Fix rollback:okta

scripts/lib/agent-identity-api.ts

@@ -348,6 +348,25 @@ export class AgentIdentityAPIClient {
     }
   }
 
+  /**
+   * Deactivate a connection between agent and authorization server
+   */
+  async deactivateConnection(agentId: string, connectionId: string): Promise<void> {
+    try {
+      const response = await axios.post(
+        `${this.baseUrl}/workload-principals/api/v1/ai-agents/${agentId}/connections/${connectionId}/lifecycle/deactivate`,
+        {},
+        this.getAxiosConfig()
+      );
+
+      if (response.status !== 200) {
+        throw new Error(`Unexpected status: ${response.status}`);
+      }
+    } catch (error: any) {
+      this.handleAxiosError(error, 'Deactivate connection');
+    }
+  }
+
   /**
    * Delete a connection between agent and authorization server
    */
@@ -358,8 +377,7 @@ export class AgentIdentityAPIClient {
         this.getAxiosConfig()
       );
 
-      // spec wrong, says 204 but actually returns 200
-      if (response.status !== 200) {
+      if (response.status !== 204) {
         throw new Error(`Unexpected status: ${response.status}`);
       }
     } catch (error: any) {

scripts/rollback-okta-config.ts

@@ -208,7 +208,21 @@ async function rollback() {
       }
     }
 
-    // Step 3: Delete Agent Connections (must be before agents)
+    // Step 3: Deactivate Agent Connections (must be deactivated before deletion)
+    if (state.agentConnections && state.agentConnections.length > 0) {
+      for (const connection of state.agentConnections) {
+        const spinner = ora(`Deactivate agent connection ${connection.connectionId}...`).start();
+        try {
+          await agentClient.deactivateConnection(connection.agentId, connection.connectionId);
+          spinner.succeed(`Agent connection deactivated`);
+        } catch (error: any) {
+          spinner.fail(`Failed: ${error.message}`);
+          errorCount++;
+        }
+      }
+    }
+
+    // Step 3.5: Delete Agent Connections (must be before agents)
     if (state.agentConnections && state.agentConnections.length > 0) {
       for (const connection of state.agentConnections) {
         const spinner = ora(`Deleting agent connection ${connection.connectionId}...`).start();