MFA_ENROLL policy deserialization fails on BY_SKIP_COUNT grace period (EnrollmentPolicyAuthenticatorGracePeriod discriminator only maps BY_DATE_TIME)

[im007]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.

Python Version & Okta SDK Version(s)

Python 3.13.12
okta 3.4.1 — also verified still present in 3.4.4 (latest)

Affected Class/Method(s)

okta.models.enrollment_policy_authenticator_grace_period.EnrollmentPolicyAuthenticatorGracePeriod (oneOf discriminator dispatch in from_dict / get_discriminator_value)

Surfaces through any policy read that touches an MFA_ENROLL (authenticator enrollment) policy, e.g. list_policies(type="MFA_ENROLL") and get_policy(<policy-id>).

Customer Information

Paid customer. Organization name available via support case on request.

Code Snippet

Self-contained reproduction, no org required — this is the exact gracePeriod object the /api/v1/policies?type=MFA_ENROLL endpoint returns when an authenticator's enrollment grace period is configured as "by skip count":

from okta.models.enrollment_policy_authenticator_grace_period import (
    EnrollmentPolicyAuthenticatorGracePeriod,
)

EnrollmentPolicyAuthenticatorGracePeriod.from_dict(
    {"type": "BY_SKIP_COUNT", "skipCount": 5}
)

Debug Output / Traceback

ValueError: EnrollmentPolicyAuthenticatorGracePeriod failed to lookup discriminator value from
{"skipCount": 5, "type": "BY_SKIP_COUNT"}. Discriminator property name: type,
mapping: {"BY_DATE_TIME": "ByDateTimeAuthenticatorGracePeriodExpiry"}

Expected Behavior

The payload deserializes into a typed model — i.e. a BySkipCountAuthenticatorGracePeriodExpiry counterpart to the existing ByDateTimeAuthenticatorGracePeriodExpiry, with the discriminator map containing both BY_DATE_TIME and BY_SKIP_COUNT.

Actual Behavior

ValueError is raised. Because the failure happens during response deserialization, a single authenticator with a skip-count grace period anywhere in the org makes every list_policies(type="MFA_ENROLL") call fail wholesale — there is no way to read any enrollment policy through the SDK once one policy uses this (Admin-Console-configurable) setting.

The generated model only knows one variant:

# okta/models/enrollment_policy_authenticator_grace_period.py
__discriminator_value_class_map: ClassVar[Dict[str, str]] = {
    "BY_DATE_TIME": "ByDateTimeAuthenticatorGracePeriodExpiry"
}

and no BySkipCountAuthenticatorGracePeriodExpiry model exists in the package, so the OpenAPI spec the SDK is generated from appears to be missing this variant.

Steps to reproduce

1. Run the two-line snippet above against okta 3.4.4; or
2. Against a live org: in the Admin Console set any authenticator in an authenticator enrollment policy to Required with a grace period of the "user may skip N times" kind, then call list_policies(type="MFA_ENROLL") or get_policy() on that policy via the SDK.

References

• Same failure class as Listing factors fails if a claims_provider factor is encountered.  #311 and Device Assurance Policy deserialization fails on gracePeriod.expiry ISO 8601 duration string #518: an unmodeled oneOf variant fails the entire API call during deserialization. Consider — in addition to adding the missing BY_SKIP_COUNT model — having discriminator dispatch degrade gracefully (preserve unknown variants raw) so future enum additions on the API side don't hard-break existing SDK versions.
• Downstream impact: okta/okta-mcp-server pins this SDK, so its list_policies/get_policy tools return this error for MFA_ENROLL policies on affected orgs.