output<string?> SignatureAlgorithm { get; private set; } = null!;
@@ -845,7 +845,7 @@ public InputList<Inputs.SamlAttributeStatementArgs> AttributeStatements
         public Input<string>? SamlVersion { get; set; }
 
         /// <summary>
-        /// Signature algorithm used ot digitally sign the assertion and response.
+        /// Signature algorithm used to digitally sign the assertion and response.
         /// </summary>
         [Input("signatureAlgorithm")]
         public Input<string>? SignatureAlgorithm { get; set; }
@@ -1237,7 +1237,7 @@ public InputList<Inputs.SamlKeyGetArgs> Keys
         public Input<string>? SignOnMode { get; set; }
 
         /// <summary>
-        /// Signature algorithm used ot digitally sign the assertion and response.
+        /// Signature algorithm used to digitally sign the assertion and response.
         /// </summary>
         [Input("signatureAlgorithm")]
         public Input<string>? SignatureAlgorithm { get; set; }
diff --git a/sdk/dotnet/App/ThreeField.cs b/sdk/dotnet/App/ThreeField.cs
index e4b8ed28..db8d9fd1 100644
--- a/sdk/dotnet/App/ThreeField.cs
+++ b/sdk/dotnet/App/ThreeField.cs
@@ -52,7 +52,7 @@ public partial class ThreeField : global::Pulumi.CustomResource
         public Output<string?> AdminNote { get; private set; } = null!;
 
         /// <summary>
-        /// Displays specific appLinks for the app
+        /// Displays specific appLinks for the app. The value for each application link should be boolean.
         /// </summary>
         [Output("appLinksJson")]
         public Output<string?> AppLinksJson { get; private set; } = null!;
@@ -278,7 +278,7 @@ public sealed class ThreeFieldArgs : global::Pulumi.ResourceArgs
         public Input<string>? AdminNote { get; set; }
 
         /// <summary>
-        /// Displays specific appLinks for the app
+        /// Displays specific appLinks for the app. The value for each application link should be boolean.
         /// </summary>
         [Input("appLinksJson")]
         public Input<string>? AppLinksJson { get; set; }
@@ -448,7 +448,7 @@ public sealed class ThreeFieldState : global::Pulumi.ResourceArgs
         public Input<string>? AdminNote { get; set; }
 
         /// <summary>
-        /// Displays specific appLinks for the app
+        /// Displays specific appLinks for the app. The value for each application link should be boolean.
         /// </summary>
         [Input("appLinksJson")]
         public Input<string>? AppLinksJson { get; set; }
diff --git a/sdk/dotnet/AppUserSchemaProperty.cs b/sdk/dotnet/AppUserSchemaProperty.cs
index 41a22055..a062a052 100644
--- a/sdk/dotnet/AppUserSchemaProperty.cs
+++ b/sdk/dotnet/AppUserSchemaProperty.cs
@@ -162,13 +162,13 @@ public partial class AppUserSchemaProperty : global::Pulumi.CustomResource
         public Output<bool?> Union { get; private set; } = null!;
 
         /// <summary>
-        /// Subschema unique restriction
+        /// Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.
         /// </summary>
         [Output("unique")]
         public Output<string?> Unique { get; private set; } = null!;
 
         /// <summary>
-        /// Custom subschema user type
+        /// User type ID. By default, it is `default`
         /// </summary>
         [Output("userType")]
         public Output<string?> UserType { get; private set; } = null!;
@@ -358,13 +358,13 @@ public InputList<Inputs.AppUserSchemaPropertyOneOfArgs> OneOfs
         public Input<bool>? Union { get; set; }
 
         /// <summary>
-        /// Subschema unique restriction
+        /// Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.
         /// </summary>
         [Input("unique")]
         public Input<string>? Unique { get; set; }
 
         /// <summary>
-        /// Custom subschema user type
+        /// User type ID. By default, it is `default`
         /// </summary>
         [Input("userType")]
         public Input<string>? UserType { get; set; }
@@ -516,13 +516,13 @@ public InputList<Inputs.AppUserSchemaPropertyOneOfGetArgs> OneOfs
         public Input<bool>? Union { get; set; }
 
         /// <summary>
-        /// Subschema unique restriction
+        /// Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.
         /// </summary>
         [Input("unique")]
         public Input<string>? Unique { get; set; }
 
         /// <summary>
-        /// Custom subschema user type
+        /// User type ID. By default, it is `default`
         /// </summary>
         [Input("userType")]
         public Input<string>? UserType { get; set; }
diff --git a/sdk/dotnet/EventHook.cs b/sdk/dotnet/EventHook.cs
index f8a84a72..00c67861 100644
--- a/sdk/dotnet/EventHook.cs
+++ b/sdk/dotnet/EventHook.cs
@@ -91,6 +91,9 @@ public partial class EventHook : global::Pulumi.CustomResource
         [Output("name")]
         public Output<string> Name { get; private set; } = null!;
 
+        /// <summary>
+        /// Default to `ACTIVE`
+        /// </summary>
         [Output("status")]
         public Output<string?> Status { get; private set; } = null!;
 
@@ -194,6 +197,9 @@ public InputList<Inputs.EventHookHeaderArgs> Headers
         [Input("name")]
         public Input<string>? Name { get; set; }
 
+        /// <summary>
+        /// Default to `ACTIVE`
+        /// </summary>
         [Input("status")]
         public Input<string>? Status { get; set; }
 
@@ -259,6 +265,9 @@ public InputList<Inputs.EventHookHeaderGetArgs> Headers
         [Input("name")]
         public Input<string>? Name { get; set; }
 
+        /// <summary>
+        /// Default to `ACTIVE`
+        /// </summary>
         [Input("status")]
         public Input<string>? Status { get; set; }
 
diff --git a/sdk/dotnet/GetRoleSubscription.cs b/sdk/dotnet/GetRoleSubscription.cs
index 54b4918b..a7ee6b7b 100644
--- a/sdk/dotnet/GetRoleSubscription.cs
+++ b/sdk/dotnet/GetRoleSubscription.cs
@@ -79,7 +79,7 @@ public sealed class GetRoleSubscriptionArgs : global::Pulumi.InvokeArgs
 
         /// <summary>
         /// Type of the role. Valid values:
-        /// `"API_ADMIN"`,
+        /// `"API_ACCESS_MANAGEMENT_ADMIN"`,
         /// `"APP_ADMIN"`,
         /// `"CUSTOM"`,
         /// `"GROUP_MEMBERSHIP_ADMIN"`,
@@ -113,7 +113,7 @@ public sealed class GetRoleSubscriptionInvokeArgs : global::Pulumi.InvokeArgs
 
         /// <summary>
         /// Type of the role. Valid values:
-        /// `"API_ADMIN"`,
+        /// `"API_ACCESS_MANAGEMENT_ADMIN"`,
         /// `"APP_ADMIN"`,
         /// `"CUSTOM"`,
         /// `"GROUP_MEMBERSHIP_ADMIN"`,
diff --git a/sdk/dotnet/Group/Role.cs b/sdk/dotnet/Group/Role.cs
index 1c99460d..0dfa04a9 100644
--- a/sdk/dotnet/Group/Role.cs
+++ b/sdk/dotnet/Group/Role.cs
@@ -62,7 +62,7 @@ public partial class Role : global::Pulumi.CustomResource
 
         /// <summary>
         /// Admin role assigned to the group. It can be any one of the following values:
-        /// `"API_ADMIN"`,
+        /// `"API_ACCESS_MANAGEMENT_ADMIN"`,
         /// `"APP_ADMIN"`,
         /// `"CUSTOM"`,
         /// `"GROUP_MEMBERSHIP_ADMIN"`,
@@ -158,7 +158,7 @@ public sealed class RoleArgs : global::Pulumi.ResourceArgs
 
         /// <summary>
         /// Admin role assigned to the group. It can be any one of the following values:
-        /// `"API_ADMIN"`,
+        /// `"API_ACCESS_MANAGEMENT_ADMIN"`,
         /// `"APP_ADMIN"`,
         /// `"CUSTOM"`,
         /// `"GROUP_MEMBERSHIP_ADMIN"`,
@@ -228,7 +228,7 @@ public sealed class RoleState : global::Pulumi.ResourceArgs
 
         /// <summary>
         /// Admin role assigned to the group. It can be any one of the following values:
-        /// `"API_ADMIN"`,
+        /// `"API_ACCESS_MANAGEMENT_ADMIN"`,
         /// `"APP_ADMIN"`,
         /// `"CUSTOM"`,
         /// `"GROUP_MEMBERSHIP_ADMIN"`,
diff --git a/sdk/dotnet/Idp/Oidc.cs b/sdk/dotnet/Idp/Oidc.cs
index 18cdc8c5..1e11aba1 100644
--- a/sdk/dotnet/Idp/Oidc.cs
+++ b/sdk/dotnet/Idp/Oidc.cs
@@ -162,13 +162,6 @@ public partial class Oidc : global::Pulumi.CustomResource
         [Output("name")]
         public Output<string> Name { get; private set; } = null!;
 
-        /// <summary>
-        /// Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See:
-        /// https://developer.okta.com/docs/reference/api/idps/#oauth-2-0-and-openid-connect-client-object
-        /// </summary>
-        [Output("pkceRequired")]
-        public Output<bool?> PkceRequired { get; private set; } = null!;
-
         /// <summary>
         /// Determines if the IdP should act as a source of truth for user profile attributes.
         /// </summary>
@@ -448,13 +441,6 @@ public InputList<string> GroupsFilters
         [Input("name")]
         public Input<string>? Name { get; set; }
 
-        /// <summary>
-        /// Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See:
-        /// https://developer.okta.com/docs/reference/api/idps/#oauth-2-0-and-openid-connect-client-object
-        /// </summary>
-        [Input("pkceRequired")]
-        public Input<bool>? PkceRequired { get; set; }
-
         /// <summary>
         /// Determines if the IdP should act as a source of truth for user profile attributes.
         /// </summary>
@@ -686,13 +672,6 @@ public InputList<string> GroupsFilters
         [Input("name")]
         public Input<string>? Name { get; set; }
 
-        /// <summary>
-        /// Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See:
-        /// https://developer.okta.com/docs/reference/api/idps/#oauth-2-0-and-openid-connect-client-object
-        /// </summary>
-        [Input("pkceRequired")]
-        public Input<bool>? PkceRequired { get; set; }
-
         /// <summary>
         /// Determines if the IdP should act as a source of truth for user profile attributes.
         /// </summary>
diff --git a/sdk/dotnet/Inline/Hook.cs b/sdk/dotnet/Inline/Hook.cs
index 261403e0..884045ec 100644
--- a/sdk/dotnet/Inline/Hook.cs
+++ b/sdk/dotnet/Inline/Hook.cs
@@ -82,6 +82,9 @@ public partial class Hook : global::Pulumi.CustomResource
         [Output("name")]
         public Output<string> Name { get; private set; } = null!;
 
+        /// <summary>
+        /// Default to `ACTIVE`
+        /// </summary>
         [Output("status")]
         public Output<string?> Status { get; private set; } = null!;
 
@@ -185,6 +188,9 @@ public InputList<Inputs.HookHeaderArgs> Headers
         [Input("name")]
         public Input<string>? Name { get; set; }
 
+        /// <summary>
+        /// Default to `ACTIVE`
+        /// </summary>
         [Input("status")]
         public Input<string>? Status { get; set; }
 
@@ -250,6 +256,9 @@ public InputList<Inputs.HookHeaderGetArgs> Headers
         [Input("name")]
         public Input<string>? Name { get; set; }
 
+        /// <summary>
+        /// Default to `ACTIVE`
+        /// </summary>
         [Input("status")]
         public Input<string>? Status { get; set; }
 
diff --git a/sdk/dotnet/OrgConfiguration.cs b/sdk/dotnet/OrgConfiguration.cs
index 3ea68343..32fb35a6 100644
--- a/sdk/dotnet/OrgConfiguration.cs
+++ b/sdk/dotnet/OrgConfiguration.cs
@@ -95,7 +95,8 @@ public partial class OrgConfiguration : global::Pulumi.CustomResource
         public Output<string> ExpiresAt { get; private set; } = null!;
 
         /// <summary>
-        /// Local path to logo of the org.
+        /// Logo of org. The file must be in PNG, JPG, or GIF format and less than 1 MB in size. For best results use landscape
+        /// orientation, a transparent background, and a minimum size of 420px by 120px to prevent upscaling.
         /// </summary>
         [Output("logo")]
         public Output<string?> Logo { get; private set; } = null!;
@@ -237,7 +238,8 @@ public sealed class OrgConfigurationArgs : global::Pulumi.ResourceArgs
         public Input<string>? EndUserSupportHelpUrl { get; set; }
 
         /// <summary>
-        /// Local path to logo of the org.
+        /// Logo of org. The file must be in PNG, JPG, or GIF format and less than 1 MB in size. For best results use landscape
+        /// orientation, a transparent background, and a minimum size of 420px by 120px to prevent upscaling.
         /// </summary>
         [Input("logo")]
         public Input<string>? Logo { get; set; }
@@ -341,7 +343,8 @@ public sealed class OrgConfigurationState : global::Pulumi.ResourceArgs
         public Input<string>? ExpiresAt { get; set; }
 
         /// <summary>
-        /// Local path to logo of the org.
+        /// Logo of org. The file must be in PNG, JPG, or GIF format and less than 1 MB in size. For best results use landscape
+        /// orientation, a transparent background, and a minimum size of 420px by 120px to prevent upscaling.
         /// </summary>
         [Input("logo")]
         public Input<string>? Logo { get; set; }
diff --git a/sdk/dotnet/Policy/DeviceAssuranceAndroid.cs b/sdk/dotnet/Policy/DeviceAssuranceAndroid.cs
index 4dcf21f6..9669f74e 100644
--- a/sdk/dotnet/Policy/DeviceAssuranceAndroid.cs
+++ b/sdk/dotnet/Policy/DeviceAssuranceAndroid.cs
@@ -25,13 +25,13 @@ public partial class DeviceAssuranceAndroid : global::Pulumi.CustomResource
         public Output<string> CreatedDate { get; private set; } = null!;
 
         /// <summary>
-        /// List of disk encryption type, can be FULL, USER
+        /// List of disk encryption type, can be `FULL`, `USER`
         /// </summary>
         [Output("diskEncryptionTypes")]
         public Output<ImmutableArray<string>> DiskEncryptionTypes { get; private set; } = null!;
 
         /// <summary>
-        /// The device jailbreak. Only for android and iOS platform
+        /// Is the device jailbroken in the device assurance policy.
         /// </summary>
         [Output("jailbreak")]
         public Output<bool?> Jailbreak { get; private set; } = null!;
@@ -55,7 +55,7 @@ public partial class DeviceAssuranceAndroid : global::Pulumi.CustomResource
         public Output<string> Name { get; private set; } = null!;
 
         /// <summary>
-        /// The device os minimum version
+        /// Minimum os version of the device in the device assurance policy.
         /// </summary>
         [Output("osVersion")]
         public Output<string?> OsVersion { get; private set; } = null!;
@@ -67,13 +67,13 @@ public partial class DeviceAssuranceAndroid : global::Pulumi.CustomResource
         public Output<string> Platform { get; private set; } = null!;
 
         /// <summary>
-        /// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+        /// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
         /// </summary>
         [Output("screenlockTypes")]
         public Output<ImmutableArray<string>> ScreenlockTypes { get; private set; } = null!;
 
         /// <summary>
-        /// Indicates if the device constains a secure hardware functionality
+        /// Indicates if the device contains a secure hardware functionality
         /// </summary>
         [Output("secureHardwarePresent")]
         public Output<bool?> SecureHardwarePresent { get; private set; } = null!;
@@ -128,7 +128,7 @@ public sealed class DeviceAssuranceAndroidArgs : global::Pulumi.ResourceArgs
         private InputList<string>? _diskEncryptionTypes;
 
         /// <summary>
-        /// List of disk encryption type, can be FULL, USER
+        /// List of disk encryption type, can be `FULL`, `USER`
         /// </summary>
         public InputList<string> DiskEncryptionTypes
         {
@@ -137,7 +137,7 @@ public InputList<string> DiskEncryptionTypes
         }
 
         /// <summary>
-        /// The device jailbreak. Only for android and iOS platform
+        /// Is the device jailbroken in the device assurance policy.
         /// </summary>
         [Input("jailbreak")]
         public Input<bool>? Jailbreak { get; set; }
@@ -149,7 +149,7 @@ public InputList<string> DiskEncryptionTypes
         public Input<string>? Name { get; set; }
 
         /// <summary>
-        /// The device os minimum version
+        /// Minimum os version of the device in the device assurance policy.
         /// </summary>
         [Input("osVersion")]
         public Input<string>? OsVersion { get; set; }
@@ -158,7 +158,7 @@ public InputList<string> DiskEncryptionTypes
         private InputList<string>? _screenlockTypes;
 
         /// <summary>
-        /// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+        /// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
         /// </summary>
         public InputList<string> ScreenlockTypes
         {
@@ -167,7 +167,7 @@ public InputList<string> ScreenlockTypes
         }
 
         /// <summary>
-        /// Indicates if the device constains a secure hardware functionality
+        /// Indicates if the device contains a secure hardware functionality
         /// </summary>
         [Input("secureHardwarePresent")]
         public Input<bool>? SecureHardwarePresent { get; set; }
@@ -196,7 +196,7 @@ public sealed class DeviceAssuranceAndroidState : global::Pulumi.ResourceArgs
         private InputList<string>? _diskEncryptionTypes;
 
         /// <summary>
-        /// List of disk encryption type, can be FULL, USER
+        /// List of disk encryption type, can be `FULL`, `USER`
         /// </summary>
         public InputList<string> DiskEncryptionTypes
         {
@@ -205,7 +205,7 @@ public InputList<string> DiskEncryptionTypes
         }
 
         /// <summary>
-        /// The device jailbreak. Only for android and iOS platform
+        /// Is the device jailbroken in the device assurance policy.
         /// </summary>
         [Input("jailbreak")]
         public Input<bool>? Jailbreak { get; set; }
@@ -229,7 +229,7 @@ public InputList<string> DiskEncryptionTypes
         public Input<string>? Name { get; set; }
 
         /// <summary>
-        /// The device os minimum version
+        /// Minimum os version of the device in the device assurance policy.
         /// </summary>
         [Input("osVersion")]
         public Input<string>? OsVersion { get; set; }
@@ -244,7 +244,7 @@ public InputList<string> DiskEncryptionTypes
         private InputList<string>? _screenlockTypes;
 
         /// <summary>
-        /// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+        /// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
         /// </summary>
         public InputList<string> ScreenlockTypes
         {
@@ -253,7 +253,7 @@ public InputList<string> ScreenlockTypes
         }
 
         /// <summary>
-        /// Indicates if the device constains a secure hardware functionality
+        /// Indicates if the device contains a secure hardware functionality
         /// </summary>
         [Input("secureHardwarePresent")]
         public Input<bool>? SecureHardwarePresent { get; set; }
diff --git a/sdk/dotnet/Policy/DeviceAssuranceChromeos.cs b/sdk/dotnet/Policy/DeviceAssuranceChromeos.cs
index bde74d59..b8daf263 100644
--- a/sdk/dotnet/Policy/DeviceAssuranceChromeos.cs
+++ b/sdk/dotnet/Policy/DeviceAssuranceChromeos.cs
@@ -37,7 +37,7 @@ public partial class DeviceAssuranceChromeos : global::Pulumi.CustomResource
         public Output<string> LastUpdatedBy { get; private set; } = null!;
 
         /// <summary>
-        /// Policy device assurance name
+        /// Name of the device assurance policy.
         /// </summary>
         [Output("name")]
         public Output<string> Name { get; private set; } = null!;
@@ -179,7 +179,7 @@ public static DeviceAssuranceChromeos Get(string name, Input<string> id, DeviceA
     public sealed class DeviceAssuranceChromeosArgs : global::Pulumi.ResourceArgs
     {
         /// <summary>
-        /// Policy device assurance name
+        /// Name of the device assurance policy.
         /// </summary>
         [Input("name")]
         public Input<string>? Name { get; set; }
@@ -301,7 +301,7 @@ public sealed class DeviceAssuranceChromeosState : global::Pulumi.ResourceArgs
         public Input<string>? LastUpdatedBy { get; set; }
 
         /// <summary>
-        /// Policy device assurance name
+        /// Name of the device assurance policy.
         /// </summary>
         [Input("name")]
         public Input<string>? Name { get; set; }
diff --git a/sdk/dotnet/Policy/DeviceAssuranceIos.cs b/sdk/dotnet/Policy/DeviceAssuranceIos.cs
index 3ec67617..5a766fe3 100644
--- a/sdk/dotnet/Policy/DeviceAssuranceIos.cs
+++ b/sdk/dotnet/Policy/DeviceAssuranceIos.cs
@@ -13,43 +13,43 @@ namespace Pulumi.Okta.Policy
     public partial class DeviceAssuranceIos : global::Pulumi.CustomResource
     {
         /// <summary>
-        /// Created by
+        /// Created by of the device assurance polic
         /// </summary>
         [Output("createdBy")]
         public Output<string> CreatedBy { get; private set; } = null!;
 
         /// <summary>
-        /// Created date
+        /// Created date of the device assurance polic
         /// </summary>
         [Output("createdDate")]
         public Output<string> CreatedDate { get; private set; } = null!;
 
         /// <summary>
-        /// The device jailbreak. Only for android and iOS platform
+        /// Is the device jailbroken in the device assurance policy.
         /// </summary>
         [Output("jailbreak")]
         public Output<bool?> Jailbreak { get; private set; } = null!;
 
         /// <summary>
-        /// Last update
+        /// Last update of the device assurance polic
         /// </summary>
         [Output("lastUpdate")]
         public Output<string> LastUpdate { get; private set; } = null!;
 
         /// <summary>
-        /// Last updated by
+        /// Last updated by of the device assurance polic
         /// </summary>
         [Output("lastUpdatedBy")]
         public Output<string> LastUpdatedBy { get; private set; } = null!;
 
         /// <summary>
-        /// Policy device assurance name
+        /// Name of the device assurance policy.
         /// </summary>
         [Output("name")]
         public Output<string> Name { get; private set; } = null!;
 
         /// <summary>
-        /// The device os minimum version
+        /// Minimum os version of the device in the device assurance policy.
         /// </summary>
         [Output("osVersion")]
         public Output<string?> OsVersion { get; private set; } = null!;
@@ -61,7 +61,7 @@ public partial class DeviceAssuranceIos : global::Pulumi.CustomResource
         public Output<string> Platform { get; private set; } = null!;
 
         /// <summary>
-        /// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+        /// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
         /// </summary>
         [Output("screenlockTypes")]
         public Output<ImmutableArray<string>> ScreenlockTypes { get; private set; } = null!;
@@ -113,19 +113,19 @@ public static DeviceAssuranceIos Get(string name, Input<string> id, DeviceAssura
     public sealed class DeviceAssuranceIosArgs : global::Pulumi.ResourceArgs
     {
         /// <summary>
-        /// The device jailbreak. Only for android and iOS platform
+        /// Is the device jailbroken in the device assurance policy.
         /// </summary>
         [Input("jailbreak")]
         public Input<bool>? Jailbreak { get; set; }
 
         /// <summary>
-        /// Policy device assurance name
+        /// Name of the device assurance policy.
         /// </summary>
         [Input("name")]
         public Input<string>? Name { get; set; }
 
         /// <summary>
-        /// The device os minimum version
+        /// Minimum os version of the device in the device assurance policy.
         /// </summary>
         [Input("osVersion")]
         public Input<string>? OsVersion { get; set; }
@@ -134,7 +134,7 @@ public sealed class DeviceAssuranceIosArgs : global::Pulumi.ResourceArgs
         private InputList<string>? _screenlockTypes;
 
         /// <summary>
-        /// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+        /// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
         /// </summary>
         public InputList<string> ScreenlockTypes
         {
@@ -151,43 +151,43 @@ public DeviceAssuranceIosArgs()
     public sealed class DeviceAssuranceIosState : global::Pulumi.ResourceArgs
     {
         /// <summary>
-        /// Created by
+        /// Created by of the device assurance polic
         /// </summary>
         [Input("createdBy")]
         public Input<string>? CreatedBy { get; set; }
 
         /// <summary>
-        /// Created date
+        /// Created date of the device assurance polic
         /// </summary>
         [Input("createdDate")]
         public Input<string>? CreatedDate { get; set; }
 
         /// <summary>
-        /// The device jailbreak. Only for android and iOS platform
+        /// Is the device jailbroken in the device assurance policy.
         /// </summary>
         [Input("jailbreak")]
         public Input<bool>? Jailbreak { get; set; }
 
         /// <summary>
-        /// Last update
+        /// Last update of the device assurance polic
         /// </summary>
         [Input("lastUpdate")]
         public Input<string>? LastUpdate { get; set; }
 
         /// <summary>
-        /// Last updated by
+        /// Last updated by of the device assurance polic
         /// </summary>
         [Input("lastUpdatedBy")]
         public Input<string>? LastUpdatedBy { get; set; }
 
         /// <summary>
-        /// Policy device assurance name
+        /// Name of the device assurance policy.
         /// </summary>
         [Input("name")]
         public Input<string>? Name { get; set; }
 
         /// <summary>
-        /// The device os minimum version
+        /// Minimum os version of the device in the device assurance policy.
         /// </summary>
         [Input("osVersion")]
         public Input<string>? OsVersion { get; set; }
@@ -202,7 +202,7 @@ public sealed class DeviceAssuranceIosState : global::Pulumi.ResourceArgs
         private InputList<string>? _screenlockTypes;
 
         /// <summary>
-        /// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+        /// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
         /// </summary>
         public InputList<string> ScreenlockTypes
         {
diff --git a/sdk/dotnet/Policy/DeviceAssuranceMacos.cs b/sdk/dotnet/Policy/DeviceAssuranceMacos.cs
index faa61b6d..79bacfeb 100644
--- a/sdk/dotnet/Policy/DeviceAssuranceMacos.cs
+++ b/sdk/dotnet/Policy/DeviceAssuranceMacos.cs
@@ -25,7 +25,7 @@ public partial class DeviceAssuranceMacos : global::Pulumi.CustomResource
         public Output<string> CreatedDate { get; private set; } = null!;
 
         /// <summary>
-        /// List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+        /// List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
         /// </summary>
         [Output("diskEncryptionTypes")]
         public Output<ImmutableArray<string>> DiskEncryptionTypes { get; private set; } = null!;
@@ -43,13 +43,13 @@ public partial class DeviceAssuranceMacos : global::Pulumi.CustomResource
         public Output<string> LastUpdatedBy { get; private set; } = null!;
 
         /// <summary>
-        /// Policy device assurance name
+        /// Name of the device assurance policy.
         /// </summary>
         [Output("name")]
         public Output<string> Name { get; private set; } = null!;
 
         /// <summary>
-        /// The device os minimum version
+        /// Minimum os version of the device in the device assurance policy.
         /// </summary>
         [Output("osVersion")]
         public Output<string?> OsVersion { get; private set; } = null!;
@@ -61,13 +61,13 @@ public partial class DeviceAssuranceMacos : global::Pulumi.CustomResource
         public Output<string> Platform { get; private set; } = null!;
 
         /// <summary>
-        /// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+        /// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
         /// </summary>
         [Output("screenlockTypes")]
         public Output<ImmutableArray<string>> ScreenlockTypes { get; private set; } = null!;
 
         /// <summary>
-        /// Indicates if the device constains a secure hardware functionality
+        /// Is the device secure with hardware in the device assurance policy.
         /// </summary>
         [Output("secureHardwarePresent")]
         public Output<bool?> SecureHardwarePresent { get; private set; } = null!;
@@ -206,7 +206,7 @@ public sealed class DeviceAssuranceMacosArgs : global::Pulumi.ResourceArgs
         private InputList<string>? _diskEncryptionTypes;
 
         /// <summary>
-        /// List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+        /// List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
         /// </summary>
         public InputList<string> DiskEncryptionTypes
         {
@@ -215,13 +215,13 @@ public InputList<string> DiskEncryptionTypes
         }
 
         /// <summary>
-        /// Policy device assurance name
+        /// Name of the device assurance policy.
         /// </summary>
         [Input("name")]
         public Input<string>? Name { get; set; }
 
         /// <summary>
-        /// The device os minimum version
+        /// Minimum os version of the device in the device assurance policy.
         /// </summary>
         [Input("osVersion")]
         public Input<string>? OsVersion { get; set; }
@@ -230,7 +230,7 @@ public InputList<string> DiskEncryptionTypes
         private InputList<string>? _screenlockTypes;
 
         /// <summary>
-        /// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+        /// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
         /// </summary>
         public InputList<string> ScreenlockTypes
         {
@@ -239,7 +239,7 @@ public InputList<string> ScreenlockTypes
         }
 
         /// <summary>
-        /// Indicates if the device constains a secure hardware functionality
+        /// Is the device secure with hardware in the device assurance policy.
         /// </summary>
         [Input("secureHardwarePresent")]
         public Input<bool>? SecureHardwarePresent { get; set; }
@@ -352,7 +352,7 @@ public sealed class DeviceAssuranceMacosState : global::Pulumi.ResourceArgs
         private InputList<string>? _diskEncryptionTypes;
 
         /// <summary>
-        /// List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+        /// List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
         /// </summary>
         public InputList<string> DiskEncryptionTypes
         {
@@ -373,13 +373,13 @@ public InputList<string> DiskEncryptionTypes
         public Input<string>? LastUpdatedBy { get; set; }
 
         /// <summary>
-        /// Policy device assurance name
+        /// Name of the device assurance policy.
         /// </summary>
         [Input("name")]
         public Input<string>? Name { get; set; }
 
         /// <summary>
-        /// The device os minimum version
+        /// Minimum os version of the device in the device assurance policy.
         /// </summary>
         [Input("osVersion")]
         public Input<string>? OsVersion { get; set; }
@@ -394,7 +394,7 @@ public InputList<string> DiskEncryptionTypes
         private InputList<string>? _screenlockTypes;
 
         /// <summary>
-        /// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+        /// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
         /// </summary>
         public InputList<string> ScreenlockTypes
         {
@@ -403,7 +403,7 @@ public InputList<string> ScreenlockTypes
         }
 
         /// <summary>
-        /// Indicates if the device constains a secure hardware functionality
+        /// Is the device secure with hardware in the device assurance policy.
         /// </summary>
         [Input("secureHardwarePresent")]
         public Input<bool>? SecureHardwarePresent { get; set; }
diff --git a/sdk/dotnet/Policy/DeviceAssuranceWindows.cs b/sdk/dotnet/Policy/DeviceAssuranceWindows.cs
index 94bea41c..63659f19 100644
--- a/sdk/dotnet/Policy/DeviceAssuranceWindows.cs
+++ b/sdk/dotnet/Policy/DeviceAssuranceWindows.cs
@@ -25,7 +25,7 @@ public partial class DeviceAssuranceWindows : global::Pulumi.CustomResource
         public Output<string> CreatedDate { get; private set; } = null!;
 
         /// <summary>
-        /// List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+        /// List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
         /// </summary>
         [Output("diskEncryptionTypes")]
         public Output<ImmutableArray<string>> DiskEncryptionTypes { get; private set; } = null!;
@@ -43,13 +43,13 @@ public partial class DeviceAssuranceWindows : global::Pulumi.CustomResource
         public Output<string> LastUpdatedBy { get; private set; } = null!;
 
         /// <summary>
-        /// Policy device assurance name
+        /// Name of the device assurance policy.
         /// </summary>
         [Output("name")]
         public Output<string> Name { get; private set; } = null!;
 
         /// <summary>
-        /// The device os minimum version
+        /// Minimum os version of the device in the device assurance policy.
         /// </summary>
         [Output("osVersion")]
         public Output<string?> OsVersion { get; private set; } = null!;
@@ -61,13 +61,13 @@ public partial class DeviceAssuranceWindows : global::Pulumi.CustomResource
         public Output<string> Platform { get; private set; } = null!;
 
         /// <summary>
-        /// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+        /// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
         /// </summary>
         [Output("screenlockTypes")]
         public Output<ImmutableArray<string>> ScreenlockTypes { get; private set; } = null!;
 
         /// <summary>
-        /// Indicates if the device constains a secure hardware functionality
+        /// Is the device secure with hardware in the device assurance policy.
         /// </summary>
         [Output("secureHardwarePresent")]
         public Output<bool?> SecureHardwarePresent { get; private set; } = null!;
@@ -242,7 +242,7 @@ public sealed class DeviceAssuranceWindowsArgs : global::Pulumi.ResourceArgs
         private InputList<string>? _diskEncryptionTypes;
 
         /// <summary>
-        /// List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+        /// List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
         /// </summary>
         public InputList<string> DiskEncryptionTypes
         {
@@ -251,13 +251,13 @@ public InputList<string> DiskEncryptionTypes
         }
 
         /// <summary>
-        /// Policy device assurance name
+        /// Name of the device assurance policy.
         /// </summary>
         [Input("name")]
         public Input<string>? Name { get; set; }
 
         /// <summary>
-        /// The device os minimum version
+        /// Minimum os version of the device in the device assurance policy.
         /// </summary>
         [Input("osVersion")]
         public Input<string>? OsVersion { get; set; }
@@ -266,7 +266,7 @@ public InputList<string> DiskEncryptionTypes
         private InputList<string>? _screenlockTypes;
 
         /// <summary>
-        /// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+        /// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
         /// </summary>
         public InputList<string> ScreenlockTypes
         {
@@ -275,7 +275,7 @@ public InputList<string> ScreenlockTypes
         }
 
         /// <summary>
-        /// Indicates if the device constains a secure hardware functionality
+        /// Is the device secure with hardware in the device assurance policy.
         /// </summary>
         [Input("secureHardwarePresent")]
         public Input<bool>? SecureHardwarePresent { get; set; }
@@ -424,7 +424,7 @@ public sealed class DeviceAssuranceWindowsState : global::Pulumi.ResourceArgs
         private InputList<string>? _diskEncryptionTypes;
 
         /// <summary>
-        /// List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+        /// List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
         /// </summary>
         public InputList<string> DiskEncryptionTypes
         {
@@ -445,13 +445,13 @@ public InputList<string> DiskEncryptionTypes
         public Input<string>? LastUpdatedBy { get; set; }
 
         /// <summary>
-        /// Policy device assurance name
+        /// Name of the device assurance policy.
         /// </summary>
         [Input("name")]
         public Input<string>? Name { get; set; }
 
         /// <summary>
-        /// The device os minimum version
+        /// Minimum os version of the device in the device assurance policy.
         /// </summary>
         [Input("osVersion")]
         public Input<string>? OsVersion { get; set; }
@@ -466,7 +466,7 @@ public InputList<string> DiskEncryptionTypes
         private InputList<string>? _screenlockTypes;
 
         /// <summary>
-        /// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+        /// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
         /// </summary>
         public InputList<string> ScreenlockTypes
         {
@@ -475,7 +475,7 @@ public InputList<string> ScreenlockTypes
         }
 
         /// <summary>
-        /// Indicates if the device constains a secure hardware functionality
+        /// Is the device secure with hardware in the device assurance policy.
         /// </summary>
         [Input("secureHardwarePresent")]
         public Input<bool>? SecureHardwarePresent { get; set; }
diff --git a/sdk/dotnet/Policy/RuleIdpDiscovery.cs b/sdk/dotnet/Policy/RuleIdpDiscovery.cs
index 1cffb780..1ae187bc 100644
--- a/sdk/dotnet/Policy/RuleIdpDiscovery.cs
+++ b/sdk/dotnet/Policy/RuleIdpDiscovery.cs
@@ -162,6 +162,11 @@ public partial class RuleIdpDiscovery : global::Pulumi.CustomResource
         [Output("networkIncludes")]
         public Output<ImmutableArray<string>> NetworkIncludes { get; private set; } = null!;
 
+        /// <summary>
+        /// Platform to include in discovery rule. - 'type' - (Optional) One of: 'ANY', 'MOBILE', 'DESKTOP' - 'os_expression -
+        /// (Optional) Only available when using os_type = 'OTHER' - 'os_type' - (Optional) One of: 'ANY', 'IOS', 'WINDOWS',
+        /// 'ANDROID', 'OTHER', 'OSX'
+        /// </summary>
         [Output("platformIncludes")]
         public Output<ImmutableArray<Outputs.RuleIdpDiscoveryPlatformInclude>> PlatformIncludes { get; private set; } = null!;
 
@@ -333,6 +338,12 @@ public InputList<string> NetworkIncludes
 
         [Input("platformIncludes")]
         private InputList<Inputs.RuleIdpDiscoveryPlatformIncludeArgs>? _platformIncludes;
+
+        /// <summary>
+        /// Platform to include in discovery rule. - 'type' - (Optional) One of: 'ANY', 'MOBILE', 'DESKTOP' - 'os_expression -
+        /// (Optional) Only available when using os_type = 'OTHER' - 'os_type' - (Optional) One of: 'ANY', 'IOS', 'WINDOWS',
+        /// 'ANDROID', 'OTHER', 'OSX'
+        /// </summary>
         public InputList<Inputs.RuleIdpDiscoveryPlatformIncludeArgs> PlatformIncludes
         {
             get => _platformIncludes ?? (_platformIncludes = new InputList<Inputs.RuleIdpDiscoveryPlatformIncludeArgs>());
@@ -475,6 +486,12 @@ public InputList<string> NetworkIncludes
 
         [Input("platformIncludes")]
         private InputList<Inputs.RuleIdpDiscoveryPlatformIncludeGetArgs>? _platformIncludes;
+
+        /// <summary>
+        /// Platform to include in discovery rule. - 'type' - (Optional) One of: 'ANY', 'MOBILE', 'DESKTOP' - 'os_expression -
+        /// (Optional) Only available when using os_type = 'OTHER' - 'os_type' - (Optional) One of: 'ANY', 'IOS', 'WINDOWS',
+        /// 'ANDROID', 'OTHER', 'OSX'
+        /// </summary>
         public InputList<Inputs.RuleIdpDiscoveryPlatformIncludeGetArgs> PlatformIncludes
         {
             get => _platformIncludes ?? (_platformIncludes = new InputList<Inputs.RuleIdpDiscoveryPlatformIncludeGetArgs>());
diff --git a/sdk/dotnet/Policy/RuleMfa.cs b/sdk/dotnet/Policy/RuleMfa.cs
index f7362ac7..3c5b37ea 100644
--- a/sdk/dotnet/Policy/RuleMfa.cs
+++ b/sdk/dotnet/Policy/RuleMfa.cs
@@ -24,7 +24,10 @@ namespace Pulumi.Okta.Policy
     public partial class RuleMfa : global::Pulumi.CustomResource
     {
         /// <summary>
-        /// Applications to exclude
+        /// Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations. - 'id'
+        /// - (Optional) Use if 'type' is 'APP' to indicate the application id to include. - 'name' - (Optional) Use if the 'type'
+        /// is 'APP_TYPE' to indicate the type of application(s) to include in instances where an entire group (i.e. 'yahoo_mail')
+        /// of applications should be included. - 'type' - (Required) One of: 'APP', 'APP_TYPE'
         /// </summary>
         [Output("appExcludes")]
         public Output<ImmutableArray<Outputs.RuleMfaAppExclude>> AppExcludes { get; private set; } = null!;
@@ -139,7 +142,10 @@ public sealed class RuleMfaArgs : global::Pulumi.ResourceArgs
         private InputList<Inputs.RuleMfaAppExcludeArgs>? _appExcludes;
 
         /// <summary>
-        /// Applications to exclude
+        /// Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations. - 'id'
+        /// - (Optional) Use if 'type' is 'APP' to indicate the application id to include. - 'name' - (Optional) Use if the 'type'
+        /// is 'APP_TYPE' to indicate the type of application(s) to include in instances where an entire group (i.e. 'yahoo_mail')
+        /// of applications should be included. - 'type' - (Required) One of: 'APP', 'APP_TYPE'
         /// </summary>
         public InputList<Inputs.RuleMfaAppExcludeArgs> AppExcludes
         {
@@ -243,7 +249,10 @@ public sealed class RuleMfaState : global::Pulumi.ResourceArgs
         private InputList<Inputs.RuleMfaAppExcludeGetArgs>? _appExcludes;
 
         /// <summary>
-        /// Applications to exclude
+        /// Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations. - 'id'
+        /// - (Optional) Use if 'type' is 'APP' to indicate the application id to include. - 'name' - (Optional) Use if the 'type'
+        /// is 'APP_TYPE' to indicate the type of application(s) to include in instances where an entire group (i.e. 'yahoo_mail')
+        /// of applications should be included. - 'type' - (Required) One of: 'APP', 'APP_TYPE'
         /// </summary>
         public InputList<Inputs.RuleMfaAppExcludeGetArgs> AppExcludes
         {
diff --git a/sdk/dotnet/Policy/RuleSignon.cs b/sdk/dotnet/Policy/RuleSignon.cs
index 5fb39aa0..f43b6304 100644
--- a/sdk/dotnet/Policy/RuleSignon.cs
+++ b/sdk/dotnet/Policy/RuleSignon.cs
@@ -247,6 +247,12 @@ public partial class RuleSignon : global::Pulumi.CustomResource
         [Output("riscLevel")]
         public Output<string?> RiscLevel { get; private set; } = null!;
 
+        /// <summary>
+        /// Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
+        /// </summary>
+        [Output("riskLevel")]
+        public Output<string?> RiskLevel { get; private set; } = null!;
+
         /// <summary>
         /// Max minutes a session can be idle.,
         /// </summary>
@@ -465,6 +471,12 @@ public InputList<string> NetworkIncludes
         [Input("riscLevel")]
         public Input<string>? RiscLevel { get; set; }
 
+        /// <summary>
+        /// Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
+        /// </summary>
+        [Input("riskLevel")]
+        public Input<string>? RiskLevel { get; set; }
+
         /// <summary>
         /// Max minutes a session can be idle.,
         /// </summary>
@@ -651,6 +663,12 @@ public InputList<string> NetworkIncludes
         [Input("riscLevel")]
         public Input<string>? RiscLevel { get; set; }
 
+        /// <summary>
+        /// Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
+        /// </summary>
+        [Input("riskLevel")]
+        public Input<string>? RiskLevel { get; set; }
+
         /// <summary>
         /// Max minutes a session can be idle.,
         /// </summary>
diff --git a/sdk/dotnet/RoleSubscription.cs b/sdk/dotnet/RoleSubscription.cs
index b55df93c..b888158e 100644
--- a/sdk/dotnet/RoleSubscription.cs
+++ b/sdk/dotnet/RoleSubscription.cs
@@ -68,7 +68,7 @@ public partial class RoleSubscription : global::Pulumi.CustomResource
 
         /// <summary>
         /// Type of the role. Valid values:
-        /// `"API_ADMIN"`,
+        /// `"API_ACCESS_MANAGEMENT_ADMIN"`,
         /// `"APP_ADMIN"`,
         /// `"CUSTOM"`,
         /// `"GROUP_MEMBERSHIP_ADMIN"`,
@@ -157,7 +157,7 @@ public sealed class RoleSubscriptionArgs : global::Pulumi.ResourceArgs
 
         /// <summary>
         /// Type of the role. Valid values:
-        /// `"API_ADMIN"`,
+        /// `"API_ACCESS_MANAGEMENT_ADMIN"`,
         /// `"APP_ADMIN"`,
         /// `"CUSTOM"`,
         /// `"GROUP_MEMBERSHIP_ADMIN"`,
@@ -208,7 +208,7 @@ public sealed class RoleSubscriptionState : global::Pulumi.ResourceArgs
 
         /// <summary>
         /// Type of the role. Valid values:
-        /// `"API_ADMIN"`,
+        /// `"API_ACCESS_MANAGEMENT_ADMIN"`,
         /// `"APP_ADMIN"`,
         /// `"CUSTOM"`,
         /// `"GROUP_MEMBERSHIP_ADMIN"`,
diff --git a/sdk/dotnet/User/User.cs b/sdk/dotnet/User/User.cs
index 0b56f8ac..7ed3c317 100644
--- a/sdk/dotnet/User/User.cs
+++ b/sdk/dotnet/User/User.cs
@@ -126,7 +126,8 @@ public partial class User : global::Pulumi.CustomResource
         public Output<string> CustomProfileAttributes { get; private set; } = null!;
 
         /// <summary>
-        /// List of custom_profile_attribute keys that should be excluded from being managed by Terraform.
+        /// List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in
+        /// situations where specific custom fields may contain sensitive information and should be managed outside of Terraform.
         /// </summary>
         [Output("customProfileAttributesToIgnores")]
         public Output<ImmutableArray<string>> CustomProfileAttributesToIgnores { get; private set; } = null!;
@@ -448,7 +449,8 @@ public sealed class UserArgs : global::Pulumi.ResourceArgs
         private InputList<string>? _customProfileAttributesToIgnores;
 
         /// <summary>
-        /// List of custom_profile_attribute keys that should be excluded from being managed by Terraform.
+        /// List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in
+        /// situations where specific custom fields may contain sensitive information and should be managed outside of Terraform.
         /// </summary>
         public InputList<string> CustomProfileAttributesToIgnores
         {
@@ -753,7 +755,8 @@ public sealed class UserState : global::Pulumi.ResourceArgs
         private InputList<string>? _customProfileAttributesToIgnores;
 
         /// <summary>
-        /// List of custom_profile_attribute keys that should be excluded from being managed by Terraform.
+        /// List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in
+        /// situations where specific custom fields may contain sensitive information and should be managed outside of Terraform.
         /// </summary>
         public InputList<string> CustomProfileAttributesToIgnores
         {
diff --git a/sdk/go/okta/app/getSaml.go b/sdk/go/okta/app/getSaml.go
index e9215922..a38ac5ae 100644
--- a/sdk/go/okta/app/getSaml.go
+++ b/sdk/go/okta/app/getSaml.go
@@ -135,7 +135,7 @@ type LookupSamlResult struct {
 	ResponseSigned bool `pulumi:"responseSigned"`
 	// SAML Signed Request enabled
 	SamlSignedRequestEnabled bool `pulumi:"samlSignedRequestEnabled"`
-	// Signature algorithm used ot digitally sign the assertion and response.
+	// Signature algorithm used to digitally sign the assertion and response.
 	SignatureAlgorithm string `pulumi:"signatureAlgorithm"`
 	// x509 encoded certificate that the Service Provider uses to sign Single Logout requests.
 	SingleLogoutCertificate string `pulumi:"singleLogoutCertificate"`
@@ -377,7 +377,7 @@ func (o LookupSamlResultOutput) SamlSignedRequestEnabled() pulumi.BoolOutput {
 	return o.ApplyT(func(v LookupSamlResult) bool { return v.SamlSignedRequestEnabled }).(pulumi.BoolOutput)
 }
 
-// Signature algorithm used ot digitally sign the assertion and response.
+// Signature algorithm used to digitally sign the assertion and response.
 func (o LookupSamlResultOutput) SignatureAlgorithm() pulumi.StringOutput {
 	return o.ApplyT(func(v LookupSamlResult) string { return v.SignatureAlgorithm }).(pulumi.StringOutput)
 }
diff --git a/sdk/go/okta/app/saml.go b/sdk/go/okta/app/saml.go
index 8516e192..e630fee1 100644
--- a/sdk/go/okta/app/saml.go
+++ b/sdk/go/okta/app/saml.go
@@ -350,7 +350,7 @@ type Saml struct {
 	SamlVersion pulumi.StringPtrOutput `pulumi:"samlVersion"`
 	// Sign-on mode of application.
 	SignOnMode pulumi.StringOutput `pulumi:"signOnMode"`
-	// Signature algorithm used ot digitally sign the assertion and response.
+	// Signature algorithm used to digitally sign the assertion and response.
 	SignatureAlgorithm pulumi.StringPtrOutput `pulumi:"signatureAlgorithm"`
 	// x509 encoded certificate that the Service Provider uses to sign Single Logout requests.  Note: should be provided without `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----`, see [official documentation](https://developer.okta.com/docs/reference/api/apps/#service-provider-certificate).
 	SingleLogoutCertificate pulumi.StringPtrOutput `pulumi:"singleLogoutCertificate"`
@@ -505,7 +505,7 @@ type samlState struct {
 	SamlVersion *string `pulumi:"samlVersion"`
 	// Sign-on mode of application.
 	SignOnMode *string `pulumi:"signOnMode"`
-	// Signature algorithm used ot digitally sign the assertion and response.
+	// Signature algorithm used to digitally sign the assertion and response.
 	SignatureAlgorithm *string `pulumi:"signatureAlgorithm"`
 	// x509 encoded certificate that the Service Provider uses to sign Single Logout requests.  Note: should be provided without `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----`, see [official documentation](https://developer.okta.com/docs/reference/api/apps/#service-provider-certificate).
 	SingleLogoutCertificate *string `pulumi:"singleLogoutCertificate"`
@@ -628,7 +628,7 @@ type SamlState struct {
 	SamlVersion pulumi.StringPtrInput
 	// Sign-on mode of application.
 	SignOnMode pulumi.StringPtrInput
-	// Signature algorithm used ot digitally sign the assertion and response.
+	// Signature algorithm used to digitally sign the assertion and response.
 	SignatureAlgorithm pulumi.StringPtrInput
 	// x509 encoded certificate that the Service Provider uses to sign Single Logout requests.  Note: should be provided without `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----`, see [official documentation](https://developer.okta.com/docs/reference/api/apps/#service-provider-certificate).
 	SingleLogoutCertificate pulumi.StringPtrInput
@@ -727,7 +727,7 @@ type samlArgs struct {
 	SamlSignedRequestEnabled *bool `pulumi:"samlSignedRequestEnabled"`
 	// SAML version for the app's sign-on mode. Valid values are: `"2.0"` or `"1.1"`. Default is `"2.0"`.
 	SamlVersion *string `pulumi:"samlVersion"`
-	// Signature algorithm used ot digitally sign the assertion and response.
+	// Signature algorithm used to digitally sign the assertion and response.
 	SignatureAlgorithm *string `pulumi:"signatureAlgorithm"`
 	// x509 encoded certificate that the Service Provider uses to sign Single Logout requests.  Note: should be provided without `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----`, see [official documentation](https://developer.okta.com/docs/reference/api/apps/#service-provider-certificate).
 	SingleLogoutCertificate *string `pulumi:"singleLogoutCertificate"`
@@ -823,7 +823,7 @@ type SamlArgs struct {
 	SamlSignedRequestEnabled pulumi.BoolPtrInput
 	// SAML version for the app's sign-on mode. Valid values are: `"2.0"` or `"1.1"`. Default is `"2.0"`.
 	SamlVersion pulumi.StringPtrInput
-	// Signature algorithm used ot digitally sign the assertion and response.
+	// Signature algorithm used to digitally sign the assertion and response.
 	SignatureAlgorithm pulumi.StringPtrInput
 	// x509 encoded certificate that the Service Provider uses to sign Single Logout requests.  Note: should be provided without `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----`, see [official documentation](https://developer.okta.com/docs/reference/api/apps/#service-provider-certificate).
 	SingleLogoutCertificate pulumi.StringPtrInput
@@ -1173,7 +1173,7 @@ func (o SamlOutput) SignOnMode() pulumi.StringOutput {
 	return o.ApplyT(func(v *Saml) pulumi.StringOutput { return v.SignOnMode }).(pulumi.StringOutput)
 }
 
-// Signature algorithm used ot digitally sign the assertion and response.
+// Signature algorithm used to digitally sign the assertion and response.
 func (o SamlOutput) SignatureAlgorithm() pulumi.StringPtrOutput {
 	return o.ApplyT(func(v *Saml) pulumi.StringPtrOutput { return v.SignatureAlgorithm }).(pulumi.StringPtrOutput)
 }
diff --git a/sdk/go/okta/app/threeField.go b/sdk/go/okta/app/threeField.go
index 6bf44b58..ccf354dc 100644
--- a/sdk/go/okta/app/threeField.go
+++ b/sdk/go/okta/app/threeField.go
@@ -36,7 +36,7 @@ type ThreeField struct {
 	AccessibilitySelfService pulumi.BoolPtrOutput `pulumi:"accessibilitySelfService"`
 	// Application notes for admins.
 	AdminNote pulumi.StringPtrOutput `pulumi:"adminNote"`
-	// Displays specific appLinks for the app
+	// Displays specific appLinks for the app. The value for each application link should be boolean.
 	AppLinksJson pulumi.StringPtrOutput `pulumi:"appLinksJson"`
 	// Display auto submit toolbar.
 	AutoSubmitToolbar pulumi.BoolPtrOutput `pulumi:"autoSubmitToolbar"`
@@ -149,7 +149,7 @@ type threeFieldState struct {
 	AccessibilitySelfService *bool `pulumi:"accessibilitySelfService"`
 	// Application notes for admins.
 	AdminNote *string `pulumi:"adminNote"`
-	// Displays specific appLinks for the app
+	// Displays specific appLinks for the app. The value for each application link should be boolean.
 	AppLinksJson *string `pulumi:"appLinksJson"`
 	// Display auto submit toolbar.
 	AutoSubmitToolbar *bool `pulumi:"autoSubmitToolbar"`
@@ -212,7 +212,7 @@ type ThreeFieldState struct {
 	AccessibilitySelfService pulumi.BoolPtrInput
 	// Application notes for admins.
 	AdminNote pulumi.StringPtrInput
-	// Displays specific appLinks for the app
+	// Displays specific appLinks for the app. The value for each application link should be boolean.
 	AppLinksJson pulumi.StringPtrInput
 	// Display auto submit toolbar.
 	AutoSubmitToolbar pulumi.BoolPtrInput
@@ -279,7 +279,7 @@ type threeFieldArgs struct {
 	AccessibilitySelfService *bool `pulumi:"accessibilitySelfService"`
 	// Application notes for admins.
 	AdminNote *string `pulumi:"adminNote"`
-	// Displays specific appLinks for the app
+	// Displays specific appLinks for the app. The value for each application link should be boolean.
 	AppLinksJson *string `pulumi:"appLinksJson"`
 	// Display auto submit toolbar.
 	AutoSubmitToolbar *bool `pulumi:"autoSubmitToolbar"`
@@ -337,7 +337,7 @@ type ThreeFieldArgs struct {
 	AccessibilitySelfService pulumi.BoolPtrInput
 	// Application notes for admins.
 	AdminNote pulumi.StringPtrInput
-	// Displays specific appLinks for the app
+	// Displays specific appLinks for the app. The value for each application link should be boolean.
 	AppLinksJson pulumi.StringPtrInput
 	// Display auto submit toolbar.
 	AutoSubmitToolbar pulumi.BoolPtrInput
@@ -492,7 +492,7 @@ func (o ThreeFieldOutput) AdminNote() pulumi.StringPtrOutput {
 	return o.ApplyT(func(v *ThreeField) pulumi.StringPtrOutput { return v.AdminNote }).(pulumi.StringPtrOutput)
 }
 
-// Displays specific appLinks for the app
+// Displays specific appLinks for the app. The value for each application link should be boolean.
 func (o ThreeFieldOutput) AppLinksJson() pulumi.StringPtrOutput {
 	return o.ApplyT(func(v *ThreeField) pulumi.StringPtrOutput { return v.AppLinksJson }).(pulumi.StringPtrOutput)
 }
diff --git a/sdk/go/okta/appUserSchemaProperty.go b/sdk/go/okta/appUserSchemaProperty.go
index d0f181ce..cf9b01ba 100644
--- a/sdk/go/okta/appUserSchemaProperty.go
+++ b/sdk/go/okta/appUserSchemaProperty.go
@@ -94,9 +94,9 @@ type AppUserSchemaProperty struct {
 	Type pulumi.StringOutput `pulumi:"type"`
 	// If `type` is set to `"array"`, used to set whether attribute value is determined by group priority `false`, or combine values across groups `true`. Can not be set to `true` if `scope` is set to `"SELF"`.
 	Union pulumi.BoolPtrOutput `pulumi:"union"`
-	// Subschema unique restriction
+	// Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.
 	Unique pulumi.StringPtrOutput `pulumi:"unique"`
-	// Custom subschema user type
+	// User type ID. By default, it is `default`
 	UserType pulumi.StringPtrOutput `pulumi:"userType"`
 }
 
@@ -180,9 +180,9 @@ type appUserSchemaPropertyState struct {
 	Type *string `pulumi:"type"`
 	// If `type` is set to `"array"`, used to set whether attribute value is determined by group priority `false`, or combine values across groups `true`. Can not be set to `true` if `scope` is set to `"SELF"`.
 	Union *bool `pulumi:"union"`
-	// Subschema unique restriction
+	// Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.
 	Unique *string `pulumi:"unique"`
-	// Custom subschema user type
+	// User type ID. By default, it is `default`
 	UserType *string `pulumi:"userType"`
 }
 
@@ -225,9 +225,9 @@ type AppUserSchemaPropertyState struct {
 	Type pulumi.StringPtrInput
 	// If `type` is set to `"array"`, used to set whether attribute value is determined by group priority `false`, or combine values across groups `true`. Can not be set to `true` if `scope` is set to `"SELF"`.
 	Union pulumi.BoolPtrInput
-	// Subschema unique restriction
+	// Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.
 	Unique pulumi.StringPtrInput
-	// Custom subschema user type
+	// User type ID. By default, it is `default`
 	UserType pulumi.StringPtrInput
 }
 
@@ -274,9 +274,9 @@ type appUserSchemaPropertyArgs struct {
 	Type string `pulumi:"type"`
 	// If `type` is set to `"array"`, used to set whether attribute value is determined by group priority `false`, or combine values across groups `true`. Can not be set to `true` if `scope` is set to `"SELF"`.
 	Union *bool `pulumi:"union"`
-	// Subschema unique restriction
+	// Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.
 	Unique *string `pulumi:"unique"`
-	// Custom subschema user type
+	// User type ID. By default, it is `default`
 	UserType *string `pulumi:"userType"`
 }
 
@@ -320,9 +320,9 @@ type AppUserSchemaPropertyArgs struct {
 	Type pulumi.StringInput
 	// If `type` is set to `"array"`, used to set whether attribute value is determined by group priority `false`, or combine values across groups `true`. Can not be set to `true` if `scope` is set to `"SELF"`.
 	Union pulumi.BoolPtrInput
-	// Subschema unique restriction
+	// Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.
 	Unique pulumi.StringPtrInput
-	// Custom subschema user type
+	// User type ID. By default, it is `default`
 	UserType pulumi.StringPtrInput
 }
 
@@ -508,12 +508,12 @@ func (o AppUserSchemaPropertyOutput) Union() pulumi.BoolPtrOutput {
 	return o.ApplyT(func(v *AppUserSchemaProperty) pulumi.BoolPtrOutput { return v.Union }).(pulumi.BoolPtrOutput)
 }
 
-// Subschema unique restriction
+// Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.
 func (o AppUserSchemaPropertyOutput) Unique() pulumi.StringPtrOutput {
 	return o.ApplyT(func(v *AppUserSchemaProperty) pulumi.StringPtrOutput { return v.Unique }).(pulumi.StringPtrOutput)
 }
 
-// Custom subschema user type
+// User type ID. By default, it is `default`
 func (o AppUserSchemaPropertyOutput) UserType() pulumi.StringPtrOutput {
 	return o.ApplyT(func(v *AppUserSchemaProperty) pulumi.StringPtrOutput { return v.UserType }).(pulumi.StringPtrOutput)
 }
diff --git a/sdk/go/okta/eventHook.go b/sdk/go/okta/eventHook.go
index 67a72c9d..ebf54ff3 100644
--- a/sdk/go/okta/eventHook.go
+++ b/sdk/go/okta/eventHook.go
@@ -76,7 +76,8 @@ type EventHook struct {
 	// Map of headers to send along in event hook request.
 	Headers EventHookHeaderArrayOutput `pulumi:"headers"`
 	// The event hook display name.
-	Name   pulumi.StringOutput    `pulumi:"name"`
+	Name pulumi.StringOutput `pulumi:"name"`
+	// Default to `ACTIVE`
 	Status pulumi.StringPtrOutput `pulumi:"status"`
 }
 
@@ -125,7 +126,8 @@ type eventHookState struct {
 	// Map of headers to send along in event hook request.
 	Headers []EventHookHeader `pulumi:"headers"`
 	// The event hook display name.
-	Name   *string `pulumi:"name"`
+	Name *string `pulumi:"name"`
+	// Default to `ACTIVE`
 	Status *string `pulumi:"status"`
 }
 
@@ -139,7 +141,8 @@ type EventHookState struct {
 	// Map of headers to send along in event hook request.
 	Headers EventHookHeaderArrayInput
 	// The event hook display name.
-	Name   pulumi.StringPtrInput
+	Name pulumi.StringPtrInput
+	// Default to `ACTIVE`
 	Status pulumi.StringPtrInput
 }
 
@@ -157,7 +160,8 @@ type eventHookArgs struct {
 	// Map of headers to send along in event hook request.
 	Headers []EventHookHeader `pulumi:"headers"`
 	// The event hook display name.
-	Name   *string `pulumi:"name"`
+	Name *string `pulumi:"name"`
+	// Default to `ACTIVE`
 	Status *string `pulumi:"status"`
 }
 
@@ -172,7 +176,8 @@ type EventHookArgs struct {
 	// Map of headers to send along in event hook request.
 	Headers EventHookHeaderArrayInput
 	// The event hook display name.
-	Name   pulumi.StringPtrInput
+	Name pulumi.StringPtrInput
+	// Default to `ACTIVE`
 	Status pulumi.StringPtrInput
 }
 
@@ -288,6 +293,7 @@ func (o EventHookOutput) Name() pulumi.StringOutput {
 	return o.ApplyT(func(v *EventHook) pulumi.StringOutput { return v.Name }).(pulumi.StringOutput)
 }
 
+// Default to `ACTIVE`
 func (o EventHookOutput) Status() pulumi.StringPtrOutput {
 	return o.ApplyT(func(v *EventHook) pulumi.StringPtrOutput { return v.Status }).(pulumi.StringPtrOutput)
 }
diff --git a/sdk/go/okta/getRoleSubscription.go b/sdk/go/okta/getRoleSubscription.go
index db988acd..6a017093 100644
--- a/sdk/go/okta/getRoleSubscription.go
+++ b/sdk/go/okta/getRoleSubscription.go
@@ -58,7 +58,7 @@ type LookupRoleSubscriptionArgs struct {
 	// `"USER_DEPROVISION"`, `"REPORT_SUSPICIOUS_ACTIVITY"`, `"RATELIMIT_NOTIFICATION"`.
 	NotificationType string `pulumi:"notificationType"`
 	// Type of the role. Valid values:
-	// `"API_ADMIN"`,
+	// `"API_ACCESS_MANAGEMENT_ADMIN"`,
 	// `"APP_ADMIN"`,
 	// `"CUSTOM"`,
 	// `"GROUP_MEMBERSHIP_ADMIN"`,
@@ -103,7 +103,7 @@ type LookupRoleSubscriptionOutputArgs struct {
 	// `"USER_DEPROVISION"`, `"REPORT_SUSPICIOUS_ACTIVITY"`, `"RATELIMIT_NOTIFICATION"`.
 	NotificationType pulumi.StringInput `pulumi:"notificationType"`
 	// Type of the role. Valid values:
-	// `"API_ADMIN"`,
+	// `"API_ACCESS_MANAGEMENT_ADMIN"`,
 	// `"APP_ADMIN"`,
 	// `"CUSTOM"`,
 	// `"GROUP_MEMBERSHIP_ADMIN"`,
diff --git a/sdk/go/okta/group/role.go b/sdk/go/okta/group/role.go
index 1725b5fb..ecbb6c18 100644
--- a/sdk/go/okta/group/role.go
+++ b/sdk/go/okta/group/role.go
@@ -62,7 +62,7 @@ type Role struct {
 	// The ID of group to attach admin roles to.
 	GroupId pulumi.StringOutput `pulumi:"groupId"`
 	// Admin role assigned to the group. It can be any one of the following values:
-	// `"API_ADMIN"`,
+	// `"API_ACCESS_MANAGEMENT_ADMIN"`,
 	// `"APP_ADMIN"`,
 	// `"CUSTOM"`,
 	// `"GROUP_MEMBERSHIP_ADMIN"`,
@@ -129,7 +129,7 @@ type roleState struct {
 	// The ID of group to attach admin roles to.
 	GroupId *string `pulumi:"groupId"`
 	// Admin role assigned to the group. It can be any one of the following values:
-	// `"API_ADMIN"`,
+	// `"API_ACCESS_MANAGEMENT_ADMIN"`,
 	// `"APP_ADMIN"`,
 	// `"CUSTOM"`,
 	// `"GROUP_MEMBERSHIP_ADMIN"`,
@@ -161,7 +161,7 @@ type RoleState struct {
 	// The ID of group to attach admin roles to.
 	GroupId pulumi.StringPtrInput
 	// Admin role assigned to the group. It can be any one of the following values:
-	// `"API_ADMIN"`,
+	// `"API_ACCESS_MANAGEMENT_ADMIN"`,
 	// `"APP_ADMIN"`,
 	// `"CUSTOM"`,
 	// `"GROUP_MEMBERSHIP_ADMIN"`,
@@ -197,7 +197,7 @@ type roleArgs struct {
 	// The ID of group to attach admin roles to.
 	GroupId string `pulumi:"groupId"`
 	// Admin role assigned to the group. It can be any one of the following values:
-	// `"API_ADMIN"`,
+	// `"API_ACCESS_MANAGEMENT_ADMIN"`,
 	// `"APP_ADMIN"`,
 	// `"CUSTOM"`,
 	// `"GROUP_MEMBERSHIP_ADMIN"`,
@@ -230,7 +230,7 @@ type RoleArgs struct {
 	// The ID of group to attach admin roles to.
 	GroupId pulumi.StringInput
 	// Admin role assigned to the group. It can be any one of the following values:
-	// `"API_ADMIN"`,
+	// `"API_ACCESS_MANAGEMENT_ADMIN"`,
 	// `"APP_ADMIN"`,
 	// `"CUSTOM"`,
 	// `"GROUP_MEMBERSHIP_ADMIN"`,
@@ -354,7 +354,7 @@ func (o RoleOutput) GroupId() pulumi.StringOutput {
 }
 
 // Admin role assigned to the group. It can be any one of the following values:
-// `"API_ADMIN"`,
+// `"API_ACCESS_MANAGEMENT_ADMIN"`,
 // `"APP_ADMIN"`,
 // `"CUSTOM"`,
 // `"GROUP_MEMBERSHIP_ADMIN"`,
diff --git a/sdk/go/okta/idp/oidc.go b/sdk/go/okta/idp/oidc.go
index ff4d5613..832742be 100644
--- a/sdk/go/okta/idp/oidc.go
+++ b/sdk/go/okta/idp/oidc.go
@@ -102,9 +102,6 @@ type Oidc struct {
 	MaxClockSkew pulumi.IntPtrOutput `pulumi:"maxClockSkew"`
 	// The Application's display name.
 	Name pulumi.StringOutput `pulumi:"name"`
-	// Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See:
-	// https://developer.okta.com/docs/reference/api/idps/#oauth-2-0-and-openid-connect-client-object
-	PkceRequired pulumi.BoolPtrOutput `pulumi:"pkceRequired"`
 	// Determines if the IdP should act as a source of truth for user profile attributes.
 	ProfileMaster pulumi.BoolPtrOutput `pulumi:"profileMaster"`
 	// The type of protocol to use. It can be `"OIDC"` or `"OAUTH2"`.
@@ -241,9 +238,6 @@ type oidcState struct {
 	MaxClockSkew *int `pulumi:"maxClockSkew"`
 	// The Application's display name.
 	Name *string `pulumi:"name"`
-	// Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See:
-	// https://developer.okta.com/docs/reference/api/idps/#oauth-2-0-and-openid-connect-client-object
-	PkceRequired *bool `pulumi:"pkceRequired"`
 	// Determines if the IdP should act as a source of truth for user profile attributes.
 	ProfileMaster *bool `pulumi:"profileMaster"`
 	// The type of protocol to use. It can be `"OIDC"` or `"OAUTH2"`.
@@ -314,9 +308,6 @@ type OidcState struct {
 	MaxClockSkew pulumi.IntPtrInput
 	// The Application's display name.
 	Name pulumi.StringPtrInput
-	// Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See:
-	// https://developer.okta.com/docs/reference/api/idps/#oauth-2-0-and-openid-connect-client-object
-	PkceRequired pulumi.BoolPtrInput
 	// Determines if the IdP should act as a source of truth for user profile attributes.
 	ProfileMaster pulumi.BoolPtrInput
 	// The type of protocol to use. It can be `"OIDC"` or `"OAUTH2"`.
@@ -391,9 +382,6 @@ type oidcArgs struct {
 	MaxClockSkew *int `pulumi:"maxClockSkew"`
 	// The Application's display name.
 	Name *string `pulumi:"name"`
-	// Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See:
-	// https://developer.okta.com/docs/reference/api/idps/#oauth-2-0-and-openid-connect-client-object
-	PkceRequired *bool `pulumi:"pkceRequired"`
 	// Determines if the IdP should act as a source of truth for user profile attributes.
 	ProfileMaster *bool `pulumi:"profileMaster"`
 	// The type of protocol to use. It can be `"OIDC"` or `"OAUTH2"`.
@@ -461,9 +449,6 @@ type OidcArgs struct {
 	MaxClockSkew pulumi.IntPtrInput
 	// The Application's display name.
 	Name pulumi.StringPtrInput
-	// Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See:
-	// https://developer.okta.com/docs/reference/api/idps/#oauth-2-0-and-openid-connect-client-object
-	PkceRequired pulumi.BoolPtrInput
 	// Determines if the IdP should act as a source of truth for user profile attributes.
 	ProfileMaster pulumi.BoolPtrInput
 	// The type of protocol to use. It can be `"OIDC"` or `"OAUTH2"`.
@@ -667,12 +652,6 @@ func (o OidcOutput) Name() pulumi.StringOutput {
 	return o.ApplyT(func(v *Oidc) pulumi.StringOutput { return v.Name }).(pulumi.StringOutput)
 }
 
-// Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See:
-// https://developer.okta.com/docs/reference/api/idps/#oauth-2-0-and-openid-connect-client-object
-func (o OidcOutput) PkceRequired() pulumi.BoolPtrOutput {
-	return o.ApplyT(func(v *Oidc) pulumi.BoolPtrOutput { return v.PkceRequired }).(pulumi.BoolPtrOutput)
-}
-
 // Determines if the IdP should act as a source of truth for user profile attributes.
 func (o OidcOutput) ProfileMaster() pulumi.BoolPtrOutput {
 	return o.ApplyT(func(v *Oidc) pulumi.BoolPtrOutput { return v.ProfileMaster }).(pulumi.BoolPtrOutput)
diff --git a/sdk/go/okta/inline/hook.go b/sdk/go/okta/inline/hook.go
index 988200e0..0f1b3ec9 100644
--- a/sdk/go/okta/inline/hook.go
+++ b/sdk/go/okta/inline/hook.go
@@ -72,7 +72,8 @@ type Hook struct {
 	// Map of headers to send along in inline hook request.
 	Headers HookHeaderArrayOutput `pulumi:"headers"`
 	// The inline hook display name.
-	Name   pulumi.StringOutput    `pulumi:"name"`
+	Name pulumi.StringOutput `pulumi:"name"`
+	// Default to `ACTIVE`
 	Status pulumi.StringPtrOutput `pulumi:"status"`
 	// The type of hook to trigger. Currently, the only supported type is `"HTTP"`.
 	Type pulumi.StringOutput `pulumi:"type"`
@@ -126,7 +127,8 @@ type hookState struct {
 	// Map of headers to send along in inline hook request.
 	Headers []HookHeader `pulumi:"headers"`
 	// The inline hook display name.
-	Name   *string `pulumi:"name"`
+	Name *string `pulumi:"name"`
+	// Default to `ACTIVE`
 	Status *string `pulumi:"status"`
 	// The type of hook to trigger. Currently, the only supported type is `"HTTP"`.
 	Type *string `pulumi:"type"`
@@ -142,7 +144,8 @@ type HookState struct {
 	// Map of headers to send along in inline hook request.
 	Headers HookHeaderArrayInput
 	// The inline hook display name.
-	Name   pulumi.StringPtrInput
+	Name pulumi.StringPtrInput
+	// Default to `ACTIVE`
 	Status pulumi.StringPtrInput
 	// The type of hook to trigger. Currently, the only supported type is `"HTTP"`.
 	Type pulumi.StringPtrInput
@@ -162,7 +165,8 @@ type hookArgs struct {
 	// Map of headers to send along in inline hook request.
 	Headers []HookHeader `pulumi:"headers"`
 	// The inline hook display name.
-	Name   *string `pulumi:"name"`
+	Name *string `pulumi:"name"`
+	// Default to `ACTIVE`
 	Status *string `pulumi:"status"`
 	// The type of hook to trigger. Currently, the only supported type is `"HTTP"`.
 	Type string `pulumi:"type"`
@@ -179,7 +183,8 @@ type HookArgs struct {
 	// Map of headers to send along in inline hook request.
 	Headers HookHeaderArrayInput
 	// The inline hook display name.
-	Name   pulumi.StringPtrInput
+	Name pulumi.StringPtrInput
+	// Default to `ACTIVE`
 	Status pulumi.StringPtrInput
 	// The type of hook to trigger. Currently, the only supported type is `"HTTP"`.
 	Type pulumi.StringInput
@@ -294,6 +299,7 @@ func (o HookOutput) Name() pulumi.StringOutput {
 	return o.ApplyT(func(v *Hook) pulumi.StringOutput { return v.Name }).(pulumi.StringOutput)
 }
 
+// Default to `ACTIVE`
 func (o HookOutput) Status() pulumi.StringPtrOutput {
 	return o.ApplyT(func(v *Hook) pulumi.StringPtrOutput { return v.Status }).(pulumi.StringPtrOutput)
 }
diff --git a/sdk/go/okta/orgConfiguration.go b/sdk/go/okta/orgConfiguration.go
index c55b3b9f..85b053c7 100644
--- a/sdk/go/okta/orgConfiguration.go
+++ b/sdk/go/okta/orgConfiguration.go
@@ -71,7 +71,8 @@ type OrgConfiguration struct {
 	EndUserSupportHelpUrl pulumi.StringPtrOutput `pulumi:"endUserSupportHelpUrl"`
 	// Expiration of org
 	ExpiresAt pulumi.StringOutput `pulumi:"expiresAt"`
-	// Local path to logo of the org.
+	// Logo of org. The file must be in PNG, JPG, or GIF format and less than 1 MB in size. For best results use landscape
+	// orientation, a transparent background, and a minimum size of 420px by 120px to prevent upscaling.
 	Logo pulumi.StringPtrOutput `pulumi:"logo"`
 	// Indicates whether the org's users receive Okta Communication emails
 	OptOutCommunicationEmails pulumi.BoolPtrOutput `pulumi:"optOutCommunicationEmails"`
@@ -140,7 +141,8 @@ type orgConfigurationState struct {
 	EndUserSupportHelpUrl *string `pulumi:"endUserSupportHelpUrl"`
 	// Expiration of org
 	ExpiresAt *string `pulumi:"expiresAt"`
-	// Local path to logo of the org.
+	// Logo of org. The file must be in PNG, JPG, or GIF format and less than 1 MB in size. For best results use landscape
+	// orientation, a transparent background, and a minimum size of 420px by 120px to prevent upscaling.
 	Logo *string `pulumi:"logo"`
 	// Indicates whether the org's users receive Okta Communication emails
 	OptOutCommunicationEmails *bool `pulumi:"optOutCommunicationEmails"`
@@ -177,7 +179,8 @@ type OrgConfigurationState struct {
 	EndUserSupportHelpUrl pulumi.StringPtrInput
 	// Expiration of org
 	ExpiresAt pulumi.StringPtrInput
-	// Local path to logo of the org.
+	// Logo of org. The file must be in PNG, JPG, or GIF format and less than 1 MB in size. For best results use landscape
+	// orientation, a transparent background, and a minimum size of 420px by 120px to prevent upscaling.
 	Logo pulumi.StringPtrInput
 	// Indicates whether the org's users receive Okta Communication emails
 	OptOutCommunicationEmails pulumi.BoolPtrInput
@@ -216,7 +219,8 @@ type orgConfigurationArgs struct {
 	Country *string `pulumi:"country"`
 	// Support link of org
 	EndUserSupportHelpUrl *string `pulumi:"endUserSupportHelpUrl"`
-	// Local path to logo of the org.
+	// Logo of org. The file must be in PNG, JPG, or GIF format and less than 1 MB in size. For best results use landscape
+	// orientation, a transparent background, and a minimum size of 420px by 120px to prevent upscaling.
 	Logo *string `pulumi:"logo"`
 	// Indicates whether the org's users receive Okta Communication emails
 	OptOutCommunicationEmails *bool `pulumi:"optOutCommunicationEmails"`
@@ -250,7 +254,8 @@ type OrgConfigurationArgs struct {
 	Country pulumi.StringPtrInput
 	// Support link of org
 	EndUserSupportHelpUrl pulumi.StringPtrInput
-	// Local path to logo of the org.
+	// Logo of org. The file must be in PNG, JPG, or GIF format and less than 1 MB in size. For best results use landscape
+	// orientation, a transparent background, and a minimum size of 420px by 120px to prevent upscaling.
 	Logo pulumi.StringPtrInput
 	// Indicates whether the org's users receive Okta Communication emails
 	OptOutCommunicationEmails pulumi.BoolPtrInput
@@ -395,7 +400,8 @@ func (o OrgConfigurationOutput) ExpiresAt() pulumi.StringOutput {
 	return o.ApplyT(func(v *OrgConfiguration) pulumi.StringOutput { return v.ExpiresAt }).(pulumi.StringOutput)
 }
 
-// Local path to logo of the org.
+// Logo of org. The file must be in PNG, JPG, or GIF format and less than 1 MB in size. For best results use landscape
+// orientation, a transparent background, and a minimum size of 420px by 120px to prevent upscaling.
 func (o OrgConfigurationOutput) Logo() pulumi.StringPtrOutput {
 	return o.ApplyT(func(v *OrgConfiguration) pulumi.StringPtrOutput { return v.Logo }).(pulumi.StringPtrOutput)
 }
diff --git a/sdk/go/okta/policy/deviceAssuranceAndroid.go b/sdk/go/okta/policy/deviceAssuranceAndroid.go
index 3d5613d9..77fa17dd 100644
--- a/sdk/go/okta/policy/deviceAssuranceAndroid.go
+++ b/sdk/go/okta/policy/deviceAssuranceAndroid.go
@@ -18,9 +18,9 @@ type DeviceAssuranceAndroid struct {
 	CreatedBy pulumi.StringOutput `pulumi:"createdBy"`
 	// Created date
 	CreatedDate pulumi.StringOutput `pulumi:"createdDate"`
-	// List of disk encryption type, can be FULL, USER
+	// List of disk encryption type, can be `FULL`, `USER`
 	DiskEncryptionTypes pulumi.StringArrayOutput `pulumi:"diskEncryptionTypes"`
-	// The device jailbreak. Only for android and iOS platform
+	// Is the device jailbroken in the device assurance policy.
 	Jailbreak pulumi.BoolPtrOutput `pulumi:"jailbreak"`
 	// Last update
 	LastUpdate pulumi.StringOutput `pulumi:"lastUpdate"`
@@ -28,13 +28,13 @@ type DeviceAssuranceAndroid struct {
 	LastUpdatedBy pulumi.StringOutput `pulumi:"lastUpdatedBy"`
 	// Policy device assurance name
 	Name pulumi.StringOutput `pulumi:"name"`
-	// The device os minimum version
+	// Minimum os version of the device in the device assurance policy.
 	OsVersion pulumi.StringPtrOutput `pulumi:"osVersion"`
 	// Policy device assurance platform
 	Platform pulumi.StringOutput `pulumi:"platform"`
-	// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+	// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
 	ScreenlockTypes pulumi.StringArrayOutput `pulumi:"screenlockTypes"`
-	// Indicates if the device constains a secure hardware functionality
+	// Indicates if the device contains a secure hardware functionality
 	SecureHardwarePresent pulumi.BoolPtrOutput `pulumi:"secureHardwarePresent"`
 }
 
@@ -72,9 +72,9 @@ type deviceAssuranceAndroidState struct {
 	CreatedBy *string `pulumi:"createdBy"`
 	// Created date
 	CreatedDate *string `pulumi:"createdDate"`
-	// List of disk encryption type, can be FULL, USER
+	// List of disk encryption type, can be `FULL`, `USER`
 	DiskEncryptionTypes []string `pulumi:"diskEncryptionTypes"`
-	// The device jailbreak. Only for android and iOS platform
+	// Is the device jailbroken in the device assurance policy.
 	Jailbreak *bool `pulumi:"jailbreak"`
 	// Last update
 	LastUpdate *string `pulumi:"lastUpdate"`
@@ -82,13 +82,13 @@ type deviceAssuranceAndroidState struct {
 	LastUpdatedBy *string `pulumi:"lastUpdatedBy"`
 	// Policy device assurance name
 	Name *string `pulumi:"name"`
-	// The device os minimum version
+	// Minimum os version of the device in the device assurance policy.
 	OsVersion *string `pulumi:"osVersion"`
 	// Policy device assurance platform
 	Platform *string `pulumi:"platform"`
-	// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+	// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
 	ScreenlockTypes []string `pulumi:"screenlockTypes"`
-	// Indicates if the device constains a secure hardware functionality
+	// Indicates if the device contains a secure hardware functionality
 	SecureHardwarePresent *bool `pulumi:"secureHardwarePresent"`
 }
 
@@ -97,9 +97,9 @@ type DeviceAssuranceAndroidState struct {
 	CreatedBy pulumi.StringPtrInput
 	// Created date
 	CreatedDate pulumi.StringPtrInput
-	// List of disk encryption type, can be FULL, USER
+	// List of disk encryption type, can be `FULL`, `USER`
 	DiskEncryptionTypes pulumi.StringArrayInput
-	// The device jailbreak. Only for android and iOS platform
+	// Is the device jailbroken in the device assurance policy.
 	Jailbreak pulumi.BoolPtrInput
 	// Last update
 	LastUpdate pulumi.StringPtrInput
@@ -107,13 +107,13 @@ type DeviceAssuranceAndroidState struct {
 	LastUpdatedBy pulumi.StringPtrInput
 	// Policy device assurance name
 	Name pulumi.StringPtrInput
-	// The device os minimum version
+	// Minimum os version of the device in the device assurance policy.
 	OsVersion pulumi.StringPtrInput
 	// Policy device assurance platform
 	Platform pulumi.StringPtrInput
-	// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+	// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
 	ScreenlockTypes pulumi.StringArrayInput
-	// Indicates if the device constains a secure hardware functionality
+	// Indicates if the device contains a secure hardware functionality
 	SecureHardwarePresent pulumi.BoolPtrInput
 }
 
@@ -122,33 +122,33 @@ func (DeviceAssuranceAndroidState) ElementType() reflect.Type {
 }
 
 type deviceAssuranceAndroidArgs struct {
-	// List of disk encryption type, can be FULL, USER
+	// List of disk encryption type, can be `FULL`, `USER`
 	DiskEncryptionTypes []string `pulumi:"diskEncryptionTypes"`
-	// The device jailbreak. Only for android and iOS platform
+	// Is the device jailbroken in the device assurance policy.
 	Jailbreak *bool `pulumi:"jailbreak"`
 	// Policy device assurance name
 	Name *string `pulumi:"name"`
-	// The device os minimum version
+	// Minimum os version of the device in the device assurance policy.
 	OsVersion *string `pulumi:"osVersion"`
-	// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+	// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
 	ScreenlockTypes []string `pulumi:"screenlockTypes"`
-	// Indicates if the device constains a secure hardware functionality
+	// Indicates if the device contains a secure hardware functionality
 	SecureHardwarePresent *bool `pulumi:"secureHardwarePresent"`
 }
 
 // The set of arguments for constructing a DeviceAssuranceAndroid resource.
 type DeviceAssuranceAndroidArgs struct {
-	// List of disk encryption type, can be FULL, USER
+	// List of disk encryption type, can be `FULL`, `USER`
 	DiskEncryptionTypes pulumi.StringArrayInput
-	// The device jailbreak. Only for android and iOS platform
+	// Is the device jailbroken in the device assurance policy.
 	Jailbreak pulumi.BoolPtrInput
 	// Policy device assurance name
 	Name pulumi.StringPtrInput
-	// The device os minimum version
+	// Minimum os version of the device in the device assurance policy.
 	OsVersion pulumi.StringPtrInput
-	// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+	// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
 	ScreenlockTypes pulumi.StringArrayInput
-	// Indicates if the device constains a secure hardware functionality
+	// Indicates if the device contains a secure hardware functionality
 	SecureHardwarePresent pulumi.BoolPtrInput
 }
 
@@ -249,12 +249,12 @@ func (o DeviceAssuranceAndroidOutput) CreatedDate() pulumi.StringOutput {
 	return o.ApplyT(func(v *DeviceAssuranceAndroid) pulumi.StringOutput { return v.CreatedDate }).(pulumi.StringOutput)
 }
 
-// List of disk encryption type, can be FULL, USER
+// List of disk encryption type, can be `FULL`, `USER`
 func (o DeviceAssuranceAndroidOutput) DiskEncryptionTypes() pulumi.StringArrayOutput {
 	return o.ApplyT(func(v *DeviceAssuranceAndroid) pulumi.StringArrayOutput { return v.DiskEncryptionTypes }).(pulumi.StringArrayOutput)
 }
 
-// The device jailbreak. Only for android and iOS platform
+// Is the device jailbroken in the device assurance policy.
 func (o DeviceAssuranceAndroidOutput) Jailbreak() pulumi.BoolPtrOutput {
 	return o.ApplyT(func(v *DeviceAssuranceAndroid) pulumi.BoolPtrOutput { return v.Jailbreak }).(pulumi.BoolPtrOutput)
 }
@@ -274,7 +274,7 @@ func (o DeviceAssuranceAndroidOutput) Name() pulumi.StringOutput {
 	return o.ApplyT(func(v *DeviceAssuranceAndroid) pulumi.StringOutput { return v.Name }).(pulumi.StringOutput)
 }
 
-// The device os minimum version
+// Minimum os version of the device in the device assurance policy.
 func (o DeviceAssuranceAndroidOutput) OsVersion() pulumi.StringPtrOutput {
 	return o.ApplyT(func(v *DeviceAssuranceAndroid) pulumi.StringPtrOutput { return v.OsVersion }).(pulumi.StringPtrOutput)
 }
@@ -284,12 +284,12 @@ func (o DeviceAssuranceAndroidOutput) Platform() pulumi.StringOutput {
 	return o.ApplyT(func(v *DeviceAssuranceAndroid) pulumi.StringOutput { return v.Platform }).(pulumi.StringOutput)
 }
 
-// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
 func (o DeviceAssuranceAndroidOutput) ScreenlockTypes() pulumi.StringArrayOutput {
 	return o.ApplyT(func(v *DeviceAssuranceAndroid) pulumi.StringArrayOutput { return v.ScreenlockTypes }).(pulumi.StringArrayOutput)
 }
 
-// Indicates if the device constains a secure hardware functionality
+// Indicates if the device contains a secure hardware functionality
 func (o DeviceAssuranceAndroidOutput) SecureHardwarePresent() pulumi.BoolPtrOutput {
 	return o.ApplyT(func(v *DeviceAssuranceAndroid) pulumi.BoolPtrOutput { return v.SecureHardwarePresent }).(pulumi.BoolPtrOutput)
 }
diff --git a/sdk/go/okta/policy/deviceAssuranceChromeos.go b/sdk/go/okta/policy/deviceAssuranceChromeos.go
index 699ff25e..b9b3c5d2 100644
--- a/sdk/go/okta/policy/deviceAssuranceChromeos.go
+++ b/sdk/go/okta/policy/deviceAssuranceChromeos.go
@@ -22,7 +22,7 @@ type DeviceAssuranceChromeos struct {
 	LastUpdate pulumi.StringOutput `pulumi:"lastUpdate"`
 	// Last updated by
 	LastUpdatedBy pulumi.StringOutput `pulumi:"lastUpdatedBy"`
-	// Policy device assurance name
+	// Name of the device assurance policy.
 	Name pulumi.StringOutput `pulumi:"name"`
 	// Policy device assurance platform
 	Platform pulumi.StringOutput `pulumi:"platform"`
@@ -94,7 +94,7 @@ type deviceAssuranceChromeosState struct {
 	LastUpdate *string `pulumi:"lastUpdate"`
 	// Last updated by
 	LastUpdatedBy *string `pulumi:"lastUpdatedBy"`
-	// Policy device assurance name
+	// Name of the device assurance policy.
 	Name *string `pulumi:"name"`
 	// Policy device assurance platform
 	Platform *string `pulumi:"platform"`
@@ -137,7 +137,7 @@ type DeviceAssuranceChromeosState struct {
 	LastUpdate pulumi.StringPtrInput
 	// Last updated by
 	LastUpdatedBy pulumi.StringPtrInput
-	// Policy device assurance name
+	// Name of the device assurance policy.
 	Name pulumi.StringPtrInput
 	// Policy device assurance platform
 	Platform pulumi.StringPtrInput
@@ -176,7 +176,7 @@ func (DeviceAssuranceChromeosState) ElementType() reflect.Type {
 }
 
 type deviceAssuranceChromeosArgs struct {
-	// Policy device assurance name
+	// Name of the device assurance policy.
 	Name *string `pulumi:"name"`
 	// Third party signal provider allow screen lock
 	TpspAllowScreenLock *bool `pulumi:"tpspAllowScreenLock"`
@@ -210,7 +210,7 @@ type deviceAssuranceChromeosArgs struct {
 
 // The set of arguments for constructing a DeviceAssuranceChromeos resource.
 type DeviceAssuranceChromeosArgs struct {
-	// Policy device assurance name
+	// Name of the device assurance policy.
 	Name pulumi.StringPtrInput
 	// Third party signal provider allow screen lock
 	TpspAllowScreenLock pulumi.BoolPtrInput
@@ -349,7 +349,7 @@ func (o DeviceAssuranceChromeosOutput) LastUpdatedBy() pulumi.StringOutput {
 	return o.ApplyT(func(v *DeviceAssuranceChromeos) pulumi.StringOutput { return v.LastUpdatedBy }).(pulumi.StringOutput)
 }
 
-// Policy device assurance name
+// Name of the device assurance policy.
 func (o DeviceAssuranceChromeosOutput) Name() pulumi.StringOutput {
 	return o.ApplyT(func(v *DeviceAssuranceChromeos) pulumi.StringOutput { return v.Name }).(pulumi.StringOutput)
 }
diff --git a/sdk/go/okta/policy/deviceAssuranceIos.go b/sdk/go/okta/policy/deviceAssuranceIos.go
index af8f3e89..faa94ce5 100644
--- a/sdk/go/okta/policy/deviceAssuranceIos.go
+++ b/sdk/go/okta/policy/deviceAssuranceIos.go
@@ -14,23 +14,23 @@ import (
 type DeviceAssuranceIos struct {
 	pulumi.CustomResourceState
 
-	// Created by
+	// Created by of the device assurance polic
 	CreatedBy pulumi.StringOutput `pulumi:"createdBy"`
-	// Created date
+	// Created date of the device assurance polic
 	CreatedDate pulumi.StringOutput `pulumi:"createdDate"`
-	// The device jailbreak. Only for android and iOS platform
+	// Is the device jailbroken in the device assurance policy.
 	Jailbreak pulumi.BoolPtrOutput `pulumi:"jailbreak"`
-	// Last update
+	// Last update of the device assurance polic
 	LastUpdate pulumi.StringOutput `pulumi:"lastUpdate"`
-	// Last updated by
+	// Last updated by of the device assurance polic
 	LastUpdatedBy pulumi.StringOutput `pulumi:"lastUpdatedBy"`
-	// Policy device assurance name
+	// Name of the device assurance policy.
 	Name pulumi.StringOutput `pulumi:"name"`
-	// The device os minimum version
+	// Minimum os version of the device in the device assurance policy.
 	OsVersion pulumi.StringPtrOutput `pulumi:"osVersion"`
 	// Policy device assurance platform
 	Platform pulumi.StringOutput `pulumi:"platform"`
-	// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+	// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
 	ScreenlockTypes pulumi.StringArrayOutput `pulumi:"screenlockTypes"`
 }
 
@@ -64,44 +64,44 @@ func GetDeviceAssuranceIos(ctx *pulumi.Context,
 
 // Input properties used for looking up and filtering DeviceAssuranceIos resources.
 type deviceAssuranceIosState struct {
-	// Created by
+	// Created by of the device assurance polic
 	CreatedBy *string `pulumi:"createdBy"`
-	// Created date
+	// Created date of the device assurance polic
 	CreatedDate *string `pulumi:"createdDate"`
-	// The device jailbreak. Only for android and iOS platform
+	// Is the device jailbroken in the device assurance policy.
 	Jailbreak *bool `pulumi:"jailbreak"`
-	// Last update
+	// Last update of the device assurance polic
 	LastUpdate *string `pulumi:"lastUpdate"`
-	// Last updated by
+	// Last updated by of the device assurance polic
 	LastUpdatedBy *string `pulumi:"lastUpdatedBy"`
-	// Policy device assurance name
+	// Name of the device assurance policy.
 	Name *string `pulumi:"name"`
-	// The device os minimum version
+	// Minimum os version of the device in the device assurance policy.
 	OsVersion *string `pulumi:"osVersion"`
 	// Policy device assurance platform
 	Platform *string `pulumi:"platform"`
-	// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+	// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
 	ScreenlockTypes []string `pulumi:"screenlockTypes"`
 }
 
 type DeviceAssuranceIosState struct {
-	// Created by
+	// Created by of the device assurance polic
 	CreatedBy pulumi.StringPtrInput
-	// Created date
+	// Created date of the device assurance polic
 	CreatedDate pulumi.StringPtrInput
-	// The device jailbreak. Only for android and iOS platform
+	// Is the device jailbroken in the device assurance policy.
 	Jailbreak pulumi.BoolPtrInput
-	// Last update
+	// Last update of the device assurance polic
 	LastUpdate pulumi.StringPtrInput
-	// Last updated by
+	// Last updated by of the device assurance polic
 	LastUpdatedBy pulumi.StringPtrInput
-	// Policy device assurance name
+	// Name of the device assurance policy.
 	Name pulumi.StringPtrInput
-	// The device os minimum version
+	// Minimum os version of the device in the device assurance policy.
 	OsVersion pulumi.StringPtrInput
 	// Policy device assurance platform
 	Platform pulumi.StringPtrInput
-	// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+	// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
 	ScreenlockTypes pulumi.StringArrayInput
 }
 
@@ -110,25 +110,25 @@ func (DeviceAssuranceIosState) ElementType() reflect.Type {
 }
 
 type deviceAssuranceIosArgs struct {
-	// The device jailbreak. Only for android and iOS platform
+	// Is the device jailbroken in the device assurance policy.
 	Jailbreak *bool `pulumi:"jailbreak"`
-	// Policy device assurance name
+	// Name of the device assurance policy.
 	Name *string `pulumi:"name"`
-	// The device os minimum version
+	// Minimum os version of the device in the device assurance policy.
 	OsVersion *string `pulumi:"osVersion"`
-	// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+	// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
 	ScreenlockTypes []string `pulumi:"screenlockTypes"`
 }
 
 // The set of arguments for constructing a DeviceAssuranceIos resource.
 type DeviceAssuranceIosArgs struct {
-	// The device jailbreak. Only for android and iOS platform
+	// Is the device jailbroken in the device assurance policy.
 	Jailbreak pulumi.BoolPtrInput
-	// Policy device assurance name
+	// Name of the device assurance policy.
 	Name pulumi.StringPtrInput
-	// The device os minimum version
+	// Minimum os version of the device in the device assurance policy.
 	OsVersion pulumi.StringPtrInput
-	// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+	// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
 	ScreenlockTypes pulumi.StringArrayInput
 }
 
@@ -219,37 +219,37 @@ func (o DeviceAssuranceIosOutput) ToDeviceAssuranceIosOutputWithContext(ctx cont
 	return o
 }
 
-// Created by
+// Created by of the device assurance polic
 func (o DeviceAssuranceIosOutput) CreatedBy() pulumi.StringOutput {
 	return o.ApplyT(func(v *DeviceAssuranceIos) pulumi.StringOutput { return v.CreatedBy }).(pulumi.StringOutput)
 }
 
-// Created date
+// Created date of the device assurance polic
 func (o DeviceAssuranceIosOutput) CreatedDate() pulumi.StringOutput {
 	return o.ApplyT(func(v *DeviceAssuranceIos) pulumi.StringOutput { return v.CreatedDate }).(pulumi.StringOutput)
 }
 
-// The device jailbreak. Only for android and iOS platform
+// Is the device jailbroken in the device assurance policy.
 func (o DeviceAssuranceIosOutput) Jailbreak() pulumi.BoolPtrOutput {
 	return o.ApplyT(func(v *DeviceAssuranceIos) pulumi.BoolPtrOutput { return v.Jailbreak }).(pulumi.BoolPtrOutput)
 }
 
-// Last update
+// Last update of the device assurance polic
 func (o DeviceAssuranceIosOutput) LastUpdate() pulumi.StringOutput {
 	return o.ApplyT(func(v *DeviceAssuranceIos) pulumi.StringOutput { return v.LastUpdate }).(pulumi.StringOutput)
 }
 
-// Last updated by
+// Last updated by of the device assurance polic
 func (o DeviceAssuranceIosOutput) LastUpdatedBy() pulumi.StringOutput {
 	return o.ApplyT(func(v *DeviceAssuranceIos) pulumi.StringOutput { return v.LastUpdatedBy }).(pulumi.StringOutput)
 }
 
-// Policy device assurance name
+// Name of the device assurance policy.
 func (o DeviceAssuranceIosOutput) Name() pulumi.StringOutput {
 	return o.ApplyT(func(v *DeviceAssuranceIos) pulumi.StringOutput { return v.Name }).(pulumi.StringOutput)
 }
 
-// The device os minimum version
+// Minimum os version of the device in the device assurance policy.
 func (o DeviceAssuranceIosOutput) OsVersion() pulumi.StringPtrOutput {
 	return o.ApplyT(func(v *DeviceAssuranceIos) pulumi.StringPtrOutput { return v.OsVersion }).(pulumi.StringPtrOutput)
 }
@@ -259,7 +259,7 @@ func (o DeviceAssuranceIosOutput) Platform() pulumi.StringOutput {
 	return o.ApplyT(func(v *DeviceAssuranceIos) pulumi.StringOutput { return v.Platform }).(pulumi.StringOutput)
 }
 
-// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
 func (o DeviceAssuranceIosOutput) ScreenlockTypes() pulumi.StringArrayOutput {
 	return o.ApplyT(func(v *DeviceAssuranceIos) pulumi.StringArrayOutput { return v.ScreenlockTypes }).(pulumi.StringArrayOutput)
 }
diff --git a/sdk/go/okta/policy/deviceAssuranceMacos.go b/sdk/go/okta/policy/deviceAssuranceMacos.go
index 631951e3..8d688de5 100644
--- a/sdk/go/okta/policy/deviceAssuranceMacos.go
+++ b/sdk/go/okta/policy/deviceAssuranceMacos.go
@@ -18,21 +18,21 @@ type DeviceAssuranceMacos struct {
 	CreatedBy pulumi.StringOutput `pulumi:"createdBy"`
 	// Created date
 	CreatedDate pulumi.StringOutput `pulumi:"createdDate"`
-	// List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+	// List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
 	DiskEncryptionTypes pulumi.StringArrayOutput `pulumi:"diskEncryptionTypes"`
 	// Last update
 	LastUpdate pulumi.StringOutput `pulumi:"lastUpdate"`
 	// Last updated by
 	LastUpdatedBy pulumi.StringOutput `pulumi:"lastUpdatedBy"`
-	// Policy device assurance name
+	// Name of the device assurance policy.
 	Name pulumi.StringOutput `pulumi:"name"`
-	// The device os minimum version
+	// Minimum os version of the device in the device assurance policy.
 	OsVersion pulumi.StringPtrOutput `pulumi:"osVersion"`
 	// Policy device assurance platform
 	Platform pulumi.StringOutput `pulumi:"platform"`
-	// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+	// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
 	ScreenlockTypes pulumi.StringArrayOutput `pulumi:"screenlockTypes"`
-	// Indicates if the device constains a secure hardware functionality
+	// Is the device secure with hardware in the device assurance policy.
 	SecureHardwarePresent pulumi.BoolPtrOutput `pulumi:"secureHardwarePresent"`
 	// Check to include third party signal provider
 	ThirdPartySignalProviders pulumi.BoolPtrOutput `pulumi:"thirdPartySignalProviders"`
@@ -98,21 +98,21 @@ type deviceAssuranceMacosState struct {
 	CreatedBy *string `pulumi:"createdBy"`
 	// Created date
 	CreatedDate *string `pulumi:"createdDate"`
-	// List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+	// List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
 	DiskEncryptionTypes []string `pulumi:"diskEncryptionTypes"`
 	// Last update
 	LastUpdate *string `pulumi:"lastUpdate"`
 	// Last updated by
 	LastUpdatedBy *string `pulumi:"lastUpdatedBy"`
-	// Policy device assurance name
+	// Name of the device assurance policy.
 	Name *string `pulumi:"name"`
-	// The device os minimum version
+	// Minimum os version of the device in the device assurance policy.
 	OsVersion *string `pulumi:"osVersion"`
 	// Policy device assurance platform
 	Platform *string `pulumi:"platform"`
-	// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+	// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
 	ScreenlockTypes []string `pulumi:"screenlockTypes"`
-	// Indicates if the device constains a secure hardware functionality
+	// Is the device secure with hardware in the device assurance policy.
 	SecureHardwarePresent *bool `pulumi:"secureHardwarePresent"`
 	// Check to include third party signal provider
 	ThirdPartySignalProviders *bool `pulumi:"thirdPartySignalProviders"`
@@ -149,21 +149,21 @@ type DeviceAssuranceMacosState struct {
 	CreatedBy pulumi.StringPtrInput
 	// Created date
 	CreatedDate pulumi.StringPtrInput
-	// List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+	// List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
 	DiskEncryptionTypes pulumi.StringArrayInput
 	// Last update
 	LastUpdate pulumi.StringPtrInput
 	// Last updated by
 	LastUpdatedBy pulumi.StringPtrInput
-	// Policy device assurance name
+	// Name of the device assurance policy.
 	Name pulumi.StringPtrInput
-	// The device os minimum version
+	// Minimum os version of the device in the device assurance policy.
 	OsVersion pulumi.StringPtrInput
 	// Policy device assurance platform
 	Platform pulumi.StringPtrInput
-	// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+	// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
 	ScreenlockTypes pulumi.StringArrayInput
-	// Indicates if the device constains a secure hardware functionality
+	// Is the device secure with hardware in the device assurance policy.
 	SecureHardwarePresent pulumi.BoolPtrInput
 	// Check to include third party signal provider
 	ThirdPartySignalProviders pulumi.BoolPtrInput
@@ -200,15 +200,15 @@ func (DeviceAssuranceMacosState) ElementType() reflect.Type {
 }
 
 type deviceAssuranceMacosArgs struct {
-	// List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+	// List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
 	DiskEncryptionTypes []string `pulumi:"diskEncryptionTypes"`
-	// Policy device assurance name
+	// Name of the device assurance policy.
 	Name *string `pulumi:"name"`
-	// The device os minimum version
+	// Minimum os version of the device in the device assurance policy.
 	OsVersion *string `pulumi:"osVersion"`
-	// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+	// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
 	ScreenlockTypes []string `pulumi:"screenlockTypes"`
-	// Indicates if the device constains a secure hardware functionality
+	// Is the device secure with hardware in the device assurance policy.
 	SecureHardwarePresent *bool `pulumi:"secureHardwarePresent"`
 	// Check to include third party signal provider
 	ThirdPartySignalProviders *bool `pulumi:"thirdPartySignalProviders"`
@@ -242,15 +242,15 @@ type deviceAssuranceMacosArgs struct {
 
 // The set of arguments for constructing a DeviceAssuranceMacos resource.
 type DeviceAssuranceMacosArgs struct {
-	// List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+	// List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
 	DiskEncryptionTypes pulumi.StringArrayInput
-	// Policy device assurance name
+	// Name of the device assurance policy.
 	Name pulumi.StringPtrInput
-	// The device os minimum version
+	// Minimum os version of the device in the device assurance policy.
 	OsVersion pulumi.StringPtrInput
-	// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+	// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
 	ScreenlockTypes pulumi.StringArrayInput
-	// Indicates if the device constains a secure hardware functionality
+	// Is the device secure with hardware in the device assurance policy.
 	SecureHardwarePresent pulumi.BoolPtrInput
 	// Check to include third party signal provider
 	ThirdPartySignalProviders pulumi.BoolPtrInput
@@ -379,7 +379,7 @@ func (o DeviceAssuranceMacosOutput) CreatedDate() pulumi.StringOutput {
 	return o.ApplyT(func(v *DeviceAssuranceMacos) pulumi.StringOutput { return v.CreatedDate }).(pulumi.StringOutput)
 }
 
-// List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+// List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
 func (o DeviceAssuranceMacosOutput) DiskEncryptionTypes() pulumi.StringArrayOutput {
 	return o.ApplyT(func(v *DeviceAssuranceMacos) pulumi.StringArrayOutput { return v.DiskEncryptionTypes }).(pulumi.StringArrayOutput)
 }
@@ -394,12 +394,12 @@ func (o DeviceAssuranceMacosOutput) LastUpdatedBy() pulumi.StringOutput {
 	return o.ApplyT(func(v *DeviceAssuranceMacos) pulumi.StringOutput { return v.LastUpdatedBy }).(pulumi.StringOutput)
 }
 
-// Policy device assurance name
+// Name of the device assurance policy.
 func (o DeviceAssuranceMacosOutput) Name() pulumi.StringOutput {
 	return o.ApplyT(func(v *DeviceAssuranceMacos) pulumi.StringOutput { return v.Name }).(pulumi.StringOutput)
 }
 
-// The device os minimum version
+// Minimum os version of the device in the device assurance policy.
 func (o DeviceAssuranceMacosOutput) OsVersion() pulumi.StringPtrOutput {
 	return o.ApplyT(func(v *DeviceAssuranceMacos) pulumi.StringPtrOutput { return v.OsVersion }).(pulumi.StringPtrOutput)
 }
@@ -409,12 +409,12 @@ func (o DeviceAssuranceMacosOutput) Platform() pulumi.StringOutput {
 	return o.ApplyT(func(v *DeviceAssuranceMacos) pulumi.StringOutput { return v.Platform }).(pulumi.StringOutput)
 }
 
-// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
 func (o DeviceAssuranceMacosOutput) ScreenlockTypes() pulumi.StringArrayOutput {
 	return o.ApplyT(func(v *DeviceAssuranceMacos) pulumi.StringArrayOutput { return v.ScreenlockTypes }).(pulumi.StringArrayOutput)
 }
 
-// Indicates if the device constains a secure hardware functionality
+// Is the device secure with hardware in the device assurance policy.
 func (o DeviceAssuranceMacosOutput) SecureHardwarePresent() pulumi.BoolPtrOutput {
 	return o.ApplyT(func(v *DeviceAssuranceMacos) pulumi.BoolPtrOutput { return v.SecureHardwarePresent }).(pulumi.BoolPtrOutput)
 }
diff --git a/sdk/go/okta/policy/deviceAssuranceWindows.go b/sdk/go/okta/policy/deviceAssuranceWindows.go
index 9dc7b1dc..928f95a0 100644
--- a/sdk/go/okta/policy/deviceAssuranceWindows.go
+++ b/sdk/go/okta/policy/deviceAssuranceWindows.go
@@ -18,21 +18,21 @@ type DeviceAssuranceWindows struct {
 	CreatedBy pulumi.StringOutput `pulumi:"createdBy"`
 	// Created date
 	CreatedDate pulumi.StringOutput `pulumi:"createdDate"`
-	// List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+	// List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
 	DiskEncryptionTypes pulumi.StringArrayOutput `pulumi:"diskEncryptionTypes"`
 	// Last update
 	LastUpdate pulumi.StringOutput `pulumi:"lastUpdate"`
 	// Last updated by
 	LastUpdatedBy pulumi.StringOutput `pulumi:"lastUpdatedBy"`
-	// Policy device assurance name
+	// Name of the device assurance policy.
 	Name pulumi.StringOutput `pulumi:"name"`
-	// The device os minimum version
+	// Minimum os version of the device in the device assurance policy.
 	OsVersion pulumi.StringPtrOutput `pulumi:"osVersion"`
 	// Policy device assurance platform
 	Platform pulumi.StringOutput `pulumi:"platform"`
-	// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+	// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
 	ScreenlockTypes pulumi.StringArrayOutput `pulumi:"screenlockTypes"`
-	// Indicates if the device constains a secure hardware functionality
+	// Is the device secure with hardware in the device assurance policy.
 	SecureHardwarePresent pulumi.BoolPtrOutput `pulumi:"secureHardwarePresent"`
 	// Check to include third party signal provider
 	ThirdPartySignalProviders pulumi.BoolPtrOutput `pulumi:"thirdPartySignalProviders"`
@@ -110,21 +110,21 @@ type deviceAssuranceWindowsState struct {
 	CreatedBy *string `pulumi:"createdBy"`
 	// Created date
 	CreatedDate *string `pulumi:"createdDate"`
-	// List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+	// List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
 	DiskEncryptionTypes []string `pulumi:"diskEncryptionTypes"`
 	// Last update
 	LastUpdate *string `pulumi:"lastUpdate"`
 	// Last updated by
 	LastUpdatedBy *string `pulumi:"lastUpdatedBy"`
-	// Policy device assurance name
+	// Name of the device assurance policy.
 	Name *string `pulumi:"name"`
-	// The device os minimum version
+	// Minimum os version of the device in the device assurance policy.
 	OsVersion *string `pulumi:"osVersion"`
 	// Policy device assurance platform
 	Platform *string `pulumi:"platform"`
-	// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+	// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
 	ScreenlockTypes []string `pulumi:"screenlockTypes"`
-	// Indicates if the device constains a secure hardware functionality
+	// Is the device secure with hardware in the device assurance policy.
 	SecureHardwarePresent *bool `pulumi:"secureHardwarePresent"`
 	// Check to include third party signal provider
 	ThirdPartySignalProviders *bool `pulumi:"thirdPartySignalProviders"`
@@ -173,21 +173,21 @@ type DeviceAssuranceWindowsState struct {
 	CreatedBy pulumi.StringPtrInput
 	// Created date
 	CreatedDate pulumi.StringPtrInput
-	// List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+	// List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
 	DiskEncryptionTypes pulumi.StringArrayInput
 	// Last update
 	LastUpdate pulumi.StringPtrInput
 	// Last updated by
 	LastUpdatedBy pulumi.StringPtrInput
-	// Policy device assurance name
+	// Name of the device assurance policy.
 	Name pulumi.StringPtrInput
-	// The device os minimum version
+	// Minimum os version of the device in the device assurance policy.
 	OsVersion pulumi.StringPtrInput
 	// Policy device assurance platform
 	Platform pulumi.StringPtrInput
-	// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+	// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
 	ScreenlockTypes pulumi.StringArrayInput
-	// Indicates if the device constains a secure hardware functionality
+	// Is the device secure with hardware in the device assurance policy.
 	SecureHardwarePresent pulumi.BoolPtrInput
 	// Check to include third party signal provider
 	ThirdPartySignalProviders pulumi.BoolPtrInput
@@ -236,15 +236,15 @@ func (DeviceAssuranceWindowsState) ElementType() reflect.Type {
 }
 
 type deviceAssuranceWindowsArgs struct {
-	// List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+	// List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
 	DiskEncryptionTypes []string `pulumi:"diskEncryptionTypes"`
-	// Policy device assurance name
+	// Name of the device assurance policy.
 	Name *string `pulumi:"name"`
-	// The device os minimum version
+	// Minimum os version of the device in the device assurance policy.
 	OsVersion *string `pulumi:"osVersion"`
-	// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+	// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
 	ScreenlockTypes []string `pulumi:"screenlockTypes"`
-	// Indicates if the device constains a secure hardware functionality
+	// Is the device secure with hardware in the device assurance policy.
 	SecureHardwarePresent *bool `pulumi:"secureHardwarePresent"`
 	// Check to include third party signal provider
 	ThirdPartySignalProviders *bool `pulumi:"thirdPartySignalProviders"`
@@ -290,15 +290,15 @@ type deviceAssuranceWindowsArgs struct {
 
 // The set of arguments for constructing a DeviceAssuranceWindows resource.
 type DeviceAssuranceWindowsArgs struct {
-	// List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+	// List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
 	DiskEncryptionTypes pulumi.StringArrayInput
-	// Policy device assurance name
+	// Name of the device assurance policy.
 	Name pulumi.StringPtrInput
-	// The device os minimum version
+	// Minimum os version of the device in the device assurance policy.
 	OsVersion pulumi.StringPtrInput
-	// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+	// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
 	ScreenlockTypes pulumi.StringArrayInput
-	// Indicates if the device constains a secure hardware functionality
+	// Is the device secure with hardware in the device assurance policy.
 	SecureHardwarePresent pulumi.BoolPtrInput
 	// Check to include third party signal provider
 	ThirdPartySignalProviders pulumi.BoolPtrInput
@@ -439,7 +439,7 @@ func (o DeviceAssuranceWindowsOutput) CreatedDate() pulumi.StringOutput {
 	return o.ApplyT(func(v *DeviceAssuranceWindows) pulumi.StringOutput { return v.CreatedDate }).(pulumi.StringOutput)
 }
 
-// List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+// List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
 func (o DeviceAssuranceWindowsOutput) DiskEncryptionTypes() pulumi.StringArrayOutput {
 	return o.ApplyT(func(v *DeviceAssuranceWindows) pulumi.StringArrayOutput { return v.DiskEncryptionTypes }).(pulumi.StringArrayOutput)
 }
@@ -454,12 +454,12 @@ func (o DeviceAssuranceWindowsOutput) LastUpdatedBy() pulumi.StringOutput {
 	return o.ApplyT(func(v *DeviceAssuranceWindows) pulumi.StringOutput { return v.LastUpdatedBy }).(pulumi.StringOutput)
 }
 
-// Policy device assurance name
+// Name of the device assurance policy.
 func (o DeviceAssuranceWindowsOutput) Name() pulumi.StringOutput {
 	return o.ApplyT(func(v *DeviceAssuranceWindows) pulumi.StringOutput { return v.Name }).(pulumi.StringOutput)
 }
 
-// The device os minimum version
+// Minimum os version of the device in the device assurance policy.
 func (o DeviceAssuranceWindowsOutput) OsVersion() pulumi.StringPtrOutput {
 	return o.ApplyT(func(v *DeviceAssuranceWindows) pulumi.StringPtrOutput { return v.OsVersion }).(pulumi.StringPtrOutput)
 }
@@ -469,12 +469,12 @@ func (o DeviceAssuranceWindowsOutput) Platform() pulumi.StringOutput {
 	return o.ApplyT(func(v *DeviceAssuranceWindows) pulumi.StringOutput { return v.Platform }).(pulumi.StringOutput)
 }
 
-// List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+// List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
 func (o DeviceAssuranceWindowsOutput) ScreenlockTypes() pulumi.StringArrayOutput {
 	return o.ApplyT(func(v *DeviceAssuranceWindows) pulumi.StringArrayOutput { return v.ScreenlockTypes }).(pulumi.StringArrayOutput)
 }
 
-// Indicates if the device constains a secure hardware functionality
+// Is the device secure with hardware in the device assurance policy.
 func (o DeviceAssuranceWindowsOutput) SecureHardwarePresent() pulumi.BoolPtrOutput {
 	return o.ApplyT(func(v *DeviceAssuranceWindows) pulumi.BoolPtrOutput { return v.SecureHardwarePresent }).(pulumi.BoolPtrOutput)
 }
diff --git a/sdk/go/okta/policy/ruleIdpDiscovery.go b/sdk/go/okta/policy/ruleIdpDiscovery.go
index ecf16a38..04f98563 100644
--- a/sdk/go/okta/policy/ruleIdpDiscovery.go
+++ b/sdk/go/okta/policy/ruleIdpDiscovery.go
@@ -132,7 +132,10 @@ type RuleIdpDiscovery struct {
 	// Required if `networkConnection` = `"ZONE"`. Indicates the network zones to exclude.
 	NetworkExcludes pulumi.StringArrayOutput `pulumi:"networkExcludes"`
 	// Required if `networkConnection` = `"ZONE"`. Indicates the network zones to include.
-	NetworkIncludes  pulumi.StringArrayOutput                   `pulumi:"networkIncludes"`
+	NetworkIncludes pulumi.StringArrayOutput `pulumi:"networkIncludes"`
+	// Platform to include in discovery rule. - 'type' - (Optional) One of: 'ANY', 'MOBILE', 'DESKTOP' - 'os_expression -
+	// (Optional) Only available when using os_type = 'OTHER' - 'os_type' - (Optional) One of: 'ANY', 'IOS', 'WINDOWS',
+	// 'ANDROID', 'OTHER', 'OSX'
 	PlatformIncludes RuleIdpDiscoveryPlatformIncludeArrayOutput `pulumi:"platformIncludes"`
 	// Policy ID.
 	PolicyId pulumi.StringPtrOutput `pulumi:"policyId"`
@@ -209,7 +212,10 @@ type ruleIdpDiscoveryState struct {
 	// Required if `networkConnection` = `"ZONE"`. Indicates the network zones to exclude.
 	NetworkExcludes []string `pulumi:"networkExcludes"`
 	// Required if `networkConnection` = `"ZONE"`. Indicates the network zones to include.
-	NetworkIncludes  []string                          `pulumi:"networkIncludes"`
+	NetworkIncludes []string `pulumi:"networkIncludes"`
+	// Platform to include in discovery rule. - 'type' - (Optional) One of: 'ANY', 'MOBILE', 'DESKTOP' - 'os_expression -
+	// (Optional) Only available when using os_type = 'OTHER' - 'os_type' - (Optional) One of: 'ANY', 'IOS', 'WINDOWS',
+	// 'ANDROID', 'OTHER', 'OSX'
 	PlatformIncludes []RuleIdpDiscoveryPlatformInclude `pulumi:"platformIncludes"`
 	// Policy ID.
 	PolicyId *string `pulumi:"policyId"`
@@ -257,7 +263,10 @@ type RuleIdpDiscoveryState struct {
 	// Required if `networkConnection` = `"ZONE"`. Indicates the network zones to exclude.
 	NetworkExcludes pulumi.StringArrayInput
 	// Required if `networkConnection` = `"ZONE"`. Indicates the network zones to include.
-	NetworkIncludes  pulumi.StringArrayInput
+	NetworkIncludes pulumi.StringArrayInput
+	// Platform to include in discovery rule. - 'type' - (Optional) One of: 'ANY', 'MOBILE', 'DESKTOP' - 'os_expression -
+	// (Optional) Only available when using os_type = 'OTHER' - 'os_type' - (Optional) One of: 'ANY', 'IOS', 'WINDOWS',
+	// 'ANDROID', 'OTHER', 'OSX'
 	PlatformIncludes RuleIdpDiscoveryPlatformIncludeArrayInput
 	// Policy ID.
 	PolicyId pulumi.StringPtrInput
@@ -309,7 +318,10 @@ type ruleIdpDiscoveryArgs struct {
 	// Required if `networkConnection` = `"ZONE"`. Indicates the network zones to exclude.
 	NetworkExcludes []string `pulumi:"networkExcludes"`
 	// Required if `networkConnection` = `"ZONE"`. Indicates the network zones to include.
-	NetworkIncludes  []string                          `pulumi:"networkIncludes"`
+	NetworkIncludes []string `pulumi:"networkIncludes"`
+	// Platform to include in discovery rule. - 'type' - (Optional) One of: 'ANY', 'MOBILE', 'DESKTOP' - 'os_expression -
+	// (Optional) Only available when using os_type = 'OTHER' - 'os_type' - (Optional) One of: 'ANY', 'IOS', 'WINDOWS',
+	// 'ANDROID', 'OTHER', 'OSX'
 	PlatformIncludes []RuleIdpDiscoveryPlatformInclude `pulumi:"platformIncludes"`
 	// Policy ID.
 	PolicyId *string `pulumi:"policyId"`
@@ -358,7 +370,10 @@ type RuleIdpDiscoveryArgs struct {
 	// Required if `networkConnection` = `"ZONE"`. Indicates the network zones to exclude.
 	NetworkExcludes pulumi.StringArrayInput
 	// Required if `networkConnection` = `"ZONE"`. Indicates the network zones to include.
-	NetworkIncludes  pulumi.StringArrayInput
+	NetworkIncludes pulumi.StringArrayInput
+	// Platform to include in discovery rule. - 'type' - (Optional) One of: 'ANY', 'MOBILE', 'DESKTOP' - 'os_expression -
+	// (Optional) Only available when using os_type = 'OTHER' - 'os_type' - (Optional) One of: 'ANY', 'IOS', 'WINDOWS',
+	// 'ANDROID', 'OTHER', 'OSX'
 	PlatformIncludes RuleIdpDiscoveryPlatformIncludeArrayInput
 	// Policy ID.
 	PolicyId pulumi.StringPtrInput
@@ -520,6 +535,9 @@ func (o RuleIdpDiscoveryOutput) NetworkIncludes() pulumi.StringArrayOutput {
 	return o.ApplyT(func(v *RuleIdpDiscovery) pulumi.StringArrayOutput { return v.NetworkIncludes }).(pulumi.StringArrayOutput)
 }
 
+// Platform to include in discovery rule. - 'type' - (Optional) One of: 'ANY', 'MOBILE', 'DESKTOP' - 'os_expression -
+// (Optional) Only available when using os_type = 'OTHER' - 'os_type' - (Optional) One of: 'ANY', 'IOS', 'WINDOWS',
+// 'ANDROID', 'OTHER', 'OSX'
 func (o RuleIdpDiscoveryOutput) PlatformIncludes() RuleIdpDiscoveryPlatformIncludeArrayOutput {
 	return o.ApplyT(func(v *RuleIdpDiscovery) RuleIdpDiscoveryPlatformIncludeArrayOutput { return v.PlatformIncludes }).(RuleIdpDiscoveryPlatformIncludeArrayOutput)
 }
diff --git a/sdk/go/okta/policy/ruleMfa.go b/sdk/go/okta/policy/ruleMfa.go
index fd931d1e..354457b2 100644
--- a/sdk/go/okta/policy/ruleMfa.go
+++ b/sdk/go/okta/policy/ruleMfa.go
@@ -23,7 +23,10 @@ import (
 type RuleMfa struct {
 	pulumi.CustomResourceState
 
-	// Applications to exclude
+	// Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations. - 'id'
+	// - (Optional) Use if 'type' is 'APP' to indicate the application id to include. - 'name' - (Optional) Use if the 'type'
+	//   is 'APP_TYPE' to indicate the type of application(s) to include in instances where an entire group (i.e. 'yahoo_mail')
+	//   of applications should be included. - 'type' - (Required) One of: 'APP', 'APP_TYPE'
 	AppExcludes RuleMfaAppExcludeArrayOutput `pulumi:"appExcludes"`
 	// Applications to include in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations.
 	AppIncludes RuleMfaAppIncludeArrayOutput `pulumi:"appIncludes"`
@@ -77,7 +80,10 @@ func GetRuleMfa(ctx *pulumi.Context,
 
 // Input properties used for looking up and filtering RuleMfa resources.
 type ruleMfaState struct {
-	// Applications to exclude
+	// Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations. - 'id'
+	// - (Optional) Use if 'type' is 'APP' to indicate the application id to include. - 'name' - (Optional) Use if the 'type'
+	//   is 'APP_TYPE' to indicate the type of application(s) to include in instances where an entire group (i.e. 'yahoo_mail')
+	//   of applications should be included. - 'type' - (Required) One of: 'APP', 'APP_TYPE'
 	AppExcludes []RuleMfaAppExclude `pulumi:"appExcludes"`
 	// Applications to include in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations.
 	AppIncludes []RuleMfaAppInclude `pulumi:"appIncludes"`
@@ -102,7 +108,10 @@ type ruleMfaState struct {
 }
 
 type RuleMfaState struct {
-	// Applications to exclude
+	// Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations. - 'id'
+	// - (Optional) Use if 'type' is 'APP' to indicate the application id to include. - 'name' - (Optional) Use if the 'type'
+	//   is 'APP_TYPE' to indicate the type of application(s) to include in instances where an entire group (i.e. 'yahoo_mail')
+	//   of applications should be included. - 'type' - (Required) One of: 'APP', 'APP_TYPE'
 	AppExcludes RuleMfaAppExcludeArrayInput
 	// Applications to include in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations.
 	AppIncludes RuleMfaAppIncludeArrayInput
@@ -131,7 +140,10 @@ func (RuleMfaState) ElementType() reflect.Type {
 }
 
 type ruleMfaArgs struct {
-	// Applications to exclude
+	// Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations. - 'id'
+	// - (Optional) Use if 'type' is 'APP' to indicate the application id to include. - 'name' - (Optional) Use if the 'type'
+	//   is 'APP_TYPE' to indicate the type of application(s) to include in instances where an entire group (i.e. 'yahoo_mail')
+	//   of applications should be included. - 'type' - (Required) One of: 'APP', 'APP_TYPE'
 	AppExcludes []RuleMfaAppExclude `pulumi:"appExcludes"`
 	// Applications to include in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations.
 	AppIncludes []RuleMfaAppInclude `pulumi:"appIncludes"`
@@ -157,7 +169,10 @@ type ruleMfaArgs struct {
 
 // The set of arguments for constructing a RuleMfa resource.
 type RuleMfaArgs struct {
-	// Applications to exclude
+	// Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations. - 'id'
+	// - (Optional) Use if 'type' is 'APP' to indicate the application id to include. - 'name' - (Optional) Use if the 'type'
+	//   is 'APP_TYPE' to indicate the type of application(s) to include in instances where an entire group (i.e. 'yahoo_mail')
+	//   of applications should be included. - 'type' - (Required) One of: 'APP', 'APP_TYPE'
 	AppExcludes RuleMfaAppExcludeArrayInput
 	// Applications to include in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations.
 	AppIncludes RuleMfaAppIncludeArrayInput
@@ -268,7 +283,10 @@ func (o RuleMfaOutput) ToRuleMfaOutputWithContext(ctx context.Context) RuleMfaOu
 	return o
 }
 
-// Applications to exclude
+// Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations. - 'id'
+//   - (Optional) Use if 'type' is 'APP' to indicate the application id to include. - 'name' - (Optional) Use if the 'type'
+//     is 'APP_TYPE' to indicate the type of application(s) to include in instances where an entire group (i.e. 'yahoo_mail')
+//     of applications should be included. - 'type' - (Required) One of: 'APP', 'APP_TYPE'
 func (o RuleMfaOutput) AppExcludes() RuleMfaAppExcludeArrayOutput {
 	return o.ApplyT(func(v *RuleMfa) RuleMfaAppExcludeArrayOutput { return v.AppExcludes }).(RuleMfaAppExcludeArrayOutput)
 }
diff --git a/sdk/go/okta/policy/ruleSignon.go b/sdk/go/okta/policy/ruleSignon.go
index 0a03c2e8..d939d8f7 100644
--- a/sdk/go/okta/policy/ruleSignon.go
+++ b/sdk/go/okta/policy/ruleSignon.go
@@ -169,7 +169,11 @@ type RuleSignon struct {
 	Priority pulumi.IntPtrOutput `pulumi:"priority"`
 	// Risc level: `"ANY"`, `"LOW"`, `"MEDIUM"` or `"HIGH"`. Default is `"ANY"`. It can be also
 	// set to an empty string in case `RISC_SCORING` org feature flag is disabled.
+	//
+	// Deprecated: Attribute typo, switch to riskLevel instead. Default: `ANY`
 	RiscLevel pulumi.StringPtrOutput `pulumi:"riscLevel"`
+	// Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
+	RiskLevel pulumi.StringPtrOutput `pulumi:"riskLevel"`
 	// Max minutes a session can be idle.,
 	SessionIdle pulumi.IntPtrOutput `pulumi:"sessionIdle"`
 	// Max minutes a session is active: Disable = 0.
@@ -251,7 +255,11 @@ type ruleSignonState struct {
 	Priority *int `pulumi:"priority"`
 	// Risc level: `"ANY"`, `"LOW"`, `"MEDIUM"` or `"HIGH"`. Default is `"ANY"`. It can be also
 	// set to an empty string in case `RISC_SCORING` org feature flag is disabled.
+	//
+	// Deprecated: Attribute typo, switch to riskLevel instead. Default: `ANY`
 	RiscLevel *string `pulumi:"riscLevel"`
+	// Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
+	RiskLevel *string `pulumi:"riskLevel"`
 	// Max minutes a session can be idle.,
 	SessionIdle *int `pulumi:"sessionIdle"`
 	// Max minutes a session is active: Disable = 0.
@@ -304,7 +312,11 @@ type RuleSignonState struct {
 	Priority pulumi.IntPtrInput
 	// Risc level: `"ANY"`, `"LOW"`, `"MEDIUM"` or `"HIGH"`. Default is `"ANY"`. It can be also
 	// set to an empty string in case `RISC_SCORING` org feature flag is disabled.
+	//
+	// Deprecated: Attribute typo, switch to riskLevel instead. Default: `ANY`
 	RiscLevel pulumi.StringPtrInput
+	// Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
+	RiskLevel pulumi.StringPtrInput
 	// Max minutes a session can be idle.,
 	SessionIdle pulumi.IntPtrInput
 	// Max minutes a session is active: Disable = 0.
@@ -361,7 +373,11 @@ type ruleSignonArgs struct {
 	Priority *int `pulumi:"priority"`
 	// Risc level: `"ANY"`, `"LOW"`, `"MEDIUM"` or `"HIGH"`. Default is `"ANY"`. It can be also
 	// set to an empty string in case `RISC_SCORING` org feature flag is disabled.
+	//
+	// Deprecated: Attribute typo, switch to riskLevel instead. Default: `ANY`
 	RiscLevel *string `pulumi:"riscLevel"`
+	// Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
+	RiskLevel *string `pulumi:"riskLevel"`
 	// Max minutes a session can be idle.,
 	SessionIdle *int `pulumi:"sessionIdle"`
 	// Max minutes a session is active: Disable = 0.
@@ -415,7 +431,11 @@ type RuleSignonArgs struct {
 	Priority pulumi.IntPtrInput
 	// Risc level: `"ANY"`, `"LOW"`, `"MEDIUM"` or `"HIGH"`. Default is `"ANY"`. It can be also
 	// set to an empty string in case `RISC_SCORING` org feature flag is disabled.
+	//
+	// Deprecated: Attribute typo, switch to riskLevel instead. Default: `ANY`
 	RiscLevel pulumi.StringPtrInput
+	// Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
+	RiskLevel pulumi.StringPtrInput
 	// Max minutes a session can be idle.,
 	SessionIdle pulumi.IntPtrInput
 	// Max minutes a session is active: Disable = 0.
@@ -605,10 +625,17 @@ func (o RuleSignonOutput) Priority() pulumi.IntPtrOutput {
 
 // Risc level: `"ANY"`, `"LOW"`, `"MEDIUM"` or `"HIGH"`. Default is `"ANY"`. It can be also
 // set to an empty string in case `RISC_SCORING` org feature flag is disabled.
+//
+// Deprecated: Attribute typo, switch to riskLevel instead. Default: `ANY`
 func (o RuleSignonOutput) RiscLevel() pulumi.StringPtrOutput {
 	return o.ApplyT(func(v *RuleSignon) pulumi.StringPtrOutput { return v.RiscLevel }).(pulumi.StringPtrOutput)
 }
 
+// Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
+func (o RuleSignonOutput) RiskLevel() pulumi.StringPtrOutput {
+	return o.ApplyT(func(v *RuleSignon) pulumi.StringPtrOutput { return v.RiskLevel }).(pulumi.StringPtrOutput)
+}
+
 // Max minutes a session can be idle.,
 func (o RuleSignonOutput) SessionIdle() pulumi.IntPtrOutput {
 	return o.ApplyT(func(v *RuleSignon) pulumi.IntPtrOutput { return v.SessionIdle }).(pulumi.IntPtrOutput)
diff --git a/sdk/go/okta/roleSubscription.go b/sdk/go/okta/roleSubscription.go
index be46984a..b187e464 100644
--- a/sdk/go/okta/roleSubscription.go
+++ b/sdk/go/okta/roleSubscription.go
@@ -72,7 +72,7 @@ type RoleSubscription struct {
 	// - `"AGENT_AUTO_UPDATE_NOTIFICATION"` - Agent auto-update notifications: AD Agent.
 	NotificationType pulumi.StringOutput `pulumi:"notificationType"`
 	// Type of the role. Valid values:
-	// `"API_ADMIN"`,
+	// `"API_ACCESS_MANAGEMENT_ADMIN"`,
 	// `"APP_ADMIN"`,
 	// `"CUSTOM"`,
 	// `"GROUP_MEMBERSHIP_ADMIN"`,
@@ -141,7 +141,7 @@ type roleSubscriptionState struct {
 	// - `"AGENT_AUTO_UPDATE_NOTIFICATION"` - Agent auto-update notifications: AD Agent.
 	NotificationType *string `pulumi:"notificationType"`
 	// Type of the role. Valid values:
-	// `"API_ADMIN"`,
+	// `"API_ACCESS_MANAGEMENT_ADMIN"`,
 	// `"APP_ADMIN"`,
 	// `"CUSTOM"`,
 	// `"GROUP_MEMBERSHIP_ADMIN"`,
@@ -175,7 +175,7 @@ type RoleSubscriptionState struct {
 	// - `"AGENT_AUTO_UPDATE_NOTIFICATION"` - Agent auto-update notifications: AD Agent.
 	NotificationType pulumi.StringPtrInput
 	// Type of the role. Valid values:
-	// `"API_ADMIN"`,
+	// `"API_ACCESS_MANAGEMENT_ADMIN"`,
 	// `"APP_ADMIN"`,
 	// `"CUSTOM"`,
 	// `"GROUP_MEMBERSHIP_ADMIN"`,
@@ -213,7 +213,7 @@ type roleSubscriptionArgs struct {
 	// - `"AGENT_AUTO_UPDATE_NOTIFICATION"` - Agent auto-update notifications: AD Agent.
 	NotificationType string `pulumi:"notificationType"`
 	// Type of the role. Valid values:
-	// `"API_ADMIN"`,
+	// `"API_ACCESS_MANAGEMENT_ADMIN"`,
 	// `"APP_ADMIN"`,
 	// `"CUSTOM"`,
 	// `"GROUP_MEMBERSHIP_ADMIN"`,
@@ -248,7 +248,7 @@ type RoleSubscriptionArgs struct {
 	// - `"AGENT_AUTO_UPDATE_NOTIFICATION"` - Agent auto-update notifications: AD Agent.
 	NotificationType pulumi.StringInput
 	// Type of the role. Valid values:
-	// `"API_ADMIN"`,
+	// `"API_ACCESS_MANAGEMENT_ADMIN"`,
 	// `"APP_ADMIN"`,
 	// `"CUSTOM"`,
 	// `"GROUP_MEMBERSHIP_ADMIN"`,
@@ -371,7 +371,7 @@ func (o RoleSubscriptionOutput) NotificationType() pulumi.StringOutput {
 }
 
 // Type of the role. Valid values:
-// `"API_ADMIN"`,
+// `"API_ACCESS_MANAGEMENT_ADMIN"`,
 // `"APP_ADMIN"`,
 // `"CUSTOM"`,
 // `"GROUP_MEMBERSHIP_ADMIN"`,
diff --git a/sdk/go/okta/user/user.go b/sdk/go/okta/user/user.go
index f53ecdc2..2642b333 100644
--- a/sdk/go/okta/user/user.go
+++ b/sdk/go/okta/user/user.go
@@ -126,7 +126,8 @@ type User struct {
 	CountryCode pulumi.StringPtrOutput `pulumi:"countryCode"`
 	// raw JSON containing all custom profile attributes.
 	CustomProfileAttributes pulumi.StringOutput `pulumi:"customProfileAttributes"`
-	// List of custom_profile_attribute keys that should be excluded from being managed by Terraform.
+	// List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in
+	// situations where specific custom fields may contain sensitive information and should be managed outside of Terraform.
 	CustomProfileAttributesToIgnores pulumi.StringArrayOutput `pulumi:"customProfileAttributesToIgnores"`
 	// User profile property.
 	Department pulumi.StringPtrOutput `pulumi:"department"`
@@ -282,7 +283,8 @@ type userState struct {
 	CountryCode *string `pulumi:"countryCode"`
 	// raw JSON containing all custom profile attributes.
 	CustomProfileAttributes *string `pulumi:"customProfileAttributes"`
-	// List of custom_profile_attribute keys that should be excluded from being managed by Terraform.
+	// List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in
+	// situations where specific custom fields may contain sensitive information and should be managed outside of Terraform.
 	CustomProfileAttributesToIgnores []string `pulumi:"customProfileAttributesToIgnores"`
 	// User profile property.
 	Department *string `pulumi:"department"`
@@ -382,7 +384,8 @@ type UserState struct {
 	CountryCode pulumi.StringPtrInput
 	// raw JSON containing all custom profile attributes.
 	CustomProfileAttributes pulumi.StringPtrInput
-	// List of custom_profile_attribute keys that should be excluded from being managed by Terraform.
+	// List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in
+	// situations where specific custom fields may contain sensitive information and should be managed outside of Terraform.
 	CustomProfileAttributesToIgnores pulumi.StringArrayInput
 	// User profile property.
 	Department pulumi.StringPtrInput
@@ -486,7 +489,8 @@ type userArgs struct {
 	CountryCode *string `pulumi:"countryCode"`
 	// raw JSON containing all custom profile attributes.
 	CustomProfileAttributes *string `pulumi:"customProfileAttributes"`
-	// List of custom_profile_attribute keys that should be excluded from being managed by Terraform.
+	// List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in
+	// situations where specific custom fields may contain sensitive information and should be managed outside of Terraform.
 	CustomProfileAttributesToIgnores []string `pulumi:"customProfileAttributesToIgnores"`
 	// User profile property.
 	Department *string `pulumi:"department"`
@@ -585,7 +589,8 @@ type UserArgs struct {
 	CountryCode pulumi.StringPtrInput
 	// raw JSON containing all custom profile attributes.
 	CustomProfileAttributes pulumi.StringPtrInput
-	// List of custom_profile_attribute keys that should be excluded from being managed by Terraform.
+	// List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in
+	// situations where specific custom fields may contain sensitive information and should be managed outside of Terraform.
 	CustomProfileAttributesToIgnores pulumi.StringArrayInput
 	// User profile property.
 	Department pulumi.StringPtrInput
@@ -781,7 +786,8 @@ func (o UserOutput) CustomProfileAttributes() pulumi.StringOutput {
 	return o.ApplyT(func(v *User) pulumi.StringOutput { return v.CustomProfileAttributes }).(pulumi.StringOutput)
 }
 
-// List of custom_profile_attribute keys that should be excluded from being managed by Terraform.
+// List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in
+// situations where specific custom fields may contain sensitive information and should be managed outside of Terraform.
 func (o UserOutput) CustomProfileAttributesToIgnores() pulumi.StringArrayOutput {
 	return o.ApplyT(func(v *User) pulumi.StringArrayOutput { return v.CustomProfileAttributesToIgnores }).(pulumi.StringArrayOutput)
 }
diff --git a/sdk/java/src/main/java/com/pulumi/okta/AppUserSchemaProperty.java b/sdk/java/src/main/java/com/pulumi/okta/AppUserSchemaProperty.java
index b0627a8d..6c4da9b7 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/AppUserSchemaProperty.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/AppUserSchemaProperty.java
@@ -337,28 +337,28 @@ public Output<Optional<Boolean>> union() {
         return Codegen.optional(this.union);
     }
     /**
-     * Subschema unique restriction
+     * Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.
      * 
      */
     @Export(name="unique", refs={String.class}, tree="[0]")
     private Output</* @Nullable */ String> unique;
 
     /**
-     * @return Subschema unique restriction
+     * @return Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.
      * 
      */
     public Output<Optional<String>> unique() {
         return Codegen.optional(this.unique);
     }
     /**
-     * Custom subschema user type
+     * User type ID. By default, it is `default`
      * 
      */
     @Export(name="userType", refs={String.class}, tree="[0]")
     private Output</* @Nullable */ String> userType;
 
     /**
-     * @return Custom subschema user type
+     * @return User type ID. By default, it is `default`
      * 
      */
     public Output<Optional<String>> userType() {
diff --git a/sdk/java/src/main/java/com/pulumi/okta/AppUserSchemaPropertyArgs.java b/sdk/java/src/main/java/com/pulumi/okta/AppUserSchemaPropertyArgs.java
index 0ec0f755..4ef848b8 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/AppUserSchemaPropertyArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/AppUserSchemaPropertyArgs.java
@@ -307,14 +307,14 @@ public Optional<Output<Boolean>> union() {
     }
 
     /**
-     * Subschema unique restriction
+     * Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.
      * 
      */
     @Import(name="unique")
     private @Nullable Output<String> unique;
 
     /**
-     * @return Subschema unique restriction
+     * @return Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.
      * 
      */
     public Optional<Output<String>> unique() {
@@ -322,14 +322,14 @@ public Optional<Output<String>> unique() {
     }
 
     /**
-     * Custom subschema user type
+     * User type ID. By default, it is `default`
      * 
      */
     @Import(name="userType")
     private @Nullable Output<String> userType;
 
     /**
-     * @return Custom subschema user type
+     * @return User type ID. By default, it is `default`
      * 
      */
     public Optional<Output<String>> userType() {
@@ -820,7 +820,7 @@ public Builder union(Boolean union) {
         }
 
         /**
-         * @param unique Subschema unique restriction
+         * @param unique Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.
          * 
          * @return builder
          * 
@@ -831,7 +831,7 @@ public Builder unique(@Nullable Output<String> unique) {
         }
 
         /**
-         * @param unique Subschema unique restriction
+         * @param unique Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.
          * 
          * @return builder
          * 
@@ -841,7 +841,7 @@ public Builder unique(String unique) {
         }
 
         /**
-         * @param userType Custom subschema user type
+         * @param userType User type ID. By default, it is `default`
          * 
          * @return builder
          * 
@@ -852,7 +852,7 @@ public Builder userType(@Nullable Output<String> userType) {
         }
 
         /**
-         * @param userType Custom subschema user type
+         * @param userType User type ID. By default, it is `default`
          * 
          * @return builder
          * 
diff --git a/sdk/java/src/main/java/com/pulumi/okta/EventHook.java b/sdk/java/src/main/java/com/pulumi/okta/EventHook.java
index efbd3c40..73cbe93b 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/EventHook.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/EventHook.java
@@ -148,9 +148,17 @@ public Output<Optional<List<EventHookHeader>>> headers() {
     public Output<String> name() {
         return this.name;
     }
+    /**
+     * Default to `ACTIVE`
+     * 
+     */
     @Export(name="status", refs={String.class}, tree="[0]")
     private Output</* @Nullable */ String> status;
 
+    /**
+     * @return Default to `ACTIVE`
+     * 
+     */
     public Output<Optional<String>> status() {
         return Codegen.optional(this.status);
     }
diff --git a/sdk/java/src/main/java/com/pulumi/okta/EventHookArgs.java b/sdk/java/src/main/java/com/pulumi/okta/EventHookArgs.java
index 2cfcdf6a..6029ae45 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/EventHookArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/EventHookArgs.java
@@ -94,9 +94,17 @@ public Optional<Output<String>> name() {
         return Optional.ofNullable(this.name);
     }
 
+    /**
+     * Default to `ACTIVE`
+     * 
+     */
     @Import(name="status")
     private @Nullable Output<String> status;
 
+    /**
+     * @return Default to `ACTIVE`
+     * 
+     */
     public Optional<Output<String>> status() {
         return Optional.ofNullable(this.status);
     }
@@ -255,11 +263,23 @@ public Builder name(String name) {
             return name(Output.of(name));
         }
 
+        /**
+         * @param status Default to `ACTIVE`
+         * 
+         * @return builder
+         * 
+         */
         public Builder status(@Nullable Output<String> status) {
             $.status = status;
             return this;
         }
 
+        /**
+         * @param status Default to `ACTIVE`
+         * 
+         * @return builder
+         * 
+         */
         public Builder status(String status) {
             return status(Output.of(status));
         }
diff --git a/sdk/java/src/main/java/com/pulumi/okta/OrgConfiguration.java b/sdk/java/src/main/java/com/pulumi/okta/OrgConfiguration.java
index 5e7b2dd5..f496a431 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/OrgConfiguration.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/OrgConfiguration.java
@@ -178,14 +178,16 @@ public Output<String> expiresAt() {
         return this.expiresAt;
     }
     /**
-     * Local path to logo of the org.
+     * Logo of org. The file must be in PNG, JPG, or GIF format and less than 1 MB in size. For best results use landscape
+     * orientation, a transparent background, and a minimum size of 420px by 120px to prevent upscaling.
      * 
      */
     @Export(name="logo", refs={String.class}, tree="[0]")
     private Output</* @Nullable */ String> logo;
 
     /**
-     * @return Local path to logo of the org.
+     * @return Logo of org. The file must be in PNG, JPG, or GIF format and less than 1 MB in size. For best results use landscape
+     * orientation, a transparent background, and a minimum size of 420px by 120px to prevent upscaling.
      * 
      */
     public Output<Optional<String>> logo() {
diff --git a/sdk/java/src/main/java/com/pulumi/okta/OrgConfigurationArgs.java b/sdk/java/src/main/java/com/pulumi/okta/OrgConfigurationArgs.java
index b66f0609..56f7522c 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/OrgConfigurationArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/OrgConfigurationArgs.java
@@ -123,14 +123,16 @@ public Optional<Output<String>> endUserSupportHelpUrl() {
     }
 
     /**
-     * Local path to logo of the org.
+     * Logo of org. The file must be in PNG, JPG, or GIF format and less than 1 MB in size. For best results use landscape
+     * orientation, a transparent background, and a minimum size of 420px by 120px to prevent upscaling.
      * 
      */
     @Import(name="logo")
     private @Nullable Output<String> logo;
 
     /**
-     * @return Local path to logo of the org.
+     * @return Logo of org. The file must be in PNG, JPG, or GIF format and less than 1 MB in size. For best results use landscape
+     * orientation, a transparent background, and a minimum size of 420px by 120px to prevent upscaling.
      * 
      */
     public Optional<Output<String>> logo() {
@@ -428,7 +430,8 @@ public Builder endUserSupportHelpUrl(String endUserSupportHelpUrl) {
         }
 
         /**
-         * @param logo Local path to logo of the org.
+         * @param logo Logo of org. The file must be in PNG, JPG, or GIF format and less than 1 MB in size. For best results use landscape
+         * orientation, a transparent background, and a minimum size of 420px by 120px to prevent upscaling.
          * 
          * @return builder
          * 
@@ -439,7 +442,8 @@ public Builder logo(@Nullable Output<String> logo) {
         }
 
         /**
-         * @param logo Local path to logo of the org.
+         * @param logo Logo of org. The file must be in PNG, JPG, or GIF format and less than 1 MB in size. For best results use landscape
+         * orientation, a transparent background, and a minimum size of 420px by 120px to prevent upscaling.
          * 
          * @return builder
          * 
diff --git a/sdk/java/src/main/java/com/pulumi/okta/RoleSubscription.java b/sdk/java/src/main/java/com/pulumi/okta/RoleSubscription.java
index f287845d..da287ba1 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/RoleSubscription.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/RoleSubscription.java
@@ -107,7 +107,7 @@ public Output<String> notificationType() {
     }
     /**
      * Type of the role. Valid values:
-     * `&#34;API_ADMIN&#34;`,
+     * `&#34;API_ACCESS_MANAGEMENT_ADMIN&#34;`,
      * `&#34;APP_ADMIN&#34;`,
      * `&#34;CUSTOM&#34;`,
      * `&#34;GROUP_MEMBERSHIP_ADMIN&#34;`,
@@ -126,7 +126,7 @@ public Output<String> notificationType() {
 
     /**
      * @return Type of the role. Valid values:
-     * `&#34;API_ADMIN&#34;`,
+     * `&#34;API_ACCESS_MANAGEMENT_ADMIN&#34;`,
      * `&#34;APP_ADMIN&#34;`,
      * `&#34;CUSTOM&#34;`,
      * `&#34;GROUP_MEMBERSHIP_ADMIN&#34;`,
diff --git a/sdk/java/src/main/java/com/pulumi/okta/RoleSubscriptionArgs.java b/sdk/java/src/main/java/com/pulumi/okta/RoleSubscriptionArgs.java
index 1852b072..15b3ca71 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/RoleSubscriptionArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/RoleSubscriptionArgs.java
@@ -59,7 +59,7 @@ public Output<String> notificationType() {
 
     /**
      * Type of the role. Valid values:
-     * `&#34;API_ADMIN&#34;`,
+     * `&#34;API_ACCESS_MANAGEMENT_ADMIN&#34;`,
      * `&#34;APP_ADMIN&#34;`,
      * `&#34;CUSTOM&#34;`,
      * `&#34;GROUP_MEMBERSHIP_ADMIN&#34;`,
@@ -78,7 +78,7 @@ public Output<String> notificationType() {
 
     /**
      * @return Type of the role. Valid values:
-     * `&#34;API_ADMIN&#34;`,
+     * `&#34;API_ACCESS_MANAGEMENT_ADMIN&#34;`,
      * `&#34;APP_ADMIN&#34;`,
      * `&#34;CUSTOM&#34;`,
      * `&#34;GROUP_MEMBERSHIP_ADMIN&#34;`,
@@ -186,7 +186,7 @@ public Builder notificationType(String notificationType) {
 
         /**
          * @param roleType Type of the role. Valid values:
-         * `&#34;API_ADMIN&#34;`,
+         * `&#34;API_ACCESS_MANAGEMENT_ADMIN&#34;`,
          * `&#34;APP_ADMIN&#34;`,
          * `&#34;CUSTOM&#34;`,
          * `&#34;GROUP_MEMBERSHIP_ADMIN&#34;`,
@@ -209,7 +209,7 @@ public Builder roleType(Output<String> roleType) {
 
         /**
          * @param roleType Type of the role. Valid values:
-         * `&#34;API_ADMIN&#34;`,
+         * `&#34;API_ACCESS_MANAGEMENT_ADMIN&#34;`,
          * `&#34;APP_ADMIN&#34;`,
          * `&#34;CUSTOM&#34;`,
          * `&#34;GROUP_MEMBERSHIP_ADMIN&#34;`,
diff --git a/sdk/java/src/main/java/com/pulumi/okta/app/Saml.java b/sdk/java/src/main/java/com/pulumi/okta/app/Saml.java
index 0c4657b7..0f807592 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/app/Saml.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/app/Saml.java
@@ -942,14 +942,14 @@ public Output<String> signOnMode() {
         return this.signOnMode;
     }
     /**
-     * Signature algorithm used ot digitally sign the assertion and response.
+     * Signature algorithm used to digitally sign the assertion and response.
      * 
      */
     @Export(name="signatureAlgorithm", refs={String.class}, tree="[0]")
     private Output</* @Nullable */ String> signatureAlgorithm;
 
     /**
-     * @return Signature algorithm used ot digitally sign the assertion and response.
+     * @return Signature algorithm used to digitally sign the assertion and response.
      * 
      */
     public Output<Optional<String>> signatureAlgorithm() {
diff --git a/sdk/java/src/main/java/com/pulumi/okta/app/SamlArgs.java b/sdk/java/src/main/java/com/pulumi/okta/app/SamlArgs.java
index 07ec590e..0f6d21f0 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/app/SamlArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/app/SamlArgs.java
@@ -516,14 +516,14 @@ public Optional<Output<String>> samlVersion() {
     }
 
     /**
-     * Signature algorithm used ot digitally sign the assertion and response.
+     * Signature algorithm used to digitally sign the assertion and response.
      * 
      */
     @Import(name="signatureAlgorithm")
     private @Nullable Output<String> signatureAlgorithm;
 
     /**
-     * @return Signature algorithm used ot digitally sign the assertion and response.
+     * @return Signature algorithm used to digitally sign the assertion and response.
      * 
      */
     public Optional<Output<String>> signatureAlgorithm() {
@@ -1493,7 +1493,7 @@ public Builder samlVersion(String samlVersion) {
         }
 
         /**
-         * @param signatureAlgorithm Signature algorithm used ot digitally sign the assertion and response.
+         * @param signatureAlgorithm Signature algorithm used to digitally sign the assertion and response.
          * 
          * @return builder
          * 
@@ -1504,7 +1504,7 @@ public Builder signatureAlgorithm(@Nullable Output<String> signatureAlgorithm) {
         }
 
         /**
-         * @param signatureAlgorithm Signature algorithm used ot digitally sign the assertion and response.
+         * @param signatureAlgorithm Signature algorithm used to digitally sign the assertion and response.
          * 
          * @return builder
          * 
diff --git a/sdk/java/src/main/java/com/pulumi/okta/app/ThreeField.java b/sdk/java/src/main/java/com/pulumi/okta/app/ThreeField.java
index 5a3e8c80..87b42cf5 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/app/ThreeField.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/app/ThreeField.java
@@ -127,14 +127,14 @@ public Output<Optional<String>> adminNote() {
         return Codegen.optional(this.adminNote);
     }
     /**
-     * Displays specific appLinks for the app
+     * Displays specific appLinks for the app. The value for each application link should be boolean.
      * 
      */
     @Export(name="appLinksJson", refs={String.class}, tree="[0]")
     private Output</* @Nullable */ String> appLinksJson;
 
     /**
-     * @return Displays specific appLinks for the app
+     * @return Displays specific appLinks for the app. The value for each application link should be boolean.
      * 
      */
     public Output<Optional<String>> appLinksJson() {
diff --git a/sdk/java/src/main/java/com/pulumi/okta/app/ThreeFieldArgs.java b/sdk/java/src/main/java/com/pulumi/okta/app/ThreeFieldArgs.java
index 03c75d3e..c682b735 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/app/ThreeFieldArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/app/ThreeFieldArgs.java
@@ -78,14 +78,14 @@ public Optional<Output<String>> adminNote() {
     }
 
     /**
-     * Displays specific appLinks for the app
+     * Displays specific appLinks for the app. The value for each application link should be boolean.
      * 
      */
     @Import(name="appLinksJson")
     private @Nullable Output<String> appLinksJson;
 
     /**
-     * @return Displays specific appLinks for the app
+     * @return Displays specific appLinks for the app. The value for each application link should be boolean.
      * 
      */
     public Optional<Output<String>> appLinksJson() {
@@ -557,7 +557,7 @@ public Builder adminNote(String adminNote) {
         }
 
         /**
-         * @param appLinksJson Displays specific appLinks for the app
+         * @param appLinksJson Displays specific appLinks for the app. The value for each application link should be boolean.
          * 
          * @return builder
          * 
@@ -568,7 +568,7 @@ public Builder appLinksJson(@Nullable Output<String> appLinksJson) {
         }
 
         /**
-         * @param appLinksJson Displays specific appLinks for the app
+         * @param appLinksJson Displays specific appLinks for the app. The value for each application link should be boolean.
          * 
          * @return builder
          * 
diff --git a/sdk/java/src/main/java/com/pulumi/okta/app/inputs/SamlState.java b/sdk/java/src/main/java/com/pulumi/okta/app/inputs/SamlState.java
index f4025cd7..f9bdb5d5 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/app/inputs/SamlState.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/app/inputs/SamlState.java
@@ -726,14 +726,14 @@ public Optional<Output<String>> signOnMode() {
     }
 
     /**
-     * Signature algorithm used ot digitally sign the assertion and response.
+     * Signature algorithm used to digitally sign the assertion and response.
      * 
      */
     @Import(name="signatureAlgorithm")
     private @Nullable Output<String> signatureAlgorithm;
 
     /**
-     * @return Signature algorithm used ot digitally sign the assertion and response.
+     * @return Signature algorithm used to digitally sign the assertion and response.
      * 
      */
     public Optional<Output<String>> signatureAlgorithm() {
@@ -2031,7 +2031,7 @@ public Builder signOnMode(String signOnMode) {
         }
 
         /**
-         * @param signatureAlgorithm Signature algorithm used ot digitally sign the assertion and response.
+         * @param signatureAlgorithm Signature algorithm used to digitally sign the assertion and response.
          * 
          * @return builder
          * 
@@ -2042,7 +2042,7 @@ public Builder signatureAlgorithm(@Nullable Output<String> signatureAlgorithm) {
         }
 
         /**
-         * @param signatureAlgorithm Signature algorithm used ot digitally sign the assertion and response.
+         * @param signatureAlgorithm Signature algorithm used to digitally sign the assertion and response.
          * 
          * @return builder
          * 
diff --git a/sdk/java/src/main/java/com/pulumi/okta/app/inputs/ThreeFieldState.java b/sdk/java/src/main/java/com/pulumi/okta/app/inputs/ThreeFieldState.java
index 9104db88..1a63d375 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/app/inputs/ThreeFieldState.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/app/inputs/ThreeFieldState.java
@@ -77,14 +77,14 @@ public Optional<Output<String>> adminNote() {
     }
 
     /**
-     * Displays specific appLinks for the app
+     * Displays specific appLinks for the app. The value for each application link should be boolean.
      * 
      */
     @Import(name="appLinksJson")
     private @Nullable Output<String> appLinksJson;
 
     /**
-     * @return Displays specific appLinks for the app
+     * @return Displays specific appLinks for the app. The value for each application link should be boolean.
      * 
      */
     public Optional<Output<String>> appLinksJson() {
@@ -604,7 +604,7 @@ public Builder adminNote(String adminNote) {
         }
 
         /**
-         * @param appLinksJson Displays specific appLinks for the app
+         * @param appLinksJson Displays specific appLinks for the app. The value for each application link should be boolean.
          * 
          * @return builder
          * 
@@ -615,7 +615,7 @@ public Builder appLinksJson(@Nullable Output<String> appLinksJson) {
         }
 
         /**
-         * @param appLinksJson Displays specific appLinks for the app
+         * @param appLinksJson Displays specific appLinks for the app. The value for each application link should be boolean.
          * 
          * @return builder
          * 
diff --git a/sdk/java/src/main/java/com/pulumi/okta/app/outputs/GetSamlResult.java b/sdk/java/src/main/java/com/pulumi/okta/app/outputs/GetSamlResult.java
index 8403c920..5e0db13b 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/app/outputs/GetSamlResult.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/app/outputs/GetSamlResult.java
@@ -167,7 +167,7 @@ public final class GetSamlResult {
      */
     private Boolean samlSignedRequestEnabled;
     /**
-     * @return Signature algorithm used ot digitally sign the assertion and response.
+     * @return Signature algorithm used to digitally sign the assertion and response.
      * 
      */
     private String signatureAlgorithm;
@@ -468,7 +468,7 @@ public Boolean samlSignedRequestEnabled() {
         return this.samlSignedRequestEnabled;
     }
     /**
-     * @return Signature algorithm used ot digitally sign the assertion and response.
+     * @return Signature algorithm used to digitally sign the assertion and response.
      * 
      */
     public String signatureAlgorithm() {
diff --git a/sdk/java/src/main/java/com/pulumi/okta/group/Role.java b/sdk/java/src/main/java/com/pulumi/okta/group/Role.java
index cdc673b7..8932c435 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/group/Role.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/group/Role.java
@@ -99,7 +99,7 @@ public Output<String> groupId() {
     }
     /**
      * Admin role assigned to the group. It can be any one of the following values:
-     * `&#34;API_ADMIN&#34;`,
+     * `&#34;API_ACCESS_MANAGEMENT_ADMIN&#34;`,
      * `&#34;APP_ADMIN&#34;`,
      * `&#34;CUSTOM&#34;`,
      * `&#34;GROUP_MEMBERSHIP_ADMIN&#34;`,
@@ -120,7 +120,7 @@ public Output<String> groupId() {
 
     /**
      * @return Admin role assigned to the group. It can be any one of the following values:
-     * `&#34;API_ADMIN&#34;`,
+     * `&#34;API_ACCESS_MANAGEMENT_ADMIN&#34;`,
      * `&#34;APP_ADMIN&#34;`,
      * `&#34;CUSTOM&#34;`,
      * `&#34;GROUP_MEMBERSHIP_ADMIN&#34;`,
diff --git a/sdk/java/src/main/java/com/pulumi/okta/group/RoleArgs.java b/sdk/java/src/main/java/com/pulumi/okta/group/RoleArgs.java
index 21dbe212..925fa537 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/group/RoleArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/group/RoleArgs.java
@@ -52,7 +52,7 @@ public Output<String> groupId() {
 
     /**
      * Admin role assigned to the group. It can be any one of the following values:
-     * `&#34;API_ADMIN&#34;`,
+     * `&#34;API_ACCESS_MANAGEMENT_ADMIN&#34;`,
      * `&#34;APP_ADMIN&#34;`,
      * `&#34;CUSTOM&#34;`,
      * `&#34;GROUP_MEMBERSHIP_ADMIN&#34;`,
@@ -73,7 +73,7 @@ public Output<String> groupId() {
 
     /**
      * @return Admin role assigned to the group. It can be any one of the following values:
-     * `&#34;API_ADMIN&#34;`,
+     * `&#34;API_ACCESS_MANAGEMENT_ADMIN&#34;`,
      * `&#34;APP_ADMIN&#34;`,
      * `&#34;CUSTOM&#34;`,
      * `&#34;GROUP_MEMBERSHIP_ADMIN&#34;`,
@@ -205,7 +205,7 @@ public Builder groupId(String groupId) {
 
         /**
          * @param roleType Admin role assigned to the group. It can be any one of the following values:
-         * `&#34;API_ADMIN&#34;`,
+         * `&#34;API_ACCESS_MANAGEMENT_ADMIN&#34;`,
          * `&#34;APP_ADMIN&#34;`,
          * `&#34;CUSTOM&#34;`,
          * `&#34;GROUP_MEMBERSHIP_ADMIN&#34;`,
@@ -230,7 +230,7 @@ public Builder roleType(Output<String> roleType) {
 
         /**
          * @param roleType Admin role assigned to the group. It can be any one of the following values:
-         * `&#34;API_ADMIN&#34;`,
+         * `&#34;API_ACCESS_MANAGEMENT_ADMIN&#34;`,
          * `&#34;APP_ADMIN&#34;`,
          * `&#34;CUSTOM&#34;`,
          * `&#34;GROUP_MEMBERSHIP_ADMIN&#34;`,
diff --git a/sdk/java/src/main/java/com/pulumi/okta/group/inputs/RoleState.java b/sdk/java/src/main/java/com/pulumi/okta/group/inputs/RoleState.java
index 12e3f865..a593e628 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/group/inputs/RoleState.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/group/inputs/RoleState.java
@@ -51,7 +51,7 @@ public Optional<Output<String>> groupId() {
 
     /**
      * Admin role assigned to the group. It can be any one of the following values:
-     * `&#34;API_ADMIN&#34;`,
+     * `&#34;API_ACCESS_MANAGEMENT_ADMIN&#34;`,
      * `&#34;APP_ADMIN&#34;`,
      * `&#34;CUSTOM&#34;`,
      * `&#34;GROUP_MEMBERSHIP_ADMIN&#34;`,
@@ -72,7 +72,7 @@ public Optional<Output<String>> groupId() {
 
     /**
      * @return Admin role assigned to the group. It can be any one of the following values:
-     * `&#34;API_ADMIN&#34;`,
+     * `&#34;API_ACCESS_MANAGEMENT_ADMIN&#34;`,
      * `&#34;APP_ADMIN&#34;`,
      * `&#34;CUSTOM&#34;`,
      * `&#34;GROUP_MEMBERSHIP_ADMIN&#34;`,
@@ -204,7 +204,7 @@ public Builder groupId(String groupId) {
 
         /**
          * @param roleType Admin role assigned to the group. It can be any one of the following values:
-         * `&#34;API_ADMIN&#34;`,
+         * `&#34;API_ACCESS_MANAGEMENT_ADMIN&#34;`,
          * `&#34;APP_ADMIN&#34;`,
          * `&#34;CUSTOM&#34;`,
          * `&#34;GROUP_MEMBERSHIP_ADMIN&#34;`,
@@ -229,7 +229,7 @@ public Builder roleType(@Nullable Output<String> roleType) {
 
         /**
          * @param roleType Admin role assigned to the group. It can be any one of the following values:
-         * `&#34;API_ADMIN&#34;`,
+         * `&#34;API_ACCESS_MANAGEMENT_ADMIN&#34;`,
          * `&#34;APP_ADMIN&#34;`,
          * `&#34;CUSTOM&#34;`,
          * `&#34;GROUP_MEMBERSHIP_ADMIN&#34;`,
diff --git a/sdk/java/src/main/java/com/pulumi/okta/idp/Oidc.java b/sdk/java/src/main/java/com/pulumi/okta/idp/Oidc.java
index 4ebb34e8..498907a9 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/idp/Oidc.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/idp/Oidc.java
@@ -316,22 +316,6 @@ public Output<Optional<Integer>> maxClockSkew() {
     public Output<String> name() {
         return this.name;
     }
-    /**
-     * Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See:
-     * https://developer.okta.com/docs/reference/api/idps/#oauth-2-0-and-openid-connect-client-object
-     * 
-     */
-    @Export(name="pkceRequired", refs={Boolean.class}, tree="[0]")
-    private Output</* @Nullable */ Boolean> pkceRequired;
-
-    /**
-     * @return Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See:
-     * https://developer.okta.com/docs/reference/api/idps/#oauth-2-0-and-openid-connect-client-object
-     * 
-     */
-    public Output<Optional<Boolean>> pkceRequired() {
-        return Codegen.optional(this.pkceRequired);
-    }
     /**
      * Determines if the IdP should act as a source of truth for user profile attributes.
      * 
diff --git a/sdk/java/src/main/java/com/pulumi/okta/idp/OidcArgs.java b/sdk/java/src/main/java/com/pulumi/okta/idp/OidcArgs.java
index 1a052076..840d4f55 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/idp/OidcArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/idp/OidcArgs.java
@@ -274,23 +274,6 @@ public Optional<Output<String>> name() {
         return Optional.ofNullable(this.name);
     }
 
-    /**
-     * Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See:
-     * https://developer.okta.com/docs/reference/api/idps/#oauth-2-0-and-openid-connect-client-object
-     * 
-     */
-    @Import(name="pkceRequired")
-    private @Nullable Output<Boolean> pkceRequired;
-
-    /**
-     * @return Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See:
-     * https://developer.okta.com/docs/reference/api/idps/#oauth-2-0-and-openid-connect-client-object
-     * 
-     */
-    public Optional<Output<Boolean>> pkceRequired() {
-        return Optional.ofNullable(this.pkceRequired);
-    }
-
     /**
      * Determines if the IdP should act as a source of truth for user profile attributes.
      * 
@@ -528,7 +511,6 @@ private OidcArgs(OidcArgs $) {
         this.jwksUrl = $.jwksUrl;
         this.maxClockSkew = $.maxClockSkew;
         this.name = $.name;
-        this.pkceRequired = $.pkceRequired;
         this.profileMaster = $.profileMaster;
         this.protocolType = $.protocolType;
         this.provisioningAction = $.provisioningAction;
@@ -951,29 +933,6 @@ public Builder name(String name) {
             return name(Output.of(name));
         }
 
-        /**
-         * @param pkceRequired Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See:
-         * https://developer.okta.com/docs/reference/api/idps/#oauth-2-0-and-openid-connect-client-object
-         * 
-         * @return builder
-         * 
-         */
-        public Builder pkceRequired(@Nullable Output<Boolean> pkceRequired) {
-            $.pkceRequired = pkceRequired;
-            return this;
-        }
-
-        /**
-         * @param pkceRequired Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See:
-         * https://developer.okta.com/docs/reference/api/idps/#oauth-2-0-and-openid-connect-client-object
-         * 
-         * @return builder
-         * 
-         */
-        public Builder pkceRequired(Boolean pkceRequired) {
-            return pkceRequired(Output.of(pkceRequired));
-        }
-
         /**
          * @param profileMaster Determines if the IdP should act as a source of truth for user profile attributes.
          * 
diff --git a/sdk/java/src/main/java/com/pulumi/okta/idp/inputs/OidcState.java b/sdk/java/src/main/java/com/pulumi/okta/idp/inputs/OidcState.java
index 08ce0d41..d9c00735 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/idp/inputs/OidcState.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/idp/inputs/OidcState.java
@@ -273,23 +273,6 @@ public Optional<Output<String>> name() {
         return Optional.ofNullable(this.name);
     }
 
-    /**
-     * Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See:
-     * https://developer.okta.com/docs/reference/api/idps/#oauth-2-0-and-openid-connect-client-object
-     * 
-     */
-    @Import(name="pkceRequired")
-    private @Nullable Output<Boolean> pkceRequired;
-
-    /**
-     * @return Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See:
-     * https://developer.okta.com/docs/reference/api/idps/#oauth-2-0-and-openid-connect-client-object
-     * 
-     */
-    public Optional<Output<Boolean>> pkceRequired() {
-        return Optional.ofNullable(this.pkceRequired);
-    }
-
     /**
      * Determines if the IdP should act as a source of truth for user profile attributes.
      * 
@@ -557,7 +540,6 @@ private OidcState(OidcState $) {
         this.jwksUrl = $.jwksUrl;
         this.maxClockSkew = $.maxClockSkew;
         this.name = $.name;
-        this.pkceRequired = $.pkceRequired;
         this.profileMaster = $.profileMaster;
         this.protocolType = $.protocolType;
         this.provisioningAction = $.provisioningAction;
@@ -982,29 +964,6 @@ public Builder name(String name) {
             return name(Output.of(name));
         }
 
-        /**
-         * @param pkceRequired Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See:
-         * https://developer.okta.com/docs/reference/api/idps/#oauth-2-0-and-openid-connect-client-object
-         * 
-         * @return builder
-         * 
-         */
-        public Builder pkceRequired(@Nullable Output<Boolean> pkceRequired) {
-            $.pkceRequired = pkceRequired;
-            return this;
-        }
-
-        /**
-         * @param pkceRequired Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See:
-         * https://developer.okta.com/docs/reference/api/idps/#oauth-2-0-and-openid-connect-client-object
-         * 
-         * @return builder
-         * 
-         */
-        public Builder pkceRequired(Boolean pkceRequired) {
-            return pkceRequired(Output.of(pkceRequired));
-        }
-
         /**
          * @param profileMaster Determines if the IdP should act as a source of truth for user profile attributes.
          * 
diff --git a/sdk/java/src/main/java/com/pulumi/okta/inline/Hook.java b/sdk/java/src/main/java/com/pulumi/okta/inline/Hook.java
index 41a40be0..29804968 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/inline/Hook.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/inline/Hook.java
@@ -133,9 +133,17 @@ public Output<Optional<List<HookHeader>>> headers() {
     public Output<String> name() {
         return this.name;
     }
+    /**
+     * Default to `ACTIVE`
+     * 
+     */
     @Export(name="status", refs={String.class}, tree="[0]")
     private Output</* @Nullable */ String> status;
 
+    /**
+     * @return Default to `ACTIVE`
+     * 
+     */
     public Output<Optional<String>> status() {
         return Codegen.optional(this.status);
     }
diff --git a/sdk/java/src/main/java/com/pulumi/okta/inline/HookArgs.java b/sdk/java/src/main/java/com/pulumi/okta/inline/HookArgs.java
index 4411d421..73646309 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/inline/HookArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/inline/HookArgs.java
@@ -79,9 +79,17 @@ public Optional<Output<String>> name() {
         return Optional.ofNullable(this.name);
     }
 
+    /**
+     * Default to `ACTIVE`
+     * 
+     */
     @Import(name="status")
     private @Nullable Output<String> status;
 
+    /**
+     * @return Default to `ACTIVE`
+     * 
+     */
     public Optional<Output<String>> status() {
         return Optional.ofNullable(this.status);
     }
@@ -240,11 +248,23 @@ public Builder name(String name) {
             return name(Output.of(name));
         }
 
+        /**
+         * @param status Default to `ACTIVE`
+         * 
+         * @return builder
+         * 
+         */
         public Builder status(@Nullable Output<String> status) {
             $.status = status;
             return this;
         }
 
+        /**
+         * @param status Default to `ACTIVE`
+         * 
+         * @return builder
+         * 
+         */
         public Builder status(String status) {
             return status(Output.of(status));
         }
diff --git a/sdk/java/src/main/java/com/pulumi/okta/inline/inputs/HookState.java b/sdk/java/src/main/java/com/pulumi/okta/inline/inputs/HookState.java
index 44c4d11b..ff006597 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/inline/inputs/HookState.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/inline/inputs/HookState.java
@@ -78,9 +78,17 @@ public Optional<Output<String>> name() {
         return Optional.ofNullable(this.name);
     }
 
+    /**
+     * Default to `ACTIVE`
+     * 
+     */
     @Import(name="status")
     private @Nullable Output<String> status;
 
+    /**
+     * @return Default to `ACTIVE`
+     * 
+     */
     public Optional<Output<String>> status() {
         return Optional.ofNullable(this.status);
     }
@@ -239,11 +247,23 @@ public Builder name(String name) {
             return name(Output.of(name));
         }
 
+        /**
+         * @param status Default to `ACTIVE`
+         * 
+         * @return builder
+         * 
+         */
         public Builder status(@Nullable Output<String> status) {
             $.status = status;
             return this;
         }
 
+        /**
+         * @param status Default to `ACTIVE`
+         * 
+         * @return builder
+         * 
+         */
         public Builder status(String status) {
             return status(Output.of(status));
         }
diff --git a/sdk/java/src/main/java/com/pulumi/okta/inputs/AppUserSchemaPropertyState.java b/sdk/java/src/main/java/com/pulumi/okta/inputs/AppUserSchemaPropertyState.java
index 90810c6a..e656c224 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/inputs/AppUserSchemaPropertyState.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/inputs/AppUserSchemaPropertyState.java
@@ -306,14 +306,14 @@ public Optional<Output<Boolean>> union() {
     }
 
     /**
-     * Subschema unique restriction
+     * Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.
      * 
      */
     @Import(name="unique")
     private @Nullable Output<String> unique;
 
     /**
-     * @return Subschema unique restriction
+     * @return Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.
      * 
      */
     public Optional<Output<String>> unique() {
@@ -321,14 +321,14 @@ public Optional<Output<String>> unique() {
     }
 
     /**
-     * Custom subschema user type
+     * User type ID. By default, it is `default`
      * 
      */
     @Import(name="userType")
     private @Nullable Output<String> userType;
 
     /**
-     * @return Custom subschema user type
+     * @return User type ID. By default, it is `default`
      * 
      */
     public Optional<Output<String>> userType() {
@@ -819,7 +819,7 @@ public Builder union(Boolean union) {
         }
 
         /**
-         * @param unique Subschema unique restriction
+         * @param unique Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.
          * 
          * @return builder
          * 
@@ -830,7 +830,7 @@ public Builder unique(@Nullable Output<String> unique) {
         }
 
         /**
-         * @param unique Subschema unique restriction
+         * @param unique Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.
          * 
          * @return builder
          * 
@@ -840,7 +840,7 @@ public Builder unique(String unique) {
         }
 
         /**
-         * @param userType Custom subschema user type
+         * @param userType User type ID. By default, it is `default`
          * 
          * @return builder
          * 
@@ -851,7 +851,7 @@ public Builder userType(@Nullable Output<String> userType) {
         }
 
         /**
-         * @param userType Custom subschema user type
+         * @param userType User type ID. By default, it is `default`
          * 
          * @return builder
          * 
diff --git a/sdk/java/src/main/java/com/pulumi/okta/inputs/EventHookState.java b/sdk/java/src/main/java/com/pulumi/okta/inputs/EventHookState.java
index 23e1a350..58d319eb 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/inputs/EventHookState.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/inputs/EventHookState.java
@@ -93,9 +93,17 @@ public Optional<Output<String>> name() {
         return Optional.ofNullable(this.name);
     }
 
+    /**
+     * Default to `ACTIVE`
+     * 
+     */
     @Import(name="status")
     private @Nullable Output<String> status;
 
+    /**
+     * @return Default to `ACTIVE`
+     * 
+     */
     public Optional<Output<String>> status() {
         return Optional.ofNullable(this.status);
     }
@@ -254,11 +262,23 @@ public Builder name(String name) {
             return name(Output.of(name));
         }
 
+        /**
+         * @param status Default to `ACTIVE`
+         * 
+         * @return builder
+         * 
+         */
         public Builder status(@Nullable Output<String> status) {
             $.status = status;
             return this;
         }
 
+        /**
+         * @param status Default to `ACTIVE`
+         * 
+         * @return builder
+         * 
+         */
         public Builder status(String status) {
             return status(Output.of(status));
         }
diff --git a/sdk/java/src/main/java/com/pulumi/okta/inputs/GetRoleSubscriptionArgs.java b/sdk/java/src/main/java/com/pulumi/okta/inputs/GetRoleSubscriptionArgs.java
index 781a889e..9b49fc65 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/inputs/GetRoleSubscriptionArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/inputs/GetRoleSubscriptionArgs.java
@@ -35,7 +35,7 @@ public Output<String> notificationType() {
 
     /**
      * Type of the role. Valid values:
-     * `&#34;API_ADMIN&#34;`,
+     * `&#34;API_ACCESS_MANAGEMENT_ADMIN&#34;`,
      * `&#34;APP_ADMIN&#34;`,
      * `&#34;CUSTOM&#34;`,
      * `&#34;GROUP_MEMBERSHIP_ADMIN&#34;`,
@@ -54,7 +54,7 @@ public Output<String> notificationType() {
 
     /**
      * @return Type of the role. Valid values:
-     * `&#34;API_ADMIN&#34;`,
+     * `&#34;API_ACCESS_MANAGEMENT_ADMIN&#34;`,
      * `&#34;APP_ADMIN&#34;`,
      * `&#34;CUSTOM&#34;`,
      * `&#34;GROUP_MEMBERSHIP_ADMIN&#34;`,
@@ -124,7 +124,7 @@ public Builder notificationType(String notificationType) {
 
         /**
          * @param roleType Type of the role. Valid values:
-         * `&#34;API_ADMIN&#34;`,
+         * `&#34;API_ACCESS_MANAGEMENT_ADMIN&#34;`,
          * `&#34;APP_ADMIN&#34;`,
          * `&#34;CUSTOM&#34;`,
          * `&#34;GROUP_MEMBERSHIP_ADMIN&#34;`,
@@ -147,7 +147,7 @@ public Builder roleType(Output<String> roleType) {
 
         /**
          * @param roleType Type of the role. Valid values:
-         * `&#34;API_ADMIN&#34;`,
+         * `&#34;API_ACCESS_MANAGEMENT_ADMIN&#34;`,
          * `&#34;APP_ADMIN&#34;`,
          * `&#34;CUSTOM&#34;`,
          * `&#34;GROUP_MEMBERSHIP_ADMIN&#34;`,
diff --git a/sdk/java/src/main/java/com/pulumi/okta/inputs/GetRoleSubscriptionPlainArgs.java b/sdk/java/src/main/java/com/pulumi/okta/inputs/GetRoleSubscriptionPlainArgs.java
index e4a8e41d..cff0e42f 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/inputs/GetRoleSubscriptionPlainArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/inputs/GetRoleSubscriptionPlainArgs.java
@@ -34,7 +34,7 @@ public String notificationType() {
 
     /**
      * Type of the role. Valid values:
-     * `&#34;API_ADMIN&#34;`,
+     * `&#34;API_ACCESS_MANAGEMENT_ADMIN&#34;`,
      * `&#34;APP_ADMIN&#34;`,
      * `&#34;CUSTOM&#34;`,
      * `&#34;GROUP_MEMBERSHIP_ADMIN&#34;`,
@@ -53,7 +53,7 @@ public String notificationType() {
 
     /**
      * @return Type of the role. Valid values:
-     * `&#34;API_ADMIN&#34;`,
+     * `&#34;API_ACCESS_MANAGEMENT_ADMIN&#34;`,
      * `&#34;APP_ADMIN&#34;`,
      * `&#34;CUSTOM&#34;`,
      * `&#34;GROUP_MEMBERSHIP_ADMIN&#34;`,
@@ -111,7 +111,7 @@ public Builder notificationType(String notificationType) {
 
         /**
          * @param roleType Type of the role. Valid values:
-         * `&#34;API_ADMIN&#34;`,
+         * `&#34;API_ACCESS_MANAGEMENT_ADMIN&#34;`,
          * `&#34;APP_ADMIN&#34;`,
          * `&#34;CUSTOM&#34;`,
          * `&#34;GROUP_MEMBERSHIP_ADMIN&#34;`,
diff --git a/sdk/java/src/main/java/com/pulumi/okta/inputs/OrgConfigurationState.java b/sdk/java/src/main/java/com/pulumi/okta/inputs/OrgConfigurationState.java
index 26630a14..ed0606aa 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/inputs/OrgConfigurationState.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/inputs/OrgConfigurationState.java
@@ -137,14 +137,16 @@ public Optional<Output<String>> expiresAt() {
     }
 
     /**
-     * Local path to logo of the org.
+     * Logo of org. The file must be in PNG, JPG, or GIF format and less than 1 MB in size. For best results use landscape
+     * orientation, a transparent background, and a minimum size of 420px by 120px to prevent upscaling.
      * 
      */
     @Import(name="logo")
     private @Nullable Output<String> logo;
 
     /**
-     * @return Local path to logo of the org.
+     * @return Logo of org. The file must be in PNG, JPG, or GIF format and less than 1 MB in size. For best results use landscape
+     * orientation, a transparent background, and a minimum size of 420px by 120px to prevent upscaling.
      * 
      */
     public Optional<Output<String>> logo() {
@@ -480,7 +482,8 @@ public Builder expiresAt(String expiresAt) {
         }
 
         /**
-         * @param logo Local path to logo of the org.
+         * @param logo Logo of org. The file must be in PNG, JPG, or GIF format and less than 1 MB in size. For best results use landscape
+         * orientation, a transparent background, and a minimum size of 420px by 120px to prevent upscaling.
          * 
          * @return builder
          * 
@@ -491,7 +494,8 @@ public Builder logo(@Nullable Output<String> logo) {
         }
 
         /**
-         * @param logo Local path to logo of the org.
+         * @param logo Logo of org. The file must be in PNG, JPG, or GIF format and less than 1 MB in size. For best results use landscape
+         * orientation, a transparent background, and a minimum size of 420px by 120px to prevent upscaling.
          * 
          * @return builder
          * 
diff --git a/sdk/java/src/main/java/com/pulumi/okta/inputs/RoleSubscriptionState.java b/sdk/java/src/main/java/com/pulumi/okta/inputs/RoleSubscriptionState.java
index 50405e51..3ce257c3 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/inputs/RoleSubscriptionState.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/inputs/RoleSubscriptionState.java
@@ -58,7 +58,7 @@ public Optional<Output<String>> notificationType() {
 
     /**
      * Type of the role. Valid values:
-     * `&#34;API_ADMIN&#34;`,
+     * `&#34;API_ACCESS_MANAGEMENT_ADMIN&#34;`,
      * `&#34;APP_ADMIN&#34;`,
      * `&#34;CUSTOM&#34;`,
      * `&#34;GROUP_MEMBERSHIP_ADMIN&#34;`,
@@ -77,7 +77,7 @@ public Optional<Output<String>> notificationType() {
 
     /**
      * @return Type of the role. Valid values:
-     * `&#34;API_ADMIN&#34;`,
+     * `&#34;API_ACCESS_MANAGEMENT_ADMIN&#34;`,
      * `&#34;APP_ADMIN&#34;`,
      * `&#34;CUSTOM&#34;`,
      * `&#34;GROUP_MEMBERSHIP_ADMIN&#34;`,
@@ -185,7 +185,7 @@ public Builder notificationType(String notificationType) {
 
         /**
          * @param roleType Type of the role. Valid values:
-         * `&#34;API_ADMIN&#34;`,
+         * `&#34;API_ACCESS_MANAGEMENT_ADMIN&#34;`,
          * `&#34;APP_ADMIN&#34;`,
          * `&#34;CUSTOM&#34;`,
          * `&#34;GROUP_MEMBERSHIP_ADMIN&#34;`,
@@ -208,7 +208,7 @@ public Builder roleType(@Nullable Output<String> roleType) {
 
         /**
          * @param roleType Type of the role. Valid values:
-         * `&#34;API_ADMIN&#34;`,
+         * `&#34;API_ACCESS_MANAGEMENT_ADMIN&#34;`,
          * `&#34;APP_ADMIN&#34;`,
          * `&#34;CUSTOM&#34;`,
          * `&#34;GROUP_MEMBERSHIP_ADMIN&#34;`,
diff --git a/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceAndroid.java b/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceAndroid.java
index 785971fd..28fdc4a6 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceAndroid.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceAndroid.java
@@ -47,28 +47,28 @@ public Output<String> createdDate() {
         return this.createdDate;
     }
     /**
-     * List of disk encryption type, can be FULL, USER
+     * List of disk encryption type, can be `FULL`, `USER`
      * 
      */
     @Export(name="diskEncryptionTypes", refs={List.class,String.class}, tree="[0,1]")
     private Output</* @Nullable */ List<String>> diskEncryptionTypes;
 
     /**
-     * @return List of disk encryption type, can be FULL, USER
+     * @return List of disk encryption type, can be `FULL`, `USER`
      * 
      */
     public Output<Optional<List<String>>> diskEncryptionTypes() {
         return Codegen.optional(this.diskEncryptionTypes);
     }
     /**
-     * The device jailbreak. Only for android and iOS platform
+     * Is the device jailbroken in the device assurance policy.
      * 
      */
     @Export(name="jailbreak", refs={Boolean.class}, tree="[0]")
     private Output</* @Nullable */ Boolean> jailbreak;
 
     /**
-     * @return The device jailbreak. Only for android and iOS platform
+     * @return Is the device jailbroken in the device assurance policy.
      * 
      */
     public Output<Optional<Boolean>> jailbreak() {
@@ -117,14 +117,14 @@ public Output<String> name() {
         return this.name;
     }
     /**
-     * The device os minimum version
+     * Minimum os version of the device in the device assurance policy.
      * 
      */
     @Export(name="osVersion", refs={String.class}, tree="[0]")
     private Output</* @Nullable */ String> osVersion;
 
     /**
-     * @return The device os minimum version
+     * @return Minimum os version of the device in the device assurance policy.
      * 
      */
     public Output<Optional<String>> osVersion() {
@@ -145,28 +145,28 @@ public Output<String> platform() {
         return this.platform;
     }
     /**
-     * List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      * 
      */
     @Export(name="screenlockTypes", refs={List.class,String.class}, tree="[0,1]")
     private Output</* @Nullable */ List<String>> screenlockTypes;
 
     /**
-     * @return List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * @return List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      * 
      */
     public Output<Optional<List<String>>> screenlockTypes() {
         return Codegen.optional(this.screenlockTypes);
     }
     /**
-     * Indicates if the device constains a secure hardware functionality
+     * Indicates if the device contains a secure hardware functionality
      * 
      */
     @Export(name="secureHardwarePresent", refs={Boolean.class}, tree="[0]")
     private Output</* @Nullable */ Boolean> secureHardwarePresent;
 
     /**
-     * @return Indicates if the device constains a secure hardware functionality
+     * @return Indicates if the device contains a secure hardware functionality
      * 
      */
     public Output<Optional<Boolean>> secureHardwarePresent() {
diff --git a/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceAndroidArgs.java b/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceAndroidArgs.java
index 3ffd1006..0ff8cfbf 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceAndroidArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceAndroidArgs.java
@@ -18,14 +18,14 @@ public final class DeviceAssuranceAndroidArgs extends com.pulumi.resources.Resou
     public static final DeviceAssuranceAndroidArgs Empty = new DeviceAssuranceAndroidArgs();
 
     /**
-     * List of disk encryption type, can be FULL, USER
+     * List of disk encryption type, can be `FULL`, `USER`
      * 
      */
     @Import(name="diskEncryptionTypes")
     private @Nullable Output<List<String>> diskEncryptionTypes;
 
     /**
-     * @return List of disk encryption type, can be FULL, USER
+     * @return List of disk encryption type, can be `FULL`, `USER`
      * 
      */
     public Optional<Output<List<String>>> diskEncryptionTypes() {
@@ -33,14 +33,14 @@ public Optional<Output<List<String>>> diskEncryptionTypes() {
     }
 
     /**
-     * The device jailbreak. Only for android and iOS platform
+     * Is the device jailbroken in the device assurance policy.
      * 
      */
     @Import(name="jailbreak")
     private @Nullable Output<Boolean> jailbreak;
 
     /**
-     * @return The device jailbreak. Only for android and iOS platform
+     * @return Is the device jailbroken in the device assurance policy.
      * 
      */
     public Optional<Output<Boolean>> jailbreak() {
@@ -63,14 +63,14 @@ public Optional<Output<String>> name() {
     }
 
     /**
-     * The device os minimum version
+     * Minimum os version of the device in the device assurance policy.
      * 
      */
     @Import(name="osVersion")
     private @Nullable Output<String> osVersion;
 
     /**
-     * @return The device os minimum version
+     * @return Minimum os version of the device in the device assurance policy.
      * 
      */
     public Optional<Output<String>> osVersion() {
@@ -78,14 +78,14 @@ public Optional<Output<String>> osVersion() {
     }
 
     /**
-     * List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      * 
      */
     @Import(name="screenlockTypes")
     private @Nullable Output<List<String>> screenlockTypes;
 
     /**
-     * @return List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * @return List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      * 
      */
     public Optional<Output<List<String>>> screenlockTypes() {
@@ -93,14 +93,14 @@ public Optional<Output<List<String>>> screenlockTypes() {
     }
 
     /**
-     * Indicates if the device constains a secure hardware functionality
+     * Indicates if the device contains a secure hardware functionality
      * 
      */
     @Import(name="secureHardwarePresent")
     private @Nullable Output<Boolean> secureHardwarePresent;
 
     /**
-     * @return Indicates if the device constains a secure hardware functionality
+     * @return Indicates if the device contains a secure hardware functionality
      * 
      */
     public Optional<Output<Boolean>> secureHardwarePresent() {
@@ -137,7 +137,7 @@ public Builder(DeviceAssuranceAndroidArgs defaults) {
         }
 
         /**
-         * @param diskEncryptionTypes List of disk encryption type, can be FULL, USER
+         * @param diskEncryptionTypes List of disk encryption type, can be `FULL`, `USER`
          * 
          * @return builder
          * 
@@ -148,7 +148,7 @@ public Builder diskEncryptionTypes(@Nullable Output<List<String>> diskEncryption
         }
 
         /**
-         * @param diskEncryptionTypes List of disk encryption type, can be FULL, USER
+         * @param diskEncryptionTypes List of disk encryption type, can be `FULL`, `USER`
          * 
          * @return builder
          * 
@@ -158,7 +158,7 @@ public Builder diskEncryptionTypes(List<String> diskEncryptionTypes) {
         }
 
         /**
-         * @param diskEncryptionTypes List of disk encryption type, can be FULL, USER
+         * @param diskEncryptionTypes List of disk encryption type, can be `FULL`, `USER`
          * 
          * @return builder
          * 
@@ -168,7 +168,7 @@ public Builder diskEncryptionTypes(String... diskEncryptionTypes) {
         }
 
         /**
-         * @param jailbreak The device jailbreak. Only for android and iOS platform
+         * @param jailbreak Is the device jailbroken in the device assurance policy.
          * 
          * @return builder
          * 
@@ -179,7 +179,7 @@ public Builder jailbreak(@Nullable Output<Boolean> jailbreak) {
         }
 
         /**
-         * @param jailbreak The device jailbreak. Only for android and iOS platform
+         * @param jailbreak Is the device jailbroken in the device assurance policy.
          * 
          * @return builder
          * 
@@ -210,7 +210,7 @@ public Builder name(String name) {
         }
 
         /**
-         * @param osVersion The device os minimum version
+         * @param osVersion Minimum os version of the device in the device assurance policy.
          * 
          * @return builder
          * 
@@ -221,7 +221,7 @@ public Builder osVersion(@Nullable Output<String> osVersion) {
         }
 
         /**
-         * @param osVersion The device os minimum version
+         * @param osVersion Minimum os version of the device in the device assurance policy.
          * 
          * @return builder
          * 
@@ -231,7 +231,7 @@ public Builder osVersion(String osVersion) {
         }
 
         /**
-         * @param screenlockTypes List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+         * @param screenlockTypes List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
          * 
          * @return builder
          * 
@@ -242,7 +242,7 @@ public Builder screenlockTypes(@Nullable Output<List<String>> screenlockTypes) {
         }
 
         /**
-         * @param screenlockTypes List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+         * @param screenlockTypes List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
          * 
          * @return builder
          * 
@@ -252,7 +252,7 @@ public Builder screenlockTypes(List<String> screenlockTypes) {
         }
 
         /**
-         * @param screenlockTypes List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+         * @param screenlockTypes List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
          * 
          * @return builder
          * 
@@ -262,7 +262,7 @@ public Builder screenlockTypes(String... screenlockTypes) {
         }
 
         /**
-         * @param secureHardwarePresent Indicates if the device constains a secure hardware functionality
+         * @param secureHardwarePresent Indicates if the device contains a secure hardware functionality
          * 
          * @return builder
          * 
@@ -273,7 +273,7 @@ public Builder secureHardwarePresent(@Nullable Output<Boolean> secureHardwarePre
         }
 
         /**
-         * @param secureHardwarePresent Indicates if the device constains a secure hardware functionality
+         * @param secureHardwarePresent Indicates if the device contains a secure hardware functionality
          * 
          * @return builder
          * 
diff --git a/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceChromeos.java b/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceChromeos.java
index ba292345..9a36d564 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceChromeos.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceChromeos.java
@@ -74,14 +74,14 @@ public Output<String> lastUpdatedBy() {
         return this.lastUpdatedBy;
     }
     /**
-     * Policy device assurance name
+     * Name of the device assurance policy.
      * 
      */
     @Export(name="name", refs={String.class}, tree="[0]")
     private Output<String> name;
 
     /**
-     * @return Policy device assurance name
+     * @return Name of the device assurance policy.
      * 
      */
     public Output<String> name() {
diff --git a/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceChromeosArgs.java b/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceChromeosArgs.java
index 663cd0e0..146499b7 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceChromeosArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceChromeosArgs.java
@@ -17,14 +17,14 @@ public final class DeviceAssuranceChromeosArgs extends com.pulumi.resources.Reso
     public static final DeviceAssuranceChromeosArgs Empty = new DeviceAssuranceChromeosArgs();
 
     /**
-     * Policy device assurance name
+     * Name of the device assurance policy.
      * 
      */
     @Import(name="name")
     private @Nullable Output<String> name;
 
     /**
-     * @return Policy device assurance name
+     * @return Name of the device assurance policy.
      * 
      */
     public Optional<Output<String>> name() {
@@ -280,7 +280,7 @@ public Builder(DeviceAssuranceChromeosArgs defaults) {
         }
 
         /**
-         * @param name Policy device assurance name
+         * @param name Name of the device assurance policy.
          * 
          * @return builder
          * 
@@ -291,7 +291,7 @@ public Builder name(@Nullable Output<String> name) {
         }
 
         /**
-         * @param name Policy device assurance name
+         * @param name Name of the device assurance policy.
          * 
          * @return builder
          * 
diff --git a/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceIos.java b/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceIos.java
index 33efa665..89dd3957 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceIos.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceIos.java
@@ -19,98 +19,98 @@
 @ResourceType(type="okta:policy/deviceAssuranceIos:DeviceAssuranceIos")
 public class DeviceAssuranceIos extends com.pulumi.resources.CustomResource {
     /**
-     * Created by
+     * Created by of the device assurance polic
      * 
      */
     @Export(name="createdBy", refs={String.class}, tree="[0]")
     private Output<String> createdBy;
 
     /**
-     * @return Created by
+     * @return Created by of the device assurance polic
      * 
      */
     public Output<String> createdBy() {
         return this.createdBy;
     }
     /**
-     * Created date
+     * Created date of the device assurance polic
      * 
      */
     @Export(name="createdDate", refs={String.class}, tree="[0]")
     private Output<String> createdDate;
 
     /**
-     * @return Created date
+     * @return Created date of the device assurance polic
      * 
      */
     public Output<String> createdDate() {
         return this.createdDate;
     }
     /**
-     * The device jailbreak. Only for android and iOS platform
+     * Is the device jailbroken in the device assurance policy.
      * 
      */
     @Export(name="jailbreak", refs={Boolean.class}, tree="[0]")
     private Output</* @Nullable */ Boolean> jailbreak;
 
     /**
-     * @return The device jailbreak. Only for android and iOS platform
+     * @return Is the device jailbroken in the device assurance policy.
      * 
      */
     public Output<Optional<Boolean>> jailbreak() {
         return Codegen.optional(this.jailbreak);
     }
     /**
-     * Last update
+     * Last update of the device assurance polic
      * 
      */
     @Export(name="lastUpdate", refs={String.class}, tree="[0]")
     private Output<String> lastUpdate;
 
     /**
-     * @return Last update
+     * @return Last update of the device assurance polic
      * 
      */
     public Output<String> lastUpdate() {
         return this.lastUpdate;
     }
     /**
-     * Last updated by
+     * Last updated by of the device assurance polic
      * 
      */
     @Export(name="lastUpdatedBy", refs={String.class}, tree="[0]")
     private Output<String> lastUpdatedBy;
 
     /**
-     * @return Last updated by
+     * @return Last updated by of the device assurance polic
      * 
      */
     public Output<String> lastUpdatedBy() {
         return this.lastUpdatedBy;
     }
     /**
-     * Policy device assurance name
+     * Name of the device assurance policy.
      * 
      */
     @Export(name="name", refs={String.class}, tree="[0]")
     private Output<String> name;
 
     /**
-     * @return Policy device assurance name
+     * @return Name of the device assurance policy.
      * 
      */
     public Output<String> name() {
         return this.name;
     }
     /**
-     * The device os minimum version
+     * Minimum os version of the device in the device assurance policy.
      * 
      */
     @Export(name="osVersion", refs={String.class}, tree="[0]")
     private Output</* @Nullable */ String> osVersion;
 
     /**
-     * @return The device os minimum version
+     * @return Minimum os version of the device in the device assurance policy.
      * 
      */
     public Output<Optional<String>> osVersion() {
@@ -131,14 +131,14 @@ public Output<String> platform() {
         return this.platform;
     }
     /**
-     * List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      * 
      */
     @Export(name="screenlockTypes", refs={List.class,String.class}, tree="[0,1]")
     private Output</* @Nullable */ List<String>> screenlockTypes;
 
     /**
-     * @return List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * @return List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      * 
      */
     public Output<Optional<List<String>>> screenlockTypes() {
diff --git a/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceIosArgs.java b/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceIosArgs.java
index a28a14b3..bae4f120 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceIosArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceIosArgs.java
@@ -18,14 +18,14 @@ public final class DeviceAssuranceIosArgs extends com.pulumi.resources.ResourceA
     public static final DeviceAssuranceIosArgs Empty = new DeviceAssuranceIosArgs();
 
     /**
-     * The device jailbreak. Only for android and iOS platform
+     * Is the device jailbroken in the device assurance policy.
      * 
      */
     @Import(name="jailbreak")
     private @Nullable Output<Boolean> jailbreak;
 
     /**
-     * @return The device jailbreak. Only for android and iOS platform
+     * @return Is the device jailbroken in the device assurance policy.
      * 
      */
     public Optional<Output<Boolean>> jailbreak() {
@@ -33,14 +33,14 @@ public Optional<Output<Boolean>> jailbreak() {
     }
 
     /**
-     * Policy device assurance name
+     * Name of the device assurance policy.
      * 
      */
     @Import(name="name")
     private @Nullable Output<String> name;
 
     /**
-     * @return Policy device assurance name
+     * @return Name of the device assurance policy.
      * 
      */
     public Optional<Output<String>> name() {
@@ -48,14 +48,14 @@ public Optional<Output<String>> name() {
     }
 
     /**
-     * The device os minimum version
+     * Minimum os version of the device in the device assurance policy.
      * 
      */
     @Import(name="osVersion")
     private @Nullable Output<String> osVersion;
 
     /**
-     * @return The device os minimum version
+     * @return Minimum os version of the device in the device assurance policy.
      * 
      */
     public Optional<Output<String>> osVersion() {
@@ -63,14 +63,14 @@ public Optional<Output<String>> osVersion() {
     }
 
     /**
-     * List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      * 
      */
     @Import(name="screenlockTypes")
     private @Nullable Output<List<String>> screenlockTypes;
 
     /**
-     * @return List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * @return List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      * 
      */
     public Optional<Output<List<String>>> screenlockTypes() {
@@ -105,7 +105,7 @@ public Builder(DeviceAssuranceIosArgs defaults) {
         }
 
         /**
-         * @param jailbreak The device jailbreak. Only for android and iOS platform
+         * @param jailbreak Is the device jailbroken in the device assurance policy.
          * 
          * @return builder
          * 
@@ -116,7 +116,7 @@ public Builder jailbreak(@Nullable Output<Boolean> jailbreak) {
         }
 
         /**
-         * @param jailbreak The device jailbreak. Only for android and iOS platform
+         * @param jailbreak Is the device jailbroken in the device assurance policy.
          * 
          * @return builder
          * 
@@ -126,7 +126,7 @@ public Builder jailbreak(Boolean jailbreak) {
         }
 
         /**
-         * @param name Policy device assurance name
+         * @param name Name of the device assurance policy.
          * 
          * @return builder
          * 
@@ -137,7 +137,7 @@ public Builder name(@Nullable Output<String> name) {
         }
 
         /**
-         * @param name Policy device assurance name
+         * @param name Name of the device assurance policy.
          * 
          * @return builder
          * 
@@ -147,7 +147,7 @@ public Builder name(String name) {
         }
 
         /**
-         * @param osVersion The device os minimum version
+         * @param osVersion Minimum os version of the device in the device assurance policy.
          * 
          * @return builder
          * 
@@ -158,7 +158,7 @@ public Builder osVersion(@Nullable Output<String> osVersion) {
         }
 
         /**
-         * @param osVersion The device os minimum version
+         * @param osVersion Minimum os version of the device in the device assurance policy.
          * 
          * @return builder
          * 
@@ -168,7 +168,7 @@ public Builder osVersion(String osVersion) {
         }
 
         /**
-         * @param screenlockTypes List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+         * @param screenlockTypes List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
          * 
          * @return builder
          * 
@@ -179,7 +179,7 @@ public Builder screenlockTypes(@Nullable Output<List<String>> screenlockTypes) {
         }
 
         /**
-         * @param screenlockTypes List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+         * @param screenlockTypes List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
          * 
          * @return builder
          * 
@@ -189,7 +189,7 @@ public Builder screenlockTypes(List<String> screenlockTypes) {
         }
 
         /**
-         * @param screenlockTypes List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+         * @param screenlockTypes List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
          * 
          * @return builder
          * 
diff --git a/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceMacos.java b/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceMacos.java
index d2111617..840aa052 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceMacos.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceMacos.java
@@ -47,14 +47,14 @@ public Output<String> createdDate() {
         return this.createdDate;
     }
     /**
-     * List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+     * List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
      * 
      */
     @Export(name="diskEncryptionTypes", refs={List.class,String.class}, tree="[0,1]")
     private Output</* @Nullable */ List<String>> diskEncryptionTypes;
 
     /**
-     * @return List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+     * @return List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
      * 
      */
     public Output<Optional<List<String>>> diskEncryptionTypes() {
@@ -89,28 +89,28 @@ public Output<String> lastUpdatedBy() {
         return this.lastUpdatedBy;
     }
     /**
-     * Policy device assurance name
+     * Name of the device assurance policy.
      * 
      */
     @Export(name="name", refs={String.class}, tree="[0]")
     private Output<String> name;
 
     /**
-     * @return Policy device assurance name
+     * @return Name of the device assurance policy.
      * 
      */
     public Output<String> name() {
         return this.name;
     }
     /**
-     * The device os minimum version
+     * Minimum os version of the device in the device assurance policy.
      * 
      */
     @Export(name="osVersion", refs={String.class}, tree="[0]")
     private Output</* @Nullable */ String> osVersion;
 
     /**
-     * @return The device os minimum version
+     * @return Minimum os version of the device in the device assurance policy.
      * 
      */
     public Output<Optional<String>> osVersion() {
@@ -131,28 +131,28 @@ public Output<String> platform() {
         return this.platform;
     }
     /**
-     * List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      * 
      */
     @Export(name="screenlockTypes", refs={List.class,String.class}, tree="[0,1]")
     private Output</* @Nullable */ List<String>> screenlockTypes;
 
     /**
-     * @return List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * @return List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      * 
      */
     public Output<Optional<List<String>>> screenlockTypes() {
         return Codegen.optional(this.screenlockTypes);
     }
     /**
-     * Indicates if the device constains a secure hardware functionality
+     * Is the device secure with hardware in the device assurance policy.
      * 
      */
     @Export(name="secureHardwarePresent", refs={Boolean.class}, tree="[0]")
     private Output</* @Nullable */ Boolean> secureHardwarePresent;
 
     /**
-     * @return Indicates if the device constains a secure hardware functionality
+     * @return Is the device secure with hardware in the device assurance policy.
      * 
      */
     public Output<Optional<Boolean>> secureHardwarePresent() {
diff --git a/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceMacosArgs.java b/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceMacosArgs.java
index 6e53f30e..826743f1 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceMacosArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceMacosArgs.java
@@ -18,14 +18,14 @@ public final class DeviceAssuranceMacosArgs extends com.pulumi.resources.Resourc
     public static final DeviceAssuranceMacosArgs Empty = new DeviceAssuranceMacosArgs();
 
     /**
-     * List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+     * List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
      * 
      */
     @Import(name="diskEncryptionTypes")
     private @Nullable Output<List<String>> diskEncryptionTypes;
 
     /**
-     * @return List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+     * @return List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
      * 
      */
     public Optional<Output<List<String>>> diskEncryptionTypes() {
@@ -33,14 +33,14 @@ public Optional<Output<List<String>>> diskEncryptionTypes() {
     }
 
     /**
-     * Policy device assurance name
+     * Name of the device assurance policy.
      * 
      */
     @Import(name="name")
     private @Nullable Output<String> name;
 
     /**
-     * @return Policy device assurance name
+     * @return Name of the device assurance policy.
      * 
      */
     public Optional<Output<String>> name() {
@@ -48,14 +48,14 @@ public Optional<Output<String>> name() {
     }
 
     /**
-     * The device os minimum version
+     * Minimum os version of the device in the device assurance policy.
      * 
      */
     @Import(name="osVersion")
     private @Nullable Output<String> osVersion;
 
     /**
-     * @return The device os minimum version
+     * @return Minimum os version of the device in the device assurance policy.
      * 
      */
     public Optional<Output<String>> osVersion() {
@@ -63,14 +63,14 @@ public Optional<Output<String>> osVersion() {
     }
 
     /**
-     * List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      * 
      */
     @Import(name="screenlockTypes")
     private @Nullable Output<List<String>> screenlockTypes;
 
     /**
-     * @return List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * @return List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      * 
      */
     public Optional<Output<List<String>>> screenlockTypes() {
@@ -78,14 +78,14 @@ public Optional<Output<List<String>>> screenlockTypes() {
     }
 
     /**
-     * Indicates if the device constains a secure hardware functionality
+     * Is the device secure with hardware in the device assurance policy.
      * 
      */
     @Import(name="secureHardwarePresent")
     private @Nullable Output<Boolean> secureHardwarePresent;
 
     /**
-     * @return Indicates if the device constains a secure hardware functionality
+     * @return Is the device secure with hardware in the device assurance policy.
      * 
      */
     public Optional<Output<Boolean>> secureHardwarePresent() {
@@ -345,7 +345,7 @@ public Builder(DeviceAssuranceMacosArgs defaults) {
         }
 
         /**
-         * @param diskEncryptionTypes List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+         * @param diskEncryptionTypes List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
          * 
          * @return builder
          * 
@@ -356,7 +356,7 @@ public Builder diskEncryptionTypes(@Nullable Output<List<String>> diskEncryption
         }
 
         /**
-         * @param diskEncryptionTypes List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+         * @param diskEncryptionTypes List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
          * 
          * @return builder
          * 
@@ -366,7 +366,7 @@ public Builder diskEncryptionTypes(List<String> diskEncryptionTypes) {
         }
 
         /**
-         * @param diskEncryptionTypes List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+         * @param diskEncryptionTypes List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
          * 
          * @return builder
          * 
@@ -376,7 +376,7 @@ public Builder diskEncryptionTypes(String... diskEncryptionTypes) {
         }
 
         /**
-         * @param name Policy device assurance name
+         * @param name Name of the device assurance policy.
          * 
          * @return builder
          * 
@@ -387,7 +387,7 @@ public Builder name(@Nullable Output<String> name) {
         }
 
         /**
-         * @param name Policy device assurance name
+         * @param name Name of the device assurance policy.
          * 
          * @return builder
          * 
@@ -397,7 +397,7 @@ public Builder name(String name) {
         }
 
         /**
-         * @param osVersion The device os minimum version
+         * @param osVersion Minimum os version of the device in the device assurance policy.
          * 
          * @return builder
          * 
@@ -408,7 +408,7 @@ public Builder osVersion(@Nullable Output<String> osVersion) {
         }
 
         /**
-         * @param osVersion The device os minimum version
+         * @param osVersion Minimum os version of the device in the device assurance policy.
          * 
          * @return builder
          * 
@@ -418,7 +418,7 @@ public Builder osVersion(String osVersion) {
         }
 
         /**
-         * @param screenlockTypes List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+         * @param screenlockTypes List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
          * 
          * @return builder
          * 
@@ -429,7 +429,7 @@ public Builder screenlockTypes(@Nullable Output<List<String>> screenlockTypes) {
         }
 
         /**
-         * @param screenlockTypes List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+         * @param screenlockTypes List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
          * 
          * @return builder
          * 
@@ -439,7 +439,7 @@ public Builder screenlockTypes(List<String> screenlockTypes) {
         }
 
         /**
-         * @param screenlockTypes List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+         * @param screenlockTypes List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
          * 
          * @return builder
          * 
@@ -449,7 +449,7 @@ public Builder screenlockTypes(String... screenlockTypes) {
         }
 
         /**
-         * @param secureHardwarePresent Indicates if the device constains a secure hardware functionality
+         * @param secureHardwarePresent Is the device secure with hardware in the device assurance policy.
          * 
          * @return builder
          * 
@@ -460,7 +460,7 @@ public Builder secureHardwarePresent(@Nullable Output<Boolean> secureHardwarePre
         }
 
         /**
-         * @param secureHardwarePresent Indicates if the device constains a secure hardware functionality
+         * @param secureHardwarePresent Is the device secure with hardware in the device assurance policy.
          * 
          * @return builder
          * 
diff --git a/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceWindows.java b/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceWindows.java
index 9f95d25e..be6174f6 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceWindows.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceWindows.java
@@ -47,14 +47,14 @@ public Output<String> createdDate() {
         return this.createdDate;
     }
     /**
-     * List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+     * List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
      * 
      */
     @Export(name="diskEncryptionTypes", refs={List.class,String.class}, tree="[0,1]")
     private Output</* @Nullable */ List<String>> diskEncryptionTypes;
 
     /**
-     * @return List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+     * @return List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
      * 
      */
     public Output<Optional<List<String>>> diskEncryptionTypes() {
@@ -89,28 +89,28 @@ public Output<String> lastUpdatedBy() {
         return this.lastUpdatedBy;
     }
     /**
-     * Policy device assurance name
+     * Name of the device assurance policy.
      * 
      */
     @Export(name="name", refs={String.class}, tree="[0]")
     private Output<String> name;
 
     /**
-     * @return Policy device assurance name
+     * @return Name of the device assurance policy.
      * 
      */
     public Output<String> name() {
         return this.name;
     }
     /**
-     * The device os minimum version
+     * Minimum os version of the device in the device assurance policy.
      * 
      */
     @Export(name="osVersion", refs={String.class}, tree="[0]")
     private Output</* @Nullable */ String> osVersion;
 
     /**
-     * @return The device os minimum version
+     * @return Minimum os version of the device in the device assurance policy.
      * 
      */
     public Output<Optional<String>> osVersion() {
@@ -131,28 +131,28 @@ public Output<String> platform() {
         return this.platform;
     }
     /**
-     * List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      * 
      */
     @Export(name="screenlockTypes", refs={List.class,String.class}, tree="[0,1]")
     private Output</* @Nullable */ List<String>> screenlockTypes;
 
     /**
-     * @return List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * @return List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      * 
      */
     public Output<Optional<List<String>>> screenlockTypes() {
         return Codegen.optional(this.screenlockTypes);
     }
     /**
-     * Indicates if the device constains a secure hardware functionality
+     * Is the device secure with hardware in the device assurance policy.
      * 
      */
     @Export(name="secureHardwarePresent", refs={Boolean.class}, tree="[0]")
     private Output</* @Nullable */ Boolean> secureHardwarePresent;
 
     /**
-     * @return Indicates if the device constains a secure hardware functionality
+     * @return Is the device secure with hardware in the device assurance policy.
      * 
      */
     public Output<Optional<Boolean>> secureHardwarePresent() {
diff --git a/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceWindowsArgs.java b/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceWindowsArgs.java
index 83385272..d01912ef 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceWindowsArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/policy/DeviceAssuranceWindowsArgs.java
@@ -18,14 +18,14 @@ public final class DeviceAssuranceWindowsArgs extends com.pulumi.resources.Resou
     public static final DeviceAssuranceWindowsArgs Empty = new DeviceAssuranceWindowsArgs();
 
     /**
-     * List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+     * List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
      * 
      */
     @Import(name="diskEncryptionTypes")
     private @Nullable Output<List<String>> diskEncryptionTypes;
 
     /**
-     * @return List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+     * @return List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
      * 
      */
     public Optional<Output<List<String>>> diskEncryptionTypes() {
@@ -33,14 +33,14 @@ public Optional<Output<List<String>>> diskEncryptionTypes() {
     }
 
     /**
-     * Policy device assurance name
+     * Name of the device assurance policy.
      * 
      */
     @Import(name="name")
     private @Nullable Output<String> name;
 
     /**
-     * @return Policy device assurance name
+     * @return Name of the device assurance policy.
      * 
      */
     public Optional<Output<String>> name() {
@@ -48,14 +48,14 @@ public Optional<Output<String>> name() {
     }
 
     /**
-     * The device os minimum version
+     * Minimum os version of the device in the device assurance policy.
      * 
      */
     @Import(name="osVersion")
     private @Nullable Output<String> osVersion;
 
     /**
-     * @return The device os minimum version
+     * @return Minimum os version of the device in the device assurance policy.
      * 
      */
     public Optional<Output<String>> osVersion() {
@@ -63,14 +63,14 @@ public Optional<Output<String>> osVersion() {
     }
 
     /**
-     * List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      * 
      */
     @Import(name="screenlockTypes")
     private @Nullable Output<List<String>> screenlockTypes;
 
     /**
-     * @return List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * @return List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      * 
      */
     public Optional<Output<List<String>>> screenlockTypes() {
@@ -78,14 +78,14 @@ public Optional<Output<List<String>>> screenlockTypes() {
     }
 
     /**
-     * Indicates if the device constains a secure hardware functionality
+     * Is the device secure with hardware in the device assurance policy.
      * 
      */
     @Import(name="secureHardwarePresent")
     private @Nullable Output<Boolean> secureHardwarePresent;
 
     /**
-     * @return Indicates if the device constains a secure hardware functionality
+     * @return Is the device secure with hardware in the device assurance policy.
      * 
      */
     public Optional<Output<Boolean>> secureHardwarePresent() {
@@ -441,7 +441,7 @@ public Builder(DeviceAssuranceWindowsArgs defaults) {
         }
 
         /**
-         * @param diskEncryptionTypes List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+         * @param diskEncryptionTypes List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
          * 
          * @return builder
          * 
@@ -452,7 +452,7 @@ public Builder diskEncryptionTypes(@Nullable Output<List<String>> diskEncryption
         }
 
         /**
-         * @param diskEncryptionTypes List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+         * @param diskEncryptionTypes List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
          * 
          * @return builder
          * 
@@ -462,7 +462,7 @@ public Builder diskEncryptionTypes(List<String> diskEncryptionTypes) {
         }
 
         /**
-         * @param diskEncryptionTypes List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+         * @param diskEncryptionTypes List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
          * 
          * @return builder
          * 
@@ -472,7 +472,7 @@ public Builder diskEncryptionTypes(String... diskEncryptionTypes) {
         }
 
         /**
-         * @param name Policy device assurance name
+         * @param name Name of the device assurance policy.
          * 
          * @return builder
          * 
@@ -483,7 +483,7 @@ public Builder name(@Nullable Output<String> name) {
         }
 
         /**
-         * @param name Policy device assurance name
+         * @param name Name of the device assurance policy.
          * 
          * @return builder
          * 
@@ -493,7 +493,7 @@ public Builder name(String name) {
         }
 
         /**
-         * @param osVersion The device os minimum version
+         * @param osVersion Minimum os version of the device in the device assurance policy.
          * 
          * @return builder
          * 
@@ -504,7 +504,7 @@ public Builder osVersion(@Nullable Output<String> osVersion) {
         }
 
         /**
-         * @param osVersion The device os minimum version
+         * @param osVersion Minimum os version of the device in the device assurance policy.
          * 
          * @return builder
          * 
@@ -514,7 +514,7 @@ public Builder osVersion(String osVersion) {
         }
 
         /**
-         * @param screenlockTypes List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+         * @param screenlockTypes List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
          * 
          * @return builder
          * 
@@ -525,7 +525,7 @@ public Builder screenlockTypes(@Nullable Output<List<String>> screenlockTypes) {
         }
 
         /**
-         * @param screenlockTypes List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+         * @param screenlockTypes List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
          * 
          * @return builder
          * 
@@ -535,7 +535,7 @@ public Builder screenlockTypes(List<String> screenlockTypes) {
         }
 
         /**
-         * @param screenlockTypes List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+         * @param screenlockTypes List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
          * 
          * @return builder
          * 
@@ -545,7 +545,7 @@ public Builder screenlockTypes(String... screenlockTypes) {
         }
 
         /**
-         * @param secureHardwarePresent Indicates if the device constains a secure hardware functionality
+         * @param secureHardwarePresent Is the device secure with hardware in the device assurance policy.
          * 
          * @return builder
          * 
@@ -556,7 +556,7 @@ public Builder secureHardwarePresent(@Nullable Output<Boolean> secureHardwarePre
         }
 
         /**
-         * @param secureHardwarePresent Indicates if the device constains a secure hardware functionality
+         * @param secureHardwarePresent Is the device secure with hardware in the device assurance policy.
          * 
          * @return builder
          * 
diff --git a/sdk/java/src/main/java/com/pulumi/okta/policy/RuleIdpDiscovery.java b/sdk/java/src/main/java/com/pulumi/okta/policy/RuleIdpDiscovery.java
index b7e99d95..171b4deb 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/policy/RuleIdpDiscovery.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/policy/RuleIdpDiscovery.java
@@ -277,9 +277,21 @@ public Output<Optional<List<String>>> networkExcludes() {
     public Output<Optional<List<String>>> networkIncludes() {
         return Codegen.optional(this.networkIncludes);
     }
+    /**
+     * Platform to include in discovery rule. - &#39;type&#39; - (Optional) One of: &#39;ANY&#39;, &#39;MOBILE&#39;, &#39;DESKTOP&#39; - &#39;os_expression -
+     * (Optional) Only available when using os_type = &#39;OTHER&#39; - &#39;os_type&#39; - (Optional) One of: &#39;ANY&#39;, &#39;IOS&#39;, &#39;WINDOWS&#39;,
+     * &#39;ANDROID&#39;, &#39;OTHER&#39;, &#39;OSX&#39;
+     * 
+     */
     @Export(name="platformIncludes", refs={List.class,RuleIdpDiscoveryPlatformInclude.class}, tree="[0,1]")
     private Output</* @Nullable */ List<RuleIdpDiscoveryPlatformInclude>> platformIncludes;
 
+    /**
+     * @return Platform to include in discovery rule. - &#39;type&#39; - (Optional) One of: &#39;ANY&#39;, &#39;MOBILE&#39;, &#39;DESKTOP&#39; - &#39;os_expression -
+     * (Optional) Only available when using os_type = &#39;OTHER&#39; - &#39;os_type&#39; - (Optional) One of: &#39;ANY&#39;, &#39;IOS&#39;, &#39;WINDOWS&#39;,
+     * &#39;ANDROID&#39;, &#39;OTHER&#39;, &#39;OSX&#39;
+     * 
+     */
     public Output<Optional<List<RuleIdpDiscoveryPlatformInclude>>> platformIncludes() {
         return Codegen.optional(this.platformIncludes);
     }
diff --git a/sdk/java/src/main/java/com/pulumi/okta/policy/RuleIdpDiscoveryArgs.java b/sdk/java/src/main/java/com/pulumi/okta/policy/RuleIdpDiscoveryArgs.java
index 4b67b8d9..84f05ba5 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/policy/RuleIdpDiscoveryArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/policy/RuleIdpDiscoveryArgs.java
@@ -191,9 +191,21 @@ public Optional<Output<List<String>>> networkIncludes() {
         return Optional.ofNullable(this.networkIncludes);
     }
 
+    /**
+     * Platform to include in discovery rule. - &#39;type&#39; - (Optional) One of: &#39;ANY&#39;, &#39;MOBILE&#39;, &#39;DESKTOP&#39; - &#39;os_expression -
+     * (Optional) Only available when using os_type = &#39;OTHER&#39; - &#39;os_type&#39; - (Optional) One of: &#39;ANY&#39;, &#39;IOS&#39;, &#39;WINDOWS&#39;,
+     * &#39;ANDROID&#39;, &#39;OTHER&#39;, &#39;OSX&#39;
+     * 
+     */
     @Import(name="platformIncludes")
     private @Nullable Output<List<RuleIdpDiscoveryPlatformIncludeArgs>> platformIncludes;
 
+    /**
+     * @return Platform to include in discovery rule. - &#39;type&#39; - (Optional) One of: &#39;ANY&#39;, &#39;MOBILE&#39;, &#39;DESKTOP&#39; - &#39;os_expression -
+     * (Optional) Only available when using os_type = &#39;OTHER&#39; - &#39;os_type&#39; - (Optional) One of: &#39;ANY&#39;, &#39;IOS&#39;, &#39;WINDOWS&#39;,
+     * &#39;ANDROID&#39;, &#39;OTHER&#39;, &#39;OSX&#39;
+     * 
+     */
     public Optional<Output<List<RuleIdpDiscoveryPlatformIncludeArgs>>> platformIncludes() {
         return Optional.ofNullable(this.platformIncludes);
     }
@@ -609,15 +621,39 @@ public Builder networkIncludes(String... networkIncludes) {
             return networkIncludes(List.of(networkIncludes));
         }
 
+        /**
+         * @param platformIncludes Platform to include in discovery rule. - &#39;type&#39; - (Optional) One of: &#39;ANY&#39;, &#39;MOBILE&#39;, &#39;DESKTOP&#39; - &#39;os_expression -
+         * (Optional) Only available when using os_type = &#39;OTHER&#39; - &#39;os_type&#39; - (Optional) One of: &#39;ANY&#39;, &#39;IOS&#39;, &#39;WINDOWS&#39;,
+         * &#39;ANDROID&#39;, &#39;OTHER&#39;, &#39;OSX&#39;
+         * 
+         * @return builder
+         * 
+         */
         public Builder platformIncludes(@Nullable Output<List<RuleIdpDiscoveryPlatformIncludeArgs>> platformIncludes) {
             $.platformIncludes = platformIncludes;
             return this;
         }
 
+        /**
+         * @param platformIncludes Platform to include in discovery rule. - &#39;type&#39; - (Optional) One of: &#39;ANY&#39;, &#39;MOBILE&#39;, &#39;DESKTOP&#39; - &#39;os_expression -
+         * (Optional) Only available when using os_type = &#39;OTHER&#39; - &#39;os_type&#39; - (Optional) One of: &#39;ANY&#39;, &#39;IOS&#39;, &#39;WINDOWS&#39;,
+         * &#39;ANDROID&#39;, &#39;OTHER&#39;, &#39;OSX&#39;
+         * 
+         * @return builder
+         * 
+         */
         public Builder platformIncludes(List<RuleIdpDiscoveryPlatformIncludeArgs> platformIncludes) {
             return platformIncludes(Output.of(platformIncludes));
         }
 
+        /**
+         * @param platformIncludes Platform to include in discovery rule. - &#39;type&#39; - (Optional) One of: &#39;ANY&#39;, &#39;MOBILE&#39;, &#39;DESKTOP&#39; - &#39;os_expression -
+         * (Optional) Only available when using os_type = &#39;OTHER&#39; - &#39;os_type&#39; - (Optional) One of: &#39;ANY&#39;, &#39;IOS&#39;, &#39;WINDOWS&#39;,
+         * &#39;ANDROID&#39;, &#39;OTHER&#39;, &#39;OSX&#39;
+         * 
+         * @return builder
+         * 
+         */
         public Builder platformIncludes(RuleIdpDiscoveryPlatformIncludeArgs... platformIncludes) {
             return platformIncludes(List.of(platformIncludes));
         }
diff --git a/sdk/java/src/main/java/com/pulumi/okta/policy/RuleMfa.java b/sdk/java/src/main/java/com/pulumi/okta/policy/RuleMfa.java
index d5286658..0e26c346 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/policy/RuleMfa.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/policy/RuleMfa.java
@@ -320,14 +320,20 @@
 @ResourceType(type="okta:policy/ruleMfa:RuleMfa")
 public class RuleMfa extends com.pulumi.resources.CustomResource {
     /**
-     * Applications to exclude
+     * Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations. - &#39;id&#39;
+     * - (Optional) Use if &#39;type&#39; is &#39;APP&#39; to indicate the application id to include. - &#39;name&#39; - (Optional) Use if the &#39;type&#39;
+     *   is &#39;APP_TYPE&#39; to indicate the type of application(s) to include in instances where an entire group (i.e. &#39;yahoo_mail&#39;)
+     *   of applications should be included. - &#39;type&#39; - (Required) One of: &#39;APP&#39;, &#39;APP_TYPE&#39;
      * 
      */
     @Export(name="appExcludes", refs={List.class,RuleMfaAppExclude.class}, tree="[0,1]")
     private Output</* @Nullable */ List<RuleMfaAppExclude>> appExcludes;
 
     /**
-     * @return Applications to exclude
+     * @return Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations. - &#39;id&#39;
+     * - (Optional) Use if &#39;type&#39; is &#39;APP&#39; to indicate the application id to include. - &#39;name&#39; - (Optional) Use if the &#39;type&#39;
+     *   is &#39;APP_TYPE&#39; to indicate the type of application(s) to include in instances where an entire group (i.e. &#39;yahoo_mail&#39;)
+     *   of applications should be included. - &#39;type&#39; - (Required) One of: &#39;APP&#39;, &#39;APP_TYPE&#39;
      * 
      */
     public Output<Optional<List<RuleMfaAppExclude>>> appExcludes() {
diff --git a/sdk/java/src/main/java/com/pulumi/okta/policy/RuleMfaArgs.java b/sdk/java/src/main/java/com/pulumi/okta/policy/RuleMfaArgs.java
index da148ef6..a999ae7e 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/policy/RuleMfaArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/policy/RuleMfaArgs.java
@@ -20,14 +20,20 @@ public final class RuleMfaArgs extends com.pulumi.resources.ResourceArgs {
     public static final RuleMfaArgs Empty = new RuleMfaArgs();
 
     /**
-     * Applications to exclude
+     * Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations. - &#39;id&#39;
+     * - (Optional) Use if &#39;type&#39; is &#39;APP&#39; to indicate the application id to include. - &#39;name&#39; - (Optional) Use if the &#39;type&#39;
+     *   is &#39;APP_TYPE&#39; to indicate the type of application(s) to include in instances where an entire group (i.e. &#39;yahoo_mail&#39;)
+     *   of applications should be included. - &#39;type&#39; - (Required) One of: &#39;APP&#39;, &#39;APP_TYPE&#39;
      * 
      */
     @Import(name="appExcludes")
     private @Nullable Output<List<RuleMfaAppExcludeArgs>> appExcludes;
 
     /**
-     * @return Applications to exclude
+     * @return Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations. - &#39;id&#39;
+     * - (Optional) Use if &#39;type&#39; is &#39;APP&#39; to indicate the application id to include. - &#39;name&#39; - (Optional) Use if the &#39;type&#39;
+     *   is &#39;APP_TYPE&#39; to indicate the type of application(s) to include in instances where an entire group (i.e. &#39;yahoo_mail&#39;)
+     *   of applications should be included. - &#39;type&#39; - (Required) One of: &#39;APP&#39;, &#39;APP_TYPE&#39;
      * 
      */
     public Optional<Output<List<RuleMfaAppExcludeArgs>>> appExcludes() {
@@ -219,7 +225,10 @@ public Builder(RuleMfaArgs defaults) {
         }
 
         /**
-         * @param appExcludes Applications to exclude
+         * @param appExcludes Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations. - &#39;id&#39;
+         * - (Optional) Use if &#39;type&#39; is &#39;APP&#39; to indicate the application id to include. - &#39;name&#39; - (Optional) Use if the &#39;type&#39;
+         *   is &#39;APP_TYPE&#39; to indicate the type of application(s) to include in instances where an entire group (i.e. &#39;yahoo_mail&#39;)
+         *   of applications should be included. - &#39;type&#39; - (Required) One of: &#39;APP&#39;, &#39;APP_TYPE&#39;
          * 
          * @return builder
          * 
@@ -230,7 +239,10 @@ public Builder appExcludes(@Nullable Output<List<RuleMfaAppExcludeArgs>> appExcl
         }
 
         /**
-         * @param appExcludes Applications to exclude
+         * @param appExcludes Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations. - &#39;id&#39;
+         * - (Optional) Use if &#39;type&#39; is &#39;APP&#39; to indicate the application id to include. - &#39;name&#39; - (Optional) Use if the &#39;type&#39;
+         *   is &#39;APP_TYPE&#39; to indicate the type of application(s) to include in instances where an entire group (i.e. &#39;yahoo_mail&#39;)
+         *   of applications should be included. - &#39;type&#39; - (Required) One of: &#39;APP&#39;, &#39;APP_TYPE&#39;
          * 
          * @return builder
          * 
@@ -240,7 +252,10 @@ public Builder appExcludes(List<RuleMfaAppExcludeArgs> appExcludes) {
         }
 
         /**
-         * @param appExcludes Applications to exclude
+         * @param appExcludes Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations. - &#39;id&#39;
+         * - (Optional) Use if &#39;type&#39; is &#39;APP&#39; to indicate the application id to include. - &#39;name&#39; - (Optional) Use if the &#39;type&#39;
+         *   is &#39;APP_TYPE&#39; to indicate the type of application(s) to include in instances where an entire group (i.e. &#39;yahoo_mail&#39;)
+         *   of applications should be included. - &#39;type&#39; - (Required) One of: &#39;APP&#39;, &#39;APP_TYPE&#39;
          * 
          * @return builder
          * 
diff --git a/sdk/java/src/main/java/com/pulumi/okta/policy/RuleSignon.java b/sdk/java/src/main/java/com/pulumi/okta/policy/RuleSignon.java
index 15a2443a..449c0689 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/policy/RuleSignon.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/policy/RuleSignon.java
@@ -388,7 +388,11 @@ public Output<Optional<Integer>> priority() {
      * Risc level: `&#34;ANY&#34;`, `&#34;LOW&#34;`, `&#34;MEDIUM&#34;` or `&#34;HIGH&#34;`. Default is `&#34;ANY&#34;`. It can be also
      * set to an empty string in case `RISC_SCORING` org feature flag is disabled.
      * 
+     * @deprecated
+     * Attribute typo, switch to risk_level instead. Default: `ANY`
+     * 
      */
+    @Deprecated /* Attribute typo, switch to risk_level instead. Default: `ANY` */
     @Export(name="riscLevel", refs={String.class}, tree="[0]")
     private Output</* @Nullable */ String> riscLevel;
 
@@ -400,6 +404,20 @@ public Output<Optional<Integer>> priority() {
     public Output<Optional<String>> riscLevel() {
         return Codegen.optional(this.riscLevel);
     }
+    /**
+     * Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
+     * 
+     */
+    @Export(name="riskLevel", refs={String.class}, tree="[0]")
+    private Output</* @Nullable */ String> riskLevel;
+
+    /**
+     * @return Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
+     * 
+     */
+    public Output<Optional<String>> riskLevel() {
+        return Codegen.optional(this.riskLevel);
+    }
     /**
      * Max minutes a session can be idle.,
      * 
diff --git a/sdk/java/src/main/java/com/pulumi/okta/policy/RuleSignonArgs.java b/sdk/java/src/main/java/com/pulumi/okta/policy/RuleSignonArgs.java
index 33a67ac2..34b35f23 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/policy/RuleSignonArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/policy/RuleSignonArgs.java
@@ -284,7 +284,11 @@ public Optional<Output<Integer>> priority() {
      * Risc level: `&#34;ANY&#34;`, `&#34;LOW&#34;`, `&#34;MEDIUM&#34;` or `&#34;HIGH&#34;`. Default is `&#34;ANY&#34;`. It can be also
      * set to an empty string in case `RISC_SCORING` org feature flag is disabled.
      * 
+     * @deprecated
+     * Attribute typo, switch to risk_level instead. Default: `ANY`
+     * 
      */
+    @Deprecated /* Attribute typo, switch to risk_level instead. Default: `ANY` */
     @Import(name="riscLevel")
     private @Nullable Output<String> riscLevel;
 
@@ -292,11 +296,30 @@ public Optional<Output<Integer>> priority() {
      * @return Risc level: `&#34;ANY&#34;`, `&#34;LOW&#34;`, `&#34;MEDIUM&#34;` or `&#34;HIGH&#34;`. Default is `&#34;ANY&#34;`. It can be also
      * set to an empty string in case `RISC_SCORING` org feature flag is disabled.
      * 
+     * @deprecated
+     * Attribute typo, switch to risk_level instead. Default: `ANY`
+     * 
      */
+    @Deprecated /* Attribute typo, switch to risk_level instead. Default: `ANY` */
     public Optional<Output<String>> riscLevel() {
         return Optional.ofNullable(this.riscLevel);
     }
 
+    /**
+     * Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
+     * 
+     */
+    @Import(name="riskLevel")
+    private @Nullable Output<String> riskLevel;
+
+    /**
+     * @return Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
+     * 
+     */
+    public Optional<Output<String>> riskLevel() {
+        return Optional.ofNullable(this.riskLevel);
+    }
+
     /**
      * Max minutes a session can be idle.,
      * 
@@ -393,6 +416,7 @@ private RuleSignonArgs(RuleSignonArgs $) {
         this.primaryFactor = $.primaryFactor;
         this.priority = $.priority;
         this.riscLevel = $.riscLevel;
+        this.riskLevel = $.riskLevel;
         this.sessionIdle = $.sessionIdle;
         this.sessionLifetime = $.sessionLifetime;
         this.sessionPersistent = $.sessionPersistent;
@@ -837,7 +861,11 @@ public Builder priority(Integer priority) {
          * 
          * @return builder
          * 
+         * @deprecated
+         * Attribute typo, switch to risk_level instead. Default: `ANY`
+         * 
          */
+        @Deprecated /* Attribute typo, switch to risk_level instead. Default: `ANY` */
         public Builder riscLevel(@Nullable Output<String> riscLevel) {
             $.riscLevel = riscLevel;
             return this;
@@ -849,11 +877,36 @@ public Builder riscLevel(@Nullable Output<String> riscLevel) {
          * 
          * @return builder
          * 
+         * @deprecated
+         * Attribute typo, switch to risk_level instead. Default: `ANY`
+         * 
          */
+        @Deprecated /* Attribute typo, switch to risk_level instead. Default: `ANY` */
         public Builder riscLevel(String riscLevel) {
             return riscLevel(Output.of(riscLevel));
         }
 
+        /**
+         * @param riskLevel Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
+         * 
+         * @return builder
+         * 
+         */
+        public Builder riskLevel(@Nullable Output<String> riskLevel) {
+            $.riskLevel = riskLevel;
+            return this;
+        }
+
+        /**
+         * @param riskLevel Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
+         * 
+         * @return builder
+         * 
+         */
+        public Builder riskLevel(String riskLevel) {
+            return riskLevel(Output.of(riskLevel));
+        }
+
         /**
          * @param sessionIdle Max minutes a session can be idle.,
          * 
diff --git a/sdk/java/src/main/java/com/pulumi/okta/policy/inputs/DeviceAssuranceAndroidState.java b/sdk/java/src/main/java/com/pulumi/okta/policy/inputs/DeviceAssuranceAndroidState.java
index 61214228..0473f697 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/policy/inputs/DeviceAssuranceAndroidState.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/policy/inputs/DeviceAssuranceAndroidState.java
@@ -48,14 +48,14 @@ public Optional<Output<String>> createdDate() {
     }
 
     /**
-     * List of disk encryption type, can be FULL, USER
+     * List of disk encryption type, can be `FULL`, `USER`
      * 
      */
     @Import(name="diskEncryptionTypes")
     private @Nullable Output<List<String>> diskEncryptionTypes;
 
     /**
-     * @return List of disk encryption type, can be FULL, USER
+     * @return List of disk encryption type, can be `FULL`, `USER`
      * 
      */
     public Optional<Output<List<String>>> diskEncryptionTypes() {
@@ -63,14 +63,14 @@ public Optional<Output<List<String>>> diskEncryptionTypes() {
     }
 
     /**
-     * The device jailbreak. Only for android and iOS platform
+     * Is the device jailbroken in the device assurance policy.
      * 
      */
     @Import(name="jailbreak")
     private @Nullable Output<Boolean> jailbreak;
 
     /**
-     * @return The device jailbreak. Only for android and iOS platform
+     * @return Is the device jailbroken in the device assurance policy.
      * 
      */
     public Optional<Output<Boolean>> jailbreak() {
@@ -123,14 +123,14 @@ public Optional<Output<String>> name() {
     }
 
     /**
-     * The device os minimum version
+     * Minimum os version of the device in the device assurance policy.
      * 
      */
     @Import(name="osVersion")
     private @Nullable Output<String> osVersion;
 
     /**
-     * @return The device os minimum version
+     * @return Minimum os version of the device in the device assurance policy.
      * 
      */
     public Optional<Output<String>> osVersion() {
@@ -153,14 +153,14 @@ public Optional<Output<String>> platform() {
     }
 
     /**
-     * List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      * 
      */
     @Import(name="screenlockTypes")
     private @Nullable Output<List<String>> screenlockTypes;
 
     /**
-     * @return List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * @return List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      * 
      */
     public Optional<Output<List<String>>> screenlockTypes() {
@@ -168,14 +168,14 @@ public Optional<Output<List<String>>> screenlockTypes() {
     }
 
     /**
-     * Indicates if the device constains a secure hardware functionality
+     * Indicates if the device contains a secure hardware functionality
      * 
      */
     @Import(name="secureHardwarePresent")
     private @Nullable Output<Boolean> secureHardwarePresent;
 
     /**
-     * @return Indicates if the device constains a secure hardware functionality
+     * @return Indicates if the device contains a secure hardware functionality
      * 
      */
     public Optional<Output<Boolean>> secureHardwarePresent() {
@@ -259,7 +259,7 @@ public Builder createdDate(String createdDate) {
         }
 
         /**
-         * @param diskEncryptionTypes List of disk encryption type, can be FULL, USER
+         * @param diskEncryptionTypes List of disk encryption type, can be `FULL`, `USER`
          * 
          * @return builder
          * 
@@ -270,7 +270,7 @@ public Builder diskEncryptionTypes(@Nullable Output<List<String>> diskEncryption
         }
 
         /**
-         * @param diskEncryptionTypes List of disk encryption type, can be FULL, USER
+         * @param diskEncryptionTypes List of disk encryption type, can be `FULL`, `USER`
          * 
          * @return builder
          * 
@@ -280,7 +280,7 @@ public Builder diskEncryptionTypes(List<String> diskEncryptionTypes) {
         }
 
         /**
-         * @param diskEncryptionTypes List of disk encryption type, can be FULL, USER
+         * @param diskEncryptionTypes List of disk encryption type, can be `FULL`, `USER`
          * 
          * @return builder
          * 
@@ -290,7 +290,7 @@ public Builder diskEncryptionTypes(String... diskEncryptionTypes) {
         }
 
         /**
-         * @param jailbreak The device jailbreak. Only for android and iOS platform
+         * @param jailbreak Is the device jailbroken in the device assurance policy.
          * 
          * @return builder
          * 
@@ -301,7 +301,7 @@ public Builder jailbreak(@Nullable Output<Boolean> jailbreak) {
         }
 
         /**
-         * @param jailbreak The device jailbreak. Only for android and iOS platform
+         * @param jailbreak Is the device jailbroken in the device assurance policy.
          * 
          * @return builder
          * 
@@ -374,7 +374,7 @@ public Builder name(String name) {
         }
 
         /**
-         * @param osVersion The device os minimum version
+         * @param osVersion Minimum os version of the device in the device assurance policy.
          * 
          * @return builder
          * 
@@ -385,7 +385,7 @@ public Builder osVersion(@Nullable Output<String> osVersion) {
         }
 
         /**
-         * @param osVersion The device os minimum version
+         * @param osVersion Minimum os version of the device in the device assurance policy.
          * 
          * @return builder
          * 
@@ -416,7 +416,7 @@ public Builder platform(String platform) {
         }
 
         /**
-         * @param screenlockTypes List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+         * @param screenlockTypes List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
          * 
          * @return builder
          * 
@@ -427,7 +427,7 @@ public Builder screenlockTypes(@Nullable Output<List<String>> screenlockTypes) {
         }
 
         /**
-         * @param screenlockTypes List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+         * @param screenlockTypes List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
          * 
          * @return builder
          * 
@@ -437,7 +437,7 @@ public Builder screenlockTypes(List<String> screenlockTypes) {
         }
 
         /**
-         * @param screenlockTypes List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+         * @param screenlockTypes List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
          * 
          * @return builder
          * 
@@ -447,7 +447,7 @@ public Builder screenlockTypes(String... screenlockTypes) {
         }
 
         /**
-         * @param secureHardwarePresent Indicates if the device constains a secure hardware functionality
+         * @param secureHardwarePresent Indicates if the device contains a secure hardware functionality
          * 
          * @return builder
          * 
@@ -458,7 +458,7 @@ public Builder secureHardwarePresent(@Nullable Output<Boolean> secureHardwarePre
         }
 
         /**
-         * @param secureHardwarePresent Indicates if the device constains a secure hardware functionality
+         * @param secureHardwarePresent Indicates if the device contains a secure hardware functionality
          * 
          * @return builder
          * 
diff --git a/sdk/java/src/main/java/com/pulumi/okta/policy/inputs/DeviceAssuranceChromeosState.java b/sdk/java/src/main/java/com/pulumi/okta/policy/inputs/DeviceAssuranceChromeosState.java
index 397b1846..08e45d07 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/policy/inputs/DeviceAssuranceChromeosState.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/policy/inputs/DeviceAssuranceChromeosState.java
@@ -77,14 +77,14 @@ public Optional<Output<String>> lastUpdatedBy() {
     }
 
     /**
-     * Policy device assurance name
+     * Name of the device assurance policy.
      * 
      */
     @Import(name="name")
     private @Nullable Output<String> name;
 
     /**
-     * @return Policy device assurance name
+     * @return Name of the device assurance policy.
      * 
      */
     public Optional<Output<String>> name() {
@@ -444,7 +444,7 @@ public Builder lastUpdatedBy(String lastUpdatedBy) {
         }
 
         /**
-         * @param name Policy device assurance name
+         * @param name Name of the device assurance policy.
          * 
          * @return builder
          * 
@@ -455,7 +455,7 @@ public Builder name(@Nullable Output<String> name) {
         }
 
         /**
-         * @param name Policy device assurance name
+         * @param name Name of the device assurance policy.
          * 
          * @return builder
          * 
diff --git a/sdk/java/src/main/java/com/pulumi/okta/policy/inputs/DeviceAssuranceIosState.java b/sdk/java/src/main/java/com/pulumi/okta/policy/inputs/DeviceAssuranceIosState.java
index 8564b3ca..850bd55a 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/policy/inputs/DeviceAssuranceIosState.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/policy/inputs/DeviceAssuranceIosState.java
@@ -18,14 +18,14 @@ public final class DeviceAssuranceIosState extends com.pulumi.resources.Resource
     public static final DeviceAssuranceIosState Empty = new DeviceAssuranceIosState();
 
     /**
-     * Created by
+     * Created by of the device assurance polic
      * 
      */
     @Import(name="createdBy")
     private @Nullable Output<String> createdBy;
 
     /**
-     * @return Created by
+     * @return Created by of the device assurance polic
      * 
      */
     public Optional<Output<String>> createdBy() {
@@ -33,14 +33,14 @@ public Optional<Output<String>> createdBy() {
     }
 
     /**
-     * Created date
+     * Created date of the device assurance polic
      * 
      */
     @Import(name="createdDate")
     private @Nullable Output<String> createdDate;
 
     /**
-     * @return Created date
+     * @return Created date of the device assurance polic
      * 
      */
     public Optional<Output<String>> createdDate() {
@@ -48,14 +48,14 @@ public Optional<Output<String>> createdDate() {
     }
 
     /**
-     * The device jailbreak. Only for android and iOS platform
+     * Is the device jailbroken in the device assurance policy.
      * 
      */
     @Import(name="jailbreak")
     private @Nullable Output<Boolean> jailbreak;
 
     /**
-     * @return The device jailbreak. Only for android and iOS platform
+     * @return Is the device jailbroken in the device assurance policy.
      * 
      */
     public Optional<Output<Boolean>> jailbreak() {
@@ -63,14 +63,14 @@ public Optional<Output<Boolean>> jailbreak() {
     }
 
     /**
-     * Last update
+     * Last update of the device assurance polic
      * 
      */
     @Import(name="lastUpdate")
     private @Nullable Output<String> lastUpdate;
 
     /**
-     * @return Last update
+     * @return Last update of the device assurance polic
      * 
      */
     public Optional<Output<String>> lastUpdate() {
@@ -78,14 +78,14 @@ public Optional<Output<String>> lastUpdate() {
     }
 
     /**
-     * Last updated by
+     * Last updated by of the device assurance polic
      * 
      */
     @Import(name="lastUpdatedBy")
     private @Nullable Output<String> lastUpdatedBy;
 
     /**
-     * @return Last updated by
+     * @return Last updated by of the device assurance polic
      * 
      */
     public Optional<Output<String>> lastUpdatedBy() {
@@ -93,14 +93,14 @@ public Optional<Output<String>> lastUpdatedBy() {
     }
 
     /**
-     * Policy device assurance name
+     * Name of the device assurance policy.
      * 
      */
     @Import(name="name")
     private @Nullable Output<String> name;
 
     /**
-     * @return Policy device assurance name
+     * @return Name of the device assurance policy.
      * 
      */
     public Optional<Output<String>> name() {
@@ -108,14 +108,14 @@ public Optional<Output<String>> name() {
     }
 
     /**
-     * The device os minimum version
+     * Minimum os version of the device in the device assurance policy.
      * 
      */
     @Import(name="osVersion")
     private @Nullable Output<String> osVersion;
 
     /**
-     * @return The device os minimum version
+     * @return Minimum os version of the device in the device assurance policy.
      * 
      */
     public Optional<Output<String>> osVersion() {
@@ -138,14 +138,14 @@ public Optional<Output<String>> platform() {
     }
 
     /**
-     * List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      * 
      */
     @Import(name="screenlockTypes")
     private @Nullable Output<List<String>> screenlockTypes;
 
     /**
-     * @return List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * @return List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      * 
      */
     public Optional<Output<List<String>>> screenlockTypes() {
@@ -185,7 +185,7 @@ public Builder(DeviceAssuranceIosState defaults) {
         }
 
         /**
-         * @param createdBy Created by
+         * @param createdBy Created by of the device assurance polic
          * 
          * @return builder
          * 
@@ -196,7 +196,7 @@ public Builder createdBy(@Nullable Output<String> createdBy) {
         }
 
         /**
-         * @param createdBy Created by
+         * @param createdBy Created by of the device assurance polic
          * 
          * @return builder
          * 
@@ -206,7 +206,7 @@ public Builder createdBy(String createdBy) {
         }
 
         /**
-         * @param createdDate Created date
+         * @param createdDate Created date of the device assurance polic
          * 
          * @return builder
          * 
@@ -217,7 +217,7 @@ public Builder createdDate(@Nullable Output<String> createdDate) {
         }
 
         /**
-         * @param createdDate Created date
+         * @param createdDate Created date of the device assurance polic
          * 
          * @return builder
          * 
@@ -227,7 +227,7 @@ public Builder createdDate(String createdDate) {
         }
 
         /**
-         * @param jailbreak The device jailbreak. Only for android and iOS platform
+         * @param jailbreak Is the device jailbroken in the device assurance policy.
          * 
          * @return builder
          * 
@@ -238,7 +238,7 @@ public Builder jailbreak(@Nullable Output<Boolean> jailbreak) {
         }
 
         /**
-         * @param jailbreak The device jailbreak. Only for android and iOS platform
+         * @param jailbreak Is the device jailbroken in the device assurance policy.
          * 
          * @return builder
          * 
@@ -248,7 +248,7 @@ public Builder jailbreak(Boolean jailbreak) {
         }
 
         /**
-         * @param lastUpdate Last update
+         * @param lastUpdate Last update of the device assurance polic
          * 
          * @return builder
          * 
@@ -259,7 +259,7 @@ public Builder lastUpdate(@Nullable Output<String> lastUpdate) {
         }
 
         /**
-         * @param lastUpdate Last update
+         * @param lastUpdate Last update of the device assurance polic
          * 
          * @return builder
          * 
@@ -269,7 +269,7 @@ public Builder lastUpdate(String lastUpdate) {
         }
 
         /**
-         * @param lastUpdatedBy Last updated by
+         * @param lastUpdatedBy Last updated by of the device assurance polic
          * 
          * @return builder
          * 
@@ -280,7 +280,7 @@ public Builder lastUpdatedBy(@Nullable Output<String> lastUpdatedBy) {
         }
 
         /**
-         * @param lastUpdatedBy Last updated by
+         * @param lastUpdatedBy Last updated by of the device assurance polic
          * 
          * @return builder
          * 
@@ -290,7 +290,7 @@ public Builder lastUpdatedBy(String lastUpdatedBy) {
         }
 
         /**
-         * @param name Policy device assurance name
+         * @param name Name of the device assurance policy.
          * 
          * @return builder
          * 
@@ -301,7 +301,7 @@ public Builder name(@Nullable Output<String> name) {
         }
 
         /**
-         * @param name Policy device assurance name
+         * @param name Name of the device assurance policy.
          * 
          * @return builder
          * 
@@ -311,7 +311,7 @@ public Builder name(String name) {
         }
 
         /**
-         * @param osVersion The device os minimum version
+         * @param osVersion Minimum os version of the device in the device assurance policy.
          * 
          * @return builder
          * 
@@ -322,7 +322,7 @@ public Builder osVersion(@Nullable Output<String> osVersion) {
         }
 
         /**
-         * @param osVersion The device os minimum version
+         * @param osVersion Minimum os version of the device in the device assurance policy.
          * 
          * @return builder
          * 
@@ -353,7 +353,7 @@ public Builder platform(String platform) {
         }
 
         /**
-         * @param screenlockTypes List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+         * @param screenlockTypes List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
          * 
          * @return builder
          * 
@@ -364,7 +364,7 @@ public Builder screenlockTypes(@Nullable Output<List<String>> screenlockTypes) {
         }
 
         /**
-         * @param screenlockTypes List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+         * @param screenlockTypes List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
          * 
          * @return builder
          * 
@@ -374,7 +374,7 @@ public Builder screenlockTypes(List<String> screenlockTypes) {
         }
 
         /**
-         * @param screenlockTypes List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+         * @param screenlockTypes List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
          * 
          * @return builder
          * 
diff --git a/sdk/java/src/main/java/com/pulumi/okta/policy/inputs/DeviceAssuranceMacosState.java b/sdk/java/src/main/java/com/pulumi/okta/policy/inputs/DeviceAssuranceMacosState.java
index 5310404b..29008441 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/policy/inputs/DeviceAssuranceMacosState.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/policy/inputs/DeviceAssuranceMacosState.java
@@ -48,14 +48,14 @@ public Optional<Output<String>> createdDate() {
     }
 
     /**
-     * List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+     * List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
      * 
      */
     @Import(name="diskEncryptionTypes")
     private @Nullable Output<List<String>> diskEncryptionTypes;
 
     /**
-     * @return List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+     * @return List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
      * 
      */
     public Optional<Output<List<String>>> diskEncryptionTypes() {
@@ -93,14 +93,14 @@ public Optional<Output<String>> lastUpdatedBy() {
     }
 
     /**
-     * Policy device assurance name
+     * Name of the device assurance policy.
      * 
      */
     @Import(name="name")
     private @Nullable Output<String> name;
 
     /**
-     * @return Policy device assurance name
+     * @return Name of the device assurance policy.
      * 
      */
     public Optional<Output<String>> name() {
@@ -108,14 +108,14 @@ public Optional<Output<String>> name() {
     }
 
     /**
-     * The device os minimum version
+     * Minimum os version of the device in the device assurance policy.
      * 
      */
     @Import(name="osVersion")
     private @Nullable Output<String> osVersion;
 
     /**
-     * @return The device os minimum version
+     * @return Minimum os version of the device in the device assurance policy.
      * 
      */
     public Optional<Output<String>> osVersion() {
@@ -138,14 +138,14 @@ public Optional<Output<String>> platform() {
     }
 
     /**
-     * List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      * 
      */
     @Import(name="screenlockTypes")
     private @Nullable Output<List<String>> screenlockTypes;
 
     /**
-     * @return List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * @return List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      * 
      */
     public Optional<Output<List<String>>> screenlockTypes() {
@@ -153,14 +153,14 @@ public Optional<Output<List<String>>> screenlockTypes() {
     }
 
     /**
-     * Indicates if the device constains a secure hardware functionality
+     * Is the device secure with hardware in the device assurance policy.
      * 
      */
     @Import(name="secureHardwarePresent")
     private @Nullable Output<Boolean> secureHardwarePresent;
 
     /**
-     * @return Indicates if the device constains a secure hardware functionality
+     * @return Is the device secure with hardware in the device assurance policy.
      * 
      */
     public Optional<Output<Boolean>> secureHardwarePresent() {
@@ -467,7 +467,7 @@ public Builder createdDate(String createdDate) {
         }
 
         /**
-         * @param diskEncryptionTypes List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+         * @param diskEncryptionTypes List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
          * 
          * @return builder
          * 
@@ -478,7 +478,7 @@ public Builder diskEncryptionTypes(@Nullable Output<List<String>> diskEncryption
         }
 
         /**
-         * @param diskEncryptionTypes List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+         * @param diskEncryptionTypes List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
          * 
          * @return builder
          * 
@@ -488,7 +488,7 @@ public Builder diskEncryptionTypes(List<String> diskEncryptionTypes) {
         }
 
         /**
-         * @param diskEncryptionTypes List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+         * @param diskEncryptionTypes List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
          * 
          * @return builder
          * 
@@ -540,7 +540,7 @@ public Builder lastUpdatedBy(String lastUpdatedBy) {
         }
 
         /**
-         * @param name Policy device assurance name
+         * @param name Name of the device assurance policy.
          * 
          * @return builder
          * 
@@ -551,7 +551,7 @@ public Builder name(@Nullable Output<String> name) {
         }
 
         /**
-         * @param name Policy device assurance name
+         * @param name Name of the device assurance policy.
          * 
          * @return builder
          * 
@@ -561,7 +561,7 @@ public Builder name(String name) {
         }
 
         /**
-         * @param osVersion The device os minimum version
+         * @param osVersion Minimum os version of the device in the device assurance policy.
          * 
          * @return builder
          * 
@@ -572,7 +572,7 @@ public Builder osVersion(@Nullable Output<String> osVersion) {
         }
 
         /**
-         * @param osVersion The device os minimum version
+         * @param osVersion Minimum os version of the device in the device assurance policy.
          * 
          * @return builder
          * 
@@ -603,7 +603,7 @@ public Builder platform(String platform) {
         }
 
         /**
-         * @param screenlockTypes List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+         * @param screenlockTypes List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
          * 
          * @return builder
          * 
@@ -614,7 +614,7 @@ public Builder screenlockTypes(@Nullable Output<List<String>> screenlockTypes) {
         }
 
         /**
-         * @param screenlockTypes List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+         * @param screenlockTypes List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
          * 
          * @return builder
          * 
@@ -624,7 +624,7 @@ public Builder screenlockTypes(List<String> screenlockTypes) {
         }
 
         /**
-         * @param screenlockTypes List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+         * @param screenlockTypes List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
          * 
          * @return builder
          * 
@@ -634,7 +634,7 @@ public Builder screenlockTypes(String... screenlockTypes) {
         }
 
         /**
-         * @param secureHardwarePresent Indicates if the device constains a secure hardware functionality
+         * @param secureHardwarePresent Is the device secure with hardware in the device assurance policy.
          * 
          * @return builder
          * 
@@ -645,7 +645,7 @@ public Builder secureHardwarePresent(@Nullable Output<Boolean> secureHardwarePre
         }
 
         /**
-         * @param secureHardwarePresent Indicates if the device constains a secure hardware functionality
+         * @param secureHardwarePresent Is the device secure with hardware in the device assurance policy.
          * 
          * @return builder
          * 
diff --git a/sdk/java/src/main/java/com/pulumi/okta/policy/inputs/DeviceAssuranceWindowsState.java b/sdk/java/src/main/java/com/pulumi/okta/policy/inputs/DeviceAssuranceWindowsState.java
index c5fb486f..0e71bdd7 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/policy/inputs/DeviceAssuranceWindowsState.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/policy/inputs/DeviceAssuranceWindowsState.java
@@ -48,14 +48,14 @@ public Optional<Output<String>> createdDate() {
     }
 
     /**
-     * List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+     * List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
      * 
      */
     @Import(name="diskEncryptionTypes")
     private @Nullable Output<List<String>> diskEncryptionTypes;
 
     /**
-     * @return List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+     * @return List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
      * 
      */
     public Optional<Output<List<String>>> diskEncryptionTypes() {
@@ -93,14 +93,14 @@ public Optional<Output<String>> lastUpdatedBy() {
     }
 
     /**
-     * Policy device assurance name
+     * Name of the device assurance policy.
      * 
      */
     @Import(name="name")
     private @Nullable Output<String> name;
 
     /**
-     * @return Policy device assurance name
+     * @return Name of the device assurance policy.
      * 
      */
     public Optional<Output<String>> name() {
@@ -108,14 +108,14 @@ public Optional<Output<String>> name() {
     }
 
     /**
-     * The device os minimum version
+     * Minimum os version of the device in the device assurance policy.
      * 
      */
     @Import(name="osVersion")
     private @Nullable Output<String> osVersion;
 
     /**
-     * @return The device os minimum version
+     * @return Minimum os version of the device in the device assurance policy.
      * 
      */
     public Optional<Output<String>> osVersion() {
@@ -138,14 +138,14 @@ public Optional<Output<String>> platform() {
     }
 
     /**
-     * List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      * 
      */
     @Import(name="screenlockTypes")
     private @Nullable Output<List<String>> screenlockTypes;
 
     /**
-     * @return List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * @return List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      * 
      */
     public Optional<Output<List<String>>> screenlockTypes() {
@@ -153,14 +153,14 @@ public Optional<Output<List<String>>> screenlockTypes() {
     }
 
     /**
-     * Indicates if the device constains a secure hardware functionality
+     * Is the device secure with hardware in the device assurance policy.
      * 
      */
     @Import(name="secureHardwarePresent")
     private @Nullable Output<Boolean> secureHardwarePresent;
 
     /**
-     * @return Indicates if the device constains a secure hardware functionality
+     * @return Is the device secure with hardware in the device assurance policy.
      * 
      */
     public Optional<Output<Boolean>> secureHardwarePresent() {
@@ -563,7 +563,7 @@ public Builder createdDate(String createdDate) {
         }
 
         /**
-         * @param diskEncryptionTypes List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+         * @param diskEncryptionTypes List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
          * 
          * @return builder
          * 
@@ -574,7 +574,7 @@ public Builder diskEncryptionTypes(@Nullable Output<List<String>> diskEncryption
         }
 
         /**
-         * @param diskEncryptionTypes List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+         * @param diskEncryptionTypes List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
          * 
          * @return builder
          * 
@@ -584,7 +584,7 @@ public Builder diskEncryptionTypes(List<String> diskEncryptionTypes) {
         }
 
         /**
-         * @param diskEncryptionTypes List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+         * @param diskEncryptionTypes List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
          * 
          * @return builder
          * 
@@ -636,7 +636,7 @@ public Builder lastUpdatedBy(String lastUpdatedBy) {
         }
 
         /**
-         * @param name Policy device assurance name
+         * @param name Name of the device assurance policy.
          * 
          * @return builder
          * 
@@ -647,7 +647,7 @@ public Builder name(@Nullable Output<String> name) {
         }
 
         /**
-         * @param name Policy device assurance name
+         * @param name Name of the device assurance policy.
          * 
          * @return builder
          * 
@@ -657,7 +657,7 @@ public Builder name(String name) {
         }
 
         /**
-         * @param osVersion The device os minimum version
+         * @param osVersion Minimum os version of the device in the device assurance policy.
          * 
          * @return builder
          * 
@@ -668,7 +668,7 @@ public Builder osVersion(@Nullable Output<String> osVersion) {
         }
 
         /**
-         * @param osVersion The device os minimum version
+         * @param osVersion Minimum os version of the device in the device assurance policy.
          * 
          * @return builder
          * 
@@ -699,7 +699,7 @@ public Builder platform(String platform) {
         }
 
         /**
-         * @param screenlockTypes List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+         * @param screenlockTypes List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
          * 
          * @return builder
          * 
@@ -710,7 +710,7 @@ public Builder screenlockTypes(@Nullable Output<List<String>> screenlockTypes) {
         }
 
         /**
-         * @param screenlockTypes List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+         * @param screenlockTypes List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
          * 
          * @return builder
          * 
@@ -720,7 +720,7 @@ public Builder screenlockTypes(List<String> screenlockTypes) {
         }
 
         /**
-         * @param screenlockTypes List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+         * @param screenlockTypes List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
          * 
          * @return builder
          * 
@@ -730,7 +730,7 @@ public Builder screenlockTypes(String... screenlockTypes) {
         }
 
         /**
-         * @param secureHardwarePresent Indicates if the device constains a secure hardware functionality
+         * @param secureHardwarePresent Is the device secure with hardware in the device assurance policy.
          * 
          * @return builder
          * 
@@ -741,7 +741,7 @@ public Builder secureHardwarePresent(@Nullable Output<Boolean> secureHardwarePre
         }
 
         /**
-         * @param secureHardwarePresent Indicates if the device constains a secure hardware functionality
+         * @param secureHardwarePresent Is the device secure with hardware in the device assurance policy.
          * 
          * @return builder
          * 
diff --git a/sdk/java/src/main/java/com/pulumi/okta/policy/inputs/RuleIdpDiscoveryState.java b/sdk/java/src/main/java/com/pulumi/okta/policy/inputs/RuleIdpDiscoveryState.java
index 1f856b04..5d3c4abe 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/policy/inputs/RuleIdpDiscoveryState.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/policy/inputs/RuleIdpDiscoveryState.java
@@ -191,9 +191,21 @@ public Optional<Output<List<String>>> networkIncludes() {
         return Optional.ofNullable(this.networkIncludes);
     }
 
+    /**
+     * Platform to include in discovery rule. - &#39;type&#39; - (Optional) One of: &#39;ANY&#39;, &#39;MOBILE&#39;, &#39;DESKTOP&#39; - &#39;os_expression -
+     * (Optional) Only available when using os_type = &#39;OTHER&#39; - &#39;os_type&#39; - (Optional) One of: &#39;ANY&#39;, &#39;IOS&#39;, &#39;WINDOWS&#39;,
+     * &#39;ANDROID&#39;, &#39;OTHER&#39;, &#39;OSX&#39;
+     * 
+     */
     @Import(name="platformIncludes")
     private @Nullable Output<List<RuleIdpDiscoveryPlatformIncludeArgs>> platformIncludes;
 
+    /**
+     * @return Platform to include in discovery rule. - &#39;type&#39; - (Optional) One of: &#39;ANY&#39;, &#39;MOBILE&#39;, &#39;DESKTOP&#39; - &#39;os_expression -
+     * (Optional) Only available when using os_type = &#39;OTHER&#39; - &#39;os_type&#39; - (Optional) One of: &#39;ANY&#39;, &#39;IOS&#39;, &#39;WINDOWS&#39;,
+     * &#39;ANDROID&#39;, &#39;OTHER&#39;, &#39;OSX&#39;
+     * 
+     */
     public Optional<Output<List<RuleIdpDiscoveryPlatformIncludeArgs>>> platformIncludes() {
         return Optional.ofNullable(this.platformIncludes);
     }
@@ -609,15 +621,39 @@ public Builder networkIncludes(String... networkIncludes) {
             return networkIncludes(List.of(networkIncludes));
         }
 
+        /**
+         * @param platformIncludes Platform to include in discovery rule. - &#39;type&#39; - (Optional) One of: &#39;ANY&#39;, &#39;MOBILE&#39;, &#39;DESKTOP&#39; - &#39;os_expression -
+         * (Optional) Only available when using os_type = &#39;OTHER&#39; - &#39;os_type&#39; - (Optional) One of: &#39;ANY&#39;, &#39;IOS&#39;, &#39;WINDOWS&#39;,
+         * &#39;ANDROID&#39;, &#39;OTHER&#39;, &#39;OSX&#39;
+         * 
+         * @return builder
+         * 
+         */
         public Builder platformIncludes(@Nullable Output<List<RuleIdpDiscoveryPlatformIncludeArgs>> platformIncludes) {
             $.platformIncludes = platformIncludes;
             return this;
         }
 
+        /**
+         * @param platformIncludes Platform to include in discovery rule. - &#39;type&#39; - (Optional) One of: &#39;ANY&#39;, &#39;MOBILE&#39;, &#39;DESKTOP&#39; - &#39;os_expression -
+         * (Optional) Only available when using os_type = &#39;OTHER&#39; - &#39;os_type&#39; - (Optional) One of: &#39;ANY&#39;, &#39;IOS&#39;, &#39;WINDOWS&#39;,
+         * &#39;ANDROID&#39;, &#39;OTHER&#39;, &#39;OSX&#39;
+         * 
+         * @return builder
+         * 
+         */
         public Builder platformIncludes(List<RuleIdpDiscoveryPlatformIncludeArgs> platformIncludes) {
             return platformIncludes(Output.of(platformIncludes));
         }
 
+        /**
+         * @param platformIncludes Platform to include in discovery rule. - &#39;type&#39; - (Optional) One of: &#39;ANY&#39;, &#39;MOBILE&#39;, &#39;DESKTOP&#39; - &#39;os_expression -
+         * (Optional) Only available when using os_type = &#39;OTHER&#39; - &#39;os_type&#39; - (Optional) One of: &#39;ANY&#39;, &#39;IOS&#39;, &#39;WINDOWS&#39;,
+         * &#39;ANDROID&#39;, &#39;OTHER&#39;, &#39;OSX&#39;
+         * 
+         * @return builder
+         * 
+         */
         public Builder platformIncludes(RuleIdpDiscoveryPlatformIncludeArgs... platformIncludes) {
             return platformIncludes(List.of(platformIncludes));
         }
diff --git a/sdk/java/src/main/java/com/pulumi/okta/policy/inputs/RuleMfaState.java b/sdk/java/src/main/java/com/pulumi/okta/policy/inputs/RuleMfaState.java
index 56c18247..f502c3f3 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/policy/inputs/RuleMfaState.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/policy/inputs/RuleMfaState.java
@@ -20,14 +20,20 @@ public final class RuleMfaState extends com.pulumi.resources.ResourceArgs {
     public static final RuleMfaState Empty = new RuleMfaState();
 
     /**
-     * Applications to exclude
+     * Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations. - &#39;id&#39;
+     * - (Optional) Use if &#39;type&#39; is &#39;APP&#39; to indicate the application id to include. - &#39;name&#39; - (Optional) Use if the &#39;type&#39;
+     *   is &#39;APP_TYPE&#39; to indicate the type of application(s) to include in instances where an entire group (i.e. &#39;yahoo_mail&#39;)
+     *   of applications should be included. - &#39;type&#39; - (Required) One of: &#39;APP&#39;, &#39;APP_TYPE&#39;
      * 
      */
     @Import(name="appExcludes")
     private @Nullable Output<List<RuleMfaAppExcludeArgs>> appExcludes;
 
     /**
-     * @return Applications to exclude
+     * @return Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations. - &#39;id&#39;
+     * - (Optional) Use if &#39;type&#39; is &#39;APP&#39; to indicate the application id to include. - &#39;name&#39; - (Optional) Use if the &#39;type&#39;
+     *   is &#39;APP_TYPE&#39; to indicate the type of application(s) to include in instances where an entire group (i.e. &#39;yahoo_mail&#39;)
+     *   of applications should be included. - &#39;type&#39; - (Required) One of: &#39;APP&#39;, &#39;APP_TYPE&#39;
      * 
      */
     public Optional<Output<List<RuleMfaAppExcludeArgs>>> appExcludes() {
@@ -219,7 +225,10 @@ public Builder(RuleMfaState defaults) {
         }
 
         /**
-         * @param appExcludes Applications to exclude
+         * @param appExcludes Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations. - &#39;id&#39;
+         * - (Optional) Use if &#39;type&#39; is &#39;APP&#39; to indicate the application id to include. - &#39;name&#39; - (Optional) Use if the &#39;type&#39;
+         *   is &#39;APP_TYPE&#39; to indicate the type of application(s) to include in instances where an entire group (i.e. &#39;yahoo_mail&#39;)
+         *   of applications should be included. - &#39;type&#39; - (Required) One of: &#39;APP&#39;, &#39;APP_TYPE&#39;
          * 
          * @return builder
          * 
@@ -230,7 +239,10 @@ public Builder appExcludes(@Nullable Output<List<RuleMfaAppExcludeArgs>> appExcl
         }
 
         /**
-         * @param appExcludes Applications to exclude
+         * @param appExcludes Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations. - &#39;id&#39;
+         * - (Optional) Use if &#39;type&#39; is &#39;APP&#39; to indicate the application id to include. - &#39;name&#39; - (Optional) Use if the &#39;type&#39;
+         *   is &#39;APP_TYPE&#39; to indicate the type of application(s) to include in instances where an entire group (i.e. &#39;yahoo_mail&#39;)
+         *   of applications should be included. - &#39;type&#39; - (Required) One of: &#39;APP&#39;, &#39;APP_TYPE&#39;
          * 
          * @return builder
          * 
@@ -240,7 +252,10 @@ public Builder appExcludes(List<RuleMfaAppExcludeArgs> appExcludes) {
         }
 
         /**
-         * @param appExcludes Applications to exclude
+         * @param appExcludes Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations. - &#39;id&#39;
+         * - (Optional) Use if &#39;type&#39; is &#39;APP&#39; to indicate the application id to include. - &#39;name&#39; - (Optional) Use if the &#39;type&#39;
+         *   is &#39;APP_TYPE&#39; to indicate the type of application(s) to include in instances where an entire group (i.e. &#39;yahoo_mail&#39;)
+         *   of applications should be included. - &#39;type&#39; - (Required) One of: &#39;APP&#39;, &#39;APP_TYPE&#39;
          * 
          * @return builder
          * 
diff --git a/sdk/java/src/main/java/com/pulumi/okta/policy/inputs/RuleSignonState.java b/sdk/java/src/main/java/com/pulumi/okta/policy/inputs/RuleSignonState.java
index b13e6816..0458afa4 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/policy/inputs/RuleSignonState.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/policy/inputs/RuleSignonState.java
@@ -284,7 +284,11 @@ public Optional<Output<Integer>> priority() {
      * Risc level: `&#34;ANY&#34;`, `&#34;LOW&#34;`, `&#34;MEDIUM&#34;` or `&#34;HIGH&#34;`. Default is `&#34;ANY&#34;`. It can be also
      * set to an empty string in case `RISC_SCORING` org feature flag is disabled.
      * 
+     * @deprecated
+     * Attribute typo, switch to risk_level instead. Default: `ANY`
+     * 
      */
+    @Deprecated /* Attribute typo, switch to risk_level instead. Default: `ANY` */
     @Import(name="riscLevel")
     private @Nullable Output<String> riscLevel;
 
@@ -292,11 +296,30 @@ public Optional<Output<Integer>> priority() {
      * @return Risc level: `&#34;ANY&#34;`, `&#34;LOW&#34;`, `&#34;MEDIUM&#34;` or `&#34;HIGH&#34;`. Default is `&#34;ANY&#34;`. It can be also
      * set to an empty string in case `RISC_SCORING` org feature flag is disabled.
      * 
+     * @deprecated
+     * Attribute typo, switch to risk_level instead. Default: `ANY`
+     * 
      */
+    @Deprecated /* Attribute typo, switch to risk_level instead. Default: `ANY` */
     public Optional<Output<String>> riscLevel() {
         return Optional.ofNullable(this.riscLevel);
     }
 
+    /**
+     * Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
+     * 
+     */
+    @Import(name="riskLevel")
+    private @Nullable Output<String> riskLevel;
+
+    /**
+     * @return Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
+     * 
+     */
+    public Optional<Output<String>> riskLevel() {
+        return Optional.ofNullable(this.riskLevel);
+    }
+
     /**
      * Max minutes a session can be idle.,
      * 
@@ -393,6 +416,7 @@ private RuleSignonState(RuleSignonState $) {
         this.primaryFactor = $.primaryFactor;
         this.priority = $.priority;
         this.riscLevel = $.riscLevel;
+        this.riskLevel = $.riskLevel;
         this.sessionIdle = $.sessionIdle;
         this.sessionLifetime = $.sessionLifetime;
         this.sessionPersistent = $.sessionPersistent;
@@ -837,7 +861,11 @@ public Builder priority(Integer priority) {
          * 
          * @return builder
          * 
+         * @deprecated
+         * Attribute typo, switch to risk_level instead. Default: `ANY`
+         * 
          */
+        @Deprecated /* Attribute typo, switch to risk_level instead. Default: `ANY` */
         public Builder riscLevel(@Nullable Output<String> riscLevel) {
             $.riscLevel = riscLevel;
             return this;
@@ -849,11 +877,36 @@ public Builder riscLevel(@Nullable Output<String> riscLevel) {
          * 
          * @return builder
          * 
+         * @deprecated
+         * Attribute typo, switch to risk_level instead. Default: `ANY`
+         * 
          */
+        @Deprecated /* Attribute typo, switch to risk_level instead. Default: `ANY` */
         public Builder riscLevel(String riscLevel) {
             return riscLevel(Output.of(riscLevel));
         }
 
+        /**
+         * @param riskLevel Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
+         * 
+         * @return builder
+         * 
+         */
+        public Builder riskLevel(@Nullable Output<String> riskLevel) {
+            $.riskLevel = riskLevel;
+            return this;
+        }
+
+        /**
+         * @param riskLevel Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
+         * 
+         * @return builder
+         * 
+         */
+        public Builder riskLevel(String riskLevel) {
+            return riskLevel(Output.of(riskLevel));
+        }
+
         /**
          * @param sessionIdle Max minutes a session can be idle.,
          * 
diff --git a/sdk/java/src/main/java/com/pulumi/okta/user/User.java b/sdk/java/src/main/java/com/pulumi/okta/user/User.java
index 590bc959..719b6eec 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/user/User.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/user/User.java
@@ -192,14 +192,16 @@ public Output<String> customProfileAttributes() {
         return this.customProfileAttributes;
     }
     /**
-     * List of custom_profile_attribute keys that should be excluded from being managed by Terraform.
+     * List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in
+     * situations where specific custom fields may contain sensitive information and should be managed outside of Terraform.
      * 
      */
     @Export(name="customProfileAttributesToIgnores", refs={List.class,String.class}, tree="[0,1]")
     private Output</* @Nullable */ List<String>> customProfileAttributesToIgnores;
 
     /**
-     * @return List of custom_profile_attribute keys that should be excluded from being managed by Terraform.
+     * @return List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in
+     * situations where specific custom fields may contain sensitive information and should be managed outside of Terraform.
      * 
      */
     public Output<Optional<List<String>>> customProfileAttributesToIgnores() {
diff --git a/sdk/java/src/main/java/com/pulumi/okta/user/UserArgs.java b/sdk/java/src/main/java/com/pulumi/okta/user/UserArgs.java
index b6d2ca9c..f9f9686f 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/user/UserArgs.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/user/UserArgs.java
@@ -80,14 +80,16 @@ public Optional<Output<String>> customProfileAttributes() {
     }
 
     /**
-     * List of custom_profile_attribute keys that should be excluded from being managed by Terraform.
+     * List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in
+     * situations where specific custom fields may contain sensitive information and should be managed outside of Terraform.
      * 
      */
     @Import(name="customProfileAttributesToIgnores")
     private @Nullable Output<List<String>> customProfileAttributesToIgnores;
 
     /**
-     * @return List of custom_profile_attribute keys that should be excluded from being managed by Terraform.
+     * @return List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in
+     * situations where specific custom fields may contain sensitive information and should be managed outside of Terraform.
      * 
      */
     public Optional<Output<List<String>>> customProfileAttributesToIgnores() {
@@ -825,7 +827,8 @@ public Builder customProfileAttributes(String customProfileAttributes) {
         }
 
         /**
-         * @param customProfileAttributesToIgnores List of custom_profile_attribute keys that should be excluded from being managed by Terraform.
+         * @param customProfileAttributesToIgnores List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in
+         * situations where specific custom fields may contain sensitive information and should be managed outside of Terraform.
          * 
          * @return builder
          * 
@@ -836,7 +839,8 @@ public Builder customProfileAttributesToIgnores(@Nullable Output<List<String>> c
         }
 
         /**
-         * @param customProfileAttributesToIgnores List of custom_profile_attribute keys that should be excluded from being managed by Terraform.
+         * @param customProfileAttributesToIgnores List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in
+         * situations where specific custom fields may contain sensitive information and should be managed outside of Terraform.
          * 
          * @return builder
          * 
@@ -846,7 +850,8 @@ public Builder customProfileAttributesToIgnores(List<String> customProfileAttrib
         }
 
         /**
-         * @param customProfileAttributesToIgnores List of custom_profile_attribute keys that should be excluded from being managed by Terraform.
+         * @param customProfileAttributesToIgnores List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in
+         * situations where specific custom fields may contain sensitive information and should be managed outside of Terraform.
          * 
          * @return builder
          * 
diff --git a/sdk/java/src/main/java/com/pulumi/okta/user/inputs/UserState.java b/sdk/java/src/main/java/com/pulumi/okta/user/inputs/UserState.java
index 4e769ce5..f4304c8c 100644
--- a/sdk/java/src/main/java/com/pulumi/okta/user/inputs/UserState.java
+++ b/sdk/java/src/main/java/com/pulumi/okta/user/inputs/UserState.java
@@ -79,14 +79,16 @@ public Optional<Output<String>> customProfileAttributes() {
     }
 
     /**
-     * List of custom_profile_attribute keys that should be excluded from being managed by Terraform.
+     * List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in
+     * situations where specific custom fields may contain sensitive information and should be managed outside of Terraform.
      * 
      */
     @Import(name="customProfileAttributesToIgnores")
     private @Nullable Output<List<String>> customProfileAttributesToIgnores;
 
     /**
-     * @return List of custom_profile_attribute keys that should be excluded from being managed by Terraform.
+     * @return List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in
+     * situations where specific custom fields may contain sensitive information and should be managed outside of Terraform.
      * 
      */
     public Optional<Output<List<String>>> customProfileAttributesToIgnores() {
@@ -840,7 +842,8 @@ public Builder customProfileAttributes(String customProfileAttributes) {
         }
 
         /**
-         * @param customProfileAttributesToIgnores List of custom_profile_attribute keys that should be excluded from being managed by Terraform.
+         * @param customProfileAttributesToIgnores List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in
+         * situations where specific custom fields may contain sensitive information and should be managed outside of Terraform.
          * 
          * @return builder
          * 
@@ -851,7 +854,8 @@ public Builder customProfileAttributesToIgnores(@Nullable Output<List<String>> c
         }
 
         /**
-         * @param customProfileAttributesToIgnores List of custom_profile_attribute keys that should be excluded from being managed by Terraform.
+         * @param customProfileAttributesToIgnores List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in
+         * situations where specific custom fields may contain sensitive information and should be managed outside of Terraform.
          * 
          * @return builder
          * 
@@ -861,7 +865,8 @@ public Builder customProfileAttributesToIgnores(List<String> customProfileAttrib
         }
 
         /**
-         * @param customProfileAttributesToIgnores List of custom_profile_attribute keys that should be excluded from being managed by Terraform.
+         * @param customProfileAttributesToIgnores List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in
+         * situations where specific custom fields may contain sensitive information and should be managed outside of Terraform.
          * 
          * @return builder
          * 
diff --git a/sdk/nodejs/app/getSaml.ts b/sdk/nodejs/app/getSaml.ts
index d105d208..a2ba2bbd 100644
--- a/sdk/nodejs/app/getSaml.ts
+++ b/sdk/nodejs/app/getSaml.ts
@@ -199,7 +199,7 @@ export interface GetSamlResult {
      */
     readonly samlSignedRequestEnabled: boolean;
     /**
-     * Signature algorithm used ot digitally sign the assertion and response.
+     * Signature algorithm used to digitally sign the assertion and response.
      */
     readonly signatureAlgorithm: string;
     /**
diff --git a/sdk/nodejs/app/saml.ts b/sdk/nodejs/app/saml.ts
index 2d14cca8..aba04deb 100644
--- a/sdk/nodejs/app/saml.ts
+++ b/sdk/nodejs/app/saml.ts
@@ -395,7 +395,7 @@ export class Saml extends pulumi.CustomResource {
      */
     public /*out*/ readonly signOnMode!: pulumi.Output<string>;
     /**
-     * Signature algorithm used ot digitally sign the assertion and response.
+     * Signature algorithm used to digitally sign the assertion and response.
      */
     public readonly signatureAlgorithm!: pulumi.Output<string | undefined>;
     /**
@@ -784,7 +784,7 @@ export interface SamlState {
      */
     signOnMode?: pulumi.Input<string>;
     /**
-     * Signature algorithm used ot digitally sign the assertion and response.
+     * Signature algorithm used to digitally sign the assertion and response.
      */
     signatureAlgorithm?: pulumi.Input<string>;
     /**
@@ -974,7 +974,7 @@ export interface SamlArgs {
      */
     samlVersion?: pulumi.Input<string>;
     /**
-     * Signature algorithm used ot digitally sign the assertion and response.
+     * Signature algorithm used to digitally sign the assertion and response.
      */
     signatureAlgorithm?: pulumi.Input<string>;
     /**
diff --git a/sdk/nodejs/app/threeField.ts b/sdk/nodejs/app/threeField.ts
index 2d80a93f..e156d8c2 100644
--- a/sdk/nodejs/app/threeField.ts
+++ b/sdk/nodejs/app/threeField.ts
@@ -64,7 +64,7 @@ export class ThreeField extends pulumi.CustomResource {
      */
     public readonly adminNote!: pulumi.Output<string | undefined>;
     /**
-     * Displays specific appLinks for the app
+     * Displays specific appLinks for the app. The value for each application link should be boolean.
      */
     public readonly appLinksJson!: pulumi.Output<string | undefined>;
     /**
@@ -291,7 +291,7 @@ export interface ThreeFieldState {
      */
     adminNote?: pulumi.Input<string>;
     /**
-     * Displays specific appLinks for the app
+     * Displays specific appLinks for the app. The value for each application link should be boolean.
      */
     appLinksJson?: pulumi.Input<string>;
     /**
@@ -417,7 +417,7 @@ export interface ThreeFieldArgs {
      */
     adminNote?: pulumi.Input<string>;
     /**
-     * Displays specific appLinks for the app
+     * Displays specific appLinks for the app. The value for each application link should be boolean.
      */
     appLinksJson?: pulumi.Input<string>;
     /**
diff --git a/sdk/nodejs/appUserSchemaProperty.ts b/sdk/nodejs/appUserSchemaProperty.ts
index 278696bd..0e95066a 100644
--- a/sdk/nodejs/appUserSchemaProperty.ts
+++ b/sdk/nodejs/appUserSchemaProperty.ts
@@ -139,11 +139,11 @@ export class AppUserSchemaProperty extends pulumi.CustomResource {
      */
     public readonly union!: pulumi.Output<boolean | undefined>;
     /**
-     * Subschema unique restriction
+     * Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.
      */
     public readonly unique!: pulumi.Output<string | undefined>;
     /**
-     * Custom subschema user type
+     * User type ID. By default, it is `default`
      */
     public readonly userType!: pulumi.Output<string | undefined>;
 
@@ -303,11 +303,11 @@ export interface AppUserSchemaPropertyState {
      */
     union?: pulumi.Input<boolean>;
     /**
-     * Subschema unique restriction
+     * Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.
      */
     unique?: pulumi.Input<string>;
     /**
-     * Custom subschema user type
+     * User type ID. By default, it is `default`
      */
     userType?: pulumi.Input<string>;
 }
@@ -393,11 +393,11 @@ export interface AppUserSchemaPropertyArgs {
      */
     union?: pulumi.Input<boolean>;
     /**
-     * Subschema unique restriction
+     * Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.
      */
     unique?: pulumi.Input<string>;
     /**
-     * Custom subschema user type
+     * User type ID. By default, it is `default`
      */
     userType?: pulumi.Input<string>;
 }
diff --git a/sdk/nodejs/eventHook.ts b/sdk/nodejs/eventHook.ts
index 193929c5..4be630db 100644
--- a/sdk/nodejs/eventHook.ts
+++ b/sdk/nodejs/eventHook.ts
@@ -93,6 +93,9 @@ export class EventHook extends pulumi.CustomResource {
      * The event hook display name.
      */
     public readonly name!: pulumi.Output<string>;
+    /**
+     * Default to `ACTIVE`
+     */
     public readonly status!: pulumi.Output<string | undefined>;
 
     /**
@@ -158,6 +161,9 @@ export interface EventHookState {
      * The event hook display name.
      */
     name?: pulumi.Input<string>;
+    /**
+     * Default to `ACTIVE`
+     */
     status?: pulumi.Input<string>;
 }
 
@@ -185,5 +191,8 @@ export interface EventHookArgs {
      * The event hook display name.
      */
     name?: pulumi.Input<string>;
+    /**
+     * Default to `ACTIVE`
+     */
     status?: pulumi.Input<string>;
 }
diff --git a/sdk/nodejs/getRoleSubscription.ts b/sdk/nodejs/getRoleSubscription.ts
index 4884eae8..8238d2bc 100644
--- a/sdk/nodejs/getRoleSubscription.ts
+++ b/sdk/nodejs/getRoleSubscription.ts
@@ -42,7 +42,7 @@ export interface GetRoleSubscriptionArgs {
     notificationType: string;
     /**
      * Type of the role. Valid values:
-     * `"API_ADMIN"`,
+     * `"API_ACCESS_MANAGEMENT_ADMIN"`,
      * `"APP_ADMIN"`,
      * `"CUSTOM"`,
      * `"GROUP_MEMBERSHIP_ADMIN"`,
@@ -106,7 +106,7 @@ export interface GetRoleSubscriptionOutputArgs {
     notificationType: pulumi.Input<string>;
     /**
      * Type of the role. Valid values:
-     * `"API_ADMIN"`,
+     * `"API_ACCESS_MANAGEMENT_ADMIN"`,
      * `"APP_ADMIN"`,
      * `"CUSTOM"`,
      * `"GROUP_MEMBERSHIP_ADMIN"`,
diff --git a/sdk/nodejs/group/role.ts b/sdk/nodejs/group/role.ts
index 19196621..2a0023d3 100644
--- a/sdk/nodejs/group/role.ts
+++ b/sdk/nodejs/group/role.ts
@@ -71,7 +71,7 @@ export class Role extends pulumi.CustomResource {
     public readonly groupId!: pulumi.Output<string>;
     /**
      * Admin role assigned to the group. It can be any one of the following values:
-     * `"API_ADMIN"`,
+     * `"API_ACCESS_MANAGEMENT_ADMIN"`,
      * `"APP_ADMIN"`,
      * `"CUSTOM"`,
      * `"GROUP_MEMBERSHIP_ADMIN"`,
@@ -153,7 +153,7 @@ export interface RoleState {
     groupId?: pulumi.Input<string>;
     /**
      * Admin role assigned to the group. It can be any one of the following values:
-     * `"API_ADMIN"`,
+     * `"API_ACCESS_MANAGEMENT_ADMIN"`,
      * `"APP_ADMIN"`,
      * `"CUSTOM"`,
      * `"GROUP_MEMBERSHIP_ADMIN"`,
@@ -199,7 +199,7 @@ export interface RoleArgs {
     groupId: pulumi.Input<string>;
     /**
      * Admin role assigned to the group. It can be any one of the following values:
-     * `"API_ADMIN"`,
+     * `"API_ACCESS_MANAGEMENT_ADMIN"`,
      * `"APP_ADMIN"`,
      * `"CUSTOM"`,
      * `"GROUP_MEMBERSHIP_ADMIN"`,
diff --git a/sdk/nodejs/idp/oidc.ts b/sdk/nodejs/idp/oidc.ts
index 8dd62df5..6916fd36 100644
--- a/sdk/nodejs/idp/oidc.ts
+++ b/sdk/nodejs/idp/oidc.ts
@@ -138,11 +138,6 @@ export class Oidc extends pulumi.CustomResource {
      * The Application's display name.
      */
     public readonly name!: pulumi.Output<string>;
-    /**
-     * Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See:
-     * https://developer.okta.com/docs/reference/api/idps/#oauth-2-0-and-openid-connect-client-object
-     */
-    public readonly pkceRequired!: pulumi.Output<boolean | undefined>;
     /**
      * Determines if the IdP should act as a source of truth for user profile attributes.
      */
@@ -239,7 +234,6 @@ export class Oidc extends pulumi.CustomResource {
             resourceInputs["jwksUrl"] = state ? state.jwksUrl : undefined;
             resourceInputs["maxClockSkew"] = state ? state.maxClockSkew : undefined;
             resourceInputs["name"] = state ? state.name : undefined;
-            resourceInputs["pkceRequired"] = state ? state.pkceRequired : undefined;
             resourceInputs["profileMaster"] = state ? state.profileMaster : undefined;
             resourceInputs["protocolType"] = state ? state.protocolType : undefined;
             resourceInputs["provisioningAction"] = state ? state.provisioningAction : undefined;
@@ -306,7 +300,6 @@ export class Oidc extends pulumi.CustomResource {
             resourceInputs["jwksUrl"] = args ? args.jwksUrl : undefined;
             resourceInputs["maxClockSkew"] = args ? args.maxClockSkew : undefined;
             resourceInputs["name"] = args ? args.name : undefined;
-            resourceInputs["pkceRequired"] = args ? args.pkceRequired : undefined;
             resourceInputs["profileMaster"] = args ? args.profileMaster : undefined;
             resourceInputs["protocolType"] = args ? args.protocolType : undefined;
             resourceInputs["provisioningAction"] = args ? args.provisioningAction : undefined;
@@ -404,11 +397,6 @@ export interface OidcState {
      * The Application's display name.
      */
     name?: pulumi.Input<string>;
-    /**
-     * Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See:
-     * https://developer.okta.com/docs/reference/api/idps/#oauth-2-0-and-openid-connect-client-object
-     */
-    pkceRequired?: pulumi.Input<boolean>;
     /**
      * Determines if the IdP should act as a source of truth for user profile attributes.
      */
@@ -548,11 +536,6 @@ export interface OidcArgs {
      * The Application's display name.
      */
     name?: pulumi.Input<string>;
-    /**
-     * Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See:
-     * https://developer.okta.com/docs/reference/api/idps/#oauth-2-0-and-openid-connect-client-object
-     */
-    pkceRequired?: pulumi.Input<boolean>;
     /**
      * Determines if the IdP should act as a source of truth for user profile attributes.
      */
diff --git a/sdk/nodejs/inline/hook.ts b/sdk/nodejs/inline/hook.ts
index fc0d91f4..b9a45ded 100644
--- a/sdk/nodejs/inline/hook.ts
+++ b/sdk/nodejs/inline/hook.ts
@@ -87,6 +87,9 @@ export class Hook extends pulumi.CustomResource {
      * The inline hook display name.
      */
     public readonly name!: pulumi.Output<string>;
+    /**
+     * Default to `ACTIVE`
+     */
     public readonly status!: pulumi.Output<string | undefined>;
     /**
      * The type of hook to trigger. Currently, the only supported type is `"HTTP"`.
@@ -161,6 +164,9 @@ export interface HookState {
      * The inline hook display name.
      */
     name?: pulumi.Input<string>;
+    /**
+     * Default to `ACTIVE`
+     */
     status?: pulumi.Input<string>;
     /**
      * The type of hook to trigger. Currently, the only supported type is `"HTTP"`.
@@ -192,6 +198,9 @@ export interface HookArgs {
      * The inline hook display name.
      */
     name?: pulumi.Input<string>;
+    /**
+     * Default to `ACTIVE`
+     */
     status?: pulumi.Input<string>;
     /**
      * The type of hook to trigger. Currently, the only supported type is `"HTTP"`.
diff --git a/sdk/nodejs/orgConfiguration.ts b/sdk/nodejs/orgConfiguration.ts
index 3c15395e..207e386b 100644
--- a/sdk/nodejs/orgConfiguration.ts
+++ b/sdk/nodejs/orgConfiguration.ts
@@ -92,7 +92,8 @@ export class OrgConfiguration extends pulumi.CustomResource {
      */
     public /*out*/ readonly expiresAt!: pulumi.Output<string>;
     /**
-     * Local path to logo of the org.
+     * Logo of org. The file must be in PNG, JPG, or GIF format and less than 1 MB in size. For best results use landscape
+     * orientation, a transparent background, and a minimum size of 420px by 120px to prevent upscaling.
      */
     public readonly logo!: pulumi.Output<string | undefined>;
     /**
@@ -223,7 +224,8 @@ export interface OrgConfigurationState {
      */
     expiresAt?: pulumi.Input<string>;
     /**
-     * Local path to logo of the org.
+     * Logo of org. The file must be in PNG, JPG, or GIF format and less than 1 MB in size. For best results use landscape
+     * orientation, a transparent background, and a minimum size of 420px by 120px to prevent upscaling.
      */
     logo?: pulumi.Input<string>;
     /**
@@ -293,7 +295,8 @@ export interface OrgConfigurationArgs {
      */
     endUserSupportHelpUrl?: pulumi.Input<string>;
     /**
-     * Local path to logo of the org.
+     * Logo of org. The file must be in PNG, JPG, or GIF format and less than 1 MB in size. For best results use landscape
+     * orientation, a transparent background, and a minimum size of 420px by 120px to prevent upscaling.
      */
     logo?: pulumi.Input<string>;
     /**
diff --git a/sdk/nodejs/package.json b/sdk/nodejs/package.json
index 57ece07c..f553cfc2 100644
--- a/sdk/nodejs/package.json
+++ b/sdk/nodejs/package.json
@@ -1,7 +1,7 @@
 {
     "name": "@pulumi/okta",
     "version": "${VERSION}",
-    "description": "A Pulumi package for creating and managing okta resources.. Based on terraform-provider-okta: version v4.8.0",
+    "description": "A Pulumi package for creating and managing okta resources.. Based on terraform-provider-okta: version v4.8.1",
     "keywords": [
         "pulumi",
         "okta"
diff --git a/sdk/nodejs/policy/deviceAssuranceAndroid.ts b/sdk/nodejs/policy/deviceAssuranceAndroid.ts
index e000cbc7..03b1a625 100644
--- a/sdk/nodejs/policy/deviceAssuranceAndroid.ts
+++ b/sdk/nodejs/policy/deviceAssuranceAndroid.ts
@@ -41,11 +41,11 @@ export class DeviceAssuranceAndroid extends pulumi.CustomResource {
      */
     public /*out*/ readonly createdDate!: pulumi.Output<string>;
     /**
-     * List of disk encryption type, can be FULL, USER
+     * List of disk encryption type, can be `FULL`, `USER`
      */
     public readonly diskEncryptionTypes!: pulumi.Output<string[] | undefined>;
     /**
-     * The device jailbreak. Only for android and iOS platform
+     * Is the device jailbroken in the device assurance policy.
      */
     public readonly jailbreak!: pulumi.Output<boolean | undefined>;
     /**
@@ -61,7 +61,7 @@ export class DeviceAssuranceAndroid extends pulumi.CustomResource {
      */
     public readonly name!: pulumi.Output<string>;
     /**
-     * The device os minimum version
+     * Minimum os version of the device in the device assurance policy.
      */
     public readonly osVersion!: pulumi.Output<string | undefined>;
     /**
@@ -69,11 +69,11 @@ export class DeviceAssuranceAndroid extends pulumi.CustomResource {
      */
     public /*out*/ readonly platform!: pulumi.Output<string>;
     /**
-     * List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      */
     public readonly screenlockTypes!: pulumi.Output<string[] | undefined>;
     /**
-     * Indicates if the device constains a secure hardware functionality
+     * Indicates if the device contains a secure hardware functionality
      */
     public readonly secureHardwarePresent!: pulumi.Output<boolean | undefined>;
 
@@ -133,11 +133,11 @@ export interface DeviceAssuranceAndroidState {
      */
     createdDate?: pulumi.Input<string>;
     /**
-     * List of disk encryption type, can be FULL, USER
+     * List of disk encryption type, can be `FULL`, `USER`
      */
     diskEncryptionTypes?: pulumi.Input<pulumi.Input<string>[]>;
     /**
-     * The device jailbreak. Only for android and iOS platform
+     * Is the device jailbroken in the device assurance policy.
      */
     jailbreak?: pulumi.Input<boolean>;
     /**
@@ -153,7 +153,7 @@ export interface DeviceAssuranceAndroidState {
      */
     name?: pulumi.Input<string>;
     /**
-     * The device os minimum version
+     * Minimum os version of the device in the device assurance policy.
      */
     osVersion?: pulumi.Input<string>;
     /**
@@ -161,11 +161,11 @@ export interface DeviceAssuranceAndroidState {
      */
     platform?: pulumi.Input<string>;
     /**
-     * List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      */
     screenlockTypes?: pulumi.Input<pulumi.Input<string>[]>;
     /**
-     * Indicates if the device constains a secure hardware functionality
+     * Indicates if the device contains a secure hardware functionality
      */
     secureHardwarePresent?: pulumi.Input<boolean>;
 }
@@ -175,11 +175,11 @@ export interface DeviceAssuranceAndroidState {
  */
 export interface DeviceAssuranceAndroidArgs {
     /**
-     * List of disk encryption type, can be FULL, USER
+     * List of disk encryption type, can be `FULL`, `USER`
      */
     diskEncryptionTypes?: pulumi.Input<pulumi.Input<string>[]>;
     /**
-     * The device jailbreak. Only for android and iOS platform
+     * Is the device jailbroken in the device assurance policy.
      */
     jailbreak?: pulumi.Input<boolean>;
     /**
@@ -187,15 +187,15 @@ export interface DeviceAssuranceAndroidArgs {
      */
     name?: pulumi.Input<string>;
     /**
-     * The device os minimum version
+     * Minimum os version of the device in the device assurance policy.
      */
     osVersion?: pulumi.Input<string>;
     /**
-     * List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      */
     screenlockTypes?: pulumi.Input<pulumi.Input<string>[]>;
     /**
-     * Indicates if the device constains a secure hardware functionality
+     * Indicates if the device contains a secure hardware functionality
      */
     secureHardwarePresent?: pulumi.Input<boolean>;
 }
diff --git a/sdk/nodejs/policy/deviceAssuranceChromeos.ts b/sdk/nodejs/policy/deviceAssuranceChromeos.ts
index 138e415d..704f9a4e 100644
--- a/sdk/nodejs/policy/deviceAssuranceChromeos.ts
+++ b/sdk/nodejs/policy/deviceAssuranceChromeos.ts
@@ -49,7 +49,7 @@ export class DeviceAssuranceChromeos extends pulumi.CustomResource {
      */
     public /*out*/ readonly lastUpdatedBy!: pulumi.Output<string>;
     /**
-     * Policy device assurance name
+     * Name of the device assurance policy.
      */
     public readonly name!: pulumi.Output<string>;
     /**
@@ -195,7 +195,7 @@ export interface DeviceAssuranceChromeosState {
      */
     lastUpdatedBy?: pulumi.Input<string>;
     /**
-     * Policy device assurance name
+     * Name of the device assurance policy.
      */
     name?: pulumi.Input<string>;
     /**
@@ -265,7 +265,7 @@ export interface DeviceAssuranceChromeosState {
  */
 export interface DeviceAssuranceChromeosArgs {
     /**
-     * Policy device assurance name
+     * Name of the device assurance policy.
      */
     name?: pulumi.Input<string>;
     /**
diff --git a/sdk/nodejs/policy/deviceAssuranceIos.ts b/sdk/nodejs/policy/deviceAssuranceIos.ts
index cd19a68e..eca97889 100644
--- a/sdk/nodejs/policy/deviceAssuranceIos.ts
+++ b/sdk/nodejs/policy/deviceAssuranceIos.ts
@@ -33,31 +33,31 @@ export class DeviceAssuranceIos extends pulumi.CustomResource {
     }
 
     /**
-     * Created by
+     * Created by of the device assurance polic
      */
     public /*out*/ readonly createdBy!: pulumi.Output<string>;
     /**
-     * Created date
+     * Created date of the device assurance polic
      */
     public /*out*/ readonly createdDate!: pulumi.Output<string>;
     /**
-     * The device jailbreak. Only for android and iOS platform
+     * Is the device jailbroken in the device assurance policy.
      */
     public readonly jailbreak!: pulumi.Output<boolean | undefined>;
     /**
-     * Last update
+     * Last update of the device assurance polic
      */
     public /*out*/ readonly lastUpdate!: pulumi.Output<string>;
     /**
-     * Last updated by
+     * Last updated by of the device assurance polic
      */
     public /*out*/ readonly lastUpdatedBy!: pulumi.Output<string>;
     /**
-     * Policy device assurance name
+     * Name of the device assurance policy.
      */
     public readonly name!: pulumi.Output<string>;
     /**
-     * The device os minimum version
+     * Minimum os version of the device in the device assurance policy.
      */
     public readonly osVersion!: pulumi.Output<string | undefined>;
     /**
@@ -65,7 +65,7 @@ export class DeviceAssuranceIos extends pulumi.CustomResource {
      */
     public /*out*/ readonly platform!: pulumi.Output<string>;
     /**
-     * List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      */
     public readonly screenlockTypes!: pulumi.Output<string[] | undefined>;
 
@@ -113,31 +113,31 @@ export class DeviceAssuranceIos extends pulumi.CustomResource {
  */
 export interface DeviceAssuranceIosState {
     /**
-     * Created by
+     * Created by of the device assurance polic
      */
     createdBy?: pulumi.Input<string>;
     /**
-     * Created date
+     * Created date of the device assurance polic
      */
     createdDate?: pulumi.Input<string>;
     /**
-     * The device jailbreak. Only for android and iOS platform
+     * Is the device jailbroken in the device assurance policy.
      */
     jailbreak?: pulumi.Input<boolean>;
     /**
-     * Last update
+     * Last update of the device assurance polic
      */
     lastUpdate?: pulumi.Input<string>;
     /**
-     * Last updated by
+     * Last updated by of the device assurance polic
      */
     lastUpdatedBy?: pulumi.Input<string>;
     /**
-     * Policy device assurance name
+     * Name of the device assurance policy.
      */
     name?: pulumi.Input<string>;
     /**
-     * The device os minimum version
+     * Minimum os version of the device in the device assurance policy.
      */
     osVersion?: pulumi.Input<string>;
     /**
@@ -145,7 +145,7 @@ export interface DeviceAssuranceIosState {
      */
     platform?: pulumi.Input<string>;
     /**
-     * List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      */
     screenlockTypes?: pulumi.Input<pulumi.Input<string>[]>;
 }
@@ -155,19 +155,19 @@ export interface DeviceAssuranceIosState {
  */
 export interface DeviceAssuranceIosArgs {
     /**
-     * The device jailbreak. Only for android and iOS platform
+     * Is the device jailbroken in the device assurance policy.
      */
     jailbreak?: pulumi.Input<boolean>;
     /**
-     * Policy device assurance name
+     * Name of the device assurance policy.
      */
     name?: pulumi.Input<string>;
     /**
-     * The device os minimum version
+     * Minimum os version of the device in the device assurance policy.
      */
     osVersion?: pulumi.Input<string>;
     /**
-     * List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      */
     screenlockTypes?: pulumi.Input<pulumi.Input<string>[]>;
 }
diff --git a/sdk/nodejs/policy/deviceAssuranceMacos.ts b/sdk/nodejs/policy/deviceAssuranceMacos.ts
index f228737a..86f1d8de 100644
--- a/sdk/nodejs/policy/deviceAssuranceMacos.ts
+++ b/sdk/nodejs/policy/deviceAssuranceMacos.ts
@@ -41,7 +41,7 @@ export class DeviceAssuranceMacos extends pulumi.CustomResource {
      */
     public /*out*/ readonly createdDate!: pulumi.Output<string>;
     /**
-     * List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+     * List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
      */
     public readonly diskEncryptionTypes!: pulumi.Output<string[] | undefined>;
     /**
@@ -53,11 +53,11 @@ export class DeviceAssuranceMacos extends pulumi.CustomResource {
      */
     public /*out*/ readonly lastUpdatedBy!: pulumi.Output<string>;
     /**
-     * Policy device assurance name
+     * Name of the device assurance policy.
      */
     public readonly name!: pulumi.Output<string>;
     /**
-     * The device os minimum version
+     * Minimum os version of the device in the device assurance policy.
      */
     public readonly osVersion!: pulumi.Output<string | undefined>;
     /**
@@ -65,11 +65,11 @@ export class DeviceAssuranceMacos extends pulumi.CustomResource {
      */
     public /*out*/ readonly platform!: pulumi.Output<string>;
     /**
-     * List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      */
     public readonly screenlockTypes!: pulumi.Output<string[] | undefined>;
     /**
-     * Indicates if the device constains a secure hardware functionality
+     * Is the device secure with hardware in the device assurance policy.
      */
     public readonly secureHardwarePresent!: pulumi.Output<boolean | undefined>;
     /**
@@ -211,7 +211,7 @@ export interface DeviceAssuranceMacosState {
      */
     createdDate?: pulumi.Input<string>;
     /**
-     * List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+     * List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
      */
     diskEncryptionTypes?: pulumi.Input<pulumi.Input<string>[]>;
     /**
@@ -223,11 +223,11 @@ export interface DeviceAssuranceMacosState {
      */
     lastUpdatedBy?: pulumi.Input<string>;
     /**
-     * Policy device assurance name
+     * Name of the device assurance policy.
      */
     name?: pulumi.Input<string>;
     /**
-     * The device os minimum version
+     * Minimum os version of the device in the device assurance policy.
      */
     osVersion?: pulumi.Input<string>;
     /**
@@ -235,11 +235,11 @@ export interface DeviceAssuranceMacosState {
      */
     platform?: pulumi.Input<string>;
     /**
-     * List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      */
     screenlockTypes?: pulumi.Input<pulumi.Input<string>[]>;
     /**
-     * Indicates if the device constains a secure hardware functionality
+     * Is the device secure with hardware in the device assurance policy.
      */
     secureHardwarePresent?: pulumi.Input<boolean>;
     /**
@@ -305,23 +305,23 @@ export interface DeviceAssuranceMacosState {
  */
 export interface DeviceAssuranceMacosArgs {
     /**
-     * List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+     * List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
      */
     diskEncryptionTypes?: pulumi.Input<pulumi.Input<string>[]>;
     /**
-     * Policy device assurance name
+     * Name of the device assurance policy.
      */
     name?: pulumi.Input<string>;
     /**
-     * The device os minimum version
+     * Minimum os version of the device in the device assurance policy.
      */
     osVersion?: pulumi.Input<string>;
     /**
-     * List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      */
     screenlockTypes?: pulumi.Input<pulumi.Input<string>[]>;
     /**
-     * Indicates if the device constains a secure hardware functionality
+     * Is the device secure with hardware in the device assurance policy.
      */
     secureHardwarePresent?: pulumi.Input<boolean>;
     /**
diff --git a/sdk/nodejs/policy/deviceAssuranceWindows.ts b/sdk/nodejs/policy/deviceAssuranceWindows.ts
index 7ef96d64..4b1fb1a9 100644
--- a/sdk/nodejs/policy/deviceAssuranceWindows.ts
+++ b/sdk/nodejs/policy/deviceAssuranceWindows.ts
@@ -41,7 +41,7 @@ export class DeviceAssuranceWindows extends pulumi.CustomResource {
      */
     public /*out*/ readonly createdDate!: pulumi.Output<string>;
     /**
-     * List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+     * List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
      */
     public readonly diskEncryptionTypes!: pulumi.Output<string[] | undefined>;
     /**
@@ -53,11 +53,11 @@ export class DeviceAssuranceWindows extends pulumi.CustomResource {
      */
     public /*out*/ readonly lastUpdatedBy!: pulumi.Output<string>;
     /**
-     * Policy device assurance name
+     * Name of the device assurance policy.
      */
     public readonly name!: pulumi.Output<string>;
     /**
-     * The device os minimum version
+     * Minimum os version of the device in the device assurance policy.
      */
     public readonly osVersion!: pulumi.Output<string | undefined>;
     /**
@@ -65,11 +65,11 @@ export class DeviceAssuranceWindows extends pulumi.CustomResource {
      */
     public /*out*/ readonly platform!: pulumi.Output<string>;
     /**
-     * List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      */
     public readonly screenlockTypes!: pulumi.Output<string[] | undefined>;
     /**
-     * Indicates if the device constains a secure hardware functionality
+     * Is the device secure with hardware in the device assurance policy.
      */
     public readonly secureHardwarePresent!: pulumi.Output<boolean | undefined>;
     /**
@@ -247,7 +247,7 @@ export interface DeviceAssuranceWindowsState {
      */
     createdDate?: pulumi.Input<string>;
     /**
-     * List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+     * List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
      */
     diskEncryptionTypes?: pulumi.Input<pulumi.Input<string>[]>;
     /**
@@ -259,11 +259,11 @@ export interface DeviceAssuranceWindowsState {
      */
     lastUpdatedBy?: pulumi.Input<string>;
     /**
-     * Policy device assurance name
+     * Name of the device assurance policy.
      */
     name?: pulumi.Input<string>;
     /**
-     * The device os minimum version
+     * Minimum os version of the device in the device assurance policy.
      */
     osVersion?: pulumi.Input<string>;
     /**
@@ -271,11 +271,11 @@ export interface DeviceAssuranceWindowsState {
      */
     platform?: pulumi.Input<string>;
     /**
-     * List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      */
     screenlockTypes?: pulumi.Input<pulumi.Input<string>[]>;
     /**
-     * Indicates if the device constains a secure hardware functionality
+     * Is the device secure with hardware in the device assurance policy.
      */
     secureHardwarePresent?: pulumi.Input<boolean>;
     /**
@@ -365,23 +365,23 @@ export interface DeviceAssuranceWindowsState {
  */
 export interface DeviceAssuranceWindowsArgs {
     /**
-     * List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+     * List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
      */
     diskEncryptionTypes?: pulumi.Input<pulumi.Input<string>[]>;
     /**
-     * Policy device assurance name
+     * Name of the device assurance policy.
      */
     name?: pulumi.Input<string>;
     /**
-     * The device os minimum version
+     * Minimum os version of the device in the device assurance policy.
      */
     osVersion?: pulumi.Input<string>;
     /**
-     * List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+     * List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
      */
     screenlockTypes?: pulumi.Input<pulumi.Input<string>[]>;
     /**
-     * Indicates if the device constains a secure hardware functionality
+     * Is the device secure with hardware in the device assurance policy.
      */
     secureHardwarePresent?: pulumi.Input<boolean>;
     /**
diff --git a/sdk/nodejs/policy/ruleIdpDiscovery.ts b/sdk/nodejs/policy/ruleIdpDiscovery.ts
index 33080da3..03ef0a70 100644
--- a/sdk/nodejs/policy/ruleIdpDiscovery.ts
+++ b/sdk/nodejs/policy/ruleIdpDiscovery.ts
@@ -139,6 +139,11 @@ export class RuleIdpDiscovery extends pulumi.CustomResource {
      * Required if `networkConnection` = `"ZONE"`. Indicates the network zones to include.
      */
     public readonly networkIncludes!: pulumi.Output<string[] | undefined>;
+    /**
+     * Platform to include in discovery rule. - 'type' - (Optional) One of: 'ANY', 'MOBILE', 'DESKTOP' - 'os_expression -
+     * (Optional) Only available when using os_type = 'OTHER' - 'os_type' - (Optional) One of: 'ANY', 'IOS', 'WINDOWS',
+     * 'ANDROID', 'OTHER', 'OSX'
+     */
     public readonly platformIncludes!: pulumi.Output<outputs.policy.RuleIdpDiscoveryPlatformInclude[] | undefined>;
     /**
      * Policy ID.
@@ -258,6 +263,11 @@ export interface RuleIdpDiscoveryState {
      * Required if `networkConnection` = `"ZONE"`. Indicates the network zones to include.
      */
     networkIncludes?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Platform to include in discovery rule. - 'type' - (Optional) One of: 'ANY', 'MOBILE', 'DESKTOP' - 'os_expression -
+     * (Optional) Only available when using os_type = 'OTHER' - 'os_type' - (Optional) One of: 'ANY', 'IOS', 'WINDOWS',
+     * 'ANDROID', 'OTHER', 'OSX'
+     */
     platformIncludes?: pulumi.Input<pulumi.Input<inputs.policy.RuleIdpDiscoveryPlatformInclude>[]>;
     /**
      * Policy ID.
@@ -327,6 +337,11 @@ export interface RuleIdpDiscoveryArgs {
      * Required if `networkConnection` = `"ZONE"`. Indicates the network zones to include.
      */
     networkIncludes?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * Platform to include in discovery rule. - 'type' - (Optional) One of: 'ANY', 'MOBILE', 'DESKTOP' - 'os_expression -
+     * (Optional) Only available when using os_type = 'OTHER' - 'os_type' - (Optional) One of: 'ANY', 'IOS', 'WINDOWS',
+     * 'ANDROID', 'OTHER', 'OSX'
+     */
     platformIncludes?: pulumi.Input<pulumi.Input<inputs.policy.RuleIdpDiscoveryPlatformInclude>[]>;
     /**
      * Policy ID.
diff --git a/sdk/nodejs/policy/ruleMfa.ts b/sdk/nodejs/policy/ruleMfa.ts
index 923352db..25ec915e 100644
--- a/sdk/nodejs/policy/ruleMfa.ts
+++ b/sdk/nodejs/policy/ruleMfa.ts
@@ -46,7 +46,10 @@ export class RuleMfa extends pulumi.CustomResource {
     }
 
     /**
-     * Applications to exclude
+     * Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations. - 'id'
+     * - (Optional) Use if 'type' is 'APP' to indicate the application id to include. - 'name' - (Optional) Use if the 'type'
+     * is 'APP_TYPE' to indicate the type of application(s) to include in instances where an entire group (i.e. 'yahoo_mail')
+     * of applications should be included. - 'type' - (Required) One of: 'APP', 'APP_TYPE'
      */
     public readonly appExcludes!: pulumi.Output<outputs.policy.RuleMfaAppExclude[] | undefined>;
     /**
@@ -138,7 +141,10 @@ export class RuleMfa extends pulumi.CustomResource {
  */
 export interface RuleMfaState {
     /**
-     * Applications to exclude
+     * Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations. - 'id'
+     * - (Optional) Use if 'type' is 'APP' to indicate the application id to include. - 'name' - (Optional) Use if the 'type'
+     * is 'APP_TYPE' to indicate the type of application(s) to include in instances where an entire group (i.e. 'yahoo_mail')
+     * of applications should be included. - 'type' - (Required) One of: 'APP', 'APP_TYPE'
      */
     appExcludes?: pulumi.Input<pulumi.Input<inputs.policy.RuleMfaAppExclude>[]>;
     /**
@@ -188,7 +194,10 @@ export interface RuleMfaState {
  */
 export interface RuleMfaArgs {
     /**
-     * Applications to exclude
+     * Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations. - 'id'
+     * - (Optional) Use if 'type' is 'APP' to indicate the application id to include. - 'name' - (Optional) Use if the 'type'
+     * is 'APP_TYPE' to indicate the type of application(s) to include in instances where an entire group (i.e. 'yahoo_mail')
+     * of applications should be included. - 'type' - (Required) One of: 'APP', 'APP_TYPE'
      */
     appExcludes?: pulumi.Input<pulumi.Input<inputs.policy.RuleMfaAppExclude>[]>;
     /**
diff --git a/sdk/nodejs/policy/ruleSignon.ts b/sdk/nodejs/policy/ruleSignon.ts
index 5ec32d13..ace666e5 100644
--- a/sdk/nodejs/policy/ruleSignon.ts
+++ b/sdk/nodejs/policy/ruleSignon.ts
@@ -202,8 +202,14 @@ export class RuleSignon extends pulumi.CustomResource {
     /**
      * Risc level: `"ANY"`, `"LOW"`, `"MEDIUM"` or `"HIGH"`. Default is `"ANY"`. It can be also 
      * set to an empty string in case `RISC_SCORING` org feature flag is disabled.
+     *
+     * @deprecated Attribute typo, switch to riskLevel instead. Default: `ANY`
      */
     public readonly riscLevel!: pulumi.Output<string | undefined>;
+    /**
+     * Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
+     */
+    public readonly riskLevel!: pulumi.Output<string | undefined>;
     /**
      * Max minutes a session can be idle.,
      */
@@ -256,6 +262,7 @@ export class RuleSignon extends pulumi.CustomResource {
             resourceInputs["primaryFactor"] = state ? state.primaryFactor : undefined;
             resourceInputs["priority"] = state ? state.priority : undefined;
             resourceInputs["riscLevel"] = state ? state.riscLevel : undefined;
+            resourceInputs["riskLevel"] = state ? state.riskLevel : undefined;
             resourceInputs["sessionIdle"] = state ? state.sessionIdle : undefined;
             resourceInputs["sessionLifetime"] = state ? state.sessionLifetime : undefined;
             resourceInputs["sessionPersistent"] = state ? state.sessionPersistent : undefined;
@@ -281,6 +288,7 @@ export class RuleSignon extends pulumi.CustomResource {
             resourceInputs["primaryFactor"] = args ? args.primaryFactor : undefined;
             resourceInputs["priority"] = args ? args.priority : undefined;
             resourceInputs["riscLevel"] = args ? args.riscLevel : undefined;
+            resourceInputs["riskLevel"] = args ? args.riskLevel : undefined;
             resourceInputs["sessionIdle"] = args ? args.sessionIdle : undefined;
             resourceInputs["sessionLifetime"] = args ? args.sessionLifetime : undefined;
             resourceInputs["sessionPersistent"] = args ? args.sessionPersistent : undefined;
@@ -370,8 +378,14 @@ export interface RuleSignonState {
     /**
      * Risc level: `"ANY"`, `"LOW"`, `"MEDIUM"` or `"HIGH"`. Default is `"ANY"`. It can be also 
      * set to an empty string in case `RISC_SCORING` org feature flag is disabled.
+     *
+     * @deprecated Attribute typo, switch to riskLevel instead. Default: `ANY`
      */
     riscLevel?: pulumi.Input<string>;
+    /**
+     * Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
+     */
+    riskLevel?: pulumi.Input<string>;
     /**
      * Max minutes a session can be idle.,
      */
@@ -472,8 +486,14 @@ export interface RuleSignonArgs {
     /**
      * Risc level: `"ANY"`, `"LOW"`, `"MEDIUM"` or `"HIGH"`. Default is `"ANY"`. It can be also 
      * set to an empty string in case `RISC_SCORING` org feature flag is disabled.
+     *
+     * @deprecated Attribute typo, switch to riskLevel instead. Default: `ANY`
      */
     riscLevel?: pulumi.Input<string>;
+    /**
+     * Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
+     */
+    riskLevel?: pulumi.Input<string>;
     /**
      * Max minutes a session can be idle.,
      */
diff --git a/sdk/nodejs/roleSubscription.ts b/sdk/nodejs/roleSubscription.ts
index 81cafa6f..74bdfcdc 100644
--- a/sdk/nodejs/roleSubscription.ts
+++ b/sdk/nodejs/roleSubscription.ts
@@ -79,7 +79,7 @@ export class RoleSubscription extends pulumi.CustomResource {
     public readonly notificationType!: pulumi.Output<string>;
     /**
      * Type of the role. Valid values:
-     * `"API_ADMIN"`,
+     * `"API_ACCESS_MANAGEMENT_ADMIN"`,
      * `"APP_ADMIN"`,
      * `"CUSTOM"`,
      * `"GROUP_MEMBERSHIP_ADMIN"`,
@@ -154,7 +154,7 @@ export interface RoleSubscriptionState {
     notificationType?: pulumi.Input<string>;
     /**
      * Type of the role. Valid values:
-     * `"API_ADMIN"`,
+     * `"API_ACCESS_MANAGEMENT_ADMIN"`,
      * `"APP_ADMIN"`,
      * `"CUSTOM"`,
      * `"GROUP_MEMBERSHIP_ADMIN"`,
@@ -197,7 +197,7 @@ export interface RoleSubscriptionArgs {
     notificationType: pulumi.Input<string>;
     /**
      * Type of the role. Valid values:
-     * `"API_ADMIN"`,
+     * `"API_ACCESS_MANAGEMENT_ADMIN"`,
      * `"APP_ADMIN"`,
      * `"CUSTOM"`,
      * `"GROUP_MEMBERSHIP_ADMIN"`,
diff --git a/sdk/nodejs/user/user.ts b/sdk/nodejs/user/user.ts
index ac4cbd81..fa0f35c3 100644
--- a/sdk/nodejs/user/user.ts
+++ b/sdk/nodejs/user/user.ts
@@ -126,7 +126,8 @@ export class User extends pulumi.CustomResource {
      */
     public readonly customProfileAttributes!: pulumi.Output<string>;
     /**
-     * List of custom_profile_attribute keys that should be excluded from being managed by Terraform.
+     * List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in
+     * situations where specific custom fields may contain sensitive information and should be managed outside of Terraform.
      */
     public readonly customProfileAttributesToIgnores!: pulumi.Output<string[] | undefined>;
     /**
@@ -435,7 +436,8 @@ export interface UserState {
      */
     customProfileAttributes?: pulumi.Input<string>;
     /**
-     * List of custom_profile_attribute keys that should be excluded from being managed by Terraform.
+     * List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in
+     * situations where specific custom fields may contain sensitive information and should be managed outside of Terraform.
      */
     customProfileAttributesToIgnores?: pulumi.Input<pulumi.Input<string>[]>;
     /**
@@ -624,7 +626,8 @@ export interface UserArgs {
      */
     customProfileAttributes?: pulumi.Input<string>;
     /**
-     * List of custom_profile_attribute keys that should be excluded from being managed by Terraform.
+     * List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in
+     * situations where specific custom fields may contain sensitive information and should be managed outside of Terraform.
      */
     customProfileAttributesToIgnores?: pulumi.Input<pulumi.Input<string>[]>;
     /**
diff --git a/sdk/python/pulumi_okta/app/get_saml.py b/sdk/python/pulumi_okta/app/get_saml.py
index 0194c975..7d39e584 100644
--- a/sdk/python/pulumi_okta/app/get_saml.py
+++ b/sdk/python/pulumi_okta/app/get_saml.py
@@ -414,7 +414,7 @@ def saml_signed_request_enabled(self) -> bool:
     @pulumi.getter(name="signatureAlgorithm")
     def signature_algorithm(self) -> str:
         """
-        Signature algorithm used ot digitally sign the assertion and response.
+        Signature algorithm used to digitally sign the assertion and response.
         """
         return pulumi.get(self, "signature_algorithm")
 
diff --git a/sdk/python/pulumi_okta/app/saml.py b/sdk/python/pulumi_okta/app/saml.py
index f780f819..cce99ec2 100644
--- a/sdk/python/pulumi_okta/app/saml.py
+++ b/sdk/python/pulumi_okta/app/saml.py
@@ -97,7 +97,7 @@ def __init__(__self__, *,
         :param pulumi.Input[bool] response_signed: Determines whether the SAML auth response message is digitally signed.
         :param pulumi.Input[bool] saml_signed_request_enabled: SAML Signed Request enabled
         :param pulumi.Input[str] saml_version: SAML version for the app's sign-on mode. Valid values are: `"2.0"` or `"1.1"`. Default is `"2.0"`.
-        :param pulumi.Input[str] signature_algorithm: Signature algorithm used ot digitally sign the assertion and response.
+        :param pulumi.Input[str] signature_algorithm: Signature algorithm used to digitally sign the assertion and response.
         :param pulumi.Input[str] single_logout_certificate: x509 encoded certificate that the Service Provider uses to sign Single Logout requests.  Note: should be provided without `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----`, see [official documentation](https://developer.okta.com/docs/reference/api/apps/#service-provider-certificate).
         :param pulumi.Input[str] single_logout_issuer: The issuer of the Service Provider that generates the Single Logout request.
         :param pulumi.Input[str] single_logout_url: The location where the logout response is sent.
@@ -603,7 +603,7 @@ def saml_version(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="signatureAlgorithm")
     def signature_algorithm(self) -> Optional[pulumi.Input[str]]:
         """
-        Signature algorithm used ot digitally sign the assertion and response.
+        Signature algorithm used to digitally sign the assertion and response.
         """
         return pulumi.get(self, "signature_algorithm")
 
@@ -868,7 +868,7 @@ def __init__(__self__, *,
         :param pulumi.Input[bool] saml_signed_request_enabled: SAML Signed Request enabled
         :param pulumi.Input[str] saml_version: SAML version for the app's sign-on mode. Valid values are: `"2.0"` or `"1.1"`. Default is `"2.0"`.
         :param pulumi.Input[str] sign_on_mode: Sign-on mode of application.
-        :param pulumi.Input[str] signature_algorithm: Signature algorithm used ot digitally sign the assertion and response.
+        :param pulumi.Input[str] signature_algorithm: Signature algorithm used to digitally sign the assertion and response.
         :param pulumi.Input[str] single_logout_certificate: x509 encoded certificate that the Service Provider uses to sign Single Logout requests.  Note: should be provided without `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----`, see [official documentation](https://developer.okta.com/docs/reference/api/apps/#service-provider-certificate).
         :param pulumi.Input[str] single_logout_issuer: The issuer of the Service Provider that generates the Single Logout request.
         :param pulumi.Input[str] single_logout_url: The location where the logout response is sent.
@@ -1571,7 +1571,7 @@ def sign_on_mode(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="signatureAlgorithm")
     def signature_algorithm(self) -> Optional[pulumi.Input[str]]:
         """
-        Signature algorithm used ot digitally sign the assertion and response.
+        Signature algorithm used to digitally sign the assertion and response.
         """
         return pulumi.get(self, "signature_algorithm")
 
@@ -1977,7 +1977,7 @@ def __init__(__self__,
         :param pulumi.Input[bool] response_signed: Determines whether the SAML auth response message is digitally signed.
         :param pulumi.Input[bool] saml_signed_request_enabled: SAML Signed Request enabled
         :param pulumi.Input[str] saml_version: SAML version for the app's sign-on mode. Valid values are: `"2.0"` or `"1.1"`. Default is `"2.0"`.
-        :param pulumi.Input[str] signature_algorithm: Signature algorithm used ot digitally sign the assertion and response.
+        :param pulumi.Input[str] signature_algorithm: Signature algorithm used to digitally sign the assertion and response.
         :param pulumi.Input[str] single_logout_certificate: x509 encoded certificate that the Service Provider uses to sign Single Logout requests.  Note: should be provided without `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----`, see [official documentation](https://developer.okta.com/docs/reference/api/apps/#service-provider-certificate).
         :param pulumi.Input[str] single_logout_issuer: The issuer of the Service Provider that generates the Single Logout request.
         :param pulumi.Input[str] single_logout_url: The location where the logout response is sent.
@@ -2419,7 +2419,7 @@ def get(resource_name: str,
         :param pulumi.Input[bool] saml_signed_request_enabled: SAML Signed Request enabled
         :param pulumi.Input[str] saml_version: SAML version for the app's sign-on mode. Valid values are: `"2.0"` or `"1.1"`. Default is `"2.0"`.
         :param pulumi.Input[str] sign_on_mode: Sign-on mode of application.
-        :param pulumi.Input[str] signature_algorithm: Signature algorithm used ot digitally sign the assertion and response.
+        :param pulumi.Input[str] signature_algorithm: Signature algorithm used to digitally sign the assertion and response.
         :param pulumi.Input[str] single_logout_certificate: x509 encoded certificate that the Service Provider uses to sign Single Logout requests.  Note: should be provided without `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----`, see [official documentation](https://developer.okta.com/docs/reference/api/apps/#service-provider-certificate).
         :param pulumi.Input[str] single_logout_issuer: The issuer of the Service Provider that generates the Single Logout request.
         :param pulumi.Input[str] single_logout_url: The location where the logout response is sent.
@@ -2879,7 +2879,7 @@ def sign_on_mode(self) -> pulumi.Output[str]:
     @pulumi.getter(name="signatureAlgorithm")
     def signature_algorithm(self) -> pulumi.Output[Optional[str]]:
         """
-        Signature algorithm used ot digitally sign the assertion and response.
+        Signature algorithm used to digitally sign the assertion and response.
         """
         return pulumi.get(self, "signature_algorithm")
 
diff --git a/sdk/python/pulumi_okta/app/three_field.py b/sdk/python/pulumi_okta/app/three_field.py
index 495b85d0..b0a8afc0 100644
--- a/sdk/python/pulumi_okta/app/three_field.py
+++ b/sdk/python/pulumi_okta/app/three_field.py
@@ -54,7 +54,7 @@ def __init__(__self__, *,
         :param pulumi.Input[str] accessibility_login_redirect_url: Custom login page for this application.
         :param pulumi.Input[bool] accessibility_self_service: Enable self-service. By default, it is `false`.
         :param pulumi.Input[str] admin_note: Application notes for admins.
-        :param pulumi.Input[str] app_links_json: Displays specific appLinks for the app
+        :param pulumi.Input[str] app_links_json: Displays specific appLinks for the app. The value for each application link should be boolean.
         :param pulumi.Input[bool] auto_submit_toolbar: Display auto submit toolbar.
         :param pulumi.Input[str] credentials_scheme: Application credentials scheme. Can be set to `"EDIT_USERNAME_AND_PASSWORD"`, `"ADMIN_SETS_CREDENTIALS"`, `"EDIT_PASSWORD_ONLY"`, `"EXTERNAL_PASSWORD_SYNC"`, or `"SHARED_USERNAME_AND_PASSWORD"`.
         :param pulumi.Input[str] enduser_note: Application notes for end users.
@@ -255,7 +255,7 @@ def admin_note(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="appLinksJson")
     def app_links_json(self) -> Optional[pulumi.Input[str]]:
         """
-        Displays specific appLinks for the app
+        Displays specific appLinks for the app. The value for each application link should be boolean.
         """
         return pulumi.get(self, "app_links_json")
 
@@ -483,7 +483,7 @@ def __init__(__self__, *,
         :param pulumi.Input[str] accessibility_login_redirect_url: Custom login page for this application.
         :param pulumi.Input[bool] accessibility_self_service: Enable self-service. By default, it is `false`.
         :param pulumi.Input[str] admin_note: Application notes for admins.
-        :param pulumi.Input[str] app_links_json: Displays specific appLinks for the app
+        :param pulumi.Input[str] app_links_json: Displays specific appLinks for the app. The value for each application link should be boolean.
         :param pulumi.Input[bool] auto_submit_toolbar: Display auto submit toolbar.
         :param pulumi.Input[str] button_selector: Login button field CSS selector.
         :param pulumi.Input[str] credentials_scheme: Application credentials scheme. Can be set to `"EDIT_USERNAME_AND_PASSWORD"`, `"ADMIN_SETS_CREDENTIALS"`, `"EDIT_PASSWORD_ONLY"`, `"EXTERNAL_PASSWORD_SYNC"`, or `"SHARED_USERNAME_AND_PASSWORD"`.
@@ -623,7 +623,7 @@ def admin_note(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="appLinksJson")
     def app_links_json(self) -> Optional[pulumi.Input[str]]:
         """
-        Displays specific appLinks for the app
+        Displays specific appLinks for the app. The value for each application link should be boolean.
         """
         return pulumi.get(self, "app_links_json")
 
@@ -986,7 +986,7 @@ def __init__(__self__,
         :param pulumi.Input[str] accessibility_login_redirect_url: Custom login page for this application.
         :param pulumi.Input[bool] accessibility_self_service: Enable self-service. By default, it is `false`.
         :param pulumi.Input[str] admin_note: Application notes for admins.
-        :param pulumi.Input[str] app_links_json: Displays specific appLinks for the app
+        :param pulumi.Input[str] app_links_json: Displays specific appLinks for the app. The value for each application link should be boolean.
         :param pulumi.Input[bool] auto_submit_toolbar: Display auto submit toolbar.
         :param pulumi.Input[str] button_selector: Login button field CSS selector.
         :param pulumi.Input[str] credentials_scheme: Application credentials scheme. Can be set to `"EDIT_USERNAME_AND_PASSWORD"`, `"ADMIN_SETS_CREDENTIALS"`, `"EDIT_PASSWORD_ONLY"`, `"EXTERNAL_PASSWORD_SYNC"`, or `"SHARED_USERNAME_AND_PASSWORD"`.
@@ -1177,7 +1177,7 @@ def get(resource_name: str,
         :param pulumi.Input[str] accessibility_login_redirect_url: Custom login page for this application.
         :param pulumi.Input[bool] accessibility_self_service: Enable self-service. By default, it is `false`.
         :param pulumi.Input[str] admin_note: Application notes for admins.
-        :param pulumi.Input[str] app_links_json: Displays specific appLinks for the app
+        :param pulumi.Input[str] app_links_json: Displays specific appLinks for the app. The value for each application link should be boolean.
         :param pulumi.Input[bool] auto_submit_toolbar: Display auto submit toolbar.
         :param pulumi.Input[str] button_selector: Login button field CSS selector.
         :param pulumi.Input[str] credentials_scheme: Application credentials scheme. Can be set to `"EDIT_USERNAME_AND_PASSWORD"`, `"ADMIN_SETS_CREDENTIALS"`, `"EDIT_PASSWORD_ONLY"`, `"EXTERNAL_PASSWORD_SYNC"`, or `"SHARED_USERNAME_AND_PASSWORD"`.
@@ -1276,7 +1276,7 @@ def admin_note(self) -> pulumi.Output[Optional[str]]:
     @pulumi.getter(name="appLinksJson")
     def app_links_json(self) -> pulumi.Output[Optional[str]]:
         """
-        Displays specific appLinks for the app
+        Displays specific appLinks for the app. The value for each application link should be boolean.
         """
         return pulumi.get(self, "app_links_json")
 
diff --git a/sdk/python/pulumi_okta/app_user_schema_property.py b/sdk/python/pulumi_okta/app_user_schema_property.py
index c9e2e98b..77496fb0 100644
--- a/sdk/python/pulumi_okta/app_user_schema_property.py
+++ b/sdk/python/pulumi_okta/app_user_schema_property.py
@@ -58,8 +58,8 @@ def __init__(__self__, *,
         :param pulumi.Input[bool] required: Whether the property is required for this application's users.
         :param pulumi.Input[str] scope: determines whether an app user attribute can be set at the Personal `"SELF"` or Group `"NONE"` level. Default value is `"NONE"`.
         :param pulumi.Input[bool] union: If `type` is set to `"array"`, used to set whether attribute value is determined by group priority `false`, or combine values across groups `true`. Can not be set to `true` if `scope` is set to `"SELF"`.
-        :param pulumi.Input[str] unique: Subschema unique restriction
-        :param pulumi.Input[str] user_type: Custom subschema user type
+        :param pulumi.Input[str] unique: Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.
+        :param pulumi.Input[str] user_type: User type ID. By default, it is `default`
         """
         pulumi.set(__self__, "app_id", app_id)
         pulumi.set(__self__, "index", index)
@@ -332,7 +332,7 @@ def union(self, value: Optional[pulumi.Input[bool]]):
     @pulumi.getter
     def unique(self) -> Optional[pulumi.Input[str]]:
         """
-        Subschema unique restriction
+        Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.
         """
         return pulumi.get(self, "unique")
 
@@ -344,7 +344,7 @@ def unique(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="userType")
     def user_type(self) -> Optional[pulumi.Input[str]]:
         """
-        Custom subschema user type
+        User type ID. By default, it is `default`
         """
         return pulumi.get(self, "user_type")
 
@@ -398,8 +398,8 @@ def __init__(__self__, *,
         :param pulumi.Input[str] title: display name for the enum value.
         :param pulumi.Input[str] type: The type of the schema property. It can be `"string"`, `"boolean"`, `"number"`, `"integer"`, `"array"`, or `"object"`.
         :param pulumi.Input[bool] union: If `type` is set to `"array"`, used to set whether attribute value is determined by group priority `false`, or combine values across groups `true`. Can not be set to `true` if `scope` is set to `"SELF"`.
-        :param pulumi.Input[str] unique: Subschema unique restriction
-        :param pulumi.Input[str] user_type: Custom subschema user type
+        :param pulumi.Input[str] unique: Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.
+        :param pulumi.Input[str] user_type: User type ID. By default, it is `default`
         """
         if app_id is not None:
             pulumi.set(__self__, "app_id", app_id)
@@ -676,7 +676,7 @@ def union(self, value: Optional[pulumi.Input[bool]]):
     @pulumi.getter
     def unique(self) -> Optional[pulumi.Input[str]]:
         """
-        Subschema unique restriction
+        Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.
         """
         return pulumi.get(self, "unique")
 
@@ -688,7 +688,7 @@ def unique(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="userType")
     def user_type(self) -> Optional[pulumi.Input[str]]:
         """
-        Custom subschema user type
+        User type ID. By default, it is `default`
         """
         return pulumi.get(self, "user_type")
 
@@ -772,8 +772,8 @@ def __init__(__self__,
         :param pulumi.Input[str] title: display name for the enum value.
         :param pulumi.Input[str] type: The type of the schema property. It can be `"string"`, `"boolean"`, `"number"`, `"integer"`, `"array"`, or `"object"`.
         :param pulumi.Input[bool] union: If `type` is set to `"array"`, used to set whether attribute value is determined by group priority `false`, or combine values across groups `true`. Can not be set to `true` if `scope` is set to `"SELF"`.
-        :param pulumi.Input[str] unique: Subschema unique restriction
-        :param pulumi.Input[str] user_type: Custom subschema user type
+        :param pulumi.Input[str] unique: Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.
+        :param pulumi.Input[str] user_type: User type ID. By default, it is `default`
         """
         ...
     @overload
@@ -939,8 +939,8 @@ def get(resource_name: str,
         :param pulumi.Input[str] title: display name for the enum value.
         :param pulumi.Input[str] type: The type of the schema property. It can be `"string"`, `"boolean"`, `"number"`, `"integer"`, `"array"`, or `"object"`.
         :param pulumi.Input[bool] union: If `type` is set to `"array"`, used to set whether attribute value is determined by group priority `false`, or combine values across groups `true`. Can not be set to `true` if `scope` is set to `"SELF"`.
-        :param pulumi.Input[str] unique: Subschema unique restriction
-        :param pulumi.Input[str] user_type: Custom subschema user type
+        :param pulumi.Input[str] unique: Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.
+        :param pulumi.Input[str] user_type: User type ID. By default, it is `default`
         """
         opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
 
@@ -1125,7 +1125,7 @@ def union(self) -> pulumi.Output[Optional[bool]]:
     @pulumi.getter
     def unique(self) -> pulumi.Output[Optional[str]]:
         """
-        Subschema unique restriction
+        Whether the property should be unique. It can be set to `UNIQUE_VALIDATED` or `NOT_UNIQUE`.
         """
         return pulumi.get(self, "unique")
 
@@ -1133,7 +1133,7 @@ def unique(self) -> pulumi.Output[Optional[str]]:
     @pulumi.getter(name="userType")
     def user_type(self) -> pulumi.Output[Optional[str]]:
         """
-        Custom subschema user type
+        User type ID. By default, it is `default`
         """
         return pulumi.get(self, "user_type")
 
diff --git a/sdk/python/pulumi_okta/event_hook.py b/sdk/python/pulumi_okta/event_hook.py
index e072284d..9248205c 100644
--- a/sdk/python/pulumi_okta/event_hook.py
+++ b/sdk/python/pulumi_okta/event_hook.py
@@ -29,6 +29,7 @@ def __init__(__self__, *,
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] auth: Authentication required for event hook request.
         :param pulumi.Input[Sequence[pulumi.Input['EventHookHeaderArgs']]] headers: Map of headers to send along in event hook request.
         :param pulumi.Input[str] name: The event hook display name.
+        :param pulumi.Input[str] status: Default to `ACTIVE`
         """
         pulumi.set(__self__, "channel", channel)
         pulumi.set(__self__, "events", events)
@@ -104,6 +105,9 @@ def name(self, value: Optional[pulumi.Input[str]]):
     @property
     @pulumi.getter
     def status(self) -> Optional[pulumi.Input[str]]:
+        """
+        Default to `ACTIVE`
+        """
         return pulumi.get(self, "status")
 
     @status.setter
@@ -127,6 +131,7 @@ def __init__(__self__, *,
         :param pulumi.Input[Sequence[pulumi.Input[str]]] events: The events that will be delivered to this hook. [See here for a list of supported events](https://developer.okta.com/docs/reference/api/event-types/?q=event-hook-eligible).
         :param pulumi.Input[Sequence[pulumi.Input['EventHookHeaderArgs']]] headers: Map of headers to send along in event hook request.
         :param pulumi.Input[str] name: The event hook display name.
+        :param pulumi.Input[str] status: Default to `ACTIVE`
         """
         if auth is not None:
             pulumi.set(__self__, "auth", auth)
@@ -204,6 +209,9 @@ def name(self, value: Optional[pulumi.Input[str]]):
     @property
     @pulumi.getter
     def status(self) -> Optional[pulumi.Input[str]]:
+        """
+        Default to `ACTIVE`
+        """
         return pulumi.get(self, "status")
 
     @status.setter
@@ -268,6 +276,7 @@ def __init__(__self__,
         :param pulumi.Input[Sequence[pulumi.Input[str]]] events: The events that will be delivered to this hook. [See here for a list of supported events](https://developer.okta.com/docs/reference/api/event-types/?q=event-hook-eligible).
         :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['EventHookHeaderArgs']]]] headers: Map of headers to send along in event hook request.
         :param pulumi.Input[str] name: The event hook display name.
+        :param pulumi.Input[str] status: Default to `ACTIVE`
         """
         ...
     @overload
@@ -381,6 +390,7 @@ def get(resource_name: str,
         :param pulumi.Input[Sequence[pulumi.Input[str]]] events: The events that will be delivered to this hook. [See here for a list of supported events](https://developer.okta.com/docs/reference/api/event-types/?q=event-hook-eligible).
         :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['EventHookHeaderArgs']]]] headers: Map of headers to send along in event hook request.
         :param pulumi.Input[str] name: The event hook display name.
+        :param pulumi.Input[str] status: Default to `ACTIVE`
         """
         opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
 
@@ -437,5 +447,8 @@ def name(self) -> pulumi.Output[str]:
     @property
     @pulumi.getter
     def status(self) -> pulumi.Output[Optional[str]]:
+        """
+        Default to `ACTIVE`
+        """
         return pulumi.get(self, "status")
 
diff --git a/sdk/python/pulumi_okta/get_role_subscription.py b/sdk/python/pulumi_okta/get_role_subscription.py
index 3bb756db..27c23be1 100644
--- a/sdk/python/pulumi_okta/get_role_subscription.py
+++ b/sdk/python/pulumi_okta/get_role_subscription.py
@@ -97,7 +97,7 @@ def get_role_subscription(notification_type: Optional[str] = None,
            `"APP_IMPORT"`, `"LDAP_AGENT"`, `"AD_AGENT"`, `"OKTA_ANNOUNCEMENT"`, `"OKTA_ISSUE"`, `"OKTA_UPDATE"`, `"IWA_AGENT"`,
            `"USER_DEPROVISION"`, `"REPORT_SUSPICIOUS_ACTIVITY"`, `"RATELIMIT_NOTIFICATION"`.
     :param str role_type: Type of the role. Valid values:
-           `"API_ADMIN"`,
+           `"API_ACCESS_MANAGEMENT_ADMIN"`,
            `"APP_ADMIN"`,
            `"CUSTOM"`,
            `"GROUP_MEMBERSHIP_ADMIN"`,
@@ -147,7 +147,7 @@ def get_role_subscription_output(notification_type: Optional[pulumi.Input[str]]
            `"APP_IMPORT"`, `"LDAP_AGENT"`, `"AD_AGENT"`, `"OKTA_ANNOUNCEMENT"`, `"OKTA_ISSUE"`, `"OKTA_UPDATE"`, `"IWA_AGENT"`,
            `"USER_DEPROVISION"`, `"REPORT_SUSPICIOUS_ACTIVITY"`, `"RATELIMIT_NOTIFICATION"`.
     :param str role_type: Type of the role. Valid values:
-           `"API_ADMIN"`,
+           `"API_ACCESS_MANAGEMENT_ADMIN"`,
            `"APP_ADMIN"`,
            `"CUSTOM"`,
            `"GROUP_MEMBERSHIP_ADMIN"`,
diff --git a/sdk/python/pulumi_okta/group/role.py b/sdk/python/pulumi_okta/group/role.py
index 2a673bb5..23b363ba 100644
--- a/sdk/python/pulumi_okta/group/role.py
+++ b/sdk/python/pulumi_okta/group/role.py
@@ -23,7 +23,7 @@ def __init__(__self__, *,
         The set of arguments for constructing a Role resource.
         :param pulumi.Input[str] group_id: The ID of group to attach admin roles to.
         :param pulumi.Input[str] role_type: Admin role assigned to the group. It can be any one of the following values:
-               `"API_ADMIN"`,
+               `"API_ACCESS_MANAGEMENT_ADMIN"`,
                `"APP_ADMIN"`,
                `"CUSTOM"`,
                `"GROUP_MEMBERSHIP_ADMIN"`,
@@ -73,7 +73,7 @@ def group_id(self, value: pulumi.Input[str]):
     def role_type(self) -> pulumi.Input[str]:
         """
         Admin role assigned to the group. It can be any one of the following values:
-        `"API_ADMIN"`,
+        `"API_ACCESS_MANAGEMENT_ADMIN"`,
         `"APP_ADMIN"`,
         `"CUSTOM"`,
         `"GROUP_MEMBERSHIP_ADMIN"`,
@@ -151,7 +151,7 @@ def __init__(__self__, *,
                administrator emails. These admins also won't have access to contact Okta Support and open support cases on behalf of your org.
         :param pulumi.Input[str] group_id: The ID of group to attach admin roles to.
         :param pulumi.Input[str] role_type: Admin role assigned to the group. It can be any one of the following values:
-               `"API_ADMIN"`,
+               `"API_ACCESS_MANAGEMENT_ADMIN"`,
                `"APP_ADMIN"`,
                `"CUSTOM"`,
                `"GROUP_MEMBERSHIP_ADMIN"`,
@@ -214,7 +214,7 @@ def group_id(self, value: Optional[pulumi.Input[str]]):
     def role_type(self) -> Optional[pulumi.Input[str]]:
         """
         Admin role assigned to the group. It can be any one of the following values:
-        `"API_ADMIN"`,
+        `"API_ACCESS_MANAGEMENT_ADMIN"`,
         `"APP_ADMIN"`,
         `"CUSTOM"`,
         `"GROUP_MEMBERSHIP_ADMIN"`,
@@ -309,7 +309,7 @@ def __init__(__self__,
                administrator emails. These admins also won't have access to contact Okta Support and open support cases on behalf of your org.
         :param pulumi.Input[str] group_id: The ID of group to attach admin roles to.
         :param pulumi.Input[str] role_type: Admin role assigned to the group. It can be any one of the following values:
-               `"API_ADMIN"`,
+               `"API_ACCESS_MANAGEMENT_ADMIN"`,
                `"APP_ADMIN"`,
                `"CUSTOM"`,
                `"GROUP_MEMBERSHIP_ADMIN"`,
@@ -428,7 +428,7 @@ def get(resource_name: str,
                administrator emails. These admins also won't have access to contact Okta Support and open support cases on behalf of your org.
         :param pulumi.Input[str] group_id: The ID of group to attach admin roles to.
         :param pulumi.Input[str] role_type: Admin role assigned to the group. It can be any one of the following values:
-               `"API_ADMIN"`,
+               `"API_ACCESS_MANAGEMENT_ADMIN"`,
                `"APP_ADMIN"`,
                `"CUSTOM"`,
                `"GROUP_MEMBERSHIP_ADMIN"`,
@@ -483,7 +483,7 @@ def group_id(self) -> pulumi.Output[str]:
     def role_type(self) -> pulumi.Output[str]:
         """
         Admin role assigned to the group. It can be any one of the following values:
-        `"API_ADMIN"`,
+        `"API_ACCESS_MANAGEMENT_ADMIN"`,
         `"APP_ADMIN"`,
         `"CUSTOM"`,
         `"GROUP_MEMBERSHIP_ADMIN"`,
diff --git a/sdk/python/pulumi_okta/idp/oidc.py b/sdk/python/pulumi_okta/idp/oidc.py
index aed7a621..5370a6d5 100644
--- a/sdk/python/pulumi_okta/idp/oidc.py
+++ b/sdk/python/pulumi_okta/idp/oidc.py
@@ -34,7 +34,6 @@ def __init__(__self__, *,
                  issuer_mode: Optional[pulumi.Input[str]] = None,
                  max_clock_skew: Optional[pulumi.Input[int]] = None,
                  name: Optional[pulumi.Input[str]] = None,
-                 pkce_required: Optional[pulumi.Input[bool]] = None,
                  profile_master: Optional[pulumi.Input[bool]] = None,
                  protocol_type: Optional[pulumi.Input[str]] = None,
                  provisioning_action: Optional[pulumi.Input[str]] = None,
@@ -69,8 +68,6 @@ def __init__(__self__, *,
         :param pulumi.Input[str] issuer_mode: Indicates whether Okta uses the original Okta org domain URL, a custom domain URL, or dynamic. It can be `"ORG_URL"`, `"CUSTOM_URL"`, or `"DYNAMIC"`.
         :param pulumi.Input[int] max_clock_skew: Maximum allowable clock-skew when processing messages from the IdP.
         :param pulumi.Input[str] name: The Application's display name.
-        :param pulumi.Input[bool] pkce_required: Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See:
-               https://developer.okta.com/docs/reference/api/idps/#oauth-2-0-and-openid-connect-client-object
         :param pulumi.Input[bool] profile_master: Determines if the IdP should act as a source of truth for user profile attributes.
         :param pulumi.Input[str] protocol_type: The type of protocol to use. It can be `"OIDC"` or `"OAUTH2"`.
         :param pulumi.Input[str] provisioning_action: Provisioning action for an IdP user during authentication.
@@ -113,8 +110,6 @@ def __init__(__self__, *,
             pulumi.set(__self__, "max_clock_skew", max_clock_skew)
         if name is not None:
             pulumi.set(__self__, "name", name)
-        if pkce_required is not None:
-            pulumi.set(__self__, "pkce_required", pkce_required)
         if profile_master is not None:
             pulumi.set(__self__, "profile_master", profile_master)
         if protocol_type is not None:
@@ -380,19 +375,6 @@ def name(self) -> Optional[pulumi.Input[str]]:
     def name(self, value: Optional[pulumi.Input[str]]):
         pulumi.set(self, "name", value)
 
-    @property
-    @pulumi.getter(name="pkceRequired")
-    def pkce_required(self) -> Optional[pulumi.Input[bool]]:
-        """
-        Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See:
-        https://developer.okta.com/docs/reference/api/idps/#oauth-2-0-and-openid-connect-client-object
-        """
-        return pulumi.get(self, "pkce_required")
-
-    @pkce_required.setter
-    def pkce_required(self, value: Optional[pulumi.Input[bool]]):
-        pulumi.set(self, "pkce_required", value)
-
     @property
     @pulumi.getter(name="profileMaster")
     def profile_master(self) -> Optional[pulumi.Input[bool]]:
@@ -555,7 +537,6 @@ def __init__(__self__, *,
                  jwks_url: Optional[pulumi.Input[str]] = None,
                  max_clock_skew: Optional[pulumi.Input[int]] = None,
                  name: Optional[pulumi.Input[str]] = None,
-                 pkce_required: Optional[pulumi.Input[bool]] = None,
                  profile_master: Optional[pulumi.Input[bool]] = None,
                  protocol_type: Optional[pulumi.Input[str]] = None,
                  provisioning_action: Optional[pulumi.Input[str]] = None,
@@ -592,8 +573,6 @@ def __init__(__self__, *,
         :param pulumi.Input[str] jwks_url: Endpoint where the keys signer publishes its keys in a JWK Set.
         :param pulumi.Input[int] max_clock_skew: Maximum allowable clock-skew when processing messages from the IdP.
         :param pulumi.Input[str] name: The Application's display name.
-        :param pulumi.Input[bool] pkce_required: Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See:
-               https://developer.okta.com/docs/reference/api/idps/#oauth-2-0-and-openid-connect-client-object
         :param pulumi.Input[bool] profile_master: Determines if the IdP should act as a source of truth for user profile attributes.
         :param pulumi.Input[str] protocol_type: The type of protocol to use. It can be `"OIDC"` or `"OAUTH2"`.
         :param pulumi.Input[str] provisioning_action: Provisioning action for an IdP user during authentication.
@@ -645,8 +624,6 @@ def __init__(__self__, *,
             pulumi.set(__self__, "max_clock_skew", max_clock_skew)
         if name is not None:
             pulumi.set(__self__, "name", name)
-        if pkce_required is not None:
-            pulumi.set(__self__, "pkce_required", pkce_required)
         if profile_master is not None:
             pulumi.set(__self__, "profile_master", profile_master)
         if protocol_type is not None:
@@ -886,19 +863,6 @@ def name(self) -> Optional[pulumi.Input[str]]:
     def name(self, value: Optional[pulumi.Input[str]]):
         pulumi.set(self, "name", value)
 
-    @property
-    @pulumi.getter(name="pkceRequired")
-    def pkce_required(self) -> Optional[pulumi.Input[bool]]:
-        """
-        Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See:
-        https://developer.okta.com/docs/reference/api/idps/#oauth-2-0-and-openid-connect-client-object
-        """
-        return pulumi.get(self, "pkce_required")
-
-    @pkce_required.setter
-    def pkce_required(self, value: Optional[pulumi.Input[bool]]):
-        pulumi.set(self, "pkce_required", value)
-
     @property
     @pulumi.getter(name="profileMaster")
     def profile_master(self) -> Optional[pulumi.Input[bool]]:
@@ -1123,7 +1087,6 @@ def __init__(__self__,
                  jwks_url: Optional[pulumi.Input[str]] = None,
                  max_clock_skew: Optional[pulumi.Input[int]] = None,
                  name: Optional[pulumi.Input[str]] = None,
-                 pkce_required: Optional[pulumi.Input[bool]] = None,
                  profile_master: Optional[pulumi.Input[bool]] = None,
                  protocol_type: Optional[pulumi.Input[str]] = None,
                  provisioning_action: Optional[pulumi.Input[str]] = None,
@@ -1196,8 +1159,6 @@ def __init__(__self__,
         :param pulumi.Input[str] jwks_url: Endpoint where the keys signer publishes its keys in a JWK Set.
         :param pulumi.Input[int] max_clock_skew: Maximum allowable clock-skew when processing messages from the IdP.
         :param pulumi.Input[str] name: The Application's display name.
-        :param pulumi.Input[bool] pkce_required: Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See:
-               https://developer.okta.com/docs/reference/api/idps/#oauth-2-0-and-openid-connect-client-object
         :param pulumi.Input[bool] profile_master: Determines if the IdP should act as a source of truth for user profile attributes.
         :param pulumi.Input[str] protocol_type: The type of protocol to use. It can be `"OIDC"` or `"OAUTH2"`.
         :param pulumi.Input[str] provisioning_action: Provisioning action for an IdP user during authentication.
@@ -1288,7 +1249,6 @@ def _internal_init(__self__,
                  jwks_url: Optional[pulumi.Input[str]] = None,
                  max_clock_skew: Optional[pulumi.Input[int]] = None,
                  name: Optional[pulumi.Input[str]] = None,
-                 pkce_required: Optional[pulumi.Input[bool]] = None,
                  profile_master: Optional[pulumi.Input[bool]] = None,
                  protocol_type: Optional[pulumi.Input[str]] = None,
                  provisioning_action: Optional[pulumi.Input[str]] = None,
@@ -1344,7 +1304,6 @@ def _internal_init(__self__,
             __props__.__dict__["jwks_url"] = jwks_url
             __props__.__dict__["max_clock_skew"] = max_clock_skew
             __props__.__dict__["name"] = name
-            __props__.__dict__["pkce_required"] = pkce_required
             __props__.__dict__["profile_master"] = profile_master
             __props__.__dict__["protocol_type"] = protocol_type
             __props__.__dict__["provisioning_action"] = provisioning_action
@@ -1397,7 +1356,6 @@ def get(resource_name: str,
             jwks_url: Optional[pulumi.Input[str]] = None,
             max_clock_skew: Optional[pulumi.Input[int]] = None,
             name: Optional[pulumi.Input[str]] = None,
-            pkce_required: Optional[pulumi.Input[bool]] = None,
             profile_master: Optional[pulumi.Input[bool]] = None,
             protocol_type: Optional[pulumi.Input[str]] = None,
             provisioning_action: Optional[pulumi.Input[str]] = None,
@@ -1439,8 +1397,6 @@ def get(resource_name: str,
         :param pulumi.Input[str] jwks_url: Endpoint where the keys signer publishes its keys in a JWK Set.
         :param pulumi.Input[int] max_clock_skew: Maximum allowable clock-skew when processing messages from the IdP.
         :param pulumi.Input[str] name: The Application's display name.
-        :param pulumi.Input[bool] pkce_required: Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See:
-               https://developer.okta.com/docs/reference/api/idps/#oauth-2-0-and-openid-connect-client-object
         :param pulumi.Input[bool] profile_master: Determines if the IdP should act as a source of truth for user profile attributes.
         :param pulumi.Input[str] protocol_type: The type of protocol to use. It can be `"OIDC"` or `"OAUTH2"`.
         :param pulumi.Input[str] provisioning_action: Provisioning action for an IdP user during authentication.
@@ -1479,7 +1435,6 @@ def get(resource_name: str,
         __props__.__dict__["jwks_url"] = jwks_url
         __props__.__dict__["max_clock_skew"] = max_clock_skew
         __props__.__dict__["name"] = name
-        __props__.__dict__["pkce_required"] = pkce_required
         __props__.__dict__["profile_master"] = profile_master
         __props__.__dict__["protocol_type"] = protocol_type
         __props__.__dict__["provisioning_action"] = provisioning_action
@@ -1635,15 +1590,6 @@ def name(self) -> pulumi.Output[str]:
         """
         return pulumi.get(self, "name")
 
-    @property
-    @pulumi.getter(name="pkceRequired")
-    def pkce_required(self) -> pulumi.Output[Optional[bool]]:
-        """
-        Require Proof Key for Code Exchange (PKCE) for additional verification key rotation mode. See:
-        https://developer.okta.com/docs/reference/api/idps/#oauth-2-0-and-openid-connect-client-object
-        """
-        return pulumi.get(self, "pkce_required")
-
     @property
     @pulumi.getter(name="profileMaster")
     def profile_master(self) -> pulumi.Output[Optional[bool]]:
diff --git a/sdk/python/pulumi_okta/inline/hook.py b/sdk/python/pulumi_okta/inline/hook.py
index bd01615b..8107ee55 100644
--- a/sdk/python/pulumi_okta/inline/hook.py
+++ b/sdk/python/pulumi_okta/inline/hook.py
@@ -31,6 +31,7 @@ def __init__(__self__, *,
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] auth: Authentication required for inline hook request.
         :param pulumi.Input[Sequence[pulumi.Input['HookHeaderArgs']]] headers: Map of headers to send along in inline hook request.
         :param pulumi.Input[str] name: The inline hook display name.
+        :param pulumi.Input[str] status: Default to `ACTIVE`
         """
         pulumi.set(__self__, "channel", channel)
         pulumi.set(__self__, "type", type)
@@ -119,6 +120,9 @@ def name(self, value: Optional[pulumi.Input[str]]):
     @property
     @pulumi.getter
     def status(self) -> Optional[pulumi.Input[str]]:
+        """
+        Default to `ACTIVE`
+        """
         return pulumi.get(self, "status")
 
     @status.setter
@@ -142,6 +146,7 @@ def __init__(__self__, *,
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] channel: Details of the endpoint the inline hook will hit.
         :param pulumi.Input[Sequence[pulumi.Input['HookHeaderArgs']]] headers: Map of headers to send along in inline hook request.
         :param pulumi.Input[str] name: The inline hook display name.
+        :param pulumi.Input[str] status: Default to `ACTIVE`
         :param pulumi.Input[str] type: The type of hook to trigger. Currently, the only supported type is `"HTTP"`.
         :param pulumi.Input[str] version: Version of the channel. The currently-supported version is `"1.0.0"`.
         """
@@ -211,6 +216,9 @@ def name(self, value: Optional[pulumi.Input[str]]):
     @property
     @pulumi.getter
     def status(self) -> Optional[pulumi.Input[str]]:
+        """
+        Default to `ACTIVE`
+        """
         return pulumi.get(self, "status")
 
     @status.setter
@@ -297,6 +305,7 @@ def __init__(__self__,
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] channel: Details of the endpoint the inline hook will hit.
         :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['HookHeaderArgs']]]] headers: Map of headers to send along in inline hook request.
         :param pulumi.Input[str] name: The inline hook display name.
+        :param pulumi.Input[str] status: Default to `ACTIVE`
         :param pulumi.Input[str] type: The type of hook to trigger. Currently, the only supported type is `"HTTP"`.
         :param pulumi.Input[str] version: Version of the channel. The currently-supported version is `"1.0.0"`.
         """
@@ -414,6 +423,7 @@ def get(resource_name: str,
         :param pulumi.Input[Mapping[str, pulumi.Input[str]]] channel: Details of the endpoint the inline hook will hit.
         :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['HookHeaderArgs']]]] headers: Map of headers to send along in inline hook request.
         :param pulumi.Input[str] name: The inline hook display name.
+        :param pulumi.Input[str] status: Default to `ACTIVE`
         :param pulumi.Input[str] type: The type of hook to trigger. Currently, the only supported type is `"HTTP"`.
         :param pulumi.Input[str] version: Version of the channel. The currently-supported version is `"1.0.0"`.
         """
@@ -465,6 +475,9 @@ def name(self) -> pulumi.Output[str]:
     @property
     @pulumi.getter
     def status(self) -> pulumi.Output[Optional[str]]:
+        """
+        Default to `ACTIVE`
+        """
         return pulumi.get(self, "status")
 
     @property
diff --git a/sdk/python/pulumi_okta/org_configuration.py b/sdk/python/pulumi_okta/org_configuration.py
index a4fccabb..896a5c4e 100644
--- a/sdk/python/pulumi_okta/org_configuration.py
+++ b/sdk/python/pulumi_okta/org_configuration.py
@@ -38,7 +38,8 @@ def __init__(__self__, *,
         :param pulumi.Input[str] city: City of org
         :param pulumi.Input[str] country: Country of org
         :param pulumi.Input[str] end_user_support_help_url: Support link of org
-        :param pulumi.Input[str] logo: Local path to logo of the org.
+        :param pulumi.Input[str] logo: Logo of org. The file must be in PNG, JPG, or GIF format and less than 1 MB in size. For best results use landscape
+               orientation, a transparent background, and a minimum size of 420px by 120px to prevent upscaling.
         :param pulumi.Input[bool] opt_out_communication_emails: Indicates whether the org's users receive Okta Communication emails
         :param pulumi.Input[str] phone_number: Support help phone of org
         :param pulumi.Input[str] postal_code: Postal code of org
@@ -165,7 +166,8 @@ def end_user_support_help_url(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter
     def logo(self) -> Optional[pulumi.Input[str]]:
         """
-        Local path to logo of the org.
+        Logo of org. The file must be in PNG, JPG, or GIF format and less than 1 MB in size. For best results use landscape
+        orientation, a transparent background, and a minimum size of 420px by 120px to prevent upscaling.
         """
         return pulumi.get(self, "logo")
 
@@ -288,7 +290,8 @@ def __init__(__self__, *,
         :param pulumi.Input[str] country: Country of org
         :param pulumi.Input[str] end_user_support_help_url: Support link of org
         :param pulumi.Input[str] expires_at: Expiration of org
-        :param pulumi.Input[str] logo: Local path to logo of the org.
+        :param pulumi.Input[str] logo: Logo of org. The file must be in PNG, JPG, or GIF format and less than 1 MB in size. For best results use landscape
+               orientation, a transparent background, and a minimum size of 420px by 120px to prevent upscaling.
         :param pulumi.Input[bool] opt_out_communication_emails: Indicates whether the org's users receive Okta Communication emails
         :param pulumi.Input[str] phone_number: Support help phone of org
         :param pulumi.Input[str] postal_code: Postal code of org
@@ -433,7 +436,8 @@ def expires_at(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter
     def logo(self) -> Optional[pulumi.Input[str]]:
         """
-        Local path to logo of the org.
+        Logo of org. The file must be in PNG, JPG, or GIF format and less than 1 MB in size. For best results use landscape
+        orientation, a transparent background, and a minimum size of 420px by 120px to prevent upscaling.
         """
         return pulumi.get(self, "logo")
 
@@ -594,7 +598,8 @@ def __init__(__self__,
         :param pulumi.Input[str] company_name: Name of org
         :param pulumi.Input[str] country: Country of org
         :param pulumi.Input[str] end_user_support_help_url: Support link of org
-        :param pulumi.Input[str] logo: Local path to logo of the org.
+        :param pulumi.Input[str] logo: Logo of org. The file must be in PNG, JPG, or GIF format and less than 1 MB in size. For best results use landscape
+               orientation, a transparent background, and a minimum size of 420px by 120px to prevent upscaling.
         :param pulumi.Input[bool] opt_out_communication_emails: Indicates whether the org's users receive Okta Communication emails
         :param pulumi.Input[str] phone_number: Support help phone of org
         :param pulumi.Input[str] postal_code: Postal code of org
@@ -735,7 +740,8 @@ def get(resource_name: str,
         :param pulumi.Input[str] country: Country of org
         :param pulumi.Input[str] end_user_support_help_url: Support link of org
         :param pulumi.Input[str] expires_at: Expiration of org
-        :param pulumi.Input[str] logo: Local path to logo of the org.
+        :param pulumi.Input[str] logo: Logo of org. The file must be in PNG, JPG, or GIF format and less than 1 MB in size. For best results use landscape
+               orientation, a transparent background, and a minimum size of 420px by 120px to prevent upscaling.
         :param pulumi.Input[bool] opt_out_communication_emails: Indicates whether the org's users receive Okta Communication emails
         :param pulumi.Input[str] phone_number: Support help phone of org
         :param pulumi.Input[str] postal_code: Postal code of org
@@ -836,7 +842,8 @@ def expires_at(self) -> pulumi.Output[str]:
     @pulumi.getter
     def logo(self) -> pulumi.Output[Optional[str]]:
         """
-        Local path to logo of the org.
+        Logo of org. The file must be in PNG, JPG, or GIF format and less than 1 MB in size. For best results use landscape
+        orientation, a transparent background, and a minimum size of 420px by 120px to prevent upscaling.
         """
         return pulumi.get(self, "logo")
 
diff --git a/sdk/python/pulumi_okta/policy/device_assurance_android.py b/sdk/python/pulumi_okta/policy/device_assurance_android.py
index 6fc67c14..eed4523b 100644
--- a/sdk/python/pulumi_okta/policy/device_assurance_android.py
+++ b/sdk/python/pulumi_okta/policy/device_assurance_android.py
@@ -22,12 +22,12 @@ def __init__(__self__, *,
                  secure_hardware_present: Optional[pulumi.Input[bool]] = None):
         """
         The set of arguments for constructing a DeviceAssuranceAndroid resource.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] disk_encryption_types: List of disk encryption type, can be FULL, USER
-        :param pulumi.Input[bool] jailbreak: The device jailbreak. Only for android and iOS platform
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] disk_encryption_types: List of disk encryption type, can be `FULL`, `USER`
+        :param pulumi.Input[bool] jailbreak: Is the device jailbroken in the device assurance policy.
         :param pulumi.Input[str] name: Policy device assurance name
-        :param pulumi.Input[str] os_version: The device os minimum version
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] screenlock_types: List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
-        :param pulumi.Input[bool] secure_hardware_present: Indicates if the device constains a secure hardware functionality
+        :param pulumi.Input[str] os_version: Minimum os version of the device in the device assurance policy.
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] screenlock_types: List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
+        :param pulumi.Input[bool] secure_hardware_present: Indicates if the device contains a secure hardware functionality
         """
         if disk_encryption_types is not None:
             pulumi.set(__self__, "disk_encryption_types", disk_encryption_types)
@@ -46,7 +46,7 @@ def __init__(__self__, *,
     @pulumi.getter(name="diskEncryptionTypes")
     def disk_encryption_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
         """
-        List of disk encryption type, can be FULL, USER
+        List of disk encryption type, can be `FULL`, `USER`
         """
         return pulumi.get(self, "disk_encryption_types")
 
@@ -58,7 +58,7 @@ def disk_encryption_types(self, value: Optional[pulumi.Input[Sequence[pulumi.Inp
     @pulumi.getter
     def jailbreak(self) -> Optional[pulumi.Input[bool]]:
         """
-        The device jailbreak. Only for android and iOS platform
+        Is the device jailbroken in the device assurance policy.
         """
         return pulumi.get(self, "jailbreak")
 
@@ -82,7 +82,7 @@ def name(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="osVersion")
     def os_version(self) -> Optional[pulumi.Input[str]]:
         """
-        The device os minimum version
+        Minimum os version of the device in the device assurance policy.
         """
         return pulumi.get(self, "os_version")
 
@@ -94,7 +94,7 @@ def os_version(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="screenlockTypes")
     def screenlock_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
         """
-        List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+        List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
         """
         return pulumi.get(self, "screenlock_types")
 
@@ -106,7 +106,7 @@ def screenlock_types(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[st
     @pulumi.getter(name="secureHardwarePresent")
     def secure_hardware_present(self) -> Optional[pulumi.Input[bool]]:
         """
-        Indicates if the device constains a secure hardware functionality
+        Indicates if the device contains a secure hardware functionality
         """
         return pulumi.get(self, "secure_hardware_present")
 
@@ -133,15 +133,15 @@ def __init__(__self__, *,
         Input properties used for looking up and filtering DeviceAssuranceAndroid resources.
         :param pulumi.Input[str] created_by: Created by
         :param pulumi.Input[str] created_date: Created date
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] disk_encryption_types: List of disk encryption type, can be FULL, USER
-        :param pulumi.Input[bool] jailbreak: The device jailbreak. Only for android and iOS platform
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] disk_encryption_types: List of disk encryption type, can be `FULL`, `USER`
+        :param pulumi.Input[bool] jailbreak: Is the device jailbroken in the device assurance policy.
         :param pulumi.Input[str] last_update: Last update
         :param pulumi.Input[str] last_updated_by: Last updated by
         :param pulumi.Input[str] name: Policy device assurance name
-        :param pulumi.Input[str] os_version: The device os minimum version
+        :param pulumi.Input[str] os_version: Minimum os version of the device in the device assurance policy.
         :param pulumi.Input[str] platform: Policy device assurance platform
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] screenlock_types: List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
-        :param pulumi.Input[bool] secure_hardware_present: Indicates if the device constains a secure hardware functionality
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] screenlock_types: List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
+        :param pulumi.Input[bool] secure_hardware_present: Indicates if the device contains a secure hardware functionality
         """
         if created_by is not None:
             pulumi.set(__self__, "created_by", created_by)
@@ -194,7 +194,7 @@ def created_date(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="diskEncryptionTypes")
     def disk_encryption_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
         """
-        List of disk encryption type, can be FULL, USER
+        List of disk encryption type, can be `FULL`, `USER`
         """
         return pulumi.get(self, "disk_encryption_types")
 
@@ -206,7 +206,7 @@ def disk_encryption_types(self, value: Optional[pulumi.Input[Sequence[pulumi.Inp
     @pulumi.getter
     def jailbreak(self) -> Optional[pulumi.Input[bool]]:
         """
-        The device jailbreak. Only for android and iOS platform
+        Is the device jailbroken in the device assurance policy.
         """
         return pulumi.get(self, "jailbreak")
 
@@ -254,7 +254,7 @@ def name(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="osVersion")
     def os_version(self) -> Optional[pulumi.Input[str]]:
         """
-        The device os minimum version
+        Minimum os version of the device in the device assurance policy.
         """
         return pulumi.get(self, "os_version")
 
@@ -278,7 +278,7 @@ def platform(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="screenlockTypes")
     def screenlock_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
         """
-        List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+        List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
         """
         return pulumi.get(self, "screenlock_types")
 
@@ -290,7 +290,7 @@ def screenlock_types(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[st
     @pulumi.getter(name="secureHardwarePresent")
     def secure_hardware_present(self) -> Optional[pulumi.Input[bool]]:
         """
-        Indicates if the device constains a secure hardware functionality
+        Indicates if the device contains a secure hardware functionality
         """
         return pulumi.get(self, "secure_hardware_present")
 
@@ -315,12 +315,12 @@ def __init__(__self__,
         Create a DeviceAssuranceAndroid resource with the given unique name, props, and options.
         :param str resource_name: The name of the resource.
         :param pulumi.ResourceOptions opts: Options for the resource.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] disk_encryption_types: List of disk encryption type, can be FULL, USER
-        :param pulumi.Input[bool] jailbreak: The device jailbreak. Only for android and iOS platform
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] disk_encryption_types: List of disk encryption type, can be `FULL`, `USER`
+        :param pulumi.Input[bool] jailbreak: Is the device jailbroken in the device assurance policy.
         :param pulumi.Input[str] name: Policy device assurance name
-        :param pulumi.Input[str] os_version: The device os minimum version
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] screenlock_types: List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
-        :param pulumi.Input[bool] secure_hardware_present: Indicates if the device constains a secure hardware functionality
+        :param pulumi.Input[str] os_version: Minimum os version of the device in the device assurance policy.
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] screenlock_types: List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
+        :param pulumi.Input[bool] secure_hardware_present: Indicates if the device contains a secure hardware functionality
         """
         ...
     @overload
@@ -401,15 +401,15 @@ def get(resource_name: str,
         :param pulumi.ResourceOptions opts: Options for the resource.
         :param pulumi.Input[str] created_by: Created by
         :param pulumi.Input[str] created_date: Created date
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] disk_encryption_types: List of disk encryption type, can be FULL, USER
-        :param pulumi.Input[bool] jailbreak: The device jailbreak. Only for android and iOS platform
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] disk_encryption_types: List of disk encryption type, can be `FULL`, `USER`
+        :param pulumi.Input[bool] jailbreak: Is the device jailbroken in the device assurance policy.
         :param pulumi.Input[str] last_update: Last update
         :param pulumi.Input[str] last_updated_by: Last updated by
         :param pulumi.Input[str] name: Policy device assurance name
-        :param pulumi.Input[str] os_version: The device os minimum version
+        :param pulumi.Input[str] os_version: Minimum os version of the device in the device assurance policy.
         :param pulumi.Input[str] platform: Policy device assurance platform
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] screenlock_types: List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
-        :param pulumi.Input[bool] secure_hardware_present: Indicates if the device constains a secure hardware functionality
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] screenlock_types: List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
+        :param pulumi.Input[bool] secure_hardware_present: Indicates if the device contains a secure hardware functionality
         """
         opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
 
@@ -448,7 +448,7 @@ def created_date(self) -> pulumi.Output[str]:
     @pulumi.getter(name="diskEncryptionTypes")
     def disk_encryption_types(self) -> pulumi.Output[Optional[Sequence[str]]]:
         """
-        List of disk encryption type, can be FULL, USER
+        List of disk encryption type, can be `FULL`, `USER`
         """
         return pulumi.get(self, "disk_encryption_types")
 
@@ -456,7 +456,7 @@ def disk_encryption_types(self) -> pulumi.Output[Optional[Sequence[str]]]:
     @pulumi.getter
     def jailbreak(self) -> pulumi.Output[Optional[bool]]:
         """
-        The device jailbreak. Only for android and iOS platform
+        Is the device jailbroken in the device assurance policy.
         """
         return pulumi.get(self, "jailbreak")
 
@@ -488,7 +488,7 @@ def name(self) -> pulumi.Output[str]:
     @pulumi.getter(name="osVersion")
     def os_version(self) -> pulumi.Output[Optional[str]]:
         """
-        The device os minimum version
+        Minimum os version of the device in the device assurance policy.
         """
         return pulumi.get(self, "os_version")
 
@@ -504,7 +504,7 @@ def platform(self) -> pulumi.Output[str]:
     @pulumi.getter(name="screenlockTypes")
     def screenlock_types(self) -> pulumi.Output[Optional[Sequence[str]]]:
         """
-        List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+        List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
         """
         return pulumi.get(self, "screenlock_types")
 
@@ -512,7 +512,7 @@ def screenlock_types(self) -> pulumi.Output[Optional[Sequence[str]]]:
     @pulumi.getter(name="secureHardwarePresent")
     def secure_hardware_present(self) -> pulumi.Output[Optional[bool]]:
         """
-        Indicates if the device constains a secure hardware functionality
+        Indicates if the device contains a secure hardware functionality
         """
         return pulumi.get(self, "secure_hardware_present")
 
diff --git a/sdk/python/pulumi_okta/policy/device_assurance_chromeos.py b/sdk/python/pulumi_okta/policy/device_assurance_chromeos.py
index 9d2921d1..edfee204 100644
--- a/sdk/python/pulumi_okta/policy/device_assurance_chromeos.py
+++ b/sdk/python/pulumi_okta/policy/device_assurance_chromeos.py
@@ -31,7 +31,7 @@ def __init__(__self__, *,
                  tpsp_site_isolation_enabled: Optional[pulumi.Input[bool]] = None):
         """
         The set of arguments for constructing a DeviceAssuranceChromeos resource.
-        :param pulumi.Input[str] name: Policy device assurance name
+        :param pulumi.Input[str] name: Name of the device assurance policy.
         :param pulumi.Input[bool] tpsp_allow_screen_lock: Third party signal provider allow screen lock
         :param pulumi.Input[str] tpsp_browser_version: Third party signal provider minimum browser version
         :param pulumi.Input[bool] tpsp_builtin_dns_client_enabled: Third party signal provider builtin dns client enabled
@@ -82,7 +82,7 @@ def __init__(__self__, *,
     @pulumi.getter
     def name(self) -> Optional[pulumi.Input[str]]:
         """
-        Policy device assurance name
+        Name of the device assurance policy.
         """
         return pulumi.get(self, "name")
 
@@ -288,7 +288,7 @@ def __init__(__self__, *,
         :param pulumi.Input[str] created_date: Created date
         :param pulumi.Input[str] last_update: Last update
         :param pulumi.Input[str] last_updated_by: Last updated by
-        :param pulumi.Input[str] name: Policy device assurance name
+        :param pulumi.Input[str] name: Name of the device assurance policy.
         :param pulumi.Input[str] platform: Policy device assurance platform
         :param pulumi.Input[bool] tpsp_allow_screen_lock: Third party signal provider allow screen lock
         :param pulumi.Input[str] tpsp_browser_version: Third party signal provider minimum browser version
@@ -398,7 +398,7 @@ def last_updated_by(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter
     def name(self) -> Optional[pulumi.Input[str]]:
         """
-        Policy device assurance name
+        Name of the device assurance policy.
         """
         return pulumi.get(self, "name")
 
@@ -612,7 +612,7 @@ def __init__(__self__,
         Create a DeviceAssuranceChromeos resource with the given unique name, props, and options.
         :param str resource_name: The name of the resource.
         :param pulumi.ResourceOptions opts: Options for the resource.
-        :param pulumi.Input[str] name: Policy device assurance name
+        :param pulumi.Input[str] name: Name of the device assurance policy.
         :param pulumi.Input[bool] tpsp_allow_screen_lock: Third party signal provider allow screen lock
         :param pulumi.Input[str] tpsp_browser_version: Third party signal provider minimum browser version
         :param pulumi.Input[bool] tpsp_builtin_dns_client_enabled: Third party signal provider builtin dns client enabled
@@ -736,7 +736,7 @@ def get(resource_name: str,
         :param pulumi.Input[str] created_date: Created date
         :param pulumi.Input[str] last_update: Last update
         :param pulumi.Input[str] last_updated_by: Last updated by
-        :param pulumi.Input[str] name: Policy device assurance name
+        :param pulumi.Input[str] name: Name of the device assurance policy.
         :param pulumi.Input[str] platform: Policy device assurance platform
         :param pulumi.Input[bool] tpsp_allow_screen_lock: Third party signal provider allow screen lock
         :param pulumi.Input[str] tpsp_browser_version: Third party signal provider minimum browser version
@@ -815,7 +815,7 @@ def last_updated_by(self) -> pulumi.Output[str]:
     @pulumi.getter
     def name(self) -> pulumi.Output[str]:
         """
-        Policy device assurance name
+        Name of the device assurance policy.
         """
         return pulumi.get(self, "name")
 
diff --git a/sdk/python/pulumi_okta/policy/device_assurance_ios.py b/sdk/python/pulumi_okta/policy/device_assurance_ios.py
index 288a3ee3..5f091002 100644
--- a/sdk/python/pulumi_okta/policy/device_assurance_ios.py
+++ b/sdk/python/pulumi_okta/policy/device_assurance_ios.py
@@ -20,10 +20,10 @@ def __init__(__self__, *,
                  screenlock_types: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
         """
         The set of arguments for constructing a DeviceAssuranceIos resource.
-        :param pulumi.Input[bool] jailbreak: The device jailbreak. Only for android and iOS platform
-        :param pulumi.Input[str] name: Policy device assurance name
-        :param pulumi.Input[str] os_version: The device os minimum version
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] screenlock_types: List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+        :param pulumi.Input[bool] jailbreak: Is the device jailbroken in the device assurance policy.
+        :param pulumi.Input[str] name: Name of the device assurance policy.
+        :param pulumi.Input[str] os_version: Minimum os version of the device in the device assurance policy.
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] screenlock_types: List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
         """
         if jailbreak is not None:
             pulumi.set(__self__, "jailbreak", jailbreak)
@@ -38,7 +38,7 @@ def __init__(__self__, *,
     @pulumi.getter
     def jailbreak(self) -> Optional[pulumi.Input[bool]]:
         """
-        The device jailbreak. Only for android and iOS platform
+        Is the device jailbroken in the device assurance policy.
         """
         return pulumi.get(self, "jailbreak")
 
@@ -50,7 +50,7 @@ def jailbreak(self, value: Optional[pulumi.Input[bool]]):
     @pulumi.getter
     def name(self) -> Optional[pulumi.Input[str]]:
         """
-        Policy device assurance name
+        Name of the device assurance policy.
         """
         return pulumi.get(self, "name")
 
@@ -62,7 +62,7 @@ def name(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="osVersion")
     def os_version(self) -> Optional[pulumi.Input[str]]:
         """
-        The device os minimum version
+        Minimum os version of the device in the device assurance policy.
         """
         return pulumi.get(self, "os_version")
 
@@ -74,7 +74,7 @@ def os_version(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="screenlockTypes")
     def screenlock_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
         """
-        List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+        List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
         """
         return pulumi.get(self, "screenlock_types")
 
@@ -97,15 +97,15 @@ def __init__(__self__, *,
                  screenlock_types: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
         """
         Input properties used for looking up and filtering DeviceAssuranceIos resources.
-        :param pulumi.Input[str] created_by: Created by
-        :param pulumi.Input[str] created_date: Created date
-        :param pulumi.Input[bool] jailbreak: The device jailbreak. Only for android and iOS platform
-        :param pulumi.Input[str] last_update: Last update
-        :param pulumi.Input[str] last_updated_by: Last updated by
-        :param pulumi.Input[str] name: Policy device assurance name
-        :param pulumi.Input[str] os_version: The device os minimum version
+        :param pulumi.Input[str] created_by: Created by of the device assurance polic
+        :param pulumi.Input[str] created_date: Created date of the device assurance polic
+        :param pulumi.Input[bool] jailbreak: Is the device jailbroken in the device assurance policy.
+        :param pulumi.Input[str] last_update: Last update of the device assurance polic
+        :param pulumi.Input[str] last_updated_by: Last updated by of the device assurance polic
+        :param pulumi.Input[str] name: Name of the device assurance policy.
+        :param pulumi.Input[str] os_version: Minimum os version of the device in the device assurance policy.
         :param pulumi.Input[str] platform: Policy device assurance platform
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] screenlock_types: List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] screenlock_types: List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
         """
         if created_by is not None:
             pulumi.set(__self__, "created_by", created_by)
@@ -130,7 +130,7 @@ def __init__(__self__, *,
     @pulumi.getter(name="createdBy")
     def created_by(self) -> Optional[pulumi.Input[str]]:
         """
-        Created by
+        Created by of the device assurance polic
         """
         return pulumi.get(self, "created_by")
 
@@ -142,7 +142,7 @@ def created_by(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="createdDate")
     def created_date(self) -> Optional[pulumi.Input[str]]:
         """
-        Created date
+        Created date of the device assurance polic
         """
         return pulumi.get(self, "created_date")
 
@@ -154,7 +154,7 @@ def created_date(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter
     def jailbreak(self) -> Optional[pulumi.Input[bool]]:
         """
-        The device jailbreak. Only for android and iOS platform
+        Is the device jailbroken in the device assurance policy.
         """
         return pulumi.get(self, "jailbreak")
 
@@ -166,7 +166,7 @@ def jailbreak(self, value: Optional[pulumi.Input[bool]]):
     @pulumi.getter(name="lastUpdate")
     def last_update(self) -> Optional[pulumi.Input[str]]:
         """
-        Last update
+        Last update of the device assurance polic
         """
         return pulumi.get(self, "last_update")
 
@@ -178,7 +178,7 @@ def last_update(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="lastUpdatedBy")
     def last_updated_by(self) -> Optional[pulumi.Input[str]]:
         """
-        Last updated by
+        Last updated by of the device assurance polic
         """
         return pulumi.get(self, "last_updated_by")
 
@@ -190,7 +190,7 @@ def last_updated_by(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter
     def name(self) -> Optional[pulumi.Input[str]]:
         """
-        Policy device assurance name
+        Name of the device assurance policy.
         """
         return pulumi.get(self, "name")
 
@@ -202,7 +202,7 @@ def name(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="osVersion")
     def os_version(self) -> Optional[pulumi.Input[str]]:
         """
-        The device os minimum version
+        Minimum os version of the device in the device assurance policy.
         """
         return pulumi.get(self, "os_version")
 
@@ -226,7 +226,7 @@ def platform(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="screenlockTypes")
     def screenlock_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
         """
-        List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+        List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
         """
         return pulumi.get(self, "screenlock_types")
 
@@ -249,10 +249,10 @@ def __init__(__self__,
         Create a DeviceAssuranceIos resource with the given unique name, props, and options.
         :param str resource_name: The name of the resource.
         :param pulumi.ResourceOptions opts: Options for the resource.
-        :param pulumi.Input[bool] jailbreak: The device jailbreak. Only for android and iOS platform
-        :param pulumi.Input[str] name: Policy device assurance name
-        :param pulumi.Input[str] os_version: The device os minimum version
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] screenlock_types: List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+        :param pulumi.Input[bool] jailbreak: Is the device jailbroken in the device assurance policy.
+        :param pulumi.Input[str] name: Name of the device assurance policy.
+        :param pulumi.Input[str] os_version: Minimum os version of the device in the device assurance policy.
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] screenlock_types: List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
         """
         ...
     @overload
@@ -325,15 +325,15 @@ def get(resource_name: str,
         :param str resource_name: The unique name of the resulting resource.
         :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
         :param pulumi.ResourceOptions opts: Options for the resource.
-        :param pulumi.Input[str] created_by: Created by
-        :param pulumi.Input[str] created_date: Created date
-        :param pulumi.Input[bool] jailbreak: The device jailbreak. Only for android and iOS platform
-        :param pulumi.Input[str] last_update: Last update
-        :param pulumi.Input[str] last_updated_by: Last updated by
-        :param pulumi.Input[str] name: Policy device assurance name
-        :param pulumi.Input[str] os_version: The device os minimum version
+        :param pulumi.Input[str] created_by: Created by of the device assurance polic
+        :param pulumi.Input[str] created_date: Created date of the device assurance polic
+        :param pulumi.Input[bool] jailbreak: Is the device jailbroken in the device assurance policy.
+        :param pulumi.Input[str] last_update: Last update of the device assurance polic
+        :param pulumi.Input[str] last_updated_by: Last updated by of the device assurance polic
+        :param pulumi.Input[str] name: Name of the device assurance policy.
+        :param pulumi.Input[str] os_version: Minimum os version of the device in the device assurance policy.
         :param pulumi.Input[str] platform: Policy device assurance platform
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] screenlock_types: List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] screenlock_types: List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
         """
         opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
 
@@ -354,7 +354,7 @@ def get(resource_name: str,
     @pulumi.getter(name="createdBy")
     def created_by(self) -> pulumi.Output[str]:
         """
-        Created by
+        Created by of the device assurance polic
         """
         return pulumi.get(self, "created_by")
 
@@ -362,7 +362,7 @@ def created_by(self) -> pulumi.Output[str]:
     @pulumi.getter(name="createdDate")
     def created_date(self) -> pulumi.Output[str]:
         """
-        Created date
+        Created date of the device assurance polic
         """
         return pulumi.get(self, "created_date")
 
@@ -370,7 +370,7 @@ def created_date(self) -> pulumi.Output[str]:
     @pulumi.getter
     def jailbreak(self) -> pulumi.Output[Optional[bool]]:
         """
-        The device jailbreak. Only for android and iOS platform
+        Is the device jailbroken in the device assurance policy.
         """
         return pulumi.get(self, "jailbreak")
 
@@ -378,7 +378,7 @@ def jailbreak(self) -> pulumi.Output[Optional[bool]]:
     @pulumi.getter(name="lastUpdate")
     def last_update(self) -> pulumi.Output[str]:
         """
-        Last update
+        Last update of the device assurance polic
         """
         return pulumi.get(self, "last_update")
 
@@ -386,7 +386,7 @@ def last_update(self) -> pulumi.Output[str]:
     @pulumi.getter(name="lastUpdatedBy")
     def last_updated_by(self) -> pulumi.Output[str]:
         """
-        Last updated by
+        Last updated by of the device assurance polic
         """
         return pulumi.get(self, "last_updated_by")
 
@@ -394,7 +394,7 @@ def last_updated_by(self) -> pulumi.Output[str]:
     @pulumi.getter
     def name(self) -> pulumi.Output[str]:
         """
-        Policy device assurance name
+        Name of the device assurance policy.
         """
         return pulumi.get(self, "name")
 
@@ -402,7 +402,7 @@ def name(self) -> pulumi.Output[str]:
     @pulumi.getter(name="osVersion")
     def os_version(self) -> pulumi.Output[Optional[str]]:
         """
-        The device os minimum version
+        Minimum os version of the device in the device assurance policy.
         """
         return pulumi.get(self, "os_version")
 
@@ -418,7 +418,7 @@ def platform(self) -> pulumi.Output[str]:
     @pulumi.getter(name="screenlockTypes")
     def screenlock_types(self) -> pulumi.Output[Optional[Sequence[str]]]:
         """
-        List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+        List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
         """
         return pulumi.get(self, "screenlock_types")
 
diff --git a/sdk/python/pulumi_okta/policy/device_assurance_macos.py b/sdk/python/pulumi_okta/policy/device_assurance_macos.py
index 0fe1bbf6..23b20793 100644
--- a/sdk/python/pulumi_okta/policy/device_assurance_macos.py
+++ b/sdk/python/pulumi_okta/policy/device_assurance_macos.py
@@ -35,11 +35,11 @@ def __init__(__self__, *,
                  tpsp_site_isolation_enabled: Optional[pulumi.Input[bool]] = None):
         """
         The set of arguments for constructing a DeviceAssuranceMacos resource.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] disk_encryption_types: List of disk encryption type, can be ALL_INTERNAL_VOLUMES
-        :param pulumi.Input[str] name: Policy device assurance name
-        :param pulumi.Input[str] os_version: The device os minimum version
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] screenlock_types: List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
-        :param pulumi.Input[bool] secure_hardware_present: Indicates if the device constains a secure hardware functionality
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] disk_encryption_types: List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
+        :param pulumi.Input[str] name: Name of the device assurance policy.
+        :param pulumi.Input[str] os_version: Minimum os version of the device in the device assurance policy.
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] screenlock_types: List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
+        :param pulumi.Input[bool] secure_hardware_present: Is the device secure with hardware in the device assurance policy.
         :param pulumi.Input[bool] third_party_signal_providers: Check to include third party signal provider
         :param pulumi.Input[str] tpsp_browser_version: Third party signal provider minimum browser version
         :param pulumi.Input[bool] tpsp_builtin_dns_client_enabled: Third party signal provider builtin dns client enable
@@ -98,7 +98,7 @@ def __init__(__self__, *,
     @pulumi.getter(name="diskEncryptionTypes")
     def disk_encryption_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
         """
-        List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+        List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
         """
         return pulumi.get(self, "disk_encryption_types")
 
@@ -110,7 +110,7 @@ def disk_encryption_types(self, value: Optional[pulumi.Input[Sequence[pulumi.Inp
     @pulumi.getter
     def name(self) -> Optional[pulumi.Input[str]]:
         """
-        Policy device assurance name
+        Name of the device assurance policy.
         """
         return pulumi.get(self, "name")
 
@@ -122,7 +122,7 @@ def name(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="osVersion")
     def os_version(self) -> Optional[pulumi.Input[str]]:
         """
-        The device os minimum version
+        Minimum os version of the device in the device assurance policy.
         """
         return pulumi.get(self, "os_version")
 
@@ -134,7 +134,7 @@ def os_version(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="screenlockTypes")
     def screenlock_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
         """
-        List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+        List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
         """
         return pulumi.get(self, "screenlock_types")
 
@@ -146,7 +146,7 @@ def screenlock_types(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[st
     @pulumi.getter(name="secureHardwarePresent")
     def secure_hardware_present(self) -> Optional[pulumi.Input[bool]]:
         """
-        Indicates if the device constains a secure hardware functionality
+        Is the device secure with hardware in the device assurance policy.
         """
         return pulumi.get(self, "secure_hardware_present")
 
@@ -354,14 +354,14 @@ def __init__(__self__, *,
         Input properties used for looking up and filtering DeviceAssuranceMacos resources.
         :param pulumi.Input[str] created_by: Created by
         :param pulumi.Input[str] created_date: Created date
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] disk_encryption_types: List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] disk_encryption_types: List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
         :param pulumi.Input[str] last_update: Last update
         :param pulumi.Input[str] last_updated_by: Last updated by
-        :param pulumi.Input[str] name: Policy device assurance name
-        :param pulumi.Input[str] os_version: The device os minimum version
+        :param pulumi.Input[str] name: Name of the device assurance policy.
+        :param pulumi.Input[str] os_version: Minimum os version of the device in the device assurance policy.
         :param pulumi.Input[str] platform: Policy device assurance platform
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] screenlock_types: List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
-        :param pulumi.Input[bool] secure_hardware_present: Indicates if the device constains a secure hardware functionality
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] screenlock_types: List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
+        :param pulumi.Input[bool] secure_hardware_present: Is the device secure with hardware in the device assurance policy.
         :param pulumi.Input[bool] third_party_signal_providers: Check to include third party signal provider
         :param pulumi.Input[str] tpsp_browser_version: Third party signal provider minimum browser version
         :param pulumi.Input[bool] tpsp_builtin_dns_client_enabled: Third party signal provider builtin dns client enable
@@ -454,7 +454,7 @@ def created_date(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="diskEncryptionTypes")
     def disk_encryption_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
         """
-        List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+        List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
         """
         return pulumi.get(self, "disk_encryption_types")
 
@@ -490,7 +490,7 @@ def last_updated_by(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter
     def name(self) -> Optional[pulumi.Input[str]]:
         """
-        Policy device assurance name
+        Name of the device assurance policy.
         """
         return pulumi.get(self, "name")
 
@@ -502,7 +502,7 @@ def name(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="osVersion")
     def os_version(self) -> Optional[pulumi.Input[str]]:
         """
-        The device os minimum version
+        Minimum os version of the device in the device assurance policy.
         """
         return pulumi.get(self, "os_version")
 
@@ -526,7 +526,7 @@ def platform(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="screenlockTypes")
     def screenlock_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
         """
-        List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+        List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
         """
         return pulumi.get(self, "screenlock_types")
 
@@ -538,7 +538,7 @@ def screenlock_types(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[st
     @pulumi.getter(name="secureHardwarePresent")
     def secure_hardware_present(self) -> Optional[pulumi.Input[bool]]:
         """
-        Indicates if the device constains a secure hardware functionality
+        Is the device secure with hardware in the device assurance policy.
         """
         return pulumi.get(self, "secure_hardware_present")
 
@@ -744,11 +744,11 @@ def __init__(__self__,
         Create a DeviceAssuranceMacos resource with the given unique name, props, and options.
         :param str resource_name: The name of the resource.
         :param pulumi.ResourceOptions opts: Options for the resource.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] disk_encryption_types: List of disk encryption type, can be ALL_INTERNAL_VOLUMES
-        :param pulumi.Input[str] name: Policy device assurance name
-        :param pulumi.Input[str] os_version: The device os minimum version
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] screenlock_types: List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
-        :param pulumi.Input[bool] secure_hardware_present: Indicates if the device constains a secure hardware functionality
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] disk_encryption_types: List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
+        :param pulumi.Input[str] name: Name of the device assurance policy.
+        :param pulumi.Input[str] os_version: Minimum os version of the device in the device assurance policy.
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] screenlock_types: List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
+        :param pulumi.Input[bool] secure_hardware_present: Is the device secure with hardware in the device assurance policy.
         :param pulumi.Input[bool] third_party_signal_providers: Check to include third party signal provider
         :param pulumi.Input[str] tpsp_browser_version: Third party signal provider minimum browser version
         :param pulumi.Input[bool] tpsp_builtin_dns_client_enabled: Third party signal provider builtin dns client enable
@@ -882,14 +882,14 @@ def get(resource_name: str,
         :param pulumi.ResourceOptions opts: Options for the resource.
         :param pulumi.Input[str] created_by: Created by
         :param pulumi.Input[str] created_date: Created date
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] disk_encryption_types: List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] disk_encryption_types: List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
         :param pulumi.Input[str] last_update: Last update
         :param pulumi.Input[str] last_updated_by: Last updated by
-        :param pulumi.Input[str] name: Policy device assurance name
-        :param pulumi.Input[str] os_version: The device os minimum version
+        :param pulumi.Input[str] name: Name of the device assurance policy.
+        :param pulumi.Input[str] os_version: Minimum os version of the device in the device assurance policy.
         :param pulumi.Input[str] platform: Policy device assurance platform
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] screenlock_types: List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
-        :param pulumi.Input[bool] secure_hardware_present: Indicates if the device constains a secure hardware functionality
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] screenlock_types: List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
+        :param pulumi.Input[bool] secure_hardware_present: Is the device secure with hardware in the device assurance policy.
         :param pulumi.Input[bool] third_party_signal_providers: Check to include third party signal provider
         :param pulumi.Input[str] tpsp_browser_version: Third party signal provider minimum browser version
         :param pulumi.Input[bool] tpsp_builtin_dns_client_enabled: Third party signal provider builtin dns client enable
@@ -955,7 +955,7 @@ def created_date(self) -> pulumi.Output[str]:
     @pulumi.getter(name="diskEncryptionTypes")
     def disk_encryption_types(self) -> pulumi.Output[Optional[Sequence[str]]]:
         """
-        List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+        List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
         """
         return pulumi.get(self, "disk_encryption_types")
 
@@ -979,7 +979,7 @@ def last_updated_by(self) -> pulumi.Output[str]:
     @pulumi.getter
     def name(self) -> pulumi.Output[str]:
         """
-        Policy device assurance name
+        Name of the device assurance policy.
         """
         return pulumi.get(self, "name")
 
@@ -987,7 +987,7 @@ def name(self) -> pulumi.Output[str]:
     @pulumi.getter(name="osVersion")
     def os_version(self) -> pulumi.Output[Optional[str]]:
         """
-        The device os minimum version
+        Minimum os version of the device in the device assurance policy.
         """
         return pulumi.get(self, "os_version")
 
@@ -1003,7 +1003,7 @@ def platform(self) -> pulumi.Output[str]:
     @pulumi.getter(name="screenlockTypes")
     def screenlock_types(self) -> pulumi.Output[Optional[Sequence[str]]]:
         """
-        List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+        List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
         """
         return pulumi.get(self, "screenlock_types")
 
@@ -1011,7 +1011,7 @@ def screenlock_types(self) -> pulumi.Output[Optional[Sequence[str]]]:
     @pulumi.getter(name="secureHardwarePresent")
     def secure_hardware_present(self) -> pulumi.Output[Optional[bool]]:
         """
-        Indicates if the device constains a secure hardware functionality
+        Is the device secure with hardware in the device assurance policy.
         """
         return pulumi.get(self, "secure_hardware_present")
 
diff --git a/sdk/python/pulumi_okta/policy/device_assurance_windows.py b/sdk/python/pulumi_okta/policy/device_assurance_windows.py
index b2ce39f6..3373bb40 100644
--- a/sdk/python/pulumi_okta/policy/device_assurance_windows.py
+++ b/sdk/python/pulumi_okta/policy/device_assurance_windows.py
@@ -41,11 +41,11 @@ def __init__(__self__, *,
                  tpsp_windows_user_domain: Optional[pulumi.Input[str]] = None):
         """
         The set of arguments for constructing a DeviceAssuranceWindows resource.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] disk_encryption_types: List of disk encryption type, can be ALL_INTERNAL_VOLUMES
-        :param pulumi.Input[str] name: Policy device assurance name
-        :param pulumi.Input[str] os_version: The device os minimum version
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] screenlock_types: List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
-        :param pulumi.Input[bool] secure_hardware_present: Indicates if the device constains a secure hardware functionality
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] disk_encryption_types: List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
+        :param pulumi.Input[str] name: Name of the device assurance policy.
+        :param pulumi.Input[str] os_version: Minimum os version of the device in the device assurance policy.
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] screenlock_types: List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
+        :param pulumi.Input[bool] secure_hardware_present: Is the device secure with hardware in the device assurance policy.
         :param pulumi.Input[bool] third_party_signal_providers: Check to include third party signal provider
         :param pulumi.Input[str] tpsp_browser_version: Third party signal provider minimum browser version
         :param pulumi.Input[bool] tpsp_builtin_dns_client_enabled: Third party signal provider builtin dns client enable
@@ -122,7 +122,7 @@ def __init__(__self__, *,
     @pulumi.getter(name="diskEncryptionTypes")
     def disk_encryption_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
         """
-        List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+        List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
         """
         return pulumi.get(self, "disk_encryption_types")
 
@@ -134,7 +134,7 @@ def disk_encryption_types(self, value: Optional[pulumi.Input[Sequence[pulumi.Inp
     @pulumi.getter
     def name(self) -> Optional[pulumi.Input[str]]:
         """
-        Policy device assurance name
+        Name of the device assurance policy.
         """
         return pulumi.get(self, "name")
 
@@ -146,7 +146,7 @@ def name(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="osVersion")
     def os_version(self) -> Optional[pulumi.Input[str]]:
         """
-        The device os minimum version
+        Minimum os version of the device in the device assurance policy.
         """
         return pulumi.get(self, "os_version")
 
@@ -158,7 +158,7 @@ def os_version(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="screenlockTypes")
     def screenlock_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
         """
-        List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+        List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
         """
         return pulumi.get(self, "screenlock_types")
 
@@ -170,7 +170,7 @@ def screenlock_types(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[st
     @pulumi.getter(name="secureHardwarePresent")
     def secure_hardware_present(self) -> Optional[pulumi.Input[bool]]:
         """
-        Indicates if the device constains a secure hardware functionality
+        Is the device secure with hardware in the device assurance policy.
         """
         return pulumi.get(self, "secure_hardware_present")
 
@@ -456,14 +456,14 @@ def __init__(__self__, *,
         Input properties used for looking up and filtering DeviceAssuranceWindows resources.
         :param pulumi.Input[str] created_by: Created by
         :param pulumi.Input[str] created_date: Created date
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] disk_encryption_types: List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] disk_encryption_types: List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
         :param pulumi.Input[str] last_update: Last update
         :param pulumi.Input[str] last_updated_by: Last updated by
-        :param pulumi.Input[str] name: Policy device assurance name
-        :param pulumi.Input[str] os_version: The device os minimum version
+        :param pulumi.Input[str] name: Name of the device assurance policy.
+        :param pulumi.Input[str] os_version: Minimum os version of the device in the device assurance policy.
         :param pulumi.Input[str] platform: Policy device assurance platform
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] screenlock_types: List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
-        :param pulumi.Input[bool] secure_hardware_present: Indicates if the device constains a secure hardware functionality
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] screenlock_types: List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
+        :param pulumi.Input[bool] secure_hardware_present: Is the device secure with hardware in the device assurance policy.
         :param pulumi.Input[bool] third_party_signal_providers: Check to include third party signal provider
         :param pulumi.Input[str] tpsp_browser_version: Third party signal provider minimum browser version
         :param pulumi.Input[bool] tpsp_builtin_dns_client_enabled: Third party signal provider builtin dns client enable
@@ -574,7 +574,7 @@ def created_date(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="diskEncryptionTypes")
     def disk_encryption_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
         """
-        List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+        List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
         """
         return pulumi.get(self, "disk_encryption_types")
 
@@ -610,7 +610,7 @@ def last_updated_by(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter
     def name(self) -> Optional[pulumi.Input[str]]:
         """
-        Policy device assurance name
+        Name of the device assurance policy.
         """
         return pulumi.get(self, "name")
 
@@ -622,7 +622,7 @@ def name(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="osVersion")
     def os_version(self) -> Optional[pulumi.Input[str]]:
         """
-        The device os minimum version
+        Minimum os version of the device in the device assurance policy.
         """
         return pulumi.get(self, "os_version")
 
@@ -646,7 +646,7 @@ def platform(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="screenlockTypes")
     def screenlock_types(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
         """
-        List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+        List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
         """
         return pulumi.get(self, "screenlock_types")
 
@@ -658,7 +658,7 @@ def screenlock_types(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[st
     @pulumi.getter(name="secureHardwarePresent")
     def secure_hardware_present(self) -> Optional[pulumi.Input[bool]]:
         """
-        Indicates if the device constains a secure hardware functionality
+        Is the device secure with hardware in the device assurance policy.
         """
         return pulumi.get(self, "secure_hardware_present")
 
@@ -942,11 +942,11 @@ def __init__(__self__,
         Create a DeviceAssuranceWindows resource with the given unique name, props, and options.
         :param str resource_name: The name of the resource.
         :param pulumi.ResourceOptions opts: Options for the resource.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] disk_encryption_types: List of disk encryption type, can be ALL_INTERNAL_VOLUMES
-        :param pulumi.Input[str] name: Policy device assurance name
-        :param pulumi.Input[str] os_version: The device os minimum version
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] screenlock_types: List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
-        :param pulumi.Input[bool] secure_hardware_present: Indicates if the device constains a secure hardware functionality
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] disk_encryption_types: List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
+        :param pulumi.Input[str] name: Name of the device assurance policy.
+        :param pulumi.Input[str] os_version: Minimum os version of the device in the device assurance policy.
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] screenlock_types: List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
+        :param pulumi.Input[bool] secure_hardware_present: Is the device secure with hardware in the device assurance policy.
         :param pulumi.Input[bool] third_party_signal_providers: Check to include third party signal provider
         :param pulumi.Input[str] tpsp_browser_version: Third party signal provider minimum browser version
         :param pulumi.Input[bool] tpsp_builtin_dns_client_enabled: Third party signal provider builtin dns client enable
@@ -1104,14 +1104,14 @@ def get(resource_name: str,
         :param pulumi.ResourceOptions opts: Options for the resource.
         :param pulumi.Input[str] created_by: Created by
         :param pulumi.Input[str] created_date: Created date
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] disk_encryption_types: List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] disk_encryption_types: List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
         :param pulumi.Input[str] last_update: Last update
         :param pulumi.Input[str] last_updated_by: Last updated by
-        :param pulumi.Input[str] name: Policy device assurance name
-        :param pulumi.Input[str] os_version: The device os minimum version
+        :param pulumi.Input[str] name: Name of the device assurance policy.
+        :param pulumi.Input[str] os_version: Minimum os version of the device in the device assurance policy.
         :param pulumi.Input[str] platform: Policy device assurance platform
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] screenlock_types: List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
-        :param pulumi.Input[bool] secure_hardware_present: Indicates if the device constains a secure hardware functionality
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] screenlock_types: List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
+        :param pulumi.Input[bool] secure_hardware_present: Is the device secure with hardware in the device assurance policy.
         :param pulumi.Input[bool] third_party_signal_providers: Check to include third party signal provider
         :param pulumi.Input[str] tpsp_browser_version: Third party signal provider minimum browser version
         :param pulumi.Input[bool] tpsp_builtin_dns_client_enabled: Third party signal provider builtin dns client enable
@@ -1189,7 +1189,7 @@ def created_date(self) -> pulumi.Output[str]:
     @pulumi.getter(name="diskEncryptionTypes")
     def disk_encryption_types(self) -> pulumi.Output[Optional[Sequence[str]]]:
         """
-        List of disk encryption type, can be ALL_INTERNAL_VOLUMES
+        List of disk encryption type, can be `ALL_INTERNAL_VOLUMES`
         """
         return pulumi.get(self, "disk_encryption_types")
 
@@ -1213,7 +1213,7 @@ def last_updated_by(self) -> pulumi.Output[str]:
     @pulumi.getter
     def name(self) -> pulumi.Output[str]:
         """
-        Policy device assurance name
+        Name of the device assurance policy.
         """
         return pulumi.get(self, "name")
 
@@ -1221,7 +1221,7 @@ def name(self) -> pulumi.Output[str]:
     @pulumi.getter(name="osVersion")
     def os_version(self) -> pulumi.Output[Optional[str]]:
         """
-        The device os minimum version
+        Minimum os version of the device in the device assurance policy.
         """
         return pulumi.get(self, "os_version")
 
@@ -1237,7 +1237,7 @@ def platform(self) -> pulumi.Output[str]:
     @pulumi.getter(name="screenlockTypes")
     def screenlock_types(self) -> pulumi.Output[Optional[Sequence[str]]]:
         """
-        List of screenlock type, can be BIOMETRIC or BIOMETRIC, PASSCODE
+        List of screenlock type, can be `BIOMETRIC` or `BIOMETRIC, PASSCODE`
         """
         return pulumi.get(self, "screenlock_types")
 
@@ -1245,7 +1245,7 @@ def screenlock_types(self) -> pulumi.Output[Optional[Sequence[str]]]:
     @pulumi.getter(name="secureHardwarePresent")
     def secure_hardware_present(self) -> pulumi.Output[Optional[bool]]:
         """
-        Indicates if the device constains a secure hardware functionality
+        Is the device secure with hardware in the device assurance policy.
         """
         return pulumi.get(self, "secure_hardware_present")
 
diff --git a/sdk/python/pulumi_okta/policy/rule_idp_discovery.py b/sdk/python/pulumi_okta/policy/rule_idp_discovery.py
index 728a7805..264be53b 100644
--- a/sdk/python/pulumi_okta/policy/rule_idp_discovery.py
+++ b/sdk/python/pulumi_okta/policy/rule_idp_discovery.py
@@ -47,6 +47,9 @@ def __init__(__self__, *,
         :param pulumi.Input[str] network_connection: The network selection mode. One of `"ANYWEHRE"` or `"ZONE"`.
         :param pulumi.Input[Sequence[pulumi.Input[str]]] network_excludes: Required if `network_connection` = `"ZONE"`. Indicates the network zones to exclude.
         :param pulumi.Input[Sequence[pulumi.Input[str]]] network_includes: Required if `network_connection` = `"ZONE"`. Indicates the network zones to include.
+        :param pulumi.Input[Sequence[pulumi.Input['RuleIdpDiscoveryPlatformIncludeArgs']]] platform_includes: Platform to include in discovery rule. - 'type' - (Optional) One of: 'ANY', 'MOBILE', 'DESKTOP' - 'os_expression -
+               (Optional) Only available when using os_type = 'OTHER' - 'os_type' - (Optional) One of: 'ANY', 'IOS', 'WINDOWS',
+               'ANDROID', 'OTHER', 'OSX'
         :param pulumi.Input[str] policy_id: Policy ID.
         :param pulumi.Input[int] priority: Idp rule priority. This attribute can be set to a valid priority. To avoid an endless diff situation an error is thrown if an invalid property is provided. The Okta API defaults to the last (lowest) if not provided.
         :param pulumi.Input[str] status: Idp rule status: `"ACTIVE"` or `"INACTIVE"`. By default, it is `"ACTIVE"`.
@@ -190,6 +193,11 @@ def network_includes(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[st
     @property
     @pulumi.getter(name="platformIncludes")
     def platform_includes(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['RuleIdpDiscoveryPlatformIncludeArgs']]]]:
+        """
+        Platform to include in discovery rule. - 'type' - (Optional) One of: 'ANY', 'MOBILE', 'DESKTOP' - 'os_expression -
+        (Optional) Only available when using os_type = 'OTHER' - 'os_type' - (Optional) One of: 'ANY', 'IOS', 'WINDOWS',
+        'ANDROID', 'OTHER', 'OSX'
+        """
         return pulumi.get(self, "platform_includes")
 
     @platform_includes.setter
@@ -303,6 +311,9 @@ def __init__(__self__, *,
         :param pulumi.Input[str] network_connection: The network selection mode. One of `"ANYWEHRE"` or `"ZONE"`.
         :param pulumi.Input[Sequence[pulumi.Input[str]]] network_excludes: Required if `network_connection` = `"ZONE"`. Indicates the network zones to exclude.
         :param pulumi.Input[Sequence[pulumi.Input[str]]] network_includes: Required if `network_connection` = `"ZONE"`. Indicates the network zones to include.
+        :param pulumi.Input[Sequence[pulumi.Input['RuleIdpDiscoveryPlatformIncludeArgs']]] platform_includes: Platform to include in discovery rule. - 'type' - (Optional) One of: 'ANY', 'MOBILE', 'DESKTOP' - 'os_expression -
+               (Optional) Only available when using os_type = 'OTHER' - 'os_type' - (Optional) One of: 'ANY', 'IOS', 'WINDOWS',
+               'ANDROID', 'OTHER', 'OSX'
         :param pulumi.Input[str] policy_id: Policy ID.
         :param pulumi.Input[int] priority: Idp rule priority. This attribute can be set to a valid priority. To avoid an endless diff situation an error is thrown if an invalid property is provided. The Okta API defaults to the last (lowest) if not provided.
         :param pulumi.Input[str] status: Idp rule status: `"ACTIVE"` or `"INACTIVE"`. By default, it is `"ACTIVE"`.
@@ -446,6 +457,11 @@ def network_includes(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[st
     @property
     @pulumi.getter(name="platformIncludes")
     def platform_includes(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['RuleIdpDiscoveryPlatformIncludeArgs']]]]:
+        """
+        Platform to include in discovery rule. - 'type' - (Optional) One of: 'ANY', 'MOBILE', 'DESKTOP' - 'os_expression -
+        (Optional) Only available when using os_type = 'OTHER' - 'os_type' - (Optional) One of: 'ANY', 'IOS', 'WINDOWS',
+        'ANDROID', 'OTHER', 'OSX'
+        """
         return pulumi.get(self, "platform_includes")
 
     @platform_includes.setter
@@ -626,6 +642,9 @@ def __init__(__self__,
         :param pulumi.Input[str] network_connection: The network selection mode. One of `"ANYWEHRE"` or `"ZONE"`.
         :param pulumi.Input[Sequence[pulumi.Input[str]]] network_excludes: Required if `network_connection` = `"ZONE"`. Indicates the network zones to exclude.
         :param pulumi.Input[Sequence[pulumi.Input[str]]] network_includes: Required if `network_connection` = `"ZONE"`. Indicates the network zones to include.
+        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['RuleIdpDiscoveryPlatformIncludeArgs']]]] platform_includes: Platform to include in discovery rule. - 'type' - (Optional) One of: 'ANY', 'MOBILE', 'DESKTOP' - 'os_expression -
+               (Optional) Only available when using os_type = 'OTHER' - 'os_type' - (Optional) One of: 'ANY', 'IOS', 'WINDOWS',
+               'ANDROID', 'OTHER', 'OSX'
         :param pulumi.Input[str] policy_id: Policy ID.
         :param pulumi.Input[int] priority: Idp rule priority. This attribute can be set to a valid priority. To avoid an endless diff situation an error is thrown if an invalid property is provided. The Okta API defaults to the last (lowest) if not provided.
         :param pulumi.Input[str] status: Idp rule status: `"ACTIVE"` or `"INACTIVE"`. By default, it is `"ACTIVE"`.
@@ -803,6 +822,9 @@ def get(resource_name: str,
         :param pulumi.Input[str] network_connection: The network selection mode. One of `"ANYWEHRE"` or `"ZONE"`.
         :param pulumi.Input[Sequence[pulumi.Input[str]]] network_excludes: Required if `network_connection` = `"ZONE"`. Indicates the network zones to exclude.
         :param pulumi.Input[Sequence[pulumi.Input[str]]] network_includes: Required if `network_connection` = `"ZONE"`. Indicates the network zones to include.
+        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['RuleIdpDiscoveryPlatformIncludeArgs']]]] platform_includes: Platform to include in discovery rule. - 'type' - (Optional) One of: 'ANY', 'MOBILE', 'DESKTOP' - 'os_expression -
+               (Optional) Only available when using os_type = 'OTHER' - 'os_type' - (Optional) One of: 'ANY', 'IOS', 'WINDOWS',
+               'ANDROID', 'OTHER', 'OSX'
         :param pulumi.Input[str] policy_id: Policy ID.
         :param pulumi.Input[int] priority: Idp rule priority. This attribute can be set to a valid priority. To avoid an endless diff situation an error is thrown if an invalid property is provided. The Okta API defaults to the last (lowest) if not provided.
         :param pulumi.Input[str] status: Idp rule status: `"ACTIVE"` or `"INACTIVE"`. By default, it is `"ACTIVE"`.
@@ -904,6 +926,11 @@ def network_includes(self) -> pulumi.Output[Optional[Sequence[str]]]:
     @property
     @pulumi.getter(name="platformIncludes")
     def platform_includes(self) -> pulumi.Output[Optional[Sequence['outputs.RuleIdpDiscoveryPlatformInclude']]]:
+        """
+        Platform to include in discovery rule. - 'type' - (Optional) One of: 'ANY', 'MOBILE', 'DESKTOP' - 'os_expression -
+        (Optional) Only available when using os_type = 'OTHER' - 'os_type' - (Optional) One of: 'ANY', 'IOS', 'WINDOWS',
+        'ANDROID', 'OTHER', 'OSX'
+        """
         return pulumi.get(self, "platform_includes")
 
     @property
diff --git a/sdk/python/pulumi_okta/policy/rule_mfa.py b/sdk/python/pulumi_okta/policy/rule_mfa.py
index 03d07b66..e13d475e 100644
--- a/sdk/python/pulumi_okta/policy/rule_mfa.py
+++ b/sdk/python/pulumi_okta/policy/rule_mfa.py
@@ -29,7 +29,10 @@ def __init__(__self__, *,
                  users_excludeds: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
         """
         The set of arguments for constructing a RuleMfa resource.
-        :param pulumi.Input[Sequence[pulumi.Input['RuleMfaAppExcludeArgs']]] app_excludes: Applications to exclude
+        :param pulumi.Input[Sequence[pulumi.Input['RuleMfaAppExcludeArgs']]] app_excludes: Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations. - 'id'
+               - (Optional) Use if 'type' is 'APP' to indicate the application id to include. - 'name' - (Optional) Use if the 'type'
+               is 'APP_TYPE' to indicate the type of application(s) to include in instances where an entire group (i.e. 'yahoo_mail')
+               of applications should be included. - 'type' - (Required) One of: 'APP', 'APP_TYPE'
         :param pulumi.Input[Sequence[pulumi.Input['RuleMfaAppIncludeArgs']]] app_includes: Applications to include in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations.
         :param pulumi.Input[str] enroll: When a user should be prompted for MFA. It can be `"CHALLENGE"`, `"LOGIN"`, or `"NEVER"`.
         :param pulumi.Input[str] name: Use if the `type` is `"APP_TYPE"` to indicate the type of application(s) to include in instances where an entire group (i.e. `yahoo_mail`) of applications should be included.
@@ -68,7 +71,10 @@ def __init__(__self__, *,
     @pulumi.getter(name="appExcludes")
     def app_excludes(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['RuleMfaAppExcludeArgs']]]]:
         """
-        Applications to exclude
+        Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations. - 'id'
+        - (Optional) Use if 'type' is 'APP' to indicate the application id to include. - 'name' - (Optional) Use if the 'type'
+        is 'APP_TYPE' to indicate the type of application(s) to include in instances where an entire group (i.e. 'yahoo_mail')
+        of applications should be included. - 'type' - (Required) One of: 'APP', 'APP_TYPE'
         """
         return pulumi.get(self, "app_excludes")
 
@@ -213,7 +219,10 @@ def __init__(__self__, *,
                  users_excludeds: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
         """
         Input properties used for looking up and filtering RuleMfa resources.
-        :param pulumi.Input[Sequence[pulumi.Input['RuleMfaAppExcludeArgs']]] app_excludes: Applications to exclude
+        :param pulumi.Input[Sequence[pulumi.Input['RuleMfaAppExcludeArgs']]] app_excludes: Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations. - 'id'
+               - (Optional) Use if 'type' is 'APP' to indicate the application id to include. - 'name' - (Optional) Use if the 'type'
+               is 'APP_TYPE' to indicate the type of application(s) to include in instances where an entire group (i.e. 'yahoo_mail')
+               of applications should be included. - 'type' - (Required) One of: 'APP', 'APP_TYPE'
         :param pulumi.Input[Sequence[pulumi.Input['RuleMfaAppIncludeArgs']]] app_includes: Applications to include in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations.
         :param pulumi.Input[str] enroll: When a user should be prompted for MFA. It can be `"CHALLENGE"`, `"LOGIN"`, or `"NEVER"`.
         :param pulumi.Input[str] name: Use if the `type` is `"APP_TYPE"` to indicate the type of application(s) to include in instances where an entire group (i.e. `yahoo_mail`) of applications should be included.
@@ -252,7 +261,10 @@ def __init__(__self__, *,
     @pulumi.getter(name="appExcludes")
     def app_excludes(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['RuleMfaAppExcludeArgs']]]]:
         """
-        Applications to exclude
+        Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations. - 'id'
+        - (Optional) Use if 'type' is 'APP' to indicate the application id to include. - 'name' - (Optional) Use if the 'type'
+        is 'APP_TYPE' to indicate the type of application(s) to include in instances where an entire group (i.e. 'yahoo_mail')
+        of applications should be included. - 'type' - (Required) One of: 'APP', 'APP_TYPE'
         """
         return pulumi.get(self, "app_excludes")
 
@@ -411,7 +423,10 @@ def __init__(__self__,
 
         :param str resource_name: The name of the resource.
         :param pulumi.ResourceOptions opts: Options for the resource.
-        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['RuleMfaAppExcludeArgs']]]] app_excludes: Applications to exclude
+        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['RuleMfaAppExcludeArgs']]]] app_excludes: Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations. - 'id'
+               - (Optional) Use if 'type' is 'APP' to indicate the application id to include. - 'name' - (Optional) Use if the 'type'
+               is 'APP_TYPE' to indicate the type of application(s) to include in instances where an entire group (i.e. 'yahoo_mail')
+               of applications should be included. - 'type' - (Required) One of: 'APP', 'APP_TYPE'
         :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['RuleMfaAppIncludeArgs']]]] app_includes: Applications to include in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations.
         :param pulumi.Input[str] enroll: When a user should be prompted for MFA. It can be `"CHALLENGE"`, `"LOGIN"`, or `"NEVER"`.
         :param pulumi.Input[str] name: Use if the `type` is `"APP_TYPE"` to indicate the type of application(s) to include in instances where an entire group (i.e. `yahoo_mail`) of applications should be included.
@@ -514,7 +529,10 @@ def get(resource_name: str,
         :param str resource_name: The unique name of the resulting resource.
         :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
         :param pulumi.ResourceOptions opts: Options for the resource.
-        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['RuleMfaAppExcludeArgs']]]] app_excludes: Applications to exclude
+        :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['RuleMfaAppExcludeArgs']]]] app_excludes: Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations. - 'id'
+               - (Optional) Use if 'type' is 'APP' to indicate the application id to include. - 'name' - (Optional) Use if the 'type'
+               is 'APP_TYPE' to indicate the type of application(s) to include in instances where an entire group (i.e. 'yahoo_mail')
+               of applications should be included. - 'type' - (Required) One of: 'APP', 'APP_TYPE'
         :param pulumi.Input[Sequence[pulumi.Input[pulumi.InputType['RuleMfaAppIncludeArgs']]]] app_includes: Applications to include in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations.
         :param pulumi.Input[str] enroll: When a user should be prompted for MFA. It can be `"CHALLENGE"`, `"LOGIN"`, or `"NEVER"`.
         :param pulumi.Input[str] name: Use if the `type` is `"APP_TYPE"` to indicate the type of application(s) to include in instances where an entire group (i.e. `yahoo_mail`) of applications should be included.
@@ -547,7 +565,10 @@ def get(resource_name: str,
     @pulumi.getter(name="appExcludes")
     def app_excludes(self) -> pulumi.Output[Optional[Sequence['outputs.RuleMfaAppExclude']]]:
         """
-        Applications to exclude
+        Applications to exclude in discovery rule. **IMPORTANT**: this field is only available in Classic Organizations. - 'id'
+        - (Optional) Use if 'type' is 'APP' to indicate the application id to include. - 'name' - (Optional) Use if the 'type'
+        is 'APP_TYPE' to indicate the type of application(s) to include in instances where an entire group (i.e. 'yahoo_mail')
+        of applications should be included. - 'type' - (Required) One of: 'APP', 'APP_TYPE'
         """
         return pulumi.get(self, "app_excludes")
 
diff --git a/sdk/python/pulumi_okta/policy/rule_signon.py b/sdk/python/pulumi_okta/policy/rule_signon.py
index 08723f3b..4e28756f 100644
--- a/sdk/python/pulumi_okta/policy/rule_signon.py
+++ b/sdk/python/pulumi_okta/policy/rule_signon.py
@@ -34,6 +34,7 @@ def __init__(__self__, *,
                  primary_factor: Optional[pulumi.Input[str]] = None,
                  priority: Optional[pulumi.Input[int]] = None,
                  risc_level: Optional[pulumi.Input[str]] = None,
+                 risk_level: Optional[pulumi.Input[str]] = None,
                  session_idle: Optional[pulumi.Input[int]] = None,
                  session_lifetime: Optional[pulumi.Input[int]] = None,
                  session_persistent: Optional[pulumi.Input[bool]] = None,
@@ -63,6 +64,7 @@ def __init__(__self__, *,
         :param pulumi.Input[int] priority: Policy Rule Priority, this attribute can be set to a valid priority. To avoid endless diff situation we error if an invalid priority is provided. API defaults it to the last (lowest) if not there.
         :param pulumi.Input[str] risc_level: Risc level: `"ANY"`, `"LOW"`, `"MEDIUM"` or `"HIGH"`. Default is `"ANY"`. It can be also 
                set to an empty string in case `RISC_SCORING` org feature flag is disabled.
+        :param pulumi.Input[str] risk_level: Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
         :param pulumi.Input[int] session_idle: Max minutes a session can be idle.,
         :param pulumi.Input[int] session_lifetime: Max minutes a session is active: Disable = 0.
         :param pulumi.Input[bool] session_persistent: Whether session cookies will last across browser sessions. Okta Administrators can never have persistent session cookies.
@@ -103,8 +105,13 @@ def __init__(__self__, *,
             pulumi.set(__self__, "primary_factor", primary_factor)
         if priority is not None:
             pulumi.set(__self__, "priority", priority)
+        if risc_level is not None:
+            warnings.warn("""Attribute typo, switch to risk_level instead. Default: `ANY`""", DeprecationWarning)
+            pulumi.log.warn("""risc_level is deprecated: Attribute typo, switch to risk_level instead. Default: `ANY`""")
         if risc_level is not None:
             pulumi.set(__self__, "risc_level", risc_level)
+        if risk_level is not None:
+            pulumi.set(__self__, "risk_level", risk_level)
         if session_idle is not None:
             pulumi.set(__self__, "session_idle", session_idle)
         if session_lifetime is not None:
@@ -330,12 +337,27 @@ def risc_level(self) -> Optional[pulumi.Input[str]]:
         Risc level: `"ANY"`, `"LOW"`, `"MEDIUM"` or `"HIGH"`. Default is `"ANY"`. It can be also 
         set to an empty string in case `RISC_SCORING` org feature flag is disabled.
         """
+        warnings.warn("""Attribute typo, switch to risk_level instead. Default: `ANY`""", DeprecationWarning)
+        pulumi.log.warn("""risc_level is deprecated: Attribute typo, switch to risk_level instead. Default: `ANY`""")
+
         return pulumi.get(self, "risc_level")
 
     @risc_level.setter
     def risc_level(self, value: Optional[pulumi.Input[str]]):
         pulumi.set(self, "risc_level", value)
 
+    @property
+    @pulumi.getter(name="riskLevel")
+    def risk_level(self) -> Optional[pulumi.Input[str]]:
+        """
+        Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
+        """
+        return pulumi.get(self, "risk_level")
+
+    @risk_level.setter
+    def risk_level(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "risk_level", value)
+
     @property
     @pulumi.getter(name="sessionIdle")
     def session_idle(self) -> Optional[pulumi.Input[int]]:
@@ -418,6 +440,7 @@ def __init__(__self__, *,
                  primary_factor: Optional[pulumi.Input[str]] = None,
                  priority: Optional[pulumi.Input[int]] = None,
                  risc_level: Optional[pulumi.Input[str]] = None,
+                 risk_level: Optional[pulumi.Input[str]] = None,
                  session_idle: Optional[pulumi.Input[int]] = None,
                  session_lifetime: Optional[pulumi.Input[int]] = None,
                  session_persistent: Optional[pulumi.Input[bool]] = None,
@@ -447,6 +470,7 @@ def __init__(__self__, *,
         :param pulumi.Input[int] priority: Policy Rule Priority, this attribute can be set to a valid priority. To avoid endless diff situation we error if an invalid priority is provided. API defaults it to the last (lowest) if not there.
         :param pulumi.Input[str] risc_level: Risc level: `"ANY"`, `"LOW"`, `"MEDIUM"` or `"HIGH"`. Default is `"ANY"`. It can be also 
                set to an empty string in case `RISC_SCORING` org feature flag is disabled.
+        :param pulumi.Input[str] risk_level: Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
         :param pulumi.Input[int] session_idle: Max minutes a session can be idle.,
         :param pulumi.Input[int] session_lifetime: Max minutes a session is active: Disable = 0.
         :param pulumi.Input[bool] session_persistent: Whether session cookies will last across browser sessions. Okta Administrators can never have persistent session cookies.
@@ -487,8 +511,13 @@ def __init__(__self__, *,
             pulumi.set(__self__, "primary_factor", primary_factor)
         if priority is not None:
             pulumi.set(__self__, "priority", priority)
+        if risc_level is not None:
+            warnings.warn("""Attribute typo, switch to risk_level instead. Default: `ANY`""", DeprecationWarning)
+            pulumi.log.warn("""risc_level is deprecated: Attribute typo, switch to risk_level instead. Default: `ANY`""")
         if risc_level is not None:
             pulumi.set(__self__, "risc_level", risc_level)
+        if risk_level is not None:
+            pulumi.set(__self__, "risk_level", risk_level)
         if session_idle is not None:
             pulumi.set(__self__, "session_idle", session_idle)
         if session_lifetime is not None:
@@ -714,12 +743,27 @@ def risc_level(self) -> Optional[pulumi.Input[str]]:
         Risc level: `"ANY"`, `"LOW"`, `"MEDIUM"` or `"HIGH"`. Default is `"ANY"`. It can be also 
         set to an empty string in case `RISC_SCORING` org feature flag is disabled.
         """
+        warnings.warn("""Attribute typo, switch to risk_level instead. Default: `ANY`""", DeprecationWarning)
+        pulumi.log.warn("""risc_level is deprecated: Attribute typo, switch to risk_level instead. Default: `ANY`""")
+
         return pulumi.get(self, "risc_level")
 
     @risc_level.setter
     def risc_level(self, value: Optional[pulumi.Input[str]]):
         pulumi.set(self, "risc_level", value)
 
+    @property
+    @pulumi.getter(name="riskLevel")
+    def risk_level(self) -> Optional[pulumi.Input[str]]:
+        """
+        Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
+        """
+        return pulumi.get(self, "risk_level")
+
+    @risk_level.setter
+    def risk_level(self, value: Optional[pulumi.Input[str]]):
+        pulumi.set(self, "risk_level", value)
+
     @property
     @pulumi.getter(name="sessionIdle")
     def session_idle(self) -> Optional[pulumi.Input[int]]:
@@ -804,6 +848,7 @@ def __init__(__self__,
                  primary_factor: Optional[pulumi.Input[str]] = None,
                  priority: Optional[pulumi.Input[int]] = None,
                  risc_level: Optional[pulumi.Input[str]] = None,
+                 risk_level: Optional[pulumi.Input[str]] = None,
                  session_idle: Optional[pulumi.Input[int]] = None,
                  session_lifetime: Optional[pulumi.Input[int]] = None,
                  session_persistent: Optional[pulumi.Input[bool]] = None,
@@ -924,6 +969,7 @@ def __init__(__self__,
         :param pulumi.Input[int] priority: Policy Rule Priority, this attribute can be set to a valid priority. To avoid endless diff situation we error if an invalid priority is provided. API defaults it to the last (lowest) if not there.
         :param pulumi.Input[str] risc_level: Risc level: `"ANY"`, `"LOW"`, `"MEDIUM"` or `"HIGH"`. Default is `"ANY"`. It can be also 
                set to an empty string in case `RISC_SCORING` org feature flag is disabled.
+        :param pulumi.Input[str] risk_level: Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
         :param pulumi.Input[int] session_idle: Max minutes a session can be idle.,
         :param pulumi.Input[int] session_lifetime: Max minutes a session is active: Disable = 0.
         :param pulumi.Input[bool] session_persistent: Whether session cookies will last across browser sessions. Okta Administrators can never have persistent session cookies.
@@ -1059,6 +1105,7 @@ def _internal_init(__self__,
                  primary_factor: Optional[pulumi.Input[str]] = None,
                  priority: Optional[pulumi.Input[int]] = None,
                  risc_level: Optional[pulumi.Input[str]] = None,
+                 risk_level: Optional[pulumi.Input[str]] = None,
                  session_idle: Optional[pulumi.Input[int]] = None,
                  session_lifetime: Optional[pulumi.Input[int]] = None,
                  session_persistent: Optional[pulumi.Input[bool]] = None,
@@ -1091,6 +1138,7 @@ def _internal_init(__self__,
             __props__.__dict__["primary_factor"] = primary_factor
             __props__.__dict__["priority"] = priority
             __props__.__dict__["risc_level"] = risc_level
+            __props__.__dict__["risk_level"] = risk_level
             __props__.__dict__["session_idle"] = session_idle
             __props__.__dict__["session_lifetime"] = session_lifetime
             __props__.__dict__["session_persistent"] = session_persistent
@@ -1124,6 +1172,7 @@ def get(resource_name: str,
             primary_factor: Optional[pulumi.Input[str]] = None,
             priority: Optional[pulumi.Input[int]] = None,
             risc_level: Optional[pulumi.Input[str]] = None,
+            risk_level: Optional[pulumi.Input[str]] = None,
             session_idle: Optional[pulumi.Input[int]] = None,
             session_lifetime: Optional[pulumi.Input[int]] = None,
             session_persistent: Optional[pulumi.Input[bool]] = None,
@@ -1158,6 +1207,7 @@ def get(resource_name: str,
         :param pulumi.Input[int] priority: Policy Rule Priority, this attribute can be set to a valid priority. To avoid endless diff situation we error if an invalid priority is provided. API defaults it to the last (lowest) if not there.
         :param pulumi.Input[str] risc_level: Risc level: `"ANY"`, `"LOW"`, `"MEDIUM"` or `"HIGH"`. Default is `"ANY"`. It can be also 
                set to an empty string in case `RISC_SCORING` org feature flag is disabled.
+        :param pulumi.Input[str] risk_level: Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
         :param pulumi.Input[int] session_idle: Max minutes a session can be idle.,
         :param pulumi.Input[int] session_lifetime: Max minutes a session is active: Disable = 0.
         :param pulumi.Input[bool] session_persistent: Whether session cookies will last across browser sessions. Okta Administrators can never have persistent session cookies.
@@ -1186,6 +1236,7 @@ def get(resource_name: str,
         __props__.__dict__["primary_factor"] = primary_factor
         __props__.__dict__["priority"] = priority
         __props__.__dict__["risc_level"] = risc_level
+        __props__.__dict__["risk_level"] = risk_level
         __props__.__dict__["session_idle"] = session_idle
         __props__.__dict__["session_lifetime"] = session_lifetime
         __props__.__dict__["session_persistent"] = session_persistent
@@ -1339,8 +1390,19 @@ def risc_level(self) -> pulumi.Output[Optional[str]]:
         Risc level: `"ANY"`, `"LOW"`, `"MEDIUM"` or `"HIGH"`. Default is `"ANY"`. It can be also 
         set to an empty string in case `RISC_SCORING` org feature flag is disabled.
         """
+        warnings.warn("""Attribute typo, switch to risk_level instead. Default: `ANY`""", DeprecationWarning)
+        pulumi.log.warn("""risc_level is deprecated: Attribute typo, switch to risk_level instead. Default: `ANY`""")
+
         return pulumi.get(self, "risc_level")
 
+    @property
+    @pulumi.getter(name="riskLevel")
+    def risk_level(self) -> pulumi.Output[Optional[str]]:
+        """
+        Risk level: ANY, LOW, MEDIUM or HIGH. Default: `ANY`
+        """
+        return pulumi.get(self, "risk_level")
+
     @property
     @pulumi.getter(name="sessionIdle")
     def session_idle(self) -> pulumi.Output[Optional[int]]:
diff --git a/sdk/python/pulumi_okta/role_subscription.py b/sdk/python/pulumi_okta/role_subscription.py
index 1af9d0bf..64167cd4 100644
--- a/sdk/python/pulumi_okta/role_subscription.py
+++ b/sdk/python/pulumi_okta/role_subscription.py
@@ -34,7 +34,7 @@ def __init__(__self__, *,
                - `"RATELIMIT_NOTIFICATION"` - Rate limit warning and violation.
                - `"AGENT_AUTO_UPDATE_NOTIFICATION"` - Agent auto-update notifications: AD Agent.
         :param pulumi.Input[str] role_type: Type of the role. Valid values:
-               `"API_ADMIN"`,
+               `"API_ACCESS_MANAGEMENT_ADMIN"`,
                `"APP_ADMIN"`,
                `"CUSTOM"`,
                `"GROUP_MEMBERSHIP_ADMIN"`,
@@ -83,7 +83,7 @@ def notification_type(self, value: pulumi.Input[str]):
     def role_type(self) -> pulumi.Input[str]:
         """
         Type of the role. Valid values:
-        `"API_ADMIN"`,
+        `"API_ACCESS_MANAGEMENT_ADMIN"`,
         `"APP_ADMIN"`,
         `"CUSTOM"`,
         `"GROUP_MEMBERSHIP_ADMIN"`,
@@ -138,7 +138,7 @@ def __init__(__self__, *,
                - `"RATELIMIT_NOTIFICATION"` - Rate limit warning and violation.
                - `"AGENT_AUTO_UPDATE_NOTIFICATION"` - Agent auto-update notifications: AD Agent.
         :param pulumi.Input[str] role_type: Type of the role. Valid values:
-               `"API_ADMIN"`,
+               `"API_ACCESS_MANAGEMENT_ADMIN"`,
                `"APP_ADMIN"`,
                `"CUSTOM"`,
                `"GROUP_MEMBERSHIP_ADMIN"`,
@@ -189,7 +189,7 @@ def notification_type(self, value: Optional[pulumi.Input[str]]):
     def role_type(self) -> Optional[pulumi.Input[str]]:
         """
         Type of the role. Valid values:
-        `"API_ADMIN"`,
+        `"API_ACCESS_MANAGEMENT_ADMIN"`,
         `"APP_ADMIN"`,
         `"CUSTOM"`,
         `"GROUP_MEMBERSHIP_ADMIN"`,
@@ -274,7 +274,7 @@ def __init__(__self__,
                - `"RATELIMIT_NOTIFICATION"` - Rate limit warning and violation.
                - `"AGENT_AUTO_UPDATE_NOTIFICATION"` - Agent auto-update notifications: AD Agent.
         :param pulumi.Input[str] role_type: Type of the role. Valid values:
-               `"API_ADMIN"`,
+               `"API_ACCESS_MANAGEMENT_ADMIN"`,
                `"APP_ADMIN"`,
                `"CUSTOM"`,
                `"GROUP_MEMBERSHIP_ADMIN"`,
@@ -390,7 +390,7 @@ def get(resource_name: str,
                - `"RATELIMIT_NOTIFICATION"` - Rate limit warning and violation.
                - `"AGENT_AUTO_UPDATE_NOTIFICATION"` - Agent auto-update notifications: AD Agent.
         :param pulumi.Input[str] role_type: Type of the role. Valid values:
-               `"API_ADMIN"`,
+               `"API_ACCESS_MANAGEMENT_ADMIN"`,
                `"APP_ADMIN"`,
                `"CUSTOM"`,
                `"GROUP_MEMBERSHIP_ADMIN"`,
@@ -439,7 +439,7 @@ def notification_type(self) -> pulumi.Output[str]:
     def role_type(self) -> pulumi.Output[str]:
         """
         Type of the role. Valid values:
-        `"API_ADMIN"`,
+        `"API_ACCESS_MANAGEMENT_ADMIN"`,
         `"APP_ADMIN"`,
         `"CUSTOM"`,
         `"GROUP_MEMBERSHIP_ADMIN"`,
diff --git a/sdk/python/pulumi_okta/user/user.py b/sdk/python/pulumi_okta/user/user.py
index 6512bbcd..c9f14ca1 100644
--- a/sdk/python/pulumi_okta/user/user.py
+++ b/sdk/python/pulumi_okta/user/user.py
@@ -68,7 +68,8 @@ def __init__(__self__, *,
         :param pulumi.Input[str] cost_center: User profile property.
         :param pulumi.Input[str] country_code: User profile property.
         :param pulumi.Input[str] custom_profile_attributes: raw JSON containing all custom profile attributes.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] custom_profile_attributes_to_ignores: List of custom_profile_attribute keys that should be excluded from being managed by Terraform.
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] custom_profile_attributes_to_ignores: List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in
+               situations where specific custom fields may contain sensitive information and should be managed outside of Terraform.
         :param pulumi.Input[str] department: User profile property.
         :param pulumi.Input[str] display_name: User profile property.
         :param pulumi.Input[str] division: User profile property.
@@ -296,7 +297,8 @@ def custom_profile_attributes(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="customProfileAttributesToIgnores")
     def custom_profile_attributes_to_ignores(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
         """
-        List of custom_profile_attribute keys that should be excluded from being managed by Terraform.
+        List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in
+        situations where specific custom fields may contain sensitive information and should be managed outside of Terraform.
         """
         return pulumi.get(self, "custom_profile_attributes_to_ignores")
 
@@ -765,7 +767,8 @@ def __init__(__self__, *,
         :param pulumi.Input[str] cost_center: User profile property.
         :param pulumi.Input[str] country_code: User profile property.
         :param pulumi.Input[str] custom_profile_attributes: raw JSON containing all custom profile attributes.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] custom_profile_attributes_to_ignores: List of custom_profile_attribute keys that should be excluded from being managed by Terraform.
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] custom_profile_attributes_to_ignores: List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in
+               situations where specific custom fields may contain sensitive information and should be managed outside of Terraform.
         :param pulumi.Input[str] department: User profile property.
         :param pulumi.Input[str] display_name: User profile property.
         :param pulumi.Input[str] division: User profile property.
@@ -956,7 +959,8 @@ def custom_profile_attributes(self, value: Optional[pulumi.Input[str]]):
     @pulumi.getter(name="customProfileAttributesToIgnores")
     def custom_profile_attributes_to_ignores(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
         """
-        List of custom_profile_attribute keys that should be excluded from being managed by Terraform.
+        List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in
+        situations where specific custom fields may contain sensitive information and should be managed outside of Terraform.
         """
         return pulumi.get(self, "custom_profile_attributes_to_ignores")
 
@@ -1560,7 +1564,8 @@ def __init__(__self__,
         :param pulumi.Input[str] cost_center: User profile property.
         :param pulumi.Input[str] country_code: User profile property.
         :param pulumi.Input[str] custom_profile_attributes: raw JSON containing all custom profile attributes.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] custom_profile_attributes_to_ignores: List of custom_profile_attribute keys that should be excluded from being managed by Terraform.
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] custom_profile_attributes_to_ignores: List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in
+               situations where specific custom fields may contain sensitive information and should be managed outside of Terraform.
         :param pulumi.Input[str] department: User profile property.
         :param pulumi.Input[str] display_name: User profile property.
         :param pulumi.Input[str] division: User profile property.
@@ -1870,7 +1875,8 @@ def get(resource_name: str,
         :param pulumi.Input[str] cost_center: User profile property.
         :param pulumi.Input[str] country_code: User profile property.
         :param pulumi.Input[str] custom_profile_attributes: raw JSON containing all custom profile attributes.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] custom_profile_attributes_to_ignores: List of custom_profile_attribute keys that should be excluded from being managed by Terraform.
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] custom_profile_attributes_to_ignores: List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in
+               situations where specific custom fields may contain sensitive information and should be managed outside of Terraform.
         :param pulumi.Input[str] department: User profile property.
         :param pulumi.Input[str] display_name: User profile property.
         :param pulumi.Input[str] division: User profile property.
@@ -2004,7 +2010,8 @@ def custom_profile_attributes(self) -> pulumi.Output[str]:
     @pulumi.getter(name="customProfileAttributesToIgnores")
     def custom_profile_attributes_to_ignores(self) -> pulumi.Output[Optional[Sequence[str]]]:
         """
-        List of custom_profile_attribute keys that should be excluded from being managed by Terraform.
+        List of custom_profile_attribute keys that should be excluded from being managed by Terraform. This is useful in
+        situations where specific custom fields may contain sensitive information and should be managed outside of Terraform.
         """
         return pulumi.get(self, "custom_profile_attributes_to_ignores")
 
diff --git a/upstream b/upstream
index 94fcdcc2..c894ab5f 160000
--- a/upstream
+++ b/upstream
@@ -1 +1 @@
-Subproject commit 94fcdcc2ea88ce9a759e69cce43ff8ee3aa6429c
+Subproject commit c894ab5f3ab8485ace0035c7eea4acc450a37e7c