Device Assurance Policy deserialization fails on gracePeriod.expiry ISO 8601 duration string

[teads-sylvain]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
  Before submitting a bug report, we ask that you first search existing issues and pull requests to see if someone else may have experienced the same issue or may have already submitted a fix for it.

Python Version & Okta SDK Version(s)

Python v3.13.12
okta 3.3.0

Affected Class/Method(s)

okta.models.device_assurance_policy.GracePeriodExpiry (oneOf discriminator)

Customer Information

Organization Name: Teads
Paid Customer: yes

Code Snippet

import okta
from okta.api.device_assurance_api import DeviceAssuranceApi
from okta.api_client import ApiClient

config = okta.Configuration(host="https://<your-org>.okta.com")
config.access_token = "<token-with-okta.deviceAssurance.read-scope>"
client = ApiClient(config)
api = DeviceAssuranceApi(client)

# Fails if any policy has gracePeriod configured with BY_DURATION type
policies = api.list_device_assurances()

# Also fails on a single policy
policy = api.get_device_assurance(device_assurance_id="<policy-id>")

Debug Output / Traceback

No match found when deserializing the JSON string into GracePeriodExpiry
with oneOf schemas: ByDateTimeExpiry, ByDurationExpiry.
Details:
  1 validation error for ByDateTimeExpiry
    Input should be a valid dictionary or instance of ByDateTimeExpiry
    [type=model_type, input_value='PT168H', input_type=str]
  1 validation error for ByDurationExpiry
    Input should be a valid dictionary or instance of ByDurationExpiry
    [type=model_type, input_value='PT168H', input_type=str]

Expected Behavior

The SDK should successfully deserialize a Device Assurance Policy that has a gracePeriod configured with type: "BY_DURATION". The Okta API returns the following JSON:

{
  "gracePeriod": {
    "type": "BY_DURATION",
    "expiry": "PT168H"
  }
}

The expiry field is a plain ISO 8601 duration string ("PT168H" = 168 hours = 7 days). The SDK should parse it correctly.

Actual Behavior

The GracePeriodExpiry oneOf discriminator tries to deserialize "PT168H" (a string) against ByDateTimeExpiry and ByDurationExpiry, both of which expect a dict/object, not a plain string. This causes both branches to fail, raising the error above.

Both list_device_assurances() and get_device_assurance() are affected — any org with at least one policy using BY_DURATION grace period will hit this.

Steps to reproduce

1. Create a Device Assurance Policy in the Okta Admin Console with remediation enabled (grace period by duration, e.g. 7 days).
2. Run the code snippet above.

References

• Okta Device Assurance API docs
• Similar oneOf deserialization issue: Unable to access GroupProfile.name after updating to 3.1.0 #503

[BinoyOza-okta]

The issue has been resolved and released in v3.4.1. Hence, closing this issue.