Assign an Okta application to a group and to individual users via the Apps API, including app user profile and credentials

Documented steps

1. Authenticate with scope okta.apps.manage for writes and okta.apps.read for reads.
2. Inspect the app first: GET /api/v1/apps/{appId} and note signOnMode and credentials.scheme - these determine whether app user credentials may be supplied at all.
3. Assign the app to a group: PUT /api/v1/apps/{appId}/groups/{groupId} with optional body {"priority": 99, "profile": {...}}. Every current and future member of the group receives the app, and the resulting application user has scope GROUP.
4. Use priority to arbitrate when a user belongs to several groups assigned to the same app: the group with the higher priority number has its profile applied to that user's application user object. If priority is omitted the next-highest value is assigned automatically.
5. Verify group assignments: GET /api/v1/apps/{appId}/groups with limit and the after cursor from the Link header rel="next"; use expand=group or expand=metadata to embed details.
6. Remove a group assignment: DELETE /api/v1/apps/{appId}/groups/{groupId} - this removes access for every user who held the app only via that group.
7. Assign the app to an individual user: POST /api/v1/apps/{appId}/users with body {"id": "{userId}", "scope": "USER", "credentials": {"userName": "..."}, "profile": {...}}.
8. Supply credentials only when the app's credentials.scheme requires them; otherwise the request fails with 'Credentials should not be set on this resource based on the scheme.'
9. For apps with profile mappings under Universal Directory, omit any profile properties already covered by a mapping - you can only set unmapped properties on the assignment.
10. Read the response: id, status, scope (USER or GROUP), syncState, externalId (populated once provisioned or reconciled) and _links.
11. Update an existing assignment with POST /api/v1/apps/{appId}/users/{userId}; read one with GET /api/v1/apps/{appId}/users/{userId}; list all with GET /api/v1/apps/{appId}/users paginated via the Link header.
12. Unassign an individual user: DELETE /api/v1/apps/{appId}/users/{userId}. Treat this as destructive - see gotchas.
13. Official docs consulted: https://developer.okta.com/docs/api/openapi/okta-management/management/tags/applicationgroups | https://developer.okta.com/docs/api/openapi/okta-management/management/tags/applicationusers | https://developer.okta.com/docs/reference/core-okta-api/