Create an Okta user with a profile and password via the Users API, controlling activation and retrieving the activation link

Documented steps

1. Authenticate with a token carrying scope okta.users.manage (okta.users.read is read-only and will 403 on create).
2. Build the request body: {"profile": {"firstName": "...", "lastName": "...", "email": "...", "login": "..."}, "credentials": {"password": {"value": "..."}}}. login is normally the same value as email.
3. POST /api/v1/users?activate=false with headers Authorization: Bearer {token} (or SSWS {token}), Content-Type: application/json, Accept: application/json. Pass activate explicitly - it defaults to true when omitted.
4. Read the HTTP 200 response: the created User object with id and status. With activate=false and no password the user is STAGED; with activate=true or a supplied password the user moves toward PROVISIONED or ACTIVE.
5. Activate later with POST /api/v1/users/{userId}/lifecycle/activate?sendEmail=false. This is valid only when the user status is STAGED or DEPROVISIONED.
6. Set sendEmail=false to suppress Okta's welcome email and receive the activation material in the response; set sendEmail=true to have Okta email the activation link to the user instead.
7. Parse the activation response as a UserActivationToken object containing activationToken (usable for primary authentication via the Authentication API) and activationUrl (populated when sendEmail=false).
8. Treat activation as asynchronous: poll GET /api/v1/users/{userId} and confirm status has settled to ACTIVE (or PROVISIONED if no password is set) rather than assuming the state immediately after the call returns.
9. For bulk onboarding, create with activate=false first, verify profile correctness and group/app assignments, then activate - this avoids emailing users before their access is configured.
10. Official docs consulted: https://developer.okta.com/docs/api/openapi/okta-management/management/tags/user | https://developer.okta.com/docs/api/openapi/okta-management/management/tags/userlifecycle | https://developer.okta.com/docs/reference/core-okta-api/