Implement Okta event hooks for real-time security event reaction including challenge verification

Steps

1. Register the event hook in the Okta Admin Console or via the Event Hooks API (POST /api/v1/eventHooks) with the hookUrl, the event types to subscribe to (e.g. user.session.start, user.authentication.auth_via_mfa), and an authorization header secret
2. Implement the challenge verification step: when Okta first activates the hook, it sends a GET request to your hookUrl with an X-Okta-Verification-Challenge header; respond with {verification: <value-from-header>} and HTTP 200
3. Handle incoming event payloads: each POST contains an events array; each event object has eventType, target[], actor, client, and an outcome field indicating success or failure
4. Respond within Okta's timeout (currently 3 seconds); return HTTP 200 promptly and process the event asynchronously in a background queue — synchronous heavy processing will cause timeout failures and retries
5. Verify the request came from Okta: check the Authorization header value against your configured secret before processing the event
6. Use the event hook to trigger downstream actions: update a SIEM, enforce geo-block policies, trigger re-authentication prompts, or feed a risk engine — but do not use the event hook for inline authentication decisions (use inline hooks for that)