From f470e46608ac44662e867ef8dad44c7f7ee3e9af Mon Sep 17 00:00:00 2001 From: James Maes Date: Sun, 11 Oct 2026 19:55:09 -0500 Subject: [PATCH 1/2] feat: phase 0 foundations (read-only client, contract tests on Authentik 2026.8.3) - AuthentikQBitConfig (validated, secrets resolved by the qbit, never serialized or printed) and AuthentikQBitProducer (API backend, read-only authentikUser / authentikGroup tables, Identity app). - AuthentikActionUtil on qqq-backend-module-api: bearer auth, page/page_size paging with pagination.count, key lookups by GET, server-side user scope, AuthentikFilterMapper (rejects whatever Authentik cannot evaluate), 10 rps token-bucket throttle, 429/5xx retries, error mapping, and logging that never carries the token, query strings, successful GET bodies or sensitive bodies (AuthentikRedactor). - AuthentikGuard: identity.* read checks, sensitive fields behind identity.audit.read, all writes refused in this release, protected-account detection. - Pinned Authentik 2026.8.3 schema, SchemaDriftTest / SchemaDriftIT over the API surface used, and a weekly drift workflow against new releases. - Testcontainers harness (Authentik server + worker, Postgres, Mailpit) with the kof22-shaped blueprints, fixture recorder, and contract tests (b), (c), (d), (h) plus the access-check, sign-in policy, webhook and token findings. - Owner checklist, rehearsal script and blueprint lint for the cluster-gitops migration (KofTwentyTwo/cluster-gitops#72). Co-Authored-By: Claude Opus 5.5 --- .github/workflows/schema-drift.yml | 42 + CHANGELOG.md | 10 + docs/PHASE0-OWNER-CHECKLIST.md | 103 + docs/STATUS.md | 23 + docs/cluster-gitops-phase0/README.md | 21 + docs/cluster-gitops-phase0/rehearse-phase0.sh | 108 + .../lint-authentik-blueprints.cpython-314.pyc | Bin 0 -> 16474 bytes .../scripts/lint-authentik-blueprints.py | 225 + .../qbits/authentik/AuthentikFeature.java | 58 + .../qbits/authentik/AuthentikQBitConfig.java | 925 + .../authentik/AuthentikQBitProducer.java | 223 + .../qbits/authentik/AuthentikRuntime.java | 177 + .../authentik/client/AuthentikActionUtil.java | 918 + .../authentik/client/AuthentikApiSurface.java | 98 + .../authentik/client/AuthentikFieldSpec.java | 204 + .../client/AuthentikFilterMapper.java | 446 + .../qbits/authentik/client/AuthentikJson.java | 234 + .../authentik/client/AuthentikRedactor.java | 129 + .../authentik/client/AuthentikTableSpec.java | 277 + .../authentik/client/AuthentikTables.java | 187 + .../authentik/client/TokenBucketThrottle.java | 135 + .../AbstractAuthentikTableProducer.java | 121 + .../AuthentikAppMetaDataProducer.java | 85 + .../AuthentikBackendMetaDataProducer.java | 65 + .../metadata/AuthentikGroupTableProducer.java | 38 + .../metadata/AuthentikUserTableProducer.java | 38 + .../authentik/security/AuthentikGuard.java | 255 + .../security/IdentityPermission.java | 118 + .../authentik/AuthentikQBitConfigTest.java | 153 + .../authentik/AuthentikQBitProducerTest.java | 121 + .../qbits/authentik/AuthentikTestSupport.java | 142 + .../authentik/RequiresDockerCondition.java | 72 + .../RequiresDockerConditionTest.java | 75 + .../qbits/authentik/SchemaDriftTest.java | 177 + .../client/AuthentikActionUtilTest.java | 482 + .../client/AuthentikFilterMapperTest.java | 225 + .../client/AuthentikRedactorTest.java | 70 + .../authentik/client/FixtureActionUtil.java | 98 + .../client/TokenBucketThrottleTest.java | 114 + .../authentik/contract/AccessCheckIT.java | 126 + .../contract/AuthentikTestStack.java | 349 + .../contract/BlueprintReapplyIT.java | 197 + .../contract/BootstrapBlueprintIT.java | 175 + .../authentik/contract/FixtureRecorder.java | 128 + .../contract/QbitReadContractIT.java | 319 + .../authentik/contract/SchemaDriftIT.java | 100 + .../authentik/contract/SignInPolicyIT.java | 148 + .../authentik/contract/SuperuserFloorIT.java | 266 + .../qbits/authentik/contract/TestApi.java | 219 + .../resources/authentik/schema-2026.8.3.yml | 61541 ++++++++++++++++ .../blueprints/kof22-identity-bootstrap.yaml | 107 + .../blueprints/kof22-oauth2-apps.yaml | 372 + .../fixtures/2026.8.3/admin-version.json | 8 + .../2026.8.3/error-400-bad-filter.json | 1 + .../fixtures/2026.8.3/error-403.json | 1 + .../fixtures/2026.8.3/groups-list.json | 54 + .../resources/fixtures/2026.8.3/user-get.json | 22 + .../fixtures/2026.8.3/users-list.json | 380 + src/test/resources/junit-platform.properties | 1 + src/test/resources/log4j2-test.xml | 20 + 60 files changed, 71526 insertions(+) create mode 100644 .github/workflows/schema-drift.yml create mode 100644 CHANGELOG.md create mode 100644 docs/PHASE0-OWNER-CHECKLIST.md create mode 100644 docs/STATUS.md create mode 100644 docs/cluster-gitops-phase0/README.md create mode 100644 docs/cluster-gitops-phase0/rehearse-phase0.sh create mode 100644 docs/cluster-gitops-phase0/scripts/__pycache__/lint-authentik-blueprints.cpython-314.pyc create mode 100644 docs/cluster-gitops-phase0/scripts/lint-authentik-blueprints.py create mode 100644 src/main/java/com/kingsrook/qbits/authentik/AuthentikFeature.java create mode 100644 src/main/java/com/kingsrook/qbits/authentik/AuthentikQBitConfig.java create mode 100644 src/main/java/com/kingsrook/qbits/authentik/AuthentikQBitProducer.java create mode 100644 src/main/java/com/kingsrook/qbits/authentik/AuthentikRuntime.java create mode 100644 src/main/java/com/kingsrook/qbits/authentik/client/AuthentikActionUtil.java create mode 100644 src/main/java/com/kingsrook/qbits/authentik/client/AuthentikApiSurface.java create mode 100644 src/main/java/com/kingsrook/qbits/authentik/client/AuthentikFieldSpec.java create mode 100644 src/main/java/com/kingsrook/qbits/authentik/client/AuthentikFilterMapper.java create mode 100644 src/main/java/com/kingsrook/qbits/authentik/client/AuthentikJson.java create mode 100644 src/main/java/com/kingsrook/qbits/authentik/client/AuthentikRedactor.java create mode 100644 src/main/java/com/kingsrook/qbits/authentik/client/AuthentikTableSpec.java create mode 100644 src/main/java/com/kingsrook/qbits/authentik/client/AuthentikTables.java create mode 100644 src/main/java/com/kingsrook/qbits/authentik/client/TokenBucketThrottle.java create mode 100644 src/main/java/com/kingsrook/qbits/authentik/metadata/AbstractAuthentikTableProducer.java create mode 100644 src/main/java/com/kingsrook/qbits/authentik/metadata/AuthentikAppMetaDataProducer.java create mode 100644 src/main/java/com/kingsrook/qbits/authentik/metadata/AuthentikBackendMetaDataProducer.java create mode 100644 src/main/java/com/kingsrook/qbits/authentik/metadata/AuthentikGroupTableProducer.java create mode 100644 src/main/java/com/kingsrook/qbits/authentik/metadata/AuthentikUserTableProducer.java create mode 100644 src/main/java/com/kingsrook/qbits/authentik/security/AuthentikGuard.java create mode 100644 src/main/java/com/kingsrook/qbits/authentik/security/IdentityPermission.java create mode 100644 src/test/java/com/kingsrook/qbits/authentik/AuthentikQBitConfigTest.java create mode 100644 src/test/java/com/kingsrook/qbits/authentik/AuthentikQBitProducerTest.java create mode 100644 src/test/java/com/kingsrook/qbits/authentik/AuthentikTestSupport.java create mode 100644 src/test/java/com/kingsrook/qbits/authentik/RequiresDockerCondition.java create mode 100644 src/test/java/com/kingsrook/qbits/authentik/RequiresDockerConditionTest.java create mode 100644 src/test/java/com/kingsrook/qbits/authentik/SchemaDriftTest.java create mode 100644 src/test/java/com/kingsrook/qbits/authentik/client/AuthentikActionUtilTest.java create mode 100644 src/test/java/com/kingsrook/qbits/authentik/client/AuthentikFilterMapperTest.java create mode 100644 src/test/java/com/kingsrook/qbits/authentik/client/AuthentikRedactorTest.java create mode 100644 src/test/java/com/kingsrook/qbits/authentik/client/FixtureActionUtil.java create mode 100644 src/test/java/com/kingsrook/qbits/authentik/client/TokenBucketThrottleTest.java create mode 100644 src/test/java/com/kingsrook/qbits/authentik/contract/AccessCheckIT.java create mode 100644 src/test/java/com/kingsrook/qbits/authentik/contract/AuthentikTestStack.java create mode 100644 src/test/java/com/kingsrook/qbits/authentik/contract/BlueprintReapplyIT.java create mode 100644 src/test/java/com/kingsrook/qbits/authentik/contract/BootstrapBlueprintIT.java create mode 100644 src/test/java/com/kingsrook/qbits/authentik/contract/FixtureRecorder.java create mode 100644 src/test/java/com/kingsrook/qbits/authentik/contract/QbitReadContractIT.java create mode 100644 src/test/java/com/kingsrook/qbits/authentik/contract/SchemaDriftIT.java create mode 100644 src/test/java/com/kingsrook/qbits/authentik/contract/SignInPolicyIT.java create mode 100644 src/test/java/com/kingsrook/qbits/authentik/contract/SuperuserFloorIT.java create mode 100644 src/test/java/com/kingsrook/qbits/authentik/contract/TestApi.java create mode 100644 src/test/resources/authentik/schema-2026.8.3.yml create mode 100644 src/test/resources/blueprints/kof22-identity-bootstrap.yaml create mode 100644 src/test/resources/blueprints/kof22-oauth2-apps.yaml create mode 100644 src/test/resources/fixtures/2026.8.3/admin-version.json create mode 100644 src/test/resources/fixtures/2026.8.3/error-400-bad-filter.json create mode 100644 src/test/resources/fixtures/2026.8.3/error-403.json create mode 100644 src/test/resources/fixtures/2026.8.3/groups-list.json create mode 100644 src/test/resources/fixtures/2026.8.3/user-get.json create mode 100644 src/test/resources/fixtures/2026.8.3/users-list.json create mode 100644 src/test/resources/junit-platform.properties create mode 100644 src/test/resources/log4j2-test.xml diff --git a/.github/workflows/schema-drift.yml b/.github/workflows/schema-drift.yml new file mode 100644 index 0000000..c42c95a --- /dev/null +++ b/.github/workflows/schema-drift.yml @@ -0,0 +1,42 @@ +# Weekly: does the newest Authentik release still have every operation and +# query parameter qbit-authentik uses? Downloads the release's schema.yml from +# goauthentik/authentik and runs SchemaDriftTest against it (no Docker, no +# credentials). A failure means: review the release notes before upgrading. +name: authentik-schema-drift + +on: + schedule: + - cron: "17 6 * * 1" + workflow_dispatch: + inputs: + version: + description: "Authentik version (e.g. 2026.10.0); empty = latest release" + required: false + +permissions: + contents: read + +jobs: + drift: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: actions/setup-java@v4 + with: + distribution: temurin + java-version: "21" + cache: maven + - name: Resolve version and fetch its schema + env: + GH_TOKEN: ${{ github.token }} + INPUT_VERSION: ${{ inputs.version }} + run: | + version="${INPUT_VERSION}" + if [ -z "$version" ]; then + version=$(gh release view --repo goauthentik/authentik --json tagName -q .tagName | sed 's#^version/##') + fi + echo "Authentik $version" + curl -fsSL "https://raw.githubusercontent.com/goauthentik/authentik/version/${version}/schema.yml" -o "$RUNNER_TEMP/schema.yml" + echo "SCHEMA=$RUNNER_TEMP/schema.yml" >> "$GITHUB_ENV" + - name: Drift test + run: ./mvnw -B -q test -Dtest=SchemaDriftTest -Dsurefire.failIfNoSpecifiedTests=false -Dauthentik.schema.file="$SCHEMA" diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..91e4bb2 --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,10 @@ +# Changelog + +All notable changes to this project are documented here. Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). + +## [Unreleased] + +### Added +- Phase 0 foundations: `AuthentikQBitConfig`, `AuthentikQBitProducer`, `AuthentikActionUtil` (bearer auth, page/page_size paging, filter mapping that rejects unsupported filters, 10 rps token-bucket throttle, log redaction), read-only Users and Groups tables, Identity app. +- Pinned Authentik 2026.8.3 OpenAPI schema and schema drift tests. +- Testcontainers contract tests against Authentik 2026.8.3 (bootstrap on an empty instance, superuser floor, blueprint re-apply safety, access-check behaviour) and a fixture recorder. diff --git a/docs/PHASE0-OWNER-CHECKLIST.md b/docs/PHASE0-OWNER-CHECKLIST.md new file mode 100644 index 0000000..a1b91aa --- /dev/null +++ b/docs/PHASE0-OWNER-CHECKLIST.md @@ -0,0 +1,103 @@ +# Phase 0 owner checklist (kof22) + +These are the steps only James can take: items 6, 7, 8 and 10 of DESIGN.md section 11.0, plus a few decisions the phase 0 work surfaced. Agents prepared everything else. Nothing below has been run against production. + +Links: +- cluster-gitops draft PR: KofTwentyTwo/cluster-gitops#72 (the identity bootstrap blueprint, the removal of the `present` entries, the attribute-driven sign-in policy, inert webhook plumbing, and the blueprint lint) +- Website-Backend and cluster-gitops wiring draft PRs: see `docs/STATUS.md` +- Spec: QRun-IO/qqq#1065 (revision 3 records the phase 0 findings) + +## 0. Decisions surfaced by phase 0 (read first) + +| # | Decision | Recommendation | +|---|---|---| +| D1 | **Repo visibility.** `QRun-IO/qbit-authentik` was created **private**, because creating a public repo was blocked for the agent. Other generic qbits (quick-search, sql-workbench) are public, and the spec is already public in qqq#1065. CI publishes `develop` snapshots and `release/*` RCs to Maven Central / Sonatype (with sources jars), which would make the code public anyway. | Make it public before the first publish: *Settings → General → Change visibility*. Then check that CircleCI follows the repo (it must, for PR CI). | +| D2 | **Lockout risk.** Authentik stops the service account from *escalating*, but not from *locking out*. With the phase 2/3 permissions it can do all of the following (contract test `SuperuserFloorIT`): remove members from `authentik Admins`, deactivate `kof22-breakglass`, strip `qqq.io/protected`, and rename the superuser group. The qbit guard refuses all of these; Authentik does not. | Accept, with the mitigations in the spec (§5.1, revision 3). The real break-glass for a compromised QQQ is cluster access: `kubectl exec` into the Authentik worker and run `ak shell` to reactivate or re-add. Optionally, phase 2 grants `remove_user_from_group` per group (object permissions) instead of globally. | +| D3 | **Self-minted tokens.** Any authenticated user, including the service account, can create API tokens **for itself** without `add_token`, and read their keys. A compromised QQQ could therefore keep a second token alive after you rotate the first. | Accept. The phase 1 drift report flags service-account tokens beyond the expected one. Check that list after every rotation (item 8). | +| D4 | **Access matrix.** `check_access?for_user=` only works for superusers. For the service account it silently answers *for itself*. The policy-test endpoint returns HTTP 500 for non-superusers on 2026.8.3. | Accepted in the spec: the qbit computes app access itself from `qqq.io/app-access` and the app's bindings, and shows other expression policies as "not evaluated". | + +## Item 6: staging rehearsal (needs your go-ahead) + +The agent cannot read production data. The rehearsal runs entirely in local Docker, on a dump you take. + +1. **Take a dump** of the Authentik database. This is a read-only `pg_dump` of the CNPG cluster that hosts it: + ```bash + # CNPG cluster kof22-website-pg (namespace kof22-website-prod) hosts the database "authentik" + P=$(kubectl --context=k8s-galaxy -n kof22-website-prod get pod -l cnpg.io/cluster=kof22-website-pg,cnpg.io/instanceRole=primary -o name) + kubectl --context=k8s-galaxy -n kof22-website-prod exec "$P" -c postgres -- \ + pg_dump -Fc -d authentik > authentik-$(date +%F).dump + ``` + Keep the dump on an encrypted disk. It contains every identity and password hash. Delete it after the rehearsal. +2. **Get both blueprint versions**: + ```bash + git -C cluster-gitops show origin/main:tenants/kof22/website-authentik/blueprint-configmap.yaml > before.yaml + git -C cluster-gitops show origin/feat/kof22-identity-bootstrap:tenants/kof22/website-authentik/blueprint-configmap.yaml > after.yaml + ``` +3. **Run** `docs/cluster-gitops-phase0/rehearse-phase0.sh authentik-.dump before.yaml after.yaml`. + - The script restores the dump into a throwaway Postgres and starts Authentik 2026.8.3 on the current blueprints. It then records every user's groups, switches to the phase 0 blueprints, re-applies both twice, and checks: + - nobody's memberships changed + - `james.maes` keeps `authentik Admins` and `kof22-admins` + - the service account, break-glass and seed groups exist + - It prints `REHEARSAL PASSED` or the differences. + - Containers and the work directory are removed on exit. The script mints a rehearsal-only API token **inside the throwaway copy**, which is deleted with the container. +4. Reply "rehearsal passed" (or paste the output) on cluster-gitops#72. + +## Item 7: production apply + +Do these in order, in one sitting. + +1. **Freeze.** Record the current memberships: *Authentik admin → Directory → Users*, or export each admin group's member list. Note who is in `authentik Admins`, `kof22-admins` and `kof-website-publishers`. +2. **Merge** cluster-gitops#72 (convert it from draft first). ArgoCD syncs the ConfigMap, and the worker sees the file change and applies both blueprints within about a minute. +3. **Verify** in *Authentik admin → Customization → Blueprints*: + - [ ] `kof22-oauth2-apps` and `kof22-identity-bootstrap` both show **successful** + - [ ] `james.maes` still has `authentik Admins` and `kof22-admins` + - [ ] user `qqq-kof22-admin-idadmin` exists: type *Service account*, no groups, role `qqq-kof22-admin-idadmin` + - [ ] user `kof22-breakglass` exists and is a superuser + - [ ] groups `identity-admins`, `kof22-admins`, `kof-website-publishers`, `kof-website-drafters` exist; only `identity-admins` has attributes + - [ ] you can still sign in to `https://admin.kof22.com` (the name fallback in the sign-in policy keeps today's access) + - [ ] *Events → Notification rules*: `qqq-kof22-admin-sync` has **no destination** (inert) +4. **Prove it** (optional, recommended): add a test user to `kof-website-publishers` in the UI. Then *Blueprints → kof22-oauth2-apps → Apply* and the same for `kof22-identity-bootstrap`. Wait a minute and confirm the member is still there. Remove the test user afterwards. +5. **Rollback** if anything is wrong: revert the PR. This re-adds the old `present` entries, which re-pin James's groups. Logins keep working throughout because of the fallback. + +## Item 8: service-account token and secrets + +1. **Mint the API token**: + - In Authentik admin, go to *Directory → Tokens and App passwords → Create*. + - Identifier: `qqq-kof22-admin-idadmin-api`. User: `qqq-kof22-admin-idadmin`. Intent: **API**. Expiring: **on**, with an expiry **90 days** out. + - Copy the key once. +2. **Store it** in Infisical at `/kof22-website-authentik-api/token`. Paste it straight from the Authentik dialog into Infisical; it must never go in chat, git or a ticket. +3. **Webhook secret** (used in phase 2; create it now so the phase 2 PR can be merged directly): `openssl rand -base64 48` into Infisical at `/kof22-website-authentik/qqq-webhook-secret`. +4. **Check** that *Directory → Tokens* shows **exactly one** token for `qqq-kof22-admin-idadmin` (see D3). +5. **Calendar** a rotation reminder for day 76. The health widget will also warn 14 days before expiry. + +## Item 10: seed data (Authentik UI) + +1. Add **yourself** (`james.maes`) to **`identity-admins`**. +2. On group **`kof22-admins`** → *Attributes*, set the following. This is today's `ADMIN_PERMISSIONS` from Website-Backend `AuthentikAuthenticationCustomizer`, resolved to literal strings on 2026-10-11 against `origin/main` f936cbd. Re-check if that list changed before you seed, because the phase 1 mapper will grant exactly this: + ```yaml + qqq.io/app-access: ["kof22-website-prod"] + qqq.io/permissions: + - esbView.hasAccess + - esbOperate.hasAccess + - esbDelete.hasAccess + - analytics.hasAccess + - quickSearchAdmin.hasAccess + - quickSearchIndex.read + - quickSearchIndex.write + - quickSearchIndexRun.read + - quickSearchIndexRun.write + - quickSearchFailedEvent.read + - quickSearchFailedEvent.write + - dataHealth.hasAccess + ``` + Keep the existing attributes of the group. Add only these two keys. +3. On group **`kof-website-publishers`** → *Attributes*: `qqq.io/app-access: ["kof22-website-prod"]`. This keeps the `kof-publisher-prod` service account's client-credentials tokens working once the name fallback is removed. +4. **`kof-website-drafters`**: leave it without `qqq.io/app-access` until you decide that drafters should sign in to the admin. Granting it later is that one attribute. +5. **Break-glass password**: + - Set a long random password on `kof22-breakglass` (*Directory → Users → kof22-breakglass → Set password*) and store it in 1Password. + - Sign in with it once in a private window to prove it works, then sign out. + - Its recovery path is `ak create_recovery_key 10 kof22-breakglass` on the worker pod. + +## After items 6-10 + +Tell the agent "phase 0 owner steps done". Next come item 11 (the qbit in read-only mode on staging, behind `AUTHENTIK_QBIT_ENABLED`), then the phase 1 mapper cut-over, then removal of the sign-in name fallback. diff --git a/docs/STATUS.md b/docs/STATUS.md new file mode 100644 index 0000000..cd09732 --- /dev/null +++ b/docs/STATUS.md @@ -0,0 +1,23 @@ +# Status + +The Authentik qbit's progress through DESIGN.md section 11, with links. Updated with each PR. + +## Phase 0: foundations (agent items done; owner items open) + +| # | Item | State | Where | +|---|---|---|---| +| 1 | Repo, DESIGN.md, CI, README, CLAUDE.md | done | this repo (`develop`); private for now, see owner checklist D1 | +| 2 | Config, producer, `AuthentikActionUtil`, pinned schema + drift test | done | phase 0 PR | +| 3 | Testcontainers harness, fixture recorder, contract tests (b), (c), (d), (h) | done | phase 0 PR, `src/test/java/.../contract` | +| 4 | Open points (i)-(iv) resolved | done | DESIGN.md section 0.2; QRun-IO/qqq#1065 revision 3 | +| 5 | cluster-gitops PR (bootstrap, removals, sign-in policy, webhook, lint) | draft | KofTwentyTwo/cluster-gitops#72 | +| 6 | Staging rehearsal | **owner** | `docs/PHASE0-OWNER-CHECKLIST.md`, `docs/cluster-gitops-phase0/rehearse-phase0.sh` | +| 7 | Production apply | **owner** | checklist | +| 8 | Service-account token, Infisical, webhook secret | **owner** | checklist | +| 9 | Website-Backend wiring (ExternalSecret + env, qbit behind a disabled flag) | draft | KofTwentyTwo/cluster-gitops#73, Website-Backend draft PR | +| 10 | Seed attributes, break-glass password | **owner** | checklist | +| 11 | Read-only on staging | after 6-10 | flip `AUTHENTIK_QBIT_ENABLED` | + +## Contract test results (Authentik 2026.8.3) + +`CI=true ./mvnw verify`: 48 unit tests and 27 contract tests, all green; JaCoCo gate met. diff --git a/docs/cluster-gitops-phase0/README.md b/docs/cluster-gitops-phase0/README.md new file mode 100644 index 0000000..f6e0cdb --- /dev/null +++ b/docs/cluster-gitops-phase0/README.md @@ -0,0 +1,21 @@ +# cluster-gitops phase 0 support files + +The cluster-gitops changes themselves are in **KofTwentyTwo/cluster-gitops#72** (draft). That PR adds: +- the identity bootstrap blueprint +- the removal of the `present` `james.maes` and `kof22-admins` entries +- the attribute-driven sign-in policy +- the inert webhook plumbing +- the lint + +The blueprint YAML in that PR is generated from this repo's tested fixtures, `src/test/resources/blueprints/*.yaml`. That way, what goes to cluster-gitops is what the contract tests applied to Authentik 2026.8.3. + +| File | Purpose | +|---|---| +| `scripts/lint-authentik-blueprints.py` | The blueprint lint (also in cluster-gitops#72 under `scripts/`). It forbids `present` user/group entries, member lists, roles beyond `permissions`, tokens and literal secrets. `--self-test` runs the built-in cases. | +| `rehearse-phase0.sh` | Owner checklist item 6: replays the migration on a **local, disposable** Authentik restored from a dump you take, and checks that no membership moves. | + +To re-check the fixtures with the lint: + +```bash +python3 docs/cluster-gitops-phase0/scripts/lint-authentik-blueprints.py src/test/resources/blueprints +``` diff --git a/docs/cluster-gitops-phase0/rehearse-phase0.sh b/docs/cluster-gitops-phase0/rehearse-phase0.sh new file mode 100644 index 0000000..4344367 --- /dev/null +++ b/docs/cluster-gitops-phase0/rehearse-phase0.sh @@ -0,0 +1,108 @@ +#!/usr/bin/env bash +# Rehearse the phase 0 blueprint migration (DESIGN.md section 4.4, owner +# checklist item 6) on a DISPOSABLE local Authentik restored from a dump of the +# production Authentik database. Nothing here talks to production: you supply +# the dump file; everything runs in local Docker and is removed at the end. +# +# Usage: +# rehearse-phase0.sh +# +# authentik-db.dump pg_dump -Fc of the production Authentik database +# configmap-before.yaml tenants/kof22/website-authentik/blueprint-configmap.yaml at main +# configmap-after.yaml the same file on branch feat/kof22-identity-bootstrap +# +# Needs: docker, jq, python3 with PyYAML. Takes ~5 minutes. +set -euo pipefail + +DUMP=${1:?dump file}; BEFORE=${2:?configmap before}; AFTER=${3:?configmap after} +IMAGE=${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server:2026.8.3} +NET=ak-rehearsal; PORT=${PORT:-19900} +WORK=$(mktemp -d); BP="$WORK/blueprints"; mkdir -p "$BP" +ADMIN_TOKEN="rehearsal-$(openssl rand -hex 16)" +API="http://localhost:$PORT/api/v3" + +cleanup() { docker rm -f akr-server akr-worker akr-pg >/dev/null 2>&1 || true; docker network rm $NET >/dev/null 2>&1 || true; rm -rf "$WORK"; } +trap cleanup EXIT + +extract() { # write every blueprint key of a ConfigMap into $BP + rm -f "$BP"/*.yaml + python3 - "$1" "$BP" <<'PY' +import sys, yaml +doc = yaml.safe_load(open(sys.argv[1], encoding="utf-8")) +for key, value in doc["data"].items(): + open(f"{sys.argv[2]}/{key}", "w", encoding="utf-8").write(value) + print(" blueprint file:", key) +PY +} + +api() { curl -sf -H "Authorization: Bearer $ADMIN_TOKEN" "$API$1"; } +snapshot() { # users -> sorted groups, as TSV + api "/core/users/?page_size=100&include_groups=true&type=internal&type=external&type=service_account" \ + | jq -r '.results[] | [.username, ([.groups_obj[].name] | sort | join(","))] | @tsv' | sort +} +wait_blueprints() { + for _ in $(seq 1 90); do + states=$(api "/managed/blueprints/?page_size=100" | jq -r '[.results[] | select(.name|startswith("kof22")) | .status] | join(" ")' || true) + if [ -n "$states" ] && ! grep -qv successful <<<"$(tr ' ' '\n' <<<"$states")"; then echo " kof22 blueprints: $states"; return 0; fi + sleep 5 + done + echo " blueprints did not all reach successful: $states"; api "/managed/blueprints/?page_size=100" | jq -r '.results[] | "\(.name) \(.status)"'; return 1 +} + +echo "== 1. restore the dump into a disposable Postgres" +docker network create $NET >/dev/null +docker run -d --name akr-pg --network $NET -e POSTGRES_USER=authentik -e POSTGRES_PASSWORD=rehearsal -e POSTGRES_DB=authentik postgres:16-alpine >/dev/null +until docker exec akr-pg pg_isready -U authentik >/dev/null 2>&1; do sleep 1; done +docker cp "$DUMP" akr-pg:/tmp/authentik.dump +docker exec akr-pg pg_restore -U authentik -d authentik --no-owner --no-privileges /tmp/authentik.dump || true + +echo "== 2. start Authentik with the CURRENT (main) blueprints" +extract "$BEFORE" +ENV=(-e AUTHENTIK_SECRET_KEY="$(openssl rand -hex 32)" -e AUTHENTIK_POSTGRESQL__HOST=akr-pg -e AUTHENTIK_POSTGRESQL__USER=authentik + -e AUTHENTIK_POSTGRESQL__PASSWORD=rehearsal -e AUTHENTIK_POSTGRESQL__NAME=authentik -e AUTHENTIK_BOOTSTRAP_TOKEN="$ADMIN_TOKEN" + -e KOF22_OAUTH2_CLIENT_SECRET=rehearsal-not-the-real-secret -e AUTHENTIK_ERROR_REPORTING__ENABLED=false + -e AUTHENTIK_DISABLE_UPDATE_CHECK=true -e AUTHENTIK_EMAIL__HOST=localhost -e AUTHENTIK_EMAIL__PORT=1) +docker run -d --name akr-worker --network $NET "${ENV[@]}" -v "$BP:/blueprints/custom" "$IMAGE" worker >/dev/null +docker run -d --name akr-server --network $NET -p "$PORT:9000" "${ENV[@]}" -v "$BP:/blueprints/custom" "$IMAGE" server >/dev/null +until curl -sf "http://localhost:$PORT/-/health/ready/" >/dev/null; do sleep 3; done +# The bootstrap token only applies to an EMPTY instance; on a restored database +# create a rehearsal token for akadmin-equivalent access through the shell. +docker exec akr-worker ak shell -c " +from authentik.core.models import Token, TokenIntents, User +u = User.objects.filter(is_superuser=True, is_active=True).exclude(username__startswith='ak-').order_by('pk').first() +Token.objects.update_or_create(identifier='phase0-rehearsal', defaults={'user': u, 'intent': TokenIntents.INTENT_API, 'key': '$ADMIN_TOKEN', 'expiring': False}) +print('rehearsal token for', u.username)" 2>/dev/null | grep rehearsal +wait_blueprints +snapshot > "$WORK/before.tsv"; echo " $(wc -l < "$WORK/before.tsv") users recorded (step 1, freeze)" + +echo "== 3. switch to the phase 0 blueprints (as an ArgoCD sync would)" +extract "$AFTER" +docker restart akr-worker >/dev/null # a restart triggers discovery like a ConfigMap change +wait_blueprints +for name in kof22-oauth2-apps kof22-identity-bootstrap; do + pk=$(api "/managed/blueprints/?name=$name" | jq -r '.results[0].pk') + curl -sf -X POST -H "Authorization: Bearer $ADMIN_TOKEN" "$API/managed/blueprints/$pk/apply/" >/dev/null +done +sleep 30; wait_blueprints + +echo "== 4. checks" +snapshot > "$WORK/after.tsv" +fail=0 +if ! diff <(grep -v -E '^(qqq-kof22-admin-idadmin|kof22-breakglass)\b' "$WORK/after.tsv") "$WORK/before.tsv" >/dev/null; then + echo " FAIL memberships changed:"; diff "$WORK/before.tsv" "$WORK/after.tsv" || true; fail=1 +else echo " ok existing users' memberships unchanged"; fi +grep -q $'^james.maes\t.*authentik Admins.*kof22-admins' "$WORK/after.tsv" && echo " ok james.maes keeps authentik Admins + kof22-admins" || { echo " FAIL james.maes groups"; fail=1; } +api "/core/users/?username=qqq-kof22-admin-idadmin&include_roles=true" | jq -e '.results[0] | .type=="service_account" and (.groups|length)==0 and ([.roles_obj[].name]==["qqq-kof22-admin-idadmin"])' >/dev/null \ + && echo " ok service account: type, no groups, role" || { echo " FAIL service account"; fail=1; } +api "/core/users/?username=kof22-breakglass" | jq -e '.results[0].is_superuser' >/dev/null && echo " ok break-glass superuser" || { echo " FAIL break-glass"; fail=1; } +for g in identity-admins kof22-admins kof-website-publishers kof-website-drafters; do + api "/core/groups/?name=$g" | jq -e '.pagination.count==1' >/dev/null && echo " ok group $g" || { echo " FAIL group $g"; fail=1; } +done +echo "== 5. re-apply both again (an hourly run): memberships must not move" +for name in kof22-oauth2-apps kof22-identity-bootstrap; do + pk=$(api "/managed/blueprints/?name=$name" | jq -r '.results[0].pk') + curl -sf -X POST -H "Authorization: Bearer $ADMIN_TOKEN" "$API/managed/blueprints/$pk/apply/" >/dev/null +done +sleep 30; wait_blueprints +snapshot | diff - "$WORK/after.tsv" >/dev/null && echo " ok stable across re-apply" || { echo " FAIL changed on re-apply"; fail=1; } +[ $fail = 0 ] && echo "REHEARSAL PASSED" || { echo "REHEARSAL FAILED"; exit 1; } diff --git a/docs/cluster-gitops-phase0/scripts/__pycache__/lint-authentik-blueprints.cpython-314.pyc b/docs/cluster-gitops-phase0/scripts/__pycache__/lint-authentik-blueprints.cpython-314.pyc new file mode 100644 index 0000000000000000000000000000000000000000..f0114b733cd732af319c1feb9de026394438e5fd GIT binary patch literal 16474 zcmch8dr(_fn&-XJ73c*LPus+X3;2O-5H==u4Do{)><}>E3zpjnL>7_&#X^$rmHbeW zYPK`AgS&escxQS;rcxWG*E=D*y*2LLsV#R+*N%6RsmWB$R>?*&^leY2tGcVU`me?9 zxYNn(AN%{x)x8oJ$JyE0Jrw7jd+vFB=R4o|o=1C1OY9ud=goir+B-Wq?w9nUr&6uJ zKm0E|$IWmOm*igMB)*q_(UdgRQQ6dMPMX(C5v+3ij&2XAX)aBlGeSP zv}>AA+VE_`(=HWDR@6JHxOz^qZQ>+*yGffZ>11^d)H%nBhiY_S^3Qg2u4SoIf>x!Q zxTrhn8Y>;D&$rP_l55PRk6g!%6|u41=vAiIw&$8A%cOGDSFq8_rAm~mSh+%~MtKt} zS4x{v-onaNQcbd2dPed{TczF7HffJkD>X|+Qj1h4c_mS5Z7oi2lIqdEfwkW(HKM$o zmA8!5NIRbU7RQB}Ic_UACJY_WAB^k*G*rjh-7 z_6DXb9M>O-CB?2(aw;54MlOis(Ns7gqfQZ(xEK)Sa7!SOh+Y+gftVNzUkb~pLY@>O zA?lI5Dux2dfY)v}#@MCgM-d~_iMX6(y;_vOrLZENSCWBbxI;|HVFe?c7m>*ke2B+H z8u_ZoCbTzA#Zz+hYO@%Kh4SAfBGIrIoC?Gy!yfI^bRc%MB^hs_rx-{kWkqaCDPdV@ z7ANI+Dxoyn69E~MphAvE!-_}5t0?sh^>-cb>24Nd@uWB%mM6m@uh^x7CDIULT-L^5 zFai|32kg_~>2Z9EMwDc;2)xPRi8uyS09h;vOr>I>IF=I*MS#TVKqxFmV$`kx%V&CN zC{&+5ecIl1aXgZ22^d?@-80;Ka=<$s5|wZ;8HvXfvCZ4oEVg^w7%tkq&vuHzIItE7 zCdFh}Ns3J&j|W>IrLa7)DI5q+iI*brXn=Z)5e19Fj)p^GKoJRn9fb0$9ay!Z1c1m6 zyC_QgMA3l3AH<5h3n#BuYkZCf0A&i-W(Fiu$uXW0; zCAVL|<+-j?{bDjO33~BPdd2#l*d-4maJD_2>$jbaX>5BQIkW?TXf%GA$cq(0h`q5y zD%m0SrEpMUVUVbJJRX~fOr8oPfcjWu0z^xM%8onn5Ajj}j0Y&h5Yc%2f`a39A&kRj z@FODQ;8ZwxAsoU12Hq3V01i<8I}x_x70(bwci6GqC}=)^tXhngiZ^jpJki_V;~$j# z-My06>jmjHis38RyM4rJjI*OWZJ3r8B^;e-VTX{NfJRYHX{UWW6^SNW0AetpgcZAo zR~>;Eu*D9gGJtm*tvndTR;DZRv}zo^uPWD7GU`_?Y$sGl0THPJ(O^*H^je-1nfyaY z5eVopF3Cekn_k_WG)sI^kW3IbW+reflCX(O7D*O}>at0+Z?Pp=cl&o{C39 z;B{bdbfUWS1C=KpB?Vpswo>00zB)M3EY_ch5WAKcJ$Zv9eR2|rBaqB^eYll@GDB#~5Fzm7&!r{AC3 zv9RB-x`7pMVNDAFQ7YJ4zTixjXC6>Cf1EuYqM8e0Wk$-a-uAE-RWsaKcg*;7R*dO5 zf+p3-eaH`dXp)`yu3Ff+@R(JB=#16LoA5!Qp?B`wDZ8na)$fnQB1r)0)PU697=Sd) z47XBI{eA07Rm~sTWrCRP3!W^|Q24h!>_B0L^KnC3{hHhf$nYgcR)wEBOir%Nj9ueZ zUX-ix=|f)Lj0fAPJcKgziadnc+dgXc3^G7iUj0tf^`^O+`F-;v@4x)+%kK_kTzfLs zJq%zr?tsTiOC?&zKz6@>Iv#?=qe1=ti>W{~_r>M+Pef!TiOmhi;`m(b_k$Mvet8R~ zl4%3fD!-p(PbBCkZXX#>;RvGv>9yK~gjm_8XS-2QT*&?<_cLMOk$|24t(CVlYi+4n z5dTKXZ72VbG_iuy_pE;Uk`{?jCaA6#bcL%w4pl);?;Q?IgtfB94g@)k$s*>G>nUrXtdX+qltFpt)~{?A)lv2={uStfSlK@a9ol-Re$CM> zLIp^Ke@NpIiEMOqB{Qk?Qc)|dtXOuSsah1(R^_@Hn2vh$OH=KD-LIr3CL&kl5^5>L z;-PTb#@Y>_$N={6G9g_%^NiNzGQ6|w5PhKK&TwCF#eCBP%I1%*(&LtyJ#HUjm26RK z4kN9Xt)~V%HN%bO_KV|urcr~$hXk}*mvqyBFhnVY)3lWiMzQu@nEOn+(w#7$I{Ab- ztc5+a@?&#U<>nxau1h|X1hea44ra_#0ays1>(csmql8wLB$JOP8KEbiS)ZR6@d!?} z5DJGADqoM&XOAe67|u;B7*++^D%Cy={u_{K$5c0zQgG{35IP5|Rh`4(i>WYLv+v~v z-*fe9S-x%>dVeG~$qt=IkUfA%rgJCnp^R}o+7WO)QDb|hP*e2@K~6FmN{lLG6lS>l z#btBb-xJ<wTDLuv*!=&e>^;Z$H#iGm`xZdOr%fHA$1D@(WfCEB zCuQ4^6-of`V9*Abahb6ONK;nTPfdwQX;NU%^*wXj=EoN*KdAZBng!?L3yaA=f8)b9 z7GoLL;f(dLhGt^a1K=_up6i&N3jSZ9X@RRBrbaZudM-%jvrO3u{3|58exLh=)Ad&0 zilg+cmsU#LZ}tCH;4MeAIjP}44_mZANeW+4&CpO8%5cUa!K7LQP%_t1NUP}mCU-iSkz7V0w%k@#Gfbk~cU(@Q!pJ!Ky?_+TN2 zmCQa4v?@GdEf&2$+7$WB$cx*wGv&}6850q>4ALf8O@*kSW$mZKOJFo$;WOL_cLKzB z8R(SDeLOoJOar>Y%~xI>dkz*h>a(vO=6R3fxZ-u%A|g)yvI|dnkU0axfQSSajFwu zi$`Lr1-9n2!e|g&xQo8BQ%y$%AIa;(h6fwYf$u1QSsp<%Mw%B9nW>o{Hdk# z-OJ^BGv#|1$7lNP_Y7u+UdfIHmV3tU_KeSVzukMS_fA#U;w#H7NA9#7$+jF@s_M!* zyRuUkGSSORQ&(nsR!S=7dgcz!H_V@T|J=Lh7A`MsYt3xkdy~Jp}d^ z&M0Amk-Es>d9v!#Y63H}FttVFWh6%BZe(A%$k+3V!MDbqdNzINrD(d}7uB<{8dQN6er_AD>rD9y?-?6_T!pQ5#G+`+i(K5{F6TUrVM=@K;{XVU4NBvTVl zV2~swdrW=XwG#0hPnB9sq6EPJc>pU&?_mN<^Yp@78-PnM=Le0$QOiOSs3spyIHX#b zFIg?lxpdQe*!wr_%zVCSGrZtw(de_@oh>#^!rOU1ec-&OQ+HPzF40_A^BVQ;`Jx(}*^Z>#&)8 zsql7^=Xv@`K?VR*=v_2C;pqd?eq#;f8fQLn<^~Ui;grN2=L=knaCT3`5!n#sLE4%1 zu1V&TOnaqv&G(GB2gL=ncoDWJH)4o@%==-}PPEsz^nAMhd?!U+nCFl@h)Nhirlc58 zB^78LA{=-gS6*9@Ny$(JlFX_t97`dBgOCF=9)aRSA{+}b&7LVFs;jrVXJDjvL9?Am$P zwex4r$`yCjJGSe#`CUuy1~PK1=ECm{FFWe*I_g)P)yvLpcbwbai!2uXh2vJw(%#-o z-<74>t668duTJgd&;XYpWc0fe)DQcy8SEkmKrtrq4O9BxJ%MnabT+$L__{Eo-** z*zL2Kp)=W@GiwH;ZlkQ*80+?`*3FZ3coxIi&cUpA@P6f{dCMQYl&$alw6b%y=Q9`3 zRIoYfhjN>e{cz0_4qVoqT1{6i6inJ4@BOiWQ0 z)+x%WkR(EeWdx7Flbv>N;=7?3+xf-^9I^!{#&|3S+1ulaG5N?EInMI%cYswh!bVZ0 zrHx$D^{{A1X+13E{bLZ2pF%*IMvL`t@b?)WI9<8ZMSf0zLYza`88)Zh6CNAGzbBcQ z5PyfM7X@Q)*h|orf+x=$k~L*R5()+PMk;Q54jfJNGo!S1I^ z<(wgH%Nf%4^o!>r;b=%~(wtrt`jiz!9Szp#(c)BEh#R8wxDj)t@KwH@_d`UJG#9%n zT!1S^wHZy}iGgJO%9_(dI?`6eC@I|Aq4JILx3JCuk4@f-r)nkNwjZ%i=0{&AnPh07 zT+Xvi?O<8bO63@3layVcjC4`veP?W6WBAp^f)s>x{Cd1pzKXW&{QMLJvj2Zox%r(_ z|LWAj_8)zFx$@|&m3Vp6jqYWa=dQ~`4B1if_Vd@CpD$W+)Gc&o9p1m_xHa`x(Vs*= zIk0p@%8q<%dH=b)`_HY^?p(O^X{~p;w*5|R`@Px&*X?uW`xV>f!#9SPD?Hf>&*E#h zdhU6-WoGEX}IvXCAaaG6oFPQ`5J1;aG@8JL1BT(MP^3GP2KWcR#|Gzfj zRSN>}Q_5F1X1c@8IL1tQnIz{^xzu-QS9J5eg3NbhbCFegEDW-@JpV*nmWV?z{<#3T z9B?uNp7(J$ng5e`4$S$&lT+x8%MGxRL7ew+>0BuUXC{o8Tp##a3}fD?;&28H-h}z< zVWb1HxKr-&nK$yb`JDS<W8;s&c?JS-uL;nppVSctcZq$fAAd--iEr1~c z926B8NIcTBD~0rR_iki8HT4`!*NAiXb<&GI7ax5 zu$?zBM-a7_ibfpZ${V;cwjsiwa2$2?-3F&+r3fG4G#EU^YuudVF4|AB|Bq34o;Mtw zptXx-8~TO~`ZCrF3WHe*X_7?h6boRm1KVbyS>n!mDmDd05VG0EQs zkZHktbvlXwDmZmWxg1GOsiwH13Uun_(`bN*L@ypHA5#T69#7^xt}|K`kwOmYHl|rK zKCywTbq-AwV)VabzSgb5pY+_k__r_rx0f?R|#zP2k4ag~)pKnP!*)5!~EXQR8QA*{1 zfqMBn^wAPgLJ?UNE(f9))FS9sWYCNUu9_8A+~s5%l)QcL+QGLEUpqWsx$LOD>!`iou>FHw zKisvr{m)vim(B@u0kTA#*PU5H{LK=DTGrf+HI$$OPAJ~VT?`}v0@TvfvZ7gtuj+Mwyp zUsPZ;%<_+)mvRulN3I|FoZ~TGp#t80v+>r}+hJH22Tv_E3@p0`@45&7an(%izEZXW zHGeIZ9q+V#WcGHK3LkYkx*a7Smsa(Z6o1@U*JCaI8>gs$<2%HQ7caJ4d6Ru+4iJ1Ou=zX0SMuYt zYe|)9V``JU&)X>04G#b;?K1Uv~&EUFvqQDs{6@*$g zl3?{*K7f+9;quyyF3A$S&xo6bwvcp0@QH6W^do3QTt1d5nZ0N~$Uj>|w`f{<0UE<7 zg@jlda_Ob~Q`d!{(fkKZqe+;^0!*0Ww!CZiX*XJM$zG3#n!k26!l+xHyOTdHyu^i| zM^P-;XM^@=W!j^V*B(y*_I0`eG)DwRZKo<(fYg4<4Lx2`02n+(~dCWS$lHZxLSMqI72+*|744C_%%`>eM)(1UP zLc)@;CW^liUSG)J^$7O#|2tgk_iPec^iwFlOz#6q2W@CcD#spk%%8$EN~z+Mz`PHY z&~b@{Ac5u#+R|v_RcPO@!by~ZzD+wB(Mmb&t$*`W{hEeRg~@n4BqvZzZ#~h~+b`04 z-cKM-L<5ufSwIK*g%fEr*ll|AlLWHL+t;Yn*icQSCZ9opN{vGUl^S*H(-4-sJ`Edc zc1|tM86R{@lx`QuKr#o7xDyZ64xuk6nJ%1De&s%@7i9Wb0FAy=EL4BD(v?y_U0vQl z`~3vX+3gZd`z=5G z_TM4C!DL>+CXlbZKr^D(C+Q`5;ZChK(uW|;*K8sojoC%VP%x~bN^ld{%dj3%yFQWP zoZBo|dF(`jHnpoDXKtA z5L()9TxRc3O@n=Dhd2?4L{oCON%0`c5halJQg#KIS~}d*f5MNj$%y~t;9xiNg2C-V zKQ&QH^50(Q>SoR`)r=qLXjhxaljX6i*4*fd{4NbzOd0HU*gh=Oq*1Re$h>&C9H{b& z%8$$c1}&J0MVrV{&i=3&^ejUja<{47FLUOH%RTereaDvhoj10B;Q68FM*|-p%{B}# zIYwr>KPz^uSlx47e^3GsnzbZT+MKZ-TTI@y9=lbI?0#MIa$Vbb`|jHLHW-6`aS45L>1YiXEHv2Ch%JJ=!Hj& z9PS*w@Z;poi=T7cC7uNxaAU*tTY7uRlu2CtPi5#x|L#Bk zuwQVTv)}X^maoP6p{%vzzF?beUa&59-6(lixH)z6UI zFMm_QJvYdIiAyp7_e%|Gr5v06(ca3FyDC54S9`MA{x^qfPwp>Wqka-Y#(92fd_yR> z2&4)DdGeC{2D)nQ!*8UGE)nJF?n67@Kw*uB*{c-fXqX>nZ;!hV$pyo}yN?2C#}en| znHYpmh3cz`XpbrFDEQe-x+MQ|8)7pSc6jA~i!rp@ z>pwtAHRHE+5NgoKG)IPN%ZFHL)o@2>P6%NdzY3Cnj4HMZuc83&L$PD7WcJ(H;@bPJ z&EI=HW3Bnj;lf$}{^a*df97)EFMDRbd#S8`=B1xk)y>-QVK#Ely7_^bs}_GH*uFnJ zSMxo8#<^{NEMwo36`DVD*AP9{FYw6NPSVd3Xkx#=U7HMK>YT__GeaiUb<~8*;JFX551!s_a`nP6SQ;h`Y&>Zmm1q2h zM<(Tm`9Gm;UsY5G>3;0Takve{4inQn0@P}pvI)vUlo2z+4-t&t&1mts15{fT2!;I9 zsc15i|E)mIFUl^4XgUq)Bg|zf|By;IC?geu@ex@>NfqeVfg1lI_W?Wg8pp9d59~q1 zJ|cgF4|MvKYUFVD@%#f}GcP=9=lI57a<-py_J82&f5|z1QPGsyeJoSnHRDn@J)hw! z)zbbM$4c#DeCH!8e%-QK$?@)GZpR&N z$3k%NNS5n>Q`F@6!c@c`S>=$yd1-R2((9vg-2Z;$#I@5$13Y5vk7^LYT5YZ<7iLOV zn>kBmrpmV>ltZno8ZfO0Whhj>fI<}tn~$U5$dpX22$guFacY&vV+vLY1!{)^vv@!H5-BmJIhzU>FiOC@#p1QG01s9|{f->|=d A_y7O^ literal 0 HcmV?d00001 diff --git a/docs/cluster-gitops-phase0/scripts/lint-authentik-blueprints.py b/docs/cluster-gitops-phase0/scripts/lint-authentik-blueprints.py new file mode 100644 index 0000000..665de43 --- /dev/null +++ b/docs/cluster-gitops-phase0/scripts/lint-authentik-blueprints.py @@ -0,0 +1,225 @@ +#!/usr/bin/env python3 +"""Lint Authentik blueprints so a re-apply can never revert identity data. + +Authentik's blueprint importer re-saves `state: present` entries on every apply +(hourly, and on every file change), and many-to-many attrs (users, groups, +parents, roles) are REPLACED, not merged. A present user or group entry, or a +member list, therefore silently undoes edits made in the Authentik UI or in QQQ +(qbit-authentik DESIGN.md sections 2.2, 4.2 and 4.5; contract test (d)). + +Rules (each violation is printed as file:entry: message): + R1 authentik_core.user / authentik_core.group entries must be + `state: created`, `must_created` or `absent` (no state means present). + R2 no member lists: a group entry must not carry `users`. + R3 an `authentik_rbac.role` entry may be `present` only if its attrs are + limited to `permissions` (and `name`): the qbit role pattern, whose + global permissions are re-asserted additively. + R4 no literal secrets: password, password_hash, key, token, client_secret + must be a YAML tag (e.g. !Env) or absent; authentik_core.token entries are + not allowed at all. + +Input: Kubernetes ConfigMap manifests (every data value that looks like a +blueprint is checked) and plain blueprint files. Usage: + + lint-authentik-blueprints.py FILE_OR_DIR... # exit 1 on violations + lint-authentik-blueprints.py --self-test # run the built-in cases +""" + +from __future__ import annotations + +import os +import sys +from dataclasses import dataclass + +import yaml + +IDENTITY_MODELS = {"authentik_core.user", "authentik_core.group"} +SAFE_IDENTITY_STATES = {"created", "must_created", "absent"} +SECRET_KEYS = {"password", "password_hash", "key", "token", "client_secret"} +ROLE_PRESENT_ALLOWED_ATTRS = {"permissions", "name"} + + +class Tag: + """Placeholder for an Authentik YAML tag such as !KeyOf, !Find or !Env.""" + + def __init__(self, tag: str, value): + self.tag = tag + self.value = value + + def __repr__(self): + return f"{self.tag} {self.value!r}" + + +class BlueprintLoader(yaml.SafeLoader): + """SafeLoader that accepts Authentik's custom tags.""" + + +def _construct_tag(loader: yaml.SafeLoader, tag_suffix: str, node: yaml.Node): + if isinstance(node, yaml.ScalarNode): + value = loader.construct_scalar(node) + elif isinstance(node, yaml.SequenceNode): + value = loader.construct_sequence(node, deep=True) + else: + value = loader.construct_mapping(node, deep=True) + return Tag("!" + tag_suffix, value) + + +BlueprintLoader.add_multi_constructor("!", _construct_tag) + + +@dataclass +class Violation: + source: str + entry: str + message: str + + def __str__(self): + return f"{self.source}: {self.entry}: {self.message}" + + +def entry_label(index: int, entry: dict) -> str: + identifiers = entry.get("identifiers") or {} + ident = ", ".join(f"{k}={v}" for k, v in identifiers.items()) if isinstance(identifiers, dict) else str(identifiers) + return f"entry {index} ({entry.get('model')} {ident})" + + +def lint_blueprint(source: str, document) -> list[Violation]: + violations: list[Violation] = [] + if not isinstance(document, dict) or not isinstance(document.get("entries"), list): + return violations + + for index, entry in enumerate(document["entries"]): + if not isinstance(entry, dict): + continue + model = entry.get("model") + if isinstance(model, Tag): + violations.append(Violation(source, entry_label(index, entry), "model must be a literal so it can be linted")) + continue + state = entry.get("state", "present") + if isinstance(state, Tag): + violations.append(Violation(source, entry_label(index, entry), "state must be a literal so it can be linted")) + continue + attrs = entry.get("attrs") or {} + label = entry_label(index, entry) + + if model in IDENTITY_MODELS and state not in SAFE_IDENTITY_STATES: + violations.append(Violation(source, label, f"R1 {model} must be `state: created` (got `{state}`); present entries revert UI/QQQ edits on every apply")) + + if model == "authentik_core.group" and state != "absent" and "users" in attrs: + violations.append(Violation(source, label, "R2 member list (`users:`) on a group; memberships are data, manage them in the Authentik UI or QQQ")) + + if model == "authentik_rbac.role" and state not in SAFE_IDENTITY_STATES: + extra = set(attrs) - ROLE_PRESENT_ALLOWED_ATTRS + if extra: + violations.append(Violation(source, label, f"R3 present role may only declare `permissions` (found {sorted(extra)})")) + + if model == "authentik_core.token": + violations.append(Violation(source, label, "R4 tokens must never be declared in blueprints")) + + for key in SECRET_KEYS: + if key in attrs and attrs[key] is not None and not isinstance(attrs[key], Tag): + violations.append(Violation(source, label, f"R4 literal `{key}`; use !Env or set it outside git")) + return violations + + +def blueprints_in_manifest(source: str, text: str): + """Yield (source, parsed blueprint) for a file: a ConfigMap or a blueprint.""" + for document in yaml.load_all(text, Loader=BlueprintLoader): + if not isinstance(document, dict): + continue + if document.get("kind") == "ConfigMap" and isinstance(document.get("data"), dict): + for key, value in document["data"].items(): + if isinstance(value, str) and "entries:" in value and "version:" in value: + yield f"{source}#{key}", yaml.load(value, Loader=BlueprintLoader) + elif "entries" in document: + yield source, document + + +def lint_paths(paths: list[str]) -> list[Violation]: + violations: list[Violation] = [] + for path in paths: + files = [] + if os.path.isdir(path): + for root, _, names in os.walk(path): + files.extend(os.path.join(root, n) for n in names if n.endswith((".yaml", ".yml"))) + else: + files.append(path) + for file in sorted(files): + with open(file, encoding="utf-8") as handle: + text = handle.read() + if "entries:" not in text: + continue + try: + for source, blueprint in blueprints_in_manifest(file, text): + violations.extend(lint_blueprint(source, blueprint)) + except yaml.YAMLError as error: + violations.append(Violation(file, "-", f"YAML error: {error}")) + return violations + + +SELF_TEST_GOOD = """ +version: 1 +entries: + - model: authentik_rbac.role + state: present + identifiers: {name: qqq-x} + attrs: {permissions: [authentik_core.view_user]} + - model: authentik_core.user + state: created + identifiers: {username: sa} + attrs: {type: service_account, roles: [!KeyOf r], groups: [!Find [authentik_core.group, [name, x]]]} + - model: authentik_core.group + state: created + identifiers: {name: g} + attrs: {attributes: {qqq.io/permissions: [a]}} + - model: authentik_providers_oauth2.oauth2provider + state: present + identifiers: {name: p} + attrs: {client_secret: !Env SECRET} +""" + +SELF_TEST_BAD = { + "present group": ("model: authentik_core.group\n identifiers: {name: g}", "R1"), + "present user": ("model: authentik_core.user\n state: present\n identifiers: {username: u}\n attrs: {groups: [!KeyOf g]}", "R1"), + "member list": ("model: authentik_core.group\n state: created\n identifiers: {name: g}\n attrs: {users: [1]}", "R2"), + "role with users": ("model: authentik_rbac.role\n identifiers: {name: r}\n attrs: {permissions: [a], users: [1]}", "R3"), + "token": ("model: authentik_core.token\n state: created\n identifiers: {identifier: t}", "R4"), + "literal secret": ("model: authentik_providers_oauth2.oauth2provider\n identifiers: {name: p}\n attrs: {client_secret: hunter2}", "R4"), + "literal password": ("model: authentik_core.user\n state: created\n identifiers: {username: u}\n attrs: {password: hunter2}", "R4"), +} + + +def self_test() -> int: + failures = 0 + good = lint_blueprint("good", yaml.load(SELF_TEST_GOOD, Loader=BlueprintLoader)) + if good: + failures += 1 + print("FAIL good blueprint flagged:", *good, sep="\n ") + for name, (entry, rule) in SELF_TEST_BAD.items(): + found = lint_blueprint(name, yaml.load(f"version: 1\nentries:\n - {entry}\n", Loader=BlueprintLoader)) + if not any(v.message.startswith(rule) for v in found): + failures += 1 + print(f"FAIL {name}: expected {rule}, got {[str(v) for v in found]}") + configmap = "apiVersion: v1\nkind: ConfigMap\nmetadata: {name: x}\ndata:\n bad.yaml: |\n version: 1\n entries:\n - model: authentik_core.group\n identifiers: {name: g}\n" + if not any("#bad.yaml" in v.source for v in [v for s, b in blueprints_in_manifest("cm.yaml", configmap) for v in lint_blueprint(s, b)]): + failures += 1 + print("FAIL ConfigMap data values are not linted") + print("self-test:", "OK" if failures == 0 else f"{failures} failure(s)") + return 1 if failures else 0 + + +def main(argv: list[str]) -> int: + if argv == ["--self-test"]: + return self_test() + if not argv: + print(__doc__) + return 2 + violations = lint_paths(argv) + for violation in violations: + print(violation) + print(f"{len(violations)} violation(s)") + return 1 if violations else 0 + + +if __name__ == "__main__": + sys.exit(main(sys.argv[1:])) diff --git a/src/main/java/com/kingsrook/qbits/authentik/AuthentikFeature.java b/src/main/java/com/kingsrook/qbits/authentik/AuthentikFeature.java new file mode 100644 index 0000000..02f6c10 --- /dev/null +++ b/src/main/java/com/kingsrook/qbits/authentik/AuthentikFeature.java @@ -0,0 +1,58 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik; + + +/******************************************************************************* + ** Features a host can turn on (DESIGN.md section 3.2). A feature that is off + ** produces no metadata, and the guard refuses its operations. + *******************************************************************************/ +public enum AuthentikFeature +{ + /** Read-only tables: users, groups, memberships, roles, applications, bindings, blueprints, sessions, events. */ + READ, + + /** Create, invite, edit, deactivate users (phase 3). */ + USERS, + + /** Create and edit groups, permissions and app-access attributes (phase 2/3). */ + GROUPS, + + /** Add and remove members (phase 2). */ + MEMBERSHIP, + + /** Recovery email, MFA reset, app-password revoke (phase 3). */ + CREDENTIALS, + + /** Revoke sessions (phase 3). */ + SESSIONS, + + /** Authentik RBAC role management (phase 4). */ + RBAC, + + /** Access matrix widget. */ + ACCESS_MATRIX, + + /** Local mirror tables (phase 1+). */ + MIRROR, + + /** Inbound Authentik webhook (phase 2). */ + WEBHOOK, + + /** Nightly read-only snapshot export (phase 3). */ + SNAPSHOT_EXPORT +} diff --git a/src/main/java/com/kingsrook/qbits/authentik/AuthentikQBitConfig.java b/src/main/java/com/kingsrook/qbits/authentik/AuthentikQBitConfig.java new file mode 100644 index 0000000..9df6b45 --- /dev/null +++ b/src/main/java/com/kingsrook/qbits/authentik/AuthentikQBitConfig.java @@ -0,0 +1,925 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik; + + +import java.net.URI; +import java.util.ArrayList; +import java.util.EnumSet; +import java.util.LinkedHashSet; +import java.util.List; +import java.util.Set; +import java.util.regex.Pattern; +import com.fasterxml.jackson.annotation.JsonIgnore; +import com.kingsrook.qqq.backend.core.instances.QMetaDataVariableInterpreter; +import com.kingsrook.qqq.backend.core.model.metadata.QInstance; +import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitConfig; +import com.kingsrook.qqq.backend.core.utils.StringUtils; + + +/******************************************************************************* + ** Host-facing configuration of the Authentik QBit (DESIGN.md section 3.2). + ** + ** Secrets (apiToken, webhookSecret) may be given as ${env.NAME} references; + ** the qbit resolves them itself (APIBackendMetaData.enrich() is disabled in + ** QQQ), never serializes them, and redacts them in toString(). + ** + ** validate() is list-based and never throws; the producer fails production + ** with all collected errors. + *******************************************************************************/ +public class AuthentikQBitConfig implements QBitConfig +{ + /** Features implemented in this release. Others are refused by validate(). */ + public static final Set AVAILABLE_FEATURES = EnumSet.of(AuthentikFeature.READ, AuthentikFeature.MIRROR); + + private static final Pattern APP_KEY_PATTERN = Pattern.compile("[a-z0-9][a-z0-9-]{0,48}[a-z0-9]"); + private static final Pattern PREFIX_PATTERN = Pattern.compile("[a-zA-Z][a-zA-Z0-9]{0,30}"); + + private String baseUrl; + private String apiToken; + private String appKey; + private String tableNamePrefix = "authentik"; + private Set features = EnumSet.of(AuthentikFeature.READ); + private Boolean readOnly = false; + private String serviceAccountUsername; + private String userScopePathStartsWith; + private List userScopeGroupNames = new ArrayList<>(); + private String groupScopeNamePrefix; + private List protectedUsernames = new ArrayList<>(); + private String bootstrapOperators = "${env.AUTHENTIK_QBIT_BOOTSTRAP_OPERATORS}"; + private List applicationsInScope = new ArrayList<>(); + private String mirrorBackendName; + private String recoveryEmailStage; + private String invitationFlow; + private String newUserPath = "users"; + private String webhookSecret = "${env.AUTHENTIK_WEBHOOK_SECRET}"; + private Integer throttleRequestsPerSecond = 10; + private Integer throttleBurst = 20; + private Integer bulkPacingMillis = 100; + private Integer listCacheTtlSeconds = 30; + private Integer groupCacheTtlSeconds = 60; + private Integer connectTimeoutMillis = 5_000; + private Integer socketTimeoutMillis = 30_000; + private String expectedServerVersion = "2026.8"; + + + + /******************************************************************************* + ** Collect configuration errors. Never throws; null-safe for a partially + ** built QInstance. + *******************************************************************************/ + @Override + public void validate(QInstance qInstance, List errors) + { + if(!StringUtils.hasContent(baseUrl)) + { + errors.add("baseUrl is required (the Authentik host root, e.g. https://auth.example.com)"); + } + else + { + try + { + URI uri = URI.create(baseUrl); + if(uri.getScheme() == null || !(uri.getScheme().equals("https") || uri.getScheme().equals("http")) || uri.getHost() == null) + { + errors.add("baseUrl must be an absolute http(s) URL: " + baseUrl); + } + else if(uri.getPath() != null && uri.getPath().contains("/api/v3")) + { + errors.add("baseUrl must be the host root; /api/v3 is appended by the qbit: " + baseUrl); + } + } + catch(IllegalArgumentException e) + { + errors.add("baseUrl is not a valid URL: " + baseUrl); + } + } + + if(!StringUtils.hasContent(getResolvedApiToken())) + { + errors.add("apiToken is required (usually ${env.AUTHENTIK_API_TOKEN}) and resolved to an empty value"); + } + + if(!StringUtils.hasContent(appKey) || !APP_KEY_PATTERN.matcher(appKey).matches()) + { + errors.add("appKey is required: lower-case letters, digits and dashes, e.g. kof22-admin"); + } + + if(tableNamePrefix != null && !tableNamePrefix.isEmpty() && !PREFIX_PATTERN.matcher(tableNamePrefix).matches()) + { + errors.add("tableNamePrefix must start with a letter and contain only letters and digits: " + tableNamePrefix); + } + + Set requested = features == null ? EnumSet.noneOf(AuthentikFeature.class) : features; + if(!requested.contains(AuthentikFeature.READ)) + { + errors.add("feature READ is required"); + } + for(AuthentikFeature feature : requested) + { + if(!AVAILABLE_FEATURES.contains(feature)) + { + errors.add("feature " + feature + " is not available in this release of qbit-authentik (available: " + AVAILABLE_FEATURES + ")"); + } + } + + if(requested.contains(AuthentikFeature.MIRROR)) + { + if(!StringUtils.hasContent(mirrorBackendName)) + { + errors.add("feature MIRROR needs mirrorBackendName (an RDBMS backend of the instance)"); + } + else if(qInstance != null && qInstance.getBackends() != null && qInstance.getBackend(mirrorBackendName) == null) + { + errors.add("mirrorBackendName: backend not found: " + mirrorBackendName); + } + } + + if((requested.contains(AuthentikFeature.USERS) || requested.contains(AuthentikFeature.CREDENTIALS)) && !StringUtils.hasContent(recoveryEmailStage)) + { + errors.add("features USERS and CREDENTIALS need recoveryEmailStage"); + } + + if(requested.contains(AuthentikFeature.WEBHOOK) && !StringUtils.hasContent(getResolvedWebhookSecret())) + { + errors.add("feature WEBHOOK needs webhookSecret"); + } + + for(Integer value : new Integer[] { throttleRequestsPerSecond, throttleBurst, listCacheTtlSeconds, groupCacheTtlSeconds, connectTimeoutMillis, socketTimeoutMillis }) + { + if(value == null || value < 0) + { + errors.add("throttle, cache and timeout settings must be non-negative numbers"); + break; + } + } + if(throttleRequestsPerSecond != null && throttleRequestsPerSecond == 0) + { + errors.add("throttleRequestsPerSecond must be at least 1"); + } + } + + + + /******************************************************************************* + ** Prefix a component name with the tableNamePrefix (camel-cased join). + *******************************************************************************/ + public String applyPrefix(String name) + { + if(!StringUtils.hasContent(tableNamePrefix)) + { + return (name); + } + return (tableNamePrefix + Character.toUpperCase(name.charAt(0)) + name.substring(1)); + } + + + + /******************************************************************************* + ** Name of the API backend the qbit produces. + *******************************************************************************/ + @JsonIgnore + public String getApiBackendName() + { + return (applyPrefix("api")); + } + + + + /******************************************************************************* + ** The API root: baseUrl without a trailing slash, plus /api/v3. + *******************************************************************************/ + @JsonIgnore + public String getApiRoot() + { + String root = baseUrl == null ? "" : baseUrl.trim(); + while(root.endsWith("/")) + { + root = root.substring(0, root.length() - 1); + } + return (root + "/api/v3"); + } + + + + /******************************************************************************* + ** The service account's username: explicit, or qqq-{appKey}-idadmin. + *******************************************************************************/ + @JsonIgnore + public String getEffectiveServiceAccountUsername() + { + return (StringUtils.hasContent(serviceAccountUsername) ? serviceAccountUsername : "qqq-" + appKey + "-idadmin"); + } + + + + /******************************************************************************* + ** The API token with ${env.X} / ${prop.X} references resolved. + *******************************************************************************/ + @JsonIgnore + public String getResolvedApiToken() + { + return (resolve(apiToken)); + } + + + + /******************************************************************************* + ** The webhook secret with references resolved. + *******************************************************************************/ + @JsonIgnore + public String getResolvedWebhookSecret() + { + return (resolve(webhookSecret)); + } + + + + /******************************************************************************* + ** Bootstrap operator emails, resolved and split on commas, lower-cased. + *******************************************************************************/ + @JsonIgnore + public Set getResolvedBootstrapOperators() + { + Set rs = new LinkedHashSet<>(); + String resolved = resolve(bootstrapOperators); + if(StringUtils.hasContent(resolved)) + { + for(String part : resolved.split(",")) + { + if(StringUtils.hasContent(part)) + { + rs.add(part.trim().toLowerCase()); + } + } + } + return (rs); + } + + + + /******************************************************************************* + ** Whether a feature is enabled. + *******************************************************************************/ + public boolean hasFeature(AuthentikFeature feature) + { + return (features != null && features.contains(feature)); + } + + + + /******************************************************************************* + ** Resolve ${env.X} style references; a reference to an unset variable + ** resolves to null rather than to its literal text. + *******************************************************************************/ + static String resolve(String value) + { + if(value == null) + { + return (null); + } + String resolved = new QMetaDataVariableInterpreter().interpret(value); + if(resolved != null && resolved.startsWith("${") && resolved.endsWith("}")) + { + return (null); + } + return (resolved); + } + + + + /******************************************************************************* + ** Never print secrets. + *******************************************************************************/ + @Override + public String toString() + { + return ("AuthentikQBitConfig{baseUrl=" + baseUrl + ", appKey=" + appKey + ", tableNamePrefix=" + tableNamePrefix + + ", features=" + features + ", readOnly=" + readOnly + ", apiToken=" + (StringUtils.hasContent(apiToken) ? "******" : "(unset)") + "}"); + } + + + + /******************************************************************************* + ** Getter for baseUrl + *******************************************************************************/ + public String getBaseUrl() + { + return (this.baseUrl); + } + + + + /******************************************************************************* + ** Setter for baseUrl + *******************************************************************************/ + public void setBaseUrl(String baseUrl) + { + this.baseUrl = baseUrl; + } + + + + /******************************************************************************* + ** Fluent setter for baseUrl + *******************************************************************************/ + public AuthentikQBitConfig withBaseUrl(String baseUrl) + { + this.baseUrl = baseUrl; + return (this); + } + + + + /******************************************************************************* + ** Getter for apiToken (the raw, possibly ${env.X}, value). Never serialized. + *******************************************************************************/ + @JsonIgnore + public String getApiToken() + { + return (this.apiToken); + } + + + + /******************************************************************************* + ** Setter for apiToken + *******************************************************************************/ + public void setApiToken(String apiToken) + { + this.apiToken = apiToken; + } + + + + /******************************************************************************* + ** Fluent setter for apiToken + *******************************************************************************/ + public AuthentikQBitConfig withApiToken(String apiToken) + { + this.apiToken = apiToken; + return (this); + } + + + + /******************************************************************************* + ** Getter for appKey + *******************************************************************************/ + public String getAppKey() + { + return (this.appKey); + } + + + + /******************************************************************************* + ** Setter for appKey + *******************************************************************************/ + public void setAppKey(String appKey) + { + this.appKey = appKey; + } + + + + /******************************************************************************* + ** Fluent setter for appKey + *******************************************************************************/ + public AuthentikQBitConfig withAppKey(String appKey) + { + this.appKey = appKey; + return (this); + } + + + + /******************************************************************************* + ** Getter for tableNamePrefix + *******************************************************************************/ + public String getTableNamePrefix() + { + return (this.tableNamePrefix); + } + + + + /******************************************************************************* + ** Setter for tableNamePrefix + *******************************************************************************/ + public void setTableNamePrefix(String tableNamePrefix) + { + this.tableNamePrefix = tableNamePrefix; + } + + + + /******************************************************************************* + ** Fluent setter for tableNamePrefix + *******************************************************************************/ + public AuthentikQBitConfig withTableNamePrefix(String tableNamePrefix) + { + this.tableNamePrefix = tableNamePrefix; + return (this); + } + + + + /******************************************************************************* + ** Getter for features + *******************************************************************************/ + public Set getFeatures() + { + return (this.features); + } + + + + /******************************************************************************* + ** Setter for features + *******************************************************************************/ + public void setFeatures(Set features) + { + this.features = features; + } + + + + /******************************************************************************* + ** Fluent setter for features + *******************************************************************************/ + public AuthentikQBitConfig withFeatures(Set features) + { + this.features = features; + return (this); + } + + + + /******************************************************************************* + ** Getter for readOnly + *******************************************************************************/ + public Boolean getReadOnly() + { + return (this.readOnly); + } + + + + /******************************************************************************* + ** Setter for readOnly + *******************************************************************************/ + public void setReadOnly(Boolean readOnly) + { + this.readOnly = readOnly; + } + + + + /******************************************************************************* + ** Fluent setter for readOnly + *******************************************************************************/ + public AuthentikQBitConfig withReadOnly(Boolean readOnly) + { + this.readOnly = readOnly; + return (this); + } + + + + /******************************************************************************* + ** Getter for serviceAccountUsername + *******************************************************************************/ + public String getServiceAccountUsername() + { + return (this.serviceAccountUsername); + } + + + + /******************************************************************************* + ** Fluent setter for serviceAccountUsername + *******************************************************************************/ + public AuthentikQBitConfig withServiceAccountUsername(String serviceAccountUsername) + { + this.serviceAccountUsername = serviceAccountUsername; + return (this); + } + + + + /******************************************************************************* + ** Getter for userScopePathStartsWith + *******************************************************************************/ + public String getUserScopePathStartsWith() + { + return (this.userScopePathStartsWith); + } + + + + /******************************************************************************* + ** Fluent setter for userScopePathStartsWith + *******************************************************************************/ + public AuthentikQBitConfig withUserScopePathStartsWith(String userScopePathStartsWith) + { + this.userScopePathStartsWith = userScopePathStartsWith; + return (this); + } + + + + /******************************************************************************* + ** Getter for userScopeGroupNames + *******************************************************************************/ + public List getUserScopeGroupNames() + { + return (this.userScopeGroupNames); + } + + + + /******************************************************************************* + ** Fluent setter for userScopeGroupNames + *******************************************************************************/ + public AuthentikQBitConfig withUserScopeGroupNames(List userScopeGroupNames) + { + this.userScopeGroupNames = userScopeGroupNames; + return (this); + } + + + + /******************************************************************************* + ** Getter for groupScopeNamePrefix + *******************************************************************************/ + public String getGroupScopeNamePrefix() + { + return (this.groupScopeNamePrefix); + } + + + + /******************************************************************************* + ** Fluent setter for groupScopeNamePrefix + *******************************************************************************/ + public AuthentikQBitConfig withGroupScopeNamePrefix(String groupScopeNamePrefix) + { + this.groupScopeNamePrefix = groupScopeNamePrefix; + return (this); + } + + + + /******************************************************************************* + ** Getter for protectedUsernames + *******************************************************************************/ + public List getProtectedUsernames() + { + return (this.protectedUsernames); + } + + + + /******************************************************************************* + ** Fluent setter for protectedUsernames + *******************************************************************************/ + public AuthentikQBitConfig withProtectedUsernames(List protectedUsernames) + { + this.protectedUsernames = protectedUsernames; + return (this); + } + + + + /******************************************************************************* + ** Getter for bootstrapOperators (raw value) + *******************************************************************************/ + public String getBootstrapOperators() + { + return (this.bootstrapOperators); + } + + + + /******************************************************************************* + ** Fluent setter for bootstrapOperators (comma-separated emails or ${env.X}) + *******************************************************************************/ + public AuthentikQBitConfig withBootstrapOperators(String bootstrapOperators) + { + this.bootstrapOperators = bootstrapOperators; + return (this); + } + + + + /******************************************************************************* + ** Getter for applicationsInScope + *******************************************************************************/ + public List getApplicationsInScope() + { + return (this.applicationsInScope); + } + + + + /******************************************************************************* + ** Fluent setter for applicationsInScope. Explicit slugs are required: + ** Authentik lists to a non-superuser only the applications that user can + ** itself access, so the qbit cannot discover them (phase 0 finding). + *******************************************************************************/ + public AuthentikQBitConfig withApplicationsInScope(List applicationsInScope) + { + this.applicationsInScope = applicationsInScope; + return (this); + } + + + + /******************************************************************************* + ** Getter for mirrorBackendName + *******************************************************************************/ + public String getMirrorBackendName() + { + return (this.mirrorBackendName); + } + + + + /******************************************************************************* + ** Fluent setter for mirrorBackendName + *******************************************************************************/ + public AuthentikQBitConfig withMirrorBackendName(String mirrorBackendName) + { + this.mirrorBackendName = mirrorBackendName; + return (this); + } + + + + /******************************************************************************* + ** Getter for recoveryEmailStage + *******************************************************************************/ + public String getRecoveryEmailStage() + { + return (this.recoveryEmailStage); + } + + + + /******************************************************************************* + ** Fluent setter for recoveryEmailStage + *******************************************************************************/ + public AuthentikQBitConfig withRecoveryEmailStage(String recoveryEmailStage) + { + this.recoveryEmailStage = recoveryEmailStage; + return (this); + } + + + + /******************************************************************************* + ** Getter for invitationFlow + *******************************************************************************/ + public String getInvitationFlow() + { + return (this.invitationFlow); + } + + + + /******************************************************************************* + ** Fluent setter for invitationFlow + *******************************************************************************/ + public AuthentikQBitConfig withInvitationFlow(String invitationFlow) + { + this.invitationFlow = invitationFlow; + return (this); + } + + + + /******************************************************************************* + ** Getter for newUserPath + *******************************************************************************/ + public String getNewUserPath() + { + return (this.newUserPath); + } + + + + /******************************************************************************* + ** Fluent setter for newUserPath + *******************************************************************************/ + public AuthentikQBitConfig withNewUserPath(String newUserPath) + { + this.newUserPath = newUserPath; + return (this); + } + + + + /******************************************************************************* + ** Getter for webhookSecret (raw value). Never serialized. + *******************************************************************************/ + @JsonIgnore + public String getWebhookSecret() + { + return (this.webhookSecret); + } + + + + /******************************************************************************* + ** Fluent setter for webhookSecret + *******************************************************************************/ + public AuthentikQBitConfig withWebhookSecret(String webhookSecret) + { + this.webhookSecret = webhookSecret; + return (this); + } + + + + /******************************************************************************* + ** Getter for throttleRequestsPerSecond + *******************************************************************************/ + public Integer getThrottleRequestsPerSecond() + { + return (this.throttleRequestsPerSecond); + } + + + + /******************************************************************************* + ** Fluent setter for throttleRequestsPerSecond + *******************************************************************************/ + public AuthentikQBitConfig withThrottleRequestsPerSecond(Integer throttleRequestsPerSecond) + { + this.throttleRequestsPerSecond = throttleRequestsPerSecond; + return (this); + } + + + + /******************************************************************************* + ** Getter for throttleBurst + *******************************************************************************/ + public Integer getThrottleBurst() + { + return (this.throttleBurst); + } + + + + /******************************************************************************* + ** Fluent setter for throttleBurst + *******************************************************************************/ + public AuthentikQBitConfig withThrottleBurst(Integer throttleBurst) + { + this.throttleBurst = throttleBurst; + return (this); + } + + + + /******************************************************************************* + ** Getter for bulkPacingMillis + *******************************************************************************/ + public Integer getBulkPacingMillis() + { + return (this.bulkPacingMillis); + } + + + + /******************************************************************************* + ** Fluent setter for bulkPacingMillis + *******************************************************************************/ + public AuthentikQBitConfig withBulkPacingMillis(Integer bulkPacingMillis) + { + this.bulkPacingMillis = bulkPacingMillis; + return (this); + } + + + + /******************************************************************************* + ** Getter for listCacheTtlSeconds + *******************************************************************************/ + public Integer getListCacheTtlSeconds() + { + return (this.listCacheTtlSeconds); + } + + + + /******************************************************************************* + ** Fluent setter for listCacheTtlSeconds (0 disables the list cache) + *******************************************************************************/ + public AuthentikQBitConfig withListCacheTtlSeconds(Integer listCacheTtlSeconds) + { + this.listCacheTtlSeconds = listCacheTtlSeconds; + return (this); + } + + + + /******************************************************************************* + ** Getter for groupCacheTtlSeconds + *******************************************************************************/ + public Integer getGroupCacheTtlSeconds() + { + return (this.groupCacheTtlSeconds); + } + + + + /******************************************************************************* + ** Fluent setter for groupCacheTtlSeconds (0 disables the group cache) + *******************************************************************************/ + public AuthentikQBitConfig withGroupCacheTtlSeconds(Integer groupCacheTtlSeconds) + { + this.groupCacheTtlSeconds = groupCacheTtlSeconds; + return (this); + } + + + + /******************************************************************************* + ** Getter for connectTimeoutMillis + *******************************************************************************/ + public Integer getConnectTimeoutMillis() + { + return (this.connectTimeoutMillis); + } + + + + /******************************************************************************* + ** Fluent setter for connectTimeoutMillis + *******************************************************************************/ + public AuthentikQBitConfig withConnectTimeoutMillis(Integer connectTimeoutMillis) + { + this.connectTimeoutMillis = connectTimeoutMillis; + return (this); + } + + + + /******************************************************************************* + ** Getter for socketTimeoutMillis + *******************************************************************************/ + public Integer getSocketTimeoutMillis() + { + return (this.socketTimeoutMillis); + } + + + + /******************************************************************************* + ** Fluent setter for socketTimeoutMillis + *******************************************************************************/ + public AuthentikQBitConfig withSocketTimeoutMillis(Integer socketTimeoutMillis) + { + this.socketTimeoutMillis = socketTimeoutMillis; + return (this); + } + + + + /******************************************************************************* + ** Getter for expectedServerVersion + *******************************************************************************/ + public String getExpectedServerVersion() + { + return (this.expectedServerVersion); + } + + + + /******************************************************************************* + ** Fluent setter for expectedServerVersion (major.minor, e.g. 2026.8) + *******************************************************************************/ + public AuthentikQBitConfig withExpectedServerVersion(String expectedServerVersion) + { + this.expectedServerVersion = expectedServerVersion; + return (this); + } + +} diff --git a/src/main/java/com/kingsrook/qbits/authentik/AuthentikQBitProducer.java b/src/main/java/com/kingsrook/qbits/authentik/AuthentikQBitProducer.java new file mode 100644 index 0000000..ee46b7e --- /dev/null +++ b/src/main/java/com/kingsrook/qbits/authentik/AuthentikQBitProducer.java @@ -0,0 +1,223 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik; + + +import java.io.InputStream; +import java.util.ArrayList; +import java.util.List; +import java.util.Properties; +import com.kingsrook.qbits.authentik.metadata.AuthentikAppMetaDataProducer; +import com.kingsrook.qqq.backend.core.exceptions.QException; +import com.kingsrook.qqq.backend.core.logging.QLogger; +import com.kingsrook.qqq.backend.core.model.metadata.MetaDataProducerMultiOutput; +import com.kingsrook.qqq.backend.core.model.metadata.QInstance; +import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitMetaData; +import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitMetaDataProducer; +import com.kingsrook.qqq.backend.core.utils.StringUtils; +import static com.kingsrook.qqq.backend.core.logging.LogUtils.logPair; + + +/******************************************************************************* + ** Entry point of the Authentik QBit (QQQ 4.1 QBitMetaDataProducer). + ** + ** produce() validates the config, registers the AuthentikRuntime for the API + ** backend, then lets QQQ run the component producers in the metadata package + ** (API backend, read-only tables, the Identity app). + ** + ** Host usage: + ** new AuthentikQBitProducer().withQBitConfig(config).produce(qInstance); + *******************************************************************************/ +public class AuthentikQBitProducer implements QBitMetaDataProducer +{ + private static final QLogger LOG = QLogger.getLogger(AuthentikQBitProducer.class); + + public static final String GROUP_ID = "com.kingsrook.qbits"; + public static final String ARTIFACT_ID = "authentik"; + + private static final String VERSION = loadVersion(); + + private AuthentikQBitConfig qBitConfig; + private String namespace; + + + + /******************************************************************************* + ** Fluent setter for the config. + *******************************************************************************/ + public AuthentikQBitProducer withQBitConfig(AuthentikQBitConfig config) + { + this.qBitConfig = config; + return (this); + } + + + + /******************************************************************************* + ** Setter for the config. + *******************************************************************************/ + public void setQBitConfig(AuthentikQBitConfig config) + { + this.qBitConfig = config; + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @Override + public AuthentikQBitConfig getQBitConfig() + { + return (this.qBitConfig); + } + + + + /******************************************************************************* + ** Namespace for this QBit instance; also the default tableNamePrefix. + *******************************************************************************/ + public AuthentikQBitProducer withNamespace(String namespace) + { + this.namespace = namespace; + return (this); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @Override + public String getNamespace() + { + return (this.namespace); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @Override + public QBitMetaData getQBitMetaData() + { + return (new QBitMetaData() + .withGroupId(GROUP_ID) + .withArtifactId(ARTIFACT_ID) + .withVersion(VERSION) + .withNamespace(getNamespace()) + .withConfig(getQBitConfig())); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @Override + public String getPackageNameForFindingMetaDataProducers() + { + return (AuthentikAppMetaDataProducer.class.getPackageName()); + } + + + + /******************************************************************************* + ** A producer found by package scanning has no config; skip it. + *******************************************************************************/ + @Override + public boolean isEnabled() + { + return (qBitConfig != null); + } + + + + /******************************************************************************* + ** Validate, register the runtime, produce and add everything to the + ** instance. Returns an empty output so a host that also calls + ** addSelfToInstance on the result adds nothing twice. + *******************************************************************************/ + @Override + public MetaDataProducerMultiOutput produce(QInstance qInstance) throws QException + { + if(qBitConfig == null) + { + throw (new QException("AuthentikQBit configuration validation failed: no config was supplied (call withQBitConfig)")); + } + + if(StringUtils.hasContent(namespace) && !StringUtils.hasContent(qBitConfig.getTableNamePrefix())) + { + qBitConfig.setTableNamePrefix(namespace); + } + + List errors = new ArrayList<>(); + qBitConfig.validate(qInstance, errors); + if(!errors.isEmpty()) + { + throw (new QException("AuthentikQBit configuration validation failed: " + String.join("; ", errors))); + } + + AuthentikRuntime.register(new AuthentikRuntime(qBitConfig)); + + MetaDataProducerMultiOutput output = QBitMetaDataProducer.super.produce(qInstance); + output.addSelfToInstance(qInstance); + + LOG.info("Authentik QBit produced", logPair("version", VERSION), logPair("appKey", qBitConfig.getAppKey()), + logPair("features", qBitConfig.getFeatures()), logPair("readOnly", qBitConfig.getReadOnly())); + return (new MetaDataProducerMultiOutput()); + } + + + + /******************************************************************************* + ** The artifact version, from the Maven-filtered qbit-authentik.properties. + *******************************************************************************/ + static String loadVersion() + { + try(InputStream inputStream = AuthentikQBitProducer.class.getClassLoader().getResourceAsStream("qbit-authentik.properties")) + { + if(inputStream != null) + { + Properties properties = new Properties(); + properties.load(inputStream); + String version = properties.getProperty("version"); + if(StringUtils.hasContent(version) && !version.contains("${")) + { + return (version); + } + } + } + catch(Exception e) + { + LOG.debug("Could not read qbit-authentik.properties", e); + } + return ("unknown"); + } + + + + /******************************************************************************* + ** Getter for the artifact version. + *******************************************************************************/ + public static String getVersion() + { + return (VERSION); + } + +} diff --git a/src/main/java/com/kingsrook/qbits/authentik/AuthentikRuntime.java b/src/main/java/com/kingsrook/qbits/authentik/AuthentikRuntime.java new file mode 100644 index 0000000..9f72990 --- /dev/null +++ b/src/main/java/com/kingsrook/qbits/authentik/AuthentikRuntime.java @@ -0,0 +1,177 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik; + + +import java.time.Duration; +import java.util.Map; +import java.util.concurrent.ConcurrentHashMap; +import com.kingsrook.qbits.authentik.client.AuthentikFilterMapper; +import com.kingsrook.qbits.authentik.client.AuthentikTableSpec; +import com.kingsrook.qbits.authentik.client.TokenBucketThrottle; +import com.kingsrook.qbits.authentik.security.AuthentikGuard; +import com.kingsrook.qqq.backend.core.utils.memoization.Memoization; + + +/******************************************************************************* + ** Live state of one qbit instance: config, throttle, guard, filter mapper, + ** response cache, and the table-name to spec map. Registered by API backend + ** name, because AuthentikActionUtil is instantiated by QQQ (QCodeLoader) with + ** no constructor arguments and finds its runtime from the backend it serves. + *******************************************************************************/ +public class AuthentikRuntime +{ + private static final Map BY_BACKEND = new ConcurrentHashMap<>(); + + private final AuthentikQBitConfig config; + private final TokenBucketThrottle throttle; + private final AuthentikGuard guard; + private final AuthentikFilterMapper filterMapper = new AuthentikFilterMapper(); + private final Memoization responseCache; + private final Map specsByTableName = new ConcurrentHashMap<>(); + + + + /******************************************************************************* + ** Constructor. + *******************************************************************************/ + public AuthentikRuntime(AuthentikQBitConfig config) + { + this.config = config; + this.throttle = new TokenBucketThrottle(config.getThrottleRequestsPerSecond(), config.getThrottleBurst()); + this.guard = new AuthentikGuard(config); + this.responseCache = new Memoization(Duration.ofSeconds(config.getListCacheTtlSeconds())).withMaxSize(500); + } + + + + /******************************************************************************* + ** Register a runtime for its config's API backend (replacing any previous). + *******************************************************************************/ + public static AuthentikRuntime register(AuthentikRuntime runtime) + { + BY_BACKEND.put(runtime.config.getApiBackendName(), runtime); + return (runtime); + } + + + + /******************************************************************************* + ** Find the runtime for an API backend name. + *******************************************************************************/ + public static AuthentikRuntime forBackend(String backendName) + { + AuthentikRuntime runtime = BY_BACKEND.get(backendName); + if(runtime == null) + { + throw (new IllegalStateException("No Authentik qbit runtime is registered for backend " + backendName + " (was the qbit produced?)")); + } + return (runtime); + } + + + + /******************************************************************************* + ** Associate a produced (prefixed) table name with its spec. + *******************************************************************************/ + public void registerTable(String tableName, AuthentikTableSpec spec) + { + specsByTableName.put(tableName, spec); + } + + + + /******************************************************************************* + ** The spec for a produced table name, or null. + *******************************************************************************/ + public AuthentikTableSpec getSpec(String tableName) + { + return (specsByTableName.get(tableName)); + } + + + + /******************************************************************************* + ** Whether responses should be cached at all. + *******************************************************************************/ + public boolean isCacheEnabled() + { + return (config.getListCacheTtlSeconds() != null && config.getListCacheTtlSeconds() > 0); + } + + + + /******************************************************************************* + ** Drop every cached response (after writes, or when a webhook arrives). + *******************************************************************************/ + public void invalidateCache() + { + responseCache.clear(); + } + + + + /******************************************************************************* + ** Getter for config + *******************************************************************************/ + public AuthentikQBitConfig getConfig() + { + return (config); + } + + + + /******************************************************************************* + ** Getter for throttle + *******************************************************************************/ + public TokenBucketThrottle getThrottle() + { + return (throttle); + } + + + + /******************************************************************************* + ** Getter for guard + *******************************************************************************/ + public AuthentikGuard getGuard() + { + return (guard); + } + + + + /******************************************************************************* + ** Getter for filterMapper + *******************************************************************************/ + public AuthentikFilterMapper getFilterMapper() + { + return (filterMapper); + } + + + + /******************************************************************************* + ** Getter for responseCache (session-independent: the API always runs as + ** the service account; permission filtering happens after the cache). + *******************************************************************************/ + public Memoization getResponseCache() + { + return (responseCache); + } + +} diff --git a/src/main/java/com/kingsrook/qbits/authentik/client/AuthentikActionUtil.java b/src/main/java/com/kingsrook/qbits/authentik/client/AuthentikActionUtil.java new file mode 100644 index 0000000..b189d12 --- /dev/null +++ b/src/main/java/com/kingsrook/qbits/authentik/client/AuthentikActionUtil.java @@ -0,0 +1,918 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik.client; + + +import java.io.Serializable; +import java.net.URI; +import java.nio.charset.StandardCharsets; +import java.time.Instant; +import java.util.ArrayList; +import java.util.Iterator; +import java.util.List; +import java.util.Optional; +import java.util.concurrent.atomic.AtomicBoolean; +import com.kingsrook.qbits.authentik.AuthentikRuntime; +import com.kingsrook.qbits.authentik.security.AuthentikGuard; +import com.kingsrook.qqq.backend.core.actions.tables.InsertAction; +import com.kingsrook.qqq.backend.core.context.QContext; +import com.kingsrook.qqq.backend.core.exceptions.QException; +import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException; +import com.kingsrook.qqq.backend.core.exceptions.QUserFacingException; +import com.kingsrook.qqq.backend.core.logging.QLogger; +import com.kingsrook.qqq.backend.core.model.actions.tables.count.CountInput; +import com.kingsrook.qqq.backend.core.model.actions.tables.count.CountOutput; +import com.kingsrook.qqq.backend.core.model.actions.tables.delete.DeleteInput; +import com.kingsrook.qqq.backend.core.model.actions.tables.delete.DeleteOutput; +import com.kingsrook.qqq.backend.core.model.actions.tables.get.GetInput; +import com.kingsrook.qqq.backend.core.model.actions.tables.get.GetOutput; +import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput; +import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertOutput; +import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter; +import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput; +import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryOutput; +import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput; +import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateOutput; +import com.kingsrook.qqq.backend.core.model.data.QRecord; +import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData; +import com.kingsrook.qqq.backend.core.utils.SleepUtils; +import com.kingsrook.qqq.backend.core.utils.StringUtils; +import com.kingsrook.qqq.backend.module.api.actions.BaseAPIActionUtil; +import com.kingsrook.qqq.backend.module.api.actions.QHttpResponse; +import com.kingsrook.qqq.backend.module.api.model.OutboundAPILog; +import org.apache.http.Header; +import org.apache.http.HttpEntityEnclosingRequest; +import org.apache.http.NameValuePair; +import org.apache.http.client.methods.CloseableHttpResponse; +import org.apache.http.client.methods.HttpGet; +import org.apache.http.client.methods.HttpRequestBase; +import org.apache.http.client.utils.URIBuilder; +import org.apache.http.impl.client.CloseableHttpClient; +import org.apache.http.impl.client.HttpClientBuilder; +import org.apache.http.client.config.RequestConfig; +import org.apache.http.util.EntityUtils; +import org.json.JSONArray; +import org.json.JSONException; +import org.json.JSONObject; +import static com.kingsrook.qqq.backend.core.logging.LogUtils.logPair; + + +/******************************************************************************* + ** The qbit's Authentik API client, as a qqq-backend-module-api action util + ** (DESIGN.md sections 2.4 and 6.1). + ** + ** - Bearer authentication with the service account's API token. + ** - Page-based paging (page / page_size, max 100), count from + ** pagination.count with page_size=1. + ** - QQQ filters mapped by AuthentikFilterMapper; unsupported ones rejected. + ** - Every call passes AuthentikGuard first, then the shared token-bucket + ** throttle (Authentik does not throttle authenticated calls). + ** - Logs carry method, path and status only. Request query strings (search + ** terms are PII), bodies of sensitive endpoints and successful GET bodies + ** are never logged or stored; anything stored is passed through + ** AuthentikRedactor. + *******************************************************************************/ +public class AuthentikActionUtil extends BaseAPIActionUtil +{ + private static final QLogger LOG = QLogger.getLogger(AuthentikActionUtil.class); + + public static final int MAX_PAGE_SIZE = 100; + + private static final int MAX_RETRIES = 3; + private static final int INITIAL_BACKOFF_MS = 250; + private static final int MAX_RETRY_AFTER_SECS = 30; + + private static final AtomicBoolean VERSION_CHECKED = new AtomicBoolean(false); + + + + /******************************************************************************* + ** The runtime for the backend this util serves. + *******************************************************************************/ + protected AuthentikRuntime runtime() + { + return (AuthentikRuntime.forBackend(backendMetaData.getName())); + } + + + + /******************************************************************************* + ** The spec for a table, or an exception for a table the qbit didn't produce. + *******************************************************************************/ + protected AuthentikTableSpec spec(QTableMetaData table) throws QException + { + AuthentikTableSpec spec = runtime().getSpec(table.getName()); + if(spec == null) + { + throw (new QException("Table " + table.getName() + " is not an Authentik qbit table")); + } + return (spec); + } + + + + /******************************************************************************* + ** Count: one request with page_size=1, reading pagination.count. + *******************************************************************************/ + @Override + public CountOutput doCount(QTableMetaData table, CountInput countInput) throws QException + { + AuthentikTableSpec spec = spec(table); + runtime().getGuard().checkRead(spec); + + AuthentikFilterMapper.MappedFilter mapped = map(spec, countInput.getFilter()); + CountOutput output = new CountOutput(); + if(mapped.isKeyLookup()) + { + output.setCount(fetchByKeys(table, spec, mapped.keyLookup(), null).size()); + return (output); + } + + JSONObject page = getJson(listUrl(spec, mapped, 1, 1)); + output.setCount(page.optJSONObject("pagination") == null ? 0 : page.getJSONObject("pagination").optInt("count", 0)); + return (output); + } + + + + /******************************************************************************* + ** Get one record by key. Out-of-scope or missing records return no record. + *******************************************************************************/ + @Override + public GetOutput doGet(QTableMetaData table, GetInput getInput) throws QException + { + AuthentikTableSpec spec = spec(table); + runtime().getGuard().checkRead(spec); + + GetOutput output = new GetOutput(); + if(getInput.getPrimaryKey() == null) + { + throw (new QUserFacingException(spec.getLabel() + " can only be fetched by id.")); + } + + JSONObject object = getObject(spec, getInput.getPrimaryKey()); + if(object != null && isVisible(spec, object)) + { + output.setRecord(toRecord(spec, object, runtime().getGuard().maySeeSensitive())); + } + return (output); + } + + + + /******************************************************************************* + ** Query with page-based paging. + *******************************************************************************/ + @Override + public QueryOutput doQuery(QTableMetaData table, QueryInput queryInput) throws QException + { + AuthentikTableSpec spec = spec(table); + runtime().getGuard().checkRead(spec); + + QueryOutput output = new QueryOutput(queryInput); + QQueryFilter filter = queryInput.getFilter(); + AuthentikFilterMapper.MappedFilter mapped = map(spec, filter); + boolean sensitive = runtime().getGuard().maySeeSensitive(); + + Integer limit = filter == null ? null : filter.getLimit(); + int skip = filter == null || filter.getSkip() == null ? 0 : filter.getSkip(); + + if(mapped.isKeyLookup()) + { + List objects = fetchByKeys(table, spec, mapped.keyLookup(), limit); + int added = 0; + for(int i = skip; i < objects.size() && (limit == null || added < limit); i++) + { + output.addRecord(toRecord(spec, objects.get(i), sensitive)); + added++; + } + return (output); + } + + int pageSize; + int page; + int offset; + if(limit != null && limit > 0 && limit <= MAX_PAGE_SIZE && skip % limit == 0) + { + pageSize = limit; + page = skip / limit + 1; + offset = 0; + } + else + { + pageSize = MAX_PAGE_SIZE; + page = skip / MAX_PAGE_SIZE + 1; + offset = skip % MAX_PAGE_SIZE; + } + + int collected = 0; + while(true) + { + JSONObject response = getJson(listUrl(spec, mapped, page, pageSize)); + JSONArray results = response.optJSONArray("results"); + if(results == null || results.isEmpty()) + { + return (output); + } + + for(int i = offset; i < results.length(); i++) + { + JSONObject object = results.getJSONObject(i); + if(!isVisible(spec, object)) + { + continue; + } + output.addRecord(toRecord(spec, object, sensitive)); + collected++; + if(limit != null && collected >= limit) + { + return (output); + } + } + offset = 0; + + JSONObject pagination = response.optJSONObject("pagination"); + int totalPages = pagination == null ? page : pagination.optInt("total_pages", page); + if(page >= totalPages || queryInput.getAsyncJobCallback().wasCancelRequested()) + { + return (output); + } + page++; + } + } + + + + /******************************************************************************* + ** Writes go through the guard, which refuses them in this release. + *******************************************************************************/ + @Override + public InsertOutput doInsert(QTableMetaData table, InsertInput insertInput) throws QException + { + runtime().getGuard().checkWrite(spec(table), "insert"); + throw (new QPermissionDeniedException("Not available")); + } + + + + /******************************************************************************* + ** Writes go through the guard, which refuses them in this release. + *******************************************************************************/ + @Override + public UpdateOutput doUpdate(QTableMetaData table, UpdateInput updateInput) throws QException + { + runtime().getGuard().checkWrite(spec(table), "update"); + throw (new QPermissionDeniedException("Not available")); + } + + + + /******************************************************************************* + ** Writes go through the guard, which refuses them in this release. + *******************************************************************************/ + @Override + public DeleteOutput doDelete(QTableMetaData table, DeleteInput deleteInput) throws QException + { + runtime().getGuard().checkWrite(spec(table), "delete"); + throw (new QPermissionDeniedException("Not available")); + } + + + + /******************************************************************************* + ** Fetch a single Authentik object by key (null when it doesn't exist). + ** No permission check: callers check first. + *******************************************************************************/ + public JSONObject getObject(AuthentikTableSpec spec, Serializable key) throws QException + { + String keyText = String.valueOf(key).trim(); + if(keyText.isEmpty() || !keyText.matches("[A-Za-z0-9._:-]+")) + { + return (null); + } + + try + { + URIBuilder builder = new URIBuilder(runtime().getConfig().getApiRoot() + spec.getPath() + keyText + "/"); + for(NameValuePair param : spec.getDefaultGetParams()) + { + builder.addParameter(param.getName(), param.getValue()); + } + return (getJsonOrNull(builder.build().toString())); + } + catch(java.net.URISyntaxException e) + { + throw (new QException("Bad Authentik URL", e)); + } + } + + + + /******************************************************************************* + ** GET an API path (relative to /api/v3, may include a query string) and + ** parse it as a JSON object. Used by the resolver and health checks. + *******************************************************************************/ + public JSONObject getApiJson(String pathAndQuery) throws QException + { + return (getJson(runtime().getConfig().getApiRoot() + pathAndQuery)); + } + + + + /******************************************************************************* + ** Fetch every page of a list endpoint (relative path with query string, + ** without page parameters). Bounded by maxObjects. + *******************************************************************************/ + public List getAllPages(String pathAndQuery, int maxObjects) throws QException + { + List rs = new ArrayList<>(); + int page = 1; + while(true) + { + String separator = pathAndQuery.contains("?") ? "&" : "?"; + JSONObject response = getApiJson(pathAndQuery + separator + "page=" + page + "&page_size=" + MAX_PAGE_SIZE); + JSONArray results = response.optJSONArray("results"); + if(results == null || results.isEmpty()) + { + return (rs); + } + for(int i = 0; i < results.length() && rs.size() < maxObjects; i++) + { + rs.add(results.getJSONObject(i)); + } + JSONObject pagination = response.optJSONObject("pagination"); + if(rs.size() >= maxObjects || pagination == null || page >= pagination.optInt("total_pages", page)) + { + return (rs); + } + page++; + } + } + + + + /******************************************************************************* + ** The server's version (GET /admin/version/), or empty when unavailable. + *******************************************************************************/ + public Optional fetchServerVersion() + { + try + { + JSONObject version = getApiJson("/admin/version/"); + return (Optional.ofNullable(version.optString("version_current", null))); + } + catch(Exception e) + { + LOG.info("Could not read the Authentik server version", logPair("error", AuthentikRedactor.redactText(e.getMessage(), token()))); + return (Optional.empty()); + } + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private AuthentikFilterMapper.MappedFilter map(AuthentikTableSpec spec, QQueryFilter filter) throws QException + { + AuthentikFilterMapper.MappedFilter mapped = runtime().getFilterMapper().map(spec, filter, runtime().getGuard().maySeeSensitive()); + if(spec.getRequiredFilterField() != null && !mapped.filteredFields().contains(spec.getRequiredFilterField())) + { + throw (new QUserFacingException(spec.getLabel() + " can only be listed with a filter on " + spec.getField(spec.getRequiredFilterField()).getLabel() + ".")); + } + return (mapped); + } + + + + /******************************************************************************* + ** Build a list URL: mapped params, defaults, scope params, paging. + *******************************************************************************/ + private String listUrl(AuthentikTableSpec spec, AuthentikFilterMapper.MappedFilter mapped, int page, int pageSize) throws QException + { + try + { + URIBuilder builder = new URIBuilder(runtime().getConfig().getApiRoot() + spec.getPath()); + List usedNames = new ArrayList<>(); + for(NameValuePair param : mapped.params()) + { + builder.addParameter(param.getName(), param.getValue()); + usedNames.add(param.getName()); + } + for(NameValuePair param : spec.getDefaultListParams()) + { + if(!usedNames.contains(param.getName())) + { + builder.addParameter(param.getName(), param.getValue()); + } + } + if(AuthentikTables.USER.equals(spec.getName())) + { + addUserScope(builder, usedNames); + } + builder.addParameter("page", String.valueOf(page)); + builder.addParameter("page_size", String.valueOf(pageSize)); + return (builder.build().toString()); + } + catch(java.net.URISyntaxException e) + { + throw (new QException("Bad Authentik URL", e)); + } + } + + + + /******************************************************************************* + ** Server-side user scope (records are also checked one by one). A filter + ** the operator set on the same parameter wins server-side; the per-record + ** check still enforces the scope. + *******************************************************************************/ + private void addUserScope(URIBuilder builder, List usedNames) + { + if(!usedNames.contains("type")) + { + for(String type : AuthentikTables.DEFAULT_USER_TYPES) + { + builder.addParameter("type", type); + } + } + String pathPrefix = runtime().getConfig().getUserScopePathStartsWith(); + if(StringUtils.hasContent(pathPrefix) && !usedNames.contains("path_startswith")) + { + builder.addParameter("path_startswith", pathPrefix); + } + List groups = runtime().getConfig().getUserScopeGroupNames(); + if(groups != null && !groups.isEmpty() && !usedNames.contains("groups_by_name")) + { + groups.forEach(g -> builder.addParameter("groups_by_name", g)); + } + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private List fetchByKeys(QTableMetaData table, AuthentikTableSpec spec, List keys, Integer limit) throws QException + { + List rs = new ArrayList<>(); + for(Serializable key : keys) + { + if(key == null) + { + continue; + } + JSONObject object = getObject(spec, key); + if(object != null && isVisible(spec, object)) + { + rs.add(object); + } + } + return (rs); + } + + + + /******************************************************************************* + ** Per-record visibility (scope). + *******************************************************************************/ + private boolean isVisible(AuthentikTableSpec spec, JSONObject object) + { + if(AuthentikTables.USER.equals(spec.getName())) + { + return (runtime().getGuard().isUserInScope(object)); + } + return (true); + } + + + + /******************************************************************************* + ** Convert an Authentik object to a QRecord, dropping sensitive fields the + ** session may not see and computing derived fields. + *******************************************************************************/ + public QRecord toRecord(AuthentikTableSpec spec, JSONObject object, boolean maySeeSensitive) throws QException + { + try + { + QRecord record = new QRecord(); + for(AuthentikFieldSpec field : spec.getFields()) + { + if(field.isSensitive() && !maySeeSensitive) + { + continue; + } + record.setValue(field.getName(), field.extract(object)); + } + + if(AuthentikTables.USER.equals(spec.getName())) + { + AuthentikGuard.ProtectionResult protection = runtime().getGuard().protection(object); + record.setValue("isProtected", protection.isProtected()); + if(protection.isProtected()) + { + record.setDisplayValue("isProtected", "Protected: " + protection.reason()); + } + } + return (record); + } + catch(JSONException | IllegalArgumentException e) + { + throw (new QException("Unexpected Authentik response for " + spec.getLabel() + ": " + e.getMessage(), e)); + } + } + + + + /******************************************************************************* + ** GET JSON through the response cache. + *******************************************************************************/ + private JSONObject getJson(String url) throws QException + { + String body = getBody(url, false); + return (parse(url, body)); + } + + + + /******************************************************************************* + ** GET JSON, or null on 404. + *******************************************************************************/ + private JSONObject getJsonOrNull(String url) throws QException + { + String body = getBody(url, true); + return (body == null ? null : parse(url, body)); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private String getBody(String url, boolean nullOn404) throws QException + { + AuthentikRuntime runtime = runtime(); + if(runtime.isCacheEnabled()) + { + Optional cached = runtime.getResponseCache().getMemoizedResult(url).map(m -> m.getResult()); + if(cached.isPresent()) + { + return (cached.get()); + } + } + + QHttpResponse response = execute(new HttpGet(url)); + if(response.getStatusCode() == 404 && nullOn404) + { + return (null); + } + if(response.getStatusCode() == 404) + { + throw (new QException("Authentik endpoint not found (404): " + pathOf(url))); + } + + String body = response.getContent(); + if(runtime.isCacheEnabled() && body != null) + { + runtime.getResponseCache().storeResult(url, body); + } + return (body); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private JSONObject parse(String url, String body) throws QException + { + try + { + return (new JSONObject(body)); + } + catch(JSONException e) + { + throw (new QException("Authentik returned a non-JSON response for " + pathOf(url))); + } + } + + + + /******************************************************************************* + ** Execute a request: throttle, auth, retries for 429 and (GET-only) 5xx, + ** error mapping, logging. Returns 2xx and 404 responses. + *******************************************************************************/ + public QHttpResponse execute(HttpRequestBase request) throws QException + { + String path = pathOf(request.getURI().toString()); + int attempts = 0; + int backoffMs = INITIAL_BACKOFF_MS; + String token = token(); + + if(!StringUtils.hasContent(token)) + { + throw (new QException("The Authentik API token is not configured (apiToken resolved to an empty value).")); + } + + while(true) + { + attempts++; + runtime().getThrottle().acquire(); + request.setHeader("Authorization", "Bearer " + token); + request.setHeader("Accept", "application/json"); + if(request instanceof HttpEntityEnclosingRequest) + { + request.setHeader("Content-Type", "application/json"); + } + + long start = System.currentTimeMillis(); + QHttpResponse response; + try + { + response = send(request); + } + catch(Exception e) + { + String message = AuthentikRedactor.redactText(e.getMessage(), token); + LOG.warn("Authentik API call failed", logPair("method", request.getMethod()), logPair("path", path), logPair("error", message)); + if(attempts < MAX_RETRIES && "GET".equals(request.getMethod())) + { + SleepUtils.sleep(backoffMs, java.util.concurrent.TimeUnit.MILLISECONDS); + backoffMs *= 2; + continue; + } + throw (new QException("Could not reach Authentik (" + request.getMethod() + " " + path + "): " + message)); + } + + int status = response.getStatusCode() == null ? 0 : response.getStatusCode(); + LOG.info("Authentik API call", logPair("method", request.getMethod()), logPair("path", path), logPair("status", status), logPair("millis", System.currentTimeMillis() - start)); + logOutboundCall(request, path, response, token); + checkVersionOnce(status); + + if(status == 429 && attempts <= MAX_RETRIES) + { + SleepUtils.sleep(retryAfterMillis(response, backoffMs), java.util.concurrent.TimeUnit.MILLISECONDS); + backoffMs *= 2; + continue; + } + if(status >= 500 && attempts < MAX_RETRIES && "GET".equals(request.getMethod())) + { + SleepUtils.sleep(backoffMs, java.util.concurrent.TimeUnit.MILLISECONDS); + backoffMs *= 2; + continue; + } + + if((status >= 200 && status < 300) || status == 404) + { + return (response); + } + throw (mapError(request, path, status, response.getContent(), token)); + } + } + + + + /******************************************************************************* + ** Send one request. The single seam tests override. + *******************************************************************************/ + protected QHttpResponse send(HttpRequestBase request) throws Exception + { + try(CloseableHttpClient client = buildHttpClient(); CloseableHttpResponse response = executeHttpRequest(request, client)) + { + QHttpResponse qResponse = new QHttpResponse(); + qResponse.setStatusCode(response.getStatusLine().getStatusCode()); + qResponse.setHeaderList(List.of(response.getAllHeaders())); + qResponse.setContent(response.getEntity() == null ? null : EntityUtils.toString(response.getEntity(), StandardCharsets.UTF_8)); + return (qResponse); + } + } + + + + /******************************************************************************* + ** HTTP client with the configured timeouts. + *******************************************************************************/ + @Override + protected CloseableHttpClient buildHttpClient() + { + return (HttpClientBuilder.create() + .disableRedirectHandling() + .setDefaultRequestConfig(RequestConfig.custom() + .setConnectTimeout(runtime().getConfig().getConnectTimeoutMillis()) + .setConnectionRequestTimeout(runtime().getConfig().getConnectTimeoutMillis()) + .setSocketTimeout(runtime().getConfig().getSocketTimeoutMillis()).build()) + .build()); + } + + + + /******************************************************************************* + ** Map an Authentik error response to an exception, with a redacted message. + *******************************************************************************/ + static QException mapError(HttpRequestBase request, String path, int status, String body, String token) + { + String detail = AuthentikRedactor.redactText(errorDetail(body), token); + if(AuthentikRedactor.isSensitivePath(path)) + { + detail = "(details omitted for a sensitive endpoint)"; + } + return switch(status) + { + case 400 -> new QUserFacingException("Authentik rejected the request: " + detail); + case 401 -> new QException("Authentik rejected the qbit's API token (401). The service-account token may be expired or revoked; rotate it (see the phase 0 owner checklist)."); + case 403 -> new QPermissionDeniedException("Authentik refused " + request.getMethod() + " " + path + " (403): " + detail); + default -> new QException("Authentik error " + status + " on " + request.getMethod() + " " + path + ": " + detail); + }; + } + + + + /******************************************************************************* + ** Flatten Authentik's error JSON ({"detail": ...} or {"field": ["msg"]}). + *******************************************************************************/ + static String errorDetail(String body) + { + if(body == null || body.isBlank()) + { + return ("(no details)"); + } + try + { + JSONObject object = new JSONObject(body); + List parts = new ArrayList<>(); + Iterator keys = object.keys(); + while(keys.hasNext()) + { + String key = keys.next(); + Object value = object.get(key); + String text = value instanceof JSONArray array ? joinArray(array) : String.valueOf(value); + parts.add(key.equals("detail") || key.equals("non_field_errors") ? text : key + ": " + text); + } + return (String.join("; ", parts)); + } + catch(JSONException e) + { + return (body.length() > 200 ? body.substring(0, 200) + "..." : body); + } + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private static String joinArray(JSONArray array) + { + List values = new ArrayList<>(); + for(int i = 0; i < array.length(); i++) + { + values.add(String.valueOf(array.get(i))); + } + return (String.join(" ", values)); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private static long retryAfterMillis(QHttpResponse response, int fallbackMillis) + { + for(Header header : response.getHeaderList() == null ? List.
of() : response.getHeaderList()) + { + if(header.getName().equalsIgnoreCase("Retry-After")) + { + try + { + return (Math.min(MAX_RETRY_AFTER_SECS, Long.parseLong(header.getValue().trim())) * 1000L); + } + catch(NumberFormatException e) + { + break; + } + } + } + return (fallbackMillis); + } + + + + /******************************************************************************* + ** Write an OutboundAPILog row (if the host has that table), keeping PII + ** out: no query string, no successful GET bodies, sensitive bodies + ** dropped, everything else redacted. + *******************************************************************************/ + protected void logOutboundCall(HttpRequestBase request, String path, QHttpResponse response, String token) + { + try + { + if(QContext.getQInstance() == null || QContext.getQInstance().getTable(OutboundAPILog.TABLE_NAME) == null) + { + return; + } + + String requestBody = null; + if(request instanceof HttpEntityEnclosingRequest entityRequest && entityRequest.getEntity() != null) + { + requestBody = EntityUtils.toString(entityRequest.getEntity(), StandardCharsets.UTF_8); + } + + int status = response.getStatusCode() == null ? 0 : response.getStatusCode(); + String responseBody = "GET".equals(request.getMethod()) && status < 400 + ? "[" + (response.getContent() == null ? 0 : response.getContent().length()) + " characters, not stored]" + : AuthentikRedactor.redactBody(path, response.getContent(), token); + + OutboundAPILog log = new OutboundAPILog() + .withMethod(request.getMethod()) + .withUrl(path) + .withTimestamp(Instant.now()) + .withRequestBody(AuthentikRedactor.redactBody(path, requestBody, token)) + .withStatusCode(status) + .withResponseBody(responseBody); + + InsertInput insertInput = new InsertInput(); + insertInput.setTableName(OutboundAPILog.TABLE_NAME); + insertInput.setRecords(List.of(log.toQRecord())); + new InsertAction().executeAsync(insertInput); + } + catch(Exception e) + { + LOG.warn("Error logging an outbound Authentik call", logPair("path", path)); + } + } + + + + /******************************************************************************* + ** Once per JVM, after the first successful call, compare the server's + ** major.minor to the configured expectation and warn on a mismatch. + *******************************************************************************/ + private void checkVersionOnce(int status) + { + if(status < 200 || status >= 300 || !VERSION_CHECKED.compareAndSet(false, true)) + { + return; + } + String expected = runtime().getConfig().getExpectedServerVersion(); + fetchServerVersion().ifPresent(actual -> + { + if(StringUtils.hasContent(expected) && !actual.startsWith(expected + ".") && !actual.equals(expected)) + { + LOG.warn("Authentik server version differs from the version qbit-authentik was tested against", logPair("expected", expected), logPair("actual", actual)); + } + }); + } + + + + /******************************************************************************* + ** Reset the once-per-JVM version check (tests). + *******************************************************************************/ + static void resetVersionCheck() + { + VERSION_CHECKED.set(false); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private String token() + { + return (runtime().getConfig().getResolvedApiToken()); + } + + + + /******************************************************************************* + ** The path of a URL without its query string (query strings may carry PII). + *******************************************************************************/ + static String pathOf(String url) + { + try + { + return (URI.create(url).getPath()); + } + catch(IllegalArgumentException e) + { + int q = url.indexOf('?'); + return (q < 0 ? url : url.substring(0, q)); + } + } + +} diff --git a/src/main/java/com/kingsrook/qbits/authentik/client/AuthentikApiSurface.java b/src/main/java/com/kingsrook/qbits/authentik/client/AuthentikApiSurface.java new file mode 100644 index 0000000..54af318 --- /dev/null +++ b/src/main/java/com/kingsrook/qbits/authentik/client/AuthentikApiSurface.java @@ -0,0 +1,98 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik.client; + + +import java.util.ArrayList; +import java.util.LinkedHashSet; +import java.util.List; +import java.util.Set; +import org.apache.http.NameValuePair; + + +/******************************************************************************* + ** Every Authentik operation the qbit uses, with the query parameters it + ** sends. The schema drift tests check this surface against the pinned + ** schema (and, in CI, against new Authentik releases). Table operations are + ** derived from AuthentikTables; others are listed here. + *******************************************************************************/ +public final class AuthentikApiSurface +{ + + /******************************************************************************* + ** One operation: method, schema path template, and parameters used. + *******************************************************************************/ + public record Operation(String method, String path, Set params) + { + } + + + + /******************************************************************************* + ** Not instantiable. + *******************************************************************************/ + private AuthentikApiSurface() + { + } + + + + /******************************************************************************* + ** Operations outside the table specs. + *******************************************************************************/ + static List extraOperations() + { + List rs = new ArrayList<>(); + rs.add(new Operation("get", "/admin/version/", Set.of())); + return (rs); + } + + + + /******************************************************************************* + ** All operations. Detail paths use "{key}" for the id segment. + *******************************************************************************/ + public static List operations() + { + List rs = new ArrayList<>(); + for(AuthentikTableSpec spec : AuthentikTables.all().values()) + { + Set listParams = new LinkedHashSet<>(List.of("page", "page_size", "ordering")); + for(AuthentikFieldSpec field : spec.getFields()) + { + listParams.addAll(field.getFilterParams().values()); + if(field.isSearchable()) + { + listParams.add("search"); + } + } + spec.getDefaultListParams().stream().map(NameValuePair::getName).forEach(listParams::add); + if(AuthentikTables.USER.equals(spec.getName())) + { + listParams.addAll(List.of("type", "path_startswith", "groups_by_name")); + } + rs.add(new Operation("get", spec.getPath(), listParams)); + + Set getParams = new LinkedHashSet<>(); + spec.getDefaultGetParams().stream().map(NameValuePair::getName).forEach(getParams::add); + rs.add(new Operation("get", spec.getPath() + "{key}/", getParams)); + } + rs.addAll(extraOperations()); + return (rs); + } + +} diff --git a/src/main/java/com/kingsrook/qbits/authentik/client/AuthentikFieldSpec.java b/src/main/java/com/kingsrook/qbits/authentik/client/AuthentikFieldSpec.java new file mode 100644 index 0000000..1fe55bb --- /dev/null +++ b/src/main/java/com/kingsrook/qbits/authentik/client/AuthentikFieldSpec.java @@ -0,0 +1,204 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik.client; + + +import java.io.Serializable; +import java.util.EnumMap; +import java.util.Map; +import java.util.function.Function; +import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator; +import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType; +import org.json.JSONObject; + + +/******************************************************************************* + ** One field of an Authentik-backed table: how to read it from the Authentik + ** JSON, which QQQ criteria map to which Authentik query parameters, and + ** whether it is sensitive (stripped without identity.audit.read). + *******************************************************************************/ +public class AuthentikFieldSpec +{ + private final String name; + private final String label; + private final QFieldType type; + private final Function extractor; + private final Map filterParams = new EnumMap<>(QCriteriaOperator.class); + private boolean sensitive; + private boolean searchable; + private String orderingName; + private boolean hidden; + + + + /******************************************************************************* + ** Constructor. + *******************************************************************************/ + public AuthentikFieldSpec(String name, String label, QFieldType type, Function extractor) + { + this.name = name; + this.label = label; + this.type = type; + this.extractor = extractor; + } + + + + /******************************************************************************* + ** Map a QQQ operator to an Authentik query parameter for this field. + *******************************************************************************/ + public AuthentikFieldSpec withFilter(QCriteriaOperator operator, String param) + { + filterParams.put(operator, param); + return (this); + } + + + + /******************************************************************************* + ** Mark as sensitive (needs identity.audit.read to see or filter on). + *******************************************************************************/ + public AuthentikFieldSpec withSensitive() + { + this.sensitive = true; + return (this); + } + + + + /******************************************************************************* + ** CONTAINS / STARTS_WITH on this field map to Authentik's search param. + *******************************************************************************/ + public AuthentikFieldSpec withSearchable() + { + this.searchable = true; + return (this); + } + + + + /******************************************************************************* + ** Allow ordering on this field, by the given Authentik ordering name. + *******************************************************************************/ + public AuthentikFieldSpec withOrdering(String orderingName) + { + this.orderingName = orderingName; + return (this); + } + + + + /******************************************************************************* + ** Hide the field in the UI (it still exists on records). + *******************************************************************************/ + public AuthentikFieldSpec withHidden() + { + this.hidden = true; + return (this); + } + + + + /******************************************************************************* + ** Read this field's value from an Authentik object. + *******************************************************************************/ + public Serializable extract(JSONObject object) + { + return (extractor.apply(object)); + } + + + + /******************************************************************************* + ** Getter for name + *******************************************************************************/ + public String getName() + { + return (name); + } + + + + /******************************************************************************* + ** Getter for label + *******************************************************************************/ + public String getLabel() + { + return (label); + } + + + + /******************************************************************************* + ** Getter for type + *******************************************************************************/ + public QFieldType getType() + { + return (type); + } + + + + /******************************************************************************* + ** Getter for filterParams + *******************************************************************************/ + public Map getFilterParams() + { + return (filterParams); + } + + + + /******************************************************************************* + ** Getter for sensitive + *******************************************************************************/ + public boolean isSensitive() + { + return (sensitive); + } + + + + /******************************************************************************* + ** Getter for searchable + *******************************************************************************/ + public boolean isSearchable() + { + return (searchable); + } + + + + /******************************************************************************* + ** Getter for orderingName + *******************************************************************************/ + public String getOrderingName() + { + return (orderingName); + } + + + + /******************************************************************************* + ** Getter for hidden + *******************************************************************************/ + public boolean isHidden() + { + return (hidden); + } + +} diff --git a/src/main/java/com/kingsrook/qbits/authentik/client/AuthentikFilterMapper.java b/src/main/java/com/kingsrook/qbits/authentik/client/AuthentikFilterMapper.java new file mode 100644 index 0000000..b802868 --- /dev/null +++ b/src/main/java/com/kingsrook/qbits/authentik/client/AuthentikFilterMapper.java @@ -0,0 +1,446 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik.client; + + +import java.io.Serializable; +import java.time.Instant; +import java.time.LocalDate; +import java.time.ZoneOffset; +import java.time.format.DateTimeParseException; +import java.util.ArrayList; +import java.util.HashSet; +import java.util.List; +import java.util.Set; +import com.kingsrook.qqq.backend.core.exceptions.QException; +import com.kingsrook.qqq.backend.core.exceptions.QUserFacingException; +import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator; +import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterCriteria; +import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy; +import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter; +import com.kingsrook.qqq.backend.core.model.actions.tables.query.expressions.AbstractFilterExpression; +import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData; +import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType; +import com.kingsrook.qqq.backend.core.utils.CollectionUtils; +import org.apache.http.NameValuePair; +import org.apache.http.message.BasicNameValuePair; + + +/******************************************************************************* + ** Maps a QQQ filter to Authentik query parameters (DESIGN.md section 6.1). + ** + ** Exactly what Authentik can evaluate server-side is accepted. Everything + ** else (OR, sub-filters, NOT_* operators, unmapped fields or operators, + ** field-to-field criteria) is REJECTED with a user-facing message: filtering + ** client-side over 100-row pages would silently truncate results. + ** + ** Notes: + ** - Authentik date filters are strict (__gt / __lt). GREATER_THAN_OR_EQUALS + ** and LESS_THAN_OR_EQUALS are widened by one millisecond; BETWEEN uses both. + ** - CONTAINS / STARTS_WITH on a searchable field use Authentik's "search" + ** parameter, which matches the term across several fields (a superset of + ** the field criterion). Only one search term per query. + ** - A filter made only of key EQUALS / IN criteria is returned as a key + ** lookup (the caller fetches each record by id), since Authentik has no + ** list filter on every table's key. + *******************************************************************************/ +public class AuthentikFilterMapper +{ + + /******************************************************************************* + ** Result of mapping a filter. + *******************************************************************************/ + public record MappedFilter(List params, List keyLookup, Set filteredFields) + { + /******************************************************************************* + ** Whether this mapping is a key lookup (fetch-by-id) rather than a list query. + *******************************************************************************/ + public boolean isKeyLookup() + { + return (keyLookup != null); + } + } + + + + /******************************************************************************* + ** Map a filter for a table. + ** + ** @param spec the table + ** @param filter the QQQ filter (may be null) + ** @param mayUseSensitive whether the session may filter on sensitive fields + *******************************************************************************/ + public MappedFilter map(AuthentikTableSpec spec, QQueryFilter filter, boolean mayUseSensitive) throws QException + { + List params = new ArrayList<>(); + Set usedParams = new HashSet<>(); + Set filteredFields = new HashSet<>(); + + if(filter == null) + { + addOrdering(spec, null, params); + return (new MappedFilter(params, null, filteredFields)); + } + + if(CollectionUtils.nullSafeHasContents(filter.getSubFilters())) + { + throw (new QUserFacingException("Nested filters (sub-filters) are not supported for " + spec.getLabel() + ".")); + } + + List criteria = CollectionUtils.nonNullList(filter.getCriteria()); + if(criteria.size() > 1 && filter.getBooleanOperator() == QQueryFilter.BooleanOperator.OR) + { + throw (new QUserFacingException("\"Any of\" (OR) filters are not supported for " + spec.getLabel() + "; use \"all of\" (AND).")); + } + + List keyLookup = keyLookup(spec, criteria); + if(keyLookup != null) + { + filteredFields.add(spec.getKeyFieldName()); + return (new MappedFilter(params, keyLookup, filteredFields)); + } + + boolean usedSearch = false; + for(QFilterCriteria criterion : criteria) + { + if(criterion == null || criterion.getFieldName() == null) + { + continue; + } + + if(criterion.getOtherFieldName() != null || criterion.getFieldFunction() != null) + { + throw (new QUserFacingException("Field-to-field and function criteria are not supported for " + spec.getLabel() + ".")); + } + + AuthentikFieldSpec field = spec.getField(criterion.getFieldName()); + if(field == null) + { + throw (new QUserFacingException("Unknown field for " + spec.getLabel() + ": " + criterion.getFieldName())); + } + if(field.isSensitive() && !mayUseSensitive) + { + throw (new QUserFacingException("You do not have permission to filter " + spec.getLabel() + " by " + field.getLabel() + ".")); + } + + QCriteriaOperator operator = criterion.getOperator(); + List values = evaluateValues(field, criterion.getValues()); + filteredFields.add(field.getName()); + + if((operator == QCriteriaOperator.CONTAINS || operator == QCriteriaOperator.STARTS_WITH) && !field.getFilterParams().containsKey(operator) && field.isSearchable()) + { + if(usedSearch) + { + throw (new QUserFacingException("Only one text-search criterion is supported for " + spec.getLabel() + ".")); + } + usedSearch = true; + add(params, usedParams, "search", singleString(field, operator, values)); + continue; + } + + switch(operator) + { + case EQUALS, STARTS_WITH -> add(params, usedParams, param(field, operator), formatValue(field, singleValue(field, operator, values))); + case IN -> + { + String param = param(field, operator); + if(values.isEmpty()) + { + throw (new QUserFacingException("An empty \"is any of\" list is not supported for " + field.getLabel() + ".")); + } + if(!usedParams.add(param)) + { + throw (duplicate(field)); + } + for(Serializable value : values) + { + params.add(new BasicNameValuePair(param, formatValue(field, value))); + } + } + case GREATER_THAN, LESS_THAN -> add(params, usedParams, param(field, operator), formatValue(field, singleValue(field, operator, values))); + case GREATER_THAN_OR_EQUALS -> add(params, usedParams, param(field, QCriteriaOperator.GREATER_THAN), formatInstant(shift(field, singleValue(field, operator, values), -1))); + case LESS_THAN_OR_EQUALS -> add(params, usedParams, param(field, QCriteriaOperator.LESS_THAN), formatInstant(shift(field, singleValue(field, operator, values), 1))); + case BETWEEN -> + { + if(values.size() != 2) + { + throw (new QUserFacingException("\"Between\" needs two values for " + field.getLabel() + ".")); + } + add(params, usedParams, param(field, QCriteriaOperator.GREATER_THAN), formatInstant(shift(field, values.get(0), -1))); + add(params, usedParams, param(field, QCriteriaOperator.LESS_THAN), formatInstant(shift(field, values.get(1), 1))); + } + case IS_BLANK -> add(params, usedParams, param(field, operator), "true"); + case IS_NOT_BLANK -> add(params, usedParams, param(field, operator), "false"); + default -> throw (unsupported(field, operator)); + } + } + + addOrdering(spec, filter.getOrderBys(), params); + return (new MappedFilter(params, null, filteredFields)); + } + + + + /******************************************************************************* + ** If every criterion is key EQUALS / IN, return the keys; else null. + *******************************************************************************/ + private List keyLookup(AuthentikTableSpec spec, List criteria) + { + if(criteria.isEmpty()) + { + return (null); + } + + List keys = null; + for(QFilterCriteria criterion : criteria) + { + if(criterion == null || !spec.getKeyFieldName().equals(criterion.getFieldName()) || criterion.getOtherFieldName() != null) + { + return (null); + } + if(criterion.getOperator() != QCriteriaOperator.EQUALS && criterion.getOperator() != QCriteriaOperator.IN) + { + return (null); + } + + List these = new ArrayList<>(CollectionUtils.nonNullList(criterion.getValues())); + if(keys == null) + { + keys = these; + } + else + { + keys.retainAll(these); + } + } + return (keys); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private void addOrdering(AuthentikTableSpec spec, List orderBys, List params) throws QUserFacingException + { + List orderings = new ArrayList<>(); + for(QFilterOrderBy orderBy : CollectionUtils.nonNullList(orderBys)) + { + AuthentikFieldSpec field = spec.getField(orderBy.getFieldName()); + if(field == null || field.getOrderingName() == null) + { + throw (new QUserFacingException(spec.getLabel() + " cannot be sorted by " + (field == null ? orderBy.getFieldName() : field.getLabel()) + ".")); + } + orderings.add((orderBy.getIsAscending() ? "" : "-") + field.getOrderingName()); + } + + if(orderings.isEmpty() && spec.getDefaultOrdering() != null) + { + orderings.add(spec.getDefaultOrdering()); + } + + if(!orderings.isEmpty()) + { + params.add(new BasicNameValuePair("ordering", String.join(",", orderings))); + } + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private static void add(List params, Set usedParams, String param, String value) throws QUserFacingException + { + if(!usedParams.add(param)) + { + throw (new QUserFacingException("Two criteria map to the same Authentik filter (" + param + "); combine them into one.")); + } + params.add(new BasicNameValuePair(param, value)); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private static String param(AuthentikFieldSpec field, QCriteriaOperator operator) throws QUserFacingException + { + String param = field.getFilterParams().get(operator); + if(param == null) + { + throw (unsupported(field, operator)); + } + return (param); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private static QUserFacingException unsupported(AuthentikFieldSpec field, QCriteriaOperator operator) + { + return (new QUserFacingException("Filtering " + field.getLabel() + " with \"" + operator.name().toLowerCase().replace('_', ' ') + "\" is not supported by Authentik.")); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private static QUserFacingException duplicate(AuthentikFieldSpec field) + { + return (new QUserFacingException("Only one criterion per field is supported (" + field.getLabel() + ").")); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private static Serializable singleValue(AuthentikFieldSpec field, QCriteriaOperator operator, List values) throws QUserFacingException + { + if(values.size() != 1 || values.get(0) == null) + { + throw (new QUserFacingException("\"" + operator.name().toLowerCase().replace('_', ' ') + "\" needs exactly one value for " + field.getLabel() + ".")); + } + return (values.get(0)); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private static String singleString(AuthentikFieldSpec field, QCriteriaOperator operator, List values) throws QUserFacingException + { + String value = String.valueOf(singleValue(field, operator, values)).trim(); + if(value.isEmpty()) + { + throw (new QUserFacingException("A search term is required for " + field.getLabel() + ".")); + } + return (value); + } + + + + /******************************************************************************* + ** Evaluate filter expressions (e.g. "now minus 90 days") into plain values. + *******************************************************************************/ + private static List evaluateValues(AuthentikFieldSpec field, List values) throws QException + { + List rs = new ArrayList<>(); + for(Serializable value : CollectionUtils.nonNullList(values)) + { + if(value instanceof AbstractFilterExpression expression) + { + rs.add(expression.evaluate(new QFieldMetaData(field.getName(), field.getType()))); + } + else + { + rs.add(value); + } + } + return (rs); + } + + + + /******************************************************************************* + ** Format a value for a query string. + *******************************************************************************/ + static String formatValue(AuthentikFieldSpec field, Serializable value) throws QUserFacingException + { + if(field.getType() == QFieldType.DATE_TIME || field.getType() == QFieldType.DATE) + { + return (formatInstant(toInstant(field, value))); + } + if(field.getType() == QFieldType.BOOLEAN) + { + String text = String.valueOf(value).trim().toLowerCase(); + return (text.equals("true") || text.equals("1") || text.equals("yes") ? "true" : "false"); + } + return (String.valueOf(value)); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private static Instant shift(AuthentikFieldSpec field, Serializable value, long millis) throws QUserFacingException + { + return (toInstant(field, value).plusMillis(millis)); + } + + + + /******************************************************************************* + ** Convert a date-ish value to an Instant (a date means its start, UTC). + *******************************************************************************/ + static Instant toInstant(AuthentikFieldSpec field, Serializable value) throws QUserFacingException + { + if(value instanceof Instant instant) + { + return (instant); + } + if(value instanceof LocalDate localDate) + { + return (localDate.atStartOfDay(ZoneOffset.UTC).toInstant()); + } + if(value instanceof java.util.Date date) + { + return (date.toInstant()); + } + + String text = value == null ? "" : String.valueOf(value).trim(); + try + { + return (Instant.parse(text)); + } + catch(DateTimeParseException e) + { + try + { + return (AuthentikJson.parseInstant(text)); + } + catch(DateTimeParseException e2) + { + try + { + return (LocalDate.parse(text).atStartOfDay(ZoneOffset.UTC).toInstant()); + } + catch(DateTimeParseException e3) + { + throw (new QUserFacingException("Not a valid date/time for " + field.getLabel() + ": " + text)); + } + } + } + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private static String formatInstant(Instant instant) + { + return (instant.toString()); + } + +} diff --git a/src/main/java/com/kingsrook/qbits/authentik/client/AuthentikJson.java b/src/main/java/com/kingsrook/qbits/authentik/client/AuthentikJson.java new file mode 100644 index 0000000..c9a5705 --- /dev/null +++ b/src/main/java/com/kingsrook/qbits/authentik/client/AuthentikJson.java @@ -0,0 +1,234 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik.client; + + +import java.io.Serializable; +import java.time.Instant; +import java.time.OffsetDateTime; +import java.util.ArrayList; +import java.util.Iterator; +import java.util.List; +import java.util.function.Function; +import org.json.JSONArray; +import org.json.JSONObject; + + +/******************************************************************************* + ** Null-safe readers for Authentik JSON objects, used as field extractors. + *******************************************************************************/ +public final class AuthentikJson +{ + /** Attribute-key prefix the qbit owns (DESIGN.md section 5.2). */ + public static final String QQQ_ATTRIBUTE_PREFIX = "qqq.io/"; + + public static final String ATTR_PERMISSIONS = "qqq.io/permissions"; + public static final String ATTR_APP_ACCESS = "qqq.io/app-access"; + public static final String ATTR_PROTECTED = "qqq.io/protected"; + + + + /******************************************************************************* + ** Not instantiable. + *******************************************************************************/ + private AuthentikJson() + { + } + + + + /******************************************************************************* + ** String value, or null. + *******************************************************************************/ + public static Function string(String key) + { + return (o -> o.has(key) && !o.isNull(key) ? String.valueOf(o.get(key)) : null); + } + + + + /******************************************************************************* + ** Integer value, or null. + *******************************************************************************/ + public static Function integer(String key) + { + return (o -> o.has(key) && !o.isNull(key) ? o.getInt(key) : null); + } + + + + /******************************************************************************* + ** Boolean value, or null. + *******************************************************************************/ + public static Function bool(String key) + { + return (o -> o.has(key) && !o.isNull(key) ? o.getBoolean(key) : null); + } + + + + /******************************************************************************* + ** ISO-8601 date-time as an Instant, or null. + *******************************************************************************/ + public static Function instant(String key) + { + return (o -> parseInstant(o.has(key) && !o.isNull(key) ? o.getString(key) : null)); + } + + + + /******************************************************************************* + ** A nested object (or array) rendered as JSON text, or null. + *******************************************************************************/ + public static Function json(String key) + { + return (o -> o.has(key) && !o.isNull(key) ? o.get(key).toString() : null); + } + + + + /******************************************************************************* + ** Length of an array value, or null. + *******************************************************************************/ + public static Function arrayLength(String key) + { + return (o -> o.optJSONArray(key) == null ? null : o.getJSONArray(key).length()); + } + + + + /******************************************************************************* + ** Comma-joined values of a property across an array of objects, e.g. the + ** names in groups_obj. Null when the array is absent. + *******************************************************************************/ + public static Function joined(String arrayKey, String property) + { + return (o -> + { + JSONArray array = o.optJSONArray(arrayKey); + if(array == null) + { + return (null); + } + List values = new ArrayList<>(); + for(int i = 0; i < array.length(); i++) + { + Object element = array.get(i); + if(element instanceof JSONObject object && object.has(property) && !object.isNull(property)) + { + values.add(String.valueOf(object.get(property))); + } + else if(!(element instanceof JSONObject) && property == null) + { + values.add(String.valueOf(element)); + } + } + return (String.join(", ", values)); + }); + } + + + + /******************************************************************************* + ** Comma-joined values of a string array inside "attributes", e.g. + ** qqq.io/permissions. Null when absent. + *******************************************************************************/ + public static Function attributeList(String attributeKey) + { + return (o -> + { + List values = stringList(o.optJSONObject("attributes"), attributeKey); + return (values == null ? null : String.join(", ", values)); + }); + } + + + + /******************************************************************************* + ** Only the qqq.io/* attribute keys, as JSON text (non-sensitive view). + *******************************************************************************/ + public static Function qqqAttributes() + { + return (o -> + { + JSONObject attributes = o.optJSONObject("attributes"); + if(attributes == null) + { + return (null); + } + JSONObject rs = new JSONObject(); + Iterator keys = attributes.keys(); + while(keys.hasNext()) + { + String key = keys.next(); + if(key.startsWith(QQQ_ATTRIBUTE_PREFIX)) + { + rs.put(key, attributes.get(key)); + } + } + return (rs.isEmpty() ? null : rs.toString()); + }); + } + + + + /******************************************************************************* + ** Read a list of strings from an object property; null when absent, and + ** non-string elements are skipped. A single string is treated as a list of + ** one (Authentik attributes are free-form JSON). + *******************************************************************************/ + public static List stringList(JSONObject object, String key) + { + if(object == null || !object.has(key) || object.isNull(key)) + { + return (null); + } + + Object value = object.get(key); + List values = new ArrayList<>(); + if(value instanceof JSONArray array) + { + for(int i = 0; i < array.length(); i++) + { + if(array.get(i) instanceof String s && !s.isBlank()) + { + values.add(s.trim()); + } + } + } + else if(value instanceof String s && !s.isBlank()) + { + values.add(s.trim()); + } + return (values); + } + + + + /******************************************************************************* + ** Parse an Authentik timestamp (ISO-8601 with offset or Z). + *******************************************************************************/ + public static Instant parseInstant(String value) + { + if(value == null || value.isBlank()) + { + return (null); + } + return (OffsetDateTime.parse(value).toInstant()); + } + +} diff --git a/src/main/java/com/kingsrook/qbits/authentik/client/AuthentikRedactor.java b/src/main/java/com/kingsrook/qbits/authentik/client/AuthentikRedactor.java new file mode 100644 index 0000000..5a61a5d --- /dev/null +++ b/src/main/java/com/kingsrook/qbits/authentik/client/AuthentikRedactor.java @@ -0,0 +1,129 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik.client; + + +import java.util.List; +import java.util.regex.Matcher; +import java.util.regex.Pattern; + + +/******************************************************************************* + ** Redaction for anything the qbit logs or stores about Authentik calls + ** (DESIGN.md section 9.1): + ** - the bearer token is never logged (it is replaced wherever it appears); + ** - bodies of sensitive endpoints (recovery, tokens, passwords, service-account + ** creation, user create) are dropped entirely; + ** - in any other body, values of JSON keys that look like secrets (key, token, + ** link, password, secret, client_secret) are masked. + *******************************************************************************/ +public final class AuthentikRedactor +{ + public static final String MASK = "******"; + + /** Path fragments whose request and response bodies are never logged. */ + private static final List SENSITIVE_PATH_FRAGMENTS = List.of( + "/recovery", "/recovery_email", "/set_password", "/set_password_hash", "/core/tokens/", "/service_account", "/impersonate", "/view_key", "/set_key"); + + private static final Pattern SECRET_JSON_VALUE = Pattern.compile( + "(\"(?:key|token|link|password|secret|client_secret|password_hash|recovery_link)\"\\s*:\\s*)\"((?:[^\"\\\\]|\\\\.)*)\"", Pattern.CASE_INSENSITIVE); + + private static final Pattern BEARER = Pattern.compile("(?i)(bearer\\s+)[A-Za-z0-9._~+/=-]+"); + + + + /******************************************************************************* + ** Not instantiable. + *******************************************************************************/ + private AuthentikRedactor() + { + } + + + + /******************************************************************************* + ** Whether bodies for this path must never be logged. + *******************************************************************************/ + public static boolean isSensitivePath(String path) + { + if(path == null) + { + return (false); + } + for(String fragment : SENSITIVE_PATH_FRAGMENTS) + { + if(path.contains(fragment)) + { + return (true); + } + } + return (false); + } + + + + /******************************************************************************* + ** Redact a request or response body for logging. + ** + ** @param path the request path (decides whether to drop the body) + ** @param body the body (may be null) + ** @param token the bearer token in use (may be null) + *******************************************************************************/ + public static String redactBody(String path, String body, String token) + { + if(body == null) + { + return (null); + } + if(isSensitivePath(path)) + { + return ("[body omitted: sensitive endpoint]"); + } + return (redactText(body, token)); + } + + + + /******************************************************************************* + ** Redact free text (exception messages, log lines): the token, bearer + ** values and secret-looking JSON values. + *******************************************************************************/ + public static String redactText(String text, String token) + { + if(text == null) + { + return (null); + } + + String safe = text; + if(token != null && !token.isBlank()) + { + safe = safe.replace(token, MASK); + } + safe = BEARER.matcher(safe).replaceAll("$1" + MASK); + + Matcher matcher = SECRET_JSON_VALUE.matcher(safe); + StringBuilder rs = new StringBuilder(); + while(matcher.find()) + { + matcher.appendReplacement(rs, Matcher.quoteReplacement(matcher.group(1) + "\"" + MASK + "\"")); + } + matcher.appendTail(rs); + return (rs.toString()); + } + +} diff --git a/src/main/java/com/kingsrook/qbits/authentik/client/AuthentikTableSpec.java b/src/main/java/com/kingsrook/qbits/authentik/client/AuthentikTableSpec.java new file mode 100644 index 0000000..48436f3 --- /dev/null +++ b/src/main/java/com/kingsrook/qbits/authentik/client/AuthentikTableSpec.java @@ -0,0 +1,277 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik.client; + + +import java.util.ArrayList; +import java.util.Collection; +import java.util.LinkedHashMap; +import java.util.List; +import java.util.Map; +import com.kingsrook.qbits.authentik.security.IdentityPermission; +import org.apache.http.NameValuePair; +import org.apache.http.message.BasicNameValuePair; + + +/******************************************************************************* + ** Definition of one Authentik-backed QQQ table: its endpoint, key, fields, + ** default query parameters and the permission needed to read it. + *******************************************************************************/ +public class AuthentikTableSpec +{ + private final String name; + private final String label; + private final String icon; + private final String path; + private final String keyFieldName; + private final Map fields = new LinkedHashMap<>(); + private final List defaultListParams = new ArrayList<>(); + private final List defaultGetParams = new ArrayList<>(); + private IdentityPermission readPermission = IdentityPermission.USERS_READ; + private String defaultOrdering; + private List recordLabelFields = new ArrayList<>(); + private String requiredFilterField; + + + + /******************************************************************************* + ** Constructor. + ** + ** @param name unprefixed table name, e.g. "user" + ** @param label UI label + ** @param icon material icon name + ** @param path API path below /api/v3, with leading and trailing slash + ** @param keyFieldName name of the primary-key field + *******************************************************************************/ + public AuthentikTableSpec(String name, String label, String icon, String path, String keyFieldName) + { + this.name = name; + this.label = label; + this.icon = icon; + this.path = path; + this.keyFieldName = keyFieldName; + } + + + + /******************************************************************************* + ** Add a field. + *******************************************************************************/ + public AuthentikTableSpec withField(AuthentikFieldSpec field) + { + fields.put(field.getName(), field); + return (this); + } + + + + /******************************************************************************* + ** Add a query parameter sent with every list request. + *******************************************************************************/ + public AuthentikTableSpec withDefaultListParam(String param, String value) + { + defaultListParams.add(new BasicNameValuePair(param, value)); + return (this); + } + + + + /******************************************************************************* + ** Add a query parameter sent with every single-record GET. + *******************************************************************************/ + public AuthentikTableSpec withDefaultGetParam(String param, String value) + { + defaultGetParams.add(new BasicNameValuePair(param, value)); + return (this); + } + + + + /******************************************************************************* + ** Set the permission needed to read the table. + *******************************************************************************/ + public AuthentikTableSpec withReadPermission(IdentityPermission readPermission) + { + this.readPermission = readPermission; + return (this); + } + + + + /******************************************************************************* + ** Set the Authentik ordering used when the query has no orderBy. + *******************************************************************************/ + public AuthentikTableSpec withDefaultOrdering(String defaultOrdering) + { + this.defaultOrdering = defaultOrdering; + return (this); + } + + + + /******************************************************************************* + ** Set the record label fields. + *******************************************************************************/ + public AuthentikTableSpec withRecordLabelFields(String... recordLabelFields) + { + this.recordLabelFields = new ArrayList<>(List.of(recordLabelFields)); + return (this); + } + + + + /******************************************************************************* + ** Require a criterion on this field for every query (e.g. MFA devices are + ** only listed per user). + *******************************************************************************/ + public AuthentikTableSpec withRequiredFilterField(String requiredFilterField) + { + this.requiredFilterField = requiredFilterField; + return (this); + } + + + + /******************************************************************************* + ** Get a field spec, or null. + *******************************************************************************/ + public AuthentikFieldSpec getField(String fieldName) + { + return (fields.get(fieldName)); + } + + + + /******************************************************************************* + ** All field specs, in display order. + *******************************************************************************/ + public Collection getFields() + { + return (fields.values()); + } + + + + /******************************************************************************* + ** Getter for name + *******************************************************************************/ + public String getName() + { + return (name); + } + + + + /******************************************************************************* + ** Getter for label + *******************************************************************************/ + public String getLabel() + { + return (label); + } + + + + /******************************************************************************* + ** Getter for icon + *******************************************************************************/ + public String getIcon() + { + return (icon); + } + + + + /******************************************************************************* + ** Getter for path + *******************************************************************************/ + public String getPath() + { + return (path); + } + + + + /******************************************************************************* + ** Getter for keyFieldName + *******************************************************************************/ + public String getKeyFieldName() + { + return (keyFieldName); + } + + + + /******************************************************************************* + ** Getter for defaultListParams + *******************************************************************************/ + public List getDefaultListParams() + { + return (defaultListParams); + } + + + + /******************************************************************************* + ** Getter for defaultGetParams + *******************************************************************************/ + public List getDefaultGetParams() + { + return (defaultGetParams); + } + + + + /******************************************************************************* + ** Getter for readPermission + *******************************************************************************/ + public IdentityPermission getReadPermission() + { + return (readPermission); + } + + + + /******************************************************************************* + ** Getter for defaultOrdering + *******************************************************************************/ + public String getDefaultOrdering() + { + return (defaultOrdering); + } + + + + /******************************************************************************* + ** Getter for recordLabelFields + *******************************************************************************/ + public List getRecordLabelFields() + { + return (recordLabelFields); + } + + + + /******************************************************************************* + ** Getter for requiredFilterField + *******************************************************************************/ + public String getRequiredFilterField() + { + return (requiredFilterField); + } + +} diff --git a/src/main/java/com/kingsrook/qbits/authentik/client/AuthentikTables.java b/src/main/java/com/kingsrook/qbits/authentik/client/AuthentikTables.java new file mode 100644 index 0000000..d401fd8 --- /dev/null +++ b/src/main/java/com/kingsrook/qbits/authentik/client/AuthentikTables.java @@ -0,0 +1,187 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik.client; + + +import java.util.LinkedHashMap; +import java.util.Map; +import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator; +import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldType; +import static com.kingsrook.qbits.authentik.client.AuthentikJson.attributeList; +import static com.kingsrook.qbits.authentik.client.AuthentikJson.bool; +import static com.kingsrook.qbits.authentik.client.AuthentikJson.instant; +import static com.kingsrook.qbits.authentik.client.AuthentikJson.integer; +import static com.kingsrook.qbits.authentik.client.AuthentikJson.joined; +import static com.kingsrook.qbits.authentik.client.AuthentikJson.json; +import static com.kingsrook.qbits.authentik.client.AuthentikJson.qqqAttributes; +import static com.kingsrook.qbits.authentik.client.AuthentikJson.string; + + +/******************************************************************************* + ** The Authentik-backed tables (DESIGN.md section 6.1), mapped against the + ** pinned 2026.8.3 schema (src/test/resources/authentik/schema-2026.8.3.yml). + ** + ** Multi-value query parameters are sent as repeated plain names + ** (type=internal&type=external). Authentik silently IGNORES the bracketed + ** form (type[]=internal), returning unfiltered results (phase 0 finding). + *******************************************************************************/ +public final class AuthentikTables +{ + public static final String USER = "user"; + public static final String GROUP = "group"; + + /** User types the qbit shows by default: everything but outposts' internal service accounts. */ + public static final String[] DEFAULT_USER_TYPES = { "internal", "external", "service_account" }; + + private static final Map SPECS = new LinkedHashMap<>(); + + static + { + register(users()); + register(groups()); + } + + + + /******************************************************************************* + ** Not instantiable. + *******************************************************************************/ + private AuthentikTables() + { + } + + + + /******************************************************************************* + ** Look up a spec by unprefixed table name, or null. + *******************************************************************************/ + public static AuthentikTableSpec get(String name) + { + return (SPECS.get(name)); + } + + + + /******************************************************************************* + ** All specs. + *******************************************************************************/ + public static Map all() + { + return (SPECS); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private static void register(AuthentikTableSpec spec) + { + SPECS.put(spec.getName(), spec); + } + + + + /******************************************************************************* + ** /core/users/ (int pk). The detail GET takes no include_* parameters and + ** always returns groups_obj and roles_obj. + *******************************************************************************/ + static AuthentikTableSpec users() + { + AuthentikTableSpec spec = new AuthentikTableSpec(USER, "Users", "person", "/core/users/", "pk") + .withDefaultListParam("include_groups", "true") + .withDefaultListParam("include_roles", "true") + .withDefaultOrdering("username") + .withRecordLabelFields("username"); + + spec.withField(new AuthentikFieldSpec("pk", "Id", QFieldType.INTEGER, integer("pk"))); + spec.withField(new AuthentikFieldSpec("username", "Username", QFieldType.STRING, string("username")) + .withFilter(QCriteriaOperator.EQUALS, "username").withSearchable().withOrdering("username")); + spec.withField(new AuthentikFieldSpec("name", "Name", QFieldType.STRING, string("name")) + .withFilter(QCriteriaOperator.EQUALS, "name").withSearchable().withOrdering("name")); + spec.withField(new AuthentikFieldSpec("email", "Email", QFieldType.STRING, string("email")) + .withFilter(QCriteriaOperator.EQUALS, "email").withSearchable().withOrdering("email")); + spec.withField(new AuthentikFieldSpec("isActive", "Active", QFieldType.BOOLEAN, bool("is_active")) + .withFilter(QCriteriaOperator.EQUALS, "is_active").withOrdering("is_active")); + spec.withField(new AuthentikFieldSpec("type", "Type", QFieldType.STRING, string("type")) + .withFilter(QCriteriaOperator.EQUALS, "type").withFilter(QCriteriaOperator.IN, "type")); + spec.withField(new AuthentikFieldSpec("isSuperuser", "Superuser", QFieldType.BOOLEAN, bool("is_superuser")) + .withFilter(QCriteriaOperator.EQUALS, "is_superuser")); + spec.withField(new AuthentikFieldSpec("isProtected", "Protected", QFieldType.BOOLEAN, o -> null)); + spec.withField(new AuthentikFieldSpec("groupNames", "Groups", QFieldType.STRING, joined("groups_obj", "name")) + .withFilter(QCriteriaOperator.EQUALS, "groups_by_name").withFilter(QCriteriaOperator.IN, "groups_by_name")); + spec.withField(new AuthentikFieldSpec("roleNames", "Roles", QFieldType.STRING, joined("roles_obj", "name")) + .withFilter(QCriteriaOperator.EQUALS, "roles_by_name").withFilter(QCriteriaOperator.IN, "roles_by_name")); + spec.withField(new AuthentikFieldSpec("lastLogin", "Last Login", QFieldType.DATE_TIME, instant("last_login")) + .withFilter(QCriteriaOperator.GREATER_THAN, "last_login__gt").withFilter(QCriteriaOperator.LESS_THAN, "last_login__lt") + .withFilter(QCriteriaOperator.IS_BLANK, "last_login__isnull").withFilter(QCriteriaOperator.IS_NOT_BLANK, "last_login__isnull") + .withOrdering("last_login")); + spec.withField(new AuthentikFieldSpec("dateJoined", "Date Joined", QFieldType.DATE_TIME, instant("date_joined")) + .withFilter(QCriteriaOperator.GREATER_THAN, "date_joined__gt").withFilter(QCriteriaOperator.LESS_THAN, "date_joined__lt") + .withOrdering("date_joined")); + spec.withField(new AuthentikFieldSpec("lastUpdated", "Last Updated", QFieldType.DATE_TIME, instant("last_updated")) + .withFilter(QCriteriaOperator.GREATER_THAN, "last_updated__gt").withFilter(QCriteriaOperator.LESS_THAN, "last_updated__lt")); + spec.withField(new AuthentikFieldSpec("path", "Path", QFieldType.STRING, string("path")) + .withFilter(QCriteriaOperator.EQUALS, "path").withFilter(QCriteriaOperator.STARTS_WITH, "path_startswith")); + spec.withField(new AuthentikFieldSpec("uuid", "UUID", QFieldType.STRING, string("uuid")) + .withFilter(QCriteriaOperator.EQUALS, "uuid").withHidden()); + spec.withField(new AuthentikFieldSpec("qqqAttributes", "QQQ Attributes", QFieldType.TEXT, qqqAttributes())); + spec.withField(new AuthentikFieldSpec("passwordChangeDate", "Password Changed", QFieldType.DATE_TIME, instant("password_change_date")) + .withSensitive()); + spec.withField(new AuthentikFieldSpec("attributes", "Attributes", QFieldType.TEXT, json("attributes")) + .withSensitive()); + return (spec); + } + + + + /******************************************************************************* + ** /core/groups/ (uuid pk). Note: Group has no last_updated in 2026.8.3. + *******************************************************************************/ + static AuthentikTableSpec groups() + { + AuthentikTableSpec spec = new AuthentikTableSpec(GROUP, "Groups", "groups", "/core/groups/", "pk") + .withDefaultListParam("include_users", "false") + .withDefaultListParam("include_parents", "true") + .withDefaultListParam("include_children", "true") + .withDefaultGetParam("include_users", "false") + .withDefaultGetParam("include_parents", "true") + .withDefaultGetParam("include_children", "true") + .withDefaultOrdering("name") + .withRecordLabelFields("name"); + + spec.withField(new AuthentikFieldSpec("pk", "Id", QFieldType.STRING, string("pk"))); + spec.withField(new AuthentikFieldSpec("name", "Name", QFieldType.STRING, string("name")) + .withFilter(QCriteriaOperator.EQUALS, "name").withSearchable().withOrdering("name")); + spec.withField(new AuthentikFieldSpec("isSuperuser", "Superuser (own flag)", QFieldType.BOOLEAN, bool("is_superuser")) + .withFilter(QCriteriaOperator.EQUALS, "is_superuser")); + spec.withField(new AuthentikFieldSpec("isSuperuserInherited", "Superuser (incl. parents)", QFieldType.BOOLEAN, o -> null)); + spec.withField(new AuthentikFieldSpec("parentNames", "Parents", QFieldType.STRING, joined("parents_obj", "name"))); + spec.withField(new AuthentikFieldSpec("childNames", "Children", QFieldType.STRING, joined("children_obj", "name"))); + spec.withField(new AuthentikFieldSpec("memberCount", "Members", QFieldType.INTEGER, AuthentikJson.arrayLength("users"))); + spec.withField(new AuthentikFieldSpec("memberUsername", "Member Username", QFieldType.STRING, o -> null) + .withFilter(QCriteriaOperator.EQUALS, "members_by_username").withFilter(QCriteriaOperator.IN, "members_by_username").withHidden()); + spec.withField(new AuthentikFieldSpec("permissions", "QQQ Permissions", QFieldType.TEXT, attributeList(AuthentikJson.ATTR_PERMISSIONS))); + spec.withField(new AuthentikFieldSpec("appAccess", "App Access", QFieldType.TEXT, attributeList(AuthentikJson.ATTR_APP_ACCESS))); + spec.withField(new AuthentikFieldSpec("roleNames", "Roles", QFieldType.STRING, joined("roles_obj", "name"))); + spec.withField(new AuthentikFieldSpec("numPk", "Numeric Id", QFieldType.INTEGER, integer("num_pk")).withHidden()); + spec.withField(new AuthentikFieldSpec("parentPks", "Parent Ids", QFieldType.TEXT, json("parents")).withHidden()); + spec.withField(new AuthentikFieldSpec("attributes", "Attributes", QFieldType.TEXT, json("attributes")).withSensitive()); + return (spec); + } + +} diff --git a/src/main/java/com/kingsrook/qbits/authentik/client/TokenBucketThrottle.java b/src/main/java/com/kingsrook/qbits/authentik/client/TokenBucketThrottle.java new file mode 100644 index 0000000..2dedc92 --- /dev/null +++ b/src/main/java/com/kingsrook/qbits/authentik/client/TokenBucketThrottle.java @@ -0,0 +1,135 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik.client; + + +import java.util.function.LongConsumer; +import java.util.function.LongSupplier; + + +/******************************************************************************* + ** Self-imposed client-side rate limit (DESIGN.md section 9.3). Authentik does + ** not throttle authenticated API calls at all, and kof22's Authentik shares the + ** website's Postgres, so the qbit limits itself: a token bucket refilled at + ** requestsPerSecond, holding at most burst tokens. acquire() blocks until a + ** token is available. Shared by all requests of one qbit instance. + *******************************************************************************/ +public class TokenBucketThrottle +{ + private final double tokensPerNano; + private final double burst; + private final LongSupplier nanoClock; + private final LongConsumer nanoSleeper; + + private double tokens; + private long lastRefillNanos; + + + + /******************************************************************************* + ** Constructor using the system clock. + *******************************************************************************/ + public TokenBucketThrottle(int requestsPerSecond, int burst) + { + this(requestsPerSecond, burst, System::nanoTime, TokenBucketThrottle::sleepNanos); + } + + + + /******************************************************************************* + ** Constructor with an injectable clock and sleeper (for tests). + *******************************************************************************/ + public TokenBucketThrottle(int requestsPerSecond, int burst, LongSupplier nanoClock, LongConsumer nanoSleeper) + { + if(requestsPerSecond < 1) + { + throw (new IllegalArgumentException("requestsPerSecond must be at least 1")); + } + this.tokensPerNano = requestsPerSecond / 1_000_000_000.0; + this.burst = Math.max(1, burst); + this.nanoClock = nanoClock; + this.nanoSleeper = nanoSleeper; + this.tokens = this.burst; + this.lastRefillNanos = nanoClock.getAsLong(); + } + + + + /******************************************************************************* + ** Take one token, waiting as long as needed. + *******************************************************************************/ + public void acquire() + { + long waitNanos; + synchronized(this) + { + refill(); + tokens -= 1; + waitNanos = tokens >= 0 ? 0 : (long) Math.ceil(-tokens / tokensPerNano); + } + + if(waitNanos > 0) + { + nanoSleeper.accept(waitNanos); + } + } + + + + /******************************************************************************* + ** Tokens currently available (may be negative while callers are waiting). + *******************************************************************************/ + public synchronized double getAvailableTokens() + { + refill(); + return (tokens); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private void refill() + { + long now = nanoClock.getAsLong(); + long elapsed = now - lastRefillNanos; + if(elapsed > 0) + { + tokens = Math.min(burst, tokens + elapsed * tokensPerNano); + lastRefillNanos = now; + } + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private static void sleepNanos(long nanos) + { + try + { + Thread.sleep(nanos / 1_000_000, (int) (nanos % 1_000_000)); + } + catch(InterruptedException e) + { + Thread.currentThread().interrupt(); + } + } + +} diff --git a/src/main/java/com/kingsrook/qbits/authentik/metadata/AbstractAuthentikTableProducer.java b/src/main/java/com/kingsrook/qbits/authentik/metadata/AbstractAuthentikTableProducer.java new file mode 100644 index 0000000..9ecb626 --- /dev/null +++ b/src/main/java/com/kingsrook/qbits/authentik/metadata/AbstractAuthentikTableProducer.java @@ -0,0 +1,121 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik.metadata; + + +import com.kingsrook.qbits.authentik.AuthentikFeature; +import com.kingsrook.qbits.authentik.AuthentikQBitConfig; +import com.kingsrook.qbits.authentik.AuthentikRuntime; +import com.kingsrook.qbits.authentik.client.AuthentikFieldSpec; +import com.kingsrook.qbits.authentik.client.AuthentikTableSpec; +import com.kingsrook.qbits.authentik.client.AuthentikTables; +import com.kingsrook.qqq.backend.core.exceptions.QException; +import com.kingsrook.qqq.backend.core.model.metadata.QInstance; +import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData; +import com.kingsrook.qqq.backend.core.model.metadata.layout.QIcon; +import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitComponentMetaDataProducer; +import com.kingsrook.qqq.backend.core.model.metadata.tables.Capability; +import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData; +import com.kingsrook.qqq.backend.module.api.model.metadata.APITableBackendDetails; + + +/******************************************************************************* + ** Builds a read-only QQQ table from an AuthentikTableSpec and registers it + ** with the runtime. Subclasses name the spec. + *******************************************************************************/ +public abstract class AbstractAuthentikTableProducer extends QBitComponentMetaDataProducer +{ + + /******************************************************************************* + ** The unprefixed spec name, e.g. AuthentikTables.USER. + *******************************************************************************/ + protected abstract String getSpecName(); + + + + /******************************************************************************* + ** Tables need READ; subclasses may add conditions. + *******************************************************************************/ + @Override + public boolean isEnabled() + { + return (getQBitConfig() != null && getQBitConfig().hasFeature(AuthentikFeature.READ)); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @Override + public QTableMetaData produce(QInstance qInstance) throws QException + { + return (buildTable(getQBitConfig(), AuthentikTables.get(getSpecName()))); + } + + + + /******************************************************************************* + ** Build the table and register it with the config's runtime. + *******************************************************************************/ + public static QTableMetaData buildTable(AuthentikQBitConfig config, AuthentikTableSpec spec) + { + String tableName = config.applyPrefix(spec.getName()); + + QTableMetaData table = new QTableMetaData() + .withName(tableName) + .withLabel(spec.getLabel()) + .withIcon(new QIcon(spec.getIcon())) + .withBackendName(config.getApiBackendName()) + .withPrimaryKeyField(spec.getKeyFieldName()) + .withBackendDetails(new APITableBackendDetails().withTablePath(spec.getPath())) + .withPermissionRules(spec.getReadPermission().rules()) + .withCapabilities(Capability.TABLE_QUERY, Capability.TABLE_GET, Capability.TABLE_COUNT, Capability.TABLE_EXPORT) + .withoutCapabilities(Capability.TABLE_INSERT, Capability.TABLE_UPDATE, Capability.TABLE_DELETE, Capability.QUERY_STATS); + + for(AuthentikFieldSpec field : spec.getFields()) + { + QFieldMetaData fieldMetaData = new QFieldMetaData(field.getName(), field.getType()).withLabel(field.getLabel()); + if(field.isHidden()) + { + fieldMetaData.withIsHidden(true); + } + table.withField(fieldMetaData); + } + + if(!spec.getRecordLabelFields().isEmpty()) + { + table.withRecordLabelFormat(String.join(" ", spec.getRecordLabelFields().stream().map(f -> "%s").toList())); + table.withRecordLabelFields(spec.getRecordLabelFields()); + } + + AuthentikRuntime.forBackend(config.getApiBackendName()).registerTable(tableName, spec); + return (table); + } + + + + /******************************************************************************* + ** After the backend. + *******************************************************************************/ + @Override + public int getSortOrder() + { + return (200); + } + +} diff --git a/src/main/java/com/kingsrook/qbits/authentik/metadata/AuthentikAppMetaDataProducer.java b/src/main/java/com/kingsrook/qbits/authentik/metadata/AuthentikAppMetaDataProducer.java new file mode 100644 index 0000000..4e62537 --- /dev/null +++ b/src/main/java/com/kingsrook/qbits/authentik/metadata/AuthentikAppMetaDataProducer.java @@ -0,0 +1,85 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik.metadata; + + +import com.kingsrook.qbits.authentik.AuthentikQBitConfig; +import com.kingsrook.qbits.authentik.client.AuthentikTables; +import com.kingsrook.qbits.authentik.security.IdentityPermission; +import com.kingsrook.qqq.backend.core.exceptions.QException; +import com.kingsrook.qqq.backend.core.model.metadata.MetaDataProducerMultiOutput; +import com.kingsrook.qqq.backend.core.model.metadata.QInstance; +import com.kingsrook.qqq.backend.core.model.metadata.layout.QAppMetaData; +import com.kingsrook.qqq.backend.core.model.metadata.layout.QIcon; +import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitComponentMetaDataProducer; +import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitProductionContext; +import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData; + + +/******************************************************************************* + ** The "Identity" app (DESIGN.md section 8.1): the qbit's tables (and, from + ** phase 1, its widgets), gated by identity.users.read. Hosts re-parent it, e.g. + ** kof22 nests it under Admin; its name stays the same. Processes are only + ** ever table or record actions, never navigation entries. + *******************************************************************************/ +public class AuthentikAppMetaDataProducer extends QBitComponentMetaDataProducer +{ + public static final String APP_NAME = "admin"; + + + + /******************************************************************************* + ** + *******************************************************************************/ + @Override + public QAppMetaData produce(QInstance qInstance) throws QException + { + AuthentikQBitConfig config = getQBitConfig(); + + QAppMetaData app = new QAppMetaData() + .withName(config.applyPrefix(APP_NAME)) + .withLabel("Identity") + .withIcon(new QIcon("badge")) + .withPermissionRules(IdentityPermission.USERS_READ.rules()); + + MetaDataProducerMultiOutput produced = QBitProductionContext.peekMetaDataProducerMultiOutput(); + if(produced != null) + { + for(String specName : AuthentikTables.all().keySet()) + { + QTableMetaData table = produced.get(QTableMetaData.class, config.applyPrefix(specName)); + if(table != null) + { + app.withChild(table); + } + } + } + return (app); + } + + + + /******************************************************************************* + ** Last, so the tables exist in the output. + *******************************************************************************/ + @Override + public int getSortOrder() + { + return (900); + } + +} diff --git a/src/main/java/com/kingsrook/qbits/authentik/metadata/AuthentikBackendMetaDataProducer.java b/src/main/java/com/kingsrook/qbits/authentik/metadata/AuthentikBackendMetaDataProducer.java new file mode 100644 index 0000000..840562f --- /dev/null +++ b/src/main/java/com/kingsrook/qbits/authentik/metadata/AuthentikBackendMetaDataProducer.java @@ -0,0 +1,65 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik.metadata; + + +import com.kingsrook.qbits.authentik.AuthentikQBitConfig; +import com.kingsrook.qbits.authentik.client.AuthentikActionUtil; +import com.kingsrook.qqq.backend.core.exceptions.QException; +import com.kingsrook.qqq.backend.core.model.metadata.QInstance; +import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference; +import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitComponentMetaDataProducer; +import com.kingsrook.qqq.backend.module.api.model.AuthorizationType; +import com.kingsrook.qqq.backend.module.api.model.metadata.APIBackendMetaData; + + +/******************************************************************************* + ** The API backend all Authentik tables use. Authorization is CUSTOM: the + ** action util adds the bearer token itself, from the qbit config, so the token + ** never sits in backend metadata (which QQQ can serialize). + *******************************************************************************/ +public class AuthentikBackendMetaDataProducer extends QBitComponentMetaDataProducer +{ + + /******************************************************************************* + ** + *******************************************************************************/ + @Override + public APIBackendMetaData produce(QInstance qInstance) throws QException + { + AuthentikQBitConfig config = getQBitConfig(); + APIBackendMetaData backend = new APIBackendMetaData() + .withBaseUrl(config.getApiRoot()) + .withAuthorizationType(AuthorizationType.CUSTOM) + .withContentType("application/json") + .withActionUtil(new QCodeReference(AuthentikActionUtil.class)); + backend.setName(config.getApiBackendName()); + return (backend); + } + + + + /******************************************************************************* + ** First: the tables reference it. + *******************************************************************************/ + @Override + public int getSortOrder() + { + return (100); + } + +} diff --git a/src/main/java/com/kingsrook/qbits/authentik/metadata/AuthentikGroupTableProducer.java b/src/main/java/com/kingsrook/qbits/authentik/metadata/AuthentikGroupTableProducer.java new file mode 100644 index 0000000..bc28501 --- /dev/null +++ b/src/main/java/com/kingsrook/qbits/authentik/metadata/AuthentikGroupTableProducer.java @@ -0,0 +1,38 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik.metadata; + + +import com.kingsrook.qbits.authentik.client.AuthentikTables; + + +/******************************************************************************* + ** authentikGroup: /core/groups/. + *******************************************************************************/ +public class AuthentikGroupTableProducer extends AbstractAuthentikTableProducer +{ + + /******************************************************************************* + ** + *******************************************************************************/ + @Override + protected String getSpecName() + { + return (AuthentikTables.GROUP); + } + +} diff --git a/src/main/java/com/kingsrook/qbits/authentik/metadata/AuthentikUserTableProducer.java b/src/main/java/com/kingsrook/qbits/authentik/metadata/AuthentikUserTableProducer.java new file mode 100644 index 0000000..1ea0c99 --- /dev/null +++ b/src/main/java/com/kingsrook/qbits/authentik/metadata/AuthentikUserTableProducer.java @@ -0,0 +1,38 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik.metadata; + + +import com.kingsrook.qbits.authentik.client.AuthentikTables; + + +/******************************************************************************* + ** authentikUser: /core/users/. + *******************************************************************************/ +public class AuthentikUserTableProducer extends AbstractAuthentikTableProducer +{ + + /******************************************************************************* + ** + *******************************************************************************/ + @Override + protected String getSpecName() + { + return (AuthentikTables.USER); + } + +} diff --git a/src/main/java/com/kingsrook/qbits/authentik/security/AuthentikGuard.java b/src/main/java/com/kingsrook/qbits/authentik/security/AuthentikGuard.java new file mode 100644 index 0000000..1d71bf7 --- /dev/null +++ b/src/main/java/com/kingsrook/qbits/authentik/security/AuthentikGuard.java @@ -0,0 +1,255 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik.security; + + +import java.util.List; +import java.util.Locale; +import com.kingsrook.qbits.authentik.AuthentikFeature; +import com.kingsrook.qbits.authentik.AuthentikQBitConfig; +import com.kingsrook.qbits.authentik.client.AuthentikJson; +import com.kingsrook.qbits.authentik.client.AuthentikTableSpec; +import com.kingsrook.qbits.authentik.client.AuthentikTables; +import com.kingsrook.qqq.backend.core.context.QContext; +import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException; +import com.kingsrook.qqq.backend.core.model.session.QSession; +import com.kingsrook.qqq.backend.core.model.session.QSystemUserSession; +import com.kingsrook.qqq.backend.core.utils.CollectionUtils; +import com.kingsrook.qqq.backend.core.utils.StringUtils; +import org.json.JSONArray; +import org.json.JSONObject; + + +/******************************************************************************* + ** The qbit's own enforcement point (DESIGN.md section 5.3). QQQ core actions + ** do not enforce permissions for non-HTTP callers (QRun-IO/qqq#1061), so every + ** call into AuthentikActionUtil is checked here first: + ** - reads need the table's identity.* permission (system sessions may read, + ** for the mirror sync); + ** - sensitive fields need identity.audit.read; + ** - writes are refused in this release (read-only MVP), and always refused + ** for system sessions, in readOnly mode, or without the feature; + ** - records outside userScope are invisible. + ** + ** Protection rules for targets (protected accounts, superuser ancestry) are + ** computed here too, so the UI can show them before writes exist. + *******************************************************************************/ +public class AuthentikGuard +{ + private final AuthentikQBitConfig config; + + + + /******************************************************************************* + ** Constructor. + *******************************************************************************/ + public AuthentikGuard(AuthentikQBitConfig config) + { + this.config = config; + } + + + + /******************************************************************************* + ** Check that the current session may read a table. + *******************************************************************************/ + public void checkRead(AuthentikTableSpec spec) throws QPermissionDeniedException + { + QSession session = QContext.getQSession(); + if(!config.hasFeature(AuthentikFeature.READ)) + { + throw (new QPermissionDeniedException("Authentik reads are not enabled.")); + } + if(session instanceof QSystemUserSession) + { + return; + } + requireUser(session); + if(!has(session, spec.getReadPermission())) + { + throw (new QPermissionDeniedException("You do not have permission to view " + spec.getLabel() + ".")); + } + } + + + + /******************************************************************************* + ** Writes: refused in this release. Kept as the single gate later phases + ** extend (feature flags, readOnly, system sessions, per-target rules). + *******************************************************************************/ + public void checkWrite(AuthentikTableSpec spec, String operation) throws QPermissionDeniedException + { + QSession session = QContext.getQSession(); + if(session instanceof QSystemUserSession) + { + throw (new QPermissionDeniedException("System sessions may not change Authentik data.")); + } + if(Boolean.TRUE.equals(config.getReadOnly())) + { + throw (new QPermissionDeniedException("The Identity screens are in read-only mode.")); + } + throw (new QPermissionDeniedException(spec.getLabel() + " cannot be changed from QQQ in this release (" + operation + " is not available; use the Authentik admin UI).")); + } + + + + /******************************************************************************* + ** Whether the current session may see and filter sensitive fields. + *******************************************************************************/ + public boolean maySeeSensitive() + { + QSession session = QContext.getQSession(); + return (session instanceof QSystemUserSession || has(session, IdentityPermission.AUDIT_READ)); + } + + + + /******************************************************************************* + ** Whether a user object is inside the configured user scope. Applied to + ** every record returned, in addition to the server-side scope filters. + *******************************************************************************/ + public boolean isUserInScope(JSONObject user) + { + String type = user.optString("type", ""); + if(!List.of(AuthentikTables.DEFAULT_USER_TYPES).contains(type)) + { + return (false); + } + + if(StringUtils.hasContent(config.getUserScopePathStartsWith()) && !user.optString("path", "").startsWith(config.getUserScopePathStartsWith())) + { + return (false); + } + + List scopeGroups = CollectionUtils.nonNullList(config.getUserScopeGroupNames()); + if(!scopeGroups.isEmpty()) + { + JSONArray groups = user.optJSONArray("groups_obj"); + if(groups == null) + { + return (false); + } + for(int i = 0; i < groups.length(); i++) + { + JSONObject group = groups.optJSONObject(i); + if(group != null && scopeGroups.contains(group.optString("name"))) + { + return (true); + } + } + return (false); + } + return (true); + } + + + + /******************************************************************************* + ** Whether a user is protected from all qbit actions (DESIGN.md section + ** 5.4 rule 1): the service account, users with qqq.io/protected: true, + ** configured protectedUsernames, and superusers (including superuser + ** status inherited through group parents, which Authentik reports in + ** is_superuser). + *******************************************************************************/ + public ProtectionResult protection(JSONObject user) + { + String username = user.optString("username", ""); + if(username.equalsIgnoreCase(config.getEffectiveServiceAccountUsername())) + { + return (ProtectionResult.of("the qbit's own service account")); + } + if(user.optBoolean("is_superuser", false)) + { + return (ProtectionResult.of("Authentik superuser")); + } + JSONObject attributes = user.optJSONObject("attributes"); + if(attributes != null && isTrue(attributes.opt(AuthentikJson.ATTR_PROTECTED))) + { + return (ProtectionResult.of("marked qqq.io/protected")); + } + for(String protectedName : CollectionUtils.nonNullList(config.getProtectedUsernames())) + { + if(username.equalsIgnoreCase(protectedName)) + { + return (ProtectionResult.of("listed in protectedUsernames")); + } + } + if("internal_service_account".equals(user.optString("type"))) + { + return (ProtectionResult.of("Authentik internal service account")); + } + return (ProtectionResult.NOT_PROTECTED); + } + + + + /******************************************************************************* + ** Whether the session holds an identity permission. + *******************************************************************************/ + public static boolean has(QSession session, IdentityPermission permission) + { + return (session != null && session.hasPermission(permission.getSessionPermission())); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private static void requireUser(QSession session) throws QPermissionDeniedException + { + if(session == null || session.getUser() == null) + { + throw (new QPermissionDeniedException("A signed-in user is required.")); + } + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private static boolean isTrue(Object value) + { + if(value instanceof Boolean b) + { + return (b); + } + return (value != null && String.valueOf(value).trim().toLowerCase(Locale.ROOT).equals("true")); + } + + + + /******************************************************************************* + ** Result of a protection check. + *******************************************************************************/ + public record ProtectionResult(boolean isProtected, String reason) + { + public static final ProtectionResult NOT_PROTECTED = new ProtectionResult(false, null); + + + + /******************************************************************************* + ** A protected result with a reason. + *******************************************************************************/ + public static ProtectionResult of(String reason) + { + return (new ProtectionResult(true, reason)); + } + } + +} diff --git a/src/main/java/com/kingsrook/qbits/authentik/security/IdentityPermission.java b/src/main/java/com/kingsrook/qbits/authentik/security/IdentityPermission.java new file mode 100644 index 0000000..a2255a7 --- /dev/null +++ b/src/main/java/com/kingsrook/qbits/authentik/security/IdentityPermission.java @@ -0,0 +1,118 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik.security; + + +import java.util.Optional; +import com.kingsrook.qqq.backend.core.model.metadata.permissions.PermissionLevel; +import com.kingsrook.qqq.backend.core.model.metadata.permissions.QPermissionRules; + + +/******************************************************************************* + ** The qbit's own QQQ permissions (DESIGN.md section 5.2). + ** + ** Operators write the short name (e.g. "identity.users.read") into a group's + ** qqq.io/permissions attribute; "identity.*" means all of them. In a QQQ + ** session each one is held as its HAS_ACCESS form, the short name plus + ** ".hasAccess", which is what QQQ's PermissionsHelper checks for metadata + ** guarded by {@link #rules()}. + *******************************************************************************/ +public enum IdentityPermission +{ + USERS_READ("identity.users.read"), + USERS_MANAGE("identity.users.manage"), + GROUPS_MANAGE("identity.groups.manage"), + MEMBERSHIPS_MANAGE("identity.memberships.manage"), + PERMISSIONS_MANAGE("identity.permissions.manage"), + ROLES_MANAGE("identity.roles.manage"), + CREDENTIALS_RESET("identity.credentials.reset"), + SESSIONS_REVOKE("identity.sessions.revoke"), + AUDIT_READ("identity.audit.read"), + APPROVE("identity.approve"), + ADMIN("identity.admin"); + + /** The wildcard operators write for "all identity permissions". */ + public static final String WILDCARD = "identity.*"; + + /** Suffix QQQ uses for HAS_ACCESS permissions. */ + public static final String HAS_ACCESS_SUFFIX = ".hasAccess"; + + private final String shortName; + + + + /******************************************************************************* + ** Constructor. + *******************************************************************************/ + IdentityPermission(String shortName) + { + this.shortName = shortName; + } + + + + /******************************************************************************* + ** The name written in qqq.io/permissions, e.g. "identity.users.read". + *******************************************************************************/ + public String getShortName() + { + return (shortName); + } + + + + /******************************************************************************* + ** The QQQ session permission, e.g. "identity.users.read.hasAccess". + *******************************************************************************/ + public String getSessionPermission() + { + return (shortName + HAS_ACCESS_SUFFIX); + } + + + + /******************************************************************************* + ** Permission rules guarding metadata by this permission. + *******************************************************************************/ + public QPermissionRules rules() + { + return (new QPermissionRules().withLevel(PermissionLevel.HAS_ACCESS_PERMISSION).withPermissionBaseName(shortName)); + } + + + + /******************************************************************************* + ** Look up by short name or by session permission name. + *******************************************************************************/ + public static Optional fromName(String name) + { + if(name == null) + { + return (Optional.empty()); + } + + for(IdentityPermission permission : values()) + { + if(permission.shortName.equals(name) || permission.getSessionPermission().equals(name)) + { + return (Optional.of(permission)); + } + } + return (Optional.empty()); + } + +} diff --git a/src/test/java/com/kingsrook/qbits/authentik/AuthentikQBitConfigTest.java b/src/test/java/com/kingsrook/qbits/authentik/AuthentikQBitConfigTest.java new file mode 100644 index 0000000..155598d --- /dev/null +++ b/src/test/java/com/kingsrook/qbits/authentik/AuthentikQBitConfigTest.java @@ -0,0 +1,153 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik; + + +import java.util.ArrayList; +import java.util.EnumSet; +import java.util.List; +import com.fasterxml.jackson.databind.ObjectMapper; +import com.kingsrook.qqq.backend.core.model.metadata.QInstance; +import org.junit.jupiter.api.Test; +import static org.assertj.core.api.Assertions.assertThat; + + +/******************************************************************************* + ** Tests for AuthentikQBitConfig. + *******************************************************************************/ +class AuthentikQBitConfigTest +{ + + /******************************************************************************* + ** + *******************************************************************************/ + private static List errors(AuthentikQBitConfig config) + { + List errors = new ArrayList<>(); + config.validate(new QInstance(), errors); + return (errors); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @Test + void validConfigHasNoErrors() + { + assertThat(errors(AuthentikTestSupport.unitConfig())).isEmpty(); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @Test + void requiredSettings() + { + List errors = errors(new AuthentikQBitConfig()); + assertThat(errors).anyMatch(e -> e.contains("baseUrl is required")); + assertThat(errors).anyMatch(e -> e.contains("apiToken is required")); + assertThat(errors).anyMatch(e -> e.contains("appKey is required")); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @Test + void baseUrlMustBeHostRoot() + { + assertThat(errors(AuthentikTestSupport.unitConfig().withBaseUrl("ftp://x"))).anyMatch(e -> e.contains("absolute http(s)")); + assertThat(errors(AuthentikTestSupport.unitConfig().withBaseUrl("https://auth.example.test/api/v3"))).anyMatch(e -> e.contains("host root")); + assertThat(errors(AuthentikTestSupport.unitConfig().withBaseUrl("not a url at all"))).isNotEmpty(); + assertThat(AuthentikTestSupport.unitConfig().withBaseUrl("https://auth.example.test//").getApiRoot()).isEqualTo("https://auth.example.test/api/v3"); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @Test + void unavailableFeaturesAndDependencies() + { + assertThat(errors(AuthentikTestSupport.unitConfig().withFeatures(EnumSet.of(AuthentikFeature.READ, AuthentikFeature.MEMBERSHIP)))) + .anyMatch(e -> e.contains("MEMBERSHIP is not available")); + assertThat(errors(AuthentikTestSupport.unitConfig().withFeatures(EnumSet.of(AuthentikFeature.MIRROR)))).anyMatch(e -> e.contains("READ is required")); + assertThat(errors(AuthentikTestSupport.unitConfig().withFeatures(EnumSet.of(AuthentikFeature.READ, AuthentikFeature.MIRROR)))).anyMatch(e -> e.contains("mirrorBackendName")); + assertThat(errors(AuthentikTestSupport.unitConfig().withFeatures(EnumSet.of(AuthentikFeature.READ, AuthentikFeature.MIRROR)).withMirrorBackendName("nope"))) + .anyMatch(e -> e.contains("backend not found")); + assertThat(errors(AuthentikTestSupport.unitConfig().withFeatures(EnumSet.of(AuthentikFeature.READ, AuthentikFeature.USERS)))).anyMatch(e -> e.contains("recoveryEmailStage")); + assertThat(errors(AuthentikTestSupport.unitConfig().withFeatures(EnumSet.of(AuthentikFeature.READ, AuthentikFeature.WEBHOOK)).withWebhookSecret(null))).anyMatch(e -> e.contains("webhookSecret")); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @Test + void numericAndNameSettings() + { + assertThat(errors(AuthentikTestSupport.unitConfig().withThrottleRequestsPerSecond(0))).anyMatch(e -> e.contains("at least 1")); + assertThat(errors(AuthentikTestSupport.unitConfig().withListCacheTtlSeconds(-1))).anyMatch(e -> e.contains("non-negative")); + assertThat(errors(AuthentikTestSupport.unitConfig().withTableNamePrefix("9bad"))).anyMatch(e -> e.contains("tableNamePrefix")); + assertThat(errors(AuthentikTestSupport.unitConfig().withAppKey("Bad Key"))).anyMatch(e -> e.contains("appKey")); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @Test + void secretsResolveAndNeverPrint() throws Exception + { + AuthentikQBitConfig config = AuthentikTestSupport.unitConfig().withApiToken("${env.QBIT_AUTHENTIK_TEST_UNSET_VARIABLE}"); + assertThat(config.getResolvedApiToken()).isNull(); + assertThat(errors(config)).anyMatch(e -> e.contains("apiToken")); + + AuthentikQBitConfig literal = AuthentikTestSupport.unitConfig(); + assertThat(literal.getResolvedApiToken()).isEqualTo(AuthentikTestSupport.TEST_TOKEN); + assertThat(literal.toString()).doesNotContain(AuthentikTestSupport.TEST_TOKEN).contains("******"); + + String json = new ObjectMapper().writeValueAsString(literal.withWebhookSecret("hook-secret-value")); + assertThat(json).doesNotContain(AuthentikTestSupport.TEST_TOKEN).doesNotContain("hook-secret-value"); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @Test + void derivedNames() + { + AuthentikQBitConfig config = AuthentikTestSupport.unitConfig(); + assertThat(config.applyPrefix("user")).isEqualTo("authentikUser"); + assertThat(config.getApiBackendName()).isEqualTo("authentikApi"); + assertThat(config.getEffectiveServiceAccountUsername()).isEqualTo("qqq-kof22-admin-idadmin"); + assertThat(config.withServiceAccountUsername("custom-sa").getEffectiveServiceAccountUsername()).isEqualTo("custom-sa"); + assertThat(new AuthentikQBitConfig().withTableNamePrefix("").applyPrefix("user")).isEqualTo("user"); + assertThat(config.withBootstrapOperators(" A@x.test, ,b@x.test ").getResolvedBootstrapOperators()).containsExactly("a@x.test", "b@x.test"); + } + +} diff --git a/src/test/java/com/kingsrook/qbits/authentik/AuthentikQBitProducerTest.java b/src/test/java/com/kingsrook/qbits/authentik/AuthentikQBitProducerTest.java new file mode 100644 index 0000000..d421b4d --- /dev/null +++ b/src/test/java/com/kingsrook/qbits/authentik/AuthentikQBitProducerTest.java @@ -0,0 +1,121 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik; + + +import com.kingsrook.qbits.authentik.client.AuthentikActionUtil; +import com.kingsrook.qbits.authentik.security.IdentityPermission; +import com.kingsrook.qqq.backend.core.actions.permissions.PermissionsHelper; +import com.kingsrook.qqq.backend.core.exceptions.QException; +import com.kingsrook.qqq.backend.core.model.metadata.QInstance; +import com.kingsrook.qqq.backend.core.model.metadata.layout.QAppMetaData; +import com.kingsrook.qqq.backend.core.model.metadata.tables.Capability; +import com.kingsrook.qqq.backend.core.model.metadata.tables.QTableMetaData; +import com.kingsrook.qqq.backend.module.api.model.AuthorizationType; +import com.kingsrook.qqq.backend.module.api.model.metadata.APIBackendMetaData; +import org.junit.jupiter.api.Test; +import static org.assertj.core.api.Assertions.assertThat; +import static org.assertj.core.api.Assertions.assertThatThrownBy; + + +/******************************************************************************* + ** Tests for AuthentikQBitProducer. + *******************************************************************************/ +class AuthentikQBitProducerTest +{ + + /******************************************************************************* + ** + *******************************************************************************/ + @Test + void producesBackendTablesAndApp() throws QException + { + AuthentikQBitConfig config = AuthentikTestSupport.unitConfig(); + QInstance qInstance = AuthentikTestSupport.produce(config); + + APIBackendMetaData backend = (APIBackendMetaData) qInstance.getBackend("authentikApi"); + assertThat(backend.getBaseUrl()).isEqualTo("https://authentik.example.test/api/v3"); + assertThat(backend.getAuthorizationType()).isEqualTo(AuthorizationType.CUSTOM); + assertThat(backend.getApiKey()).isNull(); + assertThat(backend.getActionUtil().getName()).isEqualTo(AuthentikActionUtil.class.getName()); + + QTableMetaData users = qInstance.getTable("authentikUser"); + assertThat(users.getBackendName()).isEqualTo("authentikApi"); + assertThat(users.getPrimaryKeyField()).isEqualTo("pk"); + assertThat(users.getPermissionRules().getPermissionBaseName()).isEqualTo("identity.users.read"); + assertThat(users.isCapabilityEnabled(qInstance.getBackend("authentikApi"), Capability.TABLE_QUERY)).isTrue(); + assertThat(users.isCapabilityEnabled(qInstance.getBackend("authentikApi"), Capability.TABLE_INSERT)).isFalse(); + assertThat(users.isCapabilityEnabled(qInstance.getBackend("authentikApi"), Capability.TABLE_DELETE)).isFalse(); + assertThat(users.getField("uuid").getIsHidden()).isTrue(); + assertThat(qInstance.getTable("authentikGroup")).isNotNull(); + + QAppMetaData app = qInstance.getApp("authentikAdmin"); + assertThat(app.getLabel()).isEqualTo("Identity"); + assertThat(app.getChildren()).extracting(c -> c.getName()).containsExactly("authentikUser", "authentikGroup"); + + assertThat(PermissionsHelper.getAllAvailablePermissionNames(qInstance)).contains(IdentityPermission.USERS_READ.getSessionPermission()); + assertThat(qInstance.getQBits()).containsKey("com.kingsrook.qbits:authentik"); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @Test + void namespaceBecomesPrefix() throws QException + { + AuthentikQBitConfig config = AuthentikTestSupport.unitConfig().withTableNamePrefix(null); + QInstance qInstance = new QInstance(); + new AuthentikQBitProducer().withQBitConfig(config).withNamespace("idp").produce(qInstance); + assertThat(qInstance.getTable("idpUser")).isNotNull(); + assertThat(qInstance.getBackend("idpApi")).isNotNull(); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @Test + void invalidConfigFailsWithAllErrors() + { + assertThatThrownBy(() -> new AuthentikQBitProducer().produce(new QInstance())).hasMessageContaining("no config"); + assertThatThrownBy(() -> new AuthentikQBitProducer().withQBitConfig(new AuthentikQBitConfig()).produce(new QInstance())) + .hasMessageContaining("baseUrl").hasMessageContaining("apiToken").hasMessageContaining("appKey"); + assertThat(new AuthentikQBitProducer().isEnabled()).isFalse(); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @Test + void identityAndVersion() + { + AuthentikQBitProducer producer = new AuthentikQBitProducer(); + producer.setQBitConfig(AuthentikTestSupport.unitConfig()); + assertThat(producer.getQBitMetaData().getArtifactId()).isEqualTo("authentik"); + assertThat(AuthentikQBitProducer.getVersion()).isNotBlank(); + assertThat(IdentityPermission.fromName("identity.audit.read")).contains(IdentityPermission.AUDIT_READ); + assertThat(IdentityPermission.fromName("identity.audit.read.hasAccess")).contains(IdentityPermission.AUDIT_READ); + assertThat(IdentityPermission.fromName("nope")).isEmpty(); + assertThat(IdentityPermission.fromName(null)).isEmpty(); + } + +} diff --git a/src/test/java/com/kingsrook/qbits/authentik/AuthentikTestSupport.java b/src/test/java/com/kingsrook/qbits/authentik/AuthentikTestSupport.java new file mode 100644 index 0000000..5b48889 --- /dev/null +++ b/src/test/java/com/kingsrook/qbits/authentik/AuthentikTestSupport.java @@ -0,0 +1,142 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik; + + +import java.io.IOException; +import java.io.InputStream; +import java.nio.charset.StandardCharsets; +import java.util.Arrays; +import java.util.HashSet; +import java.util.Set; +import com.kingsrook.qbits.authentik.security.IdentityPermission; +import com.kingsrook.qqq.backend.core.context.QContext; +import com.kingsrook.qqq.backend.core.exceptions.QException; +import com.kingsrook.qqq.backend.core.model.metadata.QAuthenticationType; +import com.kingsrook.qqq.backend.core.model.metadata.QInstance; +import com.kingsrook.qqq.backend.core.model.metadata.authentication.QAuthenticationMetaData; +import com.kingsrook.qqq.backend.core.model.metadata.code.QCodeReference; +import com.kingsrook.qqq.backend.core.model.session.QSession; +import com.kingsrook.qqq.backend.core.model.session.QUser; +import com.kingsrook.qqq.backend.module.api.model.metadata.APIBackendMetaData; + + +/******************************************************************************* + ** Shared test helpers: build a QInstance with the qbit, swap in a test action + ** util, and log in with chosen identity permissions. + *******************************************************************************/ +public final class AuthentikTestSupport +{ + public static final String TEST_TOKEN = "unit-test-token-abcdef0123456789"; + public static final String OPERATOR = "operator@example.test"; + + + + /******************************************************************************* + ** Not instantiable. + *******************************************************************************/ + private AuthentikTestSupport() + { + } + + + + /******************************************************************************* + ** A valid config for unit tests (fake host, literal token). + *******************************************************************************/ + public static AuthentikQBitConfig unitConfig() + { + return (new AuthentikQBitConfig() + .withBaseUrl("https://authentik.example.test") + .withApiToken(TEST_TOKEN) + .withAppKey("kof22-admin") + .withListCacheTtlSeconds(0) + .withThrottleRequestsPerSecond(1000) + .withThrottleBurst(1000)); + } + + + + /******************************************************************************* + ** A QInstance (MOCK auth) with the qbit produced from the config. + *******************************************************************************/ + public static QInstance produce(AuthentikQBitConfig config) throws QException + { + QInstance qInstance = new QInstance(); + qInstance.withInstanceDefaultAuthentication(new QAuthenticationMetaData().withName("mock").withType(QAuthenticationType.MOCK)); + new AuthentikQBitProducer().withQBitConfig(config).produce(qInstance); + return (qInstance); + } + + + + /******************************************************************************* + ** Point the qbit's API backend at a different action util class. + *******************************************************************************/ + public static void useActionUtil(QInstance qInstance, AuthentikQBitConfig config, Class actionUtilClass) + { + ((APIBackendMetaData) qInstance.getBackend(config.getApiBackendName())).setActionUtil(new QCodeReference(actionUtilClass)); + } + + + + /******************************************************************************* + ** Log in as the operator with the given identity permissions. + *******************************************************************************/ + public static QSession loginWith(QInstance qInstance, IdentityPermission... permissions) + { + Set names = new HashSet<>(); + Arrays.stream(permissions).forEach(p -> names.add(p.getSessionPermission())); + return (loginWithPermissions(qInstance, names)); + } + + + + /******************************************************************************* + ** Log in as the operator with raw QQQ permission names. + *******************************************************************************/ + public static QSession loginWithPermissions(QInstance qInstance, Set permissionNames) + { + QSession session = new QSession(); + session.setUser(new QUser().withIdReference(OPERATOR).withFullName("Test Operator")); + session.setPermissions(new HashSet<>(permissionNames)); + QContext.init(qInstance, session); + return (session); + } + + + + /******************************************************************************* + ** Read a classpath resource as text. + *******************************************************************************/ + public static String resource(String path) + { + try(InputStream inputStream = AuthentikTestSupport.class.getClassLoader().getResourceAsStream(path)) + { + if(inputStream == null) + { + throw (new IllegalArgumentException("No such test resource: " + path)); + } + return (new String(inputStream.readAllBytes(), StandardCharsets.UTF_8)); + } + catch(IOException e) + { + throw (new IllegalStateException(e)); + } + } + +} diff --git a/src/test/java/com/kingsrook/qbits/authentik/RequiresDockerCondition.java b/src/test/java/com/kingsrook/qbits/authentik/RequiresDockerCondition.java new file mode 100644 index 0000000..8b7dee4 --- /dev/null +++ b/src/test/java/com/kingsrook/qbits/authentik/RequiresDockerCondition.java @@ -0,0 +1,72 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik; + + +import org.junit.jupiter.api.extension.ConditionEvaluationResult; +import org.junit.jupiter.api.extension.ExecutionCondition; +import org.junit.jupiter.api.extension.ExtensionContext; +import org.testcontainers.DockerClientFactory; + + +/******************************************************************************* + ** JUnit condition for integration tests that need Docker. + ** + ** Without Docker, the tests are skipped on a developer machine, but fail when + ** CI=true, so a CI build can never pass with its integration tests silently + ** skipped. Register it ahead of @Testcontainers, so no container is started + ** when the tests are disabled. + *******************************************************************************/ +public class RequiresDockerCondition implements ExecutionCondition +{ + + /******************************************************************************* + ** Evaluate against the local Docker environment and the CI env var. + *******************************************************************************/ + @Override + public ConditionEvaluationResult evaluateExecutionCondition(ExtensionContext context) + { + return (evaluate(DockerClientFactory.instance().isDockerAvailable(), System.getenv("CI"))); + } + + + + /******************************************************************************* + ** Decide whether Docker-backed tests run, skip, or fail. + ** + ** @param dockerAvailable whether a usable Docker environment was found + ** @param ciValue value of the CI environment variable (may be null) + ** @return enabled when Docker is available; disabled when it is not and CI + ** is not "true" + ** @throws IllegalStateException when Docker is unavailable and CI is "true" + *******************************************************************************/ + static ConditionEvaluationResult evaluate(Boolean dockerAvailable, String ciValue) + { + if(Boolean.TRUE.equals(dockerAvailable)) + { + return (ConditionEvaluationResult.enabled("Docker is available")); + } + + if("true".equalsIgnoreCase(ciValue)) + { + throw (new IllegalStateException("Docker is required for integration tests when CI=true, but no usable Docker environment was found")); + } + + return (ConditionEvaluationResult.disabled("Docker is not available; skipping (with CI=true these tests fail instead)")); + } + +} diff --git a/src/test/java/com/kingsrook/qbits/authentik/RequiresDockerConditionTest.java b/src/test/java/com/kingsrook/qbits/authentik/RequiresDockerConditionTest.java new file mode 100644 index 0000000..ad52239 --- /dev/null +++ b/src/test/java/com/kingsrook/qbits/authentik/RequiresDockerConditionTest.java @@ -0,0 +1,75 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik; + + +import org.junit.jupiter.api.Test; +import org.junit.jupiter.api.extension.ConditionEvaluationResult; +import static org.assertj.core.api.Assertions.assertThat; +import static org.assertj.core.api.Assertions.assertThatThrownBy; + + +/******************************************************************************* + ** Tests for RequiresDockerCondition. + *******************************************************************************/ +class RequiresDockerConditionTest +{ + + /******************************************************************************* + ** Docker available: integration tests run, whether or not CI is set. + *******************************************************************************/ + @Test + void testEvaluate_dockerAvailable_enabled() + { + ConditionEvaluationResult local = RequiresDockerCondition.evaluate(true, null); + ConditionEvaluationResult ci = RequiresDockerCondition.evaluate(true, "true"); + + assertThat(local.isDisabled()).isFalse(); + assertThat(ci.isDisabled()).isFalse(); + } + + + + /******************************************************************************* + ** No Docker outside CI: integration tests are skipped. + *******************************************************************************/ + @Test + void testEvaluate_noDockerOutsideCi_disabled() + { + assertThat(RequiresDockerCondition.evaluate(false, null).isDisabled()).isTrue(); + assertThat(RequiresDockerCondition.evaluate(false, "").isDisabled()).isTrue(); + assertThat(RequiresDockerCondition.evaluate(false, "false").isDisabled()).isTrue(); + } + + + + /******************************************************************************* + ** No Docker with CI=true: evaluation throws, so the tests fail instead of + ** silently skipping. + *******************************************************************************/ + @Test + void testEvaluate_noDockerInCi_throws() + { + assertThatThrownBy(() -> RequiresDockerCondition.evaluate(false, "true")) + .isInstanceOf(IllegalStateException.class) + .hasMessageContaining("CI=true"); + + assertThatThrownBy(() -> RequiresDockerCondition.evaluate(false, "TRUE")) + .isInstanceOf(IllegalStateException.class); + } + +} diff --git a/src/test/java/com/kingsrook/qbits/authentik/SchemaDriftTest.java b/src/test/java/com/kingsrook/qbits/authentik/SchemaDriftTest.java new file mode 100644 index 0000000..4c52e63 --- /dev/null +++ b/src/test/java/com/kingsrook/qbits/authentik/SchemaDriftTest.java @@ -0,0 +1,177 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik; + + +import java.io.File; +import java.io.IOException; +import java.util.ArrayList; +import java.util.Iterator; +import java.util.LinkedHashSet; +import java.util.List; +import java.util.Map; +import java.util.Set; +import com.fasterxml.jackson.databind.JsonNode; +import com.fasterxml.jackson.databind.ObjectMapper; +import com.fasterxml.jackson.dataformat.yaml.YAMLFactory; +import com.kingsrook.qbits.authentik.client.AuthentikApiSurface; +import org.junit.jupiter.api.Test; +import org.yaml.snakeyaml.LoaderOptions; +import static org.assertj.core.api.Assertions.assertThat; + + +/******************************************************************************* + ** Schema drift test (DESIGN.md section 10): every operation and query + ** parameter the qbit uses exists in the Authentik OpenAPI schema. + ** + ** By default it reads the pinned 2026.8.3 schema + ** (src/test/resources/authentik/schema-2026.8.3.yml, fetched unauthenticated + ** from https://auth.kof22.com/api/v3/schema/). The scheduled schema-drift + ** workflow runs it with -Dauthentik.schema.file=. + *******************************************************************************/ +public class SchemaDriftTest +{ + public static final String PINNED_VERSION = "2026.8.3"; + + + + /******************************************************************************* + ** Parse an OpenAPI YAML file (the schema is ~1.8 MB). + *******************************************************************************/ + public static JsonNode loadSchema(String text) throws IOException + { + LoaderOptions options = new LoaderOptions(); + options.setCodePointLimit(64 * 1024 * 1024); + YAMLFactory factory = YAMLFactory.builder().loaderOptions(options).build(); + return (new ObjectMapper(factory).readTree(text)); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private static JsonNode schemaUnderTest() throws IOException + { + String file = System.getProperty("authentik.schema.file"); + if(file != null && !file.isBlank()) + { + return (loadSchema(java.nio.file.Files.readString(new File(file).toPath()))); + } + return (loadSchema(AuthentikTestSupport.resource("authentik/schema-" + PINNED_VERSION + ".yml"))); + } + + + + /******************************************************************************* + ** The pinned file is the version we claim. + *******************************************************************************/ + @Test + void pinnedSchemaIsTheTestedVersion() throws IOException + { + JsonNode schema = loadSchema(AuthentikTestSupport.resource("authentik/schema-" + PINNED_VERSION + ".yml")); + assertThat(schema.at("/info/version").asText()).isEqualTo(PINNED_VERSION); + } + + + + /******************************************************************************* + ** Every used operation and parameter exists. + *******************************************************************************/ + @Test + void everyUsedOperationAndParameterExists() throws IOException + { + List problems = findDrift(schemaUnderTest()); + assertThat(problems).as("Authentik API drift").isEmpty(); + } + + + + /******************************************************************************* + ** Compare the used surface against a schema; returns human-readable problems. + *******************************************************************************/ + public static List findDrift(JsonNode schema) + { + List problems = new ArrayList<>(); + JsonNode paths = schema.get("paths"); + for(AuthentikApiSurface.Operation operation : AuthentikApiSurface.operations()) + { + String schemaPath = findPath(paths, operation.path()); + JsonNode op = schemaPath == null ? null : paths.get(schemaPath).get(operation.method()); + if(op == null) + { + problems.add("missing operation " + operation.method().toUpperCase() + " " + operation.path()); + continue; + } + Set available = parameterNames(schema, op); + for(String param : operation.params()) + { + if(!available.contains(param)) + { + problems.add("missing parameter " + param + " on " + operation.method().toUpperCase() + " " + schemaPath); + } + } + } + return (problems); + } + + + + /******************************************************************************* + ** Parameters of an operation, resolving $refs. + *******************************************************************************/ + public static Set parameterNames(JsonNode schema, JsonNode operation) + { + Set rs = new LinkedHashSet<>(); + for(JsonNode parameter : operation.path("parameters")) + { + JsonNode resolved = parameter; + if(parameter.has("$ref")) + { + String ref = parameter.get("$ref").asText(); + resolved = schema.at(ref.substring(1)); + } + rs.add(resolved.path("name").asText()); + } + return (rs); + } + + + + /******************************************************************************* + ** Find the schema path for a surface path; "{key}" matches any {param}. + *******************************************************************************/ + static String findPath(JsonNode paths, String surfacePath) + { + if(paths.has(surfacePath)) + { + return (surfacePath); + } + String regex = surfacePath.replace("{key}", "\\{[^/]+\\}"); + Iterator> fields = paths.fields(); + while(fields.hasNext()) + { + String candidate = fields.next().getKey(); + if(candidate.matches(regex)) + { + return (candidate); + } + } + return (null); + } + +} diff --git a/src/test/java/com/kingsrook/qbits/authentik/client/AuthentikActionUtilTest.java b/src/test/java/com/kingsrook/qbits/authentik/client/AuthentikActionUtilTest.java new file mode 100644 index 0000000..9e1a71c --- /dev/null +++ b/src/test/java/com/kingsrook/qbits/authentik/client/AuthentikActionUtilTest.java @@ -0,0 +1,482 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik.client; + + +import java.net.URLDecoder; +import java.nio.charset.StandardCharsets; +import java.util.List; +import java.util.concurrent.atomic.AtomicInteger; +import com.kingsrook.qbits.authentik.AuthentikQBitConfig; +import com.kingsrook.qbits.authentik.AuthentikTestSupport; +import com.kingsrook.qbits.authentik.security.IdentityPermission; +import com.kingsrook.qqq.backend.core.actions.tables.CountAction; +import com.kingsrook.qqq.backend.core.actions.tables.DeleteAction; +import com.kingsrook.qqq.backend.core.actions.tables.GetAction; +import com.kingsrook.qqq.backend.core.actions.tables.InsertAction; +import com.kingsrook.qqq.backend.core.actions.tables.QueryAction; +import com.kingsrook.qqq.backend.core.actions.tables.UpdateAction; +import com.kingsrook.qqq.backend.core.context.QContext; +import com.kingsrook.qqq.backend.core.exceptions.QException; +import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException; +import com.kingsrook.qqq.backend.core.exceptions.QUserFacingException; +import com.kingsrook.qqq.backend.core.model.actions.tables.count.CountInput; +import com.kingsrook.qqq.backend.core.model.actions.tables.delete.DeleteInput; +import com.kingsrook.qqq.backend.core.model.actions.tables.get.GetInput; +import com.kingsrook.qqq.backend.core.model.actions.tables.insert.InsertInput; +import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator; +import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterCriteria; +import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter; +import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput; +import com.kingsrook.qqq.backend.core.model.actions.tables.update.UpdateInput; +import com.kingsrook.qqq.backend.core.model.data.QRecord; +import com.kingsrook.qqq.backend.core.model.metadata.QInstance; +import com.kingsrook.qqq.backend.core.model.session.QSystemUserSession; +import org.apache.http.client.methods.HttpRequestBase; +import org.json.JSONArray; +import org.json.JSONObject; +import org.junit.jupiter.api.AfterEach; +import org.junit.jupiter.api.BeforeEach; +import org.junit.jupiter.api.Test; +import static org.assertj.core.api.Assertions.assertThat; +import static org.assertj.core.api.Assertions.assertThatThrownBy; + + +/******************************************************************************* + ** Unit tests for AuthentikActionUtil over recorded 2026.8.3 fixtures + ** (src/test/resources/fixtures/2026.8.3, captured by the contract tests). + *******************************************************************************/ +class AuthentikActionUtilTest +{ + private QInstance qInstance; + private AuthentikQBitConfig config; + private String userTable; + private String groupTable; + + + + /******************************************************************************* + ** + *******************************************************************************/ + @BeforeEach + void beforeEach() throws QException + { + FixtureActionUtil.reset(); + config = AuthentikTestSupport.unitConfig(); + qInstance = AuthentikTestSupport.produce(config); + AuthentikTestSupport.useActionUtil(qInstance, config, FixtureActionUtil.class); + userTable = config.applyPrefix("user"); + groupTable = config.applyPrefix("group"); + AuthentikTestSupport.loginWith(qInstance, IdentityPermission.USERS_READ); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @AfterEach + void afterEach() + { + QContext.clear(); + FixtureActionUtil.reset(); + } + + + + /******************************************************************************* + ** The recorded users page, sliced into Authentik-shaped pages. + *******************************************************************************/ + private static JSONArray recordedUsers() + { + return (new JSONObject(FixtureActionUtil.fixture("users-list")).getJSONArray("results")); + } + + + + /******************************************************************************* + ** Serve /core/users/ with real paging semantics over the recorded users. + *******************************************************************************/ + private static void serveUsersPaged() + { + JSONArray all = recordedUsers(); + FixtureActionUtil.handler = request -> + { + int page = Integer.parseInt(param(request, "page", "1")); + int pageSize = Integer.parseInt(param(request, "page_size", "20")); + int from = (page - 1) * pageSize; + JSONArray slice = new JSONArray(); + for(int i = from; i < Math.min(all.length(), from + pageSize); i++) + { + slice.put(all.get(i)); + } + int totalPages = (int) Math.ceil(all.length() / (double) pageSize); + JSONObject body = new JSONObject() + .put("pagination", new JSONObject().put("count", all.length()).put("current", page).put("total_pages", totalPages)) + .put("results", slice); + return (FixtureActionUtil.response(200, body.toString())); + }; + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private static String param(HttpRequestBase request, String name, String defaultValue) + { + String query = request.getURI().getRawQuery(); + if(query != null) + { + for(String pair : query.split("&")) + { + String[] parts = pair.split("=", 2); + if(parts[0].equals(name)) + { + return (URLDecoder.decode(parts[1], StandardCharsets.UTF_8)); + } + } + } + return (defaultValue); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private static List params(HttpRequestBase request, String name) + { + String query = request.getURI().getRawQuery(); + return (query == null ? List.of() : java.util.Arrays.stream(query.split("&")).filter(p -> p.startsWith(name + "=")).map(p -> URLDecoder.decode(p.substring(name.length() + 1), StandardCharsets.UTF_8)).toList()); + } + + + + /******************************************************************************* + ** The last /core/users/ list request (the once-per-JVM version check may + ** come after it). + *******************************************************************************/ + private static HttpRequestBase lastUsersRequest() + { + List users = FixtureActionUtil.REQUESTS.stream().filter(r -> r.getURI().getPath().endsWith("/core/users/")).toList(); + return (users.get(users.size() - 1)); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private List query(QQueryFilter filter) throws QException + { + QueryInput input = new QueryInput(userTable); + input.setFilter(filter); + return (new QueryAction().execute(input).getRecords()); + } + + + + /******************************************************************************* + ** Requests carry the bearer token, the default scope types, and + ** include_groups; pages are page/page_size based. + *******************************************************************************/ + @Test + void queryBuildsAuthentikRequests() throws QException + { + serveUsersPaged(); + List records = query(new QQueryFilter().withLimit(2).withSkip(2)); + assertThat(records).hasSize(2); + + HttpRequestBase request = FixtureActionUtil.REQUESTS.stream().filter(r -> r.getURI().getPath().endsWith("/core/users/")).findFirst().orElseThrow(); + assertThat(request.getFirstHeader("Authorization").getValue()).isEqualTo("Bearer " + AuthentikTestSupport.TEST_TOKEN); + assertThat(request.getURI().toString()).startsWith("https://authentik.example.test/api/v3/core/users/?"); + assertThat(params(request, "type")).containsExactly("internal", "external", "service_account"); + assertThat(param(request, "include_groups", null)).isEqualTo("true"); + assertThat(param(request, "page", null)).isEqualTo("2"); + assertThat(param(request, "page_size", null)).isEqualTo("2"); + assertThat(param(request, "ordering", null)).isEqualTo("username"); + } + + + + /******************************************************************************* + ** Non-aligned skip: 100-row pages from the right page and offset; an + ** unlimited query walks every page. + *******************************************************************************/ + @Test + void unalignedSkipAndUnlimitedQueries() throws QException + { + serveUsersPaged(); + JSONArray all = recordedUsers(); + + List odd = query(new QQueryFilter().withLimit(3).withSkip(1)); + assertThat(odd).extracting(r -> r.getValueString("username")).containsExactly( + all.getJSONObject(1).getString("username"), all.getJSONObject(2).getString("username"), all.getJSONObject(3).getString("username")); + assertThat(param(lastUsersRequest(), "page_size", null)).isEqualTo("100"); + + assertThat(query(new QQueryFilter())).hasSize(all.length()); + } + + + + /******************************************************************************* + ** Count reads pagination.count from a page_size=1 request. + *******************************************************************************/ + @Test + void countUsesPaginationCount() throws QException + { + serveUsersPaged(); + assertThat(new CountAction().execute(new CountInput(userTable)).getCount()).isEqualTo(recordedUsers().length()); + assertThat(param(lastUsersRequest(), "page_size", null)).isEqualTo("1"); + } + + + + /******************************************************************************* + ** Record mapping from the recorded user (computed and joined fields). + *******************************************************************************/ + @Test + void getMapsRecordedUser() throws QException + { + JSONObject user = new JSONObject(FixtureActionUtil.fixture("user-get")); + FixtureActionUtil.handler = r -> FixtureActionUtil.response(200, user.toString()); + + QRecord record = new GetAction().executeForRecord(new GetInput(userTable).withPrimaryKey(user.getInt("pk"))); + assertThat(record.getValueInteger("pk")).isEqualTo(user.getInt("pk")); + assertThat(record.getValueString("username")).isEqualTo(user.getString("username")); + assertThat(record.getValueBoolean("isActive")).isEqualTo(user.getBoolean("is_active")); + assertThat(record.getValue("dateJoined")).isInstanceOf(java.time.Instant.class); + assertThat(record.getValueBoolean("isProtected")).isFalse(); + assertThat(record.getValues()).doesNotContainKey("attributes").doesNotContainKey("passwordChangeDate"); + assertThat(FixtureActionUtil.REQUESTS.get(0).getURI().getPath()).isEqualTo("/api/v3/core/users/" + user.getInt("pk") + "/"); + } + + + + /******************************************************************************* + ** 404 and out-of-scope records come back as "no record". + *******************************************************************************/ + @Test + void getMissingAndOutOfScope() throws QException + { + assertThat(new GetAction().executeForRecord(new GetInput(userTable).withPrimaryKey(424242))).isNull(); + + JSONObject outpost = new JSONObject(FixtureActionUtil.fixture("user-get")).put("type", "internal_service_account"); + FixtureActionUtil.handler = r -> FixtureActionUtil.response(200, outpost.toString()); + assertThat(new GetAction().executeForRecord(new GetInput(userTable).withPrimaryKey(1))).isNull(); + + assertThat(new GetAction().executeForRecord(new GetInput(userTable).withPrimaryKey("../../admin"))).isNull(); + } + + + + /******************************************************************************* + ** Protection: superusers, qqq.io/protected, configured names, the service + ** account. + *******************************************************************************/ + @Test + void protectionMarkers() throws QException + { + JSONObject base = new JSONObject(FixtureActionUtil.fixture("user-get")); + for(JSONObject variant : List.of( + new JSONObject(base.toString()).put("is_superuser", true), + new JSONObject(base.toString()).put("attributes", new JSONObject().put("qqq.io/protected", "true")), + new JSONObject(base.toString()).put("username", "qqq-kof22-admin-idadmin"))) + { + FixtureActionUtil.handler = r -> FixtureActionUtil.response(200, variant.toString()); + QRecord record = new GetAction().executeForRecord(new GetInput(userTable).withPrimaryKey(1)); + assertThat(record.getValueBoolean("isProtected")).isTrue(); + assertThat(record.getDisplayValue("isProtected")).startsWith("Protected: "); + } + } + + + + /******************************************************************************* + ** Key lookups fetch each id; sensitive fields appear with audit.read. + *******************************************************************************/ + @Test + void keyLookupAndSensitiveFields() throws QException + { + JSONObject user = new JSONObject(FixtureActionUtil.fixture("user-get")); + FixtureActionUtil.handler = r -> r.getURI().getPath().endsWith("/" + user.getInt("pk") + "/") ? FixtureActionUtil.response(200, user.toString()) : FixtureActionUtil.response(404, "{}"); + + AuthentikTestSupport.loginWith(qInstance, IdentityPermission.USERS_READ, IdentityPermission.AUDIT_READ); + List records = query(new QQueryFilter(new QFilterCriteria("pk", QCriteriaOperator.IN, List.of(user.getInt("pk"), 999)))); + assertThat(records).hasSize(1); + assertThat(records.get(0).getValues()).containsKey("attributes"); + assertThat(new CountAction().execute(new CountInput(userTable).withFilter(new QQueryFilter(new QFilterCriteria("pk", QCriteriaOperator.IN, List.of(user.getInt("pk"), 999))))).getCount()).isEqualTo(1); + } + + + + /******************************************************************************* + ** Groups from the recorded list: joined names and qqq.io attributes. + *******************************************************************************/ + @Test + void groupsFromRecordedList() throws QException + { + String body = FixtureActionUtil.fixture("groups-list"); + FixtureActionUtil.handler = r -> FixtureActionUtil.response(200, body); + QueryInput input = new QueryInput(groupTable); + List groups = new QueryAction().execute(input).getRecords(); + QRecord identityAdmins = groups.stream().filter(g -> "identity-admins".equals(g.getValueString("name"))).findFirst().orElseThrow(); + assertThat(identityAdmins.getValueString("permissions")).isEqualTo("identity.*"); + assertThat(identityAdmins.getValueString("appAccess")).isEqualTo("kof22-website-prod"); + assertThat(identityAdmins.getValueBoolean("isSuperuser")).isFalse(); + assertThat(param(FixtureActionUtil.REQUESTS.get(0), "include_users", null)).isEqualTo("false"); + } + + + + /******************************************************************************* + ** Permissions: none, system session, writes. + *******************************************************************************/ + @Test + void guardDecisions() throws QException + { + serveUsersPaged(); + AuthentikTestSupport.loginWith(qInstance); + assertThatThrownBy(() -> query(new QQueryFilter())).isInstanceOf(QPermissionDeniedException.class); + assertThatThrownBy(() -> new CountAction().execute(new CountInput(userTable))).isInstanceOf(QPermissionDeniedException.class); + assertThatThrownBy(() -> new GetAction().execute(new GetInput(userTable).withPrimaryKey(1))).isInstanceOf(QPermissionDeniedException.class); + + QContext.init(qInstance, new QSystemUserSession()); + assertThat(query(new QQueryFilter().withLimit(1))).hasSize(1); + assertThatThrownBy(() -> new InsertAction().execute(new InsertInput(userTable).withRecord(new QRecord().withValue("username", "x")))) + .hasMessageContaining("System sessions"); + + AuthentikTestSupport.loginWith(qInstance, IdentityPermission.values()); + assertThatThrownBy(() -> new InsertAction().execute(new InsertInput(userTable).withRecord(new QRecord().withValue("username", "x")))).hasMessageContaining("cannot be changed"); + assertThatThrownBy(() -> new UpdateAction().execute(new UpdateInput(userTable).withRecord(new QRecord().withValue("pk", 1)))).hasMessageContaining("cannot be changed"); + assertThatThrownBy(() -> new DeleteAction().execute(new DeleteInput(userTable).withPrimaryKey(1))).hasMessageContaining("cannot be changed"); + + config.withReadOnly(true); + assertThatThrownBy(() -> new DeleteAction().execute(new DeleteInput(userTable).withPrimaryKey(1))).hasMessageContaining("read-only"); + } + + + + /******************************************************************************* + ** Recorded error bodies map to user-facing / permission exceptions, with + ** the token never in a message. + *******************************************************************************/ + @Test + void errorMapping() throws QException + { + String badFilter = FixtureActionUtil.fixture("error-400-bad-filter"); + FixtureActionUtil.handler = r -> FixtureActionUtil.response(400, badFilter); + assertThatThrownBy(() -> query(new QQueryFilter())).isInstanceOf(QUserFacingException.class).hasMessageContaining("last_login__lt"); + + String forbidden = FixtureActionUtil.fixture("error-403"); + FixtureActionUtil.handler = r -> FixtureActionUtil.response(403, forbidden); + assertThatThrownBy(() -> query(new QQueryFilter())).isInstanceOf(QPermissionDeniedException.class).hasMessageContaining("403"); + + FixtureActionUtil.handler = r -> FixtureActionUtil.response(401, "{\"detail\":\"Token invalid " + AuthentikTestSupport.TEST_TOKEN + "\"}"); + assertThatThrownBy(() -> query(new QQueryFilter())).hasMessageContaining("401").satisfies(e -> assertThat(e.getMessage()).doesNotContain(AuthentikTestSupport.TEST_TOKEN)); + + FixtureActionUtil.handler = r -> FixtureActionUtil.response(418, "not json " + AuthentikTestSupport.TEST_TOKEN); + assertThatThrownBy(() -> query(new QQueryFilter())).hasMessageContaining("418").satisfies(e -> assertThat(e.getMessage()).doesNotContain(AuthentikTestSupport.TEST_TOKEN)); + + FixtureActionUtil.handler = r -> FixtureActionUtil.response(200, ""); + assertThatThrownBy(() -> query(new QQueryFilter())).hasMessageContaining("non-JSON"); + } + + + + /******************************************************************************* + ** 429 honours Retry-After; GET 5xx and transport errors are retried. + *******************************************************************************/ + @Test + void retries() throws QException + { + AtomicInteger calls = new AtomicInteger(); + String body = FixtureActionUtil.fixture("users-list"); + FixtureActionUtil.handler = r -> switch(calls.incrementAndGet()) + { + case 1 -> FixtureActionUtil.response(429, "{}", FixtureActionUtil.retryAfter(0)); + case 2 -> FixtureActionUtil.response(502, "bad gateway"); + default -> FixtureActionUtil.response(200, body); + }; + assertThat(query(new QQueryFilter().withLimit(1))).hasSize(1); + assertThat(calls.get()).isEqualTo(3); + + calls.set(0); + FixtureActionUtil.handler = r -> + { + calls.incrementAndGet(); + throw (new IllegalStateException("connection reset; Bearer " + AuthentikTestSupport.TEST_TOKEN)); + }; + assertThatThrownBy(() -> query(new QQueryFilter())).hasMessageContaining("Could not reach Authentik").satisfies(e -> assertThat(e.getMessage()).doesNotContain(AuthentikTestSupport.TEST_TOKEN)); + assertThat(calls.get()).isEqualTo(3); + } + + + + /******************************************************************************* + ** Missing token fails before any request. + *******************************************************************************/ + @Test + void missingTokenFailsFast() throws QException + { + config.withApiToken("${env.QBIT_AUTHENTIK_TEST_UNSET_VARIABLE}"); + assertThatThrownBy(() -> query(new QQueryFilter())).hasMessageContaining("token is not configured"); + assertThat(FixtureActionUtil.REQUESTS).isEmpty(); + } + + + + /******************************************************************************* + ** The response cache serves repeated identical reads. + *******************************************************************************/ + @Test + void responseCache() throws QException + { + config.withListCacheTtlSeconds(30); + qInstance = AuthentikTestSupport.produce(config); + AuthentikTestSupport.useActionUtil(qInstance, config, FixtureActionUtil.class); + AuthentikTestSupport.loginWith(qInstance, IdentityPermission.USERS_READ); + serveUsersPaged(); + + query(new QQueryFilter().withLimit(2)); + int afterFirst = FixtureActionUtil.REQUESTS.size(); + query(new QQueryFilter().withLimit(2)); + assertThat(FixtureActionUtil.REQUESTS.size()).isEqualTo(afterFirst); + + com.kingsrook.qbits.authentik.AuthentikRuntime.forBackend(config.getApiBackendName()).invalidateCache(); + query(new QQueryFilter().withLimit(2)); + assertThat(FixtureActionUtil.REQUESTS.size()).isGreaterThan(afterFirst); + } + + + + /******************************************************************************* + ** Error-detail flattening and path stripping. + *******************************************************************************/ + @Test + void helpers() + { + assertThat(AuthentikActionUtil.errorDetail("{\"detail\":\"Nope.\"}")).isEqualTo("Nope."); + assertThat(AuthentikActionUtil.errorDetail("{\"name\":[\"a\",\"b\"],\"non_field_errors\":[\"c\"]}")).contains("name: a b").contains("c"); + assertThat(AuthentikActionUtil.errorDetail(null)).isEqualTo("(no details)"); + assertThat(AuthentikActionUtil.errorDetail("x".repeat(300))).endsWith("..."); + assertThat(AuthentikActionUtil.pathOf("https://h/api/v3/core/users/?search=alice%40x")).isEqualTo("/api/v3/core/users/"); + assertThat(AuthentikActionUtil.pathOf("not a uri ?q=1")).isEqualTo("not a uri "); + } + +} diff --git a/src/test/java/com/kingsrook/qbits/authentik/client/AuthentikFilterMapperTest.java b/src/test/java/com/kingsrook/qbits/authentik/client/AuthentikFilterMapperTest.java new file mode 100644 index 0000000..4a281e3 --- /dev/null +++ b/src/test/java/com/kingsrook/qbits/authentik/client/AuthentikFilterMapperTest.java @@ -0,0 +1,225 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik.client; + + +import java.time.Instant; +import java.time.LocalDate; +import java.util.List; +import com.kingsrook.qqq.backend.core.exceptions.QException; +import com.kingsrook.qqq.backend.core.exceptions.QUserFacingException; +import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator; +import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterCriteria; +import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy; +import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter; +import com.kingsrook.qqq.backend.core.model.actions.tables.query.expressions.NowWithOffset; +import org.apache.http.NameValuePair; +import org.junit.jupiter.api.Test; +import static org.assertj.core.api.Assertions.assertThat; +import static org.assertj.core.api.Assertions.assertThatThrownBy; + + +/******************************************************************************* + ** Tests for AuthentikFilterMapper. + *******************************************************************************/ +class AuthentikFilterMapperTest +{ + private final AuthentikFilterMapper mapper = new AuthentikFilterMapper(); + private final AuthentikTableSpec users = AuthentikTables.get(AuthentikTables.USER); + private final AuthentikTableSpec groups = AuthentikTables.get(AuthentikTables.GROUP); + + + + /******************************************************************************* + ** + *******************************************************************************/ + private List params(AuthentikTableSpec spec, QQueryFilter filter) throws QException + { + return (mapper.map(spec, filter, false).params().stream().map(p -> p.getName() + "=" + p.getValue()).toList()); + } + + + + /******************************************************************************* + ** Appendix A example of the design. + *******************************************************************************/ + @Test + void designAppendixExample() throws QException + { + QQueryFilter filter = new QQueryFilter( + new QFilterCriteria("isActive", QCriteriaOperator.EQUALS, false), + new QFilterCriteria("lastLogin", QCriteriaOperator.LESS_THAN, LocalDate.of(2026, 7, 13))) + .withOrderBy(new QFilterOrderBy("username")); + assertThat(params(users, filter)).containsExactly("is_active=false", "last_login__lt=2026-07-13T00:00:00Z", "ordering=username"); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @Test + void nullFilterUsesDefaultOrdering() throws QException + { + assertThat(params(users, null)).containsExactly("ordering=username"); + assertThat(params(groups, new QQueryFilter())).containsExactly("ordering=name"); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @Test + void inUsesRepeatedPlainNames() throws QException + { + assertThat(params(users, new QQueryFilter(new QFilterCriteria("type", QCriteriaOperator.IN, List.of("internal", "external"))))) + .containsExactly("type=internal", "type=external", "ordering=username"); + assertThat(params(groups, new QQueryFilter(new QFilterCriteria("memberUsername", QCriteriaOperator.IN, List.of("a", "b"))))) + .containsExactly("members_by_username=a", "members_by_username=b", "ordering=name"); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @Test + void inclusiveDateBoundsAndBetween() throws QException + { + Instant at = Instant.parse("2026-01-01T00:00:00Z"); + assertThat(params(users, new QQueryFilter(new QFilterCriteria("dateJoined", QCriteriaOperator.GREATER_THAN_OR_EQUALS, at)))) + .contains("date_joined__gt=2025-12-31T23:59:59.999Z"); + assertThat(params(users, new QQueryFilter(new QFilterCriteria("dateJoined", QCriteriaOperator.LESS_THAN_OR_EQUALS, "2026-01-01T00:00:00Z")))) + .contains("date_joined__lt=2026-01-01T00:00:00.001Z"); + assertThat(params(users, new QQueryFilter(new QFilterCriteria("lastLogin", QCriteriaOperator.BETWEEN, List.of("2026-01-01", "2026-02-01"))))) + .contains("last_login__gt=2025-12-31T23:59:59.999Z", "last_login__lt=2026-02-01T00:00:00.001Z"); + assertThat(params(users, new QQueryFilter(new QFilterCriteria("lastLogin", QCriteriaOperator.GREATER_THAN, "2026-03-04T05:06:07+02:00")))) + .contains("last_login__gt=2026-03-04T03:06:07Z"); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @Test + void expressionsAreEvaluated() throws QException + { + List params = params(users, new QQueryFilter(new QFilterCriteria("lastLogin", QCriteriaOperator.LESS_THAN, NowWithOffset.minus(90, java.time.temporal.ChronoUnit.DAYS)))); + assertThat(params.get(0)).startsWith("last_login__lt=20"); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @Test + void blankChecksAndSearch() throws QException + { + assertThat(params(users, new QQueryFilter(new QFilterCriteria("lastLogin", QCriteriaOperator.IS_BLANK)))).contains("last_login__isnull=true"); + assertThat(params(users, new QQueryFilter(new QFilterCriteria("lastLogin", QCriteriaOperator.IS_NOT_BLANK)))).contains("last_login__isnull=false"); + assertThat(params(users, new QQueryFilter(new QFilterCriteria("email", QCriteriaOperator.CONTAINS, " kof22 ")))).contains("search=kof22"); + assertThat(params(users, new QQueryFilter(new QFilterCriteria("path", QCriteriaOperator.STARTS_WITH, "users/")))).contains("path_startswith=users/"); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @Test + void orderingDescendingAndMultiple() throws QException + { + assertThat(params(users, new QQueryFilter().withOrderBy(new QFilterOrderBy("lastLogin", false)).withOrderBy(new QFilterOrderBy("username")))) + .containsExactly("ordering=-last_login,username"); + assertThatThrownBy(() -> params(users, new QQueryFilter().withOrderBy(new QFilterOrderBy("groupNames")))).isInstanceOf(QUserFacingException.class); + } + + + + /******************************************************************************* + ** Key-only filters become key lookups (users have no pk list filter). + *******************************************************************************/ + @Test + void keyLookups() throws QException + { + AuthentikFilterMapper.MappedFilter mapped = mapper.map(users, new QQueryFilter(new QFilterCriteria("pk", QCriteriaOperator.IN, List.of(1, 2, 3)), new QFilterCriteria("pk", QCriteriaOperator.EQUALS, 2)), false); + assertThat(mapped.isKeyLookup()).isTrue(); + assertThat(mapped.keyLookup()).containsExactly(2); + assertThat(mapper.map(users, new QQueryFilter(new QFilterCriteria("pk", QCriteriaOperator.EQUALS, 7)), false).keyLookup()).containsExactly(7); + } + + + + /******************************************************************************* + ** Everything Authentik cannot evaluate is rejected, never post-filtered. + *******************************************************************************/ + @Test + void unsupportedFiltersAreRejected() + { + QFilterCriteria a = new QFilterCriteria("username", QCriteriaOperator.EQUALS, "a"); + QFilterCriteria b = new QFilterCriteria("email", QCriteriaOperator.EQUALS, "b"); + + assertThatThrownBy(() -> params(users, new QQueryFilter(a, b).withBooleanOperator(QQueryFilter.BooleanOperator.OR))).isInstanceOf(QUserFacingException.class).hasMessageContaining("OR"); + assertThatThrownBy(() -> params(users, new QQueryFilter(a).withSubFilters(List.of(new QQueryFilter(b))))).isInstanceOf(QUserFacingException.class).hasMessageContaining("sub-filters"); + assertThatThrownBy(() -> params(users, new QQueryFilter(new QFilterCriteria("username", QCriteriaOperator.NOT_EQUALS, "a")))).isInstanceOf(QUserFacingException.class); + assertThatThrownBy(() -> params(users, new QQueryFilter(new QFilterCriteria("nope", QCriteriaOperator.EQUALS, "a")))).isInstanceOf(QUserFacingException.class).hasMessageContaining("Unknown field"); + assertThatThrownBy(() -> params(users, new QQueryFilter(new QFilterCriteria("username", QCriteriaOperator.EQUALS, "a"), new QFilterCriteria("username", QCriteriaOperator.EQUALS, "b")))).isInstanceOf(QUserFacingException.class); + assertThatThrownBy(() -> params(users, new QQueryFilter(new QFilterCriteria("username", QCriteriaOperator.CONTAINS, "a"), new QFilterCriteria("email", QCriteriaOperator.CONTAINS, "b")))).isInstanceOf(QUserFacingException.class).hasMessageContaining("one text-search"); + assertThatThrownBy(() -> params(users, new QQueryFilter(new QFilterCriteria("type", QCriteriaOperator.IN, List.of())))).isInstanceOf(QUserFacingException.class); + assertThatThrownBy(() -> params(users, new QQueryFilter(new QFilterCriteria("lastLogin", QCriteriaOperator.BETWEEN, List.of("2026-01-01"))))).isInstanceOf(QUserFacingException.class); + assertThatThrownBy(() -> params(users, new QQueryFilter(new QFilterCriteria("lastLogin", QCriteriaOperator.LESS_THAN, "yesterday-ish")))).isInstanceOf(QUserFacingException.class).hasMessageContaining("valid date"); + assertThatThrownBy(() -> params(users, new QQueryFilter(new QFilterCriteria("username", QCriteriaOperator.EQUALS)))).isInstanceOf(QUserFacingException.class); + assertThatThrownBy(() -> params(users, new QQueryFilter(new QFilterCriteria("username", QCriteriaOperator.CONTAINS, " ")))).isInstanceOf(QUserFacingException.class); + + QFilterCriteria fieldToField = new QFilterCriteria("username", QCriteriaOperator.EQUALS, List.of()); + fieldToField.setOtherFieldName("email"); + assertThatThrownBy(() -> params(users, new QQueryFilter(fieldToField))).isInstanceOf(QUserFacingException.class); + } + + + + /******************************************************************************* + ** Sensitive fields can't be filtered without identity.audit.read. + *******************************************************************************/ + @Test + void sensitiveFieldFilters() throws QException + { + QQueryFilter filter = new QQueryFilter(new QFilterCriteria("passwordChangeDate", QCriteriaOperator.IS_BLANK)); + assertThatThrownBy(() -> mapper.map(users, filter, false)).isInstanceOf(QUserFacingException.class).hasMessageContaining("permission"); + assertThatThrownBy(() -> mapper.map(users, filter, true)).isInstanceOf(QUserFacingException.class).hasMessageContaining("not supported"); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @Test + void booleanFormatting() throws QException + { + for(java.io.Serializable value : List.of(true, "TRUE", 1, "yes")) + { + List mapped = mapper.map(users, new QQueryFilter(new QFilterCriteria("isActive", QCriteriaOperator.EQUALS, value)), false).params(); + assertThat(mapped.get(0).getValue()).isEqualTo("true"); + } + assertThat(mapper.map(users, new QQueryFilter(new QFilterCriteria("isActive", QCriteriaOperator.EQUALS, "no")), false).params().get(0).getValue()).isEqualTo("false"); + } + +} diff --git a/src/test/java/com/kingsrook/qbits/authentik/client/AuthentikRedactorTest.java b/src/test/java/com/kingsrook/qbits/authentik/client/AuthentikRedactorTest.java new file mode 100644 index 0000000..a21ca57 --- /dev/null +++ b/src/test/java/com/kingsrook/qbits/authentik/client/AuthentikRedactorTest.java @@ -0,0 +1,70 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik.client; + + +import org.junit.jupiter.api.Test; +import static org.assertj.core.api.Assertions.assertThat; + + +/******************************************************************************* + ** Tests for AuthentikRedactor. + *******************************************************************************/ +class AuthentikRedactorTest +{ + + /******************************************************************************* + ** + *******************************************************************************/ + @Test + void tokenAndBearerValuesAreMasked() + { + String text = "auth failed for token abc123secret with header Authorization: Bearer xyz.789-other"; + String safe = AuthentikRedactor.redactText(text, "abc123secret"); + assertThat(safe).doesNotContain("abc123secret").doesNotContain("xyz.789-other").contains("Bearer ******"); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @Test + void secretLookingJsonValuesAreMasked() + { + String body = "{\"identifier\":\"t\",\"key\":\"s3cr3t\",\"link\":\"https://x/recover?token=abc\",\"Password\":\"p\\\"w\",\"name\":\"ok\"}"; + String safe = AuthentikRedactor.redactText(body, null); + assertThat(safe).doesNotContain("s3cr3t").doesNotContain("recover?token").doesNotContain("p\\\"w").contains("\"name\":\"ok\"").contains("\"key\":\"******\""); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @Test + void sensitiveEndpointBodiesAreDropped() + { + assertThat(AuthentikRedactor.redactBody("/api/v3/core/users/4/recovery_email/", "{\"email_stage\":\"x\"}", null)).doesNotContain("email_stage"); + assertThat(AuthentikRedactor.redactBody("/api/v3/core/tokens/abc/view_key/", "{\"key\":\"k\"}", null)).contains("omitted"); + assertThat(AuthentikRedactor.redactBody("/api/v3/core/users/", "{\"username\":\"u\"}", null)).contains("\"username\":\"u\""); + assertThat(AuthentikRedactor.redactBody("/api/v3/core/users/", null, null)).isNull(); + assertThat(AuthentikRedactor.redactText(null, "t")).isNull(); + assertThat(AuthentikRedactor.isSensitivePath(null)).isFalse(); + } + +} diff --git a/src/test/java/com/kingsrook/qbits/authentik/client/FixtureActionUtil.java b/src/test/java/com/kingsrook/qbits/authentik/client/FixtureActionUtil.java new file mode 100644 index 0000000..60e0ffd --- /dev/null +++ b/src/test/java/com/kingsrook/qbits/authentik/client/FixtureActionUtil.java @@ -0,0 +1,98 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik.client; + + +import java.util.ArrayList; +import java.util.List; +import java.util.function.Function; +import com.kingsrook.qbits.authentik.AuthentikTestSupport; +import com.kingsrook.qqq.backend.module.api.actions.QHttpResponse; +import org.apache.http.Header; +import org.apache.http.client.methods.HttpRequestBase; +import org.apache.http.message.BasicHeader; + + +/******************************************************************************* + ** AuthentikActionUtil with the network replaced: requests are captured and + ** answered by a handler (usually serving recorded 2026.8.3 fixtures). + *******************************************************************************/ +public class FixtureActionUtil extends AuthentikActionUtil +{ + public static final List REQUESTS = new ArrayList<>(); + + public static Function handler = r -> response(404, "{\"detail\":\"Not found.\"}"); + + + + /******************************************************************************* + ** Reset captured requests and the handler. + *******************************************************************************/ + public static void reset() + { + REQUESTS.clear(); + handler = r -> response(404, "{\"detail\":\"Not found.\"}"); + AuthentikActionUtil.resetVersionCheck(); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @Override + protected QHttpResponse send(HttpRequestBase request) + { + REQUESTS.add(request); + if(request.getURI().getPath().endsWith("/admin/version/")) + { + return (response(200, AuthentikTestSupport.resource("fixtures/2026.8.3/admin-version.json"))); + } + return (handler.apply(request)); + } + + + + /******************************************************************************* + ** Build a response. + *******************************************************************************/ + public static QHttpResponse response(int status, String body, Header... headers) + { + return (new QHttpResponse().withStatusCode(status).withContent(body).withHeaderList(List.of(headers))); + } + + + + /******************************************************************************* + ** A Retry-After header. + *******************************************************************************/ + public static Header retryAfter(int seconds) + { + return (new BasicHeader("Retry-After", String.valueOf(seconds))); + } + + + + /******************************************************************************* + ** A recorded fixture. + *******************************************************************************/ + public static String fixture(String name) + { + return (AuthentikTestSupport.resource("fixtures/2026.8.3/" + name + ".json")); + } + +} diff --git a/src/test/java/com/kingsrook/qbits/authentik/client/TokenBucketThrottleTest.java b/src/test/java/com/kingsrook/qbits/authentik/client/TokenBucketThrottleTest.java new file mode 100644 index 0000000..9e9fcfa --- /dev/null +++ b/src/test/java/com/kingsrook/qbits/authentik/client/TokenBucketThrottleTest.java @@ -0,0 +1,114 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik.client; + + +import java.util.ArrayList; +import java.util.List; +import java.util.concurrent.atomic.AtomicLong; +import org.junit.jupiter.api.Test; +import static org.assertj.core.api.Assertions.assertThat; +import static org.assertj.core.api.Assertions.assertThatThrownBy; + + +/******************************************************************************* + ** Tests for TokenBucketThrottle, on a fake clock. + *******************************************************************************/ +class TokenBucketThrottleTest +{ + + /******************************************************************************* + ** 10 rps, burst 20: the first 20 calls are free, then each waits 100 ms of + ** clock time; sleeping advances the fake clock. + *******************************************************************************/ + @Test + void defaultTenPerSecondWithBurstTwenty() + { + AtomicLong clock = new AtomicLong(0); + List sleeps = new ArrayList<>(); + TokenBucketThrottle throttle = new TokenBucketThrottle(10, 20, clock::get, nanos -> + { + sleeps.add(nanos); + clock.addAndGet(nanos); + }); + + for(int i = 0; i < 20; i++) + { + throttle.acquire(); + } + assertThat(sleeps).isEmpty(); + + throttle.acquire(); + assertThat(sleeps).hasSize(1); + assertThat(sleeps.get(0)).isBetween(99_000_000L, 101_000_000L); + + for(int i = 0; i < 9; i++) + { + throttle.acquire(); + } + long total = sleeps.stream().mapToLong(Long::longValue).sum(); + assertThat(total).isBetween(990_000_000L, 1_010_000_000L); + } + + + + /******************************************************************************* + ** Idle time refills, capped at the burst. + *******************************************************************************/ + @Test + void refillsWhileIdleUpToBurst() + { + AtomicLong clock = new AtomicLong(0); + TokenBucketThrottle throttle = new TokenBucketThrottle(10, 5, clock::get, clock::addAndGet); + for(int i = 0; i < 5; i++) + { + throttle.acquire(); + } + assertThat(throttle.getAvailableTokens()).isLessThan(0.01); + + clock.addAndGet(60_000_000_000L); + assertThat(throttle.getAvailableTokens()).isEqualTo(5.0); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @Test + void rejectsZeroRate() + { + assertThatThrownBy(() -> new TokenBucketThrottle(0, 1)).isInstanceOf(IllegalArgumentException.class); + } + + + + /******************************************************************************* + ** The real clock: a burst of 1 at 1000 rps makes the second call wait a + ** little, without failing. + *******************************************************************************/ + @Test + void systemClockConstructor() + { + TokenBucketThrottle throttle = new TokenBucketThrottle(1000, 1); + long start = System.nanoTime(); + throttle.acquire(); + throttle.acquire(); + assertThat(System.nanoTime() - start).isLessThan(1_000_000_000L); + } + +} diff --git a/src/test/java/com/kingsrook/qbits/authentik/contract/AccessCheckIT.java b/src/test/java/com/kingsrook/qbits/authentik/contract/AccessCheckIT.java new file mode 100644 index 0000000..9bbeb07 --- /dev/null +++ b/src/test/java/com/kingsrook/qbits/authentik/contract/AccessCheckIT.java @@ -0,0 +1,126 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik.contract; + + +import com.kingsrook.qbits.authentik.RequiresDockerCondition; +import org.json.JSONObject; +import org.junit.jupiter.api.BeforeAll; +import org.junit.jupiter.api.Order; +import org.junit.jupiter.api.Test; +import org.junit.jupiter.api.extension.ExtendWith; +import static com.kingsrook.qbits.authentik.contract.AuthentikTestStack.APP_SLUG; +import static org.assertj.core.api.Assertions.assertThat; + + +/******************************************************************************* + ** Open point (iii): what the access matrix can rely on. + ** + ** - check_access honours for_user ONLY for superusers. For the service + ** account it silently evaluates the CALLER instead: the answer would be + ** wrong, not refused. No permission fixes this, and the service account must + ** never be a superuser, so the qbit computes access itself. + ** - POST /policies/all/{uuid}/test/ (the alternative) fails with HTTP 500 + ** (WrongAppError) for non-superusers on expression policies in 2026.8.3. + ** - The application LIST shows a non-superuser only the apps it can itself + ** access (here: none); GET by slug works with view_application. So + ** applicationsInScope must be explicit slugs. + ** - The app's policy bindings are readable with view_policybinding. + *******************************************************************************/ +@ExtendWith(RequiresDockerCondition.class) +@Order(40) +class AccessCheckIT +{ + private static TestApi admin; + private static TestApi sa; + private static int publisher; + + + + /******************************************************************************* + ** + *******************************************************************************/ + @BeforeAll + static void beforeAll() + { + AuthentikTestStack stack = AuthentikTestStack.get(); + admin = stack.admin(); + sa = stack.serviceAccount(); + admin.post("/core/users/", new JSONObject().put("username", "access.publisher").put("name", "Access Publisher").put("type", "internal").put("path", "users")); + publisher = admin.userPk("access.publisher"); + admin.post("/core/groups/" + admin.groupPk("kof-website-publishers") + "/add_user/", new JSONObject().put("pk", publisher)); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @Test + void checkAccessForUserIsIgnoredForNonSuperusers() + { + assertThat(admin.getOk("/core/applications/" + APP_SLUG + "/check_access/?for_user=" + publisher).getBoolean("passing")).isTrue(); + + TestApi.Response asServiceAccount = sa.get("/core/applications/" + APP_SLUG + "/check_access/?for_user=" + publisher); + assertThat(asServiceAccount.status()).isEqualTo(200); + assertThat(asServiceAccount.json().getBoolean("passing")).as("evaluated for the service account itself, not for_user").isFalse(); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @Test + void policyTestEndpointFailsForNonSuperusers() + { + String policy = admin.first("/policies/all/?search=kof22-require-admins-group").getString("pk"); + assertThat(admin.post("/policies/all/" + policy + "/test/", new JSONObject().put("user", publisher)).json().getBoolean("passing")).isTrue(); + + String role = admin.first("/rbac/roles/?name=" + AuthentikTestStack.SERVICE_ACCOUNT).getString("pk"); + org.json.JSONArray permission = new org.json.JSONArray().put("authentik_policies.view_policy"); + admin.post("/rbac/permissions/assigned_by_roles/" + role + "/assign/", new JSONObject().put("permissions", permission)); + try + { + assertThat(sa.post("/policies/all/" + policy + "/test/", new JSONObject().put("user", publisher)).status()).isEqualTo(500); + } + finally + { + admin.patch("/rbac/permissions/assigned_by_roles/" + role + "/unassign/", new JSONObject().put("permissions", permission)); + } + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @Test + void applicationsAreReadableBySlugButNotListed() + { + assertThat(sa.getOk("/core/applications/").getJSONArray("results")).isEmpty(); + assertThat(sa.getOk("/core/applications/?superuser_full_list=true").getJSONArray("results")).isEmpty(); + + JSONObject application = sa.getOk("/core/applications/" + APP_SLUG + "/"); + assertThat(application.getString("policy_engine_mode")).isEqualTo("any"); + + JSONObject bindings = sa.getOk("/policies/bindings/?target=" + application.getString("pbm_uuid")); + assertThat(bindings.getJSONArray("results").length()).isEqualTo(1); + assertThat(bindings.getJSONArray("results").getJSONObject(0).getJSONObject("policy_obj").getString("name")).isEqualTo("kof22-require-admins-group"); + } + +} diff --git a/src/test/java/com/kingsrook/qbits/authentik/contract/AuthentikTestStack.java b/src/test/java/com/kingsrook/qbits/authentik/contract/AuthentikTestStack.java new file mode 100644 index 0000000..13ee97b --- /dev/null +++ b/src/test/java/com/kingsrook/qbits/authentik/contract/AuthentikTestStack.java @@ -0,0 +1,349 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik.contract; + + +import java.time.Duration; +import java.time.Instant; +import java.util.HashMap; +import java.util.Map; +import java.util.function.BooleanSupplier; +import org.json.JSONObject; +import org.testcontainers.containers.GenericContainer; +import org.testcontainers.containers.Network; +import org.testcontainers.containers.PostgreSQLContainer; +import org.testcontainers.containers.wait.strategy.Wait; +import org.testcontainers.utility.DockerImageName; +import org.testcontainers.utility.MountableFile; + + +/******************************************************************************* + ** Disposable Authentik for contract tests (DESIGN.md section 10): Authentik + ** server + worker (2026.8.3 unless -Dauthentik.test.image), Postgres, and + ** Mailpit, on a private network. Started once per JVM and shared by every + ** contract test class. + ** + ** The two kof22-shaped blueprints from src/test/resources/blueprints are in + ** /blueprints/custom BEFORE the first boot, so the stack starts as an EMPTY + ** instance applying the bootstrap: that is contract test (h). + ** + ** Credentials here are test-only constants for a throwaway container: the + ** bootstrap admin token (AUTHENTIK_BOOTSTRAP_TOKEN), and a service-account + ** token minted through the admin API at start-up. + *******************************************************************************/ +public final class AuthentikTestStack +{ + public static final String BOOTSTRAP_TOKEN = "contract-test-bootstrap-token-0123456789"; + public static final String SERVICE_ACCOUNT = "qqq-kof22-admin-idadmin"; + public static final String BREAK_GLASS = "kof22-breakglass"; + public static final String SUPERUSER_GROUP = "authentik Admins"; + public static final String INFRA_BLUEPRINT = "kof22-oauth2-apps"; + public static final String BOOTSTRAP_BLUEPRINT = "kof22-identity-bootstrap"; + public static final String APP_SLUG = "kof22-website-prod"; + + private static final String SECRET_KEY = "contract-test-secret-key-0123456789abcdefghijklmnop"; + private static final String SA_TOKEN_ID = "qqq-contract-test"; + + private static AuthentikTestStack instance; + + private final Network network = Network.newNetwork(); + private final PostgreSQLContainer postgres; + private final GenericContainer mailpit; + private final GenericContainer server; + private final GenericContainer worker; + private String serviceAccountToken; + + + + /******************************************************************************* + ** The shared, started stack. + *******************************************************************************/ + public static synchronized AuthentikTestStack get() + { + if(instance == null) + { + AuthentikTestStack stack = new AuthentikTestStack(); + stack.start(); + instance = stack; + Runtime.getRuntime().addShutdownHook(new Thread(stack::stop)); + } + return (instance); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @SuppressWarnings("resource") + private AuthentikTestStack() + { + String authentikImage = System.getProperty("authentik.test.image", "ghcr.io/goauthentik/server:2026.8.3"); + String postgresImage = System.getProperty("postgres.test.image", "postgres:16-alpine"); + String mailpitImage = System.getProperty("mailpit.test.image", "axllent/mailpit:v1.27"); + + postgres = new PostgreSQLContainer<>(DockerImageName.parse(postgresImage).asCompatibleSubstituteFor("postgres")) + .withNetwork(network) + .withNetworkAliases("postgresql") + .withDatabaseName("authentik") + .withUsername("authentik") + .withPassword("authentik-test"); + + mailpit = new GenericContainer<>(DockerImageName.parse(mailpitImage)) + .withNetwork(network) + .withNetworkAliases("mailpit") + .withExposedPorts(8025) + .waitingFor(Wait.forHttp("/api/v1/info").forPort(8025)); + + Map env = new HashMap<>(); + env.put("AUTHENTIK_SECRET_KEY", SECRET_KEY); + env.put("AUTHENTIK_POSTGRESQL__HOST", "postgresql"); + env.put("AUTHENTIK_POSTGRESQL__USER", "authentik"); + env.put("AUTHENTIK_POSTGRESQL__PASSWORD", "authentik-test"); + env.put("AUTHENTIK_POSTGRESQL__NAME", "authentik"); + env.put("AUTHENTIK_BOOTSTRAP_TOKEN", BOOTSTRAP_TOKEN); + env.put("AUTHENTIK_BOOTSTRAP_PASSWORD", "contract-test-password-123"); + env.put("AUTHENTIK_BOOTSTRAP_EMAIL", "akadmin@example.test"); + env.put("AUTHENTIK_EMAIL__HOST", "mailpit"); + env.put("AUTHENTIK_EMAIL__PORT", "1025"); + env.put("AUTHENTIK_EMAIL__FROM", "authentik@example.test"); + env.put("AUTHENTIK_ERROR_REPORTING__ENABLED", "false"); + env.put("AUTHENTIK_DISABLE_UPDATE_CHECK", "true"); + env.put("AUTHENTIK_DISABLE_STARTUP_ANALYTICS", "true"); + env.put("KOF22_OAUTH2_CLIENT_SECRET", "contract-test-oauth2-client-secret"); + + server = authentik(authentikImage, env, "server") + .withNetworkAliases("authentik") + .withExposedPorts(9000) + .waitingFor(Wait.forHttp("/-/health/ready/").forPort(9000).forStatusCode(200).withStartupTimeout(Duration.ofMinutes(8))); + + worker = authentik(authentikImage, env, "worker"); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @SuppressWarnings("resource") + private GenericContainer authentik(String image, Map env, String command) + { + return (new GenericContainer<>(DockerImageName.parse(image)) + .withNetwork(network) + .withEnv(env) + .withCommand(command) + .withCopyFileToContainer(MountableFile.forClasspathResource("blueprints/" + INFRA_BLUEPRINT + ".yaml"), "/blueprints/custom/" + INFRA_BLUEPRINT + ".yaml") + .withCopyFileToContainer(MountableFile.forClasspathResource("blueprints/" + BOOTSTRAP_BLUEPRINT + ".yaml"), "/blueprints/custom/" + BOOTSTRAP_BLUEPRINT + ".yaml")); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private void start() + { + postgres.start(); + mailpit.start(); + worker.start(); + server.start(); + + TestApi admin = admin(); + waitFor(Duration.ofMinutes(8), "both kof22 blueprints applied", () -> + isSuccessful(admin, INFRA_BLUEPRINT) && isSuccessful(admin, BOOTSTRAP_BLUEPRINT) + && admin.first("/core/users/?username=" + SERVICE_ACCOUNT) != null); + + int serviceAccountPk = admin.userPk(SERVICE_ACCOUNT); + TestApi.Response created = admin.post("/core/tokens/", new JSONObject().put("identifier", SA_TOKEN_ID).put("user", serviceAccountPk).put("intent", "api").put("expiring", false)); + if(created.status() != 201) + { + throw (new IllegalStateException("Could not create the service-account test token: " + created.status() + " " + created.body())); + } + serviceAccountToken = admin.getOk("/core/tokens/" + SA_TOKEN_ID + "/view_key/").getString("key"); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private void stop() + { + for(GenericContainer container : new GenericContainer[] { server, worker, mailpit, postgres }) + { + try + { + container.stop(); + } + catch(Exception e) + { + // best effort at JVM exit + } + } + network.close(); + } + + + + /******************************************************************************* + ** Host root, e.g. http://localhost:32768 (the qbit's baseUrl). + *******************************************************************************/ + public String baseUrl() + { + return ("http://" + server.getHost() + ":" + server.getMappedPort(9000)); + } + + + + /******************************************************************************* + ** API root, baseUrl + /api/v3. + *******************************************************************************/ + public String apiRoot() + { + return (baseUrl() + "/api/v3"); + } + + + + /******************************************************************************* + ** Mailpit API root. + *******************************************************************************/ + public String mailpitRoot() + { + return ("http://" + mailpit.getHost() + ":" + mailpit.getMappedPort(8025)); + } + + + + /******************************************************************************* + ** Client acting as the bootstrap superuser (akadmin), for setup. + *******************************************************************************/ + public TestApi admin() + { + return (new TestApi(apiRoot(), BOOTSTRAP_TOKEN)); + } + + + + /******************************************************************************* + ** Client acting as the qbit's service account. + *******************************************************************************/ + public TestApi serviceAccount() + { + return (new TestApi(apiRoot(), serviceAccountToken)); + } + + + + /******************************************************************************* + ** The service account's token (for configuring the qbit under test). + *******************************************************************************/ + public String serviceAccountToken() + { + return (serviceAccountToken); + } + + + + /******************************************************************************* + ** The blueprint instance with this name. + *******************************************************************************/ + public JSONObject blueprint(String name) + { + return (admin().first("/managed/blueprints/?name=" + TestApi.encode(name))); + } + + + + /******************************************************************************* + ** Re-apply a blueprint instance (POST .../apply/, which is asynchronous) and + ** wait until it has applied again successfully. + *******************************************************************************/ + public void applyAndWait(String name) + { + JSONObject before = blueprint(name); + String lastApplied = before.optString("last_applied", ""); + admin().post("/managed/blueprints/" + before.getString("pk") + "/apply/", new JSONObject()); + waitFor(Duration.ofMinutes(3), "blueprint " + name + " re-applied", () -> + { + JSONObject now = blueprint(name); + return (!now.optString("last_applied", "").equals(lastApplied) && "successful".equals(now.optString("status"))); + }); + } + + + + /******************************************************************************* + ** Create a content-based blueprint instance and wait for it to apply. + *******************************************************************************/ + public JSONObject createContentBlueprint(String name, String yaml) + { + TestApi.Response created = admin().post("/managed/blueprints/", new JSONObject().put("name", name).put("content", yaml).put("enabled", true).put("path", "")); + if(created.status() != 201) + { + throw (new IllegalStateException("Could not create blueprint " + name + ": " + created.status() + " " + created.body())); + } + applyAndWait(name); + return (blueprint(name)); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private static boolean isSuccessful(TestApi admin, String name) + { + try + { + JSONObject blueprint = admin.first("/managed/blueprints/?name=" + TestApi.encode(name)); + return (blueprint != null && "successful".equals(blueprint.optString("status"))); + } + catch(Exception e) + { + return (false); + } + } + + + + /******************************************************************************* + ** Poll until a condition holds. + *******************************************************************************/ + public static void waitFor(Duration timeout, String what, BooleanSupplier condition) + { + Instant deadline = Instant.now().plus(timeout); + while(Instant.now().isBefore(deadline)) + { + if(condition.getAsBoolean()) + { + return; + } + try + { + Thread.sleep(2_000); + } + catch(InterruptedException e) + { + Thread.currentThread().interrupt(); + break; + } + } + throw (new IllegalStateException("Timed out waiting for " + what)); + } + +} diff --git a/src/test/java/com/kingsrook/qbits/authentik/contract/BlueprintReapplyIT.java b/src/test/java/com/kingsrook/qbits/authentik/contract/BlueprintReapplyIT.java new file mode 100644 index 0000000..48e42a5 --- /dev/null +++ b/src/test/java/com/kingsrook/qbits/authentik/contract/BlueprintReapplyIT.java @@ -0,0 +1,197 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik.contract; + + +import java.util.ArrayList; +import java.util.List; +import com.kingsrook.qbits.authentik.RequiresDockerCondition; +import org.json.JSONArray; +import org.json.JSONObject; +import org.junit.jupiter.api.BeforeAll; +import org.junit.jupiter.api.Order; +import org.junit.jupiter.api.Test; +import org.junit.jupiter.api.extension.ExtendWith; +import static com.kingsrook.qbits.authentik.contract.AuthentikTestStack.BOOTSTRAP_BLUEPRINT; +import static com.kingsrook.qbits.authentik.contract.AuthentikTestStack.BREAK_GLASS; +import static com.kingsrook.qbits.authentik.contract.AuthentikTestStack.INFRA_BLUEPRINT; +import static com.kingsrook.qbits.authentik.contract.AuthentikTestStack.SERVICE_ACCOUNT; +import static org.assertj.core.api.Assertions.assertThat; + + +/******************************************************************************* + ** Contract tests (c) and (d): the whole design rests on these. + ** + ** (c) With identity objects declared `state: created` and no member lists, + ** re-applying BOTH blueprints changes nothing made through the API or + ** the UI (memberships, group attributes, the service account's role + ** assignment), and re-asserts the qbit role's global permissions after + ** one was removed by hand. + ** + ** (d) The hazard the cluster-gitops lint exists for: a `present` group with + ** `users:` wipes API-added members, a `present` user with `groups:` + ** wipes API-added memberships (today's james.maes entry), and `present` + ** `attributes:` wipes qqq.io/* edits, on every apply. + *******************************************************************************/ +@ExtendWith(RequiresDockerCondition.class) +@Order(30) +class BlueprintReapplyIT +{ + private static AuthentikTestStack stack; + private static TestApi admin; + + + + /******************************************************************************* + ** + *******************************************************************************/ + @BeforeAll + static void beforeAll() + { + stack = AuthentikTestStack.get(); + admin = stack.admin(); + } + + + + /******************************************************************************* + ** (c) + *******************************************************************************/ + @Test + void apiEditsSurviveReapplyOfCreatedEntries() + { + admin.post("/core/users/", new JSONObject().put("username", "reapply.member").put("name", "Reapply Member").put("type", "internal").put("path", "users")); + int member = admin.userPk("reapply.member"); + + /////////////////////////////////////////////////////////////////////// + // edits as QQQ (the service account) or the UI (admin) would make // + /////////////////////////////////////////////////////////////////////// + String identityAdmins = admin.groupPk("identity-admins"); + String kof22Admins = admin.groupPk("kof22-admins"); + assertThat(admin.post("/core/groups/" + identityAdmins + "/add_user/", new JSONObject().put("pk", member)).status()).isEqualTo(204); + assertThat(admin.post("/core/groups/" + kof22Admins + "/add_user/", new JSONObject().put("pk", member)).status()).isEqualTo(204); + assertThat(admin.patch("/core/groups/" + kof22Admins + "/", new JSONObject().put("attributes", + new JSONObject().put("qqq.io/permissions", new JSONArray().put("adminEsb.hasAccess")).put("qqq.io/app-access", new JSONArray().put("kof22-website-prod")))).status()).isEqualTo(200); + assertThat(admin.patch("/core/groups/" + identityAdmins + "/", new JSONObject().put("attributes", + new JSONObject().put("qqq.io/permissions", new JSONArray().put("identity.*").put("cms.publish")).put("qqq.io/app-access", new JSONArray().put("kof22-website-prod")))).status()).isEqualTo(200); + + String roleUuid = admin.first("/rbac/roles/?name=" + SERVICE_ACCOUNT).getString("pk"); + try + { + assertThat(admin.patch("/rbac/permissions/assigned_by_roles/" + roleUuid + "/unassign/", new JSONObject().put("permissions", new JSONArray().put("authentik_core.view_user"))).status()).isEqualTo(204); + assertThat(stack.serviceAccount().get("/core/users/?page_size=1").status()).as("view_user removed in the UI").isEqualTo(403); + } + finally + { + stack.applyAndWait(INFRA_BLUEPRINT); + stack.applyAndWait(BOOTSTRAP_BLUEPRINT); + } + + assertThat(memberNames("identity-admins")).contains("reapply.member"); + assertThat(memberNames("kof22-admins")).contains("reapply.member"); + assertThat(admin.first("/core/groups/?name=kof22-admins").getJSONObject("attributes").getJSONArray("qqq.io/permissions").toList()).containsExactly("adminEsb.hasAccess"); + assertThat(admin.first("/core/groups/?name=identity-admins").getJSONObject("attributes").getJSONArray("qqq.io/permissions").toList()).containsExactly("identity.*", "cms.publish"); + + //////////////////////////////////////////////////////////////////////// + // role permission re-asserted; role assignment and break-glass kept // + //////////////////////////////////////////////////////////////////////// + assertThat(stack.serviceAccount().get("/core/users/?page_size=1").status()).as("view_user re-asserted by the re-apply").isEqualTo(200); + JSONObject serviceAccount = admin.first("/core/users/?username=" + SERVICE_ACCOUNT + "&include_roles=true"); + assertThat(BootstrapBlueprintIT.names(serviceAccount.getJSONArray("roles_obj"))).containsExactly(SERVICE_ACCOUNT); + assertThat(admin.first("/core/users/?username=" + BREAK_GLASS).getBoolean("is_superuser")).isTrue(); + + /////////////////////////////////////////////////////////// + // put the seed groups back as the bootstrap created them // + /////////////////////////////////////////////////////////// + admin.post("/core/groups/" + identityAdmins + "/remove_user/", new JSONObject().put("pk", member)); + admin.post("/core/groups/" + kof22Admins + "/remove_user/", new JSONObject().put("pk", member)); + admin.patch("/core/groups/" + kof22Admins + "/", new JSONObject().put("attributes", new JSONObject())); + admin.patch("/core/groups/" + identityAdmins + "/", new JSONObject().put("attributes", + new JSONObject().put("qqq.io/permissions", new JSONArray().put("identity.*")).put("qqq.io/app-access", new JSONArray().put("kof22-website-prod")))); + } + + + + /******************************************************************************* + ** (d) + *******************************************************************************/ + @Test + void presentEntriesWipeApiEdits() + { + String yaml = """ + version: 1 + metadata: + name: lint-demo-present + entries: + - model: authentik_core.group + state: present + id: demo-group + identifiers: + name: lint-demo-group + attrs: + attributes: + note: declared in git + users: + - !Find [authentik_core.user, [username, akadmin]] + - model: authentik_core.user + state: present + identifiers: + username: lint.demo.user + attrs: + name: Lint Demo User + type: internal + path: users + groups: + - !KeyOf demo-group + """; + stack.createContentBlueprint("lint-demo-present", yaml); + + admin.post("/core/users/", new JSONObject().put("username", "lint.added").put("name", "Added Via API").put("type", "internal").put("path", "users")); + int added = admin.userPk("lint.added"); + int demoUser = admin.userPk("lint.demo.user"); + String demoGroup = admin.groupPk("lint-demo-group"); + String publishers = admin.groupPk("kof-website-publishers"); + + assertThat(admin.post("/core/groups/" + demoGroup + "/add_user/", new JSONObject().put("pk", added)).status()).isEqualTo(204); + assertThat(admin.post("/core/groups/" + publishers + "/add_user/", new JSONObject().put("pk", demoUser)).status()).isEqualTo(204); + assertThat(admin.patch("/core/groups/" + demoGroup + "/", new JSONObject().put("attributes", new JSONObject().put("note", "declared in git").put("qqq.io/permissions", new JSONArray().put("cms.publish")))).status()).isEqualTo(200); + assertThat(memberNames("lint-demo-group")).contains("lint.added"); + + stack.applyAndWait("lint-demo-present"); + + assertThat(memberNames("lint-demo-group")).as("present users: replaces the member set").doesNotContain("lint.added").contains("akadmin"); + assertThat(memberNames("kof-website-publishers")).as("present groups: on a user replaces its memberships").doesNotContain("lint.demo.user"); + assertThat(admin.first("/core/groups/?name=lint-demo-group").getJSONObject("attributes").has("qqq.io/permissions")).as("present attributes: replaces the dict").isFalse(); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private List memberNames(String group) + { + JSONArray users = admin.first("/core/groups/?name=" + TestApi.encode(group) + "&include_users=true").getJSONArray("users_obj"); + List rs = new ArrayList<>(); + for(int i = 0; i < users.length(); i++) + { + rs.add(users.getJSONObject(i).getString("username")); + } + return (rs); + } + +} diff --git a/src/test/java/com/kingsrook/qbits/authentik/contract/BootstrapBlueprintIT.java b/src/test/java/com/kingsrook/qbits/authentik/contract/BootstrapBlueprintIT.java new file mode 100644 index 0000000..dec238f --- /dev/null +++ b/src/test/java/com/kingsrook/qbits/authentik/contract/BootstrapBlueprintIT.java @@ -0,0 +1,175 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik.contract; + + +import java.util.ArrayList; +import java.util.List; +import com.kingsrook.qbits.authentik.RequiresDockerCondition; +import org.json.JSONArray; +import org.json.JSONObject; +import org.junit.jupiter.api.BeforeAll; +import org.junit.jupiter.api.Order; +import org.junit.jupiter.api.Test; +import org.junit.jupiter.api.extension.ExtendWith; +import static com.kingsrook.qbits.authentik.contract.AuthentikTestStack.BOOTSTRAP_BLUEPRINT; +import static com.kingsrook.qbits.authentik.contract.AuthentikTestStack.BREAK_GLASS; +import static com.kingsrook.qbits.authentik.contract.AuthentikTestStack.INFRA_BLUEPRINT; +import static com.kingsrook.qbits.authentik.contract.AuthentikTestStack.SERVICE_ACCOUNT; +import static org.assertj.core.api.Assertions.assertThat; + + +/******************************************************************************* + ** Contract test (h): the bootstrap blueprint on an EMPTY Authentik, ordered + ** by its metaapplyblueprint entry, applies cleanly alongside the + ** infrastructure blueprint, and creates exactly the bootstrap objects of + ** DESIGN.md section 4.3. Also open point (i): the role's GLOBAL permissions + ** come from attrs.permissions on a present role entry. + *******************************************************************************/ +@ExtendWith(RequiresDockerCondition.class) +@Order(10) +class BootstrapBlueprintIT +{ + private static AuthentikTestStack stack; + private static TestApi admin; + + + + /******************************************************************************* + ** + *******************************************************************************/ + @BeforeAll + static void beforeAll() + { + stack = AuthentikTestStack.get(); + admin = stack.admin(); + } + + + + /******************************************************************************* + ** Both blueprints, present in /blueprints/custom at first boot, applied. + *******************************************************************************/ + @Test + void bothBlueprintsAppliedOnEmptyInstance() + { + assertThat(stack.blueprint(INFRA_BLUEPRINT).getString("status")).isEqualTo("successful"); + assertThat(stack.blueprint(BOOTSTRAP_BLUEPRINT).getString("status")).isEqualTo("successful"); + } + + + + /******************************************************************************* + ** The service account: type, path, protected marker, role, and no groups. + *******************************************************************************/ + @Test + void serviceAccountCreatedWithRoleAndNoGroups() + { + JSONObject user = admin.first("/core/users/?username=" + SERVICE_ACCOUNT + "&include_roles=true&include_groups=true"); + assertThat(user.getString("type")).isEqualTo("service_account"); + assertThat(user.getString("path")).isEqualTo("service-accounts/qqq"); + assertThat(user.getJSONObject("attributes").getBoolean("qqq.io/protected")).isTrue(); + assertThat(user.getBoolean("is_superuser")).isFalse(); + assertThat(user.getJSONArray("groups")).isEmpty(); + assertThat(names(user.getJSONArray("roles_obj"))).containsExactly(SERVICE_ACCOUNT); + } + + + + /******************************************************************************* + ** Break-glass: a protected superuser through authentik Admins. + *******************************************************************************/ + @Test + void breakGlassIsProtectedSuperuser() + { + JSONObject user = admin.first("/core/users/?username=" + BREAK_GLASS + "&include_groups=true"); + assertThat(user.getBoolean("is_superuser")).isTrue(); + assertThat(user.getJSONObject("attributes").getBoolean("qqq.io/protected")).isTrue(); + assertThat(names(user.getJSONArray("groups_obj"))).containsExactly(AuthentikTestStack.SUPERUSER_GROUP); + } + + + + /******************************************************************************* + ** The four seed groups exist, with no members; only identity-admins has + ** attributes, and drafters has no app access (owner decision pending). + *******************************************************************************/ + @Test + void seedGroupsCreatedWithoutMembers() + { + for(String name : List.of("identity-admins", "kof22-admins", "kof-website-publishers", "kof-website-drafters")) + { + JSONObject group = admin.first("/core/groups/?name=" + name + "&include_users=true"); + assertThat(group).as(name).isNotNull(); + assertThat(group.getBoolean("is_superuser")).as(name).isFalse(); + assertThat(group.getJSONArray("parents")).as(name).isEmpty(); + } + + JSONObject identityAdmins = admin.first("/core/groups/?name=identity-admins").getJSONObject("attributes"); + assertThat(identityAdmins.getJSONArray("qqq.io/permissions").toList()).containsExactly("identity.*"); + assertThat(identityAdmins.getJSONArray("qqq.io/app-access").toList()).containsExactly(AuthentikTestStack.APP_SLUG); + + JSONObject drafters = admin.first("/core/groups/?name=kof-website-drafters").getJSONObject("attributes"); + assertThat(drafters.has("qqq.io/app-access")).isFalse(); + } + + + + /******************************************************************************* + ** Open point (i): global permissions from attrs.permissions, plus the + ** object permission on the recovery email stage from `permissions:`. + *******************************************************************************/ + @Test + void roleHasGlobalAndObjectPermissions() + { + TestApi sa = stack.serviceAccount(); + assertThat(sa.get("/core/users/?page_size=1").status()).isEqualTo(200); + assertThat(sa.get("/core/groups/?page_size=1").status()).isEqualTo(200); + assertThat(sa.get("/events/events/?page_size=1").status()).isEqualTo(200); + assertThat(sa.get("/managed/blueprints/?page_size=1").status()).isEqualTo(200); + assertThat(sa.get("/core/authenticated_sessions/?page_size=1").status()).isEqualTo(200); + + JSONObject stage = admin.first("/stages/email/?name=kof22-recovery-email"); + assertThat(sa.get("/stages/email/" + stage.getString("pk") + "/").status()).isEqualTo(200); + + /////////////////////////////////////////////////// + // and nothing beyond the phase 0/1 read set // + /////////////////////////////////////////////////// + JSONArray tokens = sa.getOk("/core/tokens/?page_size=100").getJSONArray("results"); + for(int i = 0; i < tokens.length(); i++) + { + assertThat(tokens.getJSONObject(i).getJSONObject("user_obj").getString("username")).as("only its own tokens are visible").isEqualTo(SERVICE_ACCOUNT); + } + assertThat(sa.post("/core/groups/", new JSONObject().put("name", "should-not-exist")).status()).isEqualTo(403); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + static List names(JSONArray array) + { + List rs = new ArrayList<>(); + for(int i = 0; i < array.length(); i++) + { + rs.add(array.getJSONObject(i).getString("name")); + } + return (rs); + } + +} diff --git a/src/test/java/com/kingsrook/qbits/authentik/contract/FixtureRecorder.java b/src/test/java/com/kingsrook/qbits/authentik/contract/FixtureRecorder.java new file mode 100644 index 0000000..a007e8d --- /dev/null +++ b/src/test/java/com/kingsrook/qbits/authentik/contract/FixtureRecorder.java @@ -0,0 +1,128 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik.contract; + + +import java.io.IOException; +import java.nio.charset.StandardCharsets; +import java.nio.file.Files; +import java.nio.file.Path; +import com.kingsrook.qbits.authentik.client.AuthentikRedactor; +import org.json.JSONArray; +import org.json.JSONObject; + + +/******************************************************************************* + ** Records real Authentik responses from contract tests as unit-test fixtures + ** (DESIGN.md section 10). Always writes to target/recorded-fixtures/; + ** with -Dauthentik.fixtures.record=true it also refreshes + ** src/test/resources/fixtures/, which the unit tests read. + ** + ** Scrubbing: avatars (data URIs) blanked, secret-looking values masked, + ** ids left as they are (they come from a throwaway container). + *******************************************************************************/ +public final class FixtureRecorder +{ + public static final String VERSION = "2026.8.3"; + + + + /******************************************************************************* + ** Not instantiable. + *******************************************************************************/ + private FixtureRecorder() + { + } + + + + /******************************************************************************* + ** Scrub and save a JSON response under a name. + *******************************************************************************/ + public static void record(String name, String body) + { + String scrubbed = scrub(body); + write(Path.of("target", "recorded-fixtures", VERSION, name + ".json"), scrubbed); + if(Boolean.getBoolean("authentik.fixtures.record")) + { + write(Path.of("src", "test", "resources", "fixtures", VERSION, name + ".json"), scrubbed); + } + } + + + + /******************************************************************************* + ** Scrub a response body. + *******************************************************************************/ + static String scrub(String body) + { + Object parsed = body.trim().startsWith("[") ? new JSONArray(body) : new JSONObject(body); + scrubValue(parsed); + String text = parsed instanceof JSONObject object ? object.toString(2) : ((JSONArray) parsed).toString(2); + return (AuthentikRedactor.redactText(text, null) + "\n"); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private static void scrubValue(Object value) + { + if(value instanceof JSONObject object) + { + for(String key : object.keySet()) + { + Object child = object.get(key); + if(key.equals("avatar") && child instanceof String) + { + object.put(key, ""); + } + else + { + scrubValue(child); + } + } + } + else if(value instanceof JSONArray array) + { + for(int i = 0; i < array.length(); i++) + { + scrubValue(array.get(i)); + } + } + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private static void write(Path path, String text) + { + try + { + Files.createDirectories(path.getParent()); + Files.writeString(path, text, StandardCharsets.UTF_8); + } + catch(IOException e) + { + throw (new IllegalStateException("Could not write fixture " + path, e)); + } + } + +} diff --git a/src/test/java/com/kingsrook/qbits/authentik/contract/QbitReadContractIT.java b/src/test/java/com/kingsrook/qbits/authentik/contract/QbitReadContractIT.java new file mode 100644 index 0000000..99f6acf --- /dev/null +++ b/src/test/java/com/kingsrook/qbits/authentik/contract/QbitReadContractIT.java @@ -0,0 +1,319 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik.contract; + + +import java.io.Serializable; +import java.util.ArrayList; +import java.util.HashSet; +import java.util.List; +import java.util.Map; +import java.util.Set; +import java.util.concurrent.ConcurrentHashMap; +import com.kingsrook.qbits.authentik.AuthentikQBitConfig; +import com.kingsrook.qbits.authentik.AuthentikTestSupport; +import com.kingsrook.qbits.authentik.RequiresDockerCondition; +import com.kingsrook.qbits.authentik.client.AuthentikActionUtil; +import com.kingsrook.qbits.authentik.security.IdentityPermission; +import com.kingsrook.qqq.backend.core.actions.tables.CountAction; +import com.kingsrook.qqq.backend.core.actions.tables.GetAction; +import com.kingsrook.qqq.backend.core.actions.tables.QueryAction; +import com.kingsrook.qqq.backend.core.context.QContext; +import com.kingsrook.qqq.backend.core.exceptions.QException; +import com.kingsrook.qqq.backend.core.exceptions.QPermissionDeniedException; +import com.kingsrook.qqq.backend.core.exceptions.QUserFacingException; +import com.kingsrook.qqq.backend.core.model.actions.tables.count.CountInput; +import com.kingsrook.qqq.backend.core.model.actions.tables.get.GetInput; +import com.kingsrook.qqq.backend.core.model.actions.tables.query.QCriteriaOperator; +import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterCriteria; +import com.kingsrook.qqq.backend.core.model.actions.tables.query.QFilterOrderBy; +import com.kingsrook.qqq.backend.core.model.actions.tables.query.QQueryFilter; +import com.kingsrook.qqq.backend.core.model.actions.tables.query.QueryInput; +import com.kingsrook.qqq.backend.core.model.data.QRecord; +import com.kingsrook.qqq.backend.core.model.metadata.QInstance; +import com.kingsrook.qqq.backend.module.api.actions.QHttpResponse; +import org.apache.http.client.methods.HttpRequestBase; +import org.json.JSONObject; +import org.junit.jupiter.api.AfterEach; +import org.junit.jupiter.api.BeforeAll; +import org.junit.jupiter.api.BeforeEach; +import org.junit.jupiter.api.Order; +import org.junit.jupiter.api.Test; +import org.junit.jupiter.api.extension.ExtendWith; +import static org.assertj.core.api.Assertions.assertThat; +import static org.assertj.core.api.Assertions.assertThatThrownBy; + + +/******************************************************************************* + ** The qbit's own read path (AuthentikActionUtil through QQQ actions) against + ** a real Authentik, as the service account with the phase 0/1 role: paging, + ** count, get, key lookups, filters, scope, protection and sensitive-field + ** stripping. Records the responses it sees as unit-test fixtures. + *******************************************************************************/ +@ExtendWith(RequiresDockerCondition.class) +@Order(60) +class QbitReadContractIT +{ + private static AuthentikTestStack stack; + private static int probeCount = 4; + + private QInstance qInstance; + private AuthentikQBitConfig config; + private String userTable; + private String groupTable; + + + + /******************************************************************************* + ** Records the last response body per request path. + *******************************************************************************/ + public static class RecordingActionUtil extends AuthentikActionUtil + { + static final Map LAST_BODIES = new ConcurrentHashMap<>(); + + + + /******************************************************************************* + ** + *******************************************************************************/ + @Override + protected QHttpResponse send(HttpRequestBase request) throws Exception + { + QHttpResponse response = super.send(request); + LAST_BODIES.put(request.getMethod() + " " + request.getURI().getPath(), response.getContent() == null ? "" : response.getContent()); + return (response); + } + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @BeforeAll + static void beforeAll() + { + stack = AuthentikTestStack.get(); + TestApi admin = stack.admin(); + for(int i = 1; i <= probeCount; i++) + { + admin.post("/core/users/", new JSONObject().put("username", "read.probe" + i).put("name", "Read Probe " + i).put("email", "read.probe" + i + "@example.test").put("type", "internal").put("path", "users")); + } + admin.post("/core/groups/" + admin.groupPk("kof-website-publishers") + "/add_user/", new JSONObject().put("pk", admin.userPk("read.probe1"))); + admin.patch("/core/users/" + admin.userPk("read.probe4") + "/", new JSONObject().put("is_active", false)); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @BeforeEach + void beforeEach() throws QException + { + config = new AuthentikQBitConfig() + .withBaseUrl(stack.baseUrl()) + .withApiToken(stack.serviceAccountToken()) + .withAppKey("kof22-admin") + .withListCacheTtlSeconds(0); + qInstance = AuthentikTestSupport.produce(config); + AuthentikTestSupport.useActionUtil(qInstance, config, RecordingActionUtil.class); + userTable = config.applyPrefix("user"); + groupTable = config.applyPrefix("group"); + AuthentikTestSupport.loginWith(qInstance, IdentityPermission.USERS_READ); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @AfterEach + void afterEach() + { + QContext.clear(); + } + + + + /******************************************************************************* + ** Paging: aligned pages are disjoint and add up to the count; a + ** non-aligned skip uses 100-row pages and still lands on the right rows. + *******************************************************************************/ + @Test + void pagingAndCount() throws QException + { + int total = new CountAction().execute(new CountInput(userTable)).getCount(); + assertThat(total).isGreaterThanOrEqualTo(probeCount + 3); + + List all = query(new QQueryFilter().withOrderBy(new QFilterOrderBy("username"))); + assertThat(all).hasSize(total); + FixtureRecorder.record("users-list", RecordingActionUtil.LAST_BODIES.get("GET /api/v3/core/users/")); + + List pageOne = keys(query(new QQueryFilter().withOrderBy(new QFilterOrderBy("username")).withLimit(2).withSkip(0))); + List pageTwo = keys(query(new QQueryFilter().withOrderBy(new QFilterOrderBy("username")).withLimit(2).withSkip(2))); + assertThat(pageOne).hasSize(2).doesNotContainAnyElementsOf(pageTwo); + assertThat(pageTwo).containsExactlyElementsOf(keys(all).subList(2, 4)); + + List odd = keys(query(new QQueryFilter().withOrderBy(new QFilterOrderBy("username")).withLimit(3).withSkip(1))); + assertThat(odd).containsExactlyElementsOf(keys(all).subList(1, 4)); + } + + + + /******************************************************************************* + ** Filters that map to Authentik query parameters. + *******************************************************************************/ + @Test + void filters() throws QException + { + assertThat(usernames(query(new QQueryFilter(new QFilterCriteria("isActive", QCriteriaOperator.EQUALS, false))))).contains("read.probe4").doesNotContain("read.probe1"); + assertThat(usernames(query(new QQueryFilter(new QFilterCriteria("type", QCriteriaOperator.IN, List.of("service_account")))))).containsExactly(AuthentikTestStack.SERVICE_ACCOUNT); + assertThat(usernames(query(new QQueryFilter(new QFilterCriteria("groupNames", QCriteriaOperator.EQUALS, "kof-website-publishers"))))).contains("read.probe1").doesNotContain("read.probe2"); + assertThat(usernames(query(new QQueryFilter(new QFilterCriteria("username", QCriteriaOperator.CONTAINS, "read.probe"))))).contains("read.probe1", "read.probe2", "read.probe3", "read.probe4"); + assertThat(usernames(query(new QQueryFilter(new QFilterCriteria("lastLogin", QCriteriaOperator.IS_BLANK))))).contains("read.probe2"); + assertThat(usernames(query(new QQueryFilter(new QFilterCriteria("dateJoined", QCriteriaOperator.GREATER_THAN_OR_EQUALS, "2000-01-01"))))).contains("read.probe3"); + + assertThatThrownBy(() -> query(new QQueryFilter(new QFilterCriteria("username", QCriteriaOperator.EQUALS, "a"), new QFilterCriteria("email", QCriteriaOperator.EQUALS, "b")).withBooleanOperator(QQueryFilter.BooleanOperator.OR))) + .isInstanceOf(QUserFacingException.class); + assertThatThrownBy(() -> query(new QQueryFilter(new QFilterCriteria("username", QCriteriaOperator.NOT_EQUALS, "a")))) + .isInstanceOf(QUserFacingException.class); + } + + + + /******************************************************************************* + ** Get by key, key lookups, scope (internal service accounts are invisible), + ** and protection markers. + *******************************************************************************/ + @Test + void getKeyLookupScopeAndProtection() throws QException + { + TestApi admin = stack.admin(); + int probe = admin.userPk("read.probe2"); + int breakGlass = admin.userPk(AuthentikTestStack.BREAK_GLASS); + int sa = admin.userPk(AuthentikTestStack.SERVICE_ACCOUNT); + int outpost = admin.first("/core/users/?type=internal_service_account").getInt("pk"); + + QRecord record = new GetAction().executeForRecord(new GetInput(userTable).withPrimaryKey(probe)); + assertThat(record.getValueString("username")).isEqualTo("read.probe2"); + assertThat(record.getValueBoolean("isProtected")).isFalse(); + FixtureRecorder.record("user-get", RecordingActionUtil.LAST_BODIES.get("GET /api/v3/core/users/" + probe + "/")); + + assertThat(new GetAction().executeForRecord(new GetInput(userTable).withPrimaryKey(breakGlass)).getValueBoolean("isProtected")).isTrue(); + assertThat(new GetAction().executeForRecord(new GetInput(userTable).withPrimaryKey(sa)).getValueBoolean("isProtected")).isTrue(); + assertThat(new GetAction().executeForRecord(new GetInput(userTable).withPrimaryKey(outpost))).as("internal service accounts are out of scope").isNull(); + assertThat(new GetAction().executeForRecord(new GetInput(userTable).withPrimaryKey(999_999))).isNull(); + + List lookup = query(new QQueryFilter(new QFilterCriteria("pk", QCriteriaOperator.IN, List.of(probe, breakGlass, outpost)))); + assertThat(usernames(lookup)).containsExactlyInAnyOrder("read.probe2", AuthentikTestStack.BREAK_GLASS); + } + + + + /******************************************************************************* + ** Sensitive fields need identity.audit.read; reading needs users.read. + *******************************************************************************/ + @Test + void permissionsAndSensitiveFields() throws QException + { + QRecord plain = query(new QQueryFilter(new QFilterCriteria("username", QCriteriaOperator.EQUALS, AuthentikTestStack.BREAK_GLASS))).get(0); + assertThat(plain.getValues()).doesNotContainKey("attributes"); + assertThat(plain.getValueString("qqqAttributes")).contains("qqq.io/protected"); + + AuthentikTestSupport.loginWith(qInstance, IdentityPermission.USERS_READ, IdentityPermission.AUDIT_READ); + QRecord audit = query(new QQueryFilter(new QFilterCriteria("username", QCriteriaOperator.EQUALS, AuthentikTestStack.BREAK_GLASS))).get(0); + assertThat(audit.getValueString("attributes")).contains("qqq.io/protected"); + + AuthentikTestSupport.loginWith(qInstance); + assertThatThrownBy(() -> query(new QQueryFilter())).isInstanceOf(QPermissionDeniedException.class); + } + + + + /******************************************************************************* + ** Groups: list with parents/children, member filter. + *******************************************************************************/ + @Test + void groups() throws QException + { + QueryInput input = new QueryInput(groupTable); + input.setFilter(new QQueryFilter(new QFilterCriteria("memberUsername", QCriteriaOperator.EQUALS, "read.probe1"))); + List groups = new QueryAction().execute(input).getRecords(); + assertThat(groups.stream().map(r -> r.getValueString("name")).toList()).containsExactly("kof-website-publishers"); + + input.setFilter(new QQueryFilter(new QFilterCriteria("name", QCriteriaOperator.EQUALS, "identity-admins"))); + QRecord identityAdmins = new QueryAction().execute(input).getRecords().get(0); + assertThat(identityAdmins.getValueString("permissions")).isEqualTo("identity.*"); + FixtureRecorder.record("groups-list", RecordingActionUtil.LAST_BODIES.get("GET /api/v3/core/groups/")); + } + + + + /******************************************************************************* + ** Error and version responses, for the unit fixtures. + *******************************************************************************/ + @Test + void recordErrorAndVersionFixtures() + { + TestApi sa = stack.serviceAccount(); + TestApi.Response badDate = sa.get("/core/users/?last_login__lt=not-a-date"); + assertThat(badDate.status()).isEqualTo(400); + FixtureRecorder.record("error-400-bad-filter", badDate.body()); + + TestApi.Response forbidden = sa.post("/core/groups/", new JSONObject().put("name", "x")); + assertThat(forbidden.status()).isEqualTo(403); + FixtureRecorder.record("error-403", forbidden.body()); + + FixtureRecorder.record("admin-version", sa.getOk("/admin/version/").toString()); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private List query(QQueryFilter filter) throws QException + { + QueryInput input = new QueryInput(userTable); + input.setFilter(filter); + return (new QueryAction().execute(input).getRecords()); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private static List keys(List records) + { + return (records.stream().map(r -> r.getValue("pk")).toList()); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private static List usernames(List records) + { + List rs = new ArrayList<>(); + records.forEach(r -> rs.add(r.getValueString("username"))); + return (rs); + } + +} diff --git a/src/test/java/com/kingsrook/qbits/authentik/contract/SchemaDriftIT.java b/src/test/java/com/kingsrook/qbits/authentik/contract/SchemaDriftIT.java new file mode 100644 index 0000000..380511b --- /dev/null +++ b/src/test/java/com/kingsrook/qbits/authentik/contract/SchemaDriftIT.java @@ -0,0 +1,100 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik.contract; + + +import java.net.URI; +import java.net.http.HttpClient; +import java.net.http.HttpRequest; +import java.net.http.HttpResponse; +import java.util.ArrayList; +import java.util.List; +import java.util.Set; +import com.fasterxml.jackson.databind.JsonNode; +import com.kingsrook.qbits.authentik.AuthentikTestSupport; +import com.kingsrook.qbits.authentik.RequiresDockerCondition; +import com.kingsrook.qbits.authentik.SchemaDriftTest; +import com.kingsrook.qbits.authentik.client.AuthentikApiSurface; +import org.junit.jupiter.api.Order; +import org.junit.jupiter.api.Test; +import org.junit.jupiter.api.extension.ExtendWith; +import static org.assertj.core.api.Assertions.assertThat; + + +/******************************************************************************* + ** The schema the running container serves (unauthenticated, as for the + ** pinned file) has the same parameters as the pinned schema for every + ** operation the qbit uses. Run with -Dauthentik.test.image=... to rehearse an + ** upgrade: any difference fails with a list. + *******************************************************************************/ +@ExtendWith(RequiresDockerCondition.class) +@Order(20) +class SchemaDriftIT +{ + + /******************************************************************************* + ** + *******************************************************************************/ + @Test + void containerSchemaMatchesPinnedForUsedOperations() throws Exception + { + AuthentikTestStack stack = AuthentikTestStack.get(); + HttpResponse response = HttpClient.newBuilder().version(HttpClient.Version.HTTP_1_1).build().send( + HttpRequest.newBuilder(URI.create(stack.apiRoot() + "/schema/")).header("Accept", "application/yaml").build(), + HttpResponse.BodyHandlers.ofString()); + assertThat(response.statusCode()).isEqualTo(200); + + JsonNode live = SchemaDriftTest.loadSchema(response.body()); + JsonNode pinned = SchemaDriftTest.loadSchema(AuthentikTestSupport.resource("authentik/schema-" + SchemaDriftTest.PINNED_VERSION + ".yml")); + + assertThat(SchemaDriftTest.findDrift(live)).isEmpty(); + + List differences = new ArrayList<>(); + for(AuthentikApiSurface.Operation operation : AuthentikApiSurface.operations()) + { + Set liveParams = params(live, operation); + Set pinnedParams = params(pinned, operation); + if(!liveParams.equals(pinnedParams)) + { + differences.add(operation.path() + ": pinned " + pinnedParams + " vs running " + liveParams); + } + } + assertThat(differences).as("parameter differences between the pinned and the running schema").isEmpty(); + assertThat(live.at("/info/version").asText()).isEqualTo(System.getProperty("authentik.expected.version", SchemaDriftTest.PINNED_VERSION)); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private static Set params(JsonNode schema, AuthentikApiSurface.Operation operation) + { + String path = operation.path(); + JsonNode paths = schema.get("paths"); + for(java.util.Iterator it = paths.fieldNames(); it.hasNext(); ) + { + String candidate = it.next(); + if(candidate.equals(path) || candidate.matches(path.replace("{key}", "\\{[^/]+\\}"))) + { + return (SchemaDriftTest.parameterNames(schema, paths.get(candidate).get(operation.method()))); + } + } + return (Set.of()); + } + +} diff --git a/src/test/java/com/kingsrook/qbits/authentik/contract/SignInPolicyIT.java b/src/test/java/com/kingsrook/qbits/authentik/contract/SignInPolicyIT.java new file mode 100644 index 0000000..fb083fb --- /dev/null +++ b/src/test/java/com/kingsrook/qbits/authentik/contract/SignInPolicyIT.java @@ -0,0 +1,148 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik.contract; + + +import com.kingsrook.qbits.authentik.RequiresDockerCondition; +import org.json.JSONArray; +import org.json.JSONObject; +import org.junit.jupiter.api.BeforeAll; +import org.junit.jupiter.api.Order; +import org.junit.jupiter.api.Test; +import org.junit.jupiter.api.extension.ExtendWith; +import static com.kingsrook.qbits.authentik.contract.AuthentikTestStack.APP_SLUG; +import static org.assertj.core.api.Assertions.assertThat; + + +/******************************************************************************* + ** The proposed cluster-gitops infrastructure changes, on the real importer: + ** - the attribute-driven sign-in policy (qqq.io/app-access, inherited from + ** parent groups, string or list, no substring matches) with the group-name + ** fallback (DESIGN.md section 4.4 step 2), evaluated by the admin's + ** check_access?for_user (superusers may use for_user); + ** - the webhook plumbing (section 7.1) exists and is INERT: its rule has no + ** destination, so Authentik creates no notifications (events/models.py + ** NotificationRule.destination_users yields nobody). + *******************************************************************************/ +@ExtendWith(RequiresDockerCondition.class) +@Order(45) +class SignInPolicyIT +{ + private static TestApi admin; + + + + /******************************************************************************* + ** + *******************************************************************************/ + @BeforeAll + static void beforeAll() + { + admin = AuthentikTestStack.get().admin(); + } + + + + /******************************************************************************* + ** Create a user in a new group with the given attributes (and parent). + *******************************************************************************/ + private int userInGroup(String name, JSONObject attributes, String parentPk) + { + JSONObject group = new JSONObject().put("name", "signin-" + name).put("attributes", attributes); + if(parentPk != null) + { + group.put("parents", new JSONArray().put(parentPk)); + } + admin.post("/core/groups/", group); + admin.post("/core/users/", new JSONObject().put("username", "signin." + name).put("name", "Sign-in " + name).put("type", "internal").put("path", "users")); + int user = admin.userPk("signin." + name); + admin.post("/core/groups/" + admin.groupPk("signin-" + name) + "/add_user/", new JSONObject().put("pk", user)); + return (user); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private boolean passes(int user) + { + return (admin.getOk("/core/applications/" + APP_SLUG + "/check_access/?for_user=" + user).getBoolean("passing")); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @Test + void appAccessAttributeGrantsSignIn() + { + assertThat(passes(userInGroup("list", new JSONObject().put("qqq.io/app-access", new JSONArray().put("other-app").put(APP_SLUG)), null))).isTrue(); + assertThat(passes(userInGroup("string", new JSONObject().put("qqq.io/app-access", APP_SLUG), null))).isTrue(); + assertThat(passes(userInGroup("prefix", new JSONObject().put("qqq.io/app-access", APP_SLUG + "-old"), null))).as("no substring match").isFalse(); + assertThat(passes(userInGroup("none", new JSONObject(), null))).isFalse(); + + String parent = admin.groupPk("signin-list"); + assertThat(passes(userInGroup("child", new JSONObject(), parent))).as("inherited from a parent group").isTrue(); + } + + + + /******************************************************************************* + ** Transition fallback by group name; drafters get nothing until the owner + ** sets qqq.io/app-access on that group. + *******************************************************************************/ + @Test + void groupNameFallbackAndDrafters() + { + admin.post("/core/users/", new JSONObject().put("username", "signin.fallback").put("name", "Fallback").put("type", "internal").put("path", "users")); + int fallback = admin.userPk("signin.fallback"); + admin.post("/core/groups/" + admin.groupPk("kof22-admins") + "/add_user/", new JSONObject().put("pk", fallback)); + assertThat(passes(fallback)).isTrue(); + + admin.post("/core/users/", new JSONObject().put("username", "signin.drafter").put("name", "Drafter").put("type", "internal").put("path", "users")); + int drafter = admin.userPk("signin.drafter"); + admin.post("/core/groups/" + admin.groupPk("kof-website-drafters") + "/add_user/", new JSONObject().put("pk", drafter)); + assertThat(passes(drafter)).isFalse(); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + @Test + void webhookPlumbingIsPresentAndInert() + { + JSONObject transport = admin.first("/events/transports/?name=qqq-kof22-admin"); + assertThat(transport.getString("mode")).isEqualTo("webhook"); + assertThat(transport.getString("webhook_url")).isEqualTo("https://admin.kof22.com/qqq/v1/authentik/webhook"); + assertThat(transport.getBoolean("send_once")).isTrue(); + assertThat(transport.isNull("webhook_mapping_body")).isFalse(); + assertThat(transport.isNull("webhook_mapping_headers")).isFalse(); + + JSONObject rule = admin.first("/events/rules/?name=qqq-kof22-admin-sync"); + assertThat(rule.getBoolean("destination_event_user")).isFalse(); + assertThat(rule.isNull("destination_group")).isTrue(); + assertThat(rule.getJSONArray("transports").toList()).containsExactly(transport.getString("pk")); + + JSONArray bindings = admin.getOk("/policies/bindings/?target=" + rule.getString("pk") + "&page_size=50").getJSONArray("results"); + assertThat(bindings.length()).isEqualTo(11); + } + +} diff --git a/src/test/java/com/kingsrook/qbits/authentik/contract/SuperuserFloorIT.java b/src/test/java/com/kingsrook/qbits/authentik/contract/SuperuserFloorIT.java new file mode 100644 index 0000000..7a8e3a3 --- /dev/null +++ b/src/test/java/com/kingsrook/qbits/authentik/contract/SuperuserFloorIT.java @@ -0,0 +1,266 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik.contract; + + +import java.util.List; +import com.kingsrook.qbits.authentik.RequiresDockerCondition; +import org.json.JSONArray; +import org.json.JSONObject; +import org.junit.jupiter.api.AfterAll; +import org.junit.jupiter.api.BeforeAll; +import org.junit.jupiter.api.Order; +import org.junit.jupiter.api.Test; +import org.junit.jupiter.api.extension.ExtendWith; +import static com.kingsrook.qbits.authentik.contract.AuthentikTestStack.BREAK_GLASS; +import static com.kingsrook.qbits.authentik.contract.AuthentikTestStack.SERVICE_ACCOUNT; +import static com.kingsrook.qbits.authentik.contract.AuthentikTestStack.SUPERUSER_GROUP; +import static org.assertj.core.api.Assertions.assertThat; + + +/******************************************************************************* + ** Contract test (b) and open point (ii): what Authentik itself refuses the + ** qbit's service account, holding the phase 2/3 write permissions it will + ** eventually get, but never enable_group_superuser. + ** + ** ESCALATION is refused in every form (add to a superuser group or a + ** descendant, re-parent under one, user groups PATCH, group users PATCH, + ** create under one, set is_superuser). + ** + ** LOCKOUT is NOT refused: with remove_user_from_group / change_user / + ** change_group the service account can remove a superuser from the superuser + ** group, deactivate break-glass, strip qqq.io/protected, or rename the + ** superuser group. Those tests pin today's behaviour so an Authentik change + ** is noticed; the qbit's guard is the only control (DESIGN.md section 5.1). + *******************************************************************************/ +@ExtendWith(RequiresDockerCondition.class) +@Order(50) +class SuperuserFloorIT +{ + private static final List PHASE_2_3_PERMISSIONS = List.of( + "authentik_core.add_user_to_group", "authentik_core.remove_user_from_group", + "authentik_core.add_group", "authentik_core.change_group", "authentik_core.add_user", "authentik_core.change_user"); + + private static AuthentikTestStack stack; + private static TestApi admin; + private static TestApi sa; + private static String roleUuid; + private static int probeUser; + private static String superuserGroup; + private static String childOfSuperuser; + private static String plainGroup; + + + + /******************************************************************************* + ** Grant the later-phase write permissions (test-only, additive) and create + ** probe objects. + *******************************************************************************/ + @BeforeAll + static void beforeAll() + { + stack = AuthentikTestStack.get(); + admin = stack.admin(); + sa = stack.serviceAccount(); + + roleUuid = admin.first("/rbac/roles/?name=" + SERVICE_ACCOUNT).getString("pk"); + admin.post("/rbac/permissions/assigned_by_roles/" + roleUuid + "/assign/", new JSONObject().put("permissions", new JSONArray(PHASE_2_3_PERMISSIONS))); + + admin.post("/core/users/", new JSONObject().put("username", "floor.probe").put("name", "Floor Probe").put("type", "internal").put("path", "users")); + probeUser = admin.userPk("floor.probe"); + superuserGroup = admin.groupPk(SUPERUSER_GROUP); + admin.post("/core/groups/", new JSONObject().put("name", "floor-child-of-admins").put("parents", new JSONArray().put(superuserGroup))); + childOfSuperuser = admin.groupPk("floor-child-of-admins"); + admin.post("/core/groups/", new JSONObject().put("name", "floor-plain")); + plainGroup = admin.groupPk("floor-plain"); + } + + + + /******************************************************************************* + ** Remove the test-only grants again. + *******************************************************************************/ + @AfterAll + static void afterAll() + { + if(admin != null && roleUuid != null) + { + admin.patch("/rbac/permissions/assigned_by_roles/" + roleUuid + "/unassign/", new JSONObject().put("permissions", new JSONArray(PHASE_2_3_PERMISSIONS))); + } + } + + + + /******************************************************************************* + ** Sanity: an ordinary membership change is allowed. + *******************************************************************************/ + @Test + void ordinaryMembershipAllowed() + { + assertThat(sa.post("/core/groups/" + plainGroup + "/add_user/", new JSONObject().put("pk", probeUser)).status()).isEqualTo(204); + assertThat(sa.post("/core/groups/" + plainGroup + "/remove_user/", new JSONObject().put("pk", probeUser)).status()).isEqualTo(204); + } + + + + /******************************************************************************* + ** (b) add_user to a superuser group, or to a group under one: 403. + *******************************************************************************/ + @Test + void addToSuperuserAncestryRefused() + { + TestApi.Response direct = sa.post("/core/groups/" + superuserGroup + "/add_user/", new JSONObject().put("pk", probeUser)); + assertThat(direct.status()).isEqualTo(403); + assertThat(direct.body()).contains("superuser group"); + + TestApi.Response child = sa.post("/core/groups/" + childOfSuperuser + "/add_user/", new JSONObject().put("pk", probeUser)); + assertThat(child.status()).isEqualTo(403); + } + + + + /******************************************************************************* + ** (b) / open point (ii): re-parenting under a superuser group or one of its + ** descendants, creating a group under one, and setting is_superuser: 400. + *******************************************************************************/ + @Test + void reparentUnderSuperuserRefused() + { + TestApi.Response underAdmins = sa.patch("/core/groups/" + plainGroup + "/", new JSONObject().put("parents", new JSONArray().put(superuserGroup))); + assertThat(underAdmins.status()).isEqualTo(400); + assertThat(underAdmins.body()).contains("superuser parent group"); + + TestApi.Response underChild = sa.patch("/core/groups/" + plainGroup + "/", new JSONObject().put("parents", new JSONArray().put(childOfSuperuser))); + assertThat(underChild.status()).isEqualTo(400); + + TestApi.Response create = sa.post("/core/groups/", new JSONObject().put("name", "floor-new-under-admins").put("parents", new JSONArray().put(superuserGroup))); + assertThat(create.status()).isEqualTo(400); + + TestApi.Response flag = sa.patch("/core/groups/" + plainGroup + "/", new JSONObject().put("is_superuser", true)); + assertThat(flag.status()).isEqualTo(400); + + TestApi.Response unflag = sa.patch("/core/groups/" + superuserGroup + "/", new JSONObject().put("is_superuser", false)); + assertThat(unflag.status()).isEqualTo(400); + } + + + + /******************************************************************************* + ** (b) the bulk forms: user.groups and group.users PATCH. + *******************************************************************************/ + @Test + void bulkMembershipFormsRefused() + { + assertThat(sa.patch("/core/users/" + probeUser + "/", new JSONObject().put("groups", new JSONArray().put(superuserGroup))).status()).isEqualTo(400); + assertThat(sa.patch("/core/groups/" + superuserGroup + "/", new JSONObject().put("users", new JSONArray().put(probeUser))).status()).isEqualTo(400); + } + + + + /******************************************************************************* + ** Tokens, impersonation, deletion and recovery links stay out of reach. + *******************************************************************************/ + @Test + void hardFloorEndpointsRefused() + { + assertThat(sa.post("/core/users/" + probeUser + "/impersonate/", new JSONObject().put("reason", "contract test")).status()).isEqualTo(403); + assertThat(sa.delete("/core/users/" + probeUser + "/").status()).isEqualTo(403); + assertThat(sa.post("/core/users/" + probeUser + "/recovery/", new JSONObject()).status()).isEqualTo(403); + } + + + + /******************************************************************************* + ** Residual risk (pinned): any authenticated user, the service account + ** included, may create API tokens FOR ITSELF without add_token; a `user` + ** in the request is ignored. A compromised QQQ could mint a second + ** service-account token that outlives a rotation, so the drift report + ** flags service-account tokens beyond the expected one. Creating a token + ** for another user is not possible. + *******************************************************************************/ + @Test + void serviceAccountCanMintTokensOnlyForItself() + { + int saPk = admin.userPk(SERVICE_ACCOUNT); + try + { + TestApi.Response created = sa.post("/core/tokens/", new JSONObject().put("identifier", "floor-token").put("user", probeUser).put("intent", "api").put("expiring", true)); + assertThat(created.status()).isEqualTo(201); + JSONObject token = admin.getOk("/core/tokens/floor-token/"); + assertThat(token.getInt("user")).as("owner forced to the caller").isEqualTo(saPk); + + assertThat(sa.get("/core/tokens/floor-token/view_key/").status()).as("and it can read that token's key").isEqualTo(200); + } + finally + { + admin.delete("/core/tokens/floor-token/"); + } + } + + + + /******************************************************************************* + ** Residual risk (pinned): Authentik does NOT stop the lockout direction. + ** Each change is reverted immediately by the admin. + *******************************************************************************/ + @Test + void lockoutDirectionIsNotRefusedByAuthentik() + { + int breakGlass = admin.userPk(BREAK_GLASS); + try + { + assertThat(sa.post("/core/groups/" + superuserGroup + "/remove_user/", new JSONObject().put("pk", breakGlass)).status()).isEqualTo(204); + } + finally + { + admin.post("/core/groups/" + superuserGroup + "/add_user/", new JSONObject().put("pk", breakGlass)); + } + + try + { + assertThat(sa.patch("/core/users/" + breakGlass + "/", new JSONObject().put("is_active", false)).status()).isEqualTo(200); + } + finally + { + admin.patch("/core/users/" + breakGlass + "/", new JSONObject().put("is_active", true)); + } + + try + { + assertThat(sa.patch("/core/users/" + breakGlass + "/", new JSONObject().put("attributes", new JSONObject())).status()).isEqualTo(200); + } + finally + { + admin.patch("/core/users/" + breakGlass + "/", new JSONObject().put("attributes", new JSONObject().put("qqq.io/protected", true))); + } + + try + { + assertThat(sa.patch("/core/groups/" + superuserGroup + "/", new JSONObject().put("name", SUPERUSER_GROUP + " renamed")).status()).isEqualTo(200); + } + finally + { + admin.patch("/core/groups/" + superuserGroup + "/", new JSONObject().put("name", SUPERUSER_GROUP)); + } + + JSONObject restored = admin.first("/core/users/?username=" + BREAK_GLASS + "&include_groups=true"); + assertThat(restored.getBoolean("is_active")).isTrue(); + assertThat(restored.getBoolean("is_superuser")).isTrue(); + assertThat(restored.getJSONObject("attributes").getBoolean("qqq.io/protected")).isTrue(); + } + +} diff --git a/src/test/java/com/kingsrook/qbits/authentik/contract/TestApi.java b/src/test/java/com/kingsrook/qbits/authentik/contract/TestApi.java new file mode 100644 index 0000000..4907534 --- /dev/null +++ b/src/test/java/com/kingsrook/qbits/authentik/contract/TestApi.java @@ -0,0 +1,219 @@ +/* + * Copyright 2026 Kingsrook, LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.kingsrook.qbits.authentik.contract; + + +import java.net.URI; +import java.net.URLEncoder; +import java.net.http.HttpClient; +import java.net.http.HttpRequest; +import java.net.http.HttpResponse; +import java.nio.charset.StandardCharsets; +import java.time.Duration; +import org.json.JSONArray; +import org.json.JSONObject; + + +/******************************************************************************* + ** Minimal Authentik API client for contract tests, acting as one token's + ** user (the test-only bootstrap admin, or the qbit's service account). Used + ** for setup and for asserting Authentik's own behaviour; the qbit's code + ** path is AuthentikActionUtil. + ** + ** Only ever points at the disposable Testcontainers instance. + *******************************************************************************/ +public class TestApi +{ + private static final HttpClient CLIENT = HttpClient.newBuilder().version(HttpClient.Version.HTTP_1_1).connectTimeout(Duration.ofSeconds(10)).build(); + + private final String apiRoot; + private final String token; + + + + /******************************************************************************* + ** Response: status plus raw body. + *******************************************************************************/ + public record Response(int status, String body) + { + /******************************************************************************* + ** Body as a JSON object (empty object for an empty body). + *******************************************************************************/ + public JSONObject json() + { + return (body == null || body.isBlank() ? new JSONObject() : new JSONObject(body)); + } + + + + /******************************************************************************* + ** Shorthand for json().getJSONArray("results"). + *******************************************************************************/ + public JSONArray results() + { + return (json().getJSONArray("results")); + } + } + + + + /******************************************************************************* + ** Constructor. + *******************************************************************************/ + public TestApi(String apiRoot, String token) + { + this.apiRoot = apiRoot; + this.token = token; + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + public Response get(String path) + { + return (send("GET", path, null)); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + public Response post(String path, Object body) + { + return (send("POST", path, body)); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + public Response patch(String path, Object body) + { + return (send("PATCH", path, body)); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + public Response delete(String path) + { + return (send("DELETE", path, null)); + } + + + + /******************************************************************************* + ** GET that must succeed, as JSON. + *******************************************************************************/ + public JSONObject getOk(String path) + { + Response response = get(path); + if(response.status() != 200) + { + throw (new IllegalStateException("GET " + path + " -> " + response.status() + ": " + response.body())); + } + return (response.json()); + } + + + + /******************************************************************************* + ** The first result of a list GET, or null. + *******************************************************************************/ + public JSONObject first(String path) + { + JSONArray results = getOk(path).getJSONArray("results"); + return (results.isEmpty() ? null : results.getJSONObject(0)); + } + + + + /******************************************************************************* + ** pk of a group by name. + *******************************************************************************/ + public String groupPk(String name) + { + JSONObject group = first("/core/groups/?name=" + encode(name)); + if(group == null) + { + throw (new IllegalStateException("No group " + name)); + } + return (group.getString("pk")); + } + + + + /******************************************************************************* + ** pk of a user by username. + *******************************************************************************/ + public int userPk(String username) + { + JSONObject user = first("/core/users/?username=" + encode(username)); + if(user == null) + { + throw (new IllegalStateException("No user " + username)); + } + return (user.getInt("pk")); + } + + + + /******************************************************************************* + ** URL-encode a query value. + *******************************************************************************/ + public static String encode(String value) + { + return (URLEncoder.encode(value, StandardCharsets.UTF_8)); + } + + + + /******************************************************************************* + ** + *******************************************************************************/ + private Response send(String method, String path, Object body) + { + try + { + HttpRequest.Builder builder = HttpRequest.newBuilder(URI.create(apiRoot + path)) + .timeout(Duration.ofSeconds(60)) + .header("Authorization", "Bearer " + token) + .header("Accept", "application/json"); + if(body != null) + { + builder.header("Content-Type", "application/json").method(method, HttpRequest.BodyPublishers.ofString(body.toString())); + } + else + { + builder.method(method, HttpRequest.BodyPublishers.noBody()); + } + HttpResponse response = CLIENT.send(builder.build(), HttpResponse.BodyHandlers.ofString()); + return (new Response(response.statusCode(), response.body())); + } + catch(Exception e) + { + throw (new IllegalStateException(method + " " + path + " failed: " + e.getMessage(), e)); + } + } + +} diff --git a/src/test/resources/authentik/schema-2026.8.3.yml b/src/test/resources/authentik/schema-2026.8.3.yml new file mode 100644 index 0000000..2c4ebd9 --- /dev/null +++ b/src/test/resources/authentik/schema-2026.8.3.yml @@ -0,0 +1,61541 @@ +openapi: 3.0.3 +info: + title: authentik + version: 2026.8.3 + description: Making authentication simple. + contact: + email: hello@goauthentik.io + license: + name: MIT + url: https://github.com/goauthentik/authentik/blob/main/LICENSE +paths: + /admin/apps/: + get: + operationId: admin_apps_list + description: Read-only view list all installed apps + tags: + - admin + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/App' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /admin/file/: + get: + operationId: admin_file_list + description: List files from storage backend. + parameters: + - in: query + name: manageable_only + schema: + type: boolean + default: false + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: usage + schema: + allOf: + - $ref: '#/components/schemas/UsageEnum' + default: media + minLength: 1 + tags: + - admin + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/FileList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: admin_file_create + description: Upload file to storage backend. + tags: + - admin + requestBody: + content: + multipart/form-data: + schema: + $ref: '#/components/schemas/FileUploadRequest' + required: true + security: + - authentik: [] + responses: + '200': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: admin_file_destroy + description: Delete file from storage backend. + parameters: + - $ref: '#/components/parameters/QueryName' + - in: query + name: usage + schema: + allOf: + - $ref: '#/components/schemas/UsageEnum' + default: media + minLength: 1 + tags: + - admin + security: + - authentik: [] + responses: + '200': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /admin/file/used_by/: + get: + operationId: admin_file_used_by_list + parameters: + - $ref: '#/components/parameters/QueryName' + tags: + - admin + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /admin/models/: + get: + operationId: admin_models_list + description: Read-only view list all installed models + parameters: + - in: query + name: filter_has_attributes + schema: + type: boolean + nullable: true + tags: + - admin + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/App' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /admin/settings/: + get: + operationId: admin_settings_retrieve + description: Settings view + tags: + - admin + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Settings' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: admin_settings_update + description: Settings view + tags: + - admin + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SettingsRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Settings' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: admin_settings_partial_update + description: Settings view + tags: + - admin + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedSettingsRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Settings' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /admin/system/: + get: + operationId: admin_system_retrieve + description: Get system information. + tags: + - admin + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SystemInfo' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: admin_system_create + description: Get system information. + tags: + - admin + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SystemInfo' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /admin/version/: + get: + operationId: admin_version_retrieve + description: Get running and latest version. + tags: + - admin + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Version' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /admin/version/history/: + get: + operationId: admin_version_history_list + description: VersionHistory Viewset + parameters: + - in: query + name: build + schema: + type: string + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: version + schema: + type: string + tags: + - admin + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/VersionHistory' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /admin/version/history/{id}/: + get: + operationId: admin_version_history_retrieve + description: VersionHistory Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Version history. + required: true + tags: + - admin + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/VersionHistory' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /agents/agents/: + get: + operationId: agents_agents_list + description: |- + Admin-provisioned delegate identities. An admin creates a Agent for a given + parent user, then grants it access the same way as any other User -- ordinary + PolicyBindings pointed at whatever it needs. + parameters: + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: parent + schema: + type: integer + - $ref: '#/components/parameters/QuerySearch' + tags: + - agents + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedAgentList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: agents_agents_create + description: |- + Admin-provisioned delegate identities. An admin creates a Agent for a given + parent user, then grants it access the same way as any other User -- ordinary + PolicyBindings pointed at whatever it needs. + tags: + - agents + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/AgentCreateRequest' + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/AgentCreated' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /agents/agents/{id}/: + get: + operationId: agents_agents_retrieve + description: |- + Admin-provisioned delegate identities. An admin creates a Agent for a given + parent user, then grants it access the same way as any other User -- ordinary + PolicyBindings pointed at whatever it needs. + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Agent. + required: true + tags: + - agents + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Agent' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: agents_agents_update + description: |- + Admin-provisioned delegate identities. An admin creates a Agent for a given + parent user, then grants it access the same way as any other User -- ordinary + PolicyBindings pointed at whatever it needs. + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Agent. + required: true + tags: + - agents + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/AgentRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Agent' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: agents_agents_partial_update + description: |- + Admin-provisioned delegate identities. An admin creates a Agent for a given + parent user, then grants it access the same way as any other User -- ordinary + PolicyBindings pointed at whatever it needs. + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Agent. + required: true + tags: + - agents + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedAgentRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Agent' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: agents_agents_destroy + description: |- + Admin-provisioned delegate identities. An admin creates a Agent for a given + parent user, then grants it access the same way as any other User -- ordinary + PolicyBindings pointed at whatever it needs. + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Agent. + required: true + tags: + - agents + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/admin/all/: + get: + operationId: authenticators_admin_all_list + description: Get all devices for current user + parameters: + - in: query + name: user + schema: + type: integer + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/Device' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/admin/duo/: + get: + operationId: authenticators_admin_duo_list + description: Viewset for Duo authenticator devices (for admins) + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedDuoDeviceList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: authenticators_admin_duo_create + description: Viewset for Duo authenticator devices (for admins) + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/DuoDeviceRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/DuoDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/admin/duo/{id}/: + get: + operationId: authenticators_admin_duo_retrieve + description: Viewset for Duo authenticator devices (for admins) + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Duo Device. + required: true + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/DuoDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: authenticators_admin_duo_update + description: Viewset for Duo authenticator devices (for admins) + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Duo Device. + required: true + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/DuoDeviceRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/DuoDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: authenticators_admin_duo_partial_update + description: Viewset for Duo authenticator devices (for admins) + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Duo Device. + required: true + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedDuoDeviceRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/DuoDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: authenticators_admin_duo_destroy + description: Viewset for Duo authenticator devices (for admins) + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Duo Device. + required: true + tags: + - authenticators + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/admin/email/: + get: + operationId: authenticators_admin_email_list + description: Viewset for email authenticator devices (for admins) + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedEmailDeviceList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: authenticators_admin_email_create + description: Viewset for email authenticator devices (for admins) + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/EmailDeviceRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/EmailDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/admin/email/{id}/: + get: + operationId: authenticators_admin_email_retrieve + description: Viewset for email authenticator devices (for admins) + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Email Device. + required: true + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/EmailDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: authenticators_admin_email_update + description: Viewset for email authenticator devices (for admins) + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Email Device. + required: true + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/EmailDeviceRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/EmailDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: authenticators_admin_email_partial_update + description: Viewset for email authenticator devices (for admins) + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Email Device. + required: true + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedEmailDeviceRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/EmailDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: authenticators_admin_email_destroy + description: Viewset for email authenticator devices (for admins) + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Email Device. + required: true + tags: + - authenticators + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/admin/endpoint/: + get: + operationId: authenticators_admin_endpoint_list + description: Viewset for Endpoint authenticator devices (for admins) + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedGoogleEndpointDeviceList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: authenticators_admin_endpoint_create + description: Viewset for Endpoint authenticator devices (for admins) + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/GoogleEndpointDeviceRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/GoogleEndpointDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/admin/endpoint/{uuid}/: + get: + operationId: authenticators_admin_endpoint_retrieve + description: Viewset for Endpoint authenticator devices (for admins) + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Endpoint Device. + required: true + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GoogleEndpointDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: authenticators_admin_endpoint_update + description: Viewset for Endpoint authenticator devices (for admins) + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Endpoint Device. + required: true + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/GoogleEndpointDeviceRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GoogleEndpointDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: authenticators_admin_endpoint_partial_update + description: Viewset for Endpoint authenticator devices (for admins) + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Endpoint Device. + required: true + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedGoogleEndpointDeviceRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GoogleEndpointDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: authenticators_admin_endpoint_destroy + description: Viewset for Endpoint authenticator devices (for admins) + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Endpoint Device. + required: true + tags: + - authenticators + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/admin/sms/: + get: + operationId: authenticators_admin_sms_list + description: Viewset for sms authenticator devices (for admins) + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedSMSDeviceList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: authenticators_admin_sms_create + description: Viewset for sms authenticator devices (for admins) + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SMSDeviceRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/SMSDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/admin/sms/{id}/: + get: + operationId: authenticators_admin_sms_retrieve + description: Viewset for sms authenticator devices (for admins) + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this SMS Device. + required: true + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SMSDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: authenticators_admin_sms_update + description: Viewset for sms authenticator devices (for admins) + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this SMS Device. + required: true + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SMSDeviceRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SMSDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: authenticators_admin_sms_partial_update + description: Viewset for sms authenticator devices (for admins) + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this SMS Device. + required: true + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedSMSDeviceRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SMSDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: authenticators_admin_sms_destroy + description: Viewset for sms authenticator devices (for admins) + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this SMS Device. + required: true + tags: + - authenticators + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/admin/static/: + get: + operationId: authenticators_admin_static_list + description: Viewset for static authenticator devices (for admins) + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedStaticDeviceList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: authenticators_admin_static_create + description: Viewset for static authenticator devices (for admins) + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/StaticDeviceRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/StaticDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/admin/static/{id}/: + get: + operationId: authenticators_admin_static_retrieve + description: Viewset for static authenticator devices (for admins) + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Static Device. + required: true + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/StaticDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: authenticators_admin_static_update + description: Viewset for static authenticator devices (for admins) + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Static Device. + required: true + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/StaticDeviceRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/StaticDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: authenticators_admin_static_partial_update + description: Viewset for static authenticator devices (for admins) + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Static Device. + required: true + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedStaticDeviceRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/StaticDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: authenticators_admin_static_destroy + description: Viewset for static authenticator devices (for admins) + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Static Device. + required: true + tags: + - authenticators + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/admin/totp/: + get: + operationId: authenticators_admin_totp_list + description: Viewset for totp authenticator devices (for admins) + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedTOTPDeviceList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: authenticators_admin_totp_create + description: Viewset for totp authenticator devices (for admins) + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/TOTPDeviceRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/TOTPDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/admin/totp/{id}/: + get: + operationId: authenticators_admin_totp_retrieve + description: Viewset for totp authenticator devices (for admins) + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this TOTP Device. + required: true + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/TOTPDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: authenticators_admin_totp_update + description: Viewset for totp authenticator devices (for admins) + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this TOTP Device. + required: true + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/TOTPDeviceRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/TOTPDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: authenticators_admin_totp_partial_update + description: Viewset for totp authenticator devices (for admins) + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this TOTP Device. + required: true + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedTOTPDeviceRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/TOTPDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: authenticators_admin_totp_destroy + description: Viewset for totp authenticator devices (for admins) + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this TOTP Device. + required: true + tags: + - authenticators + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/admin/webauthn/: + get: + operationId: authenticators_admin_webauthn_list + description: Viewset for WebAuthn authenticator devices (for admins) + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedWebAuthnDeviceList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: authenticators_admin_webauthn_create + description: Viewset for WebAuthn authenticator devices (for admins) + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/WebAuthnDeviceRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/WebAuthnDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/admin/webauthn/{id}/: + get: + operationId: authenticators_admin_webauthn_retrieve + description: Viewset for WebAuthn authenticator devices (for admins) + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this WebAuthn Device. + required: true + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/WebAuthnDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: authenticators_admin_webauthn_update + description: Viewset for WebAuthn authenticator devices (for admins) + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this WebAuthn Device. + required: true + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/WebAuthnDeviceRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/WebAuthnDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: authenticators_admin_webauthn_partial_update + description: Viewset for WebAuthn authenticator devices (for admins) + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this WebAuthn Device. + required: true + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedWebAuthnDeviceRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/WebAuthnDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: authenticators_admin_webauthn_destroy + description: Viewset for WebAuthn authenticator devices (for admins) + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this WebAuthn Device. + required: true + tags: + - authenticators + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/all/: + get: + operationId: authenticators_all_list + description: Get all devices for current user + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/Device' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/duo/: + get: + operationId: authenticators_duo_list + description: Viewset for Duo authenticator devices + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedDuoDeviceList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/duo/{id}/: + get: + operationId: authenticators_duo_retrieve + description: Viewset for Duo authenticator devices + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Duo Device. + required: true + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/DuoDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: authenticators_duo_update + description: Viewset for Duo authenticator devices + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Duo Device. + required: true + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/DuoDeviceRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/DuoDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: authenticators_duo_partial_update + description: Viewset for Duo authenticator devices + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Duo Device. + required: true + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedDuoDeviceRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/DuoDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: authenticators_duo_destroy + description: Viewset for Duo authenticator devices + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Duo Device. + required: true + tags: + - authenticators + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/duo/{id}/used_by/: + get: + operationId: authenticators_duo_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Duo Device. + required: true + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/email/: + get: + operationId: authenticators_email_list + description: Viewset for email authenticator devices + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedEmailDeviceList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/email/{id}/: + get: + operationId: authenticators_email_retrieve + description: Viewset for email authenticator devices + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Email Device. + required: true + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/EmailDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: authenticators_email_update + description: Viewset for email authenticator devices + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Email Device. + required: true + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/EmailDeviceRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/EmailDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: authenticators_email_partial_update + description: Viewset for email authenticator devices + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Email Device. + required: true + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedEmailDeviceRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/EmailDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: authenticators_email_destroy + description: Viewset for email authenticator devices + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Email Device. + required: true + tags: + - authenticators + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/email/{id}/used_by/: + get: + operationId: authenticators_email_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Email Device. + required: true + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/endpoint/: + get: + operationId: authenticators_endpoint_list + description: Viewset for Endpoint authenticator devices + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedGoogleEndpointDeviceList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/endpoint/{uuid}/: + get: + operationId: authenticators_endpoint_retrieve + description: Viewset for Endpoint authenticator devices + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Endpoint Device. + required: true + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GoogleEndpointDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/endpoint/{uuid}/used_by/: + get: + operationId: authenticators_endpoint_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Endpoint Device. + required: true + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/sms/: + get: + operationId: authenticators_sms_list + description: Viewset for sms authenticator devices + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedSMSDeviceList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/sms/{id}/: + get: + operationId: authenticators_sms_retrieve + description: Viewset for sms authenticator devices + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this SMS Device. + required: true + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SMSDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: authenticators_sms_update + description: Viewset for sms authenticator devices + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this SMS Device. + required: true + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SMSDeviceRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SMSDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: authenticators_sms_partial_update + description: Viewset for sms authenticator devices + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this SMS Device. + required: true + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedSMSDeviceRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SMSDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: authenticators_sms_destroy + description: Viewset for sms authenticator devices + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this SMS Device. + required: true + tags: + - authenticators + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/sms/{id}/used_by/: + get: + operationId: authenticators_sms_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this SMS Device. + required: true + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/static/: + get: + operationId: authenticators_static_list + description: Viewset for static authenticator devices + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedStaticDeviceList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/static/{id}/: + get: + operationId: authenticators_static_retrieve + description: Viewset for static authenticator devices + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Static Device. + required: true + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/StaticDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: authenticators_static_update + description: Viewset for static authenticator devices + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Static Device. + required: true + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/StaticDeviceRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/StaticDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: authenticators_static_partial_update + description: Viewset for static authenticator devices + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Static Device. + required: true + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedStaticDeviceRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/StaticDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: authenticators_static_destroy + description: Viewset for static authenticator devices + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Static Device. + required: true + tags: + - authenticators + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/static/{id}/used_by/: + get: + operationId: authenticators_static_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Static Device. + required: true + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/totp/: + get: + operationId: authenticators_totp_list + description: Viewset for totp authenticator devices + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedTOTPDeviceList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/totp/{id}/: + get: + operationId: authenticators_totp_retrieve + description: Viewset for totp authenticator devices + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this TOTP Device. + required: true + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/TOTPDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: authenticators_totp_update + description: Viewset for totp authenticator devices + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this TOTP Device. + required: true + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/TOTPDeviceRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/TOTPDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: authenticators_totp_partial_update + description: Viewset for totp authenticator devices + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this TOTP Device. + required: true + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedTOTPDeviceRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/TOTPDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: authenticators_totp_destroy + description: Viewset for totp authenticator devices + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this TOTP Device. + required: true + tags: + - authenticators + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/totp/{id}/used_by/: + get: + operationId: authenticators_totp_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this TOTP Device. + required: true + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/webauthn/: + get: + operationId: authenticators_webauthn_list + description: Viewset for WebAuthn authenticator devices + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedWebAuthnDeviceList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/webauthn/{id}/: + get: + operationId: authenticators_webauthn_retrieve + description: Viewset for WebAuthn authenticator devices + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this WebAuthn Device. + required: true + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/WebAuthnDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: authenticators_webauthn_update + description: Viewset for WebAuthn authenticator devices + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this WebAuthn Device. + required: true + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/WebAuthnDeviceRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/WebAuthnDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: authenticators_webauthn_partial_update + description: Viewset for WebAuthn authenticator devices + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this WebAuthn Device. + required: true + tags: + - authenticators + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedWebAuthnDeviceRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/WebAuthnDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: authenticators_webauthn_destroy + description: Viewset for WebAuthn authenticator devices + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this WebAuthn Device. + required: true + tags: + - authenticators + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /authenticators/webauthn/{id}/used_by/: + get: + operationId: authenticators_webauthn_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this WebAuthn Device. + required: true + tags: + - authenticators + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/application_entitlements/: + get: + operationId: core_application_entitlements_list + description: ApplicationEntitlement Viewset + parameters: + - in: query + name: app + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: pbm_uuid + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QuerySearch' + tags: + - core + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedApplicationEntitlementList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: core_application_entitlements_create + description: ApplicationEntitlement Viewset + tags: + - core + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/ApplicationEntitlementRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/ApplicationEntitlement' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/application_entitlements/{pbm_uuid}/: + get: + operationId: core_application_entitlements_retrieve + description: ApplicationEntitlement Viewset + parameters: + - in: path + name: pbm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Application Entitlement. + required: true + tags: + - core + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/ApplicationEntitlement' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: core_application_entitlements_update + description: ApplicationEntitlement Viewset + parameters: + - in: path + name: pbm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Application Entitlement. + required: true + tags: + - core + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/ApplicationEntitlementRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/ApplicationEntitlement' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: core_application_entitlements_partial_update + description: ApplicationEntitlement Viewset + parameters: + - in: path + name: pbm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Application Entitlement. + required: true + tags: + - core + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedApplicationEntitlementRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/ApplicationEntitlement' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: core_application_entitlements_destroy + description: ApplicationEntitlement Viewset + parameters: + - in: path + name: pbm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Application Entitlement. + required: true + tags: + - core + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/application_entitlements/{pbm_uuid}/used_by/: + get: + operationId: core_application_entitlements_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: pbm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Application Entitlement. + required: true + tags: + - core + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/application_entitlements/requestable/: + get: + operationId: core_application_entitlements_requestable_list + description: List application entitlements which the current user can request + access to + parameters: + - in: query + name: app + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: pbm_uuid + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QuerySearch' + tags: + - core + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedRequestableTargetList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/applications/: + get: + operationId: core_applications_list + description: Custom list method that checks Policy based access instead of guardian + parameters: + - in: query + name: for_user + schema: + type: integer + - in: query + name: group + schema: + type: string + - in: query + name: meta_description + schema: + type: string + - in: query + name: meta_launch_url + schema: + type: string + - in: query + name: meta_publisher + schema: + type: string + - $ref: '#/components/parameters/QueryName' + - in: query + name: only_with_launch_url + schema: + type: boolean + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: slug + schema: + type: string + - in: query + name: superuser_full_list + schema: + type: boolean + tags: + - core + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedApplicationList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: core_applications_create + description: Application Viewset + tags: + - core + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/ApplicationRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/Application' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/applications/{slug}/: + get: + operationId: core_applications_retrieve + description: Application Viewset + parameters: + - in: path + name: slug + schema: + type: string + description: Internal application name, used in URLs. + required: true + tags: + - core + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Application' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: core_applications_update + description: Application Viewset + parameters: + - in: path + name: slug + schema: + type: string + description: Internal application name, used in URLs. + required: true + tags: + - core + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/ApplicationRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Application' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: core_applications_partial_update + description: Application Viewset + parameters: + - in: path + name: slug + schema: + type: string + description: Internal application name, used in URLs. + required: true + tags: + - core + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedApplicationRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Application' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: core_applications_destroy + description: Application Viewset + parameters: + - in: path + name: slug + schema: + type: string + description: Internal application name, used in URLs. + required: true + tags: + - core + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/applications/{slug}/check_access/: + get: + operationId: core_applications_check_access_retrieve + description: Check access to a single application by slug + parameters: + - in: query + name: for_user + schema: + type: integer + - in: path + name: slug + schema: + type: string + description: Internal application name, used in URLs. + required: true + tags: + - core + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PolicyTestResult' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/applications/{slug}/used_by/: + get: + operationId: core_applications_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: slug + schema: + type: string + description: Internal application name, used in URLs. + required: true + tags: + - core + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/applications/requestable/: + get: + operationId: core_applications_requestable_list + description: List applications which the current user can request access to + parameters: + - in: query + name: group + schema: + type: string + - in: query + name: meta_description + schema: + type: string + - in: query + name: meta_launch_url + schema: + type: string + - in: query + name: meta_publisher + schema: + type: string + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: slug + schema: + type: string + tags: + - core + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedApplicationList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/authenticated_sessions/: + get: + operationId: core_authenticated_sessions_list + description: AuthenticatedSession Viewset + parameters: + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: session__last_ip + schema: + type: string + - in: query + name: session__last_user_agent + schema: + type: string + - in: query + name: user__username + schema: + type: string + tags: + - core + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedAuthenticatedSessionList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/authenticated_sessions/{uuid}/: + get: + operationId: core_authenticated_sessions_retrieve + description: AuthenticatedSession Viewset + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + required: true + tags: + - core + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatedSession' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: core_authenticated_sessions_destroy + description: AuthenticatedSession Viewset + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + required: true + tags: + - core + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/authenticated_sessions/{uuid}/used_by/: + get: + operationId: core_authenticated_sessions_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + required: true + tags: + - core + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/authenticated_sessions/bulk_delete/: + delete: + operationId: core_authenticated_sessions_bulk_delete_destroy + description: Bulk revoke all sessions for multiple users + parameters: + - in: query + name: user_pks + schema: + type: array + items: + type: integer + description: List of user IDs to revoke all sessions for + required: true + tags: + - core + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/BulkDeleteSessionResponse' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/brands/: + get: + operationId: core_brands_list + description: Brand Viewset + parameters: + - in: query + name: brand_uuid + schema: + type: string + format: uuid + - in: query + name: branding_default_flow_background + schema: + type: string + - in: query + name: branding_favicon + schema: + type: string + - in: query + name: branding_logo + schema: + type: string + - in: query + name: branding_title + schema: + type: string + - in: query + name: client_certificates + schema: + type: array + items: + type: string + format: uuid + explode: true + style: form + - in: query + name: default + schema: + type: boolean + - in: query + name: domain + schema: + type: string + - in: query + name: flow_authentication + schema: + type: string + format: uuid + - in: query + name: flow_device_code + schema: + type: string + format: uuid + - in: query + name: flow_invalidation + schema: + type: string + format: uuid + - in: query + name: flow_lockdown + schema: + type: string + format: uuid + - in: query + name: flow_recovery + schema: + type: string + format: uuid + - in: query + name: flow_request + schema: + type: string + format: uuid + - in: query + name: flow_unenrollment + schema: + type: string + format: uuid + - in: query + name: flow_user_settings + schema: + type: string + format: uuid + - in: query + name: flow_user_switch + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: web_certificate + schema: + type: string + format: uuid + tags: + - core + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedBrandList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: core_brands_create + description: Brand Viewset + tags: + - core + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/BrandRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/Brand' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/brands/{brand_uuid}/: + get: + operationId: core_brands_retrieve + description: Brand Viewset + parameters: + - in: path + name: brand_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Brand. + required: true + tags: + - core + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Brand' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: core_brands_update + description: Brand Viewset + parameters: + - in: path + name: brand_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Brand. + required: true + tags: + - core + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/BrandRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Brand' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: core_brands_partial_update + description: Brand Viewset + parameters: + - in: path + name: brand_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Brand. + required: true + tags: + - core + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedBrandRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Brand' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: core_brands_destroy + description: Brand Viewset + parameters: + - in: path + name: brand_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Brand. + required: true + tags: + - core + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/brands/{brand_uuid}/used_by/: + get: + operationId: core_brands_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: brand_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Brand. + required: true + tags: + - core + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/brands/current/: + get: + operationId: core_brands_current_retrieve + description: Get current brand + tags: + - core + security: + - authentik: [] + - {} + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/CurrentBrand' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/groups/: + get: + operationId: core_groups_list + description: Group Viewset + parameters: + - in: query + name: attributes + schema: + type: string + description: Attributes + - in: query + name: include_children + schema: + type: boolean + default: false + - in: query + name: include_inherited_roles + schema: + type: boolean + default: false + - in: query + name: include_parents + schema: + type: boolean + default: false + - in: query + name: include_users + schema: + type: boolean + default: true + - in: query + name: is_superuser + schema: + type: boolean + - in: query + name: members_by_pk + schema: + type: array + items: + type: integer + explode: true + style: form + - in: query + name: members_by_username + schema: + type: array + items: + type: string + description: Required. 150 characters or fewer. Letters, digits and @/./+/-/_ + only. + explode: true + style: form + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - core + security: + - authentik: [] + - authentik_device_auth: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedGroupList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: core_groups_create + description: Group Viewset + tags: + - core + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/GroupRequest' + required: true + security: + - authentik: [] + - authentik_device_auth: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/Group' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/groups/{group_uuid}/: + get: + operationId: core_groups_retrieve + description: Group Viewset + parameters: + - in: path + name: group_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Group. + required: true + - in: query + name: include_children + schema: + type: boolean + default: false + - in: query + name: include_inherited_roles + schema: + type: boolean + default: false + - in: query + name: include_parents + schema: + type: boolean + default: false + - in: query + name: include_users + schema: + type: boolean + default: true + tags: + - core + security: + - authentik: [] + - authentik_device_auth: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Group' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: core_groups_update + description: Group Viewset + parameters: + - in: path + name: group_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Group. + required: true + tags: + - core + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/GroupRequest' + required: true + security: + - authentik: [] + - authentik_device_auth: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Group' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: core_groups_partial_update + description: Group Viewset + parameters: + - in: path + name: group_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Group. + required: true + tags: + - core + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedGroupRequest' + security: + - authentik: [] + - authentik_device_auth: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Group' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: core_groups_destroy + description: Group Viewset + parameters: + - in: path + name: group_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Group. + required: true + tags: + - core + security: + - authentik: [] + - authentik_device_auth: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/groups/{group_uuid}/add_user/: + post: + operationId: core_groups_add_user_create + description: Add user to group + parameters: + - in: path + name: group_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Group. + required: true + tags: + - core + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserAccountRequest' + required: true + security: + - authentik: [] + - authentik_device_auth: [] + responses: + '204': + description: User added + '404': + description: User not found + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/groups/{group_uuid}/remove_user/: + post: + operationId: core_groups_remove_user_create + description: Remove user from group + parameters: + - in: path + name: group_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Group. + required: true + tags: + - core + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserAccountRequest' + required: true + security: + - authentik: [] + - authentik_device_auth: [] + responses: + '204': + description: User removed + '404': + description: User not found + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/groups/{group_uuid}/used_by/: + get: + operationId: core_groups_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: group_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Group. + required: true + tags: + - core + security: + - authentik: [] + - authentik_device_auth: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/object_attributes/: + get: + operationId: core_object_attributes_list + parameters: + - in: query + name: enabled + schema: + type: boolean + - in: query + name: object_type__app_label + schema: + type: string + - in: query + name: object_type__model + schema: + type: string + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - core + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedObjectAttributeList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: core_object_attributes_create + tags: + - core + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/ObjectAttributeRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/ObjectAttribute' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/object_attributes/{attribute_id}/: + get: + operationId: core_object_attributes_retrieve + parameters: + - in: path + name: attribute_id + schema: + type: string + format: uuid + description: A UUID string identifying this Object Attribute. + required: true + tags: + - core + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/ObjectAttribute' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: core_object_attributes_update + parameters: + - in: path + name: attribute_id + schema: + type: string + format: uuid + description: A UUID string identifying this Object Attribute. + required: true + tags: + - core + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/ObjectAttributeRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/ObjectAttribute' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: core_object_attributes_partial_update + parameters: + - in: path + name: attribute_id + schema: + type: string + format: uuid + description: A UUID string identifying this Object Attribute. + required: true + tags: + - core + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedObjectAttributeRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/ObjectAttribute' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: core_object_attributes_destroy + parameters: + - in: path + name: attribute_id + schema: + type: string + format: uuid + description: A UUID string identifying this Object Attribute. + required: true + tags: + - core + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/tokens/: + get: + operationId: core_tokens_list + description: Token Viewset + parameters: + - in: query + name: description + schema: + type: string + - in: query + name: expires + schema: + type: string + format: date-time + - in: query + name: expiring + schema: + type: boolean + - in: query + name: identifier + schema: + type: string + - in: query + name: intent + schema: + $ref: '#/components/schemas/IntentEnum' + - in: query + name: managed + schema: + type: string + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: user__username + schema: + type: string + tags: + - core + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedTokenList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: core_tokens_create + description: Token Viewset + tags: + - core + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/TokenRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/Token' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/tokens/{identifier}/: + get: + operationId: core_tokens_retrieve + description: Token Viewset + parameters: + - in: path + name: identifier + schema: + type: string + required: true + tags: + - core + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Token' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: core_tokens_update + description: Token Viewset + parameters: + - in: path + name: identifier + schema: + type: string + required: true + tags: + - core + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/TokenRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Token' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: core_tokens_partial_update + description: Token Viewset + parameters: + - in: path + name: identifier + schema: + type: string + required: true + tags: + - core + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedTokenRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Token' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: core_tokens_destroy + description: Token Viewset + parameters: + - in: path + name: identifier + schema: + type: string + required: true + tags: + - core + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/tokens/{identifier}/set_key/: + post: + operationId: core_tokens_set_key_create + description: |- + Set token key. Action is logged as event. `authentik_core.set_token_key` permission + is required. + parameters: + - in: path + name: identifier + schema: + type: string + required: true + tags: + - core + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/TokenSetKeyRequest' + required: true + security: + - authentik: [] + responses: + '204': + description: Successfully changed key + '400': + description: Missing key + '404': + description: Token not found or expired + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/tokens/{identifier}/used_by/: + get: + operationId: core_tokens_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: identifier + schema: + type: string + required: true + tags: + - core + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/tokens/{identifier}/view_key/: + get: + operationId: core_tokens_view_key_retrieve + description: Return token key and log access + parameters: + - in: path + name: identifier + schema: + type: string + required: true + tags: + - core + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/TokenView' + description: '' + '404': + description: Token not found or expired + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/transactional/applications/: + put: + operationId: core_transactional_applications_update + description: Convert data into a blueprint, validate it and apply it + tags: + - core + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/TransactionApplicationRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/TransactionApplicationResponse' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/user_consent/: + get: + operationId: core_user_consent_list + description: UserConsent Viewset + parameters: + - in: query + name: application + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: user + schema: + type: integer + tags: + - core + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedUserConsentList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/user_consent/{id}/: + get: + operationId: core_user_consent_retrieve + description: UserConsent Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User Consent. + required: true + tags: + - core + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserConsent' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: core_user_consent_destroy + description: UserConsent Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User Consent. + required: true + tags: + - core + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/user_consent/{id}/used_by/: + get: + operationId: core_user_consent_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User Consent. + required: true + tags: + - core + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/users/: + get: + operationId: core_users_list + description: User Viewset + parameters: + - in: query + name: attributes + schema: + type: string + description: Attributes + - in: query + name: date_joined + schema: + type: string + format: date-time + - in: query + name: date_joined__gt + schema: + type: string + format: date-time + - in: query + name: date_joined__lt + schema: + type: string + format: date-time + - in: query + name: email + schema: + type: string + - in: query + name: groups_by_name + schema: + type: array + items: + type: string + explode: true + style: form + - in: query + name: groups_by_pk + schema: + type: array + items: + type: string + format: uuid + explode: true + style: form + - in: query + name: include_groups + schema: + type: boolean + default: true + - in: query + name: include_roles + schema: + type: boolean + default: true + - in: query + name: is_active + schema: + type: boolean + - in: query + name: is_superuser + schema: + type: boolean + - in: query + name: last_login + schema: + type: string + format: date-time + - in: query + name: last_login__gt + schema: + type: string + format: date-time + - in: query + name: last_login__isnull + schema: + type: boolean + - in: query + name: last_login__lt + schema: + type: string + format: date-time + - in: query + name: last_updated + schema: + type: string + format: date-time + - in: query + name: last_updated__gt + schema: + type: string + format: date-time + - in: query + name: last_updated__lt + schema: + type: string + format: date-time + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: path + schema: + type: string + - in: query + name: path_startswith + schema: + type: string + - in: query + name: roles_by_name + schema: + type: array + items: + type: string + explode: true + style: form + - in: query + name: roles_by_pk + schema: + type: array + items: + type: string + format: uuid + explode: true + style: form + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: type + schema: + type: array + items: + $ref: '#/components/schemas/UserTypeEnum' + explode: true + style: form + - in: query + name: username + schema: + type: string + - in: query + name: uuid + schema: + type: string + format: uuid + tags: + - core + security: + - authentik: [] + - authentik_device_auth: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedUserList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: core_users_create + description: User Viewset + tags: + - core + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserRequest' + required: true + security: + - authentik: [] + - authentik_device_auth: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/User' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/users/{id}/: + get: + operationId: core_users_retrieve + description: User Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User. + required: true + tags: + - core + security: + - authentik: [] + - authentik_device_auth: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/User' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: core_users_update + description: User Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User. + required: true + tags: + - core + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserRequest' + required: true + security: + - authentik: [] + - authentik_device_auth: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/User' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: core_users_partial_update + description: User Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User. + required: true + tags: + - core + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedUserRequest' + security: + - authentik: [] + - authentik_device_auth: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/User' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: core_users_destroy + description: User Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User. + required: true + tags: + - core + security: + - authentik: [] + - authentik_device_auth: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/users/{id}/impersonate/: + post: + operationId: core_users_impersonate_create + description: Impersonate a user + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User. + required: true + tags: + - core + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/ImpersonationRequest' + required: true + security: + - authentik: [] + - authentik_device_auth: [] + responses: + '204': + description: Successfully started impersonation + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/users/{id}/recovery/: + post: + operationId: core_users_recovery_create + description: Create a temporary link that a user can use to recover their account + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User. + required: true + tags: + - core + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserRecoveryLinkRequest' + security: + - authentik: [] + - authentik_device_auth: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Link' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/users/{id}/recovery_email/: + post: + operationId: core_users_recovery_email_create + description: Send an email with a temporary link that a user can use to recover + their account + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User. + required: true + tags: + - core + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserRecoveryEmailRequest' + required: true + security: + - authentik: [] + - authentik_device_auth: [] + responses: + '204': + description: Successfully sent recover email + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/users/{id}/set_password/: + post: + operationId: core_users_set_password_create + description: Set password for user + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User. + required: true + tags: + - core + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserPasswordSetRequest' + required: true + security: + - authentik: [] + - authentik_device_auth: [] + responses: + '204': + description: Successfully changed password + '400': + description: Bad request + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/users/{id}/set_password_hash/: + post: + operationId: core_users_set_password_hash_create + description: |- + Set a user's password from a pre-hashed Django password value. + + Submit the Django password hash in the shared ``password`` request field. + + This updates authentik's local password verifier only. It does not attempt + to propagate the password change to LDAP or Kerberos because no raw password + is available from the request payload. + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User. + required: true + tags: + - core + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserPasswordHashSetRequest' + required: true + security: + - authentik: [] + - authentik_device_auth: [] + responses: + '204': + description: Successfully changed password + '400': + description: Bad request + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/users/{id}/used_by/: + get: + operationId: core_users_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User. + required: true + tags: + - core + security: + - authentik: [] + - authentik_device_auth: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/users/account_lockdown/: + post: + operationId: core_users_account_lockdown_create + description: Choose the target account, then return a flow link. + tags: + - core + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserAccountLockdownRequest' + security: + - authentik: [] + - authentik_device_auth: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Link' + examples: + LockdownFlowURL: + value: + link: https://example.invalid/if/flow/default-account-lockdown/ + summary: Lockdown flow URL + description: '' + '400': + description: No lockdown flow configured or the flow is not applicable + '403': + description: Permission denied (when targeting another user) + /core/users/export/: + post: + operationId: core_users_export_create + description: |- + Create a data export for this data type. Note that the export is generated asynchronously: + this method returns a `DataExport` object that will initially have `completed=false` as well + as the permanent URL to that object in the `Location` header. + You can poll that URL until `completed=true`, at which point the `file_url` property will + contain a URL to download + parameters: + - in: query + name: attributes + schema: + type: string + description: Attributes + - in: query + name: date_joined + schema: + type: string + format: date-time + - in: query + name: date_joined__gt + schema: + type: string + format: date-time + - in: query + name: date_joined__lt + schema: + type: string + format: date-time + - in: query + name: email + schema: + type: string + - in: query + name: groups_by_name + schema: + type: array + items: + type: string + explode: true + style: form + - in: query + name: groups_by_pk + schema: + type: array + items: + type: string + format: uuid + explode: true + style: form + - in: query + name: is_active + schema: + type: boolean + - in: query + name: is_superuser + schema: + type: boolean + - in: query + name: last_login + schema: + type: string + format: date-time + - in: query + name: last_login__gt + schema: + type: string + format: date-time + - in: query + name: last_login__isnull + schema: + type: boolean + - in: query + name: last_login__lt + schema: + type: string + format: date-time + - in: query + name: last_updated + schema: + type: string + format: date-time + - in: query + name: last_updated__gt + schema: + type: string + format: date-time + - in: query + name: last_updated__lt + schema: + type: string + format: date-time + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - in: query + name: path + schema: + type: string + - in: query + name: path_startswith + schema: + type: string + - in: query + name: roles_by_name + schema: + type: array + items: + type: string + explode: true + style: form + - in: query + name: roles_by_pk + schema: + type: array + items: + type: string + format: uuid + explode: true + style: form + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: type + schema: + type: array + items: + $ref: '#/components/schemas/UserTypeEnum' + explode: true + style: form + - in: query + name: username + schema: + type: string + - in: query + name: uuid + schema: + type: string + format: uuid + tags: + - core + security: + - authentik: [] + - authentik_device_auth: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/DataExport' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/users/impersonate_end/: + get: + operationId: core_users_impersonate_end_retrieve + description: End Impersonation a user + tags: + - core + security: + - authentik: [] + - authentik_device_auth: [] + responses: + '204': + description: Successfully ended impersonation + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/users/me/: + get: + operationId: core_users_me_retrieve + description: Get information about current user + tags: + - core + security: + - authentik: [] + - authentik_device_auth: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SessionUser' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/users/paths/: + get: + operationId: core_users_paths_retrieve + description: Get all user paths + parameters: + - $ref: '#/components/parameters/QuerySearch' + tags: + - core + security: + - authentik: [] + - authentik_device_auth: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserPath' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/users/service_account/: + post: + operationId: core_users_service_account_create + description: Create a new user account that is marked as a service account + tags: + - core + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserServiceAccountRequest' + required: true + security: + - authentik: [] + - authentik_device_auth: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserServiceAccountResponse' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /core/users/switch/: + post: + operationId: core_users_switch_create + description: Start browser user switching. + parameters: + - in: query + name: next + schema: + type: string + tags: + - core + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserSwitchRequest' + security: + - authentik: [] + - authentik_device_auth: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserSwitchResponse' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /crypto/certificatekeypairs/: + get: + operationId: crypto_certificatekeypairs_list + description: CertificateKeyPair Viewset + parameters: + - in: query + name: has_key + schema: + type: boolean + description: Only return certificate-key pairs with keys + - in: query + name: key_type + schema: + type: array + items: + $ref: '#/components/schemas/KeyTypeEnum' + description: Filter by key algorithm type (RSA, EC, DSA, etc). Can be specified + multiple times (e.g. '?key_type=rsa&key_type=ec') + - in: query + name: managed + schema: + type: string + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - crypto + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedCertificateKeyPairList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: crypto_certificatekeypairs_create + description: CertificateKeyPair Viewset + tags: + - crypto + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/CertificateKeyPairRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/CertificateKeyPair' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /crypto/certificatekeypairs/{kp_uuid}/: + get: + operationId: crypto_certificatekeypairs_retrieve + description: CertificateKeyPair Viewset + parameters: + - in: path + name: kp_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Certificate-Key Pair. + required: true + tags: + - crypto + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/CertificateKeyPair' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: crypto_certificatekeypairs_update + description: CertificateKeyPair Viewset + parameters: + - in: path + name: kp_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Certificate-Key Pair. + required: true + tags: + - crypto + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/CertificateKeyPairRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/CertificateKeyPair' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: crypto_certificatekeypairs_partial_update + description: CertificateKeyPair Viewset + parameters: + - in: path + name: kp_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Certificate-Key Pair. + required: true + tags: + - crypto + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedCertificateKeyPairRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/CertificateKeyPair' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: crypto_certificatekeypairs_destroy + description: CertificateKeyPair Viewset + parameters: + - in: path + name: kp_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Certificate-Key Pair. + required: true + tags: + - crypto + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /crypto/certificatekeypairs/{kp_uuid}/used_by/: + get: + operationId: crypto_certificatekeypairs_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: kp_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Certificate-Key Pair. + required: true + tags: + - crypto + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /crypto/certificatekeypairs/{kp_uuid}/view_certificate/: + get: + operationId: crypto_certificatekeypairs_view_certificate_retrieve + description: Return certificate-key pairs certificate and log access + parameters: + - in: query + name: download + schema: + type: boolean + - in: path + name: kp_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Certificate-Key Pair. + required: true + tags: + - crypto + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/CertificateData' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /crypto/certificatekeypairs/{kp_uuid}/view_private_key/: + get: + operationId: crypto_certificatekeypairs_view_private_key_retrieve + description: Return certificate-key pairs private key and log access + parameters: + - in: query + name: download + schema: + type: boolean + - in: path + name: kp_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Certificate-Key Pair. + required: true + tags: + - crypto + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/CertificateData' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /crypto/certificatekeypairs/generate/: + post: + operationId: crypto_certificatekeypairs_generate_create + description: Generate a new, self-signed certificate-key pair + tags: + - crypto + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/CertificateGenerationRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/CertificateKeyPair' + description: '' + '400': + description: Bad request + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/agents/connectors/: + get: + operationId: endpoints_agents_connectors_list + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: query + name: enabled + schema: + type: boolean + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - endpoints + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedAgentConnectorList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: endpoints_agents_connectors_create + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + tags: + - endpoints + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/AgentConnectorRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/AgentConnector' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/agents/connectors/{connector_uuid}/: + get: + operationId: endpoints_agents_connectors_retrieve + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: path + name: connector_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Agent Connector. + required: true + tags: + - endpoints + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AgentConnector' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: endpoints_agents_connectors_update + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: path + name: connector_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Agent Connector. + required: true + tags: + - endpoints + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/AgentConnectorRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AgentConnector' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: endpoints_agents_connectors_partial_update + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: path + name: connector_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Agent Connector. + required: true + tags: + - endpoints + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedAgentConnectorRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AgentConnector' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: endpoints_agents_connectors_destroy + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: path + name: connector_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Agent Connector. + required: true + tags: + - endpoints + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/agents/connectors/{connector_uuid}/mdm_config/: + post: + operationId: endpoints_agents_connectors_mdm_config_create + description: Generate configuration for MDM systems to deploy authentik Agent + parameters: + - in: path + name: connector_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Agent Connector. + required: true + tags: + - endpoints + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/MDMConfigRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/MDMConfigResponse' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/agents/connectors/{connector_uuid}/used_by/: + get: + operationId: endpoints_agents_connectors_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: connector_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Agent Connector. + required: true + tags: + - endpoints + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/agents/connectors/agent_config/: + get: + operationId: endpoints_agents_connectors_agent_config_retrieve + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + tags: + - endpoints + security: + - authentik_device_auth: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AgentConfig' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/agents/connectors/auth_fed/: + post: + operationId: endpoints_agents_connectors_auth_fed_create + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: query + name: device + schema: + type: string + required: true + tags: + - endpoints + security: + - authentik_device_federation: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AgentTokenResponse' + description: '' + '404': + description: Device not found + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/agents/connectors/auth_ia/: + post: + operationId: endpoints_agents_connectors_auth_ia_create + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: query + name: login_hint + schema: + type: string + tags: + - endpoints + security: + - authentik_device_auth: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AgentAuthenticationResponse' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/agents/connectors/check_in/: + post: + operationId: endpoints_agents_connectors_check_in_create + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + tags: + - endpoints + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/DeviceFactsRequest' + security: + - authentik_device_auth: [] + responses: + '204': + description: Successfully checked in + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/agents/connectors/enroll/: + post: + operationId: endpoints_agents_connectors_enroll_create + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + tags: + - endpoints + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/EnrollRequest' + required: true + security: + - authentik_device_enroll: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AgentTokenResponse' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/agents/enrollment_tokens/: + get: + operationId: endpoints_agents_enrollment_tokens_list + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: query + name: connector + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: token_uuid + schema: + type: string + format: uuid + tags: + - endpoints + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedEnrollmentTokenList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: endpoints_agents_enrollment_tokens_create + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + tags: + - endpoints + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/EnrollmentTokenRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/EnrollmentToken' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/agents/enrollment_tokens/{token_uuid}/: + get: + operationId: endpoints_agents_enrollment_tokens_retrieve + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: path + name: token_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Enrollment Token. + required: true + tags: + - endpoints + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/EnrollmentToken' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: endpoints_agents_enrollment_tokens_update + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: path + name: token_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Enrollment Token. + required: true + tags: + - endpoints + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/EnrollmentTokenRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/EnrollmentToken' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: endpoints_agents_enrollment_tokens_partial_update + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: path + name: token_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Enrollment Token. + required: true + tags: + - endpoints + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedEnrollmentTokenRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/EnrollmentToken' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: endpoints_agents_enrollment_tokens_destroy + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: path + name: token_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Enrollment Token. + required: true + tags: + - endpoints + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/agents/enrollment_tokens/{token_uuid}/used_by/: + get: + operationId: endpoints_agents_enrollment_tokens_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: token_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Enrollment Token. + required: true + tags: + - endpoints + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/agents/enrollment_tokens/{token_uuid}/view_key/: + get: + operationId: endpoints_agents_enrollment_tokens_view_key_retrieve + description: Return token key and log access + parameters: + - in: path + name: token_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Enrollment Token. + required: true + tags: + - endpoints + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/TokenView' + description: '' + '404': + description: Token not found or expired + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/agents/psso/ise/: + get: + operationId: endpoints_agents_psso_ise_list + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: query + name: apple_enclave_key_id + schema: + type: string + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: user + schema: + type: integer + tags: + - endpoints + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedAppleIndependentSecureEnclaveList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: endpoints_agents_psso_ise_create + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + tags: + - endpoints + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/AppleIndependentSecureEnclaveRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/AppleIndependentSecureEnclave' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/agents/psso/ise/{uuid}/: + get: + operationId: endpoints_agents_psso_ise_retrieve + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Apple Independent Secure Enclave. + required: true + tags: + - endpoints + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AppleIndependentSecureEnclave' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: endpoints_agents_psso_ise_update + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Apple Independent Secure Enclave. + required: true + tags: + - endpoints + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/AppleIndependentSecureEnclaveRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AppleIndependentSecureEnclave' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: endpoints_agents_psso_ise_partial_update + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Apple Independent Secure Enclave. + required: true + tags: + - endpoints + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedAppleIndependentSecureEnclaveRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AppleIndependentSecureEnclave' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: endpoints_agents_psso_ise_destroy + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Apple Independent Secure Enclave. + required: true + tags: + - endpoints + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/agents/psso/ise/{uuid}/used_by/: + get: + operationId: endpoints_agents_psso_ise_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Apple Independent Secure Enclave. + required: true + tags: + - endpoints + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/agents/psso/register/device/: + post: + operationId: endpoints_agents_psso_register_device_create + tags: + - endpoints + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/AgentPSSODeviceRegistrationRequest' + required: true + security: + - authentik_device_auth: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AgentPSSODeviceRegistrationResponse' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/agents/psso/register/user/: + post: + operationId: endpoints_agents_psso_register_user_create + tags: + - endpoints + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/AgentPSSOUserRegistrationRequest' + required: true + security: + - authentik_device_auth: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserSelf' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/connectors/: + get: + operationId: endpoints_connectors_list + description: Connector Viewset + parameters: + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - endpoints + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedConnectorList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/connectors/{connector_uuid}/: + get: + operationId: endpoints_connectors_retrieve + description: Connector Viewset + parameters: + - in: path + name: connector_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this connector. + required: true + tags: + - endpoints + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Connector' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: endpoints_connectors_destroy + description: Connector Viewset + parameters: + - in: path + name: connector_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this connector. + required: true + tags: + - endpoints + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/connectors/{connector_uuid}/used_by/: + get: + operationId: endpoints_connectors_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: connector_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this connector. + required: true + tags: + - endpoints + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/connectors/types/: + get: + operationId: endpoints_connectors_types_list + description: Get all creatable types + tags: + - endpoints + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/TypeCreate' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/device_access_groups/: + get: + operationId: endpoints_device_access_groups_list + description: DeviceAccessGroup Viewset + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: pbm_uuid + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QuerySearch' + tags: + - endpoints + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedDeviceAccessGroupList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: endpoints_device_access_groups_create + description: DeviceAccessGroup Viewset + tags: + - endpoints + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/DeviceAccessGroupRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/DeviceAccessGroup' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/device_access_groups/{pbm_uuid}/: + get: + operationId: endpoints_device_access_groups_retrieve + description: DeviceAccessGroup Viewset + parameters: + - in: path + name: pbm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Device access group. + required: true + tags: + - endpoints + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/DeviceAccessGroup' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: endpoints_device_access_groups_update + description: DeviceAccessGroup Viewset + parameters: + - in: path + name: pbm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Device access group. + required: true + tags: + - endpoints + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/DeviceAccessGroupRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/DeviceAccessGroup' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: endpoints_device_access_groups_partial_update + description: DeviceAccessGroup Viewset + parameters: + - in: path + name: pbm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Device access group. + required: true + tags: + - endpoints + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedDeviceAccessGroupRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/DeviceAccessGroup' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: endpoints_device_access_groups_destroy + description: DeviceAccessGroup Viewset + parameters: + - in: path + name: pbm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Device access group. + required: true + tags: + - endpoints + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/device_access_groups/{pbm_uuid}/used_by/: + get: + operationId: endpoints_device_access_groups_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: pbm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Device access group. + required: true + tags: + - endpoints + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/device_bindings/: + get: + operationId: endpoints_device_bindings_list + description: PolicyBinding Viewset + parameters: + - in: query + name: enabled + schema: + type: boolean + - in: query + name: order + schema: + type: integer + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: policy + schema: + type: string + format: uuid + - in: query + name: policy__isnull + schema: + type: boolean + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: target + schema: + type: string + format: uuid + - in: query + name: target_in + schema: + type: array + items: + type: string + format: uuid + explode: true + style: form + - in: query + name: timeout + schema: + type: integer + tags: + - endpoints + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedDeviceUserBindingList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: endpoints_device_bindings_create + description: PolicyBinding Viewset + tags: + - endpoints + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/DeviceUserBindingRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/DeviceUserBinding' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/device_bindings/{policy_binding_uuid}/: + get: + operationId: endpoints_device_bindings_retrieve + description: PolicyBinding Viewset + parameters: + - in: path + name: policy_binding_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Device User binding. + required: true + tags: + - endpoints + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/DeviceUserBinding' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: endpoints_device_bindings_update + description: PolicyBinding Viewset + parameters: + - in: path + name: policy_binding_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Device User binding. + required: true + tags: + - endpoints + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/DeviceUserBindingRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/DeviceUserBinding' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: endpoints_device_bindings_partial_update + description: PolicyBinding Viewset + parameters: + - in: path + name: policy_binding_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Device User binding. + required: true + tags: + - endpoints + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedDeviceUserBindingRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/DeviceUserBinding' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: endpoints_device_bindings_destroy + description: PolicyBinding Viewset + parameters: + - in: path + name: policy_binding_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Device User binding. + required: true + tags: + - endpoints + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/device_bindings/{policy_binding_uuid}/used_by/: + get: + operationId: endpoints_device_bindings_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: policy_binding_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Device User binding. + required: true + tags: + - endpoints + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/devices/: + get: + operationId: endpoints_devices_list + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: query + name: identifier + schema: + type: string + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - endpoints + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedEndpointDeviceList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/devices/{device_uuid}/: + get: + operationId: endpoints_devices_retrieve + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: path + name: device_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Device. + required: true + tags: + - endpoints + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/EndpointDeviceDetails' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: endpoints_devices_update + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: path + name: device_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Device. + required: true + tags: + - endpoints + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/EndpointDeviceRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/EndpointDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: endpoints_devices_partial_update + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: path + name: device_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Device. + required: true + tags: + - endpoints + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedEndpointDeviceRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/EndpointDevice' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: endpoints_devices_destroy + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: path + name: device_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Device. + required: true + tags: + - endpoints + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/devices/{device_uuid}/used_by/: + get: + operationId: endpoints_devices_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: device_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Device. + required: true + tags: + - endpoints + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/devices/summary/: + get: + operationId: endpoints_devices_summary_retrieve + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + tags: + - endpoints + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/DeviceSummary' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/fleet/connectors/: + get: + operationId: endpoints_fleet_connectors_list + description: FleetConnector Viewset + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - endpoints + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedFleetConnectorList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: endpoints_fleet_connectors_create + description: FleetConnector Viewset + tags: + - endpoints + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/FleetConnectorRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/FleetConnector' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/fleet/connectors/{connector_uuid}/: + get: + operationId: endpoints_fleet_connectors_retrieve + description: FleetConnector Viewset + parameters: + - in: path + name: connector_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Fleet Connector. + required: true + tags: + - endpoints + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/FleetConnector' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: endpoints_fleet_connectors_update + description: FleetConnector Viewset + parameters: + - in: path + name: connector_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Fleet Connector. + required: true + tags: + - endpoints + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/FleetConnectorRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/FleetConnector' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: endpoints_fleet_connectors_partial_update + description: FleetConnector Viewset + parameters: + - in: path + name: connector_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Fleet Connector. + required: true + tags: + - endpoints + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedFleetConnectorRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/FleetConnector' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: endpoints_fleet_connectors_destroy + description: FleetConnector Viewset + parameters: + - in: path + name: connector_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Fleet Connector. + required: true + tags: + - endpoints + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/fleet/connectors/{connector_uuid}/used_by/: + get: + operationId: endpoints_fleet_connectors_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: connector_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Fleet Connector. + required: true + tags: + - endpoints + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/google_chrome/connectors/: + get: + operationId: endpoints_google_chrome_connectors_list + description: GoogleChromeConnector Viewset + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - endpoints + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedGoogleChromeConnectorList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: endpoints_google_chrome_connectors_create + description: GoogleChromeConnector Viewset + tags: + - endpoints + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/GoogleChromeConnectorRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/GoogleChromeConnector' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/google_chrome/connectors/{connector_uuid}/: + get: + operationId: endpoints_google_chrome_connectors_retrieve + description: GoogleChromeConnector Viewset + parameters: + - in: path + name: connector_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Google Device Trust Connector. + required: true + tags: + - endpoints + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GoogleChromeConnector' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: endpoints_google_chrome_connectors_update + description: GoogleChromeConnector Viewset + parameters: + - in: path + name: connector_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Google Device Trust Connector. + required: true + tags: + - endpoints + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/GoogleChromeConnectorRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GoogleChromeConnector' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: endpoints_google_chrome_connectors_partial_update + description: GoogleChromeConnector Viewset + parameters: + - in: path + name: connector_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Google Device Trust Connector. + required: true + tags: + - endpoints + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedGoogleChromeConnectorRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GoogleChromeConnector' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: endpoints_google_chrome_connectors_destroy + description: GoogleChromeConnector Viewset + parameters: + - in: path + name: connector_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Google Device Trust Connector. + required: true + tags: + - endpoints + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /endpoints/google_chrome/connectors/{connector_uuid}/used_by/: + get: + operationId: endpoints_google_chrome_connectors_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: connector_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Google Device Trust Connector. + required: true + tags: + - endpoints + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /enterprise/license/: + get: + operationId: enterprise_license_list + description: License Viewset + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - enterprise + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedLicenseList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: enterprise_license_create + description: License Viewset + tags: + - enterprise + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/LicenseRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/License' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /enterprise/license/{license_uuid}/: + get: + operationId: enterprise_license_retrieve + description: License Viewset + parameters: + - in: path + name: license_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this License. + required: true + tags: + - enterprise + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/License' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: enterprise_license_update + description: License Viewset + parameters: + - in: path + name: license_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this License. + required: true + tags: + - enterprise + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/LicenseRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/License' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: enterprise_license_partial_update + description: License Viewset + parameters: + - in: path + name: license_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this License. + required: true + tags: + - enterprise + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedLicenseRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/License' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: enterprise_license_destroy + description: License Viewset + parameters: + - in: path + name: license_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this License. + required: true + tags: + - enterprise + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /enterprise/license/{license_uuid}/used_by/: + get: + operationId: enterprise_license_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: license_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this License. + required: true + tags: + - enterprise + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /enterprise/license/forecast/: + get: + operationId: enterprise_license_forecast_retrieve + description: Forecast how many users will be required in a year + tags: + - enterprise + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/LicenseForecast' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /enterprise/license/install_id/: + get: + operationId: enterprise_license_install_id_retrieve + description: Get install_id + tags: + - enterprise + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/InstallID' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /enterprise/license/summary/: + get: + operationId: enterprise_license_summary_retrieve + description: Get the total license status + parameters: + - in: query + name: cached + schema: + type: boolean + default: true + tags: + - enterprise + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/LicenseSummary' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /events/events/: + get: + operationId: events_events_list + description: Event Read-Only Viewset + parameters: + - in: query + name: action + schema: + type: string + - in: query + name: actions + schema: + type: array + items: + $ref: '#/components/schemas/EventActions' + explode: true + style: form + - in: query + name: brand_name + schema: + type: string + description: Brand name + - in: query + name: client_ip + schema: + type: string + - in: query + name: context_authorized_app + schema: + type: string + description: Context Authorized application + - in: query + name: context_device + schema: + type: string + description: Context Device Primary Key + - in: query + name: context_model_app + schema: + type: string + description: Context Model App + - in: query + name: context_model_name + schema: + type: string + description: Context Model Name + - in: query + name: context_model_pk + schema: + type: string + description: Context Model Primary Key + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: username + schema: + type: string + description: Username + tags: + - events + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedEventList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: events_events_create + description: Event Read-Only Viewset + tags: + - events + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/EventRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/Event' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /events/events/{event_uuid}/: + get: + operationId: events_events_retrieve + description: Event Read-Only Viewset + parameters: + - in: path + name: event_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Event. + required: true + tags: + - events + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Event' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: events_events_update + description: Event Read-Only Viewset + parameters: + - in: path + name: event_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Event. + required: true + tags: + - events + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/EventRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Event' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: events_events_partial_update + description: Event Read-Only Viewset + parameters: + - in: path + name: event_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Event. + required: true + tags: + - events + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedEventRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Event' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: events_events_destroy + description: Event Read-Only Viewset + parameters: + - in: path + name: event_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Event. + required: true + tags: + - events + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /events/events/actions/: + get: + operationId: events_events_actions_list + description: Get all actions + tags: + - events + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/TypeCreate' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /events/events/export/: + post: + operationId: events_events_export_create + description: |- + Create a data export for this data type. Note that the export is generated asynchronously: + this method returns a `DataExport` object that will initially have `completed=false` as well + as the permanent URL to that object in the `Location` header. + You can poll that URL until `completed=true`, at which point the `file_url` property will + contain a URL to download + parameters: + - in: query + name: action + schema: + type: string + - in: query + name: actions + schema: + type: array + items: + $ref: '#/components/schemas/EventActions' + explode: true + style: form + - in: query + name: brand_name + schema: + type: string + description: Brand name + - in: query + name: client_ip + schema: + type: string + - in: query + name: context_authorized_app + schema: + type: string + description: Context Authorized application + - in: query + name: context_device + schema: + type: string + description: Context Device Primary Key + - in: query + name: context_model_app + schema: + type: string + description: Context Model App + - in: query + name: context_model_name + schema: + type: string + description: Context Model Name + - in: query + name: context_model_pk + schema: + type: string + description: Context Model Primary Key + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: username + schema: + type: string + description: Username + tags: + - events + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/DataExport' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /events/events/stats/: + get: + operationId: events_events_stats_retrieve + description: Get event stats for specified filters and count steps + parameters: + - in: query + name: action + schema: + type: string + - in: query + name: actions + schema: + type: array + items: + $ref: '#/components/schemas/EventActions' + explode: true + style: form + - in: query + name: brand_name + schema: + type: string + description: Brand name + - in: query + name: client_ip + schema: + type: string + - in: query + name: context_authorized_app + schema: + type: string + description: Context Authorized application + - in: query + name: context_device + schema: + type: string + description: Context Device Primary Key + - in: query + name: context_model_app + schema: + type: string + description: Context Model App + - in: query + name: context_model_name + schema: + type: string + description: Context Model Name + - in: query + name: context_model_pk + schema: + type: string + description: Context Model Primary Key + - in: query + name: count_steps + schema: + type: array + items: + type: string + minLength: 1 + description: Timedelta, format of 'weeks=3;days=2;hours=3,seconds=2' + required: true + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: username + schema: + type: string + description: Username + tags: + - events + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/EventStats' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /events/events/top_per_user/: + get: + operationId: events_events_top_per_user_list + description: Get the top_n events grouped by user count + parameters: + - in: query + name: action + schema: + type: string + - in: query + name: actions + schema: + type: array + items: + $ref: '#/components/schemas/EventActions' + explode: true + style: form + - in: query + name: brand_name + schema: + type: string + description: Brand name + - in: query + name: client_ip + schema: + type: string + - in: query + name: context_authorized_app + schema: + type: string + description: Context Authorized application + - in: query + name: context_device + schema: + type: string + description: Context Device Primary Key + - in: query + name: context_model_app + schema: + type: string + description: Context Model App + - in: query + name: context_model_name + schema: + type: string + description: Context Model Name + - in: query + name: context_model_pk + schema: + type: string + description: Context Model Primary Key + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: top_n + schema: + type: integer + default: 15 + - in: query + name: username + schema: + type: string + description: Username + tags: + - events + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/EventTopPerUser' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /events/events/volume/: + get: + operationId: events_events_volume_list + description: Get event volume for specified filters and timeframe + parameters: + - in: query + name: action + schema: + type: string + - in: query + name: actions + schema: + type: array + items: + $ref: '#/components/schemas/EventActions' + explode: true + style: form + - in: query + name: brand_name + schema: + type: string + description: Brand name + - in: query + name: client_ip + schema: + type: string + - in: query + name: context_authorized_app + schema: + type: string + description: Context Authorized application + - in: query + name: context_device + schema: + type: string + description: Context Device Primary Key + - in: query + name: context_model_app + schema: + type: string + description: Context Model App + - in: query + name: context_model_name + schema: + type: string + description: Context Model Name + - in: query + name: context_model_pk + schema: + type: string + description: Context Model Primary Key + - in: query + name: history_days + schema: + type: integer + default: 7 + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: username + schema: + type: string + description: Username + tags: + - events + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/EventVolume' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /events/notifications/: + get: + operationId: events_notifications_list + description: Notification Viewset + parameters: + - in: query + name: body + schema: + type: string + - in: query + name: created + schema: + type: string + format: date-time + - in: query + name: event + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: seen + schema: + type: boolean + - in: query + name: severity + schema: + $ref: '#/components/schemas/SeverityEnum' + - in: query + name: user + schema: + type: integer + tags: + - events + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedNotificationList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /events/notifications/{uuid}/: + get: + operationId: events_notifications_retrieve + description: Notification Viewset + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Notification. + required: true + tags: + - events + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Notification' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: events_notifications_update + description: Notification Viewset + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Notification. + required: true + tags: + - events + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/NotificationRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Notification' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: events_notifications_partial_update + description: Notification Viewset + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Notification. + required: true + tags: + - events + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedNotificationRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Notification' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: events_notifications_destroy + description: Notification Viewset + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Notification. + required: true + tags: + - events + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /events/notifications/{uuid}/used_by/: + get: + operationId: events_notifications_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Notification. + required: true + tags: + - events + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /events/notifications/mark_all_seen/: + post: + operationId: events_notifications_mark_all_seen_create + description: Mark all the user's notifications as seen + tags: + - events + security: + - authentik: [] + responses: + '204': + description: Marked tasks as read successfully. + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /events/rules/: + get: + operationId: events_rules_list + description: NotificationRule Viewset + parameters: + - in: query + name: destination_group__name + schema: + type: string + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: severity + schema: + allOf: + - $ref: '#/components/schemas/SeverityEnum' + description: |+ + Controls which severity level the created notifications will have. + + tags: + - events + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedNotificationRuleList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: events_rules_create + description: NotificationRule Viewset + tags: + - events + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/NotificationRuleRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/NotificationRule' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /events/rules/{pbm_uuid}/: + get: + operationId: events_rules_retrieve + description: NotificationRule Viewset + parameters: + - in: path + name: pbm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Notification Rule. + required: true + tags: + - events + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/NotificationRule' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: events_rules_update + description: NotificationRule Viewset + parameters: + - in: path + name: pbm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Notification Rule. + required: true + tags: + - events + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/NotificationRuleRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/NotificationRule' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: events_rules_partial_update + description: NotificationRule Viewset + parameters: + - in: path + name: pbm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Notification Rule. + required: true + tags: + - events + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedNotificationRuleRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/NotificationRule' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: events_rules_destroy + description: NotificationRule Viewset + parameters: + - in: path + name: pbm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Notification Rule. + required: true + tags: + - events + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /events/rules/{pbm_uuid}/used_by/: + get: + operationId: events_rules_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: pbm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Notification Rule. + required: true + tags: + - events + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /events/transports/: + get: + operationId: events_transports_list + description: NotificationTransport Viewset + parameters: + - in: query + name: mode + schema: + $ref: '#/components/schemas/TransportModeEnum' + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: send_once + schema: + type: boolean + - in: query + name: webhook_url + schema: + type: string + tags: + - events + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedNotificationTransportList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: events_transports_create + description: NotificationTransport Viewset + tags: + - events + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/NotificationTransportRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/NotificationTransport' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /events/transports/{uuid}/: + get: + operationId: events_transports_retrieve + description: NotificationTransport Viewset + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Notification Transport. + required: true + tags: + - events + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/NotificationTransport' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: events_transports_update + description: NotificationTransport Viewset + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Notification Transport. + required: true + tags: + - events + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/NotificationTransportRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/NotificationTransport' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: events_transports_partial_update + description: NotificationTransport Viewset + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Notification Transport. + required: true + tags: + - events + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedNotificationTransportRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/NotificationTransport' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: events_transports_destroy + description: NotificationTransport Viewset + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Notification Transport. + required: true + tags: + - events + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /events/transports/{uuid}/test/: + post: + operationId: events_transports_test_create + description: |- + Send example notification using selected transport. Requires + Modify permissions. + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Notification Transport. + required: true + tags: + - events + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/NotificationTransportTest' + description: '' + '500': + description: Failed to test transport + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /events/transports/{uuid}/used_by/: + get: + operationId: events_transports_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Notification Transport. + required: true + tags: + - events + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /flows/bindings/: + get: + operationId: flows_bindings_list + description: FlowStageBinding Viewset + parameters: + - in: query + name: evaluate_on_plan + schema: + type: boolean + - in: query + name: fsb_uuid + schema: + type: string + format: uuid + - in: query + name: invalid_response_action + schema: + allOf: + - $ref: '#/components/schemas/InvalidResponseActionEnum' + description: |+ + Configure how the flow executor should handle an invalid response to a challenge. RETRY returns the error message and a similar challenge to the executor. RESTART restarts the flow from the beginning, and RESTART_WITH_CONTEXT restarts the flow while keeping the current context. + + - in: query + name: order + schema: + type: integer + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: pbm_uuid + schema: + type: string + format: uuid + - in: query + name: policies + schema: + type: array + items: + type: string + format: uuid + explode: true + style: form + - in: query + name: policy_engine_mode + schema: + $ref: '#/components/schemas/PolicyEngineMode' + - in: query + name: re_evaluate_policies + schema: + type: boolean + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: stage + schema: + type: string + format: uuid + - in: query + name: target + schema: + type: string + format: uuid + tags: + - flows + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedFlowStageBindingList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: flows_bindings_create + description: FlowStageBinding Viewset + tags: + - flows + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/FlowStageBindingRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/FlowStageBinding' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /flows/bindings/{fsb_uuid}/: + get: + operationId: flows_bindings_retrieve + description: FlowStageBinding Viewset + parameters: + - in: path + name: fsb_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Flow Stage Binding. + required: true + tags: + - flows + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/FlowStageBinding' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: flows_bindings_update + description: FlowStageBinding Viewset + parameters: + - in: path + name: fsb_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Flow Stage Binding. + required: true + tags: + - flows + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/FlowStageBindingRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/FlowStageBinding' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: flows_bindings_partial_update + description: FlowStageBinding Viewset + parameters: + - in: path + name: fsb_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Flow Stage Binding. + required: true + tags: + - flows + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedFlowStageBindingRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/FlowStageBinding' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: flows_bindings_destroy + description: FlowStageBinding Viewset + parameters: + - in: path + name: fsb_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Flow Stage Binding. + required: true + tags: + - flows + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /flows/bindings/{fsb_uuid}/used_by/: + get: + operationId: flows_bindings_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: fsb_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Flow Stage Binding. + required: true + tags: + - flows + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /flows/executor/{flow_slug}/: + get: + operationId: flows_executor_get + description: Get the next pending challenge from the currently active flow. + parameters: + - in: path + name: flow_slug + schema: + type: string + required: true + - in: query + name: query + schema: + type: string + description: Querystring as received + required: true + tags: + - flows + security: + - authentik: [] + - {} + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/ChallengeTypes' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: flows_executor_solve + description: Solve the previously retrieved challenge and advanced to the next + stage. + parameters: + - in: path + name: flow_slug + schema: + type: string + required: true + - in: query + name: query + schema: + type: string + description: Querystring as received + required: true + tags: + - flows + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/FlowChallengeResponseRequest' + security: + - authentik: [] + - {} + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/ChallengeTypes' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /flows/inspector/{flow_slug}/: + get: + operationId: flows_inspector_get + description: Get current flow state and record it + parameters: + - in: path + name: flow_slug + schema: + type: string + required: true + tags: + - flows + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/FlowInspection' + description: '' + '400': + description: No flow plan in session. + '403': + $ref: '#/components/responses/GenericErrorResponse' + /flows/instances/: + get: + operationId: flows_instances_list + description: Flow Viewset + parameters: + - in: query + name: denied_action + schema: + allOf: + - $ref: '#/components/schemas/DeniedActionEnum' + description: |+ + Configure what should happen when a flow denies access to a user. + + - in: query + name: designation + schema: + allOf: + - $ref: '#/components/schemas/FlowDesignationEnum' + description: |+ + Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik. + + - in: query + name: flow_uuid + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: slug + schema: + type: string + tags: + - flows + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedFlowList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: flows_instances_create + description: Flow Viewset + tags: + - flows + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/FlowRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/Flow' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /flows/instances/{slug}/: + get: + operationId: flows_instances_retrieve + description: Flow Viewset + parameters: + - in: path + name: slug + schema: + type: string + description: Visible in the URL. + required: true + tags: + - flows + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Flow' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: flows_instances_update + description: Flow Viewset + parameters: + - in: path + name: slug + schema: + type: string + description: Visible in the URL. + required: true + tags: + - flows + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/FlowRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Flow' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: flows_instances_partial_update + description: Flow Viewset + parameters: + - in: path + name: slug + schema: + type: string + description: Visible in the URL. + required: true + tags: + - flows + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedFlowRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Flow' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: flows_instances_destroy + description: Flow Viewset + parameters: + - in: path + name: slug + schema: + type: string + description: Visible in the URL. + required: true + tags: + - flows + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /flows/instances/{slug}/diagram/: + get: + operationId: flows_instances_diagram_retrieve + description: Return diagram for flow with slug `slug`, in the format used by + flowchart.js + parameters: + - in: path + name: slug + schema: + type: string + description: Visible in the URL. + required: true + tags: + - flows + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/FlowDiagram' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /flows/instances/{slug}/execute/: + get: + operationId: flows_instances_execute_retrieve + description: Execute flow for current user + parameters: + - in: path + name: slug + schema: + type: string + description: Visible in the URL. + required: true + tags: + - flows + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Link' + description: '' + '400': + description: Flow not applicable + '403': + $ref: '#/components/responses/GenericErrorResponse' + /flows/instances/{slug}/export/: + get: + operationId: flows_instances_export_retrieve + description: Export flow to .yaml file + parameters: + - in: path + name: slug + schema: + type: string + description: Visible in the URL. + required: true + tags: + - flows + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: string + format: binary + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /flows/instances/{slug}/used_by/: + get: + operationId: flows_instances_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: slug + schema: + type: string + description: Visible in the URL. + required: true + tags: + - flows + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /flows/instances/cache_clear/: + post: + operationId: flows_instances_cache_clear_create + description: Clear flow cache + tags: + - flows + security: + - authentik: [] + responses: + '204': + description: Successfully cleared cache + '400': + description: Bad request + '403': + $ref: '#/components/responses/GenericErrorResponse' + /flows/instances/cache_info/: + get: + operationId: flows_instances_cache_info_retrieve + description: Info about cached flows + tags: + - flows + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Cache' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /lifecycle/iterations/: + post: + operationId: lifecycle_iterations_create + description: |- + Mixin to validate that a valid enterprise license + exists before allowing to save the object + tags: + - lifecycle + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/LifecycleIterationRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/LifecycleIteration' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /lifecycle/iterations/latest/{content_type}/{object_id}/: + get: + operationId: lifecycle_iterations_list_latest + description: |- + Mixin to validate that a valid enterprise license + exists before allowing to save the object + parameters: + - in: path + name: content_type + schema: + type: string + pattern: ^[^/]+$ + required: true + - in: path + name: object_id + schema: + type: string + pattern: ^[^/]+$ + required: true + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: user_is_reviewer + schema: + type: boolean + tags: + - lifecycle + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/LifecycleIteration' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /lifecycle/iterations/open/: + get: + operationId: lifecycle_iterations_list_open + description: |- + Mixin to validate that a valid enterprise license + exists before allowing to save the object + parameters: + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: user_is_reviewer + schema: + type: boolean + tags: + - lifecycle + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedLifecycleIterationList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /lifecycle/reviews/: + post: + operationId: lifecycle_reviews_create + description: |- + Mixin to validate that a valid enterprise license + exists before allowing to save the object + tags: + - lifecycle + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/ReviewRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/Review' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /lifecycle/rules/: + get: + operationId: lifecycle_rules_list + parameters: + - in: query + name: content_type__model + schema: + type: string + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - lifecycle + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedLifecycleRuleList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: lifecycle_rules_create + tags: + - lifecycle + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/LifecycleRuleRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/LifecycleRule' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /lifecycle/rules/{id}/: + get: + operationId: lifecycle_rules_retrieve + parameters: + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this lifecycle rule. + required: true + tags: + - lifecycle + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/LifecycleRule' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: lifecycle_rules_update + parameters: + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this lifecycle rule. + required: true + tags: + - lifecycle + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/LifecycleRuleRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/LifecycleRule' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: lifecycle_rules_partial_update + parameters: + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this lifecycle rule. + required: true + tags: + - lifecycle + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedLifecycleRuleRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/LifecycleRule' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: lifecycle_rules_destroy + parameters: + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this lifecycle rule. + required: true + tags: + - lifecycle + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /lifecycle/user_offboarding/: + get: + operationId: lifecycle_user_offboarding_list + parameters: + - in: query + name: action + schema: + $ref: '#/components/schemas/OffboardingActionEnum' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: status + schema: + $ref: '#/components/schemas/OffboardingStatusEnum' + - in: query + name: user__uuid + schema: + type: string + format: uuid + tags: + - lifecycle + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedUserOffboardingList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: lifecycle_user_offboarding_create + tags: + - lifecycle + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserOffboardingRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/UserOffboarding' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /lifecycle/user_offboarding/{id}/: + get: + operationId: lifecycle_user_offboarding_retrieve + parameters: + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this User Offboarding. + required: true + tags: + - lifecycle + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserOffboarding' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: lifecycle_user_offboarding_destroy + description: |- + Cancel a pending offboarding instead of deleting the record. + + The row is retained (as `CANCELED`) so the offboarding stays visible in + the audit history; deletion would erase who scheduled and cancelled it. + You cannot cancel an offboarding that targets you. + parameters: + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this User Offboarding. + required: true + tags: + - lifecycle + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /managed/blueprints/: + get: + operationId: managed_blueprints_list + description: Blueprint instances + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: path + schema: + type: string + - $ref: '#/components/parameters/QuerySearch' + tags: + - managed + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedBlueprintInstanceList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: managed_blueprints_create + description: Blueprint instances + tags: + - managed + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/BlueprintInstanceRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/BlueprintInstance' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /managed/blueprints/{instance_uuid}/: + get: + operationId: managed_blueprints_retrieve + description: Blueprint instances + parameters: + - in: path + name: instance_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Blueprint Instance. + required: true + tags: + - managed + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/BlueprintInstance' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: managed_blueprints_update + description: Blueprint instances + parameters: + - in: path + name: instance_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Blueprint Instance. + required: true + tags: + - managed + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/BlueprintInstanceRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/BlueprintInstance' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: managed_blueprints_partial_update + description: Blueprint instances + parameters: + - in: path + name: instance_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Blueprint Instance. + required: true + tags: + - managed + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedBlueprintInstanceRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/BlueprintInstance' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: managed_blueprints_destroy + description: Blueprint instances + parameters: + - in: path + name: instance_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Blueprint Instance. + required: true + tags: + - managed + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /managed/blueprints/{instance_uuid}/apply/: + post: + operationId: managed_blueprints_apply_create + description: Apply a blueprint + parameters: + - in: path + name: instance_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Blueprint Instance. + required: true + tags: + - managed + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/BlueprintInstance' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /managed/blueprints/{instance_uuid}/used_by/: + get: + operationId: managed_blueprints_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: instance_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Blueprint Instance. + required: true + tags: + - managed + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /managed/blueprints/available/: + get: + operationId: managed_blueprints_available_list + description: Get blueprints + tags: + - managed + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/BlueprintFile' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /managed/blueprints/import/: + post: + operationId: managed_blueprints_import_create + description: Import blueprint from .yaml file and apply it once, without creating + an instance + tags: + - managed + requestBody: + content: + multipart/form-data: + schema: + $ref: '#/components/schemas/BlueprintUploadRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/BlueprintImportResult' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /oauth2/access_tokens/: + get: + operationId: oauth2_access_tokens_list + description: AccessToken Viewset + parameters: + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: provider + schema: + type: integer + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: user + schema: + type: integer + tags: + - oauth2 + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedTokenModelList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /oauth2/access_tokens/{id}/: + get: + operationId: oauth2_access_tokens_retrieve + description: AccessToken Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this OAuth2 Access Token. + required: true + tags: + - oauth2 + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/TokenModel' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: oauth2_access_tokens_destroy + description: AccessToken Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this OAuth2 Access Token. + required: true + tags: + - oauth2 + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /oauth2/access_tokens/{id}/used_by/: + get: + operationId: oauth2_access_tokens_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this OAuth2 Access Token. + required: true + tags: + - oauth2 + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /oauth2/authorization_codes/: + get: + operationId: oauth2_authorization_codes_list + description: AuthorizationCode Viewset + parameters: + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: provider + schema: + type: integer + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: user + schema: + type: integer + tags: + - oauth2 + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedExpiringBaseGrantModelList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /oauth2/authorization_codes/{id}/: + get: + operationId: oauth2_authorization_codes_retrieve + description: AuthorizationCode Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Authorization Code. + required: true + tags: + - oauth2 + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/ExpiringBaseGrantModel' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: oauth2_authorization_codes_destroy + description: AuthorizationCode Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Authorization Code. + required: true + tags: + - oauth2 + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /oauth2/authorization_codes/{id}/used_by/: + get: + operationId: oauth2_authorization_codes_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Authorization Code. + required: true + tags: + - oauth2 + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /oauth2/refresh_tokens/: + get: + operationId: oauth2_refresh_tokens_list + description: RefreshToken Viewset + parameters: + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: provider + schema: + type: integer + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: user + schema: + type: integer + tags: + - oauth2 + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedTokenModelList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /oauth2/refresh_tokens/{id}/: + get: + operationId: oauth2_refresh_tokens_retrieve + description: RefreshToken Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this OAuth2 Refresh Token. + required: true + tags: + - oauth2 + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/TokenModel' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: oauth2_refresh_tokens_destroy + description: RefreshToken Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this OAuth2 Refresh Token. + required: true + tags: + - oauth2 + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /oauth2/refresh_tokens/{id}/used_by/: + get: + operationId: oauth2_refresh_tokens_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this OAuth2 Refresh Token. + required: true + tags: + - oauth2 + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /outposts/instances/: + get: + operationId: outposts_instances_list + description: Outpost Viewset + parameters: + - in: query + name: managed__icontains + schema: + type: string + - in: query + name: managed__iexact + schema: + type: string + - in: query + name: name__icontains + schema: + type: string + - in: query + name: name__iexact + schema: + type: string + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: providers__isnull + schema: + type: boolean + - in: query + name: providers_by_pk + schema: + type: array + items: + type: integer + explode: true + style: form + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: service_connection__name__icontains + schema: + type: string + - in: query + name: service_connection__name__iexact + schema: + type: string + tags: + - outposts + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedOutpostList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: outposts_instances_create + description: Outpost Viewset + tags: + - outposts + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/OutpostRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/Outpost' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /outposts/instances/{uuid}/: + get: + operationId: outposts_instances_retrieve + description: Outpost Viewset + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Outpost. + required: true + tags: + - outposts + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Outpost' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: outposts_instances_update + description: Outpost Viewset + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Outpost. + required: true + tags: + - outposts + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/OutpostRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Outpost' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: outposts_instances_partial_update + description: Outpost Viewset + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Outpost. + required: true + tags: + - outposts + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedOutpostRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Outpost' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: outposts_instances_destroy + description: Outpost Viewset + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Outpost. + required: true + tags: + - outposts + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /outposts/instances/{uuid}/health/: + get: + operationId: outposts_instances_health_list + description: Get outposts current health + parameters: + - in: query + name: managed__icontains + schema: + type: string + - in: query + name: managed__iexact + schema: + type: string + - in: query + name: name__icontains + schema: + type: string + - in: query + name: name__iexact + schema: + type: string + - $ref: '#/components/parameters/QueryPaginationOrdering' + - in: query + name: providers__isnull + schema: + type: boolean + - in: query + name: providers_by_pk + schema: + type: array + items: + type: integer + explode: true + style: form + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: service_connection__name__icontains + schema: + type: string + - in: query + name: service_connection__name__iexact + schema: + type: string + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Outpost. + required: true + tags: + - outposts + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/OutpostHealth' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /outposts/instances/{uuid}/used_by/: + get: + operationId: outposts_instances_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Outpost. + required: true + tags: + - outposts + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /outposts/instances/default_settings/: + get: + operationId: outposts_instances_default_settings_retrieve + description: Global default outpost config + tags: + - outposts + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/OutpostDefaultConfig' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /outposts/ldap/: + get: + operationId: outposts_ldap_list + description: LDAPProvider Viewset + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - outposts + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedLDAPOutpostConfigList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /outposts/ldap/{id}/check_access/: + get: + operationId: outposts_ldap_access_check + description: Check access to a single application by slug + parameters: + - in: query + name: app_slug + schema: + type: string + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this LDAP Provider. + required: true + tags: + - outposts + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/LDAPCheckAccess' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /outposts/proxy/: + get: + operationId: outposts_proxy_list + description: ProxyProvider Viewset + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - outposts + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedProxyOutpostConfigList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /outposts/radius/: + get: + operationId: outposts_radius_list + description: RadiusProvider Viewset + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - outposts + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedRadiusOutpostConfigList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /outposts/radius/{id}/check_access/: + get: + operationId: outposts_radius_access_check + description: Check access to a single application by slug + parameters: + - in: query + name: app_slug + schema: + type: string + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Radius Provider. + required: true + tags: + - outposts + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/RadiusCheckAccess' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /outposts/service_connections/all/: + get: + operationId: outposts_service_connections_all_list + description: ServiceConnection Viewset + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - outposts + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedServiceConnectionList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /outposts/service_connections/all/{uuid}/: + get: + operationId: outposts_service_connections_all_retrieve + description: ServiceConnection Viewset + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Outpost Service-Connection. + required: true + tags: + - outposts + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/ServiceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: outposts_service_connections_all_destroy + description: ServiceConnection Viewset + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Outpost Service-Connection. + required: true + tags: + - outposts + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /outposts/service_connections/all/{uuid}/state/: + get: + operationId: outposts_service_connections_all_state_retrieve + description: Get the service connection's state + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Outpost Service-Connection. + required: true + tags: + - outposts + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/ServiceConnectionState' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /outposts/service_connections/all/{uuid}/used_by/: + get: + operationId: outposts_service_connections_all_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Outpost Service-Connection. + required: true + tags: + - outposts + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /outposts/service_connections/all/types/: + get: + operationId: outposts_service_connections_all_types_list + description: Get all creatable types + tags: + - outposts + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/TypeCreate' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /outposts/service_connections/docker/: + get: + operationId: outposts_service_connections_docker_list + description: DockerServiceConnection Viewset + parameters: + - in: query + name: local + schema: + type: boolean + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: tls_authentication + schema: + type: string + format: uuid + - in: query + name: tls_verification + schema: + type: string + format: uuid + - in: query + name: url + schema: + type: string + tags: + - outposts + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedDockerServiceConnectionList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: outposts_service_connections_docker_create + description: DockerServiceConnection Viewset + tags: + - outposts + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/DockerServiceConnectionRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/DockerServiceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /outposts/service_connections/docker/{uuid}/: + get: + operationId: outposts_service_connections_docker_retrieve + description: DockerServiceConnection Viewset + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Docker Service-Connection. + required: true + tags: + - outposts + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/DockerServiceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: outposts_service_connections_docker_update + description: DockerServiceConnection Viewset + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Docker Service-Connection. + required: true + tags: + - outposts + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/DockerServiceConnectionRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/DockerServiceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: outposts_service_connections_docker_partial_update + description: DockerServiceConnection Viewset + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Docker Service-Connection. + required: true + tags: + - outposts + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedDockerServiceConnectionRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/DockerServiceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: outposts_service_connections_docker_destroy + description: DockerServiceConnection Viewset + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Docker Service-Connection. + required: true + tags: + - outposts + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /outposts/service_connections/docker/{uuid}/used_by/: + get: + operationId: outposts_service_connections_docker_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Docker Service-Connection. + required: true + tags: + - outposts + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /outposts/service_connections/kubernetes/: + get: + operationId: outposts_service_connections_kubernetes_list + description: KubernetesServiceConnection Viewset + parameters: + - in: query + name: local + schema: + type: boolean + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - outposts + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedKubernetesServiceConnectionList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: outposts_service_connections_kubernetes_create + description: KubernetesServiceConnection Viewset + tags: + - outposts + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/KubernetesServiceConnectionRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/KubernetesServiceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /outposts/service_connections/kubernetes/{uuid}/: + get: + operationId: outposts_service_connections_kubernetes_retrieve + description: KubernetesServiceConnection Viewset + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Kubernetes Service-Connection. + required: true + tags: + - outposts + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/KubernetesServiceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: outposts_service_connections_kubernetes_update + description: KubernetesServiceConnection Viewset + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Kubernetes Service-Connection. + required: true + tags: + - outposts + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/KubernetesServiceConnectionRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/KubernetesServiceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: outposts_service_connections_kubernetes_partial_update + description: KubernetesServiceConnection Viewset + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Kubernetes Service-Connection. + required: true + tags: + - outposts + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedKubernetesServiceConnectionRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/KubernetesServiceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: outposts_service_connections_kubernetes_destroy + description: KubernetesServiceConnection Viewset + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Kubernetes Service-Connection. + required: true + tags: + - outposts + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /outposts/service_connections/kubernetes/{uuid}/used_by/: + get: + operationId: outposts_service_connections_kubernetes_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Kubernetes Service-Connection. + required: true + tags: + - outposts + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/all/: + get: + operationId: policies_all_list + description: Policy Viewset + parameters: + - in: query + name: bindings__isnull + schema: + type: boolean + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: promptstage__isnull + schema: + type: boolean + - $ref: '#/components/parameters/QuerySearch' + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedPolicyList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/all/{policy_uuid}/: + get: + operationId: policies_all_retrieve + description: Policy Viewset + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Policy. + required: true + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Policy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: policies_all_destroy + description: Policy Viewset + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Policy. + required: true + tags: + - policies + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/all/{policy_uuid}/test/: + post: + operationId: policies_all_test_create + description: Test policy + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Policy. + required: true + tags: + - policies + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PolicyTestRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PolicyTestResult' + description: '' + '400': + description: Invalid parameters + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/all/{policy_uuid}/used_by/: + get: + operationId: policies_all_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Policy. + required: true + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/all/cache_clear/: + post: + operationId: policies_all_cache_clear_create + description: Clear policy cache + tags: + - policies + security: + - authentik: [] + responses: + '204': + description: Successfully cleared cache + '400': + description: Bad request + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/all/cache_info/: + get: + operationId: policies_all_cache_info_retrieve + description: Info about cached policies + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Cache' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/all/types/: + get: + operationId: policies_all_types_list + description: Get all creatable types + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/TypeCreate' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/bindings/: + get: + operationId: policies_bindings_list + description: PolicyBinding Viewset + parameters: + - in: query + name: enabled + schema: + type: boolean + - in: query + name: order + schema: + type: integer + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: policy + schema: + type: string + format: uuid + - in: query + name: policy__isnull + schema: + type: boolean + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: target + schema: + type: string + format: uuid + - in: query + name: target_in + schema: + type: array + items: + type: string + format: uuid + explode: true + style: form + - in: query + name: timeout + schema: + type: integer + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedPolicyBindingList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: policies_bindings_create + description: PolicyBinding Viewset + tags: + - policies + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PolicyBindingRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/PolicyBinding' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/bindings/{policy_binding_uuid}/: + get: + operationId: policies_bindings_retrieve + description: PolicyBinding Viewset + parameters: + - in: path + name: policy_binding_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Policy Binding. + required: true + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PolicyBinding' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: policies_bindings_update + description: PolicyBinding Viewset + parameters: + - in: path + name: policy_binding_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Policy Binding. + required: true + tags: + - policies + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PolicyBindingRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PolicyBinding' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: policies_bindings_partial_update + description: PolicyBinding Viewset + parameters: + - in: path + name: policy_binding_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Policy Binding. + required: true + tags: + - policies + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedPolicyBindingRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PolicyBinding' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: policies_bindings_destroy + description: PolicyBinding Viewset + parameters: + - in: path + name: policy_binding_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Policy Binding. + required: true + tags: + - policies + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/bindings/{policy_binding_uuid}/used_by/: + get: + operationId: policies_bindings_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: policy_binding_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Policy Binding. + required: true + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/dummy/: + get: + operationId: policies_dummy_list + description: Dummy Viewset + parameters: + - in: query + name: created + schema: + type: string + format: date-time + - in: query + name: execution_logging + schema: + type: boolean + - in: query + name: last_updated + schema: + type: string + format: date-time + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: policy_uuid + schema: + type: string + format: uuid + - in: query + name: result + schema: + type: boolean + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: wait_max + schema: + type: integer + - in: query + name: wait_min + schema: + type: integer + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedDummyPolicyList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: policies_dummy_create + description: Dummy Viewset + tags: + - policies + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/DummyPolicyRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/DummyPolicy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/dummy/{policy_uuid}/: + get: + operationId: policies_dummy_retrieve + description: Dummy Viewset + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Dummy Policy. + required: true + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/DummyPolicy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: policies_dummy_update + description: Dummy Viewset + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Dummy Policy. + required: true + tags: + - policies + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/DummyPolicyRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/DummyPolicy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: policies_dummy_partial_update + description: Dummy Viewset + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Dummy Policy. + required: true + tags: + - policies + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedDummyPolicyRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/DummyPolicy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: policies_dummy_destroy + description: Dummy Viewset + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Dummy Policy. + required: true + tags: + - policies + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/dummy/{policy_uuid}/used_by/: + get: + operationId: policies_dummy_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Dummy Policy. + required: true + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/event_matcher/: + get: + operationId: policies_event_matcher_list + description: Event Matcher Policy Viewset + parameters: + - in: query + name: action + schema: + allOf: + - $ref: '#/components/schemas/EventActions' + nullable: true + description: |+ + Match created events with this action type. When left empty, all action types will be matched. + + - in: query + name: app + schema: + type: string + - in: query + name: client_ip + schema: + type: string + - in: query + name: created + schema: + type: string + format: date-time + - in: query + name: execution_logging + schema: + type: boolean + - in: query + name: last_updated + schema: + type: string + format: date-time + - in: query + name: model + schema: + type: string + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: policy_uuid + schema: + type: string + format: uuid + - in: query + name: query + schema: + type: string + - $ref: '#/components/parameters/QuerySearch' + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedEventMatcherPolicyList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: policies_event_matcher_create + description: Event Matcher Policy Viewset + tags: + - policies + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/EventMatcherPolicyRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/EventMatcherPolicy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/event_matcher/{policy_uuid}/: + get: + operationId: policies_event_matcher_retrieve + description: Event Matcher Policy Viewset + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Event Matcher Policy. + required: true + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/EventMatcherPolicy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: policies_event_matcher_update + description: Event Matcher Policy Viewset + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Event Matcher Policy. + required: true + tags: + - policies + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/EventMatcherPolicyRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/EventMatcherPolicy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: policies_event_matcher_partial_update + description: Event Matcher Policy Viewset + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Event Matcher Policy. + required: true + tags: + - policies + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedEventMatcherPolicyRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/EventMatcherPolicy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: policies_event_matcher_destroy + description: Event Matcher Policy Viewset + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Event Matcher Policy. + required: true + tags: + - policies + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/event_matcher/{policy_uuid}/used_by/: + get: + operationId: policies_event_matcher_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Event Matcher Policy. + required: true + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/expression/: + get: + operationId: policies_expression_list + description: Source Viewset + parameters: + - in: query + name: created + schema: + type: string + format: date-time + - in: query + name: execution_logging + schema: + type: boolean + - in: query + name: expression + schema: + type: string + - in: query + name: last_updated + schema: + type: string + format: date-time + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: policy_uuid + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QuerySearch' + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedExpressionPolicyList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: policies_expression_create + description: Source Viewset + tags: + - policies + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/ExpressionPolicyRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/ExpressionPolicy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/expression/{policy_uuid}/: + get: + operationId: policies_expression_retrieve + description: Source Viewset + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Expression Policy. + required: true + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/ExpressionPolicy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: policies_expression_update + description: Source Viewset + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Expression Policy. + required: true + tags: + - policies + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/ExpressionPolicyRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/ExpressionPolicy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: policies_expression_partial_update + description: Source Viewset + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Expression Policy. + required: true + tags: + - policies + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedExpressionPolicyRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/ExpressionPolicy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: policies_expression_destroy + description: Source Viewset + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Expression Policy. + required: true + tags: + - policies + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/expression/{policy_uuid}/used_by/: + get: + operationId: policies_expression_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Expression Policy. + required: true + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/geoip/: + get: + operationId: policies_geoip_list + description: GeoIP Viewset + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedGeoIPPolicyList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: policies_geoip_create + description: GeoIP Viewset + tags: + - policies + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/GeoIPPolicyRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/GeoIPPolicy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/geoip/{policy_uuid}/: + get: + operationId: policies_geoip_retrieve + description: GeoIP Viewset + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this GeoIP Policy. + required: true + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GeoIPPolicy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: policies_geoip_update + description: GeoIP Viewset + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this GeoIP Policy. + required: true + tags: + - policies + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/GeoIPPolicyRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GeoIPPolicy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: policies_geoip_partial_update + description: GeoIP Viewset + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this GeoIP Policy. + required: true + tags: + - policies + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedGeoIPPolicyRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GeoIPPolicy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: policies_geoip_destroy + description: GeoIP Viewset + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this GeoIP Policy. + required: true + tags: + - policies + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/geoip/{policy_uuid}/used_by/: + get: + operationId: policies_geoip_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this GeoIP Policy. + required: true + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/geoip_iso3166/: + get: + operationId: policies_geoip_iso3166_list + description: Get all countries in ISO-3166-1 + tags: + - policies + security: + - authentik: [] + - {} + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/DetailedCountry' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/password/: + get: + operationId: policies_password_list + description: Password Policy Viewset + parameters: + - in: query + name: amount_digits + schema: + type: integer + - in: query + name: amount_lowercase + schema: + type: integer + - in: query + name: amount_symbols + schema: + type: integer + - in: query + name: amount_uppercase + schema: + type: integer + - in: query + name: check_have_i_been_pwned + schema: + type: boolean + - in: query + name: check_static_rules + schema: + type: boolean + - in: query + name: check_zxcvbn + schema: + type: boolean + - in: query + name: created + schema: + type: string + format: date-time + - in: query + name: error_message + schema: + type: string + - in: query + name: execution_logging + schema: + type: boolean + - in: query + name: hibp_allowed_count + schema: + type: integer + - in: query + name: last_updated + schema: + type: string + format: date-time + - in: query + name: length_min + schema: + type: integer + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: password_field + schema: + type: string + - in: query + name: policy_uuid + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: symbol_charset + schema: + type: string + - in: query + name: zxcvbn_score_threshold + schema: + type: integer + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedPasswordPolicyList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: policies_password_create + description: Password Policy Viewset + tags: + - policies + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PasswordPolicyRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/PasswordPolicy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/password/{policy_uuid}/: + get: + operationId: policies_password_retrieve + description: Password Policy Viewset + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Password Policy. + required: true + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PasswordPolicy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: policies_password_update + description: Password Policy Viewset + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Password Policy. + required: true + tags: + - policies + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PasswordPolicyRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PasswordPolicy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: policies_password_partial_update + description: Password Policy Viewset + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Password Policy. + required: true + tags: + - policies + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedPasswordPolicyRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PasswordPolicy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: policies_password_destroy + description: Password Policy Viewset + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Password Policy. + required: true + tags: + - policies + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/password/{policy_uuid}/used_by/: + get: + operationId: policies_password_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Password Policy. + required: true + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/password_expiry/: + get: + operationId: policies_password_expiry_list + description: Password Expiry Viewset + parameters: + - in: query + name: created + schema: + type: string + format: date-time + - in: query + name: days + schema: + type: integer + - in: query + name: deny_only + schema: + type: boolean + - in: query + name: execution_logging + schema: + type: boolean + - in: query + name: last_updated + schema: + type: string + format: date-time + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: policy_uuid + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QuerySearch' + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedPasswordExpiryPolicyList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: policies_password_expiry_create + description: Password Expiry Viewset + tags: + - policies + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PasswordExpiryPolicyRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/PasswordExpiryPolicy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/password_expiry/{policy_uuid}/: + get: + operationId: policies_password_expiry_retrieve + description: Password Expiry Viewset + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Password Expiry Policy. + required: true + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PasswordExpiryPolicy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: policies_password_expiry_update + description: Password Expiry Viewset + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Password Expiry Policy. + required: true + tags: + - policies + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PasswordExpiryPolicyRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PasswordExpiryPolicy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: policies_password_expiry_partial_update + description: Password Expiry Viewset + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Password Expiry Policy. + required: true + tags: + - policies + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedPasswordExpiryPolicyRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PasswordExpiryPolicy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: policies_password_expiry_destroy + description: Password Expiry Viewset + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Password Expiry Policy. + required: true + tags: + - policies + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/password_expiry/{policy_uuid}/used_by/: + get: + operationId: policies_password_expiry_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Password Expiry Policy. + required: true + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/reputation/: + get: + operationId: policies_reputation_list + description: Reputation Policy Viewset + parameters: + - in: query + name: check_ip + schema: + type: boolean + - in: query + name: check_username + schema: + type: boolean + - in: query + name: created + schema: + type: string + format: date-time + - in: query + name: execution_logging + schema: + type: boolean + - in: query + name: last_updated + schema: + type: string + format: date-time + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: policy_uuid + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: threshold + schema: + type: integer + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedReputationPolicyList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: policies_reputation_create + description: Reputation Policy Viewset + tags: + - policies + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/ReputationPolicyRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/ReputationPolicy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/reputation/{policy_uuid}/: + get: + operationId: policies_reputation_retrieve + description: Reputation Policy Viewset + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Reputation Policy. + required: true + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/ReputationPolicy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: policies_reputation_update + description: Reputation Policy Viewset + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Reputation Policy. + required: true + tags: + - policies + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/ReputationPolicyRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/ReputationPolicy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: policies_reputation_partial_update + description: Reputation Policy Viewset + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Reputation Policy. + required: true + tags: + - policies + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedReputationPolicyRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/ReputationPolicy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: policies_reputation_destroy + description: Reputation Policy Viewset + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Reputation Policy. + required: true + tags: + - policies + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/reputation/{policy_uuid}/used_by/: + get: + operationId: policies_reputation_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Reputation Policy. + required: true + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/reputation/scores/: + get: + operationId: policies_reputation_scores_list + description: Reputation Viewset + parameters: + - in: query + name: identifier + schema: + type: string + - in: query + name: identifier_in + schema: + type: array + items: + type: string + description: Multiple values may be separated by commas. + explode: false + style: form + - in: query + name: ip + schema: + type: string + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: score + schema: + type: integer + - $ref: '#/components/parameters/QuerySearch' + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedReputationList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/reputation/scores/{reputation_uuid}/: + get: + operationId: policies_reputation_scores_retrieve + description: Reputation Viewset + parameters: + - in: path + name: reputation_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Reputation Score. + required: true + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Reputation' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: policies_reputation_scores_destroy + description: Reputation Viewset + parameters: + - in: path + name: reputation_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Reputation Score. + required: true + tags: + - policies + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/reputation/scores/{reputation_uuid}/used_by/: + get: + operationId: policies_reputation_scores_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: reputation_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Reputation Score. + required: true + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/unique_password/: + get: + operationId: policies_unique_password_list + description: Password Uniqueness Policy Viewset + parameters: + - in: query + name: created + schema: + type: string + format: date-time + - in: query + name: execution_logging + schema: + type: boolean + - in: query + name: last_updated + schema: + type: string + format: date-time + - $ref: '#/components/parameters/QueryName' + - in: query + name: num_historical_passwords + schema: + type: integer + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: password_field + schema: + type: string + - in: query + name: policy_uuid + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QuerySearch' + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedUniquePasswordPolicyList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: policies_unique_password_create + description: Password Uniqueness Policy Viewset + tags: + - policies + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UniquePasswordPolicyRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/UniquePasswordPolicy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/unique_password/{policy_uuid}/: + get: + operationId: policies_unique_password_retrieve + description: Password Uniqueness Policy Viewset + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Password Uniqueness Policy. + required: true + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UniquePasswordPolicy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: policies_unique_password_update + description: Password Uniqueness Policy Viewset + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Password Uniqueness Policy. + required: true + tags: + - policies + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UniquePasswordPolicyRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UniquePasswordPolicy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: policies_unique_password_partial_update + description: Password Uniqueness Policy Viewset + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Password Uniqueness Policy. + required: true + tags: + - policies + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedUniquePasswordPolicyRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UniquePasswordPolicy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: policies_unique_password_destroy + description: Password Uniqueness Policy Viewset + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Password Uniqueness Policy. + required: true + tags: + - policies + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /policies/unique_password/{policy_uuid}/used_by/: + get: + operationId: policies_unique_password_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: policy_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Password Uniqueness Policy. + required: true + tags: + - policies + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/all/: + get: + operationId: propertymappings_all_list + description: PropertyMapping Viewset + parameters: + - in: query + name: managed + schema: + type: array + items: + type: string + explode: true + style: form + - in: query + name: managed__isnull + schema: + type: boolean + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedPropertyMappingList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/all/{pm_uuid}/: + get: + operationId: propertymappings_all_retrieve + description: PropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Property Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: propertymappings_all_destroy + description: PropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Property Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/all/{pm_uuid}/test/: + post: + operationId: propertymappings_all_test_create + description: Test Property Mapping + parameters: + - in: query + name: format_result + schema: + type: boolean + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Property Mapping. + required: true + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PropertyMappingTestRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PropertyMappingTestResult' + description: '' + '400': + description: Invalid parameters + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/all/{pm_uuid}/used_by/: + get: + operationId: propertymappings_all_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Property Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/all/types/: + get: + operationId: propertymappings_all_types_list + description: Get all creatable types + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/TypeCreate' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/notification/: + get: + operationId: propertymappings_notification_list + description: NotificationWebhookMapping Viewset + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedNotificationWebhookMappingList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: propertymappings_notification_create + description: NotificationWebhookMapping Viewset + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/NotificationWebhookMappingRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/NotificationWebhookMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/notification/{pm_uuid}/: + get: + operationId: propertymappings_notification_retrieve + description: NotificationWebhookMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Webhook Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/NotificationWebhookMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: propertymappings_notification_update + description: NotificationWebhookMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Webhook Mapping. + required: true + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/NotificationWebhookMappingRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/NotificationWebhookMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: propertymappings_notification_partial_update + description: NotificationWebhookMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Webhook Mapping. + required: true + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedNotificationWebhookMappingRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/NotificationWebhookMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: propertymappings_notification_destroy + description: NotificationWebhookMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Webhook Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/notification/{pm_uuid}/used_by/: + get: + operationId: propertymappings_notification_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Webhook Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/provider/google_workspace/: + get: + operationId: propertymappings_provider_google_workspace_list + description: GoogleWorkspaceProviderMapping Viewset + parameters: + - in: query + name: expression + schema: + type: string + - in: query + name: managed + schema: + type: array + items: + type: string + explode: true + style: form + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: pm_uuid + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QuerySearch' + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedGoogleWorkspaceProviderMappingList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: propertymappings_provider_google_workspace_create + description: GoogleWorkspaceProviderMapping Viewset + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/GoogleWorkspaceProviderMappingRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/GoogleWorkspaceProviderMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/provider/google_workspace/{pm_uuid}/: + get: + operationId: propertymappings_provider_google_workspace_retrieve + description: GoogleWorkspaceProviderMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Google Workspace Provider Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GoogleWorkspaceProviderMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: propertymappings_provider_google_workspace_update + description: GoogleWorkspaceProviderMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Google Workspace Provider Mapping. + required: true + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/GoogleWorkspaceProviderMappingRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GoogleWorkspaceProviderMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: propertymappings_provider_google_workspace_partial_update + description: GoogleWorkspaceProviderMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Google Workspace Provider Mapping. + required: true + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedGoogleWorkspaceProviderMappingRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GoogleWorkspaceProviderMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: propertymappings_provider_google_workspace_destroy + description: GoogleWorkspaceProviderMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Google Workspace Provider Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/provider/google_workspace/{pm_uuid}/used_by/: + get: + operationId: propertymappings_provider_google_workspace_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Google Workspace Provider Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/provider/microsoft_entra/: + get: + operationId: propertymappings_provider_microsoft_entra_list + description: MicrosoftEntraProviderMapping Viewset + parameters: + - in: query + name: expression + schema: + type: string + - in: query + name: managed + schema: + type: array + items: + type: string + explode: true + style: form + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: pm_uuid + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QuerySearch' + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedMicrosoftEntraProviderMappingList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: propertymappings_provider_microsoft_entra_create + description: MicrosoftEntraProviderMapping Viewset + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/MicrosoftEntraProviderMappingRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/MicrosoftEntraProviderMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/provider/microsoft_entra/{pm_uuid}/: + get: + operationId: propertymappings_provider_microsoft_entra_retrieve + description: MicrosoftEntraProviderMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Microsoft Entra Provider Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/MicrosoftEntraProviderMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: propertymappings_provider_microsoft_entra_update + description: MicrosoftEntraProviderMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Microsoft Entra Provider Mapping. + required: true + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/MicrosoftEntraProviderMappingRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/MicrosoftEntraProviderMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: propertymappings_provider_microsoft_entra_partial_update + description: MicrosoftEntraProviderMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Microsoft Entra Provider Mapping. + required: true + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedMicrosoftEntraProviderMappingRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/MicrosoftEntraProviderMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: propertymappings_provider_microsoft_entra_destroy + description: MicrosoftEntraProviderMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Microsoft Entra Provider Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/provider/microsoft_entra/{pm_uuid}/used_by/: + get: + operationId: propertymappings_provider_microsoft_entra_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Microsoft Entra Provider Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/provider/rac/: + get: + operationId: propertymappings_provider_rac_list + description: RACPropertyMapping Viewset + parameters: + - in: query + name: managed + schema: + type: array + items: + type: string + explode: true + style: form + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedRACPropertyMappingList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: propertymappings_provider_rac_create + description: RACPropertyMapping Viewset + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/RACPropertyMappingRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/RACPropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/provider/rac/{pm_uuid}/: + get: + operationId: propertymappings_provider_rac_retrieve + description: RACPropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this RAC Provider Property Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/RACPropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: propertymappings_provider_rac_update + description: RACPropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this RAC Provider Property Mapping. + required: true + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/RACPropertyMappingRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/RACPropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: propertymappings_provider_rac_partial_update + description: RACPropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this RAC Provider Property Mapping. + required: true + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedRACPropertyMappingRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/RACPropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: propertymappings_provider_rac_destroy + description: RACPropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this RAC Provider Property Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/provider/rac/{pm_uuid}/used_by/: + get: + operationId: propertymappings_provider_rac_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this RAC Provider Property Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/provider/radius/: + get: + operationId: propertymappings_provider_radius_list + description: RadiusProviderPropertyMapping Viewset + parameters: + - in: query + name: managed + schema: + type: array + items: + type: string + explode: true + style: form + - in: query + name: managed__isnull + schema: + type: boolean + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedRadiusProviderPropertyMappingList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: propertymappings_provider_radius_create + description: RadiusProviderPropertyMapping Viewset + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/RadiusProviderPropertyMappingRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/RadiusProviderPropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/provider/radius/{pm_uuid}/: + get: + operationId: propertymappings_provider_radius_retrieve + description: RadiusProviderPropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Radius Provider Property Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/RadiusProviderPropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: propertymappings_provider_radius_update + description: RadiusProviderPropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Radius Provider Property Mapping. + required: true + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/RadiusProviderPropertyMappingRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/RadiusProviderPropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: propertymappings_provider_radius_partial_update + description: RadiusProviderPropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Radius Provider Property Mapping. + required: true + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedRadiusProviderPropertyMappingRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/RadiusProviderPropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: propertymappings_provider_radius_destroy + description: RadiusProviderPropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Radius Provider Property Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/provider/radius/{pm_uuid}/used_by/: + get: + operationId: propertymappings_provider_radius_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Radius Provider Property Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/provider/saml/: + get: + operationId: propertymappings_provider_saml_list + description: SAMLPropertyMapping Viewset + parameters: + - in: query + name: friendly_name + schema: + type: string + - in: query + name: managed + schema: + type: array + items: + type: string + explode: true + style: form + - in: query + name: managed__isnull + schema: + type: boolean + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: saml_name + schema: + type: string + - $ref: '#/components/parameters/QuerySearch' + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedSAMLPropertyMappingList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: propertymappings_provider_saml_create + description: SAMLPropertyMapping Viewset + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SAMLPropertyMappingRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/SAMLPropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/provider/saml/{pm_uuid}/: + get: + operationId: propertymappings_provider_saml_retrieve + description: SAMLPropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this SAML Provider Property Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SAMLPropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: propertymappings_provider_saml_update + description: SAMLPropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this SAML Provider Property Mapping. + required: true + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SAMLPropertyMappingRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SAMLPropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: propertymappings_provider_saml_partial_update + description: SAMLPropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this SAML Provider Property Mapping. + required: true + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedSAMLPropertyMappingRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SAMLPropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: propertymappings_provider_saml_destroy + description: SAMLPropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this SAML Provider Property Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/provider/saml/{pm_uuid}/used_by/: + get: + operationId: propertymappings_provider_saml_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this SAML Provider Property Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/provider/scim/: + get: + operationId: propertymappings_provider_scim_list + description: SCIMMapping Viewset + parameters: + - in: query + name: managed + schema: + type: array + items: + type: string + explode: true + style: form + - in: query + name: managed__isnull + schema: + type: boolean + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedSCIMMappingList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: propertymappings_provider_scim_create + description: SCIMMapping Viewset + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMMappingRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/provider/scim/{pm_uuid}/: + get: + operationId: propertymappings_provider_scim_retrieve + description: SCIMMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this SCIM Provider Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: propertymappings_provider_scim_update + description: SCIMMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this SCIM Provider Mapping. + required: true + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMMappingRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: propertymappings_provider_scim_partial_update + description: SCIMMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this SCIM Provider Mapping. + required: true + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedSCIMMappingRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: propertymappings_provider_scim_destroy + description: SCIMMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this SCIM Provider Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/provider/scim/{pm_uuid}/used_by/: + get: + operationId: propertymappings_provider_scim_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this SCIM Provider Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/provider/scope/: + get: + operationId: propertymappings_provider_scope_list + description: ScopeMapping Viewset + parameters: + - in: query + name: managed + schema: + type: array + items: + type: string + explode: true + style: form + - in: query + name: managed__isnull + schema: + type: boolean + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: scope_name + schema: + type: string + - $ref: '#/components/parameters/QuerySearch' + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedScopeMappingList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: propertymappings_provider_scope_create + description: ScopeMapping Viewset + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/ScopeMappingRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/ScopeMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/provider/scope/{pm_uuid}/: + get: + operationId: propertymappings_provider_scope_retrieve + description: ScopeMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Scope Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/ScopeMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: propertymappings_provider_scope_update + description: ScopeMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Scope Mapping. + required: true + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/ScopeMappingRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/ScopeMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: propertymappings_provider_scope_partial_update + description: ScopeMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Scope Mapping. + required: true + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedScopeMappingRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/ScopeMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: propertymappings_provider_scope_destroy + description: ScopeMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Scope Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/provider/scope/{pm_uuid}/used_by/: + get: + operationId: propertymappings_provider_scope_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Scope Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/source/kerberos/: + get: + operationId: propertymappings_source_kerberos_list + description: KerberosSource PropertyMapping Viewset + parameters: + - in: query + name: managed + schema: + type: array + items: + type: string + explode: true + style: form + - in: query + name: managed__isnull + schema: + type: boolean + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedKerberosSourcePropertyMappingList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: propertymappings_source_kerberos_create + description: KerberosSource PropertyMapping Viewset + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/KerberosSourcePropertyMappingRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/KerberosSourcePropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/source/kerberos/{pm_uuid}/: + get: + operationId: propertymappings_source_kerberos_retrieve + description: KerberosSource PropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Kerberos Source Property Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/KerberosSourcePropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: propertymappings_source_kerberos_update + description: KerberosSource PropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Kerberos Source Property Mapping. + required: true + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/KerberosSourcePropertyMappingRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/KerberosSourcePropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: propertymappings_source_kerberos_partial_update + description: KerberosSource PropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Kerberos Source Property Mapping. + required: true + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedKerberosSourcePropertyMappingRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/KerberosSourcePropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: propertymappings_source_kerberos_destroy + description: KerberosSource PropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Kerberos Source Property Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/source/kerberos/{pm_uuid}/used_by/: + get: + operationId: propertymappings_source_kerberos_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Kerberos Source Property Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/source/ldap/: + get: + operationId: propertymappings_source_ldap_list + description: LDAP PropertyMapping Viewset + parameters: + - in: query + name: managed + schema: + type: array + items: + type: string + explode: true + style: form + - in: query + name: managed__isnull + schema: + type: boolean + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedLDAPSourcePropertyMappingList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: propertymappings_source_ldap_create + description: LDAP PropertyMapping Viewset + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/LDAPSourcePropertyMappingRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/LDAPSourcePropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/source/ldap/{pm_uuid}/: + get: + operationId: propertymappings_source_ldap_retrieve + description: LDAP PropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this LDAP Source Property Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/LDAPSourcePropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: propertymappings_source_ldap_update + description: LDAP PropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this LDAP Source Property Mapping. + required: true + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/LDAPSourcePropertyMappingRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/LDAPSourcePropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: propertymappings_source_ldap_partial_update + description: LDAP PropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this LDAP Source Property Mapping. + required: true + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedLDAPSourcePropertyMappingRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/LDAPSourcePropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: propertymappings_source_ldap_destroy + description: LDAP PropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this LDAP Source Property Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/source/ldap/{pm_uuid}/used_by/: + get: + operationId: propertymappings_source_ldap_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this LDAP Source Property Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/source/oauth/: + get: + operationId: propertymappings_source_oauth_list + description: OAuthSourcePropertyMapping Viewset + parameters: + - in: query + name: managed + schema: + type: array + items: + type: string + explode: true + style: form + - in: query + name: managed__isnull + schema: + type: boolean + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedOAuthSourcePropertyMappingList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: propertymappings_source_oauth_create + description: OAuthSourcePropertyMapping Viewset + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/OAuthSourcePropertyMappingRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/OAuthSourcePropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/source/oauth/{pm_uuid}/: + get: + operationId: propertymappings_source_oauth_retrieve + description: OAuthSourcePropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this OAuth Source Property Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/OAuthSourcePropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: propertymappings_source_oauth_update + description: OAuthSourcePropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this OAuth Source Property Mapping. + required: true + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/OAuthSourcePropertyMappingRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/OAuthSourcePropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: propertymappings_source_oauth_partial_update + description: OAuthSourcePropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this OAuth Source Property Mapping. + required: true + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedOAuthSourcePropertyMappingRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/OAuthSourcePropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: propertymappings_source_oauth_destroy + description: OAuthSourcePropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this OAuth Source Property Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/source/oauth/{pm_uuid}/used_by/: + get: + operationId: propertymappings_source_oauth_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this OAuth Source Property Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/source/plex/: + get: + operationId: propertymappings_source_plex_list + description: PlexSourcePropertyMapping Viewset + parameters: + - in: query + name: managed + schema: + type: array + items: + type: string + explode: true + style: form + - in: query + name: managed__isnull + schema: + type: boolean + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedPlexSourcePropertyMappingList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: propertymappings_source_plex_create + description: PlexSourcePropertyMapping Viewset + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PlexSourcePropertyMappingRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/PlexSourcePropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/source/plex/{pm_uuid}/: + get: + operationId: propertymappings_source_plex_retrieve + description: PlexSourcePropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Plex Source Property Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PlexSourcePropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: propertymappings_source_plex_update + description: PlexSourcePropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Plex Source Property Mapping. + required: true + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PlexSourcePropertyMappingRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PlexSourcePropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: propertymappings_source_plex_partial_update + description: PlexSourcePropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Plex Source Property Mapping. + required: true + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedPlexSourcePropertyMappingRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PlexSourcePropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: propertymappings_source_plex_destroy + description: PlexSourcePropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Plex Source Property Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/source/plex/{pm_uuid}/used_by/: + get: + operationId: propertymappings_source_plex_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Plex Source Property Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/source/saml/: + get: + operationId: propertymappings_source_saml_list + description: SAMLSourcePropertyMapping Viewset + parameters: + - in: query + name: managed + schema: + type: array + items: + type: string + explode: true + style: form + - in: query + name: managed__isnull + schema: + type: boolean + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedSAMLSourcePropertyMappingList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: propertymappings_source_saml_create + description: SAMLSourcePropertyMapping Viewset + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SAMLSourcePropertyMappingRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/SAMLSourcePropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/source/saml/{pm_uuid}/: + get: + operationId: propertymappings_source_saml_retrieve + description: SAMLSourcePropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this SAML Source Property Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SAMLSourcePropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: propertymappings_source_saml_update + description: SAMLSourcePropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this SAML Source Property Mapping. + required: true + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SAMLSourcePropertyMappingRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SAMLSourcePropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: propertymappings_source_saml_partial_update + description: SAMLSourcePropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this SAML Source Property Mapping. + required: true + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedSAMLSourcePropertyMappingRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SAMLSourcePropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: propertymappings_source_saml_destroy + description: SAMLSourcePropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this SAML Source Property Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/source/saml/{pm_uuid}/used_by/: + get: + operationId: propertymappings_source_saml_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this SAML Source Property Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/source/scim/: + get: + operationId: propertymappings_source_scim_list + description: SCIMSourcePropertyMapping Viewset + parameters: + - in: query + name: managed + schema: + type: array + items: + type: string + explode: true + style: form + - in: query + name: managed__isnull + schema: + type: boolean + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedSCIMSourcePropertyMappingList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: propertymappings_source_scim_create + description: SCIMSourcePropertyMapping Viewset + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMSourcePropertyMappingRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMSourcePropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/source/scim/{pm_uuid}/: + get: + operationId: propertymappings_source_scim_retrieve + description: SCIMSourcePropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this SCIM Source Property Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMSourcePropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: propertymappings_source_scim_update + description: SCIMSourcePropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this SCIM Source Property Mapping. + required: true + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMSourcePropertyMappingRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMSourcePropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: propertymappings_source_scim_partial_update + description: SCIMSourcePropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this SCIM Source Property Mapping. + required: true + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedSCIMSourcePropertyMappingRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMSourcePropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: propertymappings_source_scim_destroy + description: SCIMSourcePropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this SCIM Source Property Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/source/scim/{pm_uuid}/used_by/: + get: + operationId: propertymappings_source_scim_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this SCIM Source Property Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/source/telegram/: + get: + operationId: propertymappings_source_telegram_list + description: TelegramSourcePropertyMapping Viewset + parameters: + - in: query + name: managed + schema: + type: array + items: + type: string + explode: true + style: form + - in: query + name: managed__isnull + schema: + type: boolean + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedTelegramSourcePropertyMappingList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: propertymappings_source_telegram_create + description: TelegramSourcePropertyMapping Viewset + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/TelegramSourcePropertyMappingRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/TelegramSourcePropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/source/telegram/{pm_uuid}/: + get: + operationId: propertymappings_source_telegram_retrieve + description: TelegramSourcePropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Telegram Source Property Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/TelegramSourcePropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: propertymappings_source_telegram_update + description: TelegramSourcePropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Telegram Source Property Mapping. + required: true + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/TelegramSourcePropertyMappingRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/TelegramSourcePropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: propertymappings_source_telegram_partial_update + description: TelegramSourcePropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Telegram Source Property Mapping. + required: true + tags: + - propertymappings + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedTelegramSourcePropertyMappingRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/TelegramSourcePropertyMapping' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: propertymappings_source_telegram_destroy + description: TelegramSourcePropertyMapping Viewset + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Telegram Source Property Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /propertymappings/source/telegram/{pm_uuid}/used_by/: + get: + operationId: propertymappings_source_telegram_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: pm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Telegram Source Property Mapping. + required: true + tags: + - propertymappings + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/all/: + get: + operationId: providers_all_list + description: Provider Viewset + parameters: + - in: query + name: application__isnull + schema: + type: boolean + - in: query + name: backchannel + schema: + type: boolean + description: When not set all providers are returned. When set to true, only + backchannel providers are returned. When set to false, backchannel providers + are excluded + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedProviderList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/all/{id}/: + get: + operationId: providers_all_retrieve + description: Provider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Provider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: providers_all_destroy + description: Provider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/all/{id}/used_by/: + get: + operationId: providers_all_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/all/types/: + get: + operationId: providers_all_types_list + description: Get all creatable types + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/TypeCreate' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/google_workspace/: + get: + operationId: providers_google_workspace_list + description: GoogleWorkspaceProvider Viewset + parameters: + - in: query + name: delegated_subject + schema: + type: string + - in: query + name: exclude_users_service_account + schema: + type: boolean + - in: query + name: filter_group + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedGoogleWorkspaceProviderList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: providers_google_workspace_create + description: GoogleWorkspaceProvider Viewset + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/GoogleWorkspaceProviderRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/GoogleWorkspaceProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/google_workspace/{id}/: + get: + operationId: providers_google_workspace_retrieve + description: GoogleWorkspaceProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Google Workspace Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GoogleWorkspaceProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: providers_google_workspace_update + description: GoogleWorkspaceProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Google Workspace Provider. + required: true + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/GoogleWorkspaceProviderRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GoogleWorkspaceProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: providers_google_workspace_partial_update + description: GoogleWorkspaceProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Google Workspace Provider. + required: true + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedGoogleWorkspaceProviderRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GoogleWorkspaceProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: providers_google_workspace_destroy + description: GoogleWorkspaceProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Google Workspace Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/google_workspace/{id}/sync/object/: + post: + operationId: providers_google_workspace_sync_object_create + description: Sync/Re-sync a single user/group object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Google Workspace Provider. + required: true + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SyncObjectRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SyncObjectResult' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/google_workspace/{id}/sync/status/: + get: + operationId: providers_google_workspace_sync_status_retrieve + description: Get provider's sync status + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Google Workspace Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SyncStatus' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/google_workspace/{id}/used_by/: + get: + operationId: providers_google_workspace_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Google Workspace Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/google_workspace_groups/: + get: + operationId: providers_google_workspace_groups_list + description: GoogleWorkspaceProviderGroup Viewset + parameters: + - in: query + name: group__group_uuid + schema: + type: string + format: uuid + - in: query + name: group__name + schema: + type: string + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: provider__id + schema: + type: integer + - $ref: '#/components/parameters/QuerySearch' + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedGoogleWorkspaceProviderGroupList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: providers_google_workspace_groups_create + description: GoogleWorkspaceProviderGroup Viewset + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/GoogleWorkspaceProviderGroupRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/GoogleWorkspaceProviderGroup' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/google_workspace_groups/{id}/: + get: + operationId: providers_google_workspace_groups_retrieve + description: GoogleWorkspaceProviderGroup Viewset + parameters: + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this Google Workspace Provider Group. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GoogleWorkspaceProviderGroup' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: providers_google_workspace_groups_destroy + description: GoogleWorkspaceProviderGroup Viewset + parameters: + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this Google Workspace Provider Group. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/google_workspace_groups/{id}/used_by/: + get: + operationId: providers_google_workspace_groups_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this Google Workspace Provider Group. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/google_workspace_users/: + get: + operationId: providers_google_workspace_users_list + description: GoogleWorkspaceProviderUser Viewset + parameters: + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: provider__id + schema: + type: integer + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: user__id + schema: + type: integer + - in: query + name: user__username + schema: + type: string + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedGoogleWorkspaceProviderUserList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: providers_google_workspace_users_create + description: GoogleWorkspaceProviderUser Viewset + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/GoogleWorkspaceProviderUserRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/GoogleWorkspaceProviderUser' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/google_workspace_users/{id}/: + get: + operationId: providers_google_workspace_users_retrieve + description: GoogleWorkspaceProviderUser Viewset + parameters: + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this Google Workspace Provider User. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GoogleWorkspaceProviderUser' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: providers_google_workspace_users_destroy + description: GoogleWorkspaceProviderUser Viewset + parameters: + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this Google Workspace Provider User. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/google_workspace_users/{id}/used_by/: + get: + operationId: providers_google_workspace_users_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this Google Workspace Provider User. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/ldap/: + get: + operationId: providers_ldap_list + description: LDAPProvider Viewset + parameters: + - in: query + name: application__isnull + schema: + type: boolean + - in: query + name: authorization_flow__slug__iexact + schema: + type: string + - in: query + name: base_dn__iexact + schema: + type: string + - in: query + name: certificate__kp_uuid__iexact + schema: + type: string + format: uuid + - in: query + name: certificate__name__iexact + schema: + type: string + - in: query + name: gid_start_number__iexact + schema: + type: integer + - in: query + name: name__iexact + schema: + type: string + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: tls_server_name__iexact + schema: + type: string + - in: query + name: uid_start_number__iexact + schema: + type: integer + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedLDAPProviderList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: providers_ldap_create + description: LDAPProvider Viewset + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/LDAPProviderRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/LDAPProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/ldap/{id}/: + get: + operationId: providers_ldap_retrieve + description: LDAPProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this LDAP Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/LDAPProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: providers_ldap_update + description: LDAPProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this LDAP Provider. + required: true + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/LDAPProviderRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/LDAPProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: providers_ldap_partial_update + description: LDAPProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this LDAP Provider. + required: true + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedLDAPProviderRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/LDAPProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: providers_ldap_destroy + description: LDAPProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this LDAP Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/ldap/{id}/used_by/: + get: + operationId: providers_ldap_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this LDAP Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/microsoft_entra/: + get: + operationId: providers_microsoft_entra_list + description: MicrosoftEntraProvider Viewset + parameters: + - in: query + name: exclude_users_service_account + schema: + type: boolean + - in: query + name: filter_group + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedMicrosoftEntraProviderList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: providers_microsoft_entra_create + description: MicrosoftEntraProvider Viewset + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/MicrosoftEntraProviderRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/MicrosoftEntraProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/microsoft_entra/{id}/: + get: + operationId: providers_microsoft_entra_retrieve + description: MicrosoftEntraProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Microsoft Entra Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/MicrosoftEntraProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: providers_microsoft_entra_update + description: MicrosoftEntraProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Microsoft Entra Provider. + required: true + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/MicrosoftEntraProviderRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/MicrosoftEntraProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: providers_microsoft_entra_partial_update + description: MicrosoftEntraProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Microsoft Entra Provider. + required: true + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedMicrosoftEntraProviderRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/MicrosoftEntraProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: providers_microsoft_entra_destroy + description: MicrosoftEntraProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Microsoft Entra Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/microsoft_entra/{id}/sync/object/: + post: + operationId: providers_microsoft_entra_sync_object_create + description: Sync/Re-sync a single user/group object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Microsoft Entra Provider. + required: true + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SyncObjectRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SyncObjectResult' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/microsoft_entra/{id}/sync/status/: + get: + operationId: providers_microsoft_entra_sync_status_retrieve + description: Get provider's sync status + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Microsoft Entra Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SyncStatus' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/microsoft_entra/{id}/used_by/: + get: + operationId: providers_microsoft_entra_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Microsoft Entra Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/microsoft_entra_groups/: + get: + operationId: providers_microsoft_entra_groups_list + description: MicrosoftEntraProviderGroup Viewset + parameters: + - in: query + name: group__group_uuid + schema: + type: string + format: uuid + - in: query + name: group__name + schema: + type: string + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: provider__id + schema: + type: integer + - $ref: '#/components/parameters/QuerySearch' + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedMicrosoftEntraProviderGroupList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: providers_microsoft_entra_groups_create + description: MicrosoftEntraProviderGroup Viewset + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/MicrosoftEntraProviderGroupRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/MicrosoftEntraProviderGroup' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/microsoft_entra_groups/{id}/: + get: + operationId: providers_microsoft_entra_groups_retrieve + description: MicrosoftEntraProviderGroup Viewset + parameters: + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this Microsoft Entra Provider Group. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/MicrosoftEntraProviderGroup' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: providers_microsoft_entra_groups_destroy + description: MicrosoftEntraProviderGroup Viewset + parameters: + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this Microsoft Entra Provider Group. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/microsoft_entra_groups/{id}/used_by/: + get: + operationId: providers_microsoft_entra_groups_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this Microsoft Entra Provider Group. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/microsoft_entra_users/: + get: + operationId: providers_microsoft_entra_users_list + description: MicrosoftEntraProviderUser Viewset + parameters: + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: provider__id + schema: + type: integer + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: user__id + schema: + type: integer + - in: query + name: user__username + schema: + type: string + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedMicrosoftEntraProviderUserList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: providers_microsoft_entra_users_create + description: MicrosoftEntraProviderUser Viewset + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/MicrosoftEntraProviderUserRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/MicrosoftEntraProviderUser' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/microsoft_entra_users/{id}/: + get: + operationId: providers_microsoft_entra_users_retrieve + description: MicrosoftEntraProviderUser Viewset + parameters: + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this Microsoft Entra Provider User. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/MicrosoftEntraProviderUser' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: providers_microsoft_entra_users_destroy + description: MicrosoftEntraProviderUser Viewset + parameters: + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this Microsoft Entra Provider User. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/microsoft_entra_users/{id}/used_by/: + get: + operationId: providers_microsoft_entra_users_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this Microsoft Entra Provider User. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/oauth2/: + get: + operationId: providers_oauth2_list + description: OAuth2Provider Viewset + parameters: + - in: query + name: access_code_validity + schema: + type: string + - in: query + name: access_token_validity + schema: + type: string + - in: query + name: application + schema: + type: string + format: uuid + - in: query + name: authorization_flow + schema: + type: string + format: uuid + - in: query + name: client_id + schema: + type: string + - in: query + name: client_type + schema: + allOf: + - $ref: '#/components/schemas/ClientTypeEnum' + description: |+ + Confidential clients are capable of maintaining the confidentiality of their credentials. Public clients are incapable + + - in: query + name: include_claims_in_id_token + schema: + type: boolean + - in: query + name: issuer_mode + schema: + allOf: + - $ref: '#/components/schemas/IssuerModeEnum' + description: |+ + Configure how the issuer field of the ID Token should be filled. + + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: property_mappings + schema: + type: array + items: + type: string + format: uuid + explode: true + style: form + - in: query + name: refresh_token_validity + schema: + type: string + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: signing_key + schema: + type: string + format: uuid + - in: query + name: sub_mode + schema: + allOf: + - $ref: '#/components/schemas/SubModeEnum' + description: |+ + Configure what data should be used as unique User Identifier. For most cases, the default should be fine. + + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedOAuth2ProviderList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: providers_oauth2_create + description: OAuth2Provider Viewset + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/OAuth2ProviderRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/OAuth2Provider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/oauth2-dcr/: + get: + operationId: providers_oauth2_dcr_list + description: OAuth2 Dynamic Client Registration configuration ViewSet + parameters: + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: provider + schema: + type: integer + - $ref: '#/components/parameters/QuerySearch' + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedOAuth2DynamicClientRegistrationList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: providers_oauth2_dcr_create + description: OAuth2 Dynamic Client Registration configuration ViewSet + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/OAuth2DynamicClientRegistrationRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/OAuth2DynamicClientRegistration' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/oauth2-dcr/{pbm_uuid}/: + get: + operationId: providers_oauth2_dcr_retrieve + description: OAuth2 Dynamic Client Registration configuration ViewSet + parameters: + - in: path + name: pbm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this OAuth2 Dynamic Client Registration. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/OAuth2DynamicClientRegistration' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: providers_oauth2_dcr_update + description: OAuth2 Dynamic Client Registration configuration ViewSet + parameters: + - in: path + name: pbm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this OAuth2 Dynamic Client Registration. + required: true + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/OAuth2DynamicClientRegistrationRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/OAuth2DynamicClientRegistration' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: providers_oauth2_dcr_partial_update + description: OAuth2 Dynamic Client Registration configuration ViewSet + parameters: + - in: path + name: pbm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this OAuth2 Dynamic Client Registration. + required: true + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedOAuth2DynamicClientRegistrationRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/OAuth2DynamicClientRegistration' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: providers_oauth2_dcr_destroy + description: OAuth2 Dynamic Client Registration configuration ViewSet + parameters: + - in: path + name: pbm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this OAuth2 Dynamic Client Registration. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/oauth2/{id}/: + get: + operationId: providers_oauth2_retrieve + description: OAuth2Provider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this OAuth2/OpenID Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/OAuth2Provider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: providers_oauth2_update + description: OAuth2Provider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this OAuth2/OpenID Provider. + required: true + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/OAuth2ProviderRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/OAuth2Provider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: providers_oauth2_partial_update + description: OAuth2Provider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this OAuth2/OpenID Provider. + required: true + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedOAuth2ProviderRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/OAuth2Provider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: providers_oauth2_destroy + description: OAuth2Provider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this OAuth2/OpenID Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/oauth2/{id}/preview_user/: + get: + operationId: providers_oauth2_preview_user_retrieve + description: Preview user data for provider + parameters: + - in: query + name: for_user + schema: + type: integer + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this OAuth2/OpenID Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PropertyMappingPreview' + description: '' + '400': + description: Bad request + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/oauth2/{id}/setup_urls/: + get: + operationId: providers_oauth2_setup_urls_retrieve + description: Get Providers setup URLs + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this OAuth2/OpenID Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/OAuth2ProviderSetupURLs' + description: '' + '404': + description: Provider has no application assigned + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/oauth2/{id}/used_by/: + get: + operationId: providers_oauth2_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this OAuth2/OpenID Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/proxy/: + get: + operationId: providers_proxy_list + description: ProxyProvider Viewset + parameters: + - in: query + name: application__isnull + schema: + type: boolean + - in: query + name: authorization_flow__slug__iexact + schema: + type: string + - in: query + name: basic_auth_enabled__iexact + schema: + type: boolean + - in: query + name: basic_auth_password_attribute__iexact + schema: + type: string + - in: query + name: basic_auth_user_attribute__iexact + schema: + type: string + - in: query + name: certificate__kp_uuid__iexact + schema: + type: string + format: uuid + - in: query + name: certificate__name__iexact + schema: + type: string + - in: query + name: cookie_domain__iexact + schema: + type: string + - in: query + name: external_host__iexact + schema: + type: string + - in: query + name: internal_host__iexact + schema: + type: string + - in: query + name: internal_host_ssl_validation__iexact + schema: + type: boolean + - in: query + name: mode__iexact + schema: + type: string + - in: query + name: name__iexact + schema: + type: string + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: property_mappings__iexact + schema: + type: array + items: + type: string + format: uuid + explode: true + style: form + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: skip_path_regex__iexact + schema: + type: string + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedProxyProviderList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: providers_proxy_create + description: ProxyProvider Viewset + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/ProxyProviderRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/ProxyProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/proxy/{id}/: + get: + operationId: providers_proxy_retrieve + description: ProxyProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Proxy Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/ProxyProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: providers_proxy_update + description: ProxyProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Proxy Provider. + required: true + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/ProxyProviderRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/ProxyProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: providers_proxy_partial_update + description: ProxyProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Proxy Provider. + required: true + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedProxyProviderRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/ProxyProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: providers_proxy_destroy + description: ProxyProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Proxy Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/proxy/{id}/used_by/: + get: + operationId: providers_proxy_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Proxy Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/rac/: + get: + operationId: providers_rac_list + description: RACProvider Viewset + parameters: + - in: query + name: application__isnull + schema: + type: boolean + - in: query + name: name__iexact + schema: + type: string + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedRACProviderList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: providers_rac_create + description: RACProvider Viewset + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/RACProviderRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/RACProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/rac/{id}/: + get: + operationId: providers_rac_retrieve + description: RACProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this RAC Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/RACProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: providers_rac_update + description: RACProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this RAC Provider. + required: true + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/RACProviderRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/RACProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: providers_rac_partial_update + description: RACProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this RAC Provider. + required: true + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedRACProviderRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/RACProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: providers_rac_destroy + description: RACProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this RAC Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/rac/{id}/used_by/: + get: + operationId: providers_rac_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this RAC Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/radius/: + get: + operationId: providers_radius_list + description: RadiusProvider Viewset + parameters: + - in: query + name: application__isnull + schema: + type: boolean + - in: query + name: authorization_flow__slug__iexact + schema: + type: string + - in: query + name: client_networks__iexact + schema: + type: string + - in: query + name: name__iexact + schema: + type: string + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedRadiusProviderList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: providers_radius_create + description: RadiusProvider Viewset + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/RadiusProviderRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/RadiusProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/radius/{id}/: + get: + operationId: providers_radius_retrieve + description: RadiusProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Radius Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/RadiusProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: providers_radius_update + description: RadiusProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Radius Provider. + required: true + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/RadiusProviderRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/RadiusProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: providers_radius_partial_update + description: RadiusProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Radius Provider. + required: true + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedRadiusProviderRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/RadiusProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: providers_radius_destroy + description: RadiusProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Radius Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/radius/{id}/used_by/: + get: + operationId: providers_radius_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Radius Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/saml/: + get: + operationId: providers_saml_list + description: SAMLProvider Viewset + parameters: + - in: query + name: acs_url + schema: + type: string + - in: query + name: assertion_valid_not_before + schema: + type: string + - in: query + name: assertion_valid_not_on_or_after + schema: + type: string + - in: query + name: audience + schema: + type: string + - in: query + name: authentication_flow + schema: + type: string + format: uuid + - in: query + name: authn_context_class_ref_mapping + schema: + type: string + format: uuid + - in: query + name: authorization_flow + schema: + type: string + format: uuid + - in: query + name: backchannel_application + schema: + type: string + format: uuid + - in: query + name: default_name_id_policy + schema: + $ref: '#/components/schemas/SAMLNameIDPolicyEnum' + - in: query + name: default_relay_state + schema: + type: string + - in: query + name: digest_algorithm + schema: + $ref: '#/components/schemas/DigestAlgorithmEnum' + - in: query + name: encryption_kp + schema: + type: string + format: uuid + - in: query + name: invalidation_flow + schema: + type: string + format: uuid + - in: query + name: is_backchannel + schema: + type: boolean + - in: query + name: issuer_override + schema: + type: string + - in: query + name: logout_method + schema: + allOf: + - $ref: '#/components/schemas/SAMLLogoutMethods' + description: |+ + Method to use for logout. Front-channel iframe loads all logout URLs simultaneously in hidden iframes. Front-channel native uses your active browser tab to send post requests and redirect to providers. Back-channel sends logout requests directly from the server without user interaction (requires POST SLS binding). + + - $ref: '#/components/parameters/QueryName' + - in: query + name: name_id_mapping + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: property_mappings + schema: + type: array + items: + type: string + format: uuid + explode: true + style: form + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: session_valid_not_on_or_after + schema: + type: string + - in: query + name: sign_assertion + schema: + type: boolean + - in: query + name: sign_logout_request + schema: + type: boolean + - in: query + name: sign_logout_response + schema: + type: boolean + - in: query + name: sign_response + schema: + type: boolean + - in: query + name: signature_algorithm + schema: + $ref: '#/components/schemas/SignatureAlgorithmEnum' + - in: query + name: signing_kp + schema: + type: string + format: uuid + - in: query + name: sls_binding + schema: + allOf: + - $ref: '#/components/schemas/SAMLBindingsEnum' + description: |+ + This determines how authentik sends the logout response back to the Service Provider. + + - in: query + name: sls_url + schema: + type: string + - in: query + name: sp_binding + schema: + allOf: + - $ref: '#/components/schemas/SAMLBindingsEnum' + title: Service Provider Binding + description: |+ + This determines how authentik sends the response back to the Service Provider. + + - in: query + name: verification_kp + schema: + type: string + format: uuid + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedSAMLProviderList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: providers_saml_create + description: SAMLProvider Viewset + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SAMLProviderRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/SAMLProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/saml/{id}/: + get: + operationId: providers_saml_retrieve + description: SAMLProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this SAML Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SAMLProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: providers_saml_update + description: SAMLProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this SAML Provider. + required: true + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SAMLProviderRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SAMLProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: providers_saml_partial_update + description: SAMLProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this SAML Provider. + required: true + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedSAMLProviderRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SAMLProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: providers_saml_destroy + description: SAMLProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this SAML Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/saml/{id}/metadata/: + get: + operationId: providers_saml_metadata_retrieve + description: Return metadata as XML string + parameters: + - in: query + name: download + schema: + type: boolean + - in: query + name: force_binding + schema: + allOf: + - $ref: '#/components/schemas/ForceBindingEnum' + description: Optionally force the metadata to only include one binding. + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this SAML Provider. + required: true + tags: + - providers + security: + - authentik: [] + - {} + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SAMLMetadata' + application/xml: + schema: + $ref: '#/components/schemas/SAMLMetadata' + description: '' + '404': + description: Provider has no application assigned + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/saml/{id}/preview_user/: + get: + operationId: providers_saml_preview_user_retrieve + description: Preview user data for provider + parameters: + - in: query + name: for_user + schema: + type: integer + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this SAML Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PropertyMappingPreview' + description: '' + '400': + description: Bad request + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/saml/{id}/used_by/: + get: + operationId: providers_saml_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this SAML Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/saml/import_metadata/: + post: + operationId: providers_saml_import_metadata_create + description: Create provider from SAML Metadata + tags: + - providers + requestBody: + content: + multipart/form-data: + schema: + $ref: '#/components/schemas/SAMLProviderImportRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/SAMLProvider' + description: '' + '400': + description: Bad request + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/scim/: + get: + operationId: providers_scim_list + description: SCIMProvider Viewset + parameters: + - in: query + name: exclude_users_service_account + schema: + type: boolean + - in: query + name: group_filters + schema: + type: array + items: + type: string + format: uuid + explode: true + style: form + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: url + schema: + type: string + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedSCIMProviderList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: providers_scim_create + description: SCIMProvider Viewset + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMProviderRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/scim/{id}/: + get: + operationId: providers_scim_retrieve + description: SCIMProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this SCIM Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: providers_scim_update + description: SCIMProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this SCIM Provider. + required: true + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMProviderRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: providers_scim_partial_update + description: SCIMProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this SCIM Provider. + required: true + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedSCIMProviderRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: providers_scim_destroy + description: SCIMProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this SCIM Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/scim/{id}/sync/object/: + post: + operationId: providers_scim_sync_object_create + description: Sync/Re-sync a single user/group object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this SCIM Provider. + required: true + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SyncObjectRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SyncObjectResult' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/scim/{id}/sync/status/: + get: + operationId: providers_scim_sync_status_retrieve + description: Get provider's sync status + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this SCIM Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SyncStatus' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/scim/{id}/used_by/: + get: + operationId: providers_scim_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this SCIM Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/scim_groups/: + get: + operationId: providers_scim_groups_list + description: SCIMProviderGroup Viewset + parameters: + - in: query + name: group__group_uuid + schema: + type: string + format: uuid + - in: query + name: group__name + schema: + type: string + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: provider__id + schema: + type: integer + - $ref: '#/components/parameters/QuerySearch' + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedSCIMProviderGroupList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: providers_scim_groups_create + description: SCIMProviderGroup Viewset + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMProviderGroupRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMProviderGroup' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/scim_groups/{id}/: + get: + operationId: providers_scim_groups_retrieve + description: SCIMProviderGroup Viewset + parameters: + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this scim provider group. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMProviderGroup' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: providers_scim_groups_destroy + description: SCIMProviderGroup Viewset + parameters: + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this scim provider group. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/scim_groups/{id}/used_by/: + get: + operationId: providers_scim_groups_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this scim provider group. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/scim_users/: + get: + operationId: providers_scim_users_list + description: SCIMProviderUser Viewset + parameters: + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: provider__id + schema: + type: integer + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: user__id + schema: + type: integer + - in: query + name: user__username + schema: + type: string + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedSCIMProviderUserList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: providers_scim_users_create + description: SCIMProviderUser Viewset + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMProviderUserRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMProviderUser' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/scim_users/{id}/: + get: + operationId: providers_scim_users_retrieve + description: SCIMProviderUser Viewset + parameters: + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this scim provider user. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMProviderUser' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: providers_scim_users_destroy + description: SCIMProviderUser Viewset + parameters: + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this scim provider user. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/scim_users/{id}/used_by/: + get: + operationId: providers_scim_users_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this scim provider user. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/ssf/: + get: + operationId: providers_ssf_list + description: SSFProvider Viewset + parameters: + - in: query + name: application__isnull + schema: + type: boolean + - in: query + name: name__iexact + schema: + type: string + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedSSFProviderList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: providers_ssf_create + description: SSFProvider Viewset + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SSFProviderRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/SSFProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/ssf/{id}/: + get: + operationId: providers_ssf_retrieve + description: SSFProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Shared Signals Framework + Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SSFProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: providers_ssf_update + description: SSFProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Shared Signals Framework + Provider. + required: true + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SSFProviderRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SSFProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: providers_ssf_partial_update + description: SSFProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Shared Signals Framework + Provider. + required: true + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedSSFProviderRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SSFProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: providers_ssf_destroy + description: SSFProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Shared Signals Framework + Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/ssf/{id}/used_by/: + get: + operationId: providers_ssf_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Shared Signals Framework + Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/wsfed/: + get: + operationId: providers_wsfed_list + description: WSFederationProvider Viewset + parameters: + - in: query + name: acs_url + schema: + type: string + - in: query + name: assertion_valid_not_before + schema: + type: string + - in: query + name: assertion_valid_not_on_or_after + schema: + type: string + - in: query + name: audience + schema: + type: string + - in: query + name: authentication_flow + schema: + type: string + format: uuid + - in: query + name: authn_context_class_ref_mapping + schema: + type: string + format: uuid + - in: query + name: authorization_flow + schema: + type: string + format: uuid + - in: query + name: backchannel_application + schema: + type: string + format: uuid + - in: query + name: default_name_id_policy + schema: + $ref: '#/components/schemas/SAMLNameIDPolicyEnum' + - in: query + name: default_relay_state + schema: + type: string + - in: query + name: digest_algorithm + schema: + $ref: '#/components/schemas/DigestAlgorithmEnum' + - in: query + name: encryption_kp + schema: + type: string + format: uuid + - in: query + name: invalidation_flow + schema: + type: string + format: uuid + - in: query + name: is_backchannel + schema: + type: boolean + - in: query + name: issuer_override + schema: + type: string + - in: query + name: logout_method + schema: + allOf: + - $ref: '#/components/schemas/SAMLLogoutMethods' + description: |+ + Method to use for logout. Front-channel iframe loads all logout URLs simultaneously in hidden iframes. Front-channel native uses your active browser tab to send post requests and redirect to providers. Back-channel sends logout requests directly from the server without user interaction (requires POST SLS binding). + + - $ref: '#/components/parameters/QueryName' + - in: query + name: name_id_mapping + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: property_mappings + schema: + type: array + items: + type: string + format: uuid + explode: true + style: form + - in: query + name: saml_version + schema: + allOf: + - $ref: '#/components/schemas/SamlVersionEnum' + description: |+ + SAML assertion version to issue in the security token. Microsoft Entra ID and classic ADFS-style relying parties typically require SAML 1.1. + + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: session_valid_not_on_or_after + schema: + type: string + - in: query + name: sign_assertion + schema: + type: boolean + - in: query + name: sign_logout_request + schema: + type: boolean + - in: query + name: sign_logout_response + schema: + type: boolean + - in: query + name: sign_response + schema: + type: boolean + - in: query + name: signature_algorithm + schema: + $ref: '#/components/schemas/SignatureAlgorithmEnum' + - in: query + name: signing_kp + schema: + type: string + format: uuid + - in: query + name: sls_binding + schema: + allOf: + - $ref: '#/components/schemas/SAMLBindingsEnum' + description: |+ + This determines how authentik sends the logout response back to the Service Provider. + + - in: query + name: sls_url + schema: + type: string + - in: query + name: sp_binding + schema: + allOf: + - $ref: '#/components/schemas/SAMLBindingsEnum' + title: Service Provider Binding + description: |+ + This determines how authentik sends the response back to the Service Provider. + + - in: query + name: verification_kp + schema: + type: string + format: uuid + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedWSFederationProviderList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: providers_wsfed_create + description: WSFederationProvider Viewset + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/WSFederationProviderRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/WSFederationProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/wsfed/{id}/: + get: + operationId: providers_wsfed_retrieve + description: WSFederationProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this WS-Federation Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/WSFederationProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: providers_wsfed_update + description: WSFederationProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this WS-Federation Provider. + required: true + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/WSFederationProviderRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/WSFederationProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: providers_wsfed_partial_update + description: WSFederationProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this WS-Federation Provider. + required: true + tags: + - providers + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedWSFederationProviderRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/WSFederationProvider' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: providers_wsfed_destroy + description: WSFederationProvider Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this WS-Federation Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/wsfed/{id}/metadata/: + get: + operationId: providers_wsfed_metadata_retrieve + description: Return metadata as XML string + parameters: + - in: query + name: download + schema: + type: boolean + - in: query + name: force_binding + schema: + allOf: + - $ref: '#/components/schemas/ForceBindingEnum' + description: Optionally force the metadata to only include one binding. + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this WS-Federation Provider. + required: true + tags: + - providers + security: + - authentik: [] + - {} + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SAMLMetadata' + application/xml: + schema: + $ref: '#/components/schemas/SAMLMetadata' + description: '' + '404': + description: Provider has no application assigned + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/wsfed/{id}/preview_user/: + get: + operationId: providers_wsfed_preview_user_retrieve + description: Preview user data for provider + parameters: + - in: query + name: for_user + schema: + type: integer + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this WS-Federation Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PropertyMappingPreview' + description: '' + '400': + description: Bad request + '403': + $ref: '#/components/responses/GenericErrorResponse' + /providers/wsfed/{id}/used_by/: + get: + operationId: providers_wsfed_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this WS-Federation Provider. + required: true + tags: + - providers + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /rac/connection_tokens/: + get: + operationId: rac_connection_tokens_list + description: ConnectionToken Viewset + parameters: + - in: query + name: endpoint + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: provider + schema: + type: integer + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: session__user + schema: + type: integer + tags: + - rac + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedConnectionTokenList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /rac/connection_tokens/{connection_token_uuid}/: + get: + operationId: rac_connection_tokens_retrieve + description: ConnectionToken Viewset + parameters: + - in: path + name: connection_token_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this RAC Connection token. + required: true + tags: + - rac + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/ConnectionToken' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: rac_connection_tokens_update + description: ConnectionToken Viewset + parameters: + - in: path + name: connection_token_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this RAC Connection token. + required: true + tags: + - rac + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/ConnectionTokenRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/ConnectionToken' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: rac_connection_tokens_partial_update + description: ConnectionToken Viewset + parameters: + - in: path + name: connection_token_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this RAC Connection token. + required: true + tags: + - rac + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedConnectionTokenRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/ConnectionToken' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: rac_connection_tokens_destroy + description: ConnectionToken Viewset + parameters: + - in: path + name: connection_token_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this RAC Connection token. + required: true + tags: + - rac + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /rac/connection_tokens/{connection_token_uuid}/used_by/: + get: + operationId: rac_connection_tokens_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: connection_token_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this RAC Connection token. + required: true + tags: + - rac + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /rac/endpoints/: + get: + operationId: rac_endpoints_list + description: List accessible endpoints + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: provider + schema: + type: integer + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: superuser_full_list + schema: + type: boolean + tags: + - rac + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedEndpointList' + description: '' + '400': + description: Bad request + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: rac_endpoints_create + description: Endpoint Viewset + tags: + - rac + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/EndpointRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/Endpoint' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /rac/endpoints/{pbm_uuid}/: + get: + operationId: rac_endpoints_retrieve + description: Endpoint Viewset + parameters: + - in: path + name: pbm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this RAC Endpoint. + required: true + tags: + - rac + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Endpoint' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: rac_endpoints_update + description: Endpoint Viewset + parameters: + - in: path + name: pbm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this RAC Endpoint. + required: true + tags: + - rac + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/EndpointRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Endpoint' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: rac_endpoints_partial_update + description: Endpoint Viewset + parameters: + - in: path + name: pbm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this RAC Endpoint. + required: true + tags: + - rac + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedEndpointRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Endpoint' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: rac_endpoints_destroy + description: Endpoint Viewset + parameters: + - in: path + name: pbm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this RAC Endpoint. + required: true + tags: + - rac + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /rac/endpoints/{pbm_uuid}/used_by/: + get: + operationId: rac_endpoints_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: pbm_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this RAC Endpoint. + required: true + tags: + - rac + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /rbac/initial_permissions/: + get: + operationId: rbac_initial_permissions_list + description: InitialPermissions viewset + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - rbac + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedInitialPermissionsList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: rbac_initial_permissions_create + description: InitialPermissions viewset + tags: + - rbac + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/InitialPermissionsRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/InitialPermissions' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /rbac/initial_permissions/{id}/: + get: + operationId: rbac_initial_permissions_retrieve + description: InitialPermissions viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Initial Permissions. + required: true + tags: + - rbac + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/InitialPermissions' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: rbac_initial_permissions_update + description: InitialPermissions viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Initial Permissions. + required: true + tags: + - rbac + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/InitialPermissionsRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/InitialPermissions' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: rbac_initial_permissions_partial_update + description: InitialPermissions viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Initial Permissions. + required: true + tags: + - rbac + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedInitialPermissionsRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/InitialPermissions' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: rbac_initial_permissions_destroy + description: InitialPermissions viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Initial Permissions. + required: true + tags: + - rbac + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /rbac/initial_permissions/{id}/used_by/: + get: + operationId: rbac_initial_permissions_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Initial Permissions. + required: true + tags: + - rbac + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /rbac/permissions/: + get: + operationId: rbac_permissions_list + description: Read-only list of all permissions, filterable by model and app + parameters: + - in: query + name: codename + schema: + type: string + - in: query + name: content_type__app_label + schema: + type: string + - in: query + name: content_type__model + schema: + type: string + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: role + schema: + type: string + - $ref: '#/components/parameters/QuerySearch' + tags: + - rbac + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedPermissionList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /rbac/permissions/{id}/: + get: + operationId: rbac_permissions_retrieve + description: Read-only list of all permissions, filterable by model and app + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this permission. + required: true + tags: + - rbac + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Permission' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /rbac/permissions/assigned_by_roles/: + get: + operationId: rbac_permissions_assigned_by_roles_list + description: Get assigned object permissions for a single object + parameters: + - in: query + name: model + schema: + type: string + required: true + - in: query + name: object_pk + schema: + type: string + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - rbac + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedRoleAssignedObjectPermissionList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /rbac/permissions/assigned_by_roles/{uuid}/assign/: + post: + operationId: rbac_permissions_assigned_by_roles_assign + description: |- + Assign permission(s) to role. When `object_pk` is set, the permissions + are only assigned to the specific object, otherwise they are assigned globally. + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Role. + required: true + tags: + - rbac + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PermissionAssignRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/PermissionAssignResult' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /rbac/permissions/assigned_by_roles/{uuid}/unassign/: + patch: + operationId: rbac_permissions_assigned_by_roles_unassign_partial_update + description: |- + Unassign permission(s) to role. When `object_pk` is set, the permissions + are only assigned to the specific object, otherwise they are assigned globally. + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Role. + required: true + tags: + - rbac + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedPermissionAssignRequest' + security: + - authentik: [] + responses: + '204': + description: Successfully unassigned + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /rbac/permissions/roles/: + get: + operationId: rbac_permissions_roles_list + description: Get a role's assigned object permissions + parameters: + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: uuid + schema: + type: string + format: uuid + tags: + - rbac + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedExtraRoleObjectPermissionList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /rbac/roles/: + get: + operationId: rbac_roles_list + description: Role viewset + parameters: + - in: query + name: groups + schema: + type: string + format: uuid + - in: query + name: inherited + schema: + type: boolean + description: Include inherited roles (requires users or groups filter) + - in: query + name: managed + schema: + type: array + items: + type: string + explode: true + style: form + - in: query + name: managed__isnull + schema: + type: boolean + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: users + schema: + type: integer + tags: + - rbac + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedRoleList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: rbac_roles_create + description: Role viewset + tags: + - rbac + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/RoleRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/Role' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /rbac/roles/{uuid}/: + get: + operationId: rbac_roles_retrieve + description: Role viewset + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Role. + required: true + tags: + - rbac + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Role' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: rbac_roles_update + description: Role viewset + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Role. + required: true + tags: + - rbac + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/RoleRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Role' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: rbac_roles_partial_update + description: Role viewset + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Role. + required: true + tags: + - rbac + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedRoleRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Role' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: rbac_roles_destroy + description: Role viewset + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Role. + required: true + tags: + - rbac + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /rbac/roles/{uuid}/add_user/: + post: + operationId: rbac_roles_add_user_create + description: Add user to role + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Role. + required: true + tags: + - rbac + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserAccountSerializerForRoleRequest' + required: true + security: + - authentik: [] + responses: + '204': + description: User added + '404': + description: User not found + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /rbac/roles/{uuid}/remove_user/: + post: + operationId: rbac_roles_remove_user_create + description: Remove user from role + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Role. + required: true + tags: + - rbac + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserAccountSerializerForRoleRequest' + required: true + security: + - authentik: [] + responses: + '204': + description: User removed + '404': + description: User not found + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /rbac/roles/{uuid}/used_by/: + get: + operationId: rbac_roles_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Role. + required: true + tags: + - rbac + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /reports/exports/: + get: + operationId: reports_exports_list + parameters: + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - reports + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedDataExportList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /reports/exports/{id}/: + get: + operationId: reports_exports_retrieve + parameters: + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this Data Export. + required: true + tags: + - reports + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/DataExport' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: reports_exports_destroy + parameters: + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this Data Export. + required: true + tags: + - reports + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /requests/grant-requests/: + get: + operationId: requests_grant_requests_list + parameters: + - in: query + name: agent_owner + schema: + type: integer + - in: query + name: created_by + schema: + type: integer + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: status + schema: + $ref: '#/components/schemas/RequestStatus' + tags: + - requests + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedGrantRequestList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: requests_grant_requests_create + tags: + - requests + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/GrantRequestCreateRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Link' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /requests/grant-requests/{uuid}/: + get: + operationId: requests_grant_requests_retrieve + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Grant Request. + required: true + tags: + - requests + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GrantRequest' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: requests_grant_requests_destroy + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Grant Request. + required: true + tags: + - requests + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /requests/grant-requests/{uuid}/fulfill/: + patch: + operationId: requests_grant_requests_fulfill_partial_update + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Grant Request. + required: true + tags: + - requests + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedGrantRequestFulfillRequest' + security: + - authentik: [] + responses: + '204': + description: Request fulfilled + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /requests/grant-requests/{uuid}/revoke/: + delete: + operationId: requests_grant_requests_revoke_destroy + description: |- + Immediately end an active grant. Available to the same reviewers who could + approve it in the first place. + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Grant Request. + required: true + tags: + - requests + security: + - authentik: [] + responses: + '204': + description: Grant revoked + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /requests/grant-requests/agent/: + post: + operationId: requests_grant_requests_agent_create + description: |- + Delegate access an agent's owner already holds to the agent, time-boxed. Unlike + `create` this persists the request directly instead of returning a flow link -- an agent + authenticates with an API token and has no browser to run a flow in, so no justification + is ever collected. That is why the agent may only ask for what its owner already has: + the owner's approval is then the whole decision, and no reviewer is asked to judge a + request with nothing in it. The returned `fulfill_url` is what the agent hands to its + owner so they can act on it. + tags: + - requests + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/AgentGrantRequestCreateRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/AgentGrantRequestCreated' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /requests/grant-requests/pending_review/: + get: + operationId: requests_grant_requests_pending_review_list + description: List pending grant requests the current user is eligible to review. + parameters: + - in: query + name: agent_owner + schema: + type: integer + - in: query + name: created_by + schema: + type: integer + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: status + schema: + $ref: '#/components/schemas/RequestStatus' + tags: + - requests + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedGrantRequestList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /requests/rule-bindings/: + get: + operationId: requests_rule_bindings_list + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: rule + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: target + schema: + type: string + format: uuid + tags: + - requests + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedRequestRuleBindingList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: requests_rule_bindings_create + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + tags: + - requests + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/RequestRuleBindingRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/RequestRuleBinding' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /requests/rule-bindings/{uuid}/: + get: + operationId: requests_rule_bindings_retrieve + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Request Rule Binding. + required: true + tags: + - requests + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/RequestRuleBinding' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: requests_rule_bindings_update + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Request Rule Binding. + required: true + tags: + - requests + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/RequestRuleBindingRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/RequestRuleBinding' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: requests_rule_bindings_partial_update + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Request Rule Binding. + required: true + tags: + - requests + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedRequestRuleBindingRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/RequestRuleBinding' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: requests_rule_bindings_destroy + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Request Rule Binding. + required: true + tags: + - requests + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /requests/rule-bindings/{uuid}/used_by/: + get: + operationId: requests_rule_bindings_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Request Rule Binding. + required: true + tags: + - requests + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /requests/rule-child-bindings/: + get: + operationId: requests_rule_child_bindings_list + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: query + name: binding + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: target + schema: + type: string + format: uuid + tags: + - requests + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedRequestRuleChildBindingList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: requests_rule_child_bindings_create + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + tags: + - requests + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/RequestRuleChildBindingRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/RequestRuleChildBinding' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /requests/rule-child-bindings/{uuid}/: + get: + operationId: requests_rule_child_bindings_retrieve + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Request Rule Child Binding. + required: true + tags: + - requests + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/RequestRuleChildBinding' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: requests_rule_child_bindings_update + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Request Rule Child Binding. + required: true + tags: + - requests + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/RequestRuleChildBindingRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/RequestRuleChildBinding' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: requests_rule_child_bindings_partial_update + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Request Rule Child Binding. + required: true + tags: + - requests + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedRequestRuleChildBindingRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/RequestRuleChildBinding' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: requests_rule_child_bindings_destroy + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Request Rule Child Binding. + required: true + tags: + - requests + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /requests/rule-child-bindings/{uuid}/used_by/: + get: + operationId: requests_rule_child_bindings_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Request Rule Child Binding. + required: true + tags: + - requests + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /requests/rules/: + get: + operationId: requests_rules_list + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: pbm_uuid + schema: + type: string + format: uuid + - in: query + name: request_flow__slug + schema: + type: string + - $ref: '#/components/parameters/QuerySearch' + tags: + - requests + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedRequestRuleList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: requests_rules_create + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + tags: + - requests + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/RequestRuleRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/RequestRule' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /requests/rules/{uuid}/: + get: + operationId: requests_rules_retrieve + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Request Rule. + required: true + tags: + - requests + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/RequestRule' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: requests_rules_update + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Request Rule. + required: true + tags: + - requests + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/RequestRuleRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/RequestRule' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: requests_rules_partial_update + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Request Rule. + required: true + tags: + - requests + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedRequestRuleRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/RequestRule' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: requests_rules_destroy + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Request Rule. + required: true + tags: + - requests + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /requests/rules/{uuid}/used_by/: + get: + operationId: requests_rules_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Request Rule. + required: true + tags: + - requests + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /root/config/: + get: + operationId: root_config_retrieve + description: Retrieve public configuration options + tags: + - root + security: + - authentik: [] + - {} + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Config' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /schema/: + get: + operationId: schema_retrieve + description: |- + OpenApi3 schema for this API. Format can be selected via content negotiation. + + - YAML: application/vnd.oai.openapi + - JSON: application/vnd.oai.openapi+json + parameters: + - in: query + name: format + schema: + $ref: '#/components/schemas/FormatEnum' + - in: query + name: lang + schema: + $ref: '#/components/schemas/LangEnum' + tags: + - schema + security: + - authentik: [] + - {} + responses: + '200': + content: + application/vnd.oai.openapi: + schema: + type: object + additionalProperties: {} + application/yaml: + schema: + type: object + additionalProperties: {} + application/vnd.oai.openapi+json: + schema: + type: object + additionalProperties: {} + application/json: + schema: + type: object + additionalProperties: {} + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/all/: + get: + operationId: sources_all_list + description: Source Viewset + parameters: + - in: query + name: managed + schema: + type: string + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: pbm_uuid + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: slug + schema: + type: string + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedSourceList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/all/{slug}/: + get: + operationId: sources_all_retrieve + description: Source Viewset + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Source' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: sources_all_destroy + description: Prevent deletion of built-in sources + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/all/{slug}/used_by/: + get: + operationId: sources_all_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/all/types/: + get: + operationId: sources_all_types_list + description: Get all creatable types + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/TypeCreate' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/all/user_settings/: + get: + operationId: sources_all_user_settings_list + description: Get all sources the user can configure + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UserSetting' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/group_connections/all/: + get: + operationId: sources_group_connections_all_list + description: Group-source connection Viewset + parameters: + - in: query + name: group + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: source__slug + schema: + type: string + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedGroupSourceConnectionList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/group_connections/all/{id}/: + get: + operationId: sources_group_connections_all_retrieve + description: Group-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this group source connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GroupSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: sources_group_connections_all_update + description: Group-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this group source connection. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/GroupSourceConnectionRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GroupSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: sources_group_connections_all_partial_update + description: Group-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this group source connection. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedGroupSourceConnectionRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GroupSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: sources_group_connections_all_destroy + description: Group-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this group source connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/group_connections/all/{id}/used_by/: + get: + operationId: sources_group_connections_all_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this group source connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/group_connections/kerberos/: + get: + operationId: sources_group_connections_kerberos_list + description: Group-source connection Viewset + parameters: + - in: query + name: group + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: source__slug + schema: + type: string + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedGroupKerberosSourceConnectionList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: sources_group_connections_kerberos_create + description: Group-source connection Viewset + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/GroupKerberosSourceConnectionRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/GroupKerberosSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/group_connections/kerberos/{id}/: + get: + operationId: sources_group_connections_kerberos_retrieve + description: Group-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Group Kerberos Source + Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GroupKerberosSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: sources_group_connections_kerberos_update + description: Group-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Group Kerberos Source + Connection. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/GroupKerberosSourceConnectionRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GroupKerberosSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: sources_group_connections_kerberos_partial_update + description: Group-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Group Kerberos Source + Connection. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedGroupKerberosSourceConnectionRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GroupKerberosSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: sources_group_connections_kerberos_destroy + description: Group-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Group Kerberos Source + Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/group_connections/kerberos/{id}/used_by/: + get: + operationId: sources_group_connections_kerberos_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Group Kerberos Source + Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/group_connections/ldap/: + get: + operationId: sources_group_connections_ldap_list + description: Group-source connection Viewset + parameters: + - in: query + name: group + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: source__slug + schema: + type: string + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedGroupLDAPSourceConnectionList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: sources_group_connections_ldap_create + description: Group-source connection Viewset + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/GroupLDAPSourceConnectionRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/GroupLDAPSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/group_connections/ldap/{id}/: + get: + operationId: sources_group_connections_ldap_retrieve + description: Group-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Group LDAP Source Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GroupLDAPSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: sources_group_connections_ldap_update + description: Group-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Group LDAP Source Connection. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/GroupLDAPSourceConnectionRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GroupLDAPSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: sources_group_connections_ldap_partial_update + description: Group-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Group LDAP Source Connection. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedGroupLDAPSourceConnectionRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GroupLDAPSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: sources_group_connections_ldap_destroy + description: Group-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Group LDAP Source Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/group_connections/ldap/{id}/used_by/: + get: + operationId: sources_group_connections_ldap_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Group LDAP Source Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/group_connections/oauth/: + get: + operationId: sources_group_connections_oauth_list + description: Group-source connection Viewset + parameters: + - in: query + name: group + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: source__slug + schema: + type: string + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedGroupOAuthSourceConnectionList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: sources_group_connections_oauth_create + description: Group-source connection Viewset + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/GroupOAuthSourceConnectionRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/GroupOAuthSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/group_connections/oauth/{id}/: + get: + operationId: sources_group_connections_oauth_retrieve + description: Group-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Group OAuth Source Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GroupOAuthSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: sources_group_connections_oauth_update + description: Group-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Group OAuth Source Connection. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/GroupOAuthSourceConnectionRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GroupOAuthSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: sources_group_connections_oauth_partial_update + description: Group-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Group OAuth Source Connection. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedGroupOAuthSourceConnectionRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GroupOAuthSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: sources_group_connections_oauth_destroy + description: Group-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Group OAuth Source Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/group_connections/oauth/{id}/used_by/: + get: + operationId: sources_group_connections_oauth_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Group OAuth Source Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/group_connections/plex/: + get: + operationId: sources_group_connections_plex_list + description: Group-source connection Viewset + parameters: + - in: query + name: group + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: source__slug + schema: + type: string + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedGroupPlexSourceConnectionList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: sources_group_connections_plex_create + description: Group-source connection Viewset + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/GroupPlexSourceConnectionRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/GroupPlexSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/group_connections/plex/{id}/: + get: + operationId: sources_group_connections_plex_retrieve + description: Group-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Group Plex Source Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GroupPlexSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: sources_group_connections_plex_update + description: Group-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Group Plex Source Connection. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/GroupPlexSourceConnectionRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GroupPlexSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: sources_group_connections_plex_partial_update + description: Group-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Group Plex Source Connection. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedGroupPlexSourceConnectionRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GroupPlexSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: sources_group_connections_plex_destroy + description: Group-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Group Plex Source Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/group_connections/plex/{id}/used_by/: + get: + operationId: sources_group_connections_plex_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Group Plex Source Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/group_connections/saml/: + get: + operationId: sources_group_connections_saml_list + description: Group-source connection Viewset + parameters: + - in: query + name: group + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: source__slug + schema: + type: string + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedGroupSAMLSourceConnectionList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: sources_group_connections_saml_create + description: Group-source connection Viewset + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/GroupSAMLSourceConnectionRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/GroupSAMLSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/group_connections/saml/{id}/: + get: + operationId: sources_group_connections_saml_retrieve + description: Group-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Group SAML Source Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GroupSAMLSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: sources_group_connections_saml_update + description: Group-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Group SAML Source Connection. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/GroupSAMLSourceConnectionRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GroupSAMLSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: sources_group_connections_saml_partial_update + description: Group-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Group SAML Source Connection. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedGroupSAMLSourceConnectionRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GroupSAMLSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: sources_group_connections_saml_destroy + description: Group-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Group SAML Source Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/group_connections/saml/{id}/used_by/: + get: + operationId: sources_group_connections_saml_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Group SAML Source Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/group_connections/telegram/: + get: + operationId: sources_group_connections_telegram_list + description: Group-source connection Viewset + parameters: + - in: query + name: group + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: source__slug + schema: + type: string + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedGroupTelegramSourceConnectionList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: sources_group_connections_telegram_create + description: Group-source connection Viewset + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/GroupTelegramSourceConnectionRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/GroupTelegramSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/group_connections/telegram/{id}/: + get: + operationId: sources_group_connections_telegram_retrieve + description: Group-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Group Telegram Source + Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GroupTelegramSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: sources_group_connections_telegram_update + description: Group-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Group Telegram Source + Connection. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/GroupTelegramSourceConnectionRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GroupTelegramSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: sources_group_connections_telegram_partial_update + description: Group-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Group Telegram Source + Connection. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedGroupTelegramSourceConnectionRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GroupTelegramSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: sources_group_connections_telegram_destroy + description: Group-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Group Telegram Source + Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/group_connections/telegram/{id}/used_by/: + get: + operationId: sources_group_connections_telegram_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this Group Telegram Source + Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/kerberos/: + get: + operationId: sources_kerberos_list + description: Kerberos Source Viewset + parameters: + - in: query + name: enabled + schema: + type: boolean + - in: query + name: kadmin_type + schema: + allOf: + - $ref: '#/components/schemas/KadminTypeEnum' + description: |+ + KAdmin server type + + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: password_login_update_internal_password + schema: + type: boolean + - in: query + name: pbm_uuid + schema: + type: string + format: uuid + - in: query + name: realm + schema: + type: string + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: slug + schema: + type: string + - in: query + name: spnego_server_name + schema: + type: string + - in: query + name: sync_principal + schema: + type: string + - in: query + name: sync_users + schema: + type: boolean + - in: query + name: sync_users_password + schema: + type: boolean + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedKerberosSourceList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: sources_kerberos_create + description: Kerberos Source Viewset + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/KerberosSourceRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/KerberosSource' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/kerberos/{slug}/: + get: + operationId: sources_kerberos_retrieve + description: Kerberos Source Viewset + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/KerberosSource' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: sources_kerberos_update + description: Kerberos Source Viewset + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/KerberosSourceRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/KerberosSource' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: sources_kerberos_partial_update + description: Kerberos Source Viewset + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedKerberosSourceRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/KerberosSource' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: sources_kerberos_destroy + description: Kerberos Source Viewset + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/kerberos/{slug}/sync/status/: + get: + operationId: sources_kerberos_sync_status_retrieve + description: Get provider's sync status + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SyncStatus' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/kerberos/{slug}/used_by/: + get: + operationId: sources_kerberos_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/ldap/: + get: + operationId: sources_ldap_list + description: LDAP Source Viewset + parameters: + - in: query + name: additional_group_dn + schema: + type: string + - in: query + name: additional_user_dn + schema: + type: string + - in: query + name: base_dn + schema: + type: string + - in: query + name: bind_cn + schema: + type: string + - in: query + name: client_certificate + schema: + type: string + format: uuid + - in: query + name: delete_not_found_objects + schema: + type: boolean + - in: query + name: enabled + schema: + type: boolean + - in: query + name: group_membership_field + schema: + type: string + - in: query + name: group_object_filter + schema: + type: string + - in: query + name: group_property_mappings + schema: + type: array + items: + type: string + format: uuid + explode: true + style: form + - in: query + name: lookup_groups_from_user + schema: + type: boolean + - $ref: '#/components/parameters/QueryName' + - in: query + name: object_uniqueness_field + schema: + type: string + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: password_login_update_internal_password + schema: + type: boolean + - in: query + name: pbm_uuid + schema: + type: string + format: uuid + - in: query + name: peer_certificate + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: server_uri + schema: + type: string + - in: query + name: slug + schema: + type: string + - in: query + name: sni + schema: + type: boolean + - in: query + name: start_tls + schema: + type: boolean + - in: query + name: sync_group_hierarchy + schema: + type: boolean + - in: query + name: sync_groups + schema: + type: boolean + - in: query + name: sync_parent_group + schema: + type: string + format: uuid + - in: query + name: sync_users + schema: + type: boolean + - in: query + name: sync_users_password + schema: + type: boolean + - in: query + name: user_membership_attribute + schema: + type: string + - in: query + name: user_object_filter + schema: + type: string + - in: query + name: user_property_mappings + schema: + type: array + items: + type: string + format: uuid + explode: true + style: form + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedLDAPSourceList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: sources_ldap_create + description: LDAP Source Viewset + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/LDAPSourceRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/LDAPSource' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/ldap/{slug}/: + get: + operationId: sources_ldap_retrieve + description: LDAP Source Viewset + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/LDAPSource' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: sources_ldap_update + description: LDAP Source Viewset + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/LDAPSourceRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/LDAPSource' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: sources_ldap_partial_update + description: LDAP Source Viewset + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedLDAPSourceRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/LDAPSource' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: sources_ldap_destroy + description: LDAP Source Viewset + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/ldap/{slug}/debug/: + get: + operationId: sources_ldap_debug_retrieve + description: Get raw LDAP data to debug + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/LDAPDebug' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/ldap/{slug}/sync/status/: + get: + operationId: sources_ldap_sync_status_retrieve + description: Get provider's sync status + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SyncStatus' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/ldap/{slug}/used_by/: + get: + operationId: sources_ldap_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/oauth/: + get: + operationId: sources_oauth_list + description: Source Viewset + parameters: + - in: query + name: access_token_url + schema: + type: string + - in: query + name: additional_scopes + schema: + type: string + - in: query + name: authentication_flow + schema: + type: string + format: uuid + - in: query + name: authorization_url + schema: + type: string + - in: query + name: consumer_key + schema: + type: string + - in: query + name: enabled + schema: + type: boolean + - in: query + name: enrollment_flow + schema: + type: string + format: uuid + - in: query + name: group_matching_mode + schema: + allOf: + - $ref: '#/components/schemas/GroupMatchingModeEnum' + description: |+ + How the source determines if an existing group should be used or a new group created. + + - in: query + name: has_jwks + schema: + type: boolean + description: Only return sources with JWKS data + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: pbm_uuid + schema: + type: string + format: uuid + - in: query + name: policy_engine_mode + schema: + $ref: '#/components/schemas/PolicyEngineMode' + - in: query + name: profile_url + schema: + type: string + - in: query + name: provider_type + schema: + type: string + - in: query + name: request_token_url + schema: + type: string + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: slug + schema: + type: string + - in: query + name: user_matching_mode + schema: + allOf: + - $ref: '#/components/schemas/UserMatchingModeEnum' + description: |+ + How the source determines if an existing user should be authenticated or a new user enrolled. + + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedOAuthSourceList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: sources_oauth_create + description: Source Viewset + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/OAuthSourceRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/OAuthSource' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/oauth/{slug}/: + get: + operationId: sources_oauth_retrieve + description: Source Viewset + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/OAuthSource' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: sources_oauth_update + description: Source Viewset + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/OAuthSourceRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/OAuthSource' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: sources_oauth_partial_update + description: Source Viewset + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedOAuthSourceRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/OAuthSource' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: sources_oauth_destroy + description: Source Viewset + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/oauth/{slug}/used_by/: + get: + operationId: sources_oauth_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/oauth/source_types/: + get: + operationId: sources_oauth_source_types_list + description: |- + Get all creatable source types. If ?name is set, only returns the type for . + If isn't found, returns the default type. + parameters: + - $ref: '#/components/parameters/QueryName' + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/SourceType' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/plex/: + get: + operationId: sources_plex_list + description: Plex source Viewset + parameters: + - in: query + name: allow_friends + schema: + type: boolean + - in: query + name: authentication_flow + schema: + type: string + format: uuid + - in: query + name: client_id + schema: + type: string + - in: query + name: enabled + schema: + type: boolean + - in: query + name: enrollment_flow + schema: + type: string + format: uuid + - in: query + name: group_matching_mode + schema: + allOf: + - $ref: '#/components/schemas/GroupMatchingModeEnum' + description: |+ + How the source determines if an existing group should be used or a new group created. + + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: pbm_uuid + schema: + type: string + format: uuid + - in: query + name: policy_engine_mode + schema: + $ref: '#/components/schemas/PolicyEngineMode' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: slug + schema: + type: string + - in: query + name: user_matching_mode + schema: + allOf: + - $ref: '#/components/schemas/UserMatchingModeEnum' + description: |+ + How the source determines if an existing user should be authenticated or a new user enrolled. + + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedPlexSourceList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: sources_plex_create + description: Plex source Viewset + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PlexSourceRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/PlexSource' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/plex/{slug}/: + get: + operationId: sources_plex_retrieve + description: Plex source Viewset + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PlexSource' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: sources_plex_update + description: Plex source Viewset + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PlexSourceRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PlexSource' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: sources_plex_partial_update + description: Plex source Viewset + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedPlexSourceRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PlexSource' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: sources_plex_destroy + description: Plex source Viewset + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/plex/{slug}/used_by/: + get: + operationId: sources_plex_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/plex/redeem_token/: + post: + operationId: sources_plex_redeem_token_create + description: |- + Redeem a plex token, check it's access to resources against what's allowed + for the source, and redirect to an authentication/enrollment flow. + parameters: + - in: query + name: slug + schema: + type: string + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PlexTokenRedeemRequest' + required: true + security: + - authentik: [] + - {} + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/RedirectChallenge' + description: '' + '400': + description: Token not found + '403': + description: Access denied + /sources/plex/redeem_token_authenticated/: + post: + operationId: sources_plex_redeem_token_authenticated_create + description: Redeem a plex token for an authenticated user, creating a connection + parameters: + - in: query + name: slug + schema: + type: string + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PlexTokenRedeemRequest' + required: true + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + description: Token not found + '403': + description: Access denied + /sources/saml/: + get: + operationId: sources_saml_list + description: SAMLSource Viewset + parameters: + - in: query + name: allow_idp_initiated + schema: + type: boolean + - in: query + name: authentication_flow + schema: + type: string + format: uuid + - in: query + name: binding_type + schema: + $ref: '#/components/schemas/BindingTypeEnum' + - in: query + name: digest_algorithm + schema: + $ref: '#/components/schemas/DigestAlgorithmEnum' + - in: query + name: enabled + schema: + type: boolean + - in: query + name: enrollment_flow + schema: + type: string + format: uuid + - in: query + name: force_authn + schema: + type: boolean + - in: query + name: issuer_override + schema: + type: string + - in: query + name: managed + schema: + type: string + - $ref: '#/components/parameters/QueryName' + - in: query + name: name_id_policy + schema: + allOf: + - $ref: '#/components/schemas/SAMLNameIDPolicyEnum' + description: |+ + NameID Policy sent to the IdP. Can be unset, in which case no Policy is sent. + + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: pbm_uuid + schema: + type: string + format: uuid + - in: query + name: policy_engine_mode + schema: + $ref: '#/components/schemas/PolicyEngineMode' + - in: query + name: pre_authentication_flow + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: signature_algorithm + schema: + $ref: '#/components/schemas/SignatureAlgorithmEnum' + - in: query + name: signed_assertion + schema: + type: boolean + - in: query + name: signed_response + schema: + type: boolean + - in: query + name: signing_kp + schema: + type: string + format: uuid + - in: query + name: slo_url + schema: + type: string + - in: query + name: slug + schema: + type: string + - in: query + name: sso_url + schema: + type: string + - in: query + name: temporary_user_delete_after + schema: + type: string + - in: query + name: user_matching_mode + schema: + allOf: + - $ref: '#/components/schemas/UserMatchingModeEnum' + description: |+ + How the source determines if an existing user should be authenticated or a new user enrolled. + + - in: query + name: verification_kp + schema: + type: string + format: uuid + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedSAMLSourceList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: sources_saml_create + description: SAMLSource Viewset + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SAMLSourceRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/SAMLSource' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/saml/{slug}/: + get: + operationId: sources_saml_retrieve + description: SAMLSource Viewset + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SAMLSource' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: sources_saml_update + description: SAMLSource Viewset + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SAMLSourceRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SAMLSource' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: sources_saml_partial_update + description: SAMLSource Viewset + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedSAMLSourceRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SAMLSource' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: sources_saml_destroy + description: SAMLSource Viewset + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/saml/{slug}/metadata/: + get: + operationId: sources_saml_metadata_retrieve + description: Return metadata as XML string + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SAMLMetadata' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/saml/{slug}/used_by/: + get: + operationId: sources_saml_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/scim/: + get: + operationId: sources_scim_list + description: SCIMSource Viewset + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: pbm_uuid + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: slug + schema: + type: string + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedSCIMSourceList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: sources_scim_create + description: SCIMSource Viewset + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMSourceRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMSource' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/scim/{slug}/: + get: + operationId: sources_scim_retrieve + description: SCIMSource Viewset + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMSource' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: sources_scim_update + description: SCIMSource Viewset + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMSourceRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMSource' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: sources_scim_partial_update + description: SCIMSource Viewset + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedSCIMSourceRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMSource' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: sources_scim_destroy + description: SCIMSource Viewset + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/scim/{slug}/used_by/: + get: + operationId: sources_scim_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/scim_groups/: + get: + operationId: sources_scim_groups_list + description: SCIMSourceGroup Viewset + parameters: + - in: query + name: group__group_uuid + schema: + type: string + format: uuid + - in: query + name: group__name + schema: + type: string + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: source__slug + schema: + type: string + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedSCIMSourceGroupList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: sources_scim_groups_create + description: SCIMSourceGroup Viewset + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMSourceGroupRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMSourceGroup' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/scim_groups/{id}/: + get: + operationId: sources_scim_groups_retrieve + description: SCIMSourceGroup Viewset + parameters: + - in: path + name: id + schema: + type: string + description: A unique value identifying this scim source group. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMSourceGroup' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: sources_scim_groups_update + description: SCIMSourceGroup Viewset + parameters: + - in: path + name: id + schema: + type: string + description: A unique value identifying this scim source group. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMSourceGroupRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMSourceGroup' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: sources_scim_groups_partial_update + description: SCIMSourceGroup Viewset + parameters: + - in: path + name: id + schema: + type: string + description: A unique value identifying this scim source group. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedSCIMSourceGroupRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMSourceGroup' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: sources_scim_groups_destroy + description: SCIMSourceGroup Viewset + parameters: + - in: path + name: id + schema: + type: string + description: A unique value identifying this scim source group. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/scim_groups/{id}/used_by/: + get: + operationId: sources_scim_groups_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: string + description: A unique value identifying this scim source group. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/scim_users/: + get: + operationId: sources_scim_users_list + description: SCIMSourceUser Viewset + parameters: + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: source__slug + schema: + type: string + - in: query + name: user__id + schema: + type: integer + - in: query + name: user__username + schema: + type: string + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedSCIMSourceUserList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: sources_scim_users_create + description: SCIMSourceUser Viewset + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMSourceUserRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMSourceUser' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/scim_users/{id}/: + get: + operationId: sources_scim_users_retrieve + description: SCIMSourceUser Viewset + parameters: + - in: path + name: id + schema: + type: string + description: A unique value identifying this scim source user. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMSourceUser' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: sources_scim_users_update + description: SCIMSourceUser Viewset + parameters: + - in: path + name: id + schema: + type: string + description: A unique value identifying this scim source user. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMSourceUserRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMSourceUser' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: sources_scim_users_partial_update + description: SCIMSourceUser Viewset + parameters: + - in: path + name: id + schema: + type: string + description: A unique value identifying this scim source user. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedSCIMSourceUserRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SCIMSourceUser' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: sources_scim_users_destroy + description: SCIMSourceUser Viewset + parameters: + - in: path + name: id + schema: + type: string + description: A unique value identifying this scim source user. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/scim_users/{id}/used_by/: + get: + operationId: sources_scim_users_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: string + description: A unique value identifying this scim source user. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/telegram/: + get: + operationId: sources_telegram_list + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: query + name: authentication_flow + schema: + type: string + format: uuid + - in: query + name: bot_username + schema: + type: string + - in: query + name: enabled + schema: + type: boolean + - in: query + name: enrollment_flow + schema: + type: string + format: uuid + - in: query + name: group_matching_mode + schema: + allOf: + - $ref: '#/components/schemas/GroupMatchingModeEnum' + description: |+ + How the source determines if an existing group should be used or a new group created. + + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: pbm_uuid + schema: + type: string + format: uuid + - in: query + name: policy_engine_mode + schema: + $ref: '#/components/schemas/PolicyEngineMode' + - in: query + name: request_message_access + schema: + type: boolean + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: slug + schema: + type: string + - in: query + name: user_matching_mode + schema: + allOf: + - $ref: '#/components/schemas/UserMatchingModeEnum' + description: |+ + How the source determines if an existing user should be authenticated or a new user enrolled. + + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedTelegramSourceList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: sources_telegram_create + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/TelegramSourceRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/TelegramSource' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/telegram/{slug}/: + get: + operationId: sources_telegram_retrieve + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/TelegramSource' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: sources_telegram_update + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/TelegramSourceRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/TelegramSource' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: sources_telegram_partial_update + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedTelegramSourceRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/TelegramSource' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: sources_telegram_destroy + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/telegram/{slug}/connect_user/: + post: + operationId: sources_telegram_connect_user_create + description: Mixin to add a used_by endpoint to return a list of all objects + using this object + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/TelegramAuthRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/UserTelegramSourceConnection' + description: '' + '403': + description: Access denied + '400': + $ref: '#/components/responses/ValidationErrorResponse' + /sources/telegram/{slug}/used_by/: + get: + operationId: sources_telegram_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: slug + schema: + type: string + description: Internal source name, used in URLs. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/user_connections/all/: + get: + operationId: sources_user_connections_all_list + description: User-source connection Viewset + parameters: + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: source__slug + schema: + type: string + - in: query + name: user + schema: + type: integer + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedUserSourceConnectionList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/user_connections/all/{id}/: + get: + operationId: sources_user_connections_all_retrieve + description: User-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this user source connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: sources_user_connections_all_update + description: User-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this user source connection. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserSourceConnectionRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: sources_user_connections_all_partial_update + description: User-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this user source connection. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedUserSourceConnectionRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: sources_user_connections_all_destroy + description: User-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this user source connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/user_connections/all/{id}/used_by/: + get: + operationId: sources_user_connections_all_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this user source connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/user_connections/kerberos/: + get: + operationId: sources_user_connections_kerberos_list + description: User-source connection Viewset + parameters: + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: source__slug + schema: + type: string + - in: query + name: user + schema: + type: integer + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedUserKerberosSourceConnectionList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: sources_user_connections_kerberos_create + description: User-source connection Viewset + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserKerberosSourceConnectionRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/UserKerberosSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/user_connections/kerberos/{id}/: + get: + operationId: sources_user_connections_kerberos_retrieve + description: User-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User Kerberos Source + Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserKerberosSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: sources_user_connections_kerberos_update + description: User-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User Kerberos Source + Connection. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserKerberosSourceConnectionRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserKerberosSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: sources_user_connections_kerberos_partial_update + description: User-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User Kerberos Source + Connection. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedUserKerberosSourceConnectionRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserKerberosSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: sources_user_connections_kerberos_destroy + description: User-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User Kerberos Source + Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/user_connections/kerberos/{id}/used_by/: + get: + operationId: sources_user_connections_kerberos_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User Kerberos Source + Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/user_connections/ldap/: + get: + operationId: sources_user_connections_ldap_list + description: User-source connection Viewset + parameters: + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: source__slug + schema: + type: string + - in: query + name: user + schema: + type: integer + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedUserLDAPSourceConnectionList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: sources_user_connections_ldap_create + description: User-source connection Viewset + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserLDAPSourceConnectionRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/UserLDAPSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/user_connections/ldap/{id}/: + get: + operationId: sources_user_connections_ldap_retrieve + description: User-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User LDAP Source Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserLDAPSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: sources_user_connections_ldap_update + description: User-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User LDAP Source Connection. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserLDAPSourceConnectionRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserLDAPSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: sources_user_connections_ldap_partial_update + description: User-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User LDAP Source Connection. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedUserLDAPSourceConnectionRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserLDAPSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: sources_user_connections_ldap_destroy + description: User-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User LDAP Source Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/user_connections/ldap/{id}/used_by/: + get: + operationId: sources_user_connections_ldap_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User LDAP Source Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/user_connections/oauth/: + get: + operationId: sources_user_connections_oauth_list + description: User-source connection Viewset + parameters: + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: source__slug + schema: + type: string + - in: query + name: user + schema: + type: integer + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedUserOAuthSourceConnectionList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: sources_user_connections_oauth_create + description: User-source connection Viewset + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserOAuthSourceConnectionRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/UserOAuthSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/user_connections/oauth/{id}/: + get: + operationId: sources_user_connections_oauth_retrieve + description: User-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User OAuth Source Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserOAuthSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: sources_user_connections_oauth_update + description: User-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User OAuth Source Connection. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserOAuthSourceConnectionRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserOAuthSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: sources_user_connections_oauth_partial_update + description: User-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User OAuth Source Connection. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedUserOAuthSourceConnectionRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserOAuthSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: sources_user_connections_oauth_destroy + description: User-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User OAuth Source Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/user_connections/oauth/{id}/used_by/: + get: + operationId: sources_user_connections_oauth_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User OAuth Source Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/user_connections/plex/: + get: + operationId: sources_user_connections_plex_list + description: User-source connection Viewset + parameters: + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: source__slug + schema: + type: string + - in: query + name: user + schema: + type: integer + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedUserPlexSourceConnectionList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: sources_user_connections_plex_create + description: User-source connection Viewset + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserPlexSourceConnectionRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/UserPlexSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/user_connections/plex/{id}/: + get: + operationId: sources_user_connections_plex_retrieve + description: User-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User Plex Source Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserPlexSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: sources_user_connections_plex_update + description: User-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User Plex Source Connection. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserPlexSourceConnectionRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserPlexSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: sources_user_connections_plex_partial_update + description: User-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User Plex Source Connection. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedUserPlexSourceConnectionRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserPlexSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: sources_user_connections_plex_destroy + description: User-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User Plex Source Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/user_connections/plex/{id}/used_by/: + get: + operationId: sources_user_connections_plex_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User Plex Source Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/user_connections/saml/: + get: + operationId: sources_user_connections_saml_list + description: User-source connection Viewset + parameters: + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: source__slug + schema: + type: string + - in: query + name: user + schema: + type: integer + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedUserSAMLSourceConnectionList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: sources_user_connections_saml_create + description: User-source connection Viewset + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserSAMLSourceConnectionRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/UserSAMLSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/user_connections/saml/{id}/: + get: + operationId: sources_user_connections_saml_retrieve + description: User-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User SAML Source Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserSAMLSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: sources_user_connections_saml_update + description: User-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User SAML Source Connection. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserSAMLSourceConnectionRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserSAMLSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: sources_user_connections_saml_partial_update + description: User-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User SAML Source Connection. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedUserSAMLSourceConnectionRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserSAMLSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: sources_user_connections_saml_destroy + description: User-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User SAML Source Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/user_connections/saml/{id}/used_by/: + get: + operationId: sources_user_connections_saml_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User SAML Source Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/user_connections/telegram/: + get: + operationId: sources_user_connections_telegram_list + description: User-source connection Viewset + parameters: + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: source__slug + schema: + type: string + - in: query + name: user + schema: + type: integer + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedUserTelegramSourceConnectionList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: sources_user_connections_telegram_create + description: User-source connection Viewset + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserTelegramSourceConnectionRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/UserTelegramSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/user_connections/telegram/{id}/: + get: + operationId: sources_user_connections_telegram_retrieve + description: User-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User Telegram Source + Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserTelegramSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: sources_user_connections_telegram_update + description: User-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User Telegram Source + Connection. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserTelegramSourceConnectionRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserTelegramSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: sources_user_connections_telegram_partial_update + description: User-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User Telegram Source + Connection. + required: true + tags: + - sources + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedUserTelegramSourceConnectionRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserTelegramSourceConnection' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: sources_user_connections_telegram_destroy + description: User-source connection Viewset + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User Telegram Source + Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /sources/user_connections/telegram/{id}/used_by/: + get: + operationId: sources_user_connections_telegram_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: id + schema: + type: integer + description: A unique integer value identifying this User Telegram Source + Connection. + required: true + tags: + - sources + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /ssf/streams/: + get: + operationId: ssf_streams_list + description: SSFStream Viewset + parameters: + - in: query + name: delivery_method + schema: + $ref: '#/components/schemas/DeliveryMethodEnum' + - in: query + name: endpoint_url + schema: + type: string + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: provider + schema: + type: integer + - $ref: '#/components/parameters/QuerySearch' + tags: + - ssf + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedSSFStreamList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /ssf/streams/{uuid}/: + get: + operationId: ssf_streams_retrieve + description: SSFStream Viewset + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this SSF Stream. + required: true + tags: + - ssf + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SSFStream' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: ssf_streams_destroy + description: SSFStream Viewset + parameters: + - in: path + name: uuid + schema: + type: string + format: uuid + description: A UUID string identifying this SSF Stream. + required: true + tags: + - ssf + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/account_lockdown/: + get: + operationId: stages_account_lockdown_list + description: AccountLockdownStage Viewset + parameters: + - in: query + name: deactivate_user + schema: + type: boolean + - in: query + name: delete_sessions + schema: + type: boolean + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: revoke_tokens + schema: + type: boolean + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: self_service_completion_flow + schema: + type: string + format: uuid + - in: query + name: set_unusable_password + schema: + type: boolean + - in: query + name: stage_uuid + schema: + type: string + format: uuid + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedAccountLockdownStageList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: stages_account_lockdown_create + description: AccountLockdownStage Viewset + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/AccountLockdownStageRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/AccountLockdownStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/account_lockdown/{stage_uuid}/: + get: + operationId: stages_account_lockdown_retrieve + description: AccountLockdownStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Account Lockdown Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AccountLockdownStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: stages_account_lockdown_update + description: AccountLockdownStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Account Lockdown Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/AccountLockdownStageRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AccountLockdownStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: stages_account_lockdown_partial_update + description: AccountLockdownStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Account Lockdown Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedAccountLockdownStageRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AccountLockdownStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: stages_account_lockdown_destroy + description: AccountLockdownStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Account Lockdown Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/account_lockdown/{stage_uuid}/used_by/: + get: + operationId: stages_account_lockdown_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Account Lockdown Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/all/: + get: + operationId: stages_all_list + description: Stage Viewset + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedStageList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/all/{stage_uuid}/: + get: + operationId: stages_all_retrieve + description: Stage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this authentik.providers.oauth2.views.authorize.OAuthFulfillmentStage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Stage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: stages_all_destroy + description: Stage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this authentik.providers.oauth2.views.authorize.OAuthFulfillmentStage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/all/{stage_uuid}/used_by/: + get: + operationId: stages_all_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this authentik.providers.oauth2.views.authorize.OAuthFulfillmentStage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/all/types/: + get: + operationId: stages_all_types_list + description: Get all creatable types + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/TypeCreate' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/all/user_settings/: + get: + operationId: stages_all_user_settings_list + description: Get all stages the user can configure + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UserSetting' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/authenticator/duo/: + get: + operationId: stages_authenticator_duo_list + description: AuthenticatorDuoStage Viewset + parameters: + - in: query + name: api_hostname + schema: + type: string + - in: query + name: client_id + schema: + type: string + - in: query + name: configure_flow + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedAuthenticatorDuoStageList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: stages_authenticator_duo_create + description: AuthenticatorDuoStage Viewset + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorDuoStageRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorDuoStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/authenticator/duo/{stage_uuid}/: + get: + operationId: stages_authenticator_duo_retrieve + description: AuthenticatorDuoStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Duo Authenticator Setup Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorDuoStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: stages_authenticator_duo_update + description: AuthenticatorDuoStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Duo Authenticator Setup Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorDuoStageRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorDuoStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: stages_authenticator_duo_partial_update + description: AuthenticatorDuoStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Duo Authenticator Setup Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedAuthenticatorDuoStageRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorDuoStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: stages_authenticator_duo_destroy + description: AuthenticatorDuoStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Duo Authenticator Setup Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/authenticator/duo/{stage_uuid}/enrollment_status/: + post: + operationId: stages_authenticator_duo_enrollment_status_create + description: Check enrollment status of user details in current session + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Duo Authenticator Setup Stage. + required: true + tags: + - stages + security: + - {} + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/DuoDeviceEnrollmentStatus' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/authenticator/duo/{stage_uuid}/import_device_manual/: + post: + operationId: stages_authenticator_duo_import_device_manual_create + description: Import duo devices into authentik + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Duo Authenticator Setup Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorDuoStageManualDeviceImportRequest' + required: true + security: + - authentik: [] + responses: + '204': + description: Enrollment successful + '400': + description: Bad request + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/authenticator/duo/{stage_uuid}/import_devices_automatic/: + post: + operationId: stages_authenticator_duo_import_devices_automatic_create + description: Import duo devices into authentik + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Duo Authenticator Setup Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorDuoStageDeviceImportResponse' + description: '' + '400': + description: Bad request + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/authenticator/duo/{stage_uuid}/used_by/: + get: + operationId: stages_authenticator_duo_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Duo Authenticator Setup Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/authenticator/email/: + get: + operationId: stages_authenticator_email_list + description: AuthenticatorEmailStage Viewset + parameters: + - in: query + name: configure_flow + schema: + type: string + format: uuid + - in: query + name: friendly_name + schema: + type: string + - in: query + name: from_address + schema: + type: string + - in: query + name: host + schema: + type: string + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: password + schema: + type: string + - in: query + name: port + schema: + type: integer + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: stage_uuid + schema: + type: string + format: uuid + - in: query + name: subject + schema: + type: string + - in: query + name: template + schema: + type: string + - in: query + name: timeout + schema: + type: integer + - in: query + name: token_expiry + schema: + type: string + - in: query + name: use_global_settings + schema: + type: boolean + - in: query + name: use_ssl + schema: + type: boolean + - in: query + name: use_tls + schema: + type: boolean + - in: query + name: username + schema: + type: string + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedAuthenticatorEmailStageList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: stages_authenticator_email_create + description: AuthenticatorEmailStage Viewset + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorEmailStageRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorEmailStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/authenticator/email/{stage_uuid}/: + get: + operationId: stages_authenticator_email_retrieve + description: AuthenticatorEmailStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Email Authenticator Setup Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorEmailStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: stages_authenticator_email_update + description: AuthenticatorEmailStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Email Authenticator Setup Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorEmailStageRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorEmailStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: stages_authenticator_email_partial_update + description: AuthenticatorEmailStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Email Authenticator Setup Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedAuthenticatorEmailStageRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorEmailStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: stages_authenticator_email_destroy + description: AuthenticatorEmailStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Email Authenticator Setup Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/authenticator/email/{stage_uuid}/used_by/: + get: + operationId: stages_authenticator_email_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Email Authenticator Setup Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/authenticator/endpoint_gdtc/: + get: + operationId: stages_authenticator_endpoint_gdtc_list + description: AuthenticatorEndpointGDTCStage Viewset + parameters: + - in: query + name: configure_flow + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedAuthenticatorEndpointGDTCStageList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: stages_authenticator_endpoint_gdtc_create + description: AuthenticatorEndpointGDTCStage Viewset + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorEndpointGDTCStageRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorEndpointGDTCStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/authenticator/endpoint_gdtc/{stage_uuid}/: + get: + operationId: stages_authenticator_endpoint_gdtc_retrieve + description: AuthenticatorEndpointGDTCStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Endpoint Authenticator Google + Device Trust Connector Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorEndpointGDTCStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: stages_authenticator_endpoint_gdtc_update + description: AuthenticatorEndpointGDTCStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Endpoint Authenticator Google + Device Trust Connector Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorEndpointGDTCStageRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorEndpointGDTCStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: stages_authenticator_endpoint_gdtc_partial_update + description: AuthenticatorEndpointGDTCStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Endpoint Authenticator Google + Device Trust Connector Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedAuthenticatorEndpointGDTCStageRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorEndpointGDTCStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: stages_authenticator_endpoint_gdtc_destroy + description: AuthenticatorEndpointGDTCStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Endpoint Authenticator Google + Device Trust Connector Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/authenticator/endpoint_gdtc/{stage_uuid}/used_by/: + get: + operationId: stages_authenticator_endpoint_gdtc_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Endpoint Authenticator Google + Device Trust Connector Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/authenticator/sms/: + get: + operationId: stages_authenticator_sms_list + description: AuthenticatorSMSStage Viewset + parameters: + - in: query + name: account_sid + schema: + type: string + - in: query + name: auth + schema: + type: string + - in: query + name: auth_password + schema: + type: string + - in: query + name: auth_type + schema: + $ref: '#/components/schemas/AuthTypeEnum' + - in: query + name: configure_flow + schema: + type: string + format: uuid + - in: query + name: friendly_name + schema: + type: string + - in: query + name: from_number + schema: + type: string + - in: query + name: mapping + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: provider + schema: + $ref: '#/components/schemas/ProviderEnum' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: stage_uuid + schema: + type: string + format: uuid + - in: query + name: verify_only + schema: + type: boolean + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedAuthenticatorSMSStageList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: stages_authenticator_sms_create + description: AuthenticatorSMSStage Viewset + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorSMSStageRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorSMSStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/authenticator/sms/{stage_uuid}/: + get: + operationId: stages_authenticator_sms_retrieve + description: AuthenticatorSMSStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this SMS Authenticator Setup Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorSMSStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: stages_authenticator_sms_update + description: AuthenticatorSMSStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this SMS Authenticator Setup Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorSMSStageRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorSMSStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: stages_authenticator_sms_partial_update + description: AuthenticatorSMSStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this SMS Authenticator Setup Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedAuthenticatorSMSStageRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorSMSStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: stages_authenticator_sms_destroy + description: AuthenticatorSMSStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this SMS Authenticator Setup Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/authenticator/sms/{stage_uuid}/used_by/: + get: + operationId: stages_authenticator_sms_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this SMS Authenticator Setup Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/authenticator/static/: + get: + operationId: stages_authenticator_static_list + description: AuthenticatorStaticStage Viewset + parameters: + - in: query + name: configure_flow + schema: + type: string + format: uuid + - in: query + name: friendly_name + schema: + type: string + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: stage_uuid + schema: + type: string + format: uuid + - in: query + name: token_count + schema: + type: integer + - in: query + name: token_length + schema: + type: integer + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedAuthenticatorStaticStageList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: stages_authenticator_static_create + description: AuthenticatorStaticStage Viewset + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorStaticStageRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorStaticStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/authenticator/static/{stage_uuid}/: + get: + operationId: stages_authenticator_static_retrieve + description: AuthenticatorStaticStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Static Authenticator Setup Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorStaticStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: stages_authenticator_static_update + description: AuthenticatorStaticStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Static Authenticator Setup Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorStaticStageRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorStaticStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: stages_authenticator_static_partial_update + description: AuthenticatorStaticStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Static Authenticator Setup Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedAuthenticatorStaticStageRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorStaticStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: stages_authenticator_static_destroy + description: AuthenticatorStaticStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Static Authenticator Setup Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/authenticator/static/{stage_uuid}/used_by/: + get: + operationId: stages_authenticator_static_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Static Authenticator Setup Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/authenticator/totp/: + get: + operationId: stages_authenticator_totp_list + description: AuthenticatorTOTPStage Viewset + parameters: + - in: query + name: configure_flow + schema: + type: string + format: uuid + - in: query + name: digits + schema: + $ref: '#/components/schemas/DigitsEnum' + - in: query + name: friendly_name + schema: + type: string + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: stage_uuid + schema: + type: string + format: uuid + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedAuthenticatorTOTPStageList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: stages_authenticator_totp_create + description: AuthenticatorTOTPStage Viewset + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorTOTPStageRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorTOTPStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/authenticator/totp/{stage_uuid}/: + get: + operationId: stages_authenticator_totp_retrieve + description: AuthenticatorTOTPStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this TOTP Authenticator Setup Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorTOTPStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: stages_authenticator_totp_update + description: AuthenticatorTOTPStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this TOTP Authenticator Setup Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorTOTPStageRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorTOTPStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: stages_authenticator_totp_partial_update + description: AuthenticatorTOTPStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this TOTP Authenticator Setup Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedAuthenticatorTOTPStageRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorTOTPStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: stages_authenticator_totp_destroy + description: AuthenticatorTOTPStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this TOTP Authenticator Setup Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/authenticator/totp/{stage_uuid}/used_by/: + get: + operationId: stages_authenticator_totp_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this TOTP Authenticator Setup Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/authenticator/validate/: + get: + operationId: stages_authenticator_validate_list + description: AuthenticatorValidateStage Viewset + parameters: + - in: query + name: configuration_stages + schema: + type: array + items: + type: string + format: uuid + explode: true + style: form + - $ref: '#/components/parameters/QueryName' + - in: query + name: not_configured_action + schema: + $ref: '#/components/schemas/NotConfiguredActionEnum' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedAuthenticatorValidateStageList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: stages_authenticator_validate_create + description: AuthenticatorValidateStage Viewset + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorValidateStageRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorValidateStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/authenticator/validate/{stage_uuid}/: + get: + operationId: stages_authenticator_validate_retrieve + description: AuthenticatorValidateStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Authenticator Validation Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorValidateStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: stages_authenticator_validate_update + description: AuthenticatorValidateStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Authenticator Validation Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorValidateStageRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorValidateStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: stages_authenticator_validate_partial_update + description: AuthenticatorValidateStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Authenticator Validation Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedAuthenticatorValidateStageRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorValidateStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: stages_authenticator_validate_destroy + description: AuthenticatorValidateStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Authenticator Validation Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/authenticator/validate/{stage_uuid}/used_by/: + get: + operationId: stages_authenticator_validate_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Authenticator Validation Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/authenticator/webauthn/: + get: + operationId: stages_authenticator_webauthn_list + description: AuthenticatorWebAuthnStage Viewset + parameters: + - in: query + name: authenticator_attachment + schema: + allOf: + - $ref: '#/components/schemas/AuthenticatorAttachmentEnum' + nullable: true + - in: query + name: configure_flow + schema: + type: string + format: uuid + - in: query + name: device_type_restrictions + schema: + type: array + items: + type: string + format: uuid + explode: true + style: form + - in: query + name: max_attempts + schema: + type: integer + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: resident_key_requirement + schema: + $ref: '#/components/schemas/UserVerificationEnum' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: user_verification + schema: + $ref: '#/components/schemas/UserVerificationEnum' + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedAuthenticatorWebAuthnStageList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: stages_authenticator_webauthn_create + description: AuthenticatorWebAuthnStage Viewset + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorWebAuthnStageRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorWebAuthnStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/authenticator/webauthn/{stage_uuid}/: + get: + operationId: stages_authenticator_webauthn_retrieve + description: AuthenticatorWebAuthnStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this WebAuthn Authenticator Setup Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorWebAuthnStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: stages_authenticator_webauthn_update + description: AuthenticatorWebAuthnStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this WebAuthn Authenticator Setup Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorWebAuthnStageRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorWebAuthnStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: stages_authenticator_webauthn_partial_update + description: AuthenticatorWebAuthnStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this WebAuthn Authenticator Setup Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedAuthenticatorWebAuthnStageRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/AuthenticatorWebAuthnStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: stages_authenticator_webauthn_destroy + description: AuthenticatorWebAuthnStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this WebAuthn Authenticator Setup Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/authenticator/webauthn/{stage_uuid}/used_by/: + get: + operationId: stages_authenticator_webauthn_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this WebAuthn Authenticator Setup Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/authenticator/webauthn_device_types/: + get: + operationId: stages_authenticator_webauthn_device_types_list + description: WebAuthnDeviceType Viewset + parameters: + - in: query + name: aaguid + schema: + type: string + format: uuid + - in: query + name: description + schema: + type: string + - in: query + name: icon + schema: + type: string + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedWebAuthnDeviceTypeList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/authenticator/webauthn_device_types/{aaguid}/: + get: + operationId: stages_authenticator_webauthn_device_types_retrieve + description: WebAuthnDeviceType Viewset + parameters: + - in: path + name: aaguid + schema: + type: string + format: uuid + description: A UUID string identifying this WebAuthn Device type. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/WebAuthnDeviceType' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/captcha/: + get: + operationId: stages_captcha_list + description: CaptchaStage Viewset + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: public_key + schema: + type: string + - $ref: '#/components/parameters/QuerySearch' + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedCaptchaStageList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: stages_captcha_create + description: CaptchaStage Viewset + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/CaptchaStageRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/CaptchaStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/captcha/{stage_uuid}/: + get: + operationId: stages_captcha_retrieve + description: CaptchaStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Captcha Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/CaptchaStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: stages_captcha_update + description: CaptchaStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Captcha Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/CaptchaStageRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/CaptchaStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: stages_captcha_partial_update + description: CaptchaStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Captcha Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedCaptchaStageRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/CaptchaStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: stages_captcha_destroy + description: CaptchaStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Captcha Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/captcha/{stage_uuid}/used_by/: + get: + operationId: stages_captcha_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Captcha Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/consent/: + get: + operationId: stages_consent_list + description: ConsentStage Viewset + parameters: + - in: query + name: consent_expire_in + schema: + type: string + - in: query + name: mode + schema: + $ref: '#/components/schemas/ConsentModeEnum' + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: stage_uuid + schema: + type: string + format: uuid + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedConsentStageList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: stages_consent_create + description: ConsentStage Viewset + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/ConsentStageRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/ConsentStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/consent/{stage_uuid}/: + get: + operationId: stages_consent_retrieve + description: ConsentStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Consent Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/ConsentStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: stages_consent_update + description: ConsentStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Consent Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/ConsentStageRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/ConsentStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: stages_consent_partial_update + description: ConsentStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Consent Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedConsentStageRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/ConsentStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: stages_consent_destroy + description: ConsentStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Consent Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/consent/{stage_uuid}/used_by/: + get: + operationId: stages_consent_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Consent Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/deny/: + get: + operationId: stages_deny_list + description: DenyStage Viewset + parameters: + - in: query + name: deny_message + schema: + type: string + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: stage_uuid + schema: + type: string + format: uuid + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedDenyStageList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: stages_deny_create + description: DenyStage Viewset + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/DenyStageRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/DenyStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/deny/{stage_uuid}/: + get: + operationId: stages_deny_retrieve + description: DenyStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Deny Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/DenyStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: stages_deny_update + description: DenyStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Deny Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/DenyStageRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/DenyStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: stages_deny_partial_update + description: DenyStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Deny Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedDenyStageRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/DenyStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: stages_deny_destroy + description: DenyStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Deny Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/deny/{stage_uuid}/used_by/: + get: + operationId: stages_deny_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Deny Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/dummy/: + get: + operationId: stages_dummy_list + description: DummyStage Viewset + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: stage_uuid + schema: + type: string + format: uuid + - in: query + name: throw_error + schema: + type: boolean + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedDummyStageList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: stages_dummy_create + description: DummyStage Viewset + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/DummyStageRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/DummyStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/dummy/{stage_uuid}/: + get: + operationId: stages_dummy_retrieve + description: DummyStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Dummy Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/DummyStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: stages_dummy_update + description: DummyStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Dummy Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/DummyStageRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/DummyStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: stages_dummy_partial_update + description: DummyStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Dummy Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedDummyStageRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/DummyStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: stages_dummy_destroy + description: DummyStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Dummy Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/dummy/{stage_uuid}/used_by/: + get: + operationId: stages_dummy_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Dummy Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/email/: + get: + operationId: stages_email_list + description: EmailStage Viewset + parameters: + - in: query + name: activate_user_on_success + schema: + type: boolean + - in: query + name: from_address + schema: + type: string + - in: query + name: host + schema: + type: string + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: port + schema: + type: integer + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: subject + schema: + type: string + - in: query + name: template + schema: + type: string + - in: query + name: timeout + schema: + type: integer + - in: query + name: token_expiry + schema: + type: string + - in: query + name: use_global_settings + schema: + type: boolean + - in: query + name: use_ssl + schema: + type: boolean + - in: query + name: use_tls + schema: + type: boolean + - in: query + name: username + schema: + type: string + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedEmailStageList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: stages_email_create + description: EmailStage Viewset + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/EmailStageRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/EmailStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/email/{stage_uuid}/: + get: + operationId: stages_email_retrieve + description: EmailStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Email Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/EmailStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: stages_email_update + description: EmailStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Email Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/EmailStageRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/EmailStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: stages_email_partial_update + description: EmailStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Email Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedEmailStageRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/EmailStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: stages_email_destroy + description: EmailStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Email Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/email/{stage_uuid}/used_by/: + get: + operationId: stages_email_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Email Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/email/templates/: + get: + operationId: stages_email_templates_list + description: Get all available templates, including custom templates + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/TypeCreate' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/endpoints/: + get: + operationId: stages_endpoints_list + description: EndpointStage Viewset + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedEndpointStageList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: stages_endpoints_create + description: EndpointStage Viewset + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/EndpointStageRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/EndpointStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/endpoints/{stage_uuid}/: + get: + operationId: stages_endpoints_retrieve + description: EndpointStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Endpoint Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/EndpointStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: stages_endpoints_update + description: EndpointStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Endpoint Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/EndpointStageRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/EndpointStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: stages_endpoints_partial_update + description: EndpointStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Endpoint Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedEndpointStageRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/EndpointStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: stages_endpoints_destroy + description: EndpointStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Endpoint Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/endpoints/{stage_uuid}/used_by/: + get: + operationId: stages_endpoints_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Endpoint Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/identification/: + get: + operationId: stages_identification_list + description: IdentificationStage Viewset + parameters: + - in: query + name: captcha_stage + schema: + type: string + format: uuid + - in: query + name: case_insensitive_matching + schema: + type: boolean + - in: query + name: enrollment_flow + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: password_stage + schema: + type: string + format: uuid + - in: query + name: passwordless_flow + schema: + type: string + format: uuid + - in: query + name: recovery_flow + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: show_matched_user + schema: + type: boolean + - in: query + name: show_source_labels + schema: + type: boolean + - in: query + name: webauthn_stage + schema: + type: string + format: uuid + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedIdentificationStageList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: stages_identification_create + description: IdentificationStage Viewset + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/IdentificationStageRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/IdentificationStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/identification/{stage_uuid}/: + get: + operationId: stages_identification_retrieve + description: IdentificationStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Identification Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/IdentificationStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: stages_identification_update + description: IdentificationStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Identification Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/IdentificationStageRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/IdentificationStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: stages_identification_partial_update + description: IdentificationStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Identification Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedIdentificationStageRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/IdentificationStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: stages_identification_destroy + description: IdentificationStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Identification Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/identification/{stage_uuid}/used_by/: + get: + operationId: stages_identification_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Identification Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/invitation/invitations/: + get: + operationId: stages_invitation_invitations_list + description: Invitation Viewset + parameters: + - in: query + name: created_by__username + schema: + type: string + - in: query + name: expires + schema: + type: string + format: date-time + - in: query + name: flow__slug + schema: + type: string + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedInvitationList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: stages_invitation_invitations_create + description: Invitation Viewset + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/InvitationRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/Invitation' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/invitation/invitations/{invite_uuid}/: + get: + operationId: stages_invitation_invitations_retrieve + description: Invitation Viewset + parameters: + - in: path + name: invite_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Invitation. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Invitation' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: stages_invitation_invitations_update + description: Invitation Viewset + parameters: + - in: path + name: invite_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Invitation. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/InvitationRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Invitation' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: stages_invitation_invitations_partial_update + description: Invitation Viewset + parameters: + - in: path + name: invite_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Invitation. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedInvitationRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Invitation' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: stages_invitation_invitations_destroy + description: Invitation Viewset + parameters: + - in: path + name: invite_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Invitation. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/invitation/invitations/{invite_uuid}/send_email/: + post: + operationId: stages_invitation_invitations_send_email_create + description: Send invitation link via email to one or more addresses + parameters: + - in: path + name: invite_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Invitation. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/InvitationSendEmailRequest' + required: true + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/invitation/invitations/{invite_uuid}/used_by/: + get: + operationId: stages_invitation_invitations_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: invite_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Invitation. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/invitation/stages/: + get: + operationId: stages_invitation_stages_list + description: InvitationStage Viewset + parameters: + - in: query + name: continue_flow_without_invitation + schema: + type: boolean + - $ref: '#/components/parameters/QueryName' + - in: query + name: no_flows + schema: + type: boolean + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: stage_uuid + schema: + type: string + format: uuid + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedInvitationStageList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: stages_invitation_stages_create + description: InvitationStage Viewset + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/InvitationStageRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/InvitationStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/invitation/stages/{stage_uuid}/: + get: + operationId: stages_invitation_stages_retrieve + description: InvitationStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Invitation Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/InvitationStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: stages_invitation_stages_update + description: InvitationStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Invitation Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/InvitationStageRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/InvitationStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: stages_invitation_stages_partial_update + description: InvitationStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Invitation Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedInvitationStageRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/InvitationStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: stages_invitation_stages_destroy + description: InvitationStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Invitation Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/invitation/stages/{stage_uuid}/used_by/: + get: + operationId: stages_invitation_stages_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Invitation Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/mtls/: + get: + operationId: stages_mtls_list + description: MutualTLSStage Viewset + parameters: + - in: query + name: cert_attribute + schema: + $ref: '#/components/schemas/CertAttributeEnum' + - in: query + name: certificate_authorities + schema: + type: array + items: + type: string + format: uuid + explode: true + style: form + - in: query + name: mode + schema: + $ref: '#/components/schemas/StageModeEnum' + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: stage_uuid + schema: + type: string + format: uuid + - in: query + name: user_attribute + schema: + $ref: '#/components/schemas/UserAttributeEnum' + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedMutualTLSStageList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: stages_mtls_create + description: MutualTLSStage Viewset + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/MutualTLSStageRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/MutualTLSStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/mtls/{stage_uuid}/: + get: + operationId: stages_mtls_retrieve + description: MutualTLSStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Mutual TLS Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/MutualTLSStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: stages_mtls_update + description: MutualTLSStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Mutual TLS Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/MutualTLSStageRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/MutualTLSStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: stages_mtls_partial_update + description: MutualTLSStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Mutual TLS Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedMutualTLSStageRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/MutualTLSStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: stages_mtls_destroy + description: MutualTLSStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Mutual TLS Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/mtls/{stage_uuid}/used_by/: + get: + operationId: stages_mtls_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Mutual TLS Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/password/: + get: + operationId: stages_password_list + description: PasswordStage Viewset + parameters: + - in: query + name: allow_show_password + schema: + type: boolean + - in: query + name: configure_flow + schema: + type: string + format: uuid + - in: query + name: failed_attempts_before_cancel + schema: + type: integer + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedPasswordStageList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: stages_password_create + description: PasswordStage Viewset + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PasswordStageRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/PasswordStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/password/{stage_uuid}/: + get: + operationId: stages_password_retrieve + description: PasswordStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Password Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PasswordStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: stages_password_update + description: PasswordStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Password Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PasswordStageRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PasswordStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: stages_password_partial_update + description: PasswordStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Password Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedPasswordStageRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PasswordStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: stages_password_destroy + description: PasswordStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Password Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/password/{stage_uuid}/used_by/: + get: + operationId: stages_password_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Password Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/prompt/prompts/: + get: + operationId: stages_prompt_prompts_list + description: Prompt Viewset + parameters: + - in: query + name: field_key + schema: + type: string + - in: query + name: label + schema: + type: string + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: placeholder + schema: + type: string + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: type + schema: + $ref: '#/components/schemas/PromptTypeEnum' + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedPromptList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: stages_prompt_prompts_create + description: Prompt Viewset + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PromptRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/Prompt' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/prompt/prompts/{prompt_uuid}/: + get: + operationId: stages_prompt_prompts_retrieve + description: Prompt Viewset + parameters: + - in: path + name: prompt_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Prompt. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Prompt' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: stages_prompt_prompts_update + description: Prompt Viewset + parameters: + - in: path + name: prompt_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Prompt. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PromptRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Prompt' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: stages_prompt_prompts_partial_update + description: Prompt Viewset + parameters: + - in: path + name: prompt_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Prompt. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedPromptRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Prompt' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: stages_prompt_prompts_destroy + description: Prompt Viewset + parameters: + - in: path + name: prompt_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Prompt. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/prompt/prompts/{prompt_uuid}/used_by/: + get: + operationId: stages_prompt_prompts_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: prompt_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Prompt. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/prompt/prompts/preview/: + post: + operationId: stages_prompt_prompts_preview_create + description: Preview a prompt as a challenge, just like a flow would receive + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PromptRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PromptChallenge' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/prompt/stages/: + get: + operationId: stages_prompt_stages_list + description: PromptStage Viewset + parameters: + - in: query + name: fields + schema: + type: array + items: + type: string + format: uuid + explode: true + style: form + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: stage_uuid + schema: + type: string + format: uuid + - in: query + name: validation_policies + schema: + type: array + items: + type: string + format: uuid + explode: true + style: form + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedPromptStageList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: stages_prompt_stages_create + description: PromptStage Viewset + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PromptStageRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/PromptStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/prompt/stages/{stage_uuid}/: + get: + operationId: stages_prompt_stages_retrieve + description: PromptStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Prompt Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PromptStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: stages_prompt_stages_update + description: PromptStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Prompt Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PromptStageRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PromptStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: stages_prompt_stages_partial_update + description: PromptStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Prompt Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedPromptStageRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PromptStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: stages_prompt_stages_destroy + description: PromptStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Prompt Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/prompt/stages/{stage_uuid}/used_by/: + get: + operationId: stages_prompt_stages_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Prompt Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/redirect/: + get: + operationId: stages_redirect_list + description: RedirectStage Viewset + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedRedirectStageList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: stages_redirect_create + description: RedirectStage Viewset + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/RedirectStageRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/RedirectStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/redirect/{stage_uuid}/: + get: + operationId: stages_redirect_retrieve + description: RedirectStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Redirect Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/RedirectStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: stages_redirect_update + description: RedirectStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Redirect Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/RedirectStageRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/RedirectStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: stages_redirect_partial_update + description: RedirectStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Redirect Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedRedirectStageRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/RedirectStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: stages_redirect_destroy + description: RedirectStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Redirect Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/redirect/{stage_uuid}/used_by/: + get: + operationId: stages_redirect_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Redirect Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/source/: + get: + operationId: stages_source_list + description: SourceStage Viewset + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: resume_timeout + schema: + type: string + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: source + schema: + type: string + format: uuid + - in: query + name: stage_uuid + schema: + type: string + format: uuid + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedSourceStageList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: stages_source_create + description: SourceStage Viewset + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SourceStageRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/SourceStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/source/{stage_uuid}/: + get: + operationId: stages_source_retrieve + description: SourceStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Source Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SourceStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: stages_source_update + description: SourceStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Source Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/SourceStageRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SourceStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: stages_source_partial_update + description: SourceStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Source Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedSourceStageRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/SourceStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: stages_source_destroy + description: SourceStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Source Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/source/{stage_uuid}/used_by/: + get: + operationId: stages_source_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this Source Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/user_delete/: + get: + operationId: stages_user_delete_list + description: UserDeleteStage Viewset + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: stage_uuid + schema: + type: string + format: uuid + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedUserDeleteStageList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: stages_user_delete_create + description: UserDeleteStage Viewset + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserDeleteStageRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/UserDeleteStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/user_delete/{stage_uuid}/: + get: + operationId: stages_user_delete_retrieve + description: UserDeleteStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this User Delete Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserDeleteStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: stages_user_delete_update + description: UserDeleteStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this User Delete Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserDeleteStageRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserDeleteStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: stages_user_delete_partial_update + description: UserDeleteStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this User Delete Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedUserDeleteStageRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserDeleteStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: stages_user_delete_destroy + description: UserDeleteStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this User Delete Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/user_delete/{stage_uuid}/used_by/: + get: + operationId: stages_user_delete_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this User Delete Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/user_login/: + get: + operationId: stages_user_login_list + description: UserLoginStage Viewset + parameters: + - in: query + name: geoip_binding + schema: + allOf: + - $ref: '#/components/schemas/GeoipBindingEnum' + description: |+ + Bind sessions created by this stage to the configured GeoIP location + + - $ref: '#/components/parameters/QueryName' + - in: query + name: network_binding + schema: + allOf: + - $ref: '#/components/schemas/NetworkBindingEnum' + description: |+ + Bind sessions created by this stage to the configured network + + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: remember_device + schema: + type: string + - in: query + name: remember_me_offset + schema: + type: string + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: session_duration + schema: + type: string + - in: query + name: stage_uuid + schema: + type: string + format: uuid + - in: query + name: terminate_other_sessions + schema: + type: boolean + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedUserLoginStageList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: stages_user_login_create + description: UserLoginStage Viewset + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserLoginStageRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/UserLoginStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/user_login/{stage_uuid}/: + get: + operationId: stages_user_login_retrieve + description: UserLoginStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this User Login Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserLoginStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: stages_user_login_update + description: UserLoginStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this User Login Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserLoginStageRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserLoginStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: stages_user_login_partial_update + description: UserLoginStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this User Login Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedUserLoginStageRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserLoginStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: stages_user_login_destroy + description: UserLoginStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this User Login Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/user_login/{stage_uuid}/used_by/: + get: + operationId: stages_user_login_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this User Login Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/user_logout/: + get: + operationId: stages_user_logout_list + description: UserLogoutStage Viewset + parameters: + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: stage_uuid + schema: + type: string + format: uuid + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedUserLogoutStageList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: stages_user_logout_create + description: UserLogoutStage Viewset + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserLogoutStageRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/UserLogoutStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/user_logout/{stage_uuid}/: + get: + operationId: stages_user_logout_retrieve + description: UserLogoutStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this User Logout Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserLogoutStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: stages_user_logout_update + description: UserLogoutStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this User Logout Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserLogoutStageRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserLogoutStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: stages_user_logout_partial_update + description: UserLogoutStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this User Logout Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedUserLogoutStageRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserLogoutStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: stages_user_logout_destroy + description: UserLogoutStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this User Logout Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/user_logout/{stage_uuid}/used_by/: + get: + operationId: stages_user_logout_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this User Logout Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/user_write/: + get: + operationId: stages_user_write_list + description: UserWriteStage Viewset + parameters: + - in: query + name: create_users_as_inactive + schema: + type: boolean + - in: query + name: create_users_group + schema: + type: string + format: uuid + - $ref: '#/components/parameters/QueryName' + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: stage_uuid + schema: + type: string + format: uuid + - in: query + name: user_creation_mode + schema: + $ref: '#/components/schemas/UserCreationModeEnum' + - in: query + name: user_path_template + schema: + type: string + - in: query + name: user_type + schema: + $ref: '#/components/schemas/UserTypeEnum' + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedUserWriteStageList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + post: + operationId: stages_user_write_create + description: UserWriteStage Viewset + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserWriteStageRequest' + required: true + security: + - authentik: [] + responses: + '201': + content: + application/json: + schema: + $ref: '#/components/schemas/UserWriteStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/user_write/{stage_uuid}/: + get: + operationId: stages_user_write_retrieve + description: UserWriteStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this User Write Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserWriteStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: stages_user_write_update + description: UserWriteStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this User Write Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/UserWriteStageRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserWriteStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: stages_user_write_partial_update + description: UserWriteStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this User Write Stage. + required: true + tags: + - stages + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedUserWriteStageRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/UserWriteStage' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + delete: + operationId: stages_user_write_destroy + description: UserWriteStage Viewset + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this User Write Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '204': + description: No response body + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /stages/user_write/{stage_uuid}/used_by/: + get: + operationId: stages_user_write_used_by_list + description: Get a list of all objects that use this object + parameters: + - in: path + name: stage_uuid + schema: + type: string + format: uuid + description: A UUID string identifying this User Write Stage. + required: true + tags: + - stages + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/UsedBy' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /tasks/schedules/: + get: + operationId: tasks_schedules_list + parameters: + - in: query + name: actor_name + schema: + type: string + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: paused + schema: + type: boolean + - in: query + name: rel_obj_content_type__app_label + schema: + type: string + - in: query + name: rel_obj_content_type__model + schema: + type: string + - in: query + name: rel_obj_id + schema: + type: string + - in: query + name: rel_obj_id__isnull + schema: + type: boolean + - $ref: '#/components/parameters/QuerySearch' + tags: + - tasks + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedScheduleList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /tasks/schedules/{id}/: + get: + operationId: tasks_schedules_retrieve + parameters: + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this Schedule. + required: true + tags: + - tasks + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Schedule' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + put: + operationId: tasks_schedules_update + parameters: + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this Schedule. + required: true + tags: + - tasks + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/ScheduleRequest' + required: true + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Schedule' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + patch: + operationId: tasks_schedules_partial_update + parameters: + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this Schedule. + required: true + tags: + - tasks + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/PatchedScheduleRequest' + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Schedule' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /tasks/schedules/{id}/send/: + post: + operationId: tasks_schedules_send_create + description: Trigger this schedule now + parameters: + - in: path + name: id + schema: + type: string + format: uuid + description: A UUID string identifying this Schedule. + required: true + tags: + - tasks + security: + - authentik: [] + responses: + '204': + description: Schedule sent successfully + '404': + description: Schedule not found + '500': + description: Failed to send schedule + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /tasks/tasks/: + get: + operationId: tasks_tasks_list + parameters: + - in: query + name: actor_name + schema: + type: string + - in: query + name: aggregated_status + schema: + type: array + items: + $ref: '#/components/schemas/TaskAggregatedStatusEnum' + explode: true + style: form + - $ref: '#/components/parameters/QueryPaginationOrdering' + - $ref: '#/components/parameters/QueryPaginationPage' + - $ref: '#/components/parameters/QueryPaginationPageSize' + - in: query + name: queue_name + schema: + type: string + - in: query + name: rel_obj_content_type__app_label + schema: + type: string + - in: query + name: rel_obj_content_type__model + schema: + type: string + - in: query + name: rel_obj_id + schema: + type: string + - in: query + name: rel_obj_id__isnull + schema: + type: boolean + - $ref: '#/components/parameters/QuerySearch' + - in: query + name: state + schema: + allOf: + - $ref: '#/components/schemas/TaskStatusEnum' + description: |+ + Task status + + tags: + - tasks + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/PaginatedTaskList' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /tasks/tasks/{message_id}/: + get: + operationId: tasks_tasks_retrieve + parameters: + - in: path + name: message_id + schema: + type: string + format: uuid + description: A UUID string identifying this Task. + required: true + tags: + - tasks + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/Task' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /tasks/tasks/{message_id}/retry/: + post: + operationId: tasks_tasks_retry_create + description: Retry task + parameters: + - in: path + name: message_id + schema: + type: string + format: uuid + description: A UUID string identifying this Task. + required: true + tags: + - tasks + security: + - authentik: [] + responses: + '204': + description: Task retried successfully + '400': + description: Task is not in a retryable state + '404': + description: Task not found + '403': + $ref: '#/components/responses/GenericErrorResponse' + /tasks/tasks/status/: + get: + operationId: tasks_tasks_status_retrieve + description: Global status summary for all tasks + tags: + - tasks + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + $ref: '#/components/schemas/GlobalTaskStatus' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' + /tasks/workers/: + get: + operationId: tasks_workers_list + description: Get currently connected worker count. + tags: + - tasks + security: + - authentik: [] + responses: + '200': + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/Worker' + description: '' + '400': + $ref: '#/components/responses/ValidationErrorResponse' + '403': + $ref: '#/components/responses/GenericErrorResponse' +components: + parameters: + QueryName: + in: query + name: name + schema: + type: string + QueryPaginationOrdering: + in: query + name: ordering + schema: + type: string + description: Which field to use when ordering the results. + QueryPaginationPage: + in: query + name: page + schema: + type: integer + description: A page number within the paginated result set. + QueryPaginationPageSize: + in: query + name: page_size + schema: + type: integer + description: Number of results to return per page. + QuerySearch: + in: query + name: search + schema: + type: string + description: A search term. + responses: + GenericErrorResponse: + content: + application/json: + schema: + $ref: '#/components/schemas/GenericError' + description: '' + ValidationErrorResponse: + content: + application/json: + schema: + $ref: '#/components/schemas/ValidationError' + description: '' + schemas: + AccessDeniedChallenge: + type: object + description: Challenge when a flow's active stage calls `stage_invalid()`. + properties: + flow_info: + $ref: '#/components/schemas/ContextualFlowInfo' + component: + type: string + default: ak-stage-access-denied + response_errors: + type: object + additionalProperties: + type: array + items: + $ref: '#/components/schemas/ErrorDetail' + pending_user: + type: string + pending_user_avatar: + type: string + error_message: + type: string + required: + - pending_user + - pending_user_avatar + AccountLockdownStage: + type: object + description: AccountLockdownStage Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Stage uuid + name: + type: string + component: + type: string + description: Get object type so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + flow_set: + type: array + items: + $ref: '#/components/schemas/FlowSet' + readOnly: true + deactivate_user: + type: boolean + description: Deactivate the user account (set is_active to False) + set_unusable_password: + type: boolean + description: Set an unusable password for the user + delete_sessions: + type: boolean + description: Delete all active sessions for the user + revoke_tokens: + type: boolean + description: Revoke all tokens for the user (API, app password, recovery, + verification, OAuth) + self_service_completion_flow: + type: string + format: uuid + nullable: true + description: Flow to redirect users to after self-service lockdown. This + flow should not require authentication since the user's session is deleted. + required: + - component + - flow_set + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + AccountLockdownStageRequest: + type: object + description: AccountLockdownStage Serializer + properties: + name: + type: string + minLength: 1 + deactivate_user: + type: boolean + description: Deactivate the user account (set is_active to False) + set_unusable_password: + type: boolean + description: Set an unusable password for the user + delete_sessions: + type: boolean + description: Delete all active sessions for the user + revoke_tokens: + type: boolean + description: Revoke all tokens for the user (API, app password, recovery, + verification, OAuth) + self_service_completion_flow: + type: string + format: uuid + nullable: true + description: Flow to redirect users to after self-service lockdown. This + flow should not require authentication since the user's session is deleted. + required: + - name + Agent: + type: object + description: |- + Mixin to validate that a valid enterprise license + exists before allowing to save the object + properties: + pk: + type: integer + readOnly: true + title: ID + username: + type: string + description: Required. 150 characters or fewer. Letters, digits and @/./+/-/_ + only. + pattern: ^[\w.@+-]+$ + maxLength: 150 + name: + type: string + description: User's display name. + is_active: + type: boolean + title: Active + description: Designates whether this user should be treated as active. Unselect + this instead of deleting accounts. + last_login: + type: string + format: date-time + nullable: true + email: + type: string + format: email + title: Email address + maxLength: 254 + attributes: + type: object + additionalProperties: {} + uid: + type: string + readOnly: true + uuid: + type: string + format: uuid + readOnly: true + expiring: + type: boolean + expires: + type: string + format: date-time + nullable: true + parent: + allOf: + - $ref: '#/components/schemas/PartialUser' + readOnly: true + policy_behavior: + allOf: + - $ref: '#/components/schemas/PolicyBehaviorEnum' + readOnly: true + token_identifier: + type: string + nullable: true + description: Identifier of the agent's API token, so its key can be retrieved/copied + later. + readOnly: true + required: + - name + - parent + - pk + - policy_behavior + - token_identifier + - uid + - username + - uuid + AgentAuthenticationResponse: + type: object + description: Base serializer class which doesn't implement create/update methods + properties: + url: + type: string + required: + - url + AgentConfig: + type: object + description: Base serializer class which doesn't implement create/update methods + properties: + device_id: + type: string + readOnly: true + refresh_interval: + type: integer + readOnly: true + authorization_flow: + type: string + nullable: true + readOnly: true + jwks_auth: + type: object + additionalProperties: {} + readOnly: true + jwks_challenge: + type: object + additionalProperties: {} + nullable: true + readOnly: true + nss_uid_offset: + type: integer + nss_gid_offset: + type: integer + auth_terminate_session_on_expiry: + type: boolean + system_config: + allOf: + - $ref: '#/components/schemas/Config' + readOnly: true + license_status: + allOf: + - $ref: '#/components/schemas/LicenseStatusEnum' + readOnly: true + nullable: true + required: + - auth_terminate_session_on_expiry + - authorization_flow + - device_id + - jwks_auth + - jwks_challenge + - license_status + - nss_gid_offset + - nss_uid_offset + - refresh_interval + - system_config + AgentConnector: + type: object + properties: + connector_uuid: + type: string + format: uuid + name: + type: string + enabled: + type: boolean + component: + type: string + description: Get object component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + snapshot_expiry: + type: string + auth_session_duration: + type: string + auth_terminate_session_on_expiry: + type: boolean + refresh_interval: + type: string + authorization_flow: + type: string + format: uuid + nullable: true + nss_uid_offset: + type: integer + maximum: 2147483647 + minimum: 0 + nss_gid_offset: + type: integer + maximum: 2147483647 + minimum: 0 + challenge_key: + type: string + format: uuid + nullable: true + challenge_idle_timeout: + type: string + challenge_trigger_check_in: + type: boolean + jwt_federation_providers: + type: array + items: + type: integer + required: + - component + - meta_model_name + - name + - verbose_name + - verbose_name_plural + AgentConnectorRequest: + type: object + properties: + connector_uuid: + type: string + format: uuid + name: + type: string + minLength: 1 + enabled: + type: boolean + snapshot_expiry: + type: string + minLength: 1 + auth_session_duration: + type: string + minLength: 1 + auth_terminate_session_on_expiry: + type: boolean + refresh_interval: + type: string + minLength: 1 + authorization_flow: + type: string + format: uuid + nullable: true + nss_uid_offset: + type: integer + maximum: 2147483647 + minimum: 0 + nss_gid_offset: + type: integer + maximum: 2147483647 + minimum: 0 + challenge_key: + type: string + format: uuid + nullable: true + challenge_idle_timeout: + type: string + minLength: 1 + challenge_trigger_check_in: + type: boolean + jwt_federation_providers: + type: array + items: + type: integer + required: + - name + AgentCreateRequest: + type: object + description: Base serializer class which doesn't implement create/update methods + properties: + parent: + type: integer + label: + type: string + expiring: + type: boolean + default: false + expires: + type: string + format: date-time + nullable: true + policy_behavior: + allOf: + - $ref: '#/components/schemas/PolicyBehaviorEnum' + default: mirror + AgentCreated: + type: object + description: Response returned once when an agent is created, carrying the one-time + API token. + properties: + agent: + allOf: + - $ref: '#/components/schemas/Agent' + readOnly: true + token: + type: string + readOnly: true + required: + - agent + - token + AgentGrantRequestCreateRequest: + type: object + description: |- + Body for an agent requesting access for itself. Deliberately narrower than + `GrantRequestCreateSerializer`: an agent may not pick its own expiry, which is + derived from the granting rules and capped by the agent's own lifetime. + properties: + pbms: + type: array + items: + type: string + format: uuid + required: + - pbms + AgentGrantRequestCreated: + type: object + description: |- + Response to an agent's access request: the request it created, plus the URL to hand to + the human it acts for. An agent has no browser, so it cannot run the approval itself -- + `fulfill_url` is what its owner opens to approve or deny. + properties: + grant_request: + allOf: + - $ref: '#/components/schemas/GrantRequest' + readOnly: true + fulfill_url: + type: string + readOnly: true + required: + - fulfill_url + - grant_request + AgentPSSODeviceRegistrationRequest: + type: object + description: Register Apple device via Platform SSO + properties: + device_signing_key: + type: string + minLength: 1 + device_encryption_key: + type: string + minLength: 1 + sign_key_id: + type: string + minLength: 1 + enc_key_id: + type: string + minLength: 1 + required: + - device_encryption_key + - device_signing_key + - enc_key_id + - sign_key_id + AgentPSSODeviceRegistrationResponse: + type: object + description: authentik settings for Platform SSO tokens + properties: + client_id: + type: string + issuer: + type: string + token_endpoint: + type: string + jwks_endpoint: + type: string + audience: + type: string + nonce_endpoint: + type: string + required: + - audience + - client_id + - issuer + - jwks_endpoint + - nonce_endpoint + - token_endpoint + AgentPSSOUserRegistrationRequest: + type: object + description: Register Apple device user via Platform SSO + properties: + user_auth: + type: string + minLength: 1 + user_secure_enclave_key: + type: string + minLength: 1 + enclave_key_id: + type: string + minLength: 1 + required: + - enclave_key_id + - user_auth + - user_secure_enclave_key + AgentRequest: + type: object + description: |- + Mixin to validate that a valid enterprise license + exists before allowing to save the object + properties: + username: + type: string + minLength: 1 + description: Required. 150 characters or fewer. Letters, digits and @/./+/-/_ + only. + pattern: ^[\w.@+-]+$ + maxLength: 150 + name: + type: string + minLength: 1 + description: User's display name. + is_active: + type: boolean + title: Active + description: Designates whether this user should be treated as active. Unselect + this instead of deleting accounts. + last_login: + type: string + format: date-time + nullable: true + email: + type: string + format: email + title: Email address + maxLength: 254 + attributes: + type: object + additionalProperties: {} + expiring: + type: boolean + expires: + type: string + format: date-time + nullable: true + required: + - name + - username + AgentTokenResponse: + type: object + description: Base serializer class which doesn't implement create/update methods + properties: + token: + type: string + expires_in: + type: integer + required: + - token + AlgEnum: + enum: + - rsa + - ecdsa + - ed25519 + - ed448 + type: string + App: + type: object + description: Serialize Application info + properties: + name: + type: string + label: + type: string + required: + - label + - name + AppEnum: + enum: + - authentik.commands + - authentik.tenants + - authentik.tasks + - authentik.admin + - authentik.api + - authentik.core + - authentik.crypto + - authentik.endpoints + - authentik.endpoints.connectors.agent + - authentik.enterprise + - authentik.events + - authentik.admin.files + - authentik.flows + - authentik.outposts + - authentik.policies.dummy + - authentik.policies.event_matcher + - authentik.policies.expiry + - authentik.policies.expression + - authentik.policies.geoip + - authentik.policies.password + - authentik.policies.reputation + - authentik.policies + - authentik.providers.ldap + - authentik.providers.oauth2 + - authentik.providers.proxy + - authentik.providers.rac + - authentik.providers.radius + - authentik.providers.saml + - authentik.providers.scim + - authentik.rbac + - authentik.recovery + - authentik.sources.kerberos + - authentik.sources.ldap + - authentik.sources.oauth + - authentik.sources.plex + - authentik.sources.saml + - authentik.sources.scim + - authentik.sources.telegram + - authentik.stages.authenticator + - authentik.stages.authenticator_duo + - authentik.stages.authenticator_email + - authentik.stages.authenticator_sms + - authentik.stages.authenticator_static + - authentik.stages.authenticator_totp + - authentik.stages.authenticator_validate + - authentik.stages.authenticator_webauthn + - authentik.stages.captcha + - authentik.stages.consent + - authentik.stages.deny + - authentik.stages.dummy + - authentik.stages.email + - authentik.stages.identification + - authentik.stages.invitation + - authentik.stages.password + - authentik.stages.prompt + - authentik.stages.redirect + - authentik.stages.user_delete + - authentik.stages.user_login + - authentik.stages.user_logout + - authentik.stages.user_write + - authentik.tasks.schedules + - authentik.brands + - authentik.blueprints + - authentik.enterprise.agents + - authentik.enterprise.audit + - authentik.enterprise.endpoints.connectors.agent + - authentik.enterprise.endpoints.connectors.fleet + - authentik.enterprise.endpoints.connectors.google_chrome + - authentik.enterprise.lifecycle + - authentik.enterprise.policies.unique_password + - authentik.enterprise.providers.google_workspace + - authentik.enterprise.providers.microsoft_entra + - authentik.enterprise.providers.radius + - authentik.enterprise.providers.scim + - authentik.enterprise.providers.ssf + - authentik.enterprise.providers.ws_federation + - authentik.enterprise.reports + - authentik.enterprise.requests + - authentik.enterprise.stages.account_lockdown + - authentik.enterprise.stages.authenticator_endpoint_gdtc + - authentik.enterprise.stages.mtls + - authentik.enterprise.stages.source + type: string + AppleChallengeResponseRequest: + type: object + description: Pseudo class for apple response + properties: + component: + type: string + minLength: 1 + default: ak-source-oauth-apple + AppleIndependentSecureEnclave: + type: object + properties: + uuid: + type: string + format: uuid + user: + type: integer + description: The user that this device belongs to. + apple_secure_enclave_key: + type: string + apple_enclave_key_id: + type: string + device_type: + type: string + required: + - apple_enclave_key_id + - apple_secure_enclave_key + - device_type + - user + AppleIndependentSecureEnclaveRequest: + type: object + properties: + uuid: + type: string + format: uuid + user: + type: integer + description: The user that this device belongs to. + apple_secure_enclave_key: + type: string + minLength: 1 + apple_enclave_key_id: + type: string + minLength: 1 + device_type: + type: string + minLength: 1 + required: + - apple_enclave_key_id + - apple_secure_enclave_key + - device_type + - user + AppleLoginChallenge: + type: object + description: Special challenge for apple-native authentication flow, which happens + on the client. + properties: + flow_info: + $ref: '#/components/schemas/ContextualFlowInfo' + component: + type: string + default: ak-source-oauth-apple + response_errors: + type: object + additionalProperties: + type: array + items: + $ref: '#/components/schemas/ErrorDetail' + client_id: + type: string + scope: + type: string + redirect_uri: + type: string + state: + type: string + required: + - client_id + - redirect_uri + - scope + - state + Application: + type: object + description: Application Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Pbm uuid + pbm_uuid: + type: string + format: uuid + readOnly: true + name: + type: string + description: Application's display Name. + slug: + type: string + description: Internal application name, used in URLs. + pattern: ^[-a-zA-Z0-9_]+$ + provider: + type: integer + nullable: true + provider_obj: + allOf: + - $ref: '#/components/schemas/Provider' + readOnly: true + nullable: true + backchannel_providers: + type: array + items: + type: integer + backchannel_providers_obj: + type: array + items: + $ref: '#/components/schemas/Provider' + readOnly: true + launch_url: + type: string + nullable: true + description: Allow formatting of launch URL + readOnly: true + open_in_new_tab: + type: boolean + description: Open launch URL in a new browser tab or window. + meta_launch_url: + type: string + format: uri + meta_icon: + type: string + meta_icon_url: + type: string + nullable: true + description: Get the URL to the App Icon image + readOnly: true + meta_icon_themed_urls: + allOf: + - $ref: '#/components/schemas/ThemedUrls' + readOnly: true + nullable: true + meta_description: + type: string + meta_publisher: + type: string + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + group: + type: string + meta_hide: + type: boolean + description: Hide this application from the user's My applications page. + required: + - backchannel_providers_obj + - launch_url + - meta_icon_themed_urls + - meta_icon_url + - name + - pbm_uuid + - pk + - provider_obj + - slug + ApplicationEntitlement: + type: object + description: ApplicationEntitlement Serializer + properties: + pbm_uuid: + type: string + format: uuid + readOnly: true + name: + type: string + app: + type: string + format: uuid + attributes: + type: object + additionalProperties: {} + required: + - app + - name + - pbm_uuid + ApplicationEntitlementRequest: + type: object + description: ApplicationEntitlement Serializer + properties: + name: + type: string + minLength: 1 + app: + type: string + format: uuid + attributes: + type: object + additionalProperties: {} + required: + - app + - name + ApplicationRequest: + type: object + description: Application Serializer + properties: + name: + type: string + minLength: 1 + description: Application's display Name. + slug: + type: string + minLength: 1 + description: Internal application name, used in URLs. + pattern: ^[-a-zA-Z0-9_]+$ + provider: + type: integer + nullable: true + backchannel_providers: + type: array + items: + type: integer + open_in_new_tab: + type: boolean + description: Open launch URL in a new browser tab or window. + meta_launch_url: + type: string + format: uri + meta_icon: + type: string + meta_description: + type: string + meta_publisher: + type: string + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + group: + type: string + meta_hide: + type: boolean + description: Hide this application from the user's My applications page. + required: + - name + - slug + AuthTypeEnum: + enum: + - basic + - bearer + type: string + AuthenticatedSession: + type: object + description: AuthenticatedSession Serializer + properties: + uuid: + type: string + format: uuid + current: + type: boolean + description: Check if session is currently active session + readOnly: true + user_agent: + type: object + description: Get parsed user agent + properties: + device: + type: object + description: User agent device + properties: + brand: + type: string + nullable: true + family: + type: string + model: + type: string + nullable: true + required: + - brand + - family + - model + os: + type: object + description: User agent os + properties: + family: + type: string + major: + type: string + nullable: true + minor: + type: string + nullable: true + patch: + type: string + nullable: true + patch_minor: + type: string + nullable: true + required: + - family + - major + - minor + - patch + - patch_minor + user_agent: + type: object + description: User agent browser + properties: + family: + type: string + major: + type: string + minor: + type: string + patch: + type: string + required: + - family + - major + - minor + - patch + string: + type: string + required: + - device + - os + - string + - user_agent + readOnly: true + geo_ip: + type: object + description: Get GeoIP Data + properties: + continent: + type: string + nullable: true + country: + type: string + nullable: true + lat: + type: number + format: double + nullable: true + long: + type: number + format: double + nullable: true + city: + type: string + required: + - city + - continent + - country + - lat + - long + nullable: true + readOnly: true + asn: + type: object + description: Get ASN Data + properties: + asn: + type: integer + nullable: true + as_org: + type: string + nullable: true + network: + type: string + nullable: true + required: + - as_org + - asn + - network + nullable: true + readOnly: true + user: + type: integer + last_ip: + type: string + readOnly: true + last_user_agent: + type: string + readOnly: true + last_used: + type: string + format: date-time + readOnly: true + expires: + type: string + format: date-time + readOnly: true + required: + - asn + - current + - expires + - geo_ip + - last_ip + - last_used + - last_user_agent + - user + - user_agent + AuthenticationEnum: + enum: + - none + - require_authenticated + - require_unauthenticated + - require_superuser + - require_redirect + - require_outpost + - require_token + type: string + AuthenticatorAttachmentEnum: + enum: + - platform + - cross-platform + type: string + AuthenticatorDuoChallenge: + type: object + description: Duo Challenge + properties: + flow_info: + $ref: '#/components/schemas/ContextualFlowInfo' + component: + type: string + default: ak-stage-authenticator-duo + response_errors: + type: object + additionalProperties: + type: array + items: + $ref: '#/components/schemas/ErrorDetail' + pending_user: + type: string + pending_user_avatar: + type: string + activation_barcode: + type: string + activation_code: + type: string + stage_uuid: + type: string + required: + - activation_barcode + - activation_code + - pending_user + - pending_user_avatar + - stage_uuid + AuthenticatorDuoChallengeResponseRequest: + type: object + description: Pseudo class for duo response + properties: + component: + type: string + minLength: 1 + default: ak-stage-authenticator-duo + AuthenticatorDuoStage: + type: object + description: AuthenticatorDuoStage Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Stage uuid + name: + type: string + component: + type: string + description: Get object type so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + flow_set: + type: array + items: + $ref: '#/components/schemas/FlowSet' + readOnly: true + configure_flow: + type: string + format: uuid + nullable: true + description: Flow used by an authenticated user to configure this Stage. + If empty, user will not be able to configure this stage. + friendly_name: + type: string + client_id: + type: string + api_hostname: + type: string + admin_integration_key: + type: string + required: + - api_hostname + - client_id + - component + - flow_set + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + AuthenticatorDuoStageDeviceImportResponse: + type: object + properties: + count: + type: integer + readOnly: true + error: + type: string + readOnly: true + required: + - count + - error + AuthenticatorDuoStageManualDeviceImportRequest: + type: object + properties: + duo_user_id: + type: string + minLength: 1 + username: + type: string + minLength: 1 + required: + - duo_user_id + - username + AuthenticatorDuoStageRequest: + type: object + description: AuthenticatorDuoStage Serializer + properties: + name: + type: string + minLength: 1 + configure_flow: + type: string + format: uuid + nullable: true + description: Flow used by an authenticated user to configure this Stage. + If empty, user will not be able to configure this stage. + friendly_name: + type: string + client_id: + type: string + minLength: 1 + client_secret: + type: string + writeOnly: true + minLength: 1 + api_hostname: + type: string + minLength: 1 + admin_integration_key: + type: string + admin_secret_key: + type: string + writeOnly: true + required: + - api_hostname + - client_id + - client_secret + - name + AuthenticatorEmailChallenge: + type: object + description: Authenticator Email Setup challenge + properties: + flow_info: + $ref: '#/components/schemas/ContextualFlowInfo' + component: + type: string + default: ak-stage-authenticator-email + response_errors: + type: object + additionalProperties: + type: array + items: + $ref: '#/components/schemas/ErrorDetail' + pending_user: + type: string + pending_user_avatar: + type: string + email: + type: string + nullable: true + email_required: + type: boolean + default: true + required: + - pending_user + - pending_user_avatar + AuthenticatorEmailChallengeResponseRequest: + type: object + description: Authenticator Email Challenge response, device is set by get_response_instance + properties: + component: + type: string + minLength: 1 + default: ak-stage-authenticator-email + code: + type: string + minLength: 1 + email: + type: string + minLength: 1 + AuthenticatorEmailStage: + type: object + description: AuthenticatorEmailStage Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Stage uuid + name: + type: string + component: + type: string + description: Get object type so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + flow_set: + type: array + items: + $ref: '#/components/schemas/FlowSet' + readOnly: true + configure_flow: + type: string + format: uuid + nullable: true + description: Flow used by an authenticated user to configure this Stage. + If empty, user will not be able to configure this stage. + friendly_name: + type: string + use_global_settings: + type: boolean + description: When enabled, global Email connection settings will be used + and connection settings below will be ignored. + host: + type: string + port: + type: integer + maximum: 2147483647 + minimum: -2147483648 + username: + type: string + use_tls: + type: boolean + use_ssl: + type: boolean + timeout: + type: integer + maximum: 2147483647 + minimum: -2147483648 + from_address: + type: string + format: email + maxLength: 254 + subject: + type: string + token_expiry: + type: string + description: 'Time the token sent is valid (Format: hours=3,minutes=17,seconds=300).' + template: + type: string + required: + - component + - flow_set + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + AuthenticatorEmailStageRequest: + type: object + description: AuthenticatorEmailStage Serializer + properties: + name: + type: string + minLength: 1 + configure_flow: + type: string + format: uuid + nullable: true + description: Flow used by an authenticated user to configure this Stage. + If empty, user will not be able to configure this stage. + friendly_name: + type: string + use_global_settings: + type: boolean + description: When enabled, global Email connection settings will be used + and connection settings below will be ignored. + host: + type: string + minLength: 1 + port: + type: integer + maximum: 2147483647 + minimum: -2147483648 + username: + type: string + password: + type: string + writeOnly: true + use_tls: + type: boolean + use_ssl: + type: boolean + timeout: + type: integer + maximum: 2147483647 + minimum: -2147483648 + from_address: + type: string + format: email + minLength: 1 + maxLength: 254 + subject: + type: string + minLength: 1 + token_expiry: + type: string + minLength: 1 + description: 'Time the token sent is valid (Format: hours=3,minutes=17,seconds=300).' + template: + type: string + minLength: 1 + required: + - name + AuthenticatorEndpointGDTCStage: + type: object + description: AuthenticatorEndpointGDTCStage Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Stage uuid + name: + type: string + component: + type: string + description: Get object type so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + flow_set: + type: array + items: + $ref: '#/components/schemas/FlowSet' + readOnly: true + configure_flow: + type: string + format: uuid + nullable: true + description: Flow used by an authenticated user to configure this Stage. + If empty, user will not be able to configure this stage. + friendly_name: + type: string + credentials: + type: object + additionalProperties: {} + required: + - component + - credentials + - flow_set + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + AuthenticatorEndpointGDTCStageRequest: + type: object + description: AuthenticatorEndpointGDTCStage Serializer + properties: + name: + type: string + minLength: 1 + configure_flow: + type: string + format: uuid + nullable: true + description: Flow used by an authenticated user to configure this Stage. + If empty, user will not be able to configure this stage. + friendly_name: + type: string + credentials: + type: object + additionalProperties: {} + required: + - credentials + - name + AuthenticatorSMSChallenge: + type: object + description: SMS Setup challenge + properties: + flow_info: + $ref: '#/components/schemas/ContextualFlowInfo' + component: + type: string + default: ak-stage-authenticator-sms + response_errors: + type: object + additionalProperties: + type: array + items: + $ref: '#/components/schemas/ErrorDetail' + pending_user: + type: string + pending_user_avatar: + type: string + phone_number_required: + type: boolean + default: true + required: + - pending_user + - pending_user_avatar + AuthenticatorSMSChallengeResponseRequest: + type: object + description: SMS Challenge response, device is set by get_response_instance + properties: + component: + type: string + minLength: 1 + default: ak-stage-authenticator-sms + code: + type: string + minLength: 1 + phone_number: + type: string + minLength: 1 + AuthenticatorSMSStage: + type: object + description: AuthenticatorSMSStage Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Stage uuid + name: + type: string + component: + type: string + description: Get object type so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + flow_set: + type: array + items: + $ref: '#/components/schemas/FlowSet' + readOnly: true + configure_flow: + type: string + format: uuid + nullable: true + description: Flow used by an authenticated user to configure this Stage. + If empty, user will not be able to configure this stage. + friendly_name: + type: string + provider: + $ref: '#/components/schemas/ProviderEnum' + from_number: + type: string + account_sid: + type: string + auth_type: + $ref: '#/components/schemas/AuthTypeEnum' + verify_only: + type: boolean + description: When enabled, the Phone number is only used during enrollment + to verify the users authenticity. Only a hash of the phone number is saved + to ensure it is not reused in the future. + mapping: + type: string + format: uuid + nullable: true + description: Optionally modify the payload being sent to custom providers. + required: + - account_sid + - component + - flow_set + - from_number + - meta_model_name + - name + - pk + - provider + - verbose_name + - verbose_name_plural + AuthenticatorSMSStageRequest: + type: object + description: AuthenticatorSMSStage Serializer + properties: + name: + type: string + minLength: 1 + configure_flow: + type: string + format: uuid + nullable: true + description: Flow used by an authenticated user to configure this Stage. + If empty, user will not be able to configure this stage. + friendly_name: + type: string + provider: + $ref: '#/components/schemas/ProviderEnum' + from_number: + type: string + minLength: 1 + account_sid: + type: string + minLength: 1 + auth: + type: string + writeOnly: true + minLength: 1 + auth_password: + type: string + writeOnly: true + auth_type: + $ref: '#/components/schemas/AuthTypeEnum' + verify_only: + type: boolean + description: When enabled, the Phone number is only used during enrollment + to verify the users authenticity. Only a hash of the phone number is saved + to ensure it is not reused in the future. + mapping: + type: string + format: uuid + nullable: true + description: Optionally modify the payload being sent to custom providers. + required: + - account_sid + - auth + - from_number + - name + - provider + AuthenticatorStaticChallenge: + type: object + description: Static authenticator challenge + properties: + flow_info: + $ref: '#/components/schemas/ContextualFlowInfo' + component: + type: string + default: ak-stage-authenticator-static + response_errors: + type: object + additionalProperties: + type: array + items: + $ref: '#/components/schemas/ErrorDetail' + pending_user: + type: string + pending_user_avatar: + type: string + codes: + type: array + items: + type: string + required: + - codes + - pending_user + - pending_user_avatar + AuthenticatorStaticChallengeResponseRequest: + type: object + description: Pseudo class for static response + properties: + component: + type: string + minLength: 1 + default: ak-stage-authenticator-static + AuthenticatorStaticStage: + type: object + description: AuthenticatorStaticStage Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Stage uuid + name: + type: string + component: + type: string + description: Get object type so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + flow_set: + type: array + items: + $ref: '#/components/schemas/FlowSet' + readOnly: true + configure_flow: + type: string + format: uuid + nullable: true + description: Flow used by an authenticated user to configure this Stage. + If empty, user will not be able to configure this stage. + friendly_name: + type: string + token_count: + type: integer + maximum: 2147483647 + minimum: 0 + token_length: + type: integer + maximum: 100 + minimum: 0 + required: + - component + - flow_set + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + AuthenticatorStaticStageRequest: + type: object + description: AuthenticatorStaticStage Serializer + properties: + name: + type: string + minLength: 1 + configure_flow: + type: string + format: uuid + nullable: true + description: Flow used by an authenticated user to configure this Stage. + If empty, user will not be able to configure this stage. + friendly_name: + type: string + token_count: + type: integer + maximum: 2147483647 + minimum: 0 + token_length: + type: integer + maximum: 100 + minimum: 0 + required: + - name + AuthenticatorTOTPChallenge: + type: object + description: TOTP Setup challenge + properties: + flow_info: + $ref: '#/components/schemas/ContextualFlowInfo' + component: + type: string + default: ak-stage-authenticator-totp + response_errors: + type: object + additionalProperties: + type: array + items: + $ref: '#/components/schemas/ErrorDetail' + pending_user: + type: string + pending_user_avatar: + type: string + config_url: + type: string + required: + - config_url + - pending_user + - pending_user_avatar + AuthenticatorTOTPChallengeResponseRequest: + type: object + description: TOTP Challenge response, device is set by get_response_instance + properties: + component: + type: string + minLength: 1 + default: ak-stage-authenticator-totp + code: + type: string + minLength: 1 + required: + - code + AuthenticatorTOTPStage: + type: object + description: AuthenticatorTOTPStage Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Stage uuid + name: + type: string + component: + type: string + description: Get object type so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + flow_set: + type: array + items: + $ref: '#/components/schemas/FlowSet' + readOnly: true + configure_flow: + type: string + format: uuid + nullable: true + description: Flow used by an authenticated user to configure this Stage. + If empty, user will not be able to configure this stage. + friendly_name: + type: string + digits: + $ref: '#/components/schemas/DigitsEnum' + required: + - component + - digits + - flow_set + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + AuthenticatorTOTPStageRequest: + type: object + description: AuthenticatorTOTPStage Serializer + properties: + name: + type: string + minLength: 1 + configure_flow: + type: string + format: uuid + nullable: true + description: Flow used by an authenticated user to configure this Stage. + If empty, user will not be able to configure this stage. + friendly_name: + type: string + digits: + $ref: '#/components/schemas/DigitsEnum' + required: + - digits + - name + AuthenticatorValidateStage: + type: object + description: AuthenticatorValidateStage Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Stage uuid + name: + type: string + component: + type: string + description: Get object type so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + flow_set: + type: array + items: + $ref: '#/components/schemas/FlowSet' + readOnly: true + not_configured_action: + $ref: '#/components/schemas/NotConfiguredActionEnum' + device_classes: + type: array + items: + $ref: '#/components/schemas/DeviceClassesEnum' + description: Device classes which can be used to authenticate + configuration_stages: + type: array + items: + type: string + format: uuid + description: Stages used to configure Authenticator when user doesn't have + any compatible devices. After this configuration Stage passes, the user + is not prompted again. + last_auth_threshold: + type: string + description: If any of the user's device has been used within this threshold, + this stage will be skipped + webauthn_user_verification: + allOf: + - $ref: '#/components/schemas/UserVerificationEnum' + description: Enforce user verification for WebAuthn devices. + webauthn_hints: + type: array + items: + $ref: '#/components/schemas/WebAuthnHintEnum' + webauthn_allowed_device_types: + type: array + items: + type: string + format: uuid + webauthn_allowed_device_types_obj: + type: array + items: + $ref: '#/components/schemas/WebAuthnDeviceType' + readOnly: true + email_otp_throttling_factor: + type: number + format: double + sms_otp_throttling_factor: + type: number + format: double + totp_otp_throttling_factor: + type: number + format: double + static_otp_throttling_factor: + type: number + format: double + required: + - component + - flow_set + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + - webauthn_allowed_device_types_obj + AuthenticatorValidateStageRequest: + type: object + description: AuthenticatorValidateStage Serializer + properties: + name: + type: string + minLength: 1 + not_configured_action: + $ref: '#/components/schemas/NotConfiguredActionEnum' + device_classes: + type: array + items: + $ref: '#/components/schemas/DeviceClassesEnum' + description: Device classes which can be used to authenticate + configuration_stages: + type: array + items: + type: string + format: uuid + description: Stages used to configure Authenticator when user doesn't have + any compatible devices. After this configuration Stage passes, the user + is not prompted again. + last_auth_threshold: + type: string + minLength: 1 + description: If any of the user's device has been used within this threshold, + this stage will be skipped + webauthn_user_verification: + allOf: + - $ref: '#/components/schemas/UserVerificationEnum' + description: Enforce user verification for WebAuthn devices. + webauthn_hints: + type: array + items: + $ref: '#/components/schemas/WebAuthnHintEnum' + webauthn_allowed_device_types: + type: array + items: + type: string + format: uuid + email_otp_throttling_factor: + type: number + format: double + sms_otp_throttling_factor: + type: number + format: double + totp_otp_throttling_factor: + type: number + format: double + static_otp_throttling_factor: + type: number + format: double + required: + - name + AuthenticatorValidationChallenge: + type: object + description: Authenticator challenge + properties: + flow_info: + $ref: '#/components/schemas/ContextualFlowInfo' + component: + type: string + default: ak-stage-authenticator-validate + response_errors: + type: object + additionalProperties: + type: array + items: + $ref: '#/components/schemas/ErrorDetail' + pending_user: + type: string + pending_user_avatar: + type: string + device_challenges: + type: array + items: + $ref: '#/components/schemas/DeviceChallenge' + configuration_stages: + type: array + items: + $ref: '#/components/schemas/SelectableStage' + required: + - configuration_stages + - device_challenges + - pending_user + - pending_user_avatar + AuthenticatorValidationChallengeResponseRequest: + type: object + description: Challenge used for Code-based and WebAuthn authenticators + properties: + component: + type: string + minLength: 1 + default: ak-stage-authenticator-validate + selected_challenge: + $ref: '#/components/schemas/DeviceChallengeRequest' + selected_stage: + type: string + minLength: 1 + code: + type: string + minLength: 1 + webauthn: + type: object + additionalProperties: {} + duo: + type: integer + AuthenticatorWebAuthnChallenge: + type: object + description: WebAuthn Challenge + properties: + flow_info: + $ref: '#/components/schemas/ContextualFlowInfo' + component: + type: string + default: ak-stage-authenticator-webauthn + response_errors: + type: object + additionalProperties: + type: array + items: + $ref: '#/components/schemas/ErrorDetail' + pending_user: + type: string + pending_user_avatar: + type: string + registration: + type: object + additionalProperties: {} + required: + - pending_user + - pending_user_avatar + - registration + AuthenticatorWebAuthnChallengeResponseRequest: + type: object + description: WebAuthn Challenge response + properties: + component: + type: string + minLength: 1 + default: ak-stage-authenticator-webauthn + response: + type: object + additionalProperties: {} + required: + - response + AuthenticatorWebAuthnStage: + type: object + description: AuthenticatorWebAuthnStage Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Stage uuid + name: + type: string + component: + type: string + description: Get object type so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + flow_set: + type: array + items: + $ref: '#/components/schemas/FlowSet' + readOnly: true + configure_flow: + type: string + format: uuid + nullable: true + description: Flow used by an authenticated user to configure this Stage. + If empty, user will not be able to configure this stage. + friendly_name: + type: string + user_verification: + $ref: '#/components/schemas/UserVerificationEnum' + authenticator_attachment: + allOf: + - $ref: '#/components/schemas/AuthenticatorAttachmentEnum' + nullable: true + resident_key_requirement: + $ref: '#/components/schemas/UserVerificationEnum' + hints: + type: array + items: + $ref: '#/components/schemas/WebAuthnHintEnum' + device_type_restrictions: + type: array + items: + type: string + format: uuid + device_type_restrictions_obj: + type: array + items: + $ref: '#/components/schemas/WebAuthnDeviceType' + readOnly: true + max_attempts: + type: integer + maximum: 2147483647 + minimum: 0 + required: + - component + - device_type_restrictions_obj + - flow_set + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + AuthenticatorWebAuthnStageRequest: + type: object + description: AuthenticatorWebAuthnStage Serializer + properties: + name: + type: string + minLength: 1 + configure_flow: + type: string + format: uuid + nullable: true + description: Flow used by an authenticated user to configure this Stage. + If empty, user will not be able to configure this stage. + friendly_name: + type: string + user_verification: + $ref: '#/components/schemas/UserVerificationEnum' + authenticator_attachment: + allOf: + - $ref: '#/components/schemas/AuthenticatorAttachmentEnum' + nullable: true + resident_key_requirement: + $ref: '#/components/schemas/UserVerificationEnum' + hints: + type: array + items: + $ref: '#/components/schemas/WebAuthnHintEnum' + device_type_restrictions: + type: array + items: + type: string + format: uuid + max_attempts: + type: integer + maximum: 2147483647 + minimum: 0 + required: + - name + AuthorizationCodeAuthMethodEnum: + enum: + - basic_auth + - post_body + type: string + AutoSubmitChallengeResponseRequest: + type: object + description: Pseudo class for autosubmit response + properties: + component: + type: string + minLength: 1 + default: ak-stage-autosubmit + Autocomplete: + type: object + additionalProperties: {} + AutosubmitChallenge: + type: object + description: Autosubmit challenge used to send and navigate a POST request + properties: + flow_info: + $ref: '#/components/schemas/ContextualFlowInfo' + component: + type: string + default: ak-stage-autosubmit + response_errors: + type: object + additionalProperties: + type: array + items: + $ref: '#/components/schemas/ErrorDetail' + url: + type: string + attrs: + type: object + additionalProperties: + type: string + title: + type: string + required: + - attrs + - url + BackendsEnum: + enum: + - authentik.core.auth.InbuiltBackend + - authentik.core.auth.TokenBackend + - authentik.sources.ldap.auth.LDAPBackend + - authentik.sources.kerberos.auth.KerberosBackend + type: string + BindingTypeEnum: + enum: + - REDIRECT + - POST + - POST_AUTO + type: string + BlueprintFile: + type: object + properties: + path: + type: string + last_m: + type: string + format: date-time + hash: + type: string + meta: + allOf: + - $ref: '#/components/schemas/Metadata' + readOnly: true + required: + - hash + - last_m + - meta + - path + BlueprintImportResult: + type: object + description: Logs of an attempted blueprint import + properties: + logs: + type: array + items: + $ref: '#/components/schemas/LogEvent' + readOnly: true + success: + type: boolean + readOnly: true + required: + - logs + - success + BlueprintInstance: + type: object + description: Info about a single blueprint instance file + properties: + pk: + type: string + format: uuid + readOnly: true + title: Instance uuid + name: + type: string + path: + type: string + default: '' + context: + type: object + additionalProperties: {} + last_applied: + type: string + format: date-time + readOnly: true + last_applied_hash: + type: string + readOnly: true + status: + allOf: + - $ref: '#/components/schemas/BlueprintInstanceStatusEnum' + readOnly: true + enabled: + type: boolean + managed_models: + type: array + items: + type: string + readOnly: true + metadata: + type: object + additionalProperties: {} + readOnly: true + content: + type: string + required: + - last_applied + - last_applied_hash + - managed_models + - metadata + - name + - pk + - status + BlueprintInstanceRequest: + type: object + description: Info about a single blueprint instance file + properties: + name: + type: string + minLength: 1 + path: + type: string + default: '' + context: + type: object + additionalProperties: {} + enabled: + type: boolean + content: + type: string + required: + - name + BlueprintInstanceStatusEnum: + enum: + - successful + - warning + - error + - orphaned + - unknown + type: string + BlueprintUploadRequest: + type: object + description: Serializer to upload file + properties: + file: + type: string + format: binary + path: + type: string + minLength: 1 + context: + type: string + Brand: + type: object + description: Brand Serializer + properties: + brand_uuid: + type: string + format: uuid + readOnly: true + domain: + type: string + description: Domain that activates this brand. Can be a superset, i.e. `a.b` + for `aa.b` and `ba.b` + default: + type: boolean + branding_title: + type: string + branding_logo: + type: string + branding_favicon: + type: string + branding_custom_css: + type: string + branding_default_flow_background: + type: string + branding_map_tiles: + type: string + description: URL template for the vector tile source used by the events + map. Supports XYZ templates with {z}, {x} and {y} placeholders, or pmtiles:// + archive URLs. When empty, the frontend uses the bundled hexworld basemap. + This value is part of the brand information served to unauthenticated + clients; do not embed API keys or other credentials in it. + flow_authentication: + type: string + format: uuid + nullable: true + flow_user_switch: + type: string + format: uuid + nullable: true + flow_invalidation: + type: string + format: uuid + nullable: true + flow_recovery: + type: string + format: uuid + nullable: true + flow_unenrollment: + type: string + format: uuid + nullable: true + flow_user_settings: + type: string + format: uuid + nullable: true + flow_device_code: + type: string + format: uuid + nullable: true + flow_lockdown: + type: string + format: uuid + nullable: true + flow_request: + type: string + format: uuid + nullable: true + default_application: + type: string + format: uuid + nullable: true + description: When set, external users will be redirected to this application + after authenticating. + web_certificate: + type: string + format: uuid + nullable: true + description: Web Certificate used by the authentik Core webserver. + client_certificates: + type: array + items: + type: string + format: uuid + description: Certificates used for client authentication. + attributes: + type: object + additionalProperties: {} + required: + - brand_uuid + - domain + BrandRequest: + type: object + description: Brand Serializer + properties: + domain: + type: string + minLength: 1 + description: Domain that activates this brand. Can be a superset, i.e. `a.b` + for `aa.b` and `ba.b` + default: + type: boolean + branding_title: + type: string + minLength: 1 + branding_logo: + type: string + minLength: 1 + branding_favicon: + type: string + minLength: 1 + branding_custom_css: + type: string + branding_default_flow_background: + type: string + minLength: 1 + branding_map_tiles: + type: string + description: URL template for the vector tile source used by the events + map. Supports XYZ templates with {z}, {x} and {y} placeholders, or pmtiles:// + archive URLs. When empty, the frontend uses the bundled hexworld basemap. + This value is part of the brand information served to unauthenticated + clients; do not embed API keys or other credentials in it. + flow_authentication: + type: string + format: uuid + nullable: true + flow_user_switch: + type: string + format: uuid + nullable: true + flow_invalidation: + type: string + format: uuid + nullable: true + flow_recovery: + type: string + format: uuid + nullable: true + flow_unenrollment: + type: string + format: uuid + nullable: true + flow_user_settings: + type: string + format: uuid + nullable: true + flow_device_code: + type: string + format: uuid + nullable: true + flow_lockdown: + type: string + format: uuid + nullable: true + flow_request: + type: string + format: uuid + nullable: true + default_application: + type: string + format: uuid + nullable: true + description: When set, external users will be redirected to this application + after authenticating. + web_certificate: + type: string + format: uuid + nullable: true + description: Web Certificate used by the authentik Core webserver. + client_certificates: + type: array + items: + type: string + format: uuid + description: Certificates used for client authentication. + attributes: + type: object + additionalProperties: {} + required: + - domain + BulkDeleteSessionResponse: + type: object + properties: + deleted: + type: integer + required: + - deleted + Cache: + type: object + description: Generic cache stats for an object + properties: + count: + type: integer + readOnly: true + required: + - count + CapabilitiesEnum: + enum: + - can_save_media + - can_save_reports + - can_geo_ip + - can_asn + - can_impersonate + - can_debug + - is_enterprise + - can_request + - can_agent_self_service + type: string + CaptchaChallenge: + type: object + description: Site public key + properties: + flow_info: + $ref: '#/components/schemas/ContextualFlowInfo' + component: + type: string + default: ak-stage-captcha + response_errors: + type: object + additionalProperties: + type: array + items: + $ref: '#/components/schemas/ErrorDetail' + pending_user: + type: string + pending_user_avatar: + type: string + site_key: + type: string + js_url: + type: string + interactive: + type: boolean + required: + - interactive + - js_url + - pending_user + - pending_user_avatar + - site_key + CaptchaChallengeResponseRequest: + type: object + description: Validate captcha token + properties: + component: + type: string + minLength: 1 + default: ak-stage-captcha + token: + type: string + minLength: 1 + required: + - token + CaptchaStage: + type: object + description: CaptchaStage Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Stage uuid + name: + type: string + component: + type: string + description: Get object type so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + flow_set: + type: array + items: + $ref: '#/components/schemas/FlowSet' + readOnly: true + public_key: + type: string + description: Public key, acquired your captcha Provider. + js_url: + type: string + api_url: + type: string + request_content_type: + $ref: '#/components/schemas/RequestContentTypeEnum' + interactive: + type: boolean + score_min_threshold: + type: number + format: double + score_max_threshold: + type: number + format: double + error_on_invalid_score: + type: boolean + description: When enabled and the received captcha score is outside of the + given threshold, the stage will show an error message. When not enabled, + the flow will continue, but the data from the captcha will be available + in the context for policy decisions + required: + - component + - flow_set + - meta_model_name + - name + - pk + - public_key + - verbose_name + - verbose_name_plural + CaptchaStageRequest: + type: object + description: CaptchaStage Serializer + properties: + name: + type: string + minLength: 1 + public_key: + type: string + minLength: 1 + description: Public key, acquired your captcha Provider. + private_key: + type: string + writeOnly: true + minLength: 1 + description: Private key, acquired your captcha Provider. + js_url: + type: string + minLength: 1 + api_url: + type: string + minLength: 1 + request_content_type: + $ref: '#/components/schemas/RequestContentTypeEnum' + interactive: + type: boolean + score_min_threshold: + type: number + format: double + score_max_threshold: + type: number + format: double + error_on_invalid_score: + type: boolean + description: When enabled and the received captcha score is outside of the + given threshold, the stage will show an error message. When not enabled, + the flow will continue, but the data from the captcha will be available + in the context for policy decisions + required: + - name + - private_key + - public_key + CertAttributeEnum: + enum: + - subject + - common_name + - email + type: string + CertificateData: + type: object + description: Get CertificateKeyPair's data + properties: + data: + type: string + readOnly: true + required: + - data + CertificateGenerationRequest: + type: object + description: Certificate generation parameters + properties: + common_name: + type: string + minLength: 1 + subject_alt_name: + type: string + validity_days: + type: integer + alg: + allOf: + - $ref: '#/components/schemas/AlgEnum' + default: rsa + required: + - common_name + - validity_days + CertificateKeyPair: + type: object + description: CertificateKeyPair Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Kp uuid + name: + type: string + fingerprint_sha256: + type: string + readOnly: true + nullable: true + description: SHA256 fingerprint of the certificate + fingerprint_sha1: + type: string + readOnly: true + nullable: true + description: SHA1 fingerprint of the certificate + cert_expiry: + type: string + format: date-time + readOnly: true + nullable: true + description: Certificate expiry date + cert_subject: + type: string + readOnly: true + nullable: true + description: Certificate subject as RFC4514 string + private_key_available: + type: boolean + description: Show if this keypair has a private key configured or not + readOnly: true + key_type: + allOf: + - $ref: '#/components/schemas/CertificateKeyPairKeyTypeEnum' + readOnly: true + nullable: true + description: Key algorithm type detected from the certificate's public key + certificate_download_url: + type: string + description: Get URL to download certificate + readOnly: true + private_key_download_url: + type: string + description: Get URL to download private key + readOnly: true + managed: + type: string + readOnly: true + nullable: true + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + required: + - cert_expiry + - cert_subject + - certificate_download_url + - fingerprint_sha1 + - fingerprint_sha256 + - key_type + - managed + - name + - pk + - private_key_available + - private_key_download_url + CertificateKeyPairKeyTypeEnum: + enum: + - rsa + - ec + - dsa + - ed25519 + - ed448 + type: string + CertificateKeyPairRequest: + type: object + description: CertificateKeyPair Serializer + properties: + name: + type: string + minLength: 1 + certificate_data: + type: string + writeOnly: true + minLength: 1 + description: PEM-encoded Certificate data + key_data: + type: string + writeOnly: true + description: Optional Private Key. If this is set, you can use this keypair + for encryption. + required: + - certificate_data + - name + ChallengeTypes: + oneOf: + - $ref: '#/components/schemas/AccessDeniedChallenge' + - $ref: '#/components/schemas/AppleLoginChallenge' + - $ref: '#/components/schemas/AuthenticatorDuoChallenge' + - $ref: '#/components/schemas/AuthenticatorEmailChallenge' + - $ref: '#/components/schemas/AuthenticatorSMSChallenge' + - $ref: '#/components/schemas/AuthenticatorStaticChallenge' + - $ref: '#/components/schemas/AuthenticatorTOTPChallenge' + - $ref: '#/components/schemas/AuthenticatorValidationChallenge' + - $ref: '#/components/schemas/AuthenticatorWebAuthnChallenge' + - $ref: '#/components/schemas/AutosubmitChallenge' + - $ref: '#/components/schemas/CaptchaChallenge' + - $ref: '#/components/schemas/ConsentChallenge' + - $ref: '#/components/schemas/EmailChallenge' + - $ref: '#/components/schemas/EndpointAgentChallenge' + - $ref: '#/components/schemas/FlowErrorChallenge' + - $ref: '#/components/schemas/FrameChallenge' + - $ref: '#/components/schemas/IdentificationChallenge' + - $ref: '#/components/schemas/IframeLogoutChallenge' + - $ref: '#/components/schemas/NativeLogoutChallenge' + - $ref: '#/components/schemas/OAuthDeviceCodeChallenge' + - $ref: '#/components/schemas/OAuthDeviceCodeFinishChallenge' + - $ref: '#/components/schemas/PasswordChallenge' + - $ref: '#/components/schemas/PlexAuthenticationChallenge' + - $ref: '#/components/schemas/PromptChallenge' + - $ref: '#/components/schemas/RedirectChallenge' + - $ref: '#/components/schemas/SessionEndChallenge' + - $ref: '#/components/schemas/ShellChallenge' + - $ref: '#/components/schemas/TelegramLoginChallenge' + - $ref: '#/components/schemas/UserLoginChallenge' + discriminator: + propertyName: component + mapping: + ak-stage-access-denied: '#/components/schemas/AccessDeniedChallenge' + ak-source-oauth-apple: '#/components/schemas/AppleLoginChallenge' + ak-stage-authenticator-duo: '#/components/schemas/AuthenticatorDuoChallenge' + ak-stage-authenticator-email: '#/components/schemas/AuthenticatorEmailChallenge' + ak-stage-authenticator-sms: '#/components/schemas/AuthenticatorSMSChallenge' + ak-stage-authenticator-static: '#/components/schemas/AuthenticatorStaticChallenge' + ak-stage-authenticator-totp: '#/components/schemas/AuthenticatorTOTPChallenge' + ak-stage-authenticator-validate: '#/components/schemas/AuthenticatorValidationChallenge' + ak-stage-authenticator-webauthn: '#/components/schemas/AuthenticatorWebAuthnChallenge' + ak-stage-autosubmit: '#/components/schemas/AutosubmitChallenge' + ak-stage-captcha: '#/components/schemas/CaptchaChallenge' + ak-stage-consent: '#/components/schemas/ConsentChallenge' + ak-stage-email: '#/components/schemas/EmailChallenge' + ak-stage-endpoint-agent: '#/components/schemas/EndpointAgentChallenge' + ak-stage-flow-error: '#/components/schemas/FlowErrorChallenge' + xak-flow-frame: '#/components/schemas/FrameChallenge' + ak-stage-identification: '#/components/schemas/IdentificationChallenge' + ak-provider-iframe-logout: '#/components/schemas/IframeLogoutChallenge' + ak-provider-saml-native-logout: '#/components/schemas/NativeLogoutChallenge' + ak-provider-oauth2-device-code: '#/components/schemas/OAuthDeviceCodeChallenge' + ak-provider-oauth2-device-code-finish: '#/components/schemas/OAuthDeviceCodeFinishChallenge' + ak-stage-password: '#/components/schemas/PasswordChallenge' + ak-source-plex: '#/components/schemas/PlexAuthenticationChallenge' + ak-stage-prompt: '#/components/schemas/PromptChallenge' + xak-flow-redirect: '#/components/schemas/RedirectChallenge' + ak-stage-session-end: '#/components/schemas/SessionEndChallenge' + xak-flow-shell: '#/components/schemas/ShellChallenge' + ak-source-telegram: '#/components/schemas/TelegramLoginChallenge' + ak-stage-user-login: '#/components/schemas/UserLoginChallenge' + ClientTypeEnum: + enum: + - confidential + - public + type: string + CompatibilityModeEnum: + enum: + - default + - aws + - slack + - sfdc + - gitlab + - webex + - vcenter + type: string + Config: + type: object + description: Serialize authentik Config into DRF Object + properties: + error_reporting: + $ref: '#/components/schemas/ErrorReportingConfig' + capabilities: + type: array + items: + $ref: '#/components/schemas/CapabilitiesEnum' + cache_timeout: + type: integer + cache_timeout_flows: + type: integer + cache_timeout_policies: + type: integer + required: + - cache_timeout + - cache_timeout_flows + - cache_timeout_policies + - capabilities + - error_reporting + ConnectionToken: + type: object + description: ConnectionToken Serializer + properties: + pk: + type: string + format: uuid + title: Connection token uuid + provider: + type: integer + provider_obj: + allOf: + - $ref: '#/components/schemas/RACProvider' + readOnly: true + endpoint: + type: string + format: uuid + endpoint_obj: + allOf: + - $ref: '#/components/schemas/Endpoint' + readOnly: true + user: + allOf: + - $ref: '#/components/schemas/PartialUser' + readOnly: true + required: + - endpoint + - endpoint_obj + - provider + - provider_obj + - user + ConnectionTokenRequest: + type: object + description: ConnectionToken Serializer + properties: + pk: + type: string + format: uuid + title: Connection token uuid + provider: + type: integer + endpoint: + type: string + format: uuid + required: + - endpoint + - provider + Connector: + type: object + properties: + connector_uuid: + type: string + format: uuid + name: + type: string + enabled: + type: boolean + component: + type: string + description: Get object component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + required: + - component + - meta_model_name + - name + - verbose_name + - verbose_name_plural + ConsentChallenge: + type: object + description: Challenge info for consent screens + properties: + flow_info: + $ref: '#/components/schemas/ContextualFlowInfo' + component: + type: string + default: ak-stage-consent + response_errors: + type: object + additionalProperties: + type: array + items: + $ref: '#/components/schemas/ErrorDetail' + pending_user: + type: string + pending_user_avatar: + type: string + header_text: + type: string + permissions: + type: array + items: + $ref: '#/components/schemas/ConsentPermission' + additional_permissions: + type: array + items: + $ref: '#/components/schemas/ConsentPermission' + token: + type: string + required: + - additional_permissions + - pending_user + - pending_user_avatar + - permissions + - token + ConsentChallengeResponseRequest: + type: object + description: Consent challenge response, any valid response request is valid + properties: + component: + type: string + minLength: 1 + default: ak-stage-consent + token: + type: string + minLength: 1 + required: + - token + ConsentModeEnum: + enum: + - always_require + - permanent + - expiring + type: string + ConsentPermission: + type: object + description: Permission used for consent + properties: + name: + type: string + id: + type: string + required: + - id + - name + ConsentStage: + type: object + description: ConsentStage Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Stage uuid + name: + type: string + component: + type: string + description: Get object type so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + flow_set: + type: array + items: + $ref: '#/components/schemas/FlowSet' + readOnly: true + mode: + $ref: '#/components/schemas/ConsentModeEnum' + consent_expire_in: + type: string + title: Consent expires in + description: 'Offset after which consent expires. (Format: hours=1;minutes=2;seconds=3).' + required: + - component + - flow_set + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + ConsentStageRequest: + type: object + description: ConsentStage Serializer + properties: + name: + type: string + minLength: 1 + mode: + $ref: '#/components/schemas/ConsentModeEnum' + consent_expire_in: + type: string + minLength: 1 + title: Consent expires in + description: 'Offset after which consent expires. (Format: hours=1;minutes=2;seconds=3).' + required: + - name + ContentType: + type: object + properties: + id: + type: integer + readOnly: true + app_label: + type: string + readOnly: true + model: + type: string + readOnly: true + verbose_name_plural: + type: string + readOnly: true + fully_qualified_model: + type: string + readOnly: true + required: + - app_label + - fully_qualified_model + - id + - model + - verbose_name_plural + ContentTypeEnum: + enum: + - authentik_core.application + - authentik_core.group + - authentik_rbac.role + type: string + ContextualFlowInfo: + type: object + description: Contextual flow information for a challenge + properties: + title: + type: string + background: + type: string + background_themed_urls: + allOf: + - $ref: '#/components/schemas/ThemedUrls' + nullable: true + cancel_url: + type: string + layout: + $ref: '#/components/schemas/ContextualFlowInfoLayoutEnum' + required: + - cancel_url + - layout + ContextualFlowInfoLayoutEnum: + enum: + - stacked + - content_left + - content_right + - sidebar_left + - sidebar_right + - sidebar_left_frame_background + - sidebar_right_frame_background + type: string + CountryCodeEnum: + enum: + - AF + - AX + - AL + - DZ + - AS + - AD + - AO + - AI + - AQ + - AG + - AR + - AM + - AW + - AU + - AT + - AZ + - BS + - BH + - BD + - BB + - BY + - BE + - BZ + - BJ + - BM + - BT + - BO + - BQ + - BA + - BW + - BV + - BR + - IO + - BN + - BG + - BF + - BI + - CV + - KH + - CM + - CA + - KY + - CF + - TD + - CL + - CN + - CX + - CC + - CO + - KM + - CG + - CK + - CR + - CI + - HR + - CU + - CW + - CY + - CZ + - CD + - DK + - DJ + - DM + - DO + - EC + - EG + - SV + - GQ + - ER + - EE + - SZ + - ET + - FK + - FO + - FJ + - FI + - FR + - GF + - PF + - TF + - GA + - GM + - GE + - DE + - GH + - GI + - GR + - GL + - GD + - GP + - GU + - GT + - GG + - GN + - GW + - GY + - HT + - HM + - HN + - HK + - HU + - IS + - IN + - ID + - IR + - IQ + - IE + - IM + - IL + - IT + - JM + - JP + - JE + - JO + - KZ + - KE + - KI + - KW + - KG + - LA + - LV + - LB + - LS + - LR + - LY + - LI + - LT + - LU + - MO + - MG + - MW + - MY + - MV + - ML + - MT + - MH + - MQ + - MR + - MU + - YT + - MX + - FM + - MD + - MC + - MN + - ME + - MS + - MA + - MZ + - MM + - NA + - NR + - NP + - NL + - NC + - NZ + - NI + - NE + - NG + - NU + - NF + - KP + - MK + - MP + - 'NO' + - OM + - PK + - PW + - PS + - PA + - PG + - PY + - PE + - PH + - PN + - PL + - PT + - PR + - QA + - RE + - RO + - RU + - RW + - BL + - SH + - KN + - LC + - MF + - PM + - VC + - WS + - SM + - ST + - SA + - SN + - RS + - SC + - SL + - SG + - SX + - SK + - SI + - SB + - SO + - ZA + - GS + - KR + - SS + - ES + - LK + - SD + - SR + - SJ + - SE + - CH + - SY + - TW + - TJ + - TZ + - TH + - TL + - TG + - TK + - TO + - TT + - TN + - TR + - TM + - TC + - TV + - UG + - UA + - AE + - GB + - UM + - US + - UY + - UZ + - VU + - VA + - VE + - VN + - VG + - VI + - WF + - EH + - YE + - ZM + - ZW + type: string + CurrentBrand: + type: object + description: Partial brand information for styling + properties: + matched_domain: + type: string + branding_title: + type: string + branding_logo: + type: string + branding_logo_themed_urls: + allOf: + - $ref: '#/components/schemas/ThemedUrls' + readOnly: true + nullable: true + branding_favicon: + type: string + branding_favicon_themed_urls: + allOf: + - $ref: '#/components/schemas/ThemedUrls' + readOnly: true + nullable: true + branding_custom_css: + type: string + branding_map_tiles: + type: string + ui_footer_links: + type: array + items: + $ref: '#/components/schemas/FooterLink' + readOnly: true + ui_theme: + allOf: + - $ref: '#/components/schemas/UiThemeEnum' + readOnly: true + default: automatic + flow_authentication: + type: string + flow_user_switch: + type: string + flow_invalidation: + type: string + flow_recovery: + type: string + flow_unenrollment: + type: string + flow_user_settings: + type: string + flow_device_code: + type: string + flow_lockdown: + type: string + flow_request: + type: string + default_locale: + type: string + readOnly: true + flags: + type: object + properties: + flows_continuous_login: + type: boolean + description: Upon successful authentication, re-start authentication + in other open tabs. + flows_refresh_others: + type: boolean + description: Refresh other tabs after successful authentication. + deprecated: true + required: + - flows_continuous_login + - flows_refresh_others + readOnly: true + required: + - branding_custom_css + - branding_favicon + - branding_favicon_themed_urls + - branding_logo + - branding_logo_themed_urls + - branding_map_tiles + - branding_title + - default_locale + - flags + - matched_domain + - ui_footer_links + - ui_theme + DataExport: + type: object + description: |- + Mixin to validate that a valid enterprise license + exists before allowing to save the object + properties: + id: + type: string + format: uuid + readOnly: true + requested_by: + allOf: + - $ref: '#/components/schemas/PartialUser' + readOnly: true + requested_on: + type: string + format: date-time + readOnly: true + content_type: + allOf: + - $ref: '#/components/schemas/ContentType' + readOnly: true + query_params: + type: object + additionalProperties: {} + file_url: + type: string + readOnly: true + completed: + type: boolean + readOnly: true + required: + - completed + - content_type + - file_url + - id + - query_params + - requested_by + - requested_on + DeliveryMethodEnum: + enum: + - https://schemas.openid.net/secevent/risc/delivery-method/push + - https://schemas.openid.net/secevent/risc/delivery-method/poll + - urn:ietf:rfc:8935 + - urn:ietf:rfc:8936 + type: string + DeniedActionEnum: + enum: + - message_continue + - message + - continue + type: string + DenyStage: + type: object + description: DenyStage Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Stage uuid + name: + type: string + component: + type: string + description: Get object type so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + flow_set: + type: array + items: + $ref: '#/components/schemas/FlowSet' + readOnly: true + deny_message: + type: string + required: + - component + - flow_set + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + DenyStageRequest: + type: object + description: DenyStage Serializer + properties: + name: + type: string + minLength: 1 + deny_message: + type: string + required: + - name + DetailedCountry: + type: object + properties: + code: + $ref: '#/components/schemas/CountryCodeEnum' + name: + type: string + required: + - code + - name + Device: + type: object + description: Serializer for authenticator devices + properties: + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + pk: + type: string + name: + type: string + type: + type: string + description: Get type of device + readOnly: true + confirmed: + type: boolean + created: + type: string + format: date-time + readOnly: true + last_updated: + type: string + format: date-time + readOnly: true + last_used: + type: string + format: date-time + readOnly: true + nullable: true + extra_description: + type: string + nullable: true + description: Get extra description + readOnly: true + external_id: + type: string + nullable: true + description: Get external Device ID + readOnly: true + required: + - confirmed + - created + - external_id + - extra_description + - last_updated + - last_used + - meta_model_name + - name + - pk + - type + - verbose_name + - verbose_name_plural + DeviceAccessGroup: + type: object + properties: + pbm_uuid: + type: string + format: uuid + readOnly: true + name: + type: string + attributes: + type: object + additionalProperties: {} + required: + - name + - pbm_uuid + DeviceAccessGroupRequest: + type: object + properties: + name: + type: string + minLength: 1 + attributes: + type: object + additionalProperties: {} + required: + - name + DeviceChallenge: + type: object + description: Single device challenge + properties: + device_class: + $ref: '#/components/schemas/DeviceClassesEnum' + device_uid: + type: string + challenge: + type: object + additionalProperties: {} + last_used: + type: string + format: date-time + nullable: true + required: + - challenge + - device_class + - device_uid + - last_used + DeviceChallengeRequest: + type: object + description: Single device challenge + properties: + device_class: + $ref: '#/components/schemas/DeviceClassesEnum' + device_uid: + type: string + minLength: 1 + challenge: + type: object + additionalProperties: {} + last_used: + type: string + format: date-time + nullable: true + required: + - challenge + - device_class + - device_uid + - last_used + DeviceClassesEnum: + enum: + - static + - totp + - webauthn + - duo + - sms + - email + type: string + DeviceConnection: + type: object + properties: + device: + type: string + format: uuid + connector: + type: string + format: uuid + connector_obj: + allOf: + - $ref: '#/components/schemas/Connector' + readOnly: true + latest_snapshot: + allOf: + - $ref: '#/components/schemas/DeviceFactSnapshot' + readOnly: true + nullable: true + required: + - connector + - connector_obj + - device + - latest_snapshot + DeviceFactSnapshot: + type: object + properties: + data: + $ref: '#/components/schemas/DeviceFacts' + connection: + type: string + format: uuid + created: + type: string + format: date-time + readOnly: true + expires: + type: string + format: date-time + readOnly: true + nullable: true + vendor: + allOf: + - $ref: '#/components/schemas/VendorEnum' + readOnly: true + required: + - connection + - created + - data + - expires + - vendor + DeviceFacts: + type: object + properties: + os: + allOf: + - $ref: '#/components/schemas/OperatingSystem' + nullable: true + disks: + type: array + items: + $ref: '#/components/schemas/Disk' + nullable: true + network: + allOf: + - $ref: '#/components/schemas/Network' + nullable: true + hardware: + allOf: + - $ref: '#/components/schemas/Hardware' + nullable: true + software: + type: array + items: + $ref: '#/components/schemas/Software' + nullable: true + processes: + type: array + items: + $ref: '#/components/schemas/Process' + nullable: true + users: + type: array + items: + $ref: '#/components/schemas/DeviceUser' + nullable: true + groups: + type: array + items: + $ref: '#/components/schemas/DeviceGroup' + nullable: true + vendor: + type: object + additionalProperties: {} + DeviceFactsOSFamily: + enum: + - linux + - unix + - bsd + - windows + - mac_os + - android + - i_os + - other + type: string + DeviceFactsRequest: + type: object + properties: + os: + allOf: + - $ref: '#/components/schemas/OperatingSystemRequest' + nullable: true + disks: + type: array + items: + $ref: '#/components/schemas/DiskRequest' + nullable: true + network: + allOf: + - $ref: '#/components/schemas/NetworkRequest' + nullable: true + hardware: + allOf: + - $ref: '#/components/schemas/HardwareRequest' + nullable: true + software: + type: array + items: + $ref: '#/components/schemas/SoftwareRequest' + nullable: true + processes: + type: array + items: + $ref: '#/components/schemas/ProcessRequest' + nullable: true + users: + type: array + items: + $ref: '#/components/schemas/DeviceUserRequest' + nullable: true + groups: + type: array + items: + $ref: '#/components/schemas/DeviceGroupRequest' + nullable: true + vendor: + type: object + additionalProperties: {} + DeviceGroup: + type: object + properties: + id: + type: string + name: + type: string + required: + - id + DeviceGroupRequest: + type: object + properties: + id: + type: string + minLength: 1 + name: + type: string + minLength: 1 + required: + - id + DeviceSummary: + type: object + description: Summary of registered devices + properties: + total_count: + type: integer + unreachable_count: + type: integer + outdated_agent_count: + type: integer + required: + - outdated_agent_count + - total_count + - unreachable_count + DeviceUser: + type: object + properties: + id: + type: string + username: + type: string + name: + type: string + home: + type: string + required: + - id + DeviceUserBinding: + type: object + description: PolicyBinding Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Policy binding uuid + policy: + type: string + format: uuid + nullable: true + group: + type: string + format: uuid + nullable: true + user: + type: integer + nullable: true + policy_obj: + allOf: + - $ref: '#/components/schemas/Policy' + readOnly: true + nullable: true + group_obj: + allOf: + - $ref: '#/components/schemas/PartialGroup' + readOnly: true + nullable: true + user_obj: + allOf: + - $ref: '#/components/schemas/PartialUser' + readOnly: true + nullable: true + target: + type: string + format: uuid + negate: + type: boolean + description: Negates the outcome of the policy. Messages are unaffected. + enabled: + type: boolean + order: + type: integer + maximum: 2147483647 + minimum: -2147483648 + timeout: + type: integer + maximum: 2147483647 + minimum: 0 + description: Timeout after which Policy execution is terminated. + failure_result: + type: boolean + description: Result if the Policy execution fails. + expires: + type: string + format: date-time + readOnly: true + nullable: true + expiring: + type: boolean + readOnly: true + is_primary: + type: boolean + connector: + type: string + format: uuid + readOnly: true + nullable: true + connector_obj: + allOf: + - $ref: '#/components/schemas/Connector' + readOnly: true + required: + - connector + - connector_obj + - expires + - expiring + - group_obj + - order + - pk + - policy_obj + - target + - user_obj + DeviceUserBindingRequest: + type: object + description: PolicyBinding Serializer + properties: + policy: + type: string + format: uuid + nullable: true + group: + type: string + format: uuid + nullable: true + user: + type: integer + nullable: true + target: + type: string + format: uuid + negate: + type: boolean + description: Negates the outcome of the policy. Messages are unaffected. + enabled: + type: boolean + order: + type: integer + maximum: 2147483647 + minimum: -2147483648 + timeout: + type: integer + maximum: 2147483647 + minimum: 0 + description: Timeout after which Policy execution is terminated. + failure_result: + type: boolean + description: Result if the Policy execution fails. + is_primary: + type: boolean + required: + - order + - target + DeviceUserRequest: + type: object + properties: + id: + type: string + minLength: 1 + username: + type: string + minLength: 1 + name: + type: string + minLength: 1 + home: + type: string + minLength: 1 + required: + - id + DigestAlgorithmEnum: + enum: + - http://www.w3.org/2000/09/xmldsig#sha1 + - http://www.w3.org/2001/04/xmlenc#sha256 + - http://www.w3.org/2001/04/xmldsig-more#sha384 + - http://www.w3.org/2001/04/xmlenc#sha512 + type: string + DigitsEnum: + enum: + - '6' + - '8' + type: string + Disk: + type: object + properties: + name: + type: string + mountpoint: + type: string + label: + type: string + capacity_total_bytes: + type: integer + format: int64 + capacity_used_bytes: + type: integer + format: int64 + encryption_enabled: + type: boolean + default: false + required: + - mountpoint + - name + DiskRequest: + type: object + properties: + name: + type: string + minLength: 1 + mountpoint: + type: string + minLength: 1 + label: + type: string + capacity_total_bytes: + type: integer + format: int64 + capacity_used_bytes: + type: integer + format: int64 + encryption_enabled: + type: boolean + default: false + required: + - mountpoint + - name + DockerServiceConnection: + type: object + description: DockerServiceConnection Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Uuid + name: + type: string + local: + type: boolean + description: If enabled, use the local connection. Required Docker socket/Kubernetes + Integration + component: + type: string + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + url: + type: string + description: Can be in the format of 'unix://' when connecting to + a local docker daemon, or 'https://:2376' when connecting to + a remote system. + tls_verification: + type: string + format: uuid + nullable: true + description: CA which the endpoint's Certificate is verified against. Can + be left empty for no validation. + tls_authentication: + type: string + format: uuid + nullable: true + description: Certificate/Key used for authentication. Can be left empty + for no authentication. + required: + - component + - meta_model_name + - name + - pk + - url + - verbose_name + - verbose_name_plural + DockerServiceConnectionRequest: + type: object + description: DockerServiceConnection Serializer + properties: + name: + type: string + minLength: 1 + local: + type: boolean + description: If enabled, use the local connection. Required Docker socket/Kubernetes + Integration + url: + type: string + minLength: 1 + description: Can be in the format of 'unix://' when connecting to + a local docker daemon, or 'https://:2376' when connecting to + a remote system. + tls_verification: + type: string + format: uuid + nullable: true + description: CA which the endpoint's Certificate is verified against. Can + be left empty for no validation. + tls_authentication: + type: string + format: uuid + nullable: true + description: Certificate/Key used for authentication. Can be left empty + for no authentication. + required: + - name + - url + DummyPolicy: + type: object + description: Dummy Policy Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Policy uuid + name: + type: string + execution_logging: + type: boolean + description: When this option is enabled, all executions of this policy + will be logged. By default, only execution errors are logged. + component: + type: string + description: Get object component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + bound_to: + type: integer + description: Return objects policy is bound to + readOnly: true + result: + type: boolean + wait_min: + type: integer + maximum: 2147483647 + minimum: -2147483648 + wait_max: + type: integer + maximum: 2147483647 + minimum: -2147483648 + required: + - bound_to + - component + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + DummyPolicyRequest: + type: object + description: Dummy Policy Serializer + properties: + name: + type: string + minLength: 1 + execution_logging: + type: boolean + description: When this option is enabled, all executions of this policy + will be logged. By default, only execution errors are logged. + result: + type: boolean + wait_min: + type: integer + maximum: 2147483647 + minimum: -2147483648 + wait_max: + type: integer + maximum: 2147483647 + minimum: -2147483648 + required: + - name + DummyStage: + type: object + description: DummyStage Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Stage uuid + name: + type: string + component: + type: string + description: Get object type so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + flow_set: + type: array + items: + $ref: '#/components/schemas/FlowSet' + readOnly: true + throw_error: + type: boolean + required: + - component + - flow_set + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + DummyStageRequest: + type: object + description: DummyStage Serializer + properties: + name: + type: string + minLength: 1 + throw_error: + type: boolean + required: + - name + DuoDevice: + type: object + description: Serializer for Duo authenticator devices + properties: + pk: + type: integer + readOnly: true + title: ID + name: + type: string + description: The human-readable name of this device. + maxLength: 64 + user: + allOf: + - $ref: '#/components/schemas/PartialUser' + readOnly: true + required: + - name + - pk + - user + DuoDeviceEnrollmentStatus: + type: object + properties: + duo_response: + $ref: '#/components/schemas/DuoResponseEnum' + required: + - duo_response + DuoDeviceRequest: + type: object + description: Serializer for Duo authenticator devices + properties: + name: + type: string + minLength: 1 + description: The human-readable name of this device. + maxLength: 64 + required: + - name + DuoResponseEnum: + enum: + - success + - waiting + - invalid + type: string + EmailChallenge: + type: object + description: Email challenge + properties: + flow_info: + $ref: '#/components/schemas/ContextualFlowInfo' + component: + type: string + default: ak-stage-email + response_errors: + type: object + additionalProperties: + type: array + items: + $ref: '#/components/schemas/ErrorDetail' + EmailChallengeResponseRequest: + type: object + description: |- + Email challenge resposen. No fields. This challenge is + always declared invalid to give the user a chance to retry + properties: + component: + type: string + minLength: 1 + default: ak-stage-email + EmailDevice: + type: object + description: Serializer for email authenticator devices + properties: + name: + type: string + description: The human-readable name of this device. + maxLength: 64 + pk: + type: integer + readOnly: true + title: ID + email: + type: string + format: email + readOnly: true + user: + allOf: + - $ref: '#/components/schemas/PartialUser' + readOnly: true + required: + - email + - name + - pk + - user + EmailDeviceRequest: + type: object + description: Serializer for email authenticator devices + properties: + name: + type: string + minLength: 1 + description: The human-readable name of this device. + maxLength: 64 + required: + - name + EmailStage: + type: object + description: EmailStage Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Stage uuid + name: + type: string + component: + type: string + description: Get object type so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + flow_set: + type: array + items: + $ref: '#/components/schemas/FlowSet' + readOnly: true + use_global_settings: + type: boolean + description: When enabled, global Email connection settings will be used + and connection settings below will be ignored. + host: + type: string + port: + type: integer + maximum: 2147483647 + minimum: -2147483648 + username: + type: string + use_tls: + type: boolean + use_ssl: + type: boolean + timeout: + type: integer + maximum: 2147483647 + minimum: -2147483648 + from_address: + type: string + format: email + maxLength: 254 + token_expiry: + type: string + description: 'Time the token sent is valid (Format: hours=3,minutes=17,seconds=300).' + subject: + type: string + template: + type: string + activate_user_on_success: + type: boolean + description: Activate users upon completion of stage. + recovery_max_attempts: + type: integer + maximum: 2147483647 + minimum: 0 + recovery_cache_timeout: + type: string + description: 'The time window used to count recent account recovery attempts. + If the number of attempts exceed recovery_max_attempts within this period, + further attempts will be rate-limited. (Format: hours=1;minutes=2;seconds=3).' + required: + - component + - flow_set + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + EmailStageRequest: + type: object + description: EmailStage Serializer + properties: + name: + type: string + minLength: 1 + use_global_settings: + type: boolean + description: When enabled, global Email connection settings will be used + and connection settings below will be ignored. + host: + type: string + minLength: 1 + port: + type: integer + maximum: 2147483647 + minimum: -2147483648 + username: + type: string + password: + type: string + writeOnly: true + use_tls: + type: boolean + use_ssl: + type: boolean + timeout: + type: integer + maximum: 2147483647 + minimum: -2147483648 + from_address: + type: string + format: email + minLength: 1 + maxLength: 254 + token_expiry: + type: string + minLength: 1 + description: 'Time the token sent is valid (Format: hours=3,minutes=17,seconds=300).' + subject: + type: string + minLength: 1 + template: + type: string + minLength: 1 + activate_user_on_success: + type: boolean + description: Activate users upon completion of stage. + recovery_max_attempts: + type: integer + maximum: 2147483647 + minimum: 0 + recovery_cache_timeout: + type: string + minLength: 1 + description: 'The time window used to count recent account recovery attempts. + If the number of attempts exceed recovery_max_attempts within this period, + further attempts will be rate-limited. (Format: hours=1;minutes=2;seconds=3).' + required: + - name + Endpoint: + type: object + description: Endpoint Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Pbm uuid + name: + type: string + provider: + type: integer + provider_obj: + allOf: + - $ref: '#/components/schemas/RACProvider' + readOnly: true + protocol: + $ref: '#/components/schemas/ProtocolEnum' + host: + type: string + settings: + type: object + additionalProperties: {} + property_mappings: + type: array + items: + type: string + format: uuid + auth_mode: + $ref: '#/components/schemas/EndpointAuthModeEnum' + launch_url: + type: string + nullable: true + description: |- + Build actual launch URL (the provider itself does not have one, just + individual endpoints) + readOnly: true + maximum_connections: + type: integer + maximum: 2147483647 + minimum: -2147483648 + required: + - auth_mode + - host + - launch_url + - name + - pk + - protocol + - provider + - provider_obj + EndpointAgentChallenge: + type: object + description: Signed challenge for authentik agent to respond to + properties: + flow_info: + $ref: '#/components/schemas/ContextualFlowInfo' + component: + type: string + default: ak-stage-endpoint-agent + response_errors: + type: object + additionalProperties: + type: array + items: + $ref: '#/components/schemas/ErrorDetail' + challenge: + type: string + challenge_idle_timeout: + type: integer + required: + - challenge + - challenge_idle_timeout + EndpointAgentChallengeResponseRequest: + type: object + description: Response to signed challenge + properties: + component: + type: string + minLength: 1 + default: ak-stage-endpoint-agent + response: + type: string + nullable: true + minLength: 1 + EndpointAuthModeEnum: + enum: + - static + - prompt + type: string + EndpointDevice: + type: object + properties: + device_uuid: + type: string + format: uuid + pbm_uuid: + type: string + format: uuid + readOnly: true + name: + type: string + access_group: + type: string + format: uuid + nullable: true + access_group_obj: + $ref: '#/components/schemas/DeviceAccessGroup' + expiring: + type: boolean + expires: + type: string + format: date-time + nullable: true + facts: + allOf: + - $ref: '#/components/schemas/DeviceFactSnapshot' + readOnly: true + nullable: true + attributes: + type: object + additionalProperties: {} + required: + - facts + - name + - pbm_uuid + EndpointDeviceDetails: + type: object + properties: + device_uuid: + type: string + format: uuid + pbm_uuid: + type: string + format: uuid + readOnly: true + name: + type: string + access_group: + type: string + format: uuid + nullable: true + access_group_obj: + $ref: '#/components/schemas/DeviceAccessGroup' + expiring: + type: boolean + expires: + type: string + format: date-time + nullable: true + facts: + allOf: + - $ref: '#/components/schemas/DeviceFactSnapshot' + readOnly: true + nullable: true + attributes: + type: object + additionalProperties: {} + connections_obj: + type: array + items: + $ref: '#/components/schemas/DeviceConnection' + policies: + type: array + items: + type: string + format: uuid + readOnly: true + connections: + type: array + items: + type: string + format: uuid + readOnly: true + required: + - connections + - connections_obj + - facts + - name + - pbm_uuid + - policies + EndpointDeviceRequest: + type: object + properties: + device_uuid: + type: string + format: uuid + name: + type: string + minLength: 1 + access_group: + type: string + format: uuid + nullable: true + access_group_obj: + $ref: '#/components/schemas/DeviceAccessGroupRequest' + expiring: + type: boolean + expires: + type: string + format: date-time + nullable: true + attributes: + type: object + additionalProperties: {} + required: + - name + EndpointRequest: + type: object + description: Endpoint Serializer + properties: + name: + type: string + minLength: 1 + provider: + type: integer + protocol: + $ref: '#/components/schemas/ProtocolEnum' + host: + type: string + minLength: 1 + settings: + type: object + additionalProperties: {} + property_mappings: + type: array + items: + type: string + format: uuid + auth_mode: + $ref: '#/components/schemas/EndpointAuthModeEnum' + maximum_connections: + type: integer + maximum: 2147483647 + minimum: -2147483648 + required: + - auth_mode + - host + - name + - protocol + - provider + EndpointStage: + type: object + description: EndpointStage Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Stage uuid + name: + type: string + component: + type: string + description: Get object type so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + flow_set: + type: array + items: + $ref: '#/components/schemas/FlowSet' + readOnly: true + connector: + type: string + format: uuid + connector_obj: + allOf: + - $ref: '#/components/schemas/Connector' + readOnly: true + mode: + $ref: '#/components/schemas/StageModeEnum' + required: + - component + - connector + - connector_obj + - flow_set + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + EndpointStageRequest: + type: object + description: EndpointStage Serializer + properties: + name: + type: string + minLength: 1 + connector: + type: string + format: uuid + mode: + $ref: '#/components/schemas/StageModeEnum' + required: + - connector + - name + EnrollRequest: + type: object + description: Base serializer class which doesn't implement create/update methods + properties: + device_serial: + type: string + minLength: 1 + device_name: + type: string + minLength: 1 + required: + - device_name + - device_serial + EnrollmentToken: + type: object + properties: + token_uuid: + type: string + format: uuid + readOnly: true + device_group: + type: string + format: uuid + nullable: true + device_group_obj: + allOf: + - $ref: '#/components/schemas/DeviceAccessGroup' + readOnly: true + nullable: true + connector: + type: string + format: uuid + name: + type: string + expiring: + type: boolean + expires: + type: string + format: date-time + nullable: true + required: + - connector + - device_group_obj + - name + - token_uuid + EnrollmentTokenRequest: + type: object + properties: + device_group: + type: string + format: uuid + nullable: true + connector: + type: string + format: uuid + name: + type: string + minLength: 1 + expiring: + type: boolean + expires: + type: string + format: date-time + nullable: true + required: + - connector + - name + ErrorDetail: + type: object + description: Serializer for rest_framework's error messages + properties: + string: + type: string + code: + type: string + required: + - code + - string + ErrorReportingConfig: + type: object + description: Config for error reporting + properties: + enabled: + type: boolean + readOnly: true + sentry_dsn: + type: string + readOnly: true + environment: + type: string + readOnly: true + send_pii: + type: boolean + readOnly: true + traces_sample_rate: + type: number + format: double + readOnly: true + required: + - enabled + - environment + - send_pii + - sentry_dsn + - traces_sample_rate + Event: + type: object + description: Event Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Event uuid + user: + type: object + additionalProperties: {} + action: + $ref: '#/components/schemas/EventActions' + app: + type: string + context: + type: object + additionalProperties: {} + client_ip: + type: string + nullable: true + created: + type: string + format: date-time + readOnly: true + expires: + type: string + format: date-time + brand: + type: object + additionalProperties: {} + required: + - action + - app + - created + - pk + EventActions: + enum: + - login + - login_failed + - logout + - user_write + - user_offboarded + - suspicious_request + - password_set + - secret_view + - secret_rotate + - invitation_used + - authorize_application + - source_linked + - impersonation_started + - impersonation_ended + - flow_execution + - policy_execution + - policy_exception + - property_mapping_exception + - system_task_execution + - system_task_exception + - system_exception + - configuration_error + - configuration_warning + - model_created + - model_updated + - model_deleted + - email_sent + - update_available + - export_ready + - review_initiated + - review_overdue + - review_attested + - review_completed + - access_request_created + - access_request_approved + - access_request_denied + - access_request_revoked + - custom_ + type: string + EventMatcherPolicy: + type: object + description: Event Matcher Policy Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Policy uuid + name: + type: string + execution_logging: + type: boolean + description: When this option is enabled, all executions of this policy + will be logged. By default, only execution errors are logged. + component: + type: string + description: Get object component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + bound_to: + type: integer + description: Return objects policy is bound to + readOnly: true + action: + allOf: + - $ref: '#/components/schemas/EventActions' + nullable: true + description: Match created events with this action type. When left empty, + all action types will be matched. + client_ip: + type: string + nullable: true + description: Matches Event's Client IP (strict matching, for network matching + use an Expression Policy) + app: + allOf: + - $ref: '#/components/schemas/AppEnum' + nullable: true + description: Match events created by selected application. When left empty, + all applications are matched. + model: + allOf: + - $ref: '#/components/schemas/ModelEnum' + nullable: true + description: Match events created by selected model. When left empty, all + models are matched. When an app is selected, all the application's models + are matched. + query: + type: string + nullable: true + required: + - bound_to + - component + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + EventMatcherPolicyRequest: + type: object + description: Event Matcher Policy Serializer + properties: + name: + type: string + minLength: 1 + execution_logging: + type: boolean + description: When this option is enabled, all executions of this policy + will be logged. By default, only execution errors are logged. + action: + allOf: + - $ref: '#/components/schemas/EventActions' + nullable: true + description: Match created events with this action type. When left empty, + all action types will be matched. + client_ip: + type: string + nullable: true + minLength: 1 + description: Matches Event's Client IP (strict matching, for network matching + use an Expression Policy) + app: + allOf: + - $ref: '#/components/schemas/AppEnum' + nullable: true + description: Match events created by selected application. When left empty, + all applications are matched. + model: + allOf: + - $ref: '#/components/schemas/ModelEnum' + nullable: true + description: Match events created by selected model. When left empty, all + models are matched. When an app is selected, all the application's models + are matched. + query: + type: string + nullable: true + minLength: 1 + required: + - name + EventRequest: + type: object + description: Event Serializer + properties: + user: + type: object + additionalProperties: {} + action: + $ref: '#/components/schemas/EventActions' + app: + type: string + minLength: 1 + context: + type: object + additionalProperties: {} + client_ip: + type: string + nullable: true + minLength: 1 + expires: + type: string + format: date-time + brand: + type: object + additionalProperties: {} + required: + - action + - app + EventStats: + type: object + description: Count of unique users in events and aggregated counts per specified + deltas + properties: + unique_users: + type: integer + count_step: + type: object + additionalProperties: {} + required: + - count_step + - unique_users + EventTopPerUser: + type: object + description: Response object of Event's top_per_user + properties: + application: + type: object + additionalProperties: {} + counted_events: + type: integer + unique_users: + type: integer + required: + - application + - counted_events + - unique_users + EventVolume: + type: object + description: Count of events of action created on day for a single event action + properties: + action: + $ref: '#/components/schemas/EventActions' + time: + type: string + format: date-time + count: + type: integer + required: + - action + - count + - time + EventsRequestedEnum: + enum: + - https://schemas.openid.net/secevent/caep/event-type/session-revoked + - https://schemas.openid.net/secevent/caep/event-type/token-claims-change + - https://schemas.openid.net/secevent/caep/event-type/credential-change + - https://schemas.openid.net/secevent/caep/event-type/assurance-level-change + - https://schemas.openid.net/secevent/caep/event-type/device-compliance-change + - https://schemas.openid.net/secevent/caep/event-type/session-established + - https://schemas.openid.net/secevent/caep/event-type/session-presented + - https://schemas.openid.net/secevent/caep/event-type/risk-level-change + - https://schemas.openid.net/secevent/ssf/event-type/verification + type: string + ExpiringBaseGrantModel: + type: object + description: Serializer for BaseGrantModel and ExpiringBaseGrant + properties: + pk: + type: integer + readOnly: true + title: ID + provider: + $ref: '#/components/schemas/Provider' + user: + $ref: '#/components/schemas/User' + is_expired: + type: boolean + description: Check if token is expired yet. + readOnly: true + expires: + type: string + format: date-time + nullable: true + scope: + type: array + items: + type: string + required: + - is_expired + - pk + - provider + - scope + - user + ExpressionPolicy: + type: object + description: Group Membership Policy Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Policy uuid + name: + type: string + execution_logging: + type: boolean + description: When this option is enabled, all executions of this policy + will be logged. By default, only execution errors are logged. + component: + type: string + description: Get object component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + bound_to: + type: integer + description: Return objects policy is bound to + readOnly: true + expression: + type: string + required: + - bound_to + - component + - expression + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + ExpressionPolicyRequest: + type: object + description: Group Membership Policy Serializer + properties: + name: + type: string + minLength: 1 + execution_logging: + type: boolean + description: When this option is enabled, all executions of this policy + will be logged. By default, only execution errors are logged. + expression: + type: string + minLength: 1 + required: + - expression + - name + ExtraRoleObjectPermission: + type: object + description: Role permission with additional object-related data + properties: + id: + type: integer + readOnly: true + codename: + type: string + readOnly: true + model: + type: string + title: Python model class name + readOnly: true + app_label: + type: string + readOnly: true + object_pk: + type: string + name: + type: string + readOnly: true + app_label_verbose: + type: string + description: Get app label from permission's model + readOnly: true + model_verbose: + type: string + description: Get model label from permission's model + readOnly: true + object_description: + type: string + nullable: true + description: |- + Get model description from attached model. This operation takes at least + one additional query, and the description is only shown if the role has the + view_ permission on the object + readOnly: true + required: + - app_label + - app_label_verbose + - codename + - id + - model + - model_verbose + - name + - object_description + - object_pk + FileList: + type: object + description: Base serializer class which doesn't implement create/update methods + properties: + name: + type: string + mime_type: + type: string + url: + type: string + themed_urls: + allOf: + - $ref: '#/components/schemas/ThemedUrls' + nullable: true + required: + - mime_type + - name + - url + FileUploadRequest: + type: object + description: Base serializer class which doesn't implement create/update methods + properties: + file: + type: string + format: binary + name: + type: string + usage: + type: string + minLength: 1 + default: media + required: + - file + FleetConnector: + type: object + description: FleetConnector Serializer + properties: + connector_uuid: + type: string + format: uuid + name: + type: string + enabled: + type: boolean + component: + type: string + description: Get object component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + url: + type: string + format: uri + maxLength: 200 + headers_mapping: + type: string + format: uuid + nullable: true + description: Configure additional headers to be sent. Mapping should return + a dictionary of key-value pairs + map_users: + type: boolean + map_teams_access_group: + type: boolean + required: + - component + - meta_model_name + - name + - url + - verbose_name + - verbose_name_plural + FleetConnectorRequest: + type: object + description: FleetConnector Serializer + properties: + connector_uuid: + type: string + format: uuid + name: + type: string + minLength: 1 + enabled: + type: boolean + url: + type: string + format: uri + minLength: 1 + maxLength: 200 + token: + type: string + writeOnly: true + minLength: 1 + headers_mapping: + type: string + format: uuid + nullable: true + description: Configure additional headers to be sent. Mapping should return + a dictionary of key-value pairs + map_users: + type: boolean + map_teams_access_group: + type: boolean + required: + - name + - token + - url + Flow: + type: object + description: Flow Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Flow uuid + policybindingmodel_ptr_id: + type: string + format: uuid + readOnly: true + name: + type: string + slug: + type: string + description: Visible in the URL. + pattern: ^[-a-zA-Z0-9_]+$ + title: + type: string + description: Shown as the Title in Flow pages. + designation: + allOf: + - $ref: '#/components/schemas/FlowDesignationEnum' + description: Decides what this Flow is used for. For example, the Authentication + flow is redirect to when an un-authenticated user visits authentik. + background: + type: string + description: Background shown during execution + background_url: + type: string + description: Get the URL to the background image + readOnly: true + background_themed_urls: + allOf: + - $ref: '#/components/schemas/ThemedUrls' + readOnly: true + nullable: true + stages: + type: array + items: + type: string + format: uuid + readOnly: true + policies: + type: array + items: + type: string + format: uuid + readOnly: true + cache_count: + type: integer + description: Get count of cached flows + readOnly: true + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + compatibility_mode: + type: boolean + description: Enable compatibility mode, increases compatibility with password + managers on mobile devices. + export_url: + type: string + description: Get export URL for flow + readOnly: true + layout: + $ref: '#/components/schemas/FlowLayoutEnum' + denied_action: + allOf: + - $ref: '#/components/schemas/DeniedActionEnum' + description: Configure what should happen when a flow denies access to a + user. + authentication: + allOf: + - $ref: '#/components/schemas/AuthenticationEnum' + description: Required level of authentication and authorization to access + a flow. + required: + - background_themed_urls + - background_url + - cache_count + - designation + - export_url + - name + - pk + - policies + - policybindingmodel_ptr_id + - slug + - stages + - title + FlowChallengeResponseRequest: + oneOf: + - $ref: '#/components/schemas/AppleChallengeResponseRequest' + - $ref: '#/components/schemas/AuthenticatorDuoChallengeResponseRequest' + - $ref: '#/components/schemas/AuthenticatorEmailChallengeResponseRequest' + - $ref: '#/components/schemas/AuthenticatorSMSChallengeResponseRequest' + - $ref: '#/components/schemas/AuthenticatorStaticChallengeResponseRequest' + - $ref: '#/components/schemas/AuthenticatorTOTPChallengeResponseRequest' + - $ref: '#/components/schemas/AuthenticatorValidationChallengeResponseRequest' + - $ref: '#/components/schemas/AuthenticatorWebAuthnChallengeResponseRequest' + - $ref: '#/components/schemas/AutoSubmitChallengeResponseRequest' + - $ref: '#/components/schemas/CaptchaChallengeResponseRequest' + - $ref: '#/components/schemas/ConsentChallengeResponseRequest' + - $ref: '#/components/schemas/EmailChallengeResponseRequest' + - $ref: '#/components/schemas/EndpointAgentChallengeResponseRequest' + - $ref: '#/components/schemas/FrameChallengeResponseRequest' + - $ref: '#/components/schemas/IdentificationChallengeResponseRequest' + - $ref: '#/components/schemas/IframeLogoutChallengeResponseRequest' + - $ref: '#/components/schemas/NativeLogoutChallengeResponseRequest' + - $ref: '#/components/schemas/OAuthDeviceCodeChallengeResponseRequest' + - $ref: '#/components/schemas/OAuthDeviceCodeFinishChallengeResponseRequest' + - $ref: '#/components/schemas/PasswordChallengeResponseRequest' + - $ref: '#/components/schemas/PlexAuthenticationChallengeResponseRequest' + - $ref: '#/components/schemas/PromptChallengeResponseRequest' + - $ref: '#/components/schemas/RedirectChallengeResponseRequest' + - $ref: '#/components/schemas/TelegramChallengeResponseRequest' + - $ref: '#/components/schemas/UserLoginChallengeResponseRequest' + discriminator: + propertyName: component + mapping: + ak-source-oauth-apple: '#/components/schemas/AppleChallengeResponseRequest' + ak-stage-authenticator-duo: '#/components/schemas/AuthenticatorDuoChallengeResponseRequest' + ak-stage-authenticator-email: '#/components/schemas/AuthenticatorEmailChallengeResponseRequest' + ak-stage-authenticator-sms: '#/components/schemas/AuthenticatorSMSChallengeResponseRequest' + ak-stage-authenticator-static: '#/components/schemas/AuthenticatorStaticChallengeResponseRequest' + ak-stage-authenticator-totp: '#/components/schemas/AuthenticatorTOTPChallengeResponseRequest' + ak-stage-authenticator-validate: '#/components/schemas/AuthenticatorValidationChallengeResponseRequest' + ak-stage-authenticator-webauthn: '#/components/schemas/AuthenticatorWebAuthnChallengeResponseRequest' + ak-stage-autosubmit: '#/components/schemas/AutoSubmitChallengeResponseRequest' + ak-stage-captcha: '#/components/schemas/CaptchaChallengeResponseRequest' + ak-stage-consent: '#/components/schemas/ConsentChallengeResponseRequest' + ak-stage-email: '#/components/schemas/EmailChallengeResponseRequest' + ak-stage-endpoint-agent: '#/components/schemas/EndpointAgentChallengeResponseRequest' + xak-flow-frame: '#/components/schemas/FrameChallengeResponseRequest' + ak-stage-identification: '#/components/schemas/IdentificationChallengeResponseRequest' + ak-provider-iframe-logout: '#/components/schemas/IframeLogoutChallengeResponseRequest' + ak-provider-saml-native-logout: '#/components/schemas/NativeLogoutChallengeResponseRequest' + ak-provider-oauth2-device-code: '#/components/schemas/OAuthDeviceCodeChallengeResponseRequest' + ak-provider-oauth2-device-code-finish: '#/components/schemas/OAuthDeviceCodeFinishChallengeResponseRequest' + ak-stage-password: '#/components/schemas/PasswordChallengeResponseRequest' + ak-source-plex: '#/components/schemas/PlexAuthenticationChallengeResponseRequest' + ak-stage-prompt: '#/components/schemas/PromptChallengeResponseRequest' + xak-flow-redirect: '#/components/schemas/RedirectChallengeResponseRequest' + ak-source-telegram: '#/components/schemas/TelegramChallengeResponseRequest' + ak-stage-user-login: '#/components/schemas/UserLoginChallengeResponseRequest' + FlowDesignationEnum: + enum: + - authentication + - authorization + - invalidation + - enrollment + - unenrollment + - recovery + - stage_configuration + type: string + FlowDiagram: + type: object + description: response of the flow's diagram action + properties: + diagram: + type: string + readOnly: true + required: + - diagram + FlowErrorChallenge: + type: object + description: |- + Challenge class when an unhandled error occurs during a stage. Normal users + are shown an error message, superusers are shown a full stacktrace. + properties: + flow_info: + $ref: '#/components/schemas/ContextualFlowInfo' + component: + type: string + default: ak-stage-flow-error + response_errors: + type: object + additionalProperties: + type: array + items: + $ref: '#/components/schemas/ErrorDetail' + request_id: + type: string + error: + type: string + traceback: + type: string + required: + - request_id + FlowInspection: + type: object + description: Serializer for inspect endpoint + properties: + plans: + type: array + items: + $ref: '#/components/schemas/FlowInspectorPlan' + current_plan: + $ref: '#/components/schemas/FlowInspectorPlan' + is_completed: + type: boolean + required: + - is_completed + - plans + FlowInspectorPlan: + type: object + description: Serializer for an active FlowPlan + properties: + current_stage: + allOf: + - $ref: '#/components/schemas/FlowStageBinding' + readOnly: true + next_planned_stage: + allOf: + - $ref: '#/components/schemas/FlowStageBinding' + readOnly: true + plan_context: + type: object + additionalProperties: {} + description: Get the plan's context, sanitized + readOnly: true + session_id: + type: string + description: Get a unique session ID + readOnly: true + required: + - current_stage + - next_planned_stage + - plan_context + - session_id + FlowLayoutEnum: + enum: + - stacked + - content_left + - content_right + - sidebar_left + - sidebar_right + - sidebar_left_frame_background + - sidebar_right_frame_background + type: string + FlowRequest: + type: object + description: Flow Serializer + properties: + name: + type: string + minLength: 1 + slug: + type: string + minLength: 1 + description: Visible in the URL. + pattern: ^[-a-zA-Z0-9_]+$ + title: + type: string + minLength: 1 + description: Shown as the Title in Flow pages. + designation: + allOf: + - $ref: '#/components/schemas/FlowDesignationEnum' + description: Decides what this Flow is used for. For example, the Authentication + flow is redirect to when an un-authenticated user visits authentik. + background: + type: string + description: Background shown during execution + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + compatibility_mode: + type: boolean + description: Enable compatibility mode, increases compatibility with password + managers on mobile devices. + layout: + $ref: '#/components/schemas/FlowLayoutEnum' + denied_action: + allOf: + - $ref: '#/components/schemas/DeniedActionEnum' + description: Configure what should happen when a flow denies access to a + user. + authentication: + allOf: + - $ref: '#/components/schemas/AuthenticationEnum' + description: Required level of authentication and authorization to access + a flow. + required: + - designation + - name + - slug + - title + FlowSet: + type: object + description: Stripped down flow serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Flow uuid + policybindingmodel_ptr_id: + type: string + format: uuid + readOnly: true + name: + type: string + slug: + type: string + description: Visible in the URL. + pattern: ^[-a-zA-Z0-9_]+$ + title: + type: string + description: Shown as the Title in Flow pages. + designation: + allOf: + - $ref: '#/components/schemas/FlowDesignationEnum' + description: Decides what this Flow is used for. For example, the Authentication + flow is redirect to when an un-authenticated user visits authentik. + background_url: + type: string + description: Get the URL to the background image + readOnly: true + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + compatibility_mode: + type: boolean + description: Enable compatibility mode, increases compatibility with password + managers on mobile devices. + export_url: + type: string + description: Get export URL for flow + readOnly: true + layout: + $ref: '#/components/schemas/FlowLayoutEnum' + denied_action: + allOf: + - $ref: '#/components/schemas/DeniedActionEnum' + description: Configure what should happen when a flow denies access to a + user. + required: + - background_url + - designation + - export_url + - name + - pk + - policybindingmodel_ptr_id + - slug + - title + FlowStageBinding: + type: object + description: FlowStageBinding Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Fsb uuid + policybindingmodel_ptr_id: + type: string + format: uuid + readOnly: true + target: + type: string + format: uuid + stage: + type: string + format: uuid + stage_obj: + allOf: + - $ref: '#/components/schemas/Stage' + readOnly: true + evaluate_on_plan: + type: boolean + description: Evaluate policies during the Flow planning process. + re_evaluate_policies: + type: boolean + description: Evaluate policies when the Stage is presented to the user. + order: + type: integer + maximum: 2147483647 + minimum: -2147483648 + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + invalid_response_action: + allOf: + - $ref: '#/components/schemas/InvalidResponseActionEnum' + description: Configure how the flow executor should handle an invalid response + to a challenge. RETRY returns the error message and a similar challenge + to the executor. RESTART restarts the flow from the beginning, and RESTART_WITH_CONTEXT + restarts the flow while keeping the current context. + required: + - order + - pk + - policybindingmodel_ptr_id + - stage + - stage_obj + - target + FlowStageBindingRequest: + type: object + description: FlowStageBinding Serializer + properties: + target: + type: string + format: uuid + stage: + type: string + format: uuid + evaluate_on_plan: + type: boolean + description: Evaluate policies during the Flow planning process. + re_evaluate_policies: + type: boolean + description: Evaluate policies when the Stage is presented to the user. + order: + type: integer + maximum: 2147483647 + minimum: -2147483648 + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + invalid_response_action: + allOf: + - $ref: '#/components/schemas/InvalidResponseActionEnum' + description: Configure how the flow executor should handle an invalid response + to a challenge. RETRY returns the error message and a similar challenge + to the executor. RESTART restarts the flow from the beginning, and RESTART_WITH_CONTEXT + restarts the flow while keeping the current context. + required: + - order + - stage + - target + FooterLink: + type: object + description: Links returned in Config API + properties: + href: + type: string + readOnly: true + nullable: true + name: + type: string + readOnly: true + required: + - href + - name + ForceBindingEnum: + type: string + enum: + - urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST + - urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect + FormatEnum: + type: string + enum: + - json + - yaml + FrameChallenge: + type: object + description: Challenge type to render a frame + properties: + flow_info: + $ref: '#/components/schemas/ContextualFlowInfo' + component: + type: string + default: xak-flow-frame + response_errors: + type: object + additionalProperties: + type: array + items: + $ref: '#/components/schemas/ErrorDetail' + url: + type: string + loading_overlay: + type: boolean + default: false + loading_text: + type: string + required: + - loading_text + - url + FrameChallengeResponseRequest: + type: object + description: Base class for all challenge responses + properties: + component: + type: string + minLength: 1 + default: xak-flow-frame + GenericError: + type: object + description: Generic API Error + properties: + detail: + type: string + code: + type: string + required: + - detail + GeoIPPolicy: + type: object + description: GeoIP Policy Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Policy uuid + name: + type: string + execution_logging: + type: boolean + description: When this option is enabled, all executions of this policy + will be logged. By default, only execution errors are logged. + component: + type: string + description: Get object component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + bound_to: + type: integer + description: Return objects policy is bound to + readOnly: true + asns: + type: array + items: + type: integer + maximum: 2147483647 + minimum: -2147483648 + countries: + type: array + items: + $ref: '#/components/schemas/CountryCodeEnum' + maxItems: 249 + countries_obj: + type: array + items: + type: object + properties: + code: + type: string + minLength: 2 + maxLength: 2 + name: + type: string + required: + - code + - name + readOnly: true + check_history_distance: + type: boolean + history_max_distance_km: + type: integer + maximum: 9223372036854775807 + minimum: 0 + format: int64 + distance_tolerance_km: + type: integer + maximum: 2147483647 + minimum: 0 + history_login_count: + type: integer + maximum: 2147483647 + minimum: 0 + check_impossible_travel: + type: boolean + impossible_tolerance_km: + type: integer + maximum: 2147483647 + minimum: 0 + required: + - bound_to + - component + - countries + - countries_obj + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + GeoIPPolicyRequest: + type: object + description: GeoIP Policy Serializer + properties: + name: + type: string + minLength: 1 + execution_logging: + type: boolean + description: When this option is enabled, all executions of this policy + will be logged. By default, only execution errors are logged. + asns: + type: array + items: + type: integer + maximum: 2147483647 + minimum: -2147483648 + countries: + type: array + items: + $ref: '#/components/schemas/CountryCodeEnum' + maxItems: 249 + check_history_distance: + type: boolean + history_max_distance_km: + type: integer + maximum: 9223372036854775807 + minimum: 0 + format: int64 + distance_tolerance_km: + type: integer + maximum: 2147483647 + minimum: 0 + history_login_count: + type: integer + maximum: 2147483647 + minimum: 0 + check_impossible_travel: + type: boolean + impossible_tolerance_km: + type: integer + maximum: 2147483647 + minimum: 0 + required: + - countries + - name + GeoipBindingEnum: + enum: + - no_binding + - bind_continent + - bind_continent_country + - bind_continent_country_city + type: string + GlobalTaskStatus: + type: object + properties: + queued: + type: integer + readOnly: true + consumed: + type: integer + readOnly: true + preprocess: + type: integer + readOnly: true + running: + type: integer + readOnly: true + postprocess: + type: integer + readOnly: true + rejected: + type: integer + readOnly: true + done: + type: integer + readOnly: true + info: + type: integer + readOnly: true + warning: + type: integer + readOnly: true + error: + type: integer + readOnly: true + required: + - consumed + - done + - error + - info + - postprocess + - preprocess + - queued + - rejected + - running + - warning + GoogleChromeConnector: + type: object + description: GoogleChromeConnector Serializer + properties: + connector_uuid: + type: string + format: uuid + name: + type: string + enabled: + type: boolean + component: + type: string + description: Get object component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + credentials: + type: object + additionalProperties: {} + chrome_url: + type: string + nullable: true + description: Full URL to be used in Google Workspace configuration + readOnly: true + required: + - chrome_url + - component + - credentials + - meta_model_name + - name + - verbose_name + - verbose_name_plural + GoogleChromeConnectorRequest: + type: object + description: GoogleChromeConnector Serializer + properties: + connector_uuid: + type: string + format: uuid + name: + type: string + minLength: 1 + enabled: + type: boolean + credentials: + type: object + additionalProperties: {} + required: + - credentials + - name + GoogleEndpointDevice: + type: object + description: Serializer for Endpoint authenticator devices + properties: + pk: + type: string + format: uuid + title: Uuid + name: + type: string + description: The human-readable name of this device. + maxLength: 64 + required: + - name + GoogleEndpointDeviceRequest: + type: object + description: Serializer for Endpoint authenticator devices + properties: + pk: + type: string + format: uuid + title: Uuid + name: + type: string + minLength: 1 + description: The human-readable name of this device. + maxLength: 64 + required: + - name + GoogleWorkspaceProvider: + type: object + description: GoogleWorkspaceProvider Serializer + properties: + pk: + type: integer + readOnly: true + title: ID + name: + type: string + property_mappings: + type: array + items: + type: string + format: uuid + property_mappings_group: + type: array + items: + type: string + format: uuid + description: Property mappings used for group creation/updating. + component: + type: string + description: Get object component so that we know how to edit the object + readOnly: true + assigned_backchannel_application_slug: + type: string + description: Internal application name, used in URLs. + readOnly: true + nullable: true + assigned_backchannel_application_name: + type: string + description: Application's display Name. + readOnly: true + nullable: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + delegated_subject: + type: string + format: email + maxLength: 254 + credentials: + type: object + additionalProperties: {} + scopes: + type: string + exclude_users_service_account: + type: boolean + filter_group: + type: string + format: uuid + nullable: true + user_delete_action: + $ref: '#/components/schemas/OutgoingSyncDeleteAction' + group_delete_action: + $ref: '#/components/schemas/OutgoingSyncDeleteAction' + default_group_email_domain: + type: string + sync_page_size: + type: integer + maximum: 2147483647 + minimum: 1 + description: Controls the number of objects synced in a single task + sync_page_timeout: + type: string + description: Timeout for synchronization of a single page + dry_run: + type: boolean + description: When enabled, provider will not modify or create objects in + the remote system. + discovery_enabled: + type: boolean + description: When enabled, authentik will attempt to discover existing resources + in the remote system. + required: + - assigned_backchannel_application_name + - assigned_backchannel_application_slug + - component + - credentials + - default_group_email_domain + - delegated_subject + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + GoogleWorkspaceProviderGroup: + type: object + description: GoogleWorkspaceProviderGroup Serializer + properties: + id: + type: string + format: uuid + readOnly: true + google_id: + type: string + group: + type: string + format: uuid + group_obj: + allOf: + - $ref: '#/components/schemas/PartialGroup' + readOnly: true + provider: + type: integer + attributes: + type: object + additionalProperties: {} + readOnly: true + required: + - attributes + - google_id + - group + - group_obj + - id + - provider + GoogleWorkspaceProviderGroupRequest: + type: object + description: GoogleWorkspaceProviderGroup Serializer + properties: + google_id: + type: string + minLength: 1 + group: + type: string + format: uuid + provider: + type: integer + required: + - google_id + - group + - provider + GoogleWorkspaceProviderMapping: + type: object + description: GoogleWorkspaceProviderMapping Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Pm uuid + managed: + type: string + nullable: true + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + expression: + type: string + component: + type: string + description: Get object's component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + required: + - component + - expression + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + GoogleWorkspaceProviderMappingRequest: + type: object + description: GoogleWorkspaceProviderMapping Serializer + properties: + managed: + type: string + nullable: true + minLength: 1 + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + minLength: 1 + expression: + type: string + minLength: 1 + required: + - expression + - name + GoogleWorkspaceProviderRequest: + type: object + description: GoogleWorkspaceProvider Serializer + properties: + name: + type: string + minLength: 1 + property_mappings: + type: array + items: + type: string + format: uuid + property_mappings_group: + type: array + items: + type: string + format: uuid + description: Property mappings used for group creation/updating. + delegated_subject: + type: string + format: email + minLength: 1 + maxLength: 254 + credentials: + type: object + additionalProperties: {} + scopes: + type: string + minLength: 1 + exclude_users_service_account: + type: boolean + filter_group: + type: string + format: uuid + nullable: true + user_delete_action: + $ref: '#/components/schemas/OutgoingSyncDeleteAction' + group_delete_action: + $ref: '#/components/schemas/OutgoingSyncDeleteAction' + default_group_email_domain: + type: string + minLength: 1 + sync_page_size: + type: integer + maximum: 2147483647 + minimum: 1 + description: Controls the number of objects synced in a single task + sync_page_timeout: + type: string + minLength: 1 + description: Timeout for synchronization of a single page + dry_run: + type: boolean + description: When enabled, provider will not modify or create objects in + the remote system. + discovery_enabled: + type: boolean + description: When enabled, authentik will attempt to discover existing resources + in the remote system. + required: + - credentials + - default_group_email_domain + - delegated_subject + - name + GoogleWorkspaceProviderUser: + type: object + description: GoogleWorkspaceProviderUser Serializer + properties: + id: + type: string + format: uuid + readOnly: true + google_id: + type: string + user: + type: integer + user_obj: + allOf: + - $ref: '#/components/schemas/PartialUser' + readOnly: true + provider: + type: integer + attributes: + type: object + additionalProperties: {} + readOnly: true + required: + - attributes + - google_id + - id + - provider + - user + - user_obj + GoogleWorkspaceProviderUserRequest: + type: object + description: GoogleWorkspaceProviderUser Serializer + properties: + google_id: + type: string + minLength: 1 + user: + type: integer + provider: + type: integer + required: + - google_id + - provider + - user + GrantRequest: + type: object + description: |- + Mixin to validate that a valid enterprise license + exists before allowing to save the object + properties: + created: + type: string + format: date-time + readOnly: true + created_by: + allOf: + - $ref: '#/components/schemas/PartialUser' + readOnly: true + requester_data: + type: object + additionalProperties: {} + fulfiller_data: + type: object + additionalProperties: {} + revoked_by: + allOf: + - $ref: '#/components/schemas/PartialUser' + readOnly: true + nullable: true + agent_owner: + allOf: + - $ref: '#/components/schemas/PartialUser' + readOnly: true + nullable: true + is_active: + type: boolean + readOnly: true + expires: + type: string + format: date-time + nullable: true + status: + allOf: + - $ref: '#/components/schemas/RequestStatus' + readOnly: true + targets: + type: array + items: + type: string + format: uuid + readOnly: true + target_objs: + type: array + items: + $ref: '#/components/schemas/RequestableTarget' + readOnly: true + uuid: + type: string + format: uuid + required: + - agent_owner + - created + - created_by + - is_active + - revoked_by + - status + - target_objs + - targets + GrantRequestCreateRequest: + type: object + description: Base serializer class which doesn't implement create/update methods + properties: + pbms: + type: array + items: + type: string + format: uuid + expiry: + type: string + description: Optional override for how long the grant should last once approved. + Clamped to the granting rule binding(s)' expiry_granted_max. + required: + - pbms + GrantTypeEnum: + enum: + - authorization_code + - implicit + - hybrid + - refresh_token + - client_credentials + - password + - urn:ietf:params:oauth:grant-type:device_code + - urn:ietf:params:oauth:grant-type:token-exchange + type: string + Group: + type: object + description: Group Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Group uuid + num_pk: + type: integer + readOnly: true + name: + type: string + is_superuser: + type: boolean + description: Users added to this group will be superusers. + parents: + type: array + items: + type: string + format: uuid + parents_obj: + type: array + items: + $ref: '#/components/schemas/RelatedGroup' + readOnly: true + nullable: true + users: + type: array + items: + type: integer + users_obj: + type: array + items: + $ref: '#/components/schemas/PartialUser' + readOnly: true + nullable: true + attributes: + type: object + additionalProperties: {} + roles: + type: array + items: + type: string + format: uuid + roles_obj: + type: array + items: + $ref: '#/components/schemas/Role' + readOnly: true + inherited_roles_obj: + type: array + items: + $ref: '#/components/schemas/Role' + readOnly: true + nullable: true + children: + type: array + items: + type: string + format: uuid + readOnly: true + children_obj: + type: array + items: + $ref: '#/components/schemas/RelatedGroup' + readOnly: true + nullable: true + required: + - children + - children_obj + - inherited_roles_obj + - name + - num_pk + - parents_obj + - pk + - roles_obj + - users_obj + GroupKerberosSourceConnection: + type: object + description: Group Source Connection + properties: + pk: + type: integer + readOnly: true + title: ID + group: + type: string + format: uuid + readOnly: true + source: + type: string + format: uuid + source_obj: + allOf: + - $ref: '#/components/schemas/Source' + readOnly: true + identifier: + type: string + created: + type: string + format: date-time + readOnly: true + last_updated: + type: string + format: date-time + readOnly: true + required: + - created + - group + - identifier + - last_updated + - pk + - source + - source_obj + GroupKerberosSourceConnectionRequest: + type: object + description: Group Source Connection + properties: + source: + type: string + format: uuid + identifier: + type: string + minLength: 1 + required: + - identifier + - source + GroupLDAPSourceConnection: + type: object + description: Group Source Connection + properties: + pk: + type: integer + readOnly: true + title: ID + group: + type: string + format: uuid + readOnly: true + source: + type: string + format: uuid + source_obj: + allOf: + - $ref: '#/components/schemas/Source' + readOnly: true + identifier: + type: string + created: + type: string + format: date-time + readOnly: true + last_updated: + type: string + format: date-time + readOnly: true + group_obj: + allOf: + - $ref: '#/components/schemas/PartialGroup' + readOnly: true + required: + - created + - group + - group_obj + - identifier + - last_updated + - pk + - source + - source_obj + GroupLDAPSourceConnectionRequest: + type: object + description: Group Source Connection + properties: + source: + type: string + format: uuid + identifier: + type: string + minLength: 1 + required: + - identifier + - source + GroupMatchingModeEnum: + enum: + - identifier + - name_link + - name_deny + type: string + GroupOAuthSourceConnection: + type: object + description: Group Source Connection + properties: + pk: + type: integer + readOnly: true + title: ID + group: + type: string + format: uuid + readOnly: true + source: + type: string + format: uuid + source_obj: + allOf: + - $ref: '#/components/schemas/Source' + readOnly: true + identifier: + type: string + created: + type: string + format: date-time + readOnly: true + last_updated: + type: string + format: date-time + readOnly: true + required: + - created + - group + - identifier + - last_updated + - pk + - source + - source_obj + GroupOAuthSourceConnectionRequest: + type: object + description: Group Source Connection + properties: + source: + type: string + format: uuid + identifier: + type: string + minLength: 1 + required: + - identifier + - source + GroupPlexSourceConnection: + type: object + description: Group Source Connection + properties: + pk: + type: integer + readOnly: true + title: ID + group: + type: string + format: uuid + readOnly: true + source: + type: string + format: uuid + source_obj: + allOf: + - $ref: '#/components/schemas/Source' + readOnly: true + identifier: + type: string + created: + type: string + format: date-time + readOnly: true + last_updated: + type: string + format: date-time + readOnly: true + required: + - created + - group + - identifier + - last_updated + - pk + - source + - source_obj + GroupPlexSourceConnectionRequest: + type: object + description: Group Source Connection + properties: + source: + type: string + format: uuid + identifier: + type: string + minLength: 1 + required: + - identifier + - source + GroupRequest: + type: object + description: Group Serializer + properties: + name: + type: string + minLength: 1 + is_superuser: + type: boolean + description: Users added to this group will be superusers. + parents: + type: array + items: + type: string + format: uuid + users: + type: array + items: + type: integer + attributes: + type: object + additionalProperties: {} + roles: + type: array + items: + type: string + format: uuid + required: + - name + GroupSAMLSourceConnection: + type: object + description: Group Source Connection + properties: + pk: + type: integer + readOnly: true + title: ID + group: + type: string + format: uuid + readOnly: true + source: + type: string + format: uuid + source_obj: + allOf: + - $ref: '#/components/schemas/Source' + readOnly: true + identifier: + type: string + created: + type: string + format: date-time + readOnly: true + last_updated: + type: string + format: date-time + readOnly: true + required: + - created + - group + - identifier + - last_updated + - pk + - source + - source_obj + GroupSAMLSourceConnectionRequest: + type: object + description: Group Source Connection + properties: + source: + type: string + format: uuid + identifier: + type: string + minLength: 1 + required: + - identifier + - source + GroupSourceConnection: + type: object + description: Group Source Connection + properties: + pk: + type: integer + readOnly: true + title: ID + group: + type: string + format: uuid + readOnly: true + source: + type: string + format: uuid + source_obj: + allOf: + - $ref: '#/components/schemas/Source' + readOnly: true + identifier: + type: string + created: + type: string + format: date-time + readOnly: true + last_updated: + type: string + format: date-time + readOnly: true + required: + - created + - group + - identifier + - last_updated + - pk + - source + - source_obj + GroupSourceConnectionRequest: + type: object + description: Group Source Connection + properties: + source: + type: string + format: uuid + identifier: + type: string + minLength: 1 + required: + - identifier + - source + GroupTelegramSourceConnection: + type: object + description: Group Source Connection + properties: + pk: + type: integer + readOnly: true + title: ID + group: + type: string + format: uuid + readOnly: true + source: + type: string + format: uuid + source_obj: + allOf: + - $ref: '#/components/schemas/Source' + readOnly: true + identifier: + type: string + created: + type: string + format: date-time + readOnly: true + last_updated: + type: string + format: date-time + readOnly: true + required: + - created + - group + - identifier + - last_updated + - pk + - source + - source_obj + GroupTelegramSourceConnectionRequest: + type: object + description: Group Source Connection + properties: + source: + type: string + format: uuid + identifier: + type: string + minLength: 1 + required: + - identifier + - source + Hardware: + type: object + properties: + model: + type: string + manufacturer: + type: string + serial: + type: string + cpu_name: + type: string + cpu_count: + type: integer + memory_bytes: + type: integer + format: int64 + required: + - serial + HardwareRequest: + type: object + properties: + model: + type: string + minLength: 1 + manufacturer: + type: string + minLength: 1 + serial: + type: string + minLength: 1 + cpu_name: + type: string + minLength: 1 + cpu_count: + type: integer + memory_bytes: + type: integer + format: int64 + required: + - serial + IdentificationChallenge: + type: object + description: Identification challenges with all UI elements + properties: + flow_info: + $ref: '#/components/schemas/ContextualFlowInfo' + component: + type: string + default: ak-stage-identification + response_errors: + type: object + additionalProperties: + type: array + items: + $ref: '#/components/schemas/ErrorDetail' + user_fields: + type: array + items: + type: string + nullable: true + pending_user_identifier: + type: string + nullable: true + password_fields: + type: boolean + allow_show_password: + type: boolean + default: false + application_pre: + type: string + application_pre_launch: + type: string + flow_designation: + $ref: '#/components/schemas/FlowDesignationEnum' + captcha_stage: + allOf: + - $ref: '#/components/schemas/CaptchaChallenge' + nullable: true + enroll_url: + type: string + recovery_url: + type: string + passwordless_url: + type: string + primary_action: + type: string + sources: + type: array + items: + $ref: '#/components/schemas/LoginSource' + show_source_labels: + type: boolean + enable_remember_me: + type: boolean + default: true + passkey_challenge: + type: object + additionalProperties: {} + nullable: true + required: + - flow_designation + - password_fields + - primary_action + - show_source_labels + - user_fields + IdentificationChallengeResponseRequest: + type: object + description: Identification challenge + properties: + component: + type: string + minLength: 1 + default: ak-stage-identification + uid_field: + type: string + nullable: true + password: + type: string + nullable: true + captcha_token: + type: string + nullable: true + passkey: + type: object + additionalProperties: {} + nullable: true + IdentificationStage: + type: object + description: IdentificationStage Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Stage uuid + name: + type: string + component: + type: string + description: Get object type so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + flow_set: + type: array + items: + $ref: '#/components/schemas/FlowSet' + readOnly: true + user_fields: + type: array + items: + $ref: '#/components/schemas/UserFieldsEnum' + description: Fields of the user object to match against. (Hold shift to + select multiple options) + password_stage: + type: string + format: uuid + nullable: true + description: When set, shows a password field, instead of showing the password + field as separate step. + captcha_stage: + type: string + format: uuid + nullable: true + description: When set, adds functionality exactly like a Captcha stage, + but baked into the Identification stage. + case_insensitive_matching: + type: boolean + description: When enabled, user fields are matched regardless of their casing. + show_matched_user: + type: boolean + description: When a valid username/email has been entered, and this option + is enabled, the user's username and avatar will be shown. Otherwise, the + text that the user entered will be shown + enrollment_flow: + type: string + format: uuid + nullable: true + description: Optional enrollment flow, which is linked at the bottom of + the page. + recovery_flow: + type: string + format: uuid + nullable: true + description: Optional recovery flow, which is linked at the bottom of the + page. + passwordless_flow: + type: string + format: uuid + nullable: true + description: Optional passwordless flow, which is linked at the bottom of + the page. + sources: + type: array + items: + type: string + format: uuid + description: Specify which sources should be shown. + show_source_labels: + type: boolean + pretend_user_exists: + type: boolean + description: When enabled, the stage will succeed and continue even when + incorrect user info is entered. + enable_remember_me: + type: boolean + description: Show the user the 'Remember me on this device' toggle, allowing + repeat users to skip straight to entering their password. + webauthn_stage: + type: string + format: uuid + nullable: true + description: When set, and conditional WebAuthn is available, allow the + user to use their passkey as a first factor. + required: + - component + - flow_set + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + IdentificationStageRequest: + type: object + description: IdentificationStage Serializer + properties: + name: + type: string + minLength: 1 + user_fields: + type: array + items: + $ref: '#/components/schemas/UserFieldsEnum' + description: Fields of the user object to match against. (Hold shift to + select multiple options) + password_stage: + type: string + format: uuid + nullable: true + description: When set, shows a password field, instead of showing the password + field as separate step. + captcha_stage: + type: string + format: uuid + nullable: true + description: When set, adds functionality exactly like a Captcha stage, + but baked into the Identification stage. + case_insensitive_matching: + type: boolean + description: When enabled, user fields are matched regardless of their casing. + show_matched_user: + type: boolean + description: When a valid username/email has been entered, and this option + is enabled, the user's username and avatar will be shown. Otherwise, the + text that the user entered will be shown + enrollment_flow: + type: string + format: uuid + nullable: true + description: Optional enrollment flow, which is linked at the bottom of + the page. + recovery_flow: + type: string + format: uuid + nullable: true + description: Optional recovery flow, which is linked at the bottom of the + page. + passwordless_flow: + type: string + format: uuid + nullable: true + description: Optional passwordless flow, which is linked at the bottom of + the page. + sources: + type: array + items: + type: string + format: uuid + description: Specify which sources should be shown. + show_source_labels: + type: boolean + pretend_user_exists: + type: boolean + description: When enabled, the stage will succeed and continue even when + incorrect user info is entered. + enable_remember_me: + type: boolean + description: Show the user the 'Remember me on this device' toggle, allowing + repeat users to skip straight to entering their password. + webauthn_stage: + type: string + format: uuid + nullable: true + description: When set, and conditional WebAuthn is available, allow the + user to use their passkey as a first factor. + required: + - name + IframeLogoutChallenge: + type: object + description: Challenge for iframe logout + properties: + flow_info: + $ref: '#/components/schemas/ContextualFlowInfo' + component: + type: string + default: ak-provider-iframe-logout + response_errors: + type: object + additionalProperties: + type: array + items: + $ref: '#/components/schemas/ErrorDetail' + logout_urls: + type: array + items: + $ref: '#/components/schemas/LogoutURL' + IframeLogoutChallengeResponseRequest: + type: object + description: Response for iframe logout + properties: + component: + type: string + minLength: 1 + default: ak-provider-iframe-logout + ImpersonationRequest: + type: object + properties: + reason: + type: string + minLength: 1 + required: + - reason + InitialPermissions: + type: object + description: InitialPermissions serializer + properties: + pk: + type: integer + readOnly: true + title: ID + name: + type: string + maxLength: 150 + role: + type: string + format: uuid + permissions: + type: array + items: + type: integer + permissions_obj: + type: array + items: + $ref: '#/components/schemas/Permission' + readOnly: true + required: + - name + - permissions_obj + - pk + - role + InitialPermissionsRequest: + type: object + description: InitialPermissions serializer + properties: + name: + type: string + minLength: 1 + maxLength: 150 + role: + type: string + format: uuid + permissions: + type: array + items: + type: integer + required: + - name + - role + InstallID: + type: object + properties: + install_id: + type: string + required: + - install_id + IntentEnum: + enum: + - verification + - api + - recovery + - app_password + type: string + InvalidResponseActionEnum: + enum: + - retry + - restart + - restart_with_context + type: string + Invitation: + type: object + description: Invitation Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Invite uuid + name: + type: string + pattern: ^[-a-zA-Z0-9_]+$ + expires: + type: string + format: date-time + nullable: true + fixed_data: + type: object + additionalProperties: {} + created_by: + allOf: + - $ref: '#/components/schemas/PartialUser' + readOnly: true + single_use: + type: boolean + description: When enabled, the invitation will be deleted after usage. + flow: + type: string + format: uuid + nullable: true + description: When set, only the configured flow can use this invitation. + flow_obj: + allOf: + - $ref: '#/components/schemas/Flow' + readOnly: true + required: + - created_by + - flow_obj + - name + - pk + InvitationRequest: + type: object + description: Invitation Serializer + properties: + name: + type: string + minLength: 1 + pattern: ^[-a-zA-Z0-9_]+$ + expires: + type: string + format: date-time + nullable: true + fixed_data: + type: object + additionalProperties: {} + single_use: + type: boolean + description: When enabled, the invitation will be deleted after usage. + flow: + type: string + format: uuid + nullable: true + description: When set, only the configured flow can use this invitation. + required: + - name + InvitationSendEmailRequest: + type: object + description: Serializer for sending invitation emails + properties: + email_addresses: + type: array + items: {} + cc_addresses: + type: array + items: {} + bcc_addresses: + type: array + items: {} + template: + type: string + minLength: 1 + default: invitation + required: + - email_addresses + InvitationStage: + type: object + description: InvitationStage Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Stage uuid + name: + type: string + component: + type: string + description: Get object type so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + flow_set: + type: array + items: + $ref: '#/components/schemas/FlowSet' + readOnly: true + continue_flow_without_invitation: + type: boolean + description: If this flag is set, this Stage will jump to the next Stage + when no Invitation is given. By default this Stage will cancel the Flow + when no invitation is given. + required: + - component + - flow_set + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + InvitationStageRequest: + type: object + description: InvitationStage Serializer + properties: + name: + type: string + minLength: 1 + continue_flow_without_invitation: + type: boolean + description: If this flag is set, this Stage will jump to the next Stage + when no Invitation is given. By default this Stage will cancel the Flow + when no invitation is given. + required: + - name + IssuerModeEnum: + enum: + - global + - per_provider + type: string + KadminTypeEnum: + enum: + - MIT + - Heimdal + type: string + KerberosSource: + type: object + description: Kerberos Source Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Pbm uuid + name: + type: string + description: Source's display Name. + slug: + type: string + description: Internal source name, used in URLs. + pattern: ^[-a-zA-Z0-9_]+$ + enabled: + type: boolean + promoted: + type: boolean + description: When enabled, this source will be displayed as a prominent + button on the login page, instead of a small icon. + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow to use when authenticating existing users. + enrollment_flow: + type: string + format: uuid + nullable: true + description: Flow to use when enrolling new users. + user_property_mappings: + type: array + items: + type: string + format: uuid + group_property_mappings: + type: array + items: + type: string + format: uuid + component: + type: string + description: Get object component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + user_matching_mode: + allOf: + - $ref: '#/components/schemas/UserMatchingModeEnum' + description: How the source determines if an existing user should be authenticated + or a new user enrolled. + managed: + type: string + nullable: true + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + readOnly: true + user_path_template: + type: string + icon: + type: string + icon_url: + type: string + readOnly: true + icon_themed_urls: + allOf: + - $ref: '#/components/schemas/ThemedUrls' + readOnly: true + nullable: true + group_matching_mode: + allOf: + - $ref: '#/components/schemas/GroupMatchingModeEnum' + description: How the source determines if an existing group should be used + or a new group created. + realm: + type: string + description: Kerberos realm + krb5_conf: + type: string + description: Custom krb5.conf to use. Uses the system one by default + kadmin_type: + allOf: + - $ref: '#/components/schemas/KadminTypeEnum' + description: KAdmin server type + sync_users: + type: boolean + description: Sync users from Kerberos into authentik + sync_users_password: + type: boolean + description: When a user changes their password, sync it back to Kerberos + sync_principal: + type: string + description: Principal to authenticate to kadmin for sync. + connectivity: + type: object + additionalProperties: + type: string + nullable: true + description: Get cached source connectivity + readOnly: true + spnego_server_name: + type: string + description: Force the use of a specific server name for SPNEGO. Must be + in the form HTTP@hostname + password_login_update_internal_password: + type: boolean + description: If enabled, the authentik-stored password will be updated upon + login with the Kerberos password backend + sync_outgoing_trigger_mode: + allOf: + - $ref: '#/components/schemas/SyncOutgoingTriggerModeEnum' + description: When to trigger sync for outgoing providers + required: + - component + - connectivity + - icon_themed_urls + - icon_url + - managed + - meta_model_name + - name + - pk + - realm + - slug + - verbose_name + - verbose_name_plural + KerberosSourcePropertyMapping: + type: object + description: Kerberos PropertyMapping Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Pm uuid + managed: + type: string + nullable: true + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + expression: + type: string + component: + type: string + description: Get object's component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + required: + - component + - expression + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + KerberosSourcePropertyMappingRequest: + type: object + description: Kerberos PropertyMapping Serializer + properties: + managed: + type: string + nullable: true + minLength: 1 + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + minLength: 1 + expression: + type: string + minLength: 1 + required: + - expression + - name + KerberosSourceRequest: + type: object + description: Kerberos Source Serializer + properties: + name: + type: string + minLength: 1 + description: Source's display Name. + slug: + type: string + minLength: 1 + description: Internal source name, used in URLs. + pattern: ^[-a-zA-Z0-9_]+$ + enabled: + type: boolean + promoted: + type: boolean + description: When enabled, this source will be displayed as a prominent + button on the login page, instead of a small icon. + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow to use when authenticating existing users. + enrollment_flow: + type: string + format: uuid + nullable: true + description: Flow to use when enrolling new users. + user_property_mappings: + type: array + items: + type: string + format: uuid + group_property_mappings: + type: array + items: + type: string + format: uuid + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + user_matching_mode: + allOf: + - $ref: '#/components/schemas/UserMatchingModeEnum' + description: How the source determines if an existing user should be authenticated + or a new user enrolled. + user_path_template: + type: string + minLength: 1 + icon: + type: string + group_matching_mode: + allOf: + - $ref: '#/components/schemas/GroupMatchingModeEnum' + description: How the source determines if an existing group should be used + or a new group created. + realm: + type: string + minLength: 1 + description: Kerberos realm + krb5_conf: + type: string + description: Custom krb5.conf to use. Uses the system one by default + kadmin_type: + allOf: + - $ref: '#/components/schemas/KadminTypeEnum' + description: KAdmin server type + sync_users: + type: boolean + description: Sync users from Kerberos into authentik + sync_users_password: + type: boolean + description: When a user changes their password, sync it back to Kerberos + sync_principal: + type: string + description: Principal to authenticate to kadmin for sync. + sync_password: + type: string + writeOnly: true + description: Password to authenticate to kadmin for sync + sync_keytab: + type: string + writeOnly: true + description: Keytab to authenticate to kadmin for sync. Must be base64-encoded + or in the form TYPE:residual + sync_ccache: + type: string + writeOnly: true + description: Credentials cache to authenticate to kadmin for sync. Must + be in the form TYPE:residual + spnego_server_name: + type: string + description: Force the use of a specific server name for SPNEGO. Must be + in the form HTTP@hostname + spnego_keytab: + type: string + writeOnly: true + description: SPNEGO keytab base64-encoded or path to keytab in the form + FILE:path + spnego_ccache: + type: string + writeOnly: true + description: Credential cache to use for SPNEGO in form type:residual + password_login_update_internal_password: + type: boolean + description: If enabled, the authentik-stored password will be updated upon + login with the Kerberos password backend + sync_outgoing_trigger_mode: + allOf: + - $ref: '#/components/schemas/SyncOutgoingTriggerModeEnum' + description: When to trigger sync for outgoing providers + required: + - name + - realm + - slug + KeyTypeEnum: + type: string + enum: + - dsa + - ec + - ed25519 + - ed448 + - rsa + KubernetesServiceConnection: + type: object + description: KubernetesServiceConnection Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Uuid + name: + type: string + local: + type: boolean + description: If enabled, use the local connection. Required Docker socket/Kubernetes + Integration + component: + type: string + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + kubeconfig: + type: object + additionalProperties: {} + description: Paste your kubeconfig here. authentik will automatically use + the currently selected context. + verify_ssl: + type: boolean + description: Verify SSL Certificates of the Kubernetes API endpoint + required: + - component + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + KubernetesServiceConnectionRequest: + type: object + description: KubernetesServiceConnection Serializer + properties: + name: + type: string + minLength: 1 + local: + type: boolean + description: If enabled, use the local connection. Required Docker socket/Kubernetes + Integration + kubeconfig: + type: object + additionalProperties: {} + description: Paste your kubeconfig here. authentik will automatically use + the currently selected context. + verify_ssl: + type: boolean + description: Verify SSL Certificates of the Kubernetes API endpoint + required: + - name + LDAPAPIAccessMode: + enum: + - direct + - cached + type: string + LDAPCheckAccess: + type: object + description: Base serializer class which doesn't implement create/update methods + properties: + has_search_permission: + type: boolean + access: + $ref: '#/components/schemas/PolicyTestResult' + required: + - access + LDAPDebug: + type: object + properties: + user: + type: array + items: + type: object + additionalProperties: {} + readOnly: true + group: + type: array + items: + type: object + additionalProperties: {} + readOnly: true + membership: + type: array + items: + type: object + additionalProperties: {} + readOnly: true + required: + - group + - membership + - user + LDAPOutpostConfig: + type: object + description: LDAPProvider Serializer + properties: + pk: + type: integer + readOnly: true + title: ID + name: + type: string + base_dn: + type: string + description: DN under which objects are accessible. + bind_flow_slug: + type: string + unbind_flow_slug: + type: string + nullable: true + description: Get slug for unbind flow, defaulting to brand's default flow. + readOnly: true + application_slug: + type: string + description: Prioritize backchannel slug over direct application slug + readOnly: true + certificate: + type: string + format: uuid + nullable: true + tls_server_name: + type: string + uid_start_number: + type: integer + maximum: 2147483647 + minimum: -2147483648 + description: The start for uidNumbers, this number is added to the user.pk + to make sure that the numbers aren't too low for POSIX users. Default + is 2000 to ensure that we don't collide with local users uidNumber + gid_start_number: + type: integer + maximum: 2147483647 + minimum: -2147483648 + description: The start for gidNumbers, this number is added to a number + generated from the group.pk to make sure that the numbers aren't too low + for POSIX groups. Default is 4000 to ensure that we don't collide with + local groups or users primary groups gidNumber + search_mode: + $ref: '#/components/schemas/LDAPAPIAccessMode' + bind_mode: + $ref: '#/components/schemas/LDAPAPIAccessMode' + mfa_support: + type: boolean + description: When enabled, code-based multi-factor authentication can be + used by appending a semicolon and the TOTP code to the password. This + should only be enabled if all users that will bind to this provider have + a TOTP device configured, as otherwise a password may incorrectly be rejected + if it contains a semicolon. + required: + - application_slug + - bind_flow_slug + - name + - pk + - unbind_flow_slug + LDAPProvider: + type: object + description: LDAPProvider Serializer + properties: + pk: + type: integer + readOnly: true + title: ID + name: + type: string + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow used for authentication when the associated application + is accessed by an un-authenticated user. + authorization_flow: + type: string + format: uuid + description: Flow used when authorizing this provider. + invalidation_flow: + type: string + format: uuid + description: Flow used ending the session from a provider. + property_mappings: + type: array + items: + type: string + format: uuid + component: + type: string + description: Get object component so that we know how to edit the object + readOnly: true + assigned_application_slug: + type: string + description: Internal application name, used in URLs. + readOnly: true + nullable: true + assigned_application_name: + type: string + description: Application's display Name. + readOnly: true + nullable: true + assigned_backchannel_application_slug: + type: string + description: Internal application name, used in URLs. + readOnly: true + nullable: true + assigned_backchannel_application_name: + type: string + description: Application's display Name. + readOnly: true + nullable: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + base_dn: + type: string + description: DN under which objects are accessible. + certificate: + type: string + format: uuid + nullable: true + tls_server_name: + type: string + uid_start_number: + type: integer + maximum: 2147483647 + minimum: -2147483648 + description: The start for uidNumbers, this number is added to the user.pk + to make sure that the numbers aren't too low for POSIX users. Default + is 2000 to ensure that we don't collide with local users uidNumber + gid_start_number: + type: integer + maximum: 2147483647 + minimum: -2147483648 + description: The start for gidNumbers, this number is added to a number + generated from the group.pk to make sure that the numbers aren't too low + for POSIX groups. Default is 4000 to ensure that we don't collide with + local groups or users primary groups gidNumber + outpost_set: + type: array + items: + type: string + readOnly: true + search_mode: + $ref: '#/components/schemas/LDAPAPIAccessMode' + bind_mode: + $ref: '#/components/schemas/LDAPAPIAccessMode' + mfa_support: + type: boolean + description: When enabled, code-based multi-factor authentication can be + used by appending a semicolon and the TOTP code to the password. This + should only be enabled if all users that will bind to this provider have + a TOTP device configured, as otherwise a password may incorrectly be rejected + if it contains a semicolon. + required: + - assigned_application_name + - assigned_application_slug + - assigned_backchannel_application_name + - assigned_backchannel_application_slug + - authorization_flow + - component + - invalidation_flow + - meta_model_name + - name + - outpost_set + - pk + - verbose_name + - verbose_name_plural + LDAPProviderRequest: + type: object + description: LDAPProvider Serializer + properties: + name: + type: string + minLength: 1 + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow used for authentication when the associated application + is accessed by an un-authenticated user. + authorization_flow: + type: string + format: uuid + description: Flow used when authorizing this provider. + invalidation_flow: + type: string + format: uuid + description: Flow used ending the session from a provider. + property_mappings: + type: array + items: + type: string + format: uuid + base_dn: + type: string + minLength: 1 + description: DN under which objects are accessible. + certificate: + type: string + format: uuid + nullable: true + tls_server_name: + type: string + uid_start_number: + type: integer + maximum: 2147483647 + minimum: -2147483648 + description: The start for uidNumbers, this number is added to the user.pk + to make sure that the numbers aren't too low for POSIX users. Default + is 2000 to ensure that we don't collide with local users uidNumber + gid_start_number: + type: integer + maximum: 2147483647 + minimum: -2147483648 + description: The start for gidNumbers, this number is added to a number + generated from the group.pk to make sure that the numbers aren't too low + for POSIX groups. Default is 4000 to ensure that we don't collide with + local groups or users primary groups gidNumber + search_mode: + $ref: '#/components/schemas/LDAPAPIAccessMode' + bind_mode: + $ref: '#/components/schemas/LDAPAPIAccessMode' + mfa_support: + type: boolean + description: When enabled, code-based multi-factor authentication can be + used by appending a semicolon and the TOTP code to the password. This + should only be enabled if all users that will bind to this provider have + a TOTP device configured, as otherwise a password may incorrectly be rejected + if it contains a semicolon. + required: + - authorization_flow + - invalidation_flow + - name + LDAPSource: + type: object + description: LDAP Source Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Pbm uuid + name: + type: string + description: Source's display Name. + slug: + type: string + description: Internal source name, used in URLs. + pattern: ^[-a-zA-Z0-9_]+$ + enabled: + type: boolean + promoted: + type: boolean + description: When enabled, this source will be displayed as a prominent + button on the login page, instead of a small icon. + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow to use when authenticating existing users. + enrollment_flow: + type: string + format: uuid + nullable: true + description: Flow to use when enrolling new users. + user_property_mappings: + type: array + items: + type: string + format: uuid + group_property_mappings: + type: array + items: + type: string + format: uuid + component: + type: string + description: Get object component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + user_matching_mode: + allOf: + - $ref: '#/components/schemas/UserMatchingModeEnum' + description: How the source determines if an existing user should be authenticated + or a new user enrolled. + managed: + type: string + nullable: true + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + readOnly: true + user_path_template: + type: string + icon: + type: string + icon_url: + type: string + readOnly: true + icon_themed_urls: + allOf: + - $ref: '#/components/schemas/ThemedUrls' + readOnly: true + nullable: true + server_uri: + type: string + format: uri + peer_certificate: + type: string + format: uuid + nullable: true + description: Optionally verify the LDAP Server's Certificate against the + CA Chain in this keypair. + client_certificate: + type: string + format: uuid + nullable: true + description: Client certificate to authenticate against the LDAP Server's + Certificate. + bind_cn: + type: string + start_tls: + type: boolean + title: Enable Start TLS + sni: + type: boolean + title: Use Server URI for SNI verification + base_dn: + type: string + additional_user_dn: + type: string + title: Addition User DN + description: Prepended to Base DN for User-queries. + additional_group_dn: + type: string + title: Addition Group DN + description: Prepended to Base DN for Group-queries. + user_object_filter: + type: string + description: Consider Objects matching this filter to be Users. + group_object_filter: + type: string + description: Consider Objects matching this filter to be Groups. + group_membership_field: + type: string + description: Field which contains members of a group. + user_membership_attribute: + type: string + description: Attribute which matches the value of `group_membership_field`. + object_uniqueness_field: + type: string + description: Field which contains a unique Identifier. + password_login_update_internal_password: + type: boolean + description: Update internal authentik password when login succeeds with + LDAP + sync_users: + type: boolean + sync_users_password: + type: boolean + description: When a user changes their password, sync it back to LDAP. This + can only be enabled on a single LDAP source. + sync_groups: + type: boolean + sync_parent_group: + type: string + format: uuid + nullable: true + connectivity: + type: object + additionalProperties: + type: object + additionalProperties: + type: string + nullable: true + description: Get cached source connectivity + readOnly: true + lookup_groups_from_user: + type: boolean + description: Lookup group membership based on a user attribute instead of + a group attribute. This allows nested group resolution on systems like + FreeIPA and Active Directory + delete_not_found_objects: + type: boolean + description: Delete authentik users and groups which were previously supplied + by this source, but are now missing from it. + sync_outgoing_trigger_mode: + allOf: + - $ref: '#/components/schemas/SyncOutgoingTriggerModeEnum' + description: When to trigger sync for outgoing providers + sync_group_hierarchy: + type: boolean + description: Sync group parentage/hierarchy from LDAP directories. + required: + - base_dn + - component + - connectivity + - icon_themed_urls + - icon_url + - managed + - meta_model_name + - name + - pk + - server_uri + - slug + - verbose_name + - verbose_name_plural + LDAPSourcePropertyMapping: + type: object + description: LDAP PropertyMapping Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Pm uuid + managed: + type: string + nullable: true + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + expression: + type: string + component: + type: string + description: Get object's component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + required: + - component + - expression + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + LDAPSourcePropertyMappingRequest: + type: object + description: LDAP PropertyMapping Serializer + properties: + managed: + type: string + nullable: true + minLength: 1 + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + minLength: 1 + expression: + type: string + minLength: 1 + required: + - expression + - name + LDAPSourceRequest: + type: object + description: LDAP Source Serializer + properties: + name: + type: string + minLength: 1 + description: Source's display Name. + slug: + type: string + minLength: 1 + description: Internal source name, used in URLs. + pattern: ^[-a-zA-Z0-9_]+$ + enabled: + type: boolean + promoted: + type: boolean + description: When enabled, this source will be displayed as a prominent + button on the login page, instead of a small icon. + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow to use when authenticating existing users. + enrollment_flow: + type: string + format: uuid + nullable: true + description: Flow to use when enrolling new users. + user_property_mappings: + type: array + items: + type: string + format: uuid + group_property_mappings: + type: array + items: + type: string + format: uuid + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + user_matching_mode: + allOf: + - $ref: '#/components/schemas/UserMatchingModeEnum' + description: How the source determines if an existing user should be authenticated + or a new user enrolled. + user_path_template: + type: string + minLength: 1 + icon: + type: string + server_uri: + type: string + minLength: 1 + format: uri + peer_certificate: + type: string + format: uuid + nullable: true + description: Optionally verify the LDAP Server's Certificate against the + CA Chain in this keypair. + client_certificate: + type: string + format: uuid + nullable: true + description: Client certificate to authenticate against the LDAP Server's + Certificate. + bind_cn: + type: string + bind_password: + type: string + writeOnly: true + start_tls: + type: boolean + title: Enable Start TLS + sni: + type: boolean + title: Use Server URI for SNI verification + base_dn: + type: string + minLength: 1 + additional_user_dn: + type: string + title: Addition User DN + description: Prepended to Base DN for User-queries. + additional_group_dn: + type: string + title: Addition Group DN + description: Prepended to Base DN for Group-queries. + user_object_filter: + type: string + minLength: 1 + description: Consider Objects matching this filter to be Users. + group_object_filter: + type: string + minLength: 1 + description: Consider Objects matching this filter to be Groups. + group_membership_field: + type: string + minLength: 1 + description: Field which contains members of a group. + user_membership_attribute: + type: string + minLength: 1 + description: Attribute which matches the value of `group_membership_field`. + object_uniqueness_field: + type: string + minLength: 1 + description: Field which contains a unique Identifier. + password_login_update_internal_password: + type: boolean + description: Update internal authentik password when login succeeds with + LDAP + sync_users: + type: boolean + sync_users_password: + type: boolean + description: When a user changes their password, sync it back to LDAP. This + can only be enabled on a single LDAP source. + sync_groups: + type: boolean + sync_parent_group: + type: string + format: uuid + nullable: true + lookup_groups_from_user: + type: boolean + description: Lookup group membership based on a user attribute instead of + a group attribute. This allows nested group resolution on systems like + FreeIPA and Active Directory + delete_not_found_objects: + type: boolean + description: Delete authentik users and groups which were previously supplied + by this source, but are now missing from it. + sync_outgoing_trigger_mode: + allOf: + - $ref: '#/components/schemas/SyncOutgoingTriggerModeEnum' + description: When to trigger sync for outgoing providers + sync_group_hierarchy: + type: boolean + description: Sync group parentage/hierarchy from LDAP directories. + required: + - base_dn + - name + - server_uri + - slug + LangEnum: + type: string + enum: + - af + - ar + - ar-dz + - ast + - az + - be + - bg + - bn + - br + - bs + - ca + - ckb + - cs + - cy + - da + - de + - dsb + - el + - en + - en-au + - en-gb + - eo + - es + - es-ar + - es-co + - es-mx + - es-ni + - es-ve + - et + - eu + - fa + - fi + - fr + - fy + - ga + - gd + - gl + - he + - hi + - hr + - hsb + - hu + - hy + - ia + - id + - ig + - io + - is + - it + - ja + - ka + - kab + - kk + - km + - kn + - ko + - ky + - lb + - lt + - lv + - mk + - ml + - mn + - mr + - ms + - my + - nb + - ne + - nl + - nn + - os + - pa + - pl + - pt + - pt-br + - ro + - ru + - sk + - sl + - sq + - sr + - sr-latn + - sv + - sw + - ta + - te + - tg + - th + - tk + - tr + - tt + - udm + - ug + - uk + - ur + - uz + - vi + - zh-hans + - zh-hant + LastTaskStatusEnum: + enum: + - waiting_for_dependencies + - queued + - consumed + - preprocess + - running + - postprocess + - rejected + - done + - info + - warning + - error + type: string + License: + type: object + description: License Serializer + properties: + license_uuid: + type: string + format: uuid + readOnly: true + name: + type: string + readOnly: true + key: + type: string + expiry: + type: string + format: date-time + readOnly: true + internal_users: + type: integer + readOnly: true + external_users: + type: integer + readOnly: true + required: + - expiry + - external_users + - internal_users + - key + - license_uuid + - name + LicenseFlagsEnum: + enum: + - trial + - non_production + type: string + LicenseForecast: + type: object + description: Serializer for license forecast + properties: + internal_users: + type: integer + external_users: + type: integer + forecasted_internal_users: + type: integer + forecasted_external_users: + type: integer + required: + - external_users + - forecasted_external_users + - forecasted_internal_users + - internal_users + LicenseRequest: + type: object + description: License Serializer + properties: + key: + type: string + minLength: 1 + required: + - key + LicenseStatusEnum: + enum: + - unlicensed + - valid + - expired + - expiry_soon + - limit_exceeded_admin + - limit_exceeded_user + - read_only + type: string + LicenseSummary: + type: object + description: Serializer for license status + properties: + internal_users: + type: integer + external_users: + type: integer + status: + $ref: '#/components/schemas/LicenseSummaryStatusEnum' + latest_valid: + type: string + format: date-time + license_flags: + type: array + items: + $ref: '#/components/schemas/LicenseFlagsEnum' + required: + - external_users + - internal_users + - latest_valid + - license_flags + - status + LicenseSummaryStatusEnum: + enum: + - unlicensed + - valid + - expired + - expiry_soon + - limit_exceeded_admin + - limit_exceeded_user + - read_only + type: string + LifecycleIteration: + type: object + description: |- + Mixin to validate that a valid enterprise license + exists before allowing to save the object + properties: + id: + type: string + format: uuid + readOnly: true + content_type: + $ref: '#/components/schemas/ContentTypeEnum' + object_id: + type: string + readOnly: true + object_verbose: + type: string + readOnly: true + object_admin_url: + type: string + readOnly: true + state: + allOf: + - $ref: '#/components/schemas/LifecycleIterationStateEnum' + readOnly: true + opened_on: + type: string + format: date-time + readOnly: true + grace_period_end: + type: string + format: date-time + readOnly: true + next_review_date: + type: string + format: date-time + readOnly: true + reviews: + type: array + items: + $ref: '#/components/schemas/Review' + readOnly: true + rule: + allOf: + - $ref: '#/components/schemas/RelatedRule' + readOnly: true + user_can_review: + type: boolean + readOnly: true + required: + - content_type + - grace_period_end + - id + - next_review_date + - object_admin_url + - object_id + - object_verbose + - opened_on + - reviews + - rule + - state + - user_can_review + LifecycleIterationRequest: + type: object + description: |- + Mixin to validate that a valid enterprise license + exists before allowing to save the object + properties: + content_type: + $ref: '#/components/schemas/ContentTypeEnum' + required: + - content_type + LifecycleIterationStateEnum: + enum: + - REVIEWED + - PENDING + - OVERDUE + - CANCELED + type: string + LifecycleRule: + type: object + description: |- + Mixin to validate that a valid enterprise license + exists before allowing to save the object + properties: + id: + type: string + format: uuid + readOnly: true + name: + type: string + content_type: + $ref: '#/components/schemas/ContentTypeEnum' + object_id: + type: string + nullable: true + interval: + type: string + grace_period: + type: string + reviewer_groups: + type: array + items: + type: string + format: uuid + reviewer_groups_obj: + type: array + items: + $ref: '#/components/schemas/PartialGroup' + readOnly: true + min_reviewers: + type: integer + maximum: 32767 + minimum: 0 + min_reviewers_is_per_group: + type: boolean + reviewers: + type: array + items: + type: string + format: uuid + reviewers_obj: + type: array + items: + $ref: '#/components/schemas/PartialUser' + readOnly: true + notification_transports: + type: array + items: + type: string + format: uuid + description: Select which transports should be used to notify the reviewers. + If none are selected, the notification will only be shown in the authentik + UI. + target_verbose: + type: string + readOnly: true + required: + - content_type + - id + - name + - reviewer_groups_obj + - reviewers + - reviewers_obj + - target_verbose + LifecycleRuleRequest: + type: object + description: |- + Mixin to validate that a valid enterprise license + exists before allowing to save the object + properties: + name: + type: string + minLength: 1 + content_type: + $ref: '#/components/schemas/ContentTypeEnum' + object_id: + type: string + nullable: true + minLength: 1 + interval: + type: string + minLength: 1 + grace_period: + type: string + minLength: 1 + reviewer_groups: + type: array + items: + type: string + format: uuid + min_reviewers: + type: integer + maximum: 32767 + minimum: 0 + min_reviewers_is_per_group: + type: boolean + reviewers: + type: array + items: + type: string + format: uuid + notification_transports: + type: array + items: + type: string + format: uuid + description: Select which transports should be used to notify the reviewers. + If none are selected, the notification will only be shown in the authentik + UI. + required: + - content_type + - name + - reviewers + Link: + type: object + description: Returns a single link + properties: + link: + type: string + required: + - link + LogEvent: + type: object + description: Single log message with all context logged. + properties: + timestamp: + type: string + format: date-time + log_level: + $ref: '#/components/schemas/LogLevelEnum' + logger: + type: string + event: + type: string + attributes: + type: object + additionalProperties: {} + required: + - attributes + - event + - log_level + - logger + - timestamp + LogLevelEnum: + enum: + - critical + - exception + - error + - warn + - warning + - info + - debug + - notset + type: string + LoginChallengeTypes: + oneOf: + - $ref: '#/components/schemas/RedirectChallenge' + - $ref: '#/components/schemas/AppleLoginChallenge' + - $ref: '#/components/schemas/PlexAuthenticationChallenge' + - $ref: '#/components/schemas/TelegramLoginChallenge' + discriminator: + propertyName: component + mapping: + xak-flow-redirect: '#/components/schemas/RedirectChallenge' + ak-source-oauth-apple: '#/components/schemas/AppleLoginChallenge' + ak-source-plex: '#/components/schemas/PlexAuthenticationChallenge' + ak-source-telegram: '#/components/schemas/TelegramLoginChallenge' + LoginSource: + type: object + description: Serializer for Login buttons of sources + properties: + name: + type: string + icon_url: + type: string + nullable: true + promoted: + type: boolean + default: false + challenge: + $ref: '#/components/schemas/LoginChallengeTypes' + required: + - challenge + - name + LogoutURL: + type: object + description: Data for a single logout URL + properties: + url: + type: string + provider_name: + type: string + nullable: true + binding: + type: string + nullable: true + saml_request: + type: string + nullable: true + saml_response: + type: string + nullable: true + saml_relay_state: + type: string + nullable: true + required: + - url + MDMConfigRequest: + type: object + description: Base serializer class which doesn't implement create/update methods + properties: + platform: + $ref: '#/components/schemas/DeviceFactsOSFamily' + enrollment_token: + type: string + format: uuid + required: + - enrollment_token + - platform + MDMConfigResponse: + type: object + description: Base serializer class which doesn't implement create/update methods + properties: + config: + type: string + mime_type: + type: string + filename: + type: string + required: + - config + - filename + - mime_type + MatchingModeEnum: + enum: + - strict + - regex + type: string + Metadata: + type: object + description: Serializer for blueprint metadata + properties: + name: + type: string + labels: + type: object + additionalProperties: {} + required: + - labels + - name + MicrosoftEntraProvider: + type: object + description: MicrosoftEntraProvider Serializer + properties: + pk: + type: integer + readOnly: true + title: ID + name: + type: string + property_mappings: + type: array + items: + type: string + format: uuid + property_mappings_group: + type: array + items: + type: string + format: uuid + description: Property mappings used for group creation/updating. + component: + type: string + description: Get object component so that we know how to edit the object + readOnly: true + assigned_backchannel_application_slug: + type: string + description: Internal application name, used in URLs. + readOnly: true + nullable: true + assigned_backchannel_application_name: + type: string + description: Application's display Name. + readOnly: true + nullable: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + client_id: + type: string + tenant_id: + type: string + exclude_users_service_account: + type: boolean + filter_group: + type: string + format: uuid + nullable: true + user_delete_action: + $ref: '#/components/schemas/OutgoingSyncDeleteAction' + group_delete_action: + $ref: '#/components/schemas/OutgoingSyncDeleteAction' + sync_page_size: + type: integer + maximum: 2147483647 + minimum: 1 + description: Controls the number of objects synced in a single task + discovery_enabled: + type: boolean + description: When enabled, authentik will attempt to discover existing resources + in the remote system. + sync_page_timeout: + type: string + description: Timeout for synchronization of a single page + dry_run: + type: boolean + description: When enabled, provider will not modify or create objects in + the remote system. + required: + - assigned_backchannel_application_name + - assigned_backchannel_application_slug + - client_id + - component + - meta_model_name + - name + - pk + - tenant_id + - verbose_name + - verbose_name_plural + MicrosoftEntraProviderGroup: + type: object + description: MicrosoftEntraProviderGroup Serializer + properties: + id: + type: string + format: uuid + readOnly: true + microsoft_id: + type: string + group: + type: string + format: uuid + group_obj: + allOf: + - $ref: '#/components/schemas/PartialGroup' + readOnly: true + provider: + type: integer + attributes: + type: object + additionalProperties: {} + readOnly: true + required: + - attributes + - group + - group_obj + - id + - microsoft_id + - provider + MicrosoftEntraProviderGroupRequest: + type: object + description: MicrosoftEntraProviderGroup Serializer + properties: + microsoft_id: + type: string + minLength: 1 + group: + type: string + format: uuid + provider: + type: integer + required: + - group + - microsoft_id + - provider + MicrosoftEntraProviderMapping: + type: object + description: MicrosoftEntraProviderMapping Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Pm uuid + managed: + type: string + nullable: true + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + expression: + type: string + component: + type: string + description: Get object's component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + required: + - component + - expression + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + MicrosoftEntraProviderMappingRequest: + type: object + description: MicrosoftEntraProviderMapping Serializer + properties: + managed: + type: string + nullable: true + minLength: 1 + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + minLength: 1 + expression: + type: string + minLength: 1 + required: + - expression + - name + MicrosoftEntraProviderRequest: + type: object + description: MicrosoftEntraProvider Serializer + properties: + name: + type: string + minLength: 1 + property_mappings: + type: array + items: + type: string + format: uuid + property_mappings_group: + type: array + items: + type: string + format: uuid + description: Property mappings used for group creation/updating. + client_id: + type: string + minLength: 1 + client_secret: + type: string + writeOnly: true + minLength: 1 + tenant_id: + type: string + minLength: 1 + exclude_users_service_account: + type: boolean + filter_group: + type: string + format: uuid + nullable: true + user_delete_action: + $ref: '#/components/schemas/OutgoingSyncDeleteAction' + group_delete_action: + $ref: '#/components/schemas/OutgoingSyncDeleteAction' + sync_page_size: + type: integer + maximum: 2147483647 + minimum: 1 + description: Controls the number of objects synced in a single task + discovery_enabled: + type: boolean + description: When enabled, authentik will attempt to discover existing resources + in the remote system. + sync_page_timeout: + type: string + minLength: 1 + description: Timeout for synchronization of a single page + dry_run: + type: boolean + description: When enabled, provider will not modify or create objects in + the remote system. + required: + - client_id + - client_secret + - name + - tenant_id + MicrosoftEntraProviderUser: + type: object + description: MicrosoftEntraProviderUser Serializer + properties: + id: + type: string + format: uuid + readOnly: true + microsoft_id: + type: string + user: + type: integer + user_obj: + allOf: + - $ref: '#/components/schemas/PartialUser' + readOnly: true + provider: + type: integer + attributes: + type: object + additionalProperties: {} + readOnly: true + required: + - attributes + - id + - microsoft_id + - provider + - user + - user_obj + MicrosoftEntraProviderUserRequest: + type: object + description: MicrosoftEntraProviderUser Serializer + properties: + microsoft_id: + type: string + minLength: 1 + user: + type: integer + provider: + type: integer + required: + - microsoft_id + - provider + - user + ModelEnum: + enum: + - authentik_tenants.domain + - authentik_core.group + - authentik_core.user + - authentik_core.application + - authentik_core.applicationentitlement + - authentik_core.token + - authentik_core.objectattribute + - authentik_core.actor + - authentik_crypto.certificatekeypair + - authentik_endpoints.deviceuserbinding + - authentik_endpoints.deviceaccessgroup + - authentik_endpoints.endpointstage + - authentik_endpoints_connectors_agent.agentconnector + - authentik_endpoints_connectors_agent.agentdeviceuserbinding + - authentik_endpoints_connectors_agent.enrollmenttoken + - authentik_enterprise.license + - authentik_events.event + - authentik_events.notificationtransport + - authentik_events.notification + - authentik_events.notificationrule + - authentik_events.notificationwebhookmapping + - authentik_flows.flow + - authentik_flows.flowstagebinding + - authentik_outposts.dockerserviceconnection + - authentik_outposts.kubernetesserviceconnection + - authentik_outposts.outpost + - authentik_policies_dummy.dummypolicy + - authentik_policies_event_matcher.eventmatcherpolicy + - authentik_policies_expiry.passwordexpirypolicy + - authentik_policies_expression.expressionpolicy + - authentik_policies_geoip.geoippolicy + - authentik_policies_password.passwordpolicy + - authentik_policies_reputation.reputationpolicy + - authentik_policies.policybinding + - authentik_providers_ldap.ldapprovider + - authentik_providers_oauth2.scopemapping + - authentik_providers_oauth2.oauth2provider + - authentik_providers_oauth2.oauth2dynamicclientregistration + - authentik_providers_proxy.proxyprovider + - authentik_providers_rac.racprovider + - authentik_providers_rac.endpoint + - authentik_providers_rac.racpropertymapping + - authentik_providers_radius.radiusprovider + - authentik_providers_radius.radiusproviderpropertymapping + - authentik_providers_saml.samlprovider + - authentik_providers_saml.samlpropertymapping + - authentik_providers_scim.scimprovider + - authentik_providers_scim.scimmapping + - authentik_rbac.role + - authentik_rbac.initialpermissions + - authentik_sources_kerberos.kerberossource + - authentik_sources_kerberos.kerberossourcepropertymapping + - authentik_sources_kerberos.userkerberossourceconnection + - authentik_sources_kerberos.groupkerberossourceconnection + - authentik_sources_ldap.ldapsource + - authentik_sources_ldap.ldapsourcepropertymapping + - authentik_sources_ldap.userldapsourceconnection + - authentik_sources_ldap.groupldapsourceconnection + - authentik_sources_oauth.oauthsource + - authentik_sources_oauth.oauthsourcepropertymapping + - authentik_sources_oauth.useroauthsourceconnection + - authentik_sources_oauth.groupoauthsourceconnection + - authentik_sources_plex.plexsource + - authentik_sources_plex.plexsourcepropertymapping + - authentik_sources_plex.userplexsourceconnection + - authentik_sources_plex.groupplexsourceconnection + - authentik_sources_saml.samlsource + - authentik_sources_saml.samlsourcepropertymapping + - authentik_sources_saml.usersamlsourceconnection + - authentik_sources_saml.groupsamlsourceconnection + - authentik_sources_scim.scimsource + - authentik_sources_scim.scimsourcepropertymapping + - authentik_sources_telegram.telegramsource + - authentik_sources_telegram.telegramsourcepropertymapping + - authentik_sources_telegram.usertelegramsourceconnection + - authentik_sources_telegram.grouptelegramsourceconnection + - authentik_stages_authenticator_duo.authenticatorduostage + - authentik_stages_authenticator_duo.duodevice + - authentik_stages_authenticator_email.authenticatoremailstage + - authentik_stages_authenticator_email.emaildevice + - authentik_stages_authenticator_sms.authenticatorsmsstage + - authentik_stages_authenticator_sms.smsdevice + - authentik_stages_authenticator_static.authenticatorstaticstage + - authentik_stages_authenticator_static.staticdevice + - authentik_stages_authenticator_totp.authenticatortotpstage + - authentik_stages_authenticator_totp.totpdevice + - authentik_stages_authenticator_validate.authenticatorvalidatestage + - authentik_stages_authenticator_webauthn.authenticatorwebauthnstage + - authentik_stages_authenticator_webauthn.webauthndevice + - authentik_stages_captcha.captchastage + - authentik_stages_consent.consentstage + - authentik_stages_deny.denystage + - authentik_stages_dummy.dummystage + - authentik_stages_email.emailstage + - authentik_stages_identification.identificationstage + - authentik_stages_invitation.invitationstage + - authentik_stages_invitation.invitation + - authentik_stages_password.passwordstage + - authentik_stages_prompt.prompt + - authentik_stages_prompt.promptstage + - authentik_stages_redirect.redirectstage + - authentik_stages_user_delete.userdeletestage + - authentik_stages_user_login.userloginstage + - authentik_stages_user_logout.userlogoutstage + - authentik_stages_user_write.userwritestage + - authentik_tasks_schedules.schedule + - authentik_brands.brand + - authentik_blueprints.blueprintinstance + - authentik_agents.agent + - authentik_endpoints_connectors_fleet.fleetconnector + - authentik_endpoints_connectors_google_chrome.googlechromeconnector + - authentik_lifecycle.lifecyclerule + - authentik_lifecycle.lifecycleiteration + - authentik_lifecycle.review + - authentik_lifecycle.useroffboarding + - authentik_policies_unique_password.uniquepasswordpolicy + - authentik_providers_google_workspace.googleworkspaceprovider + - authentik_providers_google_workspace.googleworkspaceprovidermapping + - authentik_providers_microsoft_entra.microsoftentraprovider + - authentik_providers_microsoft_entra.microsoftentraprovidermapping + - authentik_providers_ssf.ssfprovider + - authentik_providers_ws_federation.wsfederationprovider + - authentik_reports.dataexport + - authentik_requests.requestrulechildbinding + - authentik_requests.requestrulebinding + - authentik_requests.requestrule + - authentik_requests.grantrequest + - authentik_stages_account_lockdown.accountlockdownstage + - authentik_stages_authenticator_endpoint_gdtc.authenticatorendpointgdtcstage + - authentik_stages_mtls.mutualtlsstage + - authentik_stages_source.sourcestage + type: string + MutualTLSStage: + type: object + description: MutualTLSStage Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Stage uuid + name: + type: string + component: + type: string + description: Get object type so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + flow_set: + type: array + items: + $ref: '#/components/schemas/FlowSet' + readOnly: true + mode: + $ref: '#/components/schemas/StageModeEnum' + certificate_authorities: + type: array + items: + type: string + format: uuid + description: Configure certificate authorities to validate the certificate + against. This option has a higher priority than the `client_certificate` + option on `Brand`. + cert_attribute: + $ref: '#/components/schemas/CertAttributeEnum' + user_attribute: + $ref: '#/components/schemas/UserAttributeEnum' + required: + - cert_attribute + - component + - flow_set + - meta_model_name + - mode + - name + - pk + - user_attribute + - verbose_name + - verbose_name_plural + MutualTLSStageRequest: + type: object + description: MutualTLSStage Serializer + properties: + name: + type: string + minLength: 1 + mode: + $ref: '#/components/schemas/StageModeEnum' + certificate_authorities: + type: array + items: + type: string + format: uuid + description: Configure certificate authorities to validate the certificate + against. This option has a higher priority than the `client_certificate` + option on `Brand`. + cert_attribute: + $ref: '#/components/schemas/CertAttributeEnum' + user_attribute: + $ref: '#/components/schemas/UserAttributeEnum' + required: + - cert_attribute + - mode + - name + - user_attribute + NativeLogoutChallenge: + type: object + description: Challenge for native browser logout + properties: + flow_info: + $ref: '#/components/schemas/ContextualFlowInfo' + component: + type: string + default: ak-provider-saml-native-logout + response_errors: + type: object + additionalProperties: + type: array + items: + $ref: '#/components/schemas/ErrorDetail' + provider_name: + type: string + is_complete: + type: boolean + default: false + post_url: + type: string + redirect_url: + type: string + saml_binding: + $ref: '#/components/schemas/SAMLBindingsEnum' + saml_request: + type: string + saml_response: + type: string + saml_relay_state: + type: string + NativeLogoutChallengeResponseRequest: + type: object + description: Response for native browser logout + properties: + component: + type: string + minLength: 1 + default: ak-provider-saml-native-logout + Network: + type: object + properties: + hostname: + type: string + firewall_enabled: + type: boolean + interfaces: + type: array + items: + $ref: '#/components/schemas/NetworkInterface' + gateway: + type: string + required: + - hostname + - interfaces + NetworkBindingEnum: + enum: + - no_binding + - bind_asn + - bind_asn_network + - bind_asn_network_ip + type: string + NetworkInterface: + type: object + properties: + name: + type: string + hardware_address: + type: string + ip_addresses: + type: array + items: + type: string + dns_servers: + type: array + items: + type: string + required: + - hardware_address + - name + NetworkInterfaceRequest: + type: object + properties: + name: + type: string + minLength: 1 + hardware_address: + type: string + minLength: 1 + ip_addresses: + type: array + items: + type: string + minLength: 1 + dns_servers: + type: array + items: + type: string + minLength: 1 + required: + - hardware_address + - name + NetworkRequest: + type: object + properties: + hostname: + type: string + minLength: 1 + firewall_enabled: + type: boolean + interfaces: + type: array + items: + $ref: '#/components/schemas/NetworkInterfaceRequest' + gateway: + type: string + minLength: 1 + required: + - hostname + - interfaces + NotConfiguredActionEnum: + enum: + - skip + - deny + - configure + type: string + Notification: + type: object + description: Notification Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Uuid + severity: + allOf: + - $ref: '#/components/schemas/SeverityEnum' + readOnly: true + body: + type: string + readOnly: true + hyperlink: + type: string + nullable: true + maxLength: 4096 + hyperlink_label: + type: string + nullable: true + created: + type: string + format: date-time + readOnly: true + event: + $ref: '#/components/schemas/Event' + seen: + type: boolean + required: + - body + - created + - pk + - severity + NotificationModeEnum: + enum: + - all + - direct + - random_min_reviewers + type: string + NotificationRequest: + type: object + description: Notification Serializer + properties: + hyperlink: + type: string + nullable: true + maxLength: 4096 + hyperlink_label: + type: string + nullable: true + event: + $ref: '#/components/schemas/EventRequest' + seen: + type: boolean + NotificationRule: + type: object + description: NotificationRule Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Pbm uuid + name: + type: string + transports: + type: array + items: + type: string + format: uuid + description: Select which transports should be used to notify the user. + If none are selected, the notification will only be shown in the authentik + UI. + severity: + allOf: + - $ref: '#/components/schemas/SeverityEnum' + description: Controls which severity level the created notifications will + have. + destination_group: + type: string + format: uuid + nullable: true + description: Define which group of users this notification should be sent + and shown to. If left empty, Notification won't ben sent. + destination_group_obj: + allOf: + - $ref: '#/components/schemas/Group' + readOnly: true + nullable: true + destination_event_user: + type: boolean + description: When enabled, notification will be sent to user the user that + triggered the event.When destination_group is configured, notification + is sent to both. + required: + - destination_group_obj + - name + - pk + NotificationRuleRequest: + type: object + description: NotificationRule Serializer + properties: + name: + type: string + minLength: 1 + transports: + type: array + items: + type: string + format: uuid + description: Select which transports should be used to notify the user. + If none are selected, the notification will only be shown in the authentik + UI. + severity: + allOf: + - $ref: '#/components/schemas/SeverityEnum' + description: Controls which severity level the created notifications will + have. + destination_group: + type: string + format: uuid + nullable: true + description: Define which group of users this notification should be sent + and shown to. If left empty, Notification won't ben sent. + destination_event_user: + type: boolean + description: When enabled, notification will be sent to user the user that + triggered the event.When destination_group is configured, notification + is sent to both. + required: + - name + NotificationTransport: + type: object + description: NotificationTransport Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Uuid + name: + type: string + mode: + $ref: '#/components/schemas/TransportModeEnum' + mode_verbose: + type: string + description: Return selected mode with a UI Label + readOnly: true + webhook_url: + type: string + format: uri + webhook_ca: + type: string + format: uuid + nullable: true + description: When set, the selected certificate is used to validate the + certificate of the webhook server. + webhook_mapping_body: + type: string + format: uuid + nullable: true + description: Customize the body of the request. Mapping should return data + that is JSON-serializable. + webhook_mapping_headers: + type: string + format: uuid + nullable: true + description: Configure additional headers to be sent. Mapping should return + a dictionary of key-value pairs + email_subject_prefix: + type: string + email_template: + type: string + send_once: + type: boolean + description: Only send notification once, for example when sending a webhook + into a chat channel. + required: + - mode_verbose + - name + - pk + NotificationTransportRequest: + type: object + description: NotificationTransport Serializer + properties: + name: + type: string + minLength: 1 + mode: + $ref: '#/components/schemas/TransportModeEnum' + webhook_url: + type: string + format: uri + webhook_ca: + type: string + format: uuid + nullable: true + description: When set, the selected certificate is used to validate the + certificate of the webhook server. + webhook_mapping_body: + type: string + format: uuid + nullable: true + description: Customize the body of the request. Mapping should return data + that is JSON-serializable. + webhook_mapping_headers: + type: string + format: uuid + nullable: true + description: Configure additional headers to be sent. Mapping should return + a dictionary of key-value pairs + email_subject_prefix: + type: string + email_template: + type: string + minLength: 1 + send_once: + type: boolean + description: Only send notification once, for example when sending a webhook + into a chat channel. + required: + - name + NotificationTransportTest: + type: object + description: Notification test serializer + properties: + messages: + type: array + items: + type: string + required: + - messages + NotificationWebhookMapping: + type: object + description: NotificationWebhookMapping Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Pm uuid + name: + type: string + expression: + type: string + required: + - expression + - name + - pk + NotificationWebhookMappingRequest: + type: object + description: NotificationWebhookMapping Serializer + properties: + name: + type: string + minLength: 1 + expression: + type: string + minLength: 1 + required: + - expression + - name + OAuth2DynamicClientRegistration: + type: object + description: Serializer for OAuth2DynamicClientRegistration + properties: + pbm_uuid: + type: string + format: uuid + readOnly: true + provider: + type: integer + default_application_group: + type: string + description: Group to assign to automatically created applications. + override_authorization_flow: + type: string + format: uuid + nullable: true + description: Authorization flow applied to dynamically registered clients. + override_invalidation_flow: + type: string + format: uuid + nullable: true + override_property_mappings: + type: array + items: + type: string + format: uuid + description: Scope mappings applied to dynamically registered clients. + access_token_validity: + type: string + description: 'Maximum access token validity for registered clients (Format: + hours=1;minutes=2;seconds=3).' + refresh_token_validity: + type: string + description: 'Maximum refresh token validity for registered clients (Format: + hours=1;minutes=2;seconds=3).' + allowed_grant_types: + type: array + items: + $ref: '#/components/schemas/GrantTypeEnum' + description: If empty, all grant types are allowed. + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + required: + - pbm_uuid + - provider + OAuth2DynamicClientRegistrationRequest: + type: object + description: Serializer for OAuth2DynamicClientRegistration + properties: + provider: + type: integer + default_application_group: + type: string + description: Group to assign to automatically created applications. + override_authorization_flow: + type: string + format: uuid + nullable: true + description: Authorization flow applied to dynamically registered clients. + override_invalidation_flow: + type: string + format: uuid + nullable: true + override_property_mappings: + type: array + items: + type: string + format: uuid + description: Scope mappings applied to dynamically registered clients. + access_token_validity: + type: string + minLength: 1 + description: 'Maximum access token validity for registered clients (Format: + hours=1;minutes=2;seconds=3).' + refresh_token_validity: + type: string + minLength: 1 + description: 'Maximum refresh token validity for registered clients (Format: + hours=1;minutes=2;seconds=3).' + allowed_grant_types: + type: array + items: + $ref: '#/components/schemas/GrantTypeEnum' + description: If empty, all grant types are allowed. + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + required: + - provider + OAuth2Provider: + type: object + description: OAuth2Provider Serializer + properties: + pk: + type: integer + readOnly: true + title: ID + name: + type: string + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow used for authentication when the associated application + is accessed by an un-authenticated user. + authorization_flow: + type: string + format: uuid + description: Flow used when authorizing this provider. + invalidation_flow: + type: string + format: uuid + description: Flow used ending the session from a provider. + property_mappings: + type: array + items: + type: string + format: uuid + component: + type: string + description: Get object component so that we know how to edit the object + readOnly: true + assigned_application_slug: + type: string + description: Internal application name, used in URLs. + readOnly: true + nullable: true + assigned_application_name: + type: string + description: Application's display Name. + readOnly: true + nullable: true + assigned_backchannel_application_slug: + type: string + description: Internal application name, used in URLs. + readOnly: true + nullable: true + assigned_backchannel_application_name: + type: string + description: Application's display Name. + readOnly: true + nullable: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + client_type: + allOf: + - $ref: '#/components/schemas/ClientTypeEnum' + description: Confidential clients are capable of maintaining the confidentiality + of their credentials. Public clients are incapable + grant_types: + type: array + items: + $ref: '#/components/schemas/GrantTypeEnum' + client_id: + type: string + maxLength: 255 + client_secret: + type: string + maxLength: 255 + access_code_validity: + type: string + description: 'Access codes not valid on or after current time + this value + (Format: hours=1;minutes=2;seconds=3).' + access_token_validity: + type: string + description: 'Tokens not valid on or after current time + this value (Format: + hours=1;minutes=2;seconds=3).' + refresh_token_validity: + type: string + description: 'Tokens not valid on or after current time + this value (Format: + hours=1;minutes=2;seconds=3).' + refresh_token_threshold: + type: string + description: 'When refreshing a token, if the refresh token is valid for + less than this duration, it will be renewed. When set to seconds=0, token + will always be renewed. (Format: hours=1;minutes=2;seconds=3).' + include_claims_in_id_token: + type: boolean + description: Include User claims from scopes in the id_token, for applications + that don't access the userinfo endpoint. + signing_key: + type: string + format: uuid + nullable: true + description: Key used to sign the tokens. + encryption_key: + type: string + format: uuid + nullable: true + description: Key used to encrypt the tokens. When set, tokens will be encrypted + and returned as JWEs. + redirect_uris: + type: array + items: + $ref: '#/components/schemas/RedirectURI' + logout_uri: + type: string + format: uri + logout_method: + allOf: + - $ref: '#/components/schemas/OAuth2ProviderLogoutMethodEnum' + description: Backchannel logs out with server to server calls. Frontchannel + uses iframes in your browser + sub_mode: + allOf: + - $ref: '#/components/schemas/SubModeEnum' + description: Configure what data should be used as unique User Identifier. + For most cases, the default should be fine. + issuer_mode: + allOf: + - $ref: '#/components/schemas/IssuerModeEnum' + description: Configure how the issuer field of the ID Token should be filled. + jwt_federation_sources: + type: array + items: + type: string + format: uuid + title: Any JWT signed by the JWK of the selected source can be used to + authenticate. + title: Any JWT signed by the JWK of the selected source can be used to authenticate. + jwt_federation_providers: + type: array + items: + type: integer + required: + - assigned_application_name + - assigned_application_slug + - assigned_backchannel_application_name + - assigned_backchannel_application_slug + - authorization_flow + - component + - invalidation_flow + - meta_model_name + - name + - pk + - redirect_uris + - verbose_name + - verbose_name_plural + OAuth2ProviderLogoutMethodEnum: + enum: + - backchannel + - frontchannel + type: string + OAuth2ProviderRequest: + type: object + description: OAuth2Provider Serializer + properties: + name: + type: string + minLength: 1 + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow used for authentication when the associated application + is accessed by an un-authenticated user. + authorization_flow: + type: string + format: uuid + description: Flow used when authorizing this provider. + invalidation_flow: + type: string + format: uuid + description: Flow used ending the session from a provider. + property_mappings: + type: array + items: + type: string + format: uuid + client_type: + allOf: + - $ref: '#/components/schemas/ClientTypeEnum' + description: Confidential clients are capable of maintaining the confidentiality + of their credentials. Public clients are incapable + grant_types: + type: array + items: + $ref: '#/components/schemas/GrantTypeEnum' + client_id: + type: string + minLength: 1 + maxLength: 255 + client_secret: + type: string + maxLength: 255 + access_code_validity: + type: string + minLength: 1 + description: 'Access codes not valid on or after current time + this value + (Format: hours=1;minutes=2;seconds=3).' + access_token_validity: + type: string + minLength: 1 + description: 'Tokens not valid on or after current time + this value (Format: + hours=1;minutes=2;seconds=3).' + refresh_token_validity: + type: string + minLength: 1 + description: 'Tokens not valid on or after current time + this value (Format: + hours=1;minutes=2;seconds=3).' + refresh_token_threshold: + type: string + minLength: 1 + description: 'When refreshing a token, if the refresh token is valid for + less than this duration, it will be renewed. When set to seconds=0, token + will always be renewed. (Format: hours=1;minutes=2;seconds=3).' + include_claims_in_id_token: + type: boolean + description: Include User claims from scopes in the id_token, for applications + that don't access the userinfo endpoint. + signing_key: + type: string + format: uuid + nullable: true + description: Key used to sign the tokens. + encryption_key: + type: string + format: uuid + nullable: true + description: Key used to encrypt the tokens. When set, tokens will be encrypted + and returned as JWEs. + redirect_uris: + type: array + items: + $ref: '#/components/schemas/RedirectURIRequest' + logout_uri: + type: string + format: uri + logout_method: + allOf: + - $ref: '#/components/schemas/OAuth2ProviderLogoutMethodEnum' + description: Backchannel logs out with server to server calls. Frontchannel + uses iframes in your browser + sub_mode: + allOf: + - $ref: '#/components/schemas/SubModeEnum' + description: Configure what data should be used as unique User Identifier. + For most cases, the default should be fine. + issuer_mode: + allOf: + - $ref: '#/components/schemas/IssuerModeEnum' + description: Configure how the issuer field of the ID Token should be filled. + jwt_federation_sources: + type: array + items: + type: string + format: uuid + title: Any JWT signed by the JWK of the selected source can be used to + authenticate. + title: Any JWT signed by the JWK of the selected source can be used to authenticate. + jwt_federation_providers: + type: array + items: + type: integer + required: + - authorization_flow + - invalidation_flow + - name + - redirect_uris + OAuth2ProviderSetupURLs: + type: object + description: OAuth2 Provider Metadata serializer + properties: + issuer: + type: string + readOnly: true + authorize: + type: string + readOnly: true + token: + type: string + readOnly: true + user_info: + type: string + readOnly: true + provider_info: + type: string + readOnly: true + logout: + type: string + readOnly: true + jwks: + type: string + readOnly: true + dcr_registration: + type: string + readOnly: true + nullable: true + required: + - authorize + - dcr_registration + - issuer + - jwks + - logout + - provider_info + - token + - user_info + OAuthDeviceCodeChallenge: + type: object + description: OAuth Device code challenge + properties: + flow_info: + $ref: '#/components/schemas/ContextualFlowInfo' + component: + type: string + default: ak-provider-oauth2-device-code + response_errors: + type: object + additionalProperties: + type: array + items: + $ref: '#/components/schemas/ErrorDetail' + OAuthDeviceCodeChallengeResponseRequest: + type: object + description: Response that includes the user-entered device code + properties: + component: + type: string + minLength: 1 + default: ak-provider-oauth2-device-code + code: + type: string + minLength: 1 + required: + - code + OAuthDeviceCodeFinishChallenge: + type: object + description: Final challenge after user enters their code + properties: + flow_info: + $ref: '#/components/schemas/ContextualFlowInfo' + component: + type: string + default: ak-provider-oauth2-device-code-finish + response_errors: + type: object + additionalProperties: + type: array + items: + $ref: '#/components/schemas/ErrorDetail' + OAuthDeviceCodeFinishChallengeResponseRequest: + type: object + description: Response that device has been authenticated and tab can be closed + properties: + component: + type: string + minLength: 1 + default: ak-provider-oauth2-device-code-finish + OAuthSource: + type: object + description: OAuth Source Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Pbm uuid + name: + type: string + description: Source's display Name. + slug: + type: string + description: Internal source name, used in URLs. + pattern: ^[-a-zA-Z0-9_]+$ + enabled: + type: boolean + promoted: + type: boolean + description: When enabled, this source will be displayed as a prominent + button on the login page, instead of a small icon. + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow to use when authenticating existing users. + enrollment_flow: + type: string + format: uuid + nullable: true + description: Flow to use when enrolling new users. + user_property_mappings: + type: array + items: + type: string + format: uuid + group_property_mappings: + type: array + items: + type: string + format: uuid + component: + type: string + description: Get object component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + user_matching_mode: + allOf: + - $ref: '#/components/schemas/UserMatchingModeEnum' + description: How the source determines if an existing user should be authenticated + or a new user enrolled. + managed: + type: string + nullable: true + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + readOnly: true + user_path_template: + type: string + icon: + type: string + icon_url: + type: string + nullable: true + readOnly: true + icon_themed_urls: + allOf: + - $ref: '#/components/schemas/ThemedUrls' + readOnly: true + nullable: true + group_matching_mode: + allOf: + - $ref: '#/components/schemas/GroupMatchingModeEnum' + description: How the source determines if an existing group should be used + or a new group created. + provider_type: + $ref: '#/components/schemas/ProviderTypeEnum' + request_token_url: + type: string + nullable: true + description: URL used to request the initial token. This URL is only required + for OAuth 1. + authorization_url: + type: string + nullable: true + description: URL the user is redirect to to conest the flow. + access_token_url: + type: string + nullable: true + description: URL used by authentik to retrieve tokens. + profile_url: + type: string + nullable: true + description: URL used by authentik to get user information. + pkce: + $ref: '#/components/schemas/PKCEMethodEnum' + consumer_key: + type: string + callback_url: + type: string + description: Get OAuth Callback URL + readOnly: true + additional_scopes: + type: string + type: + allOf: + - $ref: '#/components/schemas/SourceType' + readOnly: true + oidc_well_known_url: + type: string + oidc_jwks_url: + type: string + oidc_jwks: + type: object + additionalProperties: {} + authorization_code_auth_method: + allOf: + - $ref: '#/components/schemas/AuthorizationCodeAuthMethodEnum' + description: How to perform authentication during an authorization_code + token request flow + required: + - callback_url + - component + - consumer_key + - icon_themed_urls + - icon_url + - managed + - meta_model_name + - name + - pk + - provider_type + - slug + - type + - verbose_name + - verbose_name_plural + OAuthSourcePropertyMapping: + type: object + description: OAuthSourcePropertyMapping Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Pm uuid + managed: + type: string + nullable: true + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + expression: + type: string + component: + type: string + description: Get object's component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + required: + - component + - expression + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + OAuthSourcePropertyMappingRequest: + type: object + description: OAuthSourcePropertyMapping Serializer + properties: + managed: + type: string + nullable: true + minLength: 1 + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + minLength: 1 + expression: + type: string + minLength: 1 + required: + - expression + - name + OAuthSourceRequest: + type: object + description: OAuth Source Serializer + properties: + name: + type: string + minLength: 1 + description: Source's display Name. + slug: + type: string + minLength: 1 + description: Internal source name, used in URLs. + pattern: ^[-a-zA-Z0-9_]+$ + enabled: + type: boolean + promoted: + type: boolean + description: When enabled, this source will be displayed as a prominent + button on the login page, instead of a small icon. + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow to use when authenticating existing users. + enrollment_flow: + type: string + format: uuid + nullable: true + description: Flow to use when enrolling new users. + user_property_mappings: + type: array + items: + type: string + format: uuid + group_property_mappings: + type: array + items: + type: string + format: uuid + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + user_matching_mode: + allOf: + - $ref: '#/components/schemas/UserMatchingModeEnum' + description: How the source determines if an existing user should be authenticated + or a new user enrolled. + user_path_template: + type: string + minLength: 1 + icon: + type: string + group_matching_mode: + allOf: + - $ref: '#/components/schemas/GroupMatchingModeEnum' + description: How the source determines if an existing group should be used + or a new group created. + provider_type: + $ref: '#/components/schemas/ProviderTypeEnum' + request_token_url: + type: string + nullable: true + description: URL used to request the initial token. This URL is only required + for OAuth 1. + authorization_url: + type: string + nullable: true + description: URL the user is redirect to to conest the flow. + access_token_url: + type: string + nullable: true + description: URL used by authentik to retrieve tokens. + profile_url: + type: string + nullable: true + description: URL used by authentik to get user information. + pkce: + $ref: '#/components/schemas/PKCEMethodEnum' + consumer_key: + type: string + minLength: 1 + consumer_secret: + type: string + writeOnly: true + minLength: 1 + additional_scopes: + type: string + oidc_well_known_url: + type: string + oidc_jwks_url: + type: string + oidc_jwks: + type: object + additionalProperties: {} + authorization_code_auth_method: + allOf: + - $ref: '#/components/schemas/AuthorizationCodeAuthMethodEnum' + description: How to perform authentication during an authorization_code + token request flow + required: + - consumer_key + - consumer_secret + - name + - provider_type + - slug + ObjectAttribute: + type: object + properties: + pk: + type: string + format: uuid + readOnly: true + title: Attribute id + object_type: + type: string + object_type_obj: + allOf: + - $ref: '#/components/schemas/ContentType' + readOnly: true + enabled: + type: boolean + default: true + created: + type: string + format: date-time + readOnly: true + key: + type: string + label: + type: string + last_updated: + type: string + format: date-time + readOnly: true + regex: + type: string + type: + $ref: '#/components/schemas/ObjectAttributeTypeEnum' + group: + type: string + managed: + type: string + nullable: true + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + is_unique: + type: boolean + is_required: + type: boolean + required: + - created + - key + - label + - last_updated + - object_type + - object_type_obj + - pk + - type + ObjectAttributeRequest: + type: object + properties: + object_type: + type: string + minLength: 1 + enabled: + type: boolean + default: true + key: + type: string + minLength: 1 + label: + type: string + minLength: 1 + regex: + type: string + type: + $ref: '#/components/schemas/ObjectAttributeTypeEnum' + group: + type: string + managed: + type: string + nullable: true + minLength: 1 + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + is_unique: + type: boolean + is_required: + type: boolean + required: + - key + - label + - object_type + - type + ObjectAttributeTypeEnum: + enum: + - text + - number + - boolean + type: string + OffboardingActionEnum: + enum: + - deactivate + - delete + type: string + OffboardingStatusEnum: + enum: + - pending + - completed + - failed + - canceled + type: string + OpenIDConnectConfiguration: + type: object + description: rest_framework Serializer for OIDC Configuration + properties: + issuer: + type: string + authorization_endpoint: + type: string + token_endpoint: + type: string + userinfo_endpoint: + type: string + end_session_endpoint: + type: string + introspection_endpoint: + type: string + jwks_uri: + type: string + response_types_supported: + type: array + items: + type: string + id_token_signing_alg_values_supported: + type: array + items: + type: string + subject_types_supported: + type: array + items: + type: string + token_endpoint_auth_methods_supported: + type: array + items: + type: string + required: + - authorization_endpoint + - end_session_endpoint + - id_token_signing_alg_values_supported + - introspection_endpoint + - issuer + - jwks_uri + - response_types_supported + - subject_types_supported + - token_endpoint + - token_endpoint_auth_methods_supported + - userinfo_endpoint + OperatingSystem: + type: object + description: |- + For example: + {"family":"linux","name":"Ubuntu","version":"24.04.3 LTS (Noble Numbat)","arch":"amd64"} + {"family": "windows","name":"Server 2022 Datacenter","version":"10.0.20348.4405","arch":"amd64"} + {"family": "windows","name":"Server 2022 Datacenter","version":"10.0.20348.4405","arch":"amd64"} + {"family": "mac_os", "name": "", "version": "26.2", "arch": "arm64"} + properties: + family: + $ref: '#/components/schemas/DeviceFactsOSFamily' + name: + type: string + description: Operating System name, such as 'Server 2022' or 'Ubuntu' + version: + type: string + description: Operating System version, must always be the version number + but may contain build name + arch: + type: string + required: + - family + OperatingSystemRequest: + type: object + description: |- + For example: + {"family":"linux","name":"Ubuntu","version":"24.04.3 LTS (Noble Numbat)","arch":"amd64"} + {"family": "windows","name":"Server 2022 Datacenter","version":"10.0.20348.4405","arch":"amd64"} + {"family": "windows","name":"Server 2022 Datacenter","version":"10.0.20348.4405","arch":"amd64"} + {"family": "mac_os", "name": "", "version": "26.2", "arch": "arm64"} + properties: + family: + $ref: '#/components/schemas/DeviceFactsOSFamily' + name: + type: string + minLength: 1 + description: Operating System name, such as 'Server 2022' or 'Ubuntu' + version: + type: string + minLength: 1 + description: Operating System version, must always be the version number + but may contain build name + arch: + type: string + minLength: 1 + required: + - family + OutgoingSyncDeleteAction: + enum: + - do_nothing + - delete + - suspend + type: string + Outpost: + type: object + description: Outpost Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Uuid + name: + type: string + type: + $ref: '#/components/schemas/OutpostTypeEnum' + providers: + type: array + items: + type: integer + providers_obj: + type: array + items: + $ref: '#/components/schemas/Provider' + readOnly: true + service_connection: + type: string + format: uuid + nullable: true + description: Select Service-Connection authentik should use to manage this + outpost. Leave empty if authentik should not handle the deployment. + service_connection_obj: + allOf: + - $ref: '#/components/schemas/ServiceConnection' + readOnly: true + nullable: true + refresh_interval_s: + type: integer + readOnly: true + token_identifier: + type: string + description: Get Token identifier + readOnly: true + config: + type: object + additionalProperties: {} + managed: + type: string + nullable: true + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + required: + - config + - name + - pk + - providers + - providers_obj + - refresh_interval_s + - service_connection_obj + - token_identifier + - type + OutpostDefaultConfig: + type: object + description: Global default outpost config + properties: + config: + type: object + additionalProperties: {} + readOnly: true + required: + - config + OutpostHealth: + type: object + description: Outpost health status + properties: + uid: + type: string + readOnly: true + last_seen: + type: string + format: date-time + readOnly: true + version: + type: string + readOnly: true + golang_version: + type: string + readOnly: true + openssl_enabled: + type: boolean + readOnly: true + openssl_version: + type: string + readOnly: true + fips_enabled: + type: boolean + nullable: true + description: Get FIPS enabled + readOnly: true + version_should: + type: string + readOnly: true + version_outdated: + type: boolean + readOnly: true + build_hash: + type: string + readOnly: true + build_hash_should: + type: string + readOnly: true + hostname: + type: string + readOnly: true + required: + - build_hash + - build_hash_should + - fips_enabled + - golang_version + - hostname + - last_seen + - openssl_enabled + - openssl_version + - uid + - version + - version_outdated + - version_should + OutpostRequest: + type: object + description: Outpost Serializer + properties: + name: + type: string + minLength: 1 + type: + $ref: '#/components/schemas/OutpostTypeEnum' + providers: + type: array + items: + type: integer + service_connection: + type: string + format: uuid + nullable: true + description: Select Service-Connection authentik should use to manage this + outpost. Leave empty if authentik should not handle the deployment. + config: + type: object + additionalProperties: {} + managed: + type: string + nullable: true + minLength: 1 + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + required: + - config + - name + - providers + - type + OutpostTypeEnum: + enum: + - proxy + - ldap + - radius + - rac + type: string + PKCEMethodEnum: + enum: + - none + - plain + - S256 + type: string + PaginatedAccountLockdownStageList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/AccountLockdownStage' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedAgentConnectorList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/AgentConnector' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedAgentList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/Agent' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedAppleIndependentSecureEnclaveList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/AppleIndependentSecureEnclave' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedApplicationEntitlementList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/ApplicationEntitlement' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedApplicationList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/Application' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedAuthenticatedSessionList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/AuthenticatedSession' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedAuthenticatorDuoStageList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/AuthenticatorDuoStage' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedAuthenticatorEmailStageList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/AuthenticatorEmailStage' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedAuthenticatorEndpointGDTCStageList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/AuthenticatorEndpointGDTCStage' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedAuthenticatorSMSStageList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/AuthenticatorSMSStage' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedAuthenticatorStaticStageList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/AuthenticatorStaticStage' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedAuthenticatorTOTPStageList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/AuthenticatorTOTPStage' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedAuthenticatorValidateStageList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/AuthenticatorValidateStage' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedAuthenticatorWebAuthnStageList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/AuthenticatorWebAuthnStage' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedBlueprintInstanceList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/BlueprintInstance' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedBrandList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/Brand' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedCaptchaStageList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/CaptchaStage' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedCertificateKeyPairList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/CertificateKeyPair' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedConnectionTokenList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/ConnectionToken' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedConnectorList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/Connector' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedConsentStageList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/ConsentStage' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedDataExportList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/DataExport' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedDenyStageList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/DenyStage' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedDeviceAccessGroupList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/DeviceAccessGroup' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedDeviceUserBindingList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/DeviceUserBinding' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedDockerServiceConnectionList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/DockerServiceConnection' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedDummyPolicyList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/DummyPolicy' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedDummyStageList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/DummyStage' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedDuoDeviceList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/DuoDevice' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedEmailDeviceList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/EmailDevice' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedEmailStageList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/EmailStage' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedEndpointDeviceList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/EndpointDevice' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedEndpointList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/Endpoint' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedEndpointStageList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/EndpointStage' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedEnrollmentTokenList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/EnrollmentToken' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedEventList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/Event' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedEventMatcherPolicyList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/EventMatcherPolicy' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedExpiringBaseGrantModelList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/ExpiringBaseGrantModel' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedExpressionPolicyList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/ExpressionPolicy' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedExtraRoleObjectPermissionList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/ExtraRoleObjectPermission' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedFleetConnectorList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/FleetConnector' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedFlowList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/Flow' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedFlowStageBindingList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/FlowStageBinding' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedGeoIPPolicyList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/GeoIPPolicy' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedGoogleChromeConnectorList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/GoogleChromeConnector' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedGoogleEndpointDeviceList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/GoogleEndpointDevice' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedGoogleWorkspaceProviderGroupList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/GoogleWorkspaceProviderGroup' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedGoogleWorkspaceProviderList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/GoogleWorkspaceProvider' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedGoogleWorkspaceProviderMappingList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/GoogleWorkspaceProviderMapping' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedGoogleWorkspaceProviderUserList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/GoogleWorkspaceProviderUser' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedGrantRequestList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/GrantRequest' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedGroupKerberosSourceConnectionList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/GroupKerberosSourceConnection' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedGroupLDAPSourceConnectionList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/GroupLDAPSourceConnection' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedGroupList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/Group' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedGroupOAuthSourceConnectionList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/GroupOAuthSourceConnection' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedGroupPlexSourceConnectionList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/GroupPlexSourceConnection' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedGroupSAMLSourceConnectionList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/GroupSAMLSourceConnection' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedGroupSourceConnectionList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/GroupSourceConnection' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedGroupTelegramSourceConnectionList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/GroupTelegramSourceConnection' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedIdentificationStageList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/IdentificationStage' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedInitialPermissionsList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/InitialPermissions' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedInvitationList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/Invitation' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedInvitationStageList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/InvitationStage' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedKerberosSourceList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/KerberosSource' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedKerberosSourcePropertyMappingList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/KerberosSourcePropertyMapping' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedKubernetesServiceConnectionList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/KubernetesServiceConnection' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedLDAPOutpostConfigList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/LDAPOutpostConfig' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedLDAPProviderList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/LDAPProvider' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedLDAPSourceList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/LDAPSource' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedLDAPSourcePropertyMappingList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/LDAPSourcePropertyMapping' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedLicenseList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/License' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedLifecycleIterationList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/LifecycleIteration' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedLifecycleRuleList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/LifecycleRule' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedMicrosoftEntraProviderGroupList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/MicrosoftEntraProviderGroup' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedMicrosoftEntraProviderList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/MicrosoftEntraProvider' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedMicrosoftEntraProviderMappingList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/MicrosoftEntraProviderMapping' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedMicrosoftEntraProviderUserList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/MicrosoftEntraProviderUser' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedMutualTLSStageList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/MutualTLSStage' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedNotificationList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/Notification' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedNotificationRuleList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/NotificationRule' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedNotificationTransportList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/NotificationTransport' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedNotificationWebhookMappingList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/NotificationWebhookMapping' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedOAuth2DynamicClientRegistrationList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/OAuth2DynamicClientRegistration' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedOAuth2ProviderList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/OAuth2Provider' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedOAuthSourceList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/OAuthSource' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedOAuthSourcePropertyMappingList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/OAuthSourcePropertyMapping' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedObjectAttributeList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/ObjectAttribute' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedOutpostList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/Outpost' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedPasswordExpiryPolicyList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/PasswordExpiryPolicy' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedPasswordPolicyList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/PasswordPolicy' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedPasswordStageList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/PasswordStage' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedPermissionList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/Permission' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedPlexSourceList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/PlexSource' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedPlexSourcePropertyMappingList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/PlexSourcePropertyMapping' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedPolicyBindingList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/PolicyBinding' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedPolicyList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/Policy' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedPromptList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/Prompt' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedPromptStageList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/PromptStage' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedPropertyMappingList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/PropertyMapping' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedProviderList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/Provider' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedProxyOutpostConfigList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/ProxyOutpostConfig' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedProxyProviderList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/ProxyProvider' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedRACPropertyMappingList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/RACPropertyMapping' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedRACProviderList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/RACProvider' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedRadiusOutpostConfigList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/RadiusOutpostConfig' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedRadiusProviderList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/RadiusProvider' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedRadiusProviderPropertyMappingList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/RadiusProviderPropertyMapping' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedRedirectStageList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/RedirectStage' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedReputationList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/Reputation' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedReputationPolicyList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/ReputationPolicy' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedRequestRuleBindingList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/RequestRuleBinding' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedRequestRuleChildBindingList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/RequestRuleChildBinding' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedRequestRuleList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/RequestRule' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedRequestableTargetList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/RequestableTarget' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedRoleAssignedObjectPermissionList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/RoleAssignedObjectPermission' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedRoleList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/Role' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedSAMLPropertyMappingList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/SAMLPropertyMapping' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedSAMLProviderList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/SAMLProvider' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedSAMLSourceList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/SAMLSource' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedSAMLSourcePropertyMappingList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/SAMLSourcePropertyMapping' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedSCIMMappingList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/SCIMMapping' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedSCIMProviderGroupList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/SCIMProviderGroup' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedSCIMProviderList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/SCIMProvider' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedSCIMProviderUserList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/SCIMProviderUser' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedSCIMSourceGroupList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/SCIMSourceGroup' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedSCIMSourceList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/SCIMSource' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedSCIMSourcePropertyMappingList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/SCIMSourcePropertyMapping' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedSCIMSourceUserList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/SCIMSourceUser' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedSMSDeviceList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/SMSDevice' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedSSFProviderList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/SSFProvider' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedSSFStreamList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/SSFStream' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedScheduleList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/Schedule' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedScopeMappingList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/ScopeMapping' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedServiceConnectionList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/ServiceConnection' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedSourceList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/Source' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedSourceStageList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/SourceStage' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedStageList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/Stage' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedStaticDeviceList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/StaticDevice' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedTOTPDeviceList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/TOTPDevice' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedTaskList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/Task' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedTelegramSourceList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/TelegramSource' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedTelegramSourcePropertyMappingList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/TelegramSourcePropertyMapping' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedTokenList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/Token' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedTokenModelList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/TokenModel' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedUniquePasswordPolicyList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/UniquePasswordPolicy' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedUserConsentList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/UserConsent' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedUserDeleteStageList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/UserDeleteStage' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedUserKerberosSourceConnectionList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/UserKerberosSourceConnection' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedUserLDAPSourceConnectionList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/UserLDAPSourceConnection' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedUserList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/User' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedUserLoginStageList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/UserLoginStage' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedUserLogoutStageList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/UserLogoutStage' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedUserOAuthSourceConnectionList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/UserOAuthSourceConnection' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedUserOffboardingList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/UserOffboarding' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedUserPlexSourceConnectionList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/UserPlexSourceConnection' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedUserSAMLSourceConnectionList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/UserSAMLSourceConnection' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedUserSourceConnectionList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/UserSourceConnection' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedUserTelegramSourceConnectionList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/UserTelegramSourceConnection' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedUserWriteStageList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/UserWriteStage' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedWSFederationProviderList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/WSFederationProvider' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedWebAuthnDeviceList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/WebAuthnDevice' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + PaginatedWebAuthnDeviceTypeList: + type: object + properties: + pagination: + $ref: '#/components/schemas/Pagination' + results: + type: array + items: + $ref: '#/components/schemas/WebAuthnDeviceType' + autocomplete: + $ref: '#/components/schemas/Autocomplete' + required: + - autocomplete + - pagination + - results + Pagination: + type: object + properties: + next: + type: number + previous: + type: number + count: + type: number + current: + type: number + total_pages: + type: number + start_index: + type: number + end_index: + type: number + required: + - count + - current + - end_index + - next + - previous + - start_index + - total_pages + PartialGroup: + type: object + description: Partial Group Serializer, does not include child relations. + properties: + pk: + type: string + format: uuid + readOnly: true + title: Group uuid + num_pk: + type: integer + description: Get a numerical, int32 ID for the group + readOnly: true + name: + type: string + is_superuser: + type: boolean + description: Users added to this group will be superusers. + attributes: + type: object + additionalProperties: {} + required: + - name + - num_pk + - pk + PartialUser: + type: object + description: Partial User Serializer, does not include child relations. + properties: + pk: + type: integer + readOnly: true + title: ID + username: + type: string + description: Required. 150 characters or fewer. Letters, digits and @/./+/-/_ + only. + pattern: ^[\w.@+-]+$ + maxLength: 150 + name: + type: string + description: User's display name. + is_active: + type: boolean + title: Active + description: Designates whether this user should be treated as active. Unselect + this instead of deleting accounts. + last_login: + type: string + format: date-time + nullable: true + email: + type: string + format: email + title: Email address + maxLength: 254 + attributes: + type: object + additionalProperties: {} + uid: + type: string + readOnly: true + required: + - name + - pk + - uid + - username + PasswordChallenge: + type: object + description: Password challenge UI fields + properties: + flow_info: + $ref: '#/components/schemas/ContextualFlowInfo' + component: + type: string + default: ak-stage-password + response_errors: + type: object + additionalProperties: + type: array + items: + $ref: '#/components/schemas/ErrorDetail' + pending_user: + type: string + pending_user_avatar: + type: string + recovery_url: + type: string + allow_show_password: + type: boolean + default: false + required: + - pending_user + - pending_user_avatar + PasswordChallengeResponseRequest: + type: object + description: Password challenge response + properties: + component: + type: string + minLength: 1 + default: ak-stage-password + password: + type: string + minLength: 1 + required: + - password + PasswordExpiryPolicy: + type: object + description: Password Expiry Policy Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Policy uuid + name: + type: string + execution_logging: + type: boolean + description: When this option is enabled, all executions of this policy + will be logged. By default, only execution errors are logged. + component: + type: string + description: Get object component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + bound_to: + type: integer + description: Return objects policy is bound to + readOnly: true + days: + type: integer + maximum: 2147483647 + minimum: -2147483648 + deny_only: + type: boolean + required: + - bound_to + - component + - days + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + PasswordExpiryPolicyRequest: + type: object + description: Password Expiry Policy Serializer + properties: + name: + type: string + minLength: 1 + execution_logging: + type: boolean + description: When this option is enabled, all executions of this policy + will be logged. By default, only execution errors are logged. + days: + type: integer + maximum: 2147483647 + minimum: -2147483648 + deny_only: + type: boolean + required: + - days + - name + PasswordPolicy: + type: object + description: Password Policy Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Policy uuid + name: + type: string + execution_logging: + type: boolean + description: When this option is enabled, all executions of this policy + will be logged. By default, only execution errors are logged. + component: + type: string + description: Get object component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + bound_to: + type: integer + description: Return objects policy is bound to + readOnly: true + password_field: + type: string + description: Field key to check, field keys defined in Prompt stages are + available. + amount_digits: + type: integer + maximum: 2147483647 + minimum: 0 + amount_uppercase: + type: integer + maximum: 2147483647 + minimum: 0 + amount_lowercase: + type: integer + maximum: 2147483647 + minimum: 0 + amount_symbols: + type: integer + maximum: 2147483647 + minimum: 0 + length_min: + type: integer + maximum: 2147483647 + minimum: 0 + symbol_charset: + type: string + error_message: + type: string + check_static_rules: + type: boolean + check_have_i_been_pwned: + type: boolean + check_zxcvbn: + type: boolean + hibp_allowed_count: + type: integer + maximum: 2147483647 + minimum: 0 + description: How many times the password hash is allowed to be on haveibeenpwned + zxcvbn_score_threshold: + type: integer + maximum: 2147483647 + minimum: 0 + description: If the zxcvbn score is equal or less than this value, the policy + will fail. + required: + - bound_to + - component + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + PasswordPolicyRequest: + type: object + description: Password Policy Serializer + properties: + name: + type: string + minLength: 1 + execution_logging: + type: boolean + description: When this option is enabled, all executions of this policy + will be logged. By default, only execution errors are logged. + password_field: + type: string + minLength: 1 + description: Field key to check, field keys defined in Prompt stages are + available. + amount_digits: + type: integer + maximum: 2147483647 + minimum: 0 + amount_uppercase: + type: integer + maximum: 2147483647 + minimum: 0 + amount_lowercase: + type: integer + maximum: 2147483647 + minimum: 0 + amount_symbols: + type: integer + maximum: 2147483647 + minimum: 0 + length_min: + type: integer + maximum: 2147483647 + minimum: 0 + symbol_charset: + type: string + minLength: 1 + error_message: + type: string + check_static_rules: + type: boolean + check_have_i_been_pwned: + type: boolean + check_zxcvbn: + type: boolean + hibp_allowed_count: + type: integer + maximum: 2147483647 + minimum: 0 + description: How many times the password hash is allowed to be on haveibeenpwned + zxcvbn_score_threshold: + type: integer + maximum: 2147483647 + minimum: 0 + description: If the zxcvbn score is equal or less than this value, the policy + will fail. + required: + - name + PasswordStage: + type: object + description: PasswordStage Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Stage uuid + name: + type: string + component: + type: string + description: Get object type so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + flow_set: + type: array + items: + $ref: '#/components/schemas/FlowSet' + readOnly: true + backends: + type: array + items: + $ref: '#/components/schemas/BackendsEnum' + description: Selection of backends to test the password against. + configure_flow: + type: string + format: uuid + nullable: true + description: Flow used by an authenticated user to configure this Stage. + If empty, user will not be able to configure this stage. + failed_attempts_before_cancel: + type: integer + maximum: 2147483647 + minimum: -2147483648 + description: How many attempts a user has before the flow is canceled. To + lock the user out, use a reputation policy and a user_write stage. + allow_show_password: + type: boolean + description: When enabled, provides a 'show password' button with the password + input field. + required: + - backends + - component + - flow_set + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + PasswordStageRequest: + type: object + description: PasswordStage Serializer + properties: + name: + type: string + minLength: 1 + backends: + type: array + items: + $ref: '#/components/schemas/BackendsEnum' + description: Selection of backends to test the password against. + configure_flow: + type: string + format: uuid + nullable: true + description: Flow used by an authenticated user to configure this Stage. + If empty, user will not be able to configure this stage. + failed_attempts_before_cancel: + type: integer + maximum: 2147483647 + minimum: -2147483648 + description: How many attempts a user has before the flow is canceled. To + lock the user out, use a reputation policy and a user_write stage. + allow_show_password: + type: boolean + description: When enabled, provides a 'show password' button with the password + input field. + required: + - backends + - name + PatchedAccountLockdownStageRequest: + type: object + description: AccountLockdownStage Serializer + properties: + name: + type: string + minLength: 1 + deactivate_user: + type: boolean + description: Deactivate the user account (set is_active to False) + set_unusable_password: + type: boolean + description: Set an unusable password for the user + delete_sessions: + type: boolean + description: Delete all active sessions for the user + revoke_tokens: + type: boolean + description: Revoke all tokens for the user (API, app password, recovery, + verification, OAuth) + self_service_completion_flow: + type: string + format: uuid + nullable: true + description: Flow to redirect users to after self-service lockdown. This + flow should not require authentication since the user's session is deleted. + PatchedAgentConnectorRequest: + type: object + properties: + connector_uuid: + type: string + format: uuid + name: + type: string + minLength: 1 + enabled: + type: boolean + snapshot_expiry: + type: string + minLength: 1 + auth_session_duration: + type: string + minLength: 1 + auth_terminate_session_on_expiry: + type: boolean + refresh_interval: + type: string + minLength: 1 + authorization_flow: + type: string + format: uuid + nullable: true + nss_uid_offset: + type: integer + maximum: 2147483647 + minimum: 0 + nss_gid_offset: + type: integer + maximum: 2147483647 + minimum: 0 + challenge_key: + type: string + format: uuid + nullable: true + challenge_idle_timeout: + type: string + minLength: 1 + challenge_trigger_check_in: + type: boolean + jwt_federation_providers: + type: array + items: + type: integer + PatchedAgentRequest: + type: object + description: |- + Mixin to validate that a valid enterprise license + exists before allowing to save the object + properties: + username: + type: string + minLength: 1 + description: Required. 150 characters or fewer. Letters, digits and @/./+/-/_ + only. + pattern: ^[\w.@+-]+$ + maxLength: 150 + name: + type: string + minLength: 1 + description: User's display name. + is_active: + type: boolean + title: Active + description: Designates whether this user should be treated as active. Unselect + this instead of deleting accounts. + last_login: + type: string + format: date-time + nullable: true + email: + type: string + format: email + title: Email address + maxLength: 254 + attributes: + type: object + additionalProperties: {} + expiring: + type: boolean + expires: + type: string + format: date-time + nullable: true + PatchedAppleIndependentSecureEnclaveRequest: + type: object + properties: + uuid: + type: string + format: uuid + user: + type: integer + description: The user that this device belongs to. + apple_secure_enclave_key: + type: string + minLength: 1 + apple_enclave_key_id: + type: string + minLength: 1 + device_type: + type: string + minLength: 1 + PatchedApplicationEntitlementRequest: + type: object + description: ApplicationEntitlement Serializer + properties: + name: + type: string + minLength: 1 + app: + type: string + format: uuid + attributes: + type: object + additionalProperties: {} + PatchedApplicationRequest: + type: object + description: Application Serializer + properties: + name: + type: string + minLength: 1 + description: Application's display Name. + slug: + type: string + minLength: 1 + description: Internal application name, used in URLs. + pattern: ^[-a-zA-Z0-9_]+$ + provider: + type: integer + nullable: true + backchannel_providers: + type: array + items: + type: integer + open_in_new_tab: + type: boolean + description: Open launch URL in a new browser tab or window. + meta_launch_url: + type: string + format: uri + meta_icon: + type: string + meta_description: + type: string + meta_publisher: + type: string + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + group: + type: string + meta_hide: + type: boolean + description: Hide this application from the user's My applications page. + PatchedAuthenticatorDuoStageRequest: + type: object + description: AuthenticatorDuoStage Serializer + properties: + name: + type: string + minLength: 1 + configure_flow: + type: string + format: uuid + nullable: true + description: Flow used by an authenticated user to configure this Stage. + If empty, user will not be able to configure this stage. + friendly_name: + type: string + client_id: + type: string + minLength: 1 + client_secret: + type: string + writeOnly: true + minLength: 1 + api_hostname: + type: string + minLength: 1 + admin_integration_key: + type: string + admin_secret_key: + type: string + writeOnly: true + PatchedAuthenticatorEmailStageRequest: + type: object + description: AuthenticatorEmailStage Serializer + properties: + name: + type: string + minLength: 1 + configure_flow: + type: string + format: uuid + nullable: true + description: Flow used by an authenticated user to configure this Stage. + If empty, user will not be able to configure this stage. + friendly_name: + type: string + use_global_settings: + type: boolean + description: When enabled, global Email connection settings will be used + and connection settings below will be ignored. + host: + type: string + minLength: 1 + port: + type: integer + maximum: 2147483647 + minimum: -2147483648 + username: + type: string + password: + type: string + writeOnly: true + use_tls: + type: boolean + use_ssl: + type: boolean + timeout: + type: integer + maximum: 2147483647 + minimum: -2147483648 + from_address: + type: string + format: email + minLength: 1 + maxLength: 254 + subject: + type: string + minLength: 1 + token_expiry: + type: string + minLength: 1 + description: 'Time the token sent is valid (Format: hours=3,minutes=17,seconds=300).' + template: + type: string + minLength: 1 + PatchedAuthenticatorEndpointGDTCStageRequest: + type: object + description: AuthenticatorEndpointGDTCStage Serializer + properties: + name: + type: string + minLength: 1 + configure_flow: + type: string + format: uuid + nullable: true + description: Flow used by an authenticated user to configure this Stage. + If empty, user will not be able to configure this stage. + friendly_name: + type: string + credentials: + type: object + additionalProperties: {} + PatchedAuthenticatorSMSStageRequest: + type: object + description: AuthenticatorSMSStage Serializer + properties: + name: + type: string + minLength: 1 + configure_flow: + type: string + format: uuid + nullable: true + description: Flow used by an authenticated user to configure this Stage. + If empty, user will not be able to configure this stage. + friendly_name: + type: string + provider: + $ref: '#/components/schemas/ProviderEnum' + from_number: + type: string + minLength: 1 + account_sid: + type: string + minLength: 1 + auth: + type: string + writeOnly: true + minLength: 1 + auth_password: + type: string + writeOnly: true + auth_type: + $ref: '#/components/schemas/AuthTypeEnum' + verify_only: + type: boolean + description: When enabled, the Phone number is only used during enrollment + to verify the users authenticity. Only a hash of the phone number is saved + to ensure it is not reused in the future. + mapping: + type: string + format: uuid + nullable: true + description: Optionally modify the payload being sent to custom providers. + PatchedAuthenticatorStaticStageRequest: + type: object + description: AuthenticatorStaticStage Serializer + properties: + name: + type: string + minLength: 1 + configure_flow: + type: string + format: uuid + nullable: true + description: Flow used by an authenticated user to configure this Stage. + If empty, user will not be able to configure this stage. + friendly_name: + type: string + token_count: + type: integer + maximum: 2147483647 + minimum: 0 + token_length: + type: integer + maximum: 100 + minimum: 0 + PatchedAuthenticatorTOTPStageRequest: + type: object + description: AuthenticatorTOTPStage Serializer + properties: + name: + type: string + minLength: 1 + configure_flow: + type: string + format: uuid + nullable: true + description: Flow used by an authenticated user to configure this Stage. + If empty, user will not be able to configure this stage. + friendly_name: + type: string + digits: + $ref: '#/components/schemas/DigitsEnum' + PatchedAuthenticatorValidateStageRequest: + type: object + description: AuthenticatorValidateStage Serializer + properties: + name: + type: string + minLength: 1 + not_configured_action: + $ref: '#/components/schemas/NotConfiguredActionEnum' + device_classes: + type: array + items: + $ref: '#/components/schemas/DeviceClassesEnum' + description: Device classes which can be used to authenticate + configuration_stages: + type: array + items: + type: string + format: uuid + description: Stages used to configure Authenticator when user doesn't have + any compatible devices. After this configuration Stage passes, the user + is not prompted again. + last_auth_threshold: + type: string + minLength: 1 + description: If any of the user's device has been used within this threshold, + this stage will be skipped + webauthn_user_verification: + allOf: + - $ref: '#/components/schemas/UserVerificationEnum' + description: Enforce user verification for WebAuthn devices. + webauthn_hints: + type: array + items: + $ref: '#/components/schemas/WebAuthnHintEnum' + webauthn_allowed_device_types: + type: array + items: + type: string + format: uuid + email_otp_throttling_factor: + type: number + format: double + sms_otp_throttling_factor: + type: number + format: double + totp_otp_throttling_factor: + type: number + format: double + static_otp_throttling_factor: + type: number + format: double + PatchedAuthenticatorWebAuthnStageRequest: + type: object + description: AuthenticatorWebAuthnStage Serializer + properties: + name: + type: string + minLength: 1 + configure_flow: + type: string + format: uuid + nullable: true + description: Flow used by an authenticated user to configure this Stage. + If empty, user will not be able to configure this stage. + friendly_name: + type: string + user_verification: + $ref: '#/components/schemas/UserVerificationEnum' + authenticator_attachment: + allOf: + - $ref: '#/components/schemas/AuthenticatorAttachmentEnum' + nullable: true + resident_key_requirement: + $ref: '#/components/schemas/UserVerificationEnum' + hints: + type: array + items: + $ref: '#/components/schemas/WebAuthnHintEnum' + device_type_restrictions: + type: array + items: + type: string + format: uuid + max_attempts: + type: integer + maximum: 2147483647 + minimum: 0 + PatchedBlueprintInstanceRequest: + type: object + description: Info about a single blueprint instance file + properties: + name: + type: string + minLength: 1 + path: + type: string + default: '' + context: + type: object + additionalProperties: {} + enabled: + type: boolean + content: + type: string + PatchedBrandRequest: + type: object + description: Brand Serializer + properties: + domain: + type: string + minLength: 1 + description: Domain that activates this brand. Can be a superset, i.e. `a.b` + for `aa.b` and `ba.b` + default: + type: boolean + branding_title: + type: string + minLength: 1 + branding_logo: + type: string + minLength: 1 + branding_favicon: + type: string + minLength: 1 + branding_custom_css: + type: string + branding_default_flow_background: + type: string + minLength: 1 + branding_map_tiles: + type: string + description: URL template for the vector tile source used by the events + map. Supports XYZ templates with {z}, {x} and {y} placeholders, or pmtiles:// + archive URLs. When empty, the frontend uses the bundled hexworld basemap. + This value is part of the brand information served to unauthenticated + clients; do not embed API keys or other credentials in it. + flow_authentication: + type: string + format: uuid + nullable: true + flow_user_switch: + type: string + format: uuid + nullable: true + flow_invalidation: + type: string + format: uuid + nullable: true + flow_recovery: + type: string + format: uuid + nullable: true + flow_unenrollment: + type: string + format: uuid + nullable: true + flow_user_settings: + type: string + format: uuid + nullable: true + flow_device_code: + type: string + format: uuid + nullable: true + flow_lockdown: + type: string + format: uuid + nullable: true + flow_request: + type: string + format: uuid + nullable: true + default_application: + type: string + format: uuid + nullable: true + description: When set, external users will be redirected to this application + after authenticating. + web_certificate: + type: string + format: uuid + nullable: true + description: Web Certificate used by the authentik Core webserver. + client_certificates: + type: array + items: + type: string + format: uuid + description: Certificates used for client authentication. + attributes: + type: object + additionalProperties: {} + PatchedCaptchaStageRequest: + type: object + description: CaptchaStage Serializer + properties: + name: + type: string + minLength: 1 + public_key: + type: string + minLength: 1 + description: Public key, acquired your captcha Provider. + private_key: + type: string + writeOnly: true + minLength: 1 + description: Private key, acquired your captcha Provider. + js_url: + type: string + minLength: 1 + api_url: + type: string + minLength: 1 + request_content_type: + $ref: '#/components/schemas/RequestContentTypeEnum' + interactive: + type: boolean + score_min_threshold: + type: number + format: double + score_max_threshold: + type: number + format: double + error_on_invalid_score: + type: boolean + description: When enabled and the received captcha score is outside of the + given threshold, the stage will show an error message. When not enabled, + the flow will continue, but the data from the captcha will be available + in the context for policy decisions + PatchedCertificateKeyPairRequest: + type: object + description: CertificateKeyPair Serializer + properties: + name: + type: string + minLength: 1 + certificate_data: + type: string + writeOnly: true + minLength: 1 + description: PEM-encoded Certificate data + key_data: + type: string + writeOnly: true + description: Optional Private Key. If this is set, you can use this keypair + for encryption. + PatchedConnectionTokenRequest: + type: object + description: ConnectionToken Serializer + properties: + pk: + type: string + format: uuid + title: Connection token uuid + provider: + type: integer + endpoint: + type: string + format: uuid + PatchedConsentStageRequest: + type: object + description: ConsentStage Serializer + properties: + name: + type: string + minLength: 1 + mode: + $ref: '#/components/schemas/ConsentModeEnum' + consent_expire_in: + type: string + minLength: 1 + title: Consent expires in + description: 'Offset after which consent expires. (Format: hours=1;minutes=2;seconds=3).' + PatchedDenyStageRequest: + type: object + description: DenyStage Serializer + properties: + name: + type: string + minLength: 1 + deny_message: + type: string + PatchedDeviceAccessGroupRequest: + type: object + properties: + name: + type: string + minLength: 1 + attributes: + type: object + additionalProperties: {} + PatchedDeviceUserBindingRequest: + type: object + description: PolicyBinding Serializer + properties: + policy: + type: string + format: uuid + nullable: true + group: + type: string + format: uuid + nullable: true + user: + type: integer + nullable: true + target: + type: string + format: uuid + negate: + type: boolean + description: Negates the outcome of the policy. Messages are unaffected. + enabled: + type: boolean + order: + type: integer + maximum: 2147483647 + minimum: -2147483648 + timeout: + type: integer + maximum: 2147483647 + minimum: 0 + description: Timeout after which Policy execution is terminated. + failure_result: + type: boolean + description: Result if the Policy execution fails. + is_primary: + type: boolean + PatchedDockerServiceConnectionRequest: + type: object + description: DockerServiceConnection Serializer + properties: + name: + type: string + minLength: 1 + local: + type: boolean + description: If enabled, use the local connection. Required Docker socket/Kubernetes + Integration + url: + type: string + minLength: 1 + description: Can be in the format of 'unix://' when connecting to + a local docker daemon, or 'https://:2376' when connecting to + a remote system. + tls_verification: + type: string + format: uuid + nullable: true + description: CA which the endpoint's Certificate is verified against. Can + be left empty for no validation. + tls_authentication: + type: string + format: uuid + nullable: true + description: Certificate/Key used for authentication. Can be left empty + for no authentication. + PatchedDummyPolicyRequest: + type: object + description: Dummy Policy Serializer + properties: + name: + type: string + minLength: 1 + execution_logging: + type: boolean + description: When this option is enabled, all executions of this policy + will be logged. By default, only execution errors are logged. + result: + type: boolean + wait_min: + type: integer + maximum: 2147483647 + minimum: -2147483648 + wait_max: + type: integer + maximum: 2147483647 + minimum: -2147483648 + PatchedDummyStageRequest: + type: object + description: DummyStage Serializer + properties: + name: + type: string + minLength: 1 + throw_error: + type: boolean + PatchedDuoDeviceRequest: + type: object + description: Serializer for Duo authenticator devices + properties: + name: + type: string + minLength: 1 + description: The human-readable name of this device. + maxLength: 64 + PatchedEmailDeviceRequest: + type: object + description: Serializer for email authenticator devices + properties: + name: + type: string + minLength: 1 + description: The human-readable name of this device. + maxLength: 64 + PatchedEmailStageRequest: + type: object + description: EmailStage Serializer + properties: + name: + type: string + minLength: 1 + use_global_settings: + type: boolean + description: When enabled, global Email connection settings will be used + and connection settings below will be ignored. + host: + type: string + minLength: 1 + port: + type: integer + maximum: 2147483647 + minimum: -2147483648 + username: + type: string + password: + type: string + writeOnly: true + use_tls: + type: boolean + use_ssl: + type: boolean + timeout: + type: integer + maximum: 2147483647 + minimum: -2147483648 + from_address: + type: string + format: email + minLength: 1 + maxLength: 254 + token_expiry: + type: string + minLength: 1 + description: 'Time the token sent is valid (Format: hours=3,minutes=17,seconds=300).' + subject: + type: string + minLength: 1 + template: + type: string + minLength: 1 + activate_user_on_success: + type: boolean + description: Activate users upon completion of stage. + recovery_max_attempts: + type: integer + maximum: 2147483647 + minimum: 0 + recovery_cache_timeout: + type: string + minLength: 1 + description: 'The time window used to count recent account recovery attempts. + If the number of attempts exceed recovery_max_attempts within this period, + further attempts will be rate-limited. (Format: hours=1;minutes=2;seconds=3).' + PatchedEndpointDeviceRequest: + type: object + properties: + device_uuid: + type: string + format: uuid + name: + type: string + minLength: 1 + access_group: + type: string + format: uuid + nullable: true + access_group_obj: + $ref: '#/components/schemas/DeviceAccessGroupRequest' + expiring: + type: boolean + expires: + type: string + format: date-time + nullable: true + attributes: + type: object + additionalProperties: {} + PatchedEndpointRequest: + type: object + description: Endpoint Serializer + properties: + name: + type: string + minLength: 1 + provider: + type: integer + protocol: + $ref: '#/components/schemas/ProtocolEnum' + host: + type: string + minLength: 1 + settings: + type: object + additionalProperties: {} + property_mappings: + type: array + items: + type: string + format: uuid + auth_mode: + $ref: '#/components/schemas/EndpointAuthModeEnum' + maximum_connections: + type: integer + maximum: 2147483647 + minimum: -2147483648 + PatchedEndpointStageRequest: + type: object + description: EndpointStage Serializer + properties: + name: + type: string + minLength: 1 + connector: + type: string + format: uuid + mode: + $ref: '#/components/schemas/StageModeEnum' + PatchedEnrollmentTokenRequest: + type: object + properties: + device_group: + type: string + format: uuid + nullable: true + connector: + type: string + format: uuid + name: + type: string + minLength: 1 + expiring: + type: boolean + expires: + type: string + format: date-time + nullable: true + PatchedEventMatcherPolicyRequest: + type: object + description: Event Matcher Policy Serializer + properties: + name: + type: string + minLength: 1 + execution_logging: + type: boolean + description: When this option is enabled, all executions of this policy + will be logged. By default, only execution errors are logged. + action: + allOf: + - $ref: '#/components/schemas/EventActions' + nullable: true + description: Match created events with this action type. When left empty, + all action types will be matched. + client_ip: + type: string + nullable: true + minLength: 1 + description: Matches Event's Client IP (strict matching, for network matching + use an Expression Policy) + app: + allOf: + - $ref: '#/components/schemas/AppEnum' + nullable: true + description: Match events created by selected application. When left empty, + all applications are matched. + model: + allOf: + - $ref: '#/components/schemas/ModelEnum' + nullable: true + description: Match events created by selected model. When left empty, all + models are matched. When an app is selected, all the application's models + are matched. + query: + type: string + nullable: true + minLength: 1 + PatchedEventRequest: + type: object + description: Event Serializer + properties: + user: + type: object + additionalProperties: {} + action: + $ref: '#/components/schemas/EventActions' + app: + type: string + minLength: 1 + context: + type: object + additionalProperties: {} + client_ip: + type: string + nullable: true + minLength: 1 + expires: + type: string + format: date-time + brand: + type: object + additionalProperties: {} + PatchedExpressionPolicyRequest: + type: object + description: Group Membership Policy Serializer + properties: + name: + type: string + minLength: 1 + execution_logging: + type: boolean + description: When this option is enabled, all executions of this policy + will be logged. By default, only execution errors are logged. + expression: + type: string + minLength: 1 + PatchedFleetConnectorRequest: + type: object + description: FleetConnector Serializer + properties: + connector_uuid: + type: string + format: uuid + name: + type: string + minLength: 1 + enabled: + type: boolean + url: + type: string + format: uri + minLength: 1 + maxLength: 200 + token: + type: string + writeOnly: true + minLength: 1 + headers_mapping: + type: string + format: uuid + nullable: true + description: Configure additional headers to be sent. Mapping should return + a dictionary of key-value pairs + map_users: + type: boolean + map_teams_access_group: + type: boolean + PatchedFlowRequest: + type: object + description: Flow Serializer + properties: + name: + type: string + minLength: 1 + slug: + type: string + minLength: 1 + description: Visible in the URL. + pattern: ^[-a-zA-Z0-9_]+$ + title: + type: string + minLength: 1 + description: Shown as the Title in Flow pages. + designation: + allOf: + - $ref: '#/components/schemas/FlowDesignationEnum' + description: Decides what this Flow is used for. For example, the Authentication + flow is redirect to when an un-authenticated user visits authentik. + background: + type: string + description: Background shown during execution + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + compatibility_mode: + type: boolean + description: Enable compatibility mode, increases compatibility with password + managers on mobile devices. + layout: + $ref: '#/components/schemas/FlowLayoutEnum' + denied_action: + allOf: + - $ref: '#/components/schemas/DeniedActionEnum' + description: Configure what should happen when a flow denies access to a + user. + authentication: + allOf: + - $ref: '#/components/schemas/AuthenticationEnum' + description: Required level of authentication and authorization to access + a flow. + PatchedFlowStageBindingRequest: + type: object + description: FlowStageBinding Serializer + properties: + target: + type: string + format: uuid + stage: + type: string + format: uuid + evaluate_on_plan: + type: boolean + description: Evaluate policies during the Flow planning process. + re_evaluate_policies: + type: boolean + description: Evaluate policies when the Stage is presented to the user. + order: + type: integer + maximum: 2147483647 + minimum: -2147483648 + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + invalid_response_action: + allOf: + - $ref: '#/components/schemas/InvalidResponseActionEnum' + description: Configure how the flow executor should handle an invalid response + to a challenge. RETRY returns the error message and a similar challenge + to the executor. RESTART restarts the flow from the beginning, and RESTART_WITH_CONTEXT + restarts the flow while keeping the current context. + PatchedGeoIPPolicyRequest: + type: object + description: GeoIP Policy Serializer + properties: + name: + type: string + minLength: 1 + execution_logging: + type: boolean + description: When this option is enabled, all executions of this policy + will be logged. By default, only execution errors are logged. + asns: + type: array + items: + type: integer + maximum: 2147483647 + minimum: -2147483648 + countries: + type: array + items: + $ref: '#/components/schemas/CountryCodeEnum' + maxItems: 249 + check_history_distance: + type: boolean + history_max_distance_km: + type: integer + maximum: 9223372036854775807 + minimum: 0 + format: int64 + distance_tolerance_km: + type: integer + maximum: 2147483647 + minimum: 0 + history_login_count: + type: integer + maximum: 2147483647 + minimum: 0 + check_impossible_travel: + type: boolean + impossible_tolerance_km: + type: integer + maximum: 2147483647 + minimum: 0 + PatchedGoogleChromeConnectorRequest: + type: object + description: GoogleChromeConnector Serializer + properties: + connector_uuid: + type: string + format: uuid + name: + type: string + minLength: 1 + enabled: + type: boolean + credentials: + type: object + additionalProperties: {} + PatchedGoogleEndpointDeviceRequest: + type: object + description: Serializer for Endpoint authenticator devices + properties: + pk: + type: string + format: uuid + title: Uuid + name: + type: string + minLength: 1 + description: The human-readable name of this device. + maxLength: 64 + PatchedGoogleWorkspaceProviderMappingRequest: + type: object + description: GoogleWorkspaceProviderMapping Serializer + properties: + managed: + type: string + nullable: true + minLength: 1 + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + minLength: 1 + expression: + type: string + minLength: 1 + PatchedGoogleWorkspaceProviderRequest: + type: object + description: GoogleWorkspaceProvider Serializer + properties: + name: + type: string + minLength: 1 + property_mappings: + type: array + items: + type: string + format: uuid + property_mappings_group: + type: array + items: + type: string + format: uuid + description: Property mappings used for group creation/updating. + delegated_subject: + type: string + format: email + minLength: 1 + maxLength: 254 + credentials: + type: object + additionalProperties: {} + scopes: + type: string + minLength: 1 + exclude_users_service_account: + type: boolean + filter_group: + type: string + format: uuid + nullable: true + user_delete_action: + $ref: '#/components/schemas/OutgoingSyncDeleteAction' + group_delete_action: + $ref: '#/components/schemas/OutgoingSyncDeleteAction' + default_group_email_domain: + type: string + minLength: 1 + sync_page_size: + type: integer + maximum: 2147483647 + minimum: 1 + description: Controls the number of objects synced in a single task + sync_page_timeout: + type: string + minLength: 1 + description: Timeout for synchronization of a single page + dry_run: + type: boolean + description: When enabled, provider will not modify or create objects in + the remote system. + discovery_enabled: + type: boolean + description: When enabled, authentik will attempt to discover existing resources + in the remote system. + PatchedGrantRequestFulfillRequest: + type: object + description: Base serializer class which doesn't implement create/update methods + properties: + data: + type: object + additionalProperties: {} + status: + $ref: '#/components/schemas/RequestStatus' + PatchedGroupKerberosSourceConnectionRequest: + type: object + description: Group Source Connection + properties: + source: + type: string + format: uuid + identifier: + type: string + minLength: 1 + PatchedGroupLDAPSourceConnectionRequest: + type: object + description: Group Source Connection + properties: + source: + type: string + format: uuid + identifier: + type: string + minLength: 1 + PatchedGroupOAuthSourceConnectionRequest: + type: object + description: Group Source Connection + properties: + source: + type: string + format: uuid + identifier: + type: string + minLength: 1 + PatchedGroupPlexSourceConnectionRequest: + type: object + description: Group Source Connection + properties: + source: + type: string + format: uuid + identifier: + type: string + minLength: 1 + PatchedGroupRequest: + type: object + description: Group Serializer + properties: + name: + type: string + minLength: 1 + is_superuser: + type: boolean + description: Users added to this group will be superusers. + parents: + type: array + items: + type: string + format: uuid + users: + type: array + items: + type: integer + attributes: + type: object + additionalProperties: {} + roles: + type: array + items: + type: string + format: uuid + PatchedGroupSAMLSourceConnectionRequest: + type: object + description: Group Source Connection + properties: + source: + type: string + format: uuid + identifier: + type: string + minLength: 1 + PatchedGroupSourceConnectionRequest: + type: object + description: Group Source Connection + properties: + source: + type: string + format: uuid + identifier: + type: string + minLength: 1 + PatchedGroupTelegramSourceConnectionRequest: + type: object + description: Group Source Connection + properties: + source: + type: string + format: uuid + identifier: + type: string + minLength: 1 + PatchedIdentificationStageRequest: + type: object + description: IdentificationStage Serializer + properties: + name: + type: string + minLength: 1 + user_fields: + type: array + items: + $ref: '#/components/schemas/UserFieldsEnum' + description: Fields of the user object to match against. (Hold shift to + select multiple options) + password_stage: + type: string + format: uuid + nullable: true + description: When set, shows a password field, instead of showing the password + field as separate step. + captcha_stage: + type: string + format: uuid + nullable: true + description: When set, adds functionality exactly like a Captcha stage, + but baked into the Identification stage. + case_insensitive_matching: + type: boolean + description: When enabled, user fields are matched regardless of their casing. + show_matched_user: + type: boolean + description: When a valid username/email has been entered, and this option + is enabled, the user's username and avatar will be shown. Otherwise, the + text that the user entered will be shown + enrollment_flow: + type: string + format: uuid + nullable: true + description: Optional enrollment flow, which is linked at the bottom of + the page. + recovery_flow: + type: string + format: uuid + nullable: true + description: Optional recovery flow, which is linked at the bottom of the + page. + passwordless_flow: + type: string + format: uuid + nullable: true + description: Optional passwordless flow, which is linked at the bottom of + the page. + sources: + type: array + items: + type: string + format: uuid + description: Specify which sources should be shown. + show_source_labels: + type: boolean + pretend_user_exists: + type: boolean + description: When enabled, the stage will succeed and continue even when + incorrect user info is entered. + enable_remember_me: + type: boolean + description: Show the user the 'Remember me on this device' toggle, allowing + repeat users to skip straight to entering their password. + webauthn_stage: + type: string + format: uuid + nullable: true + description: When set, and conditional WebAuthn is available, allow the + user to use their passkey as a first factor. + PatchedInitialPermissionsRequest: + type: object + description: InitialPermissions serializer + properties: + name: + type: string + minLength: 1 + maxLength: 150 + role: + type: string + format: uuid + permissions: + type: array + items: + type: integer + PatchedInvitationRequest: + type: object + description: Invitation Serializer + properties: + name: + type: string + minLength: 1 + pattern: ^[-a-zA-Z0-9_]+$ + expires: + type: string + format: date-time + nullable: true + fixed_data: + type: object + additionalProperties: {} + single_use: + type: boolean + description: When enabled, the invitation will be deleted after usage. + flow: + type: string + format: uuid + nullable: true + description: When set, only the configured flow can use this invitation. + PatchedInvitationStageRequest: + type: object + description: InvitationStage Serializer + properties: + name: + type: string + minLength: 1 + continue_flow_without_invitation: + type: boolean + description: If this flag is set, this Stage will jump to the next Stage + when no Invitation is given. By default this Stage will cancel the Flow + when no invitation is given. + PatchedKerberosSourcePropertyMappingRequest: + type: object + description: Kerberos PropertyMapping Serializer + properties: + managed: + type: string + nullable: true + minLength: 1 + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + minLength: 1 + expression: + type: string + minLength: 1 + PatchedKerberosSourceRequest: + type: object + description: Kerberos Source Serializer + properties: + name: + type: string + minLength: 1 + description: Source's display Name. + slug: + type: string + minLength: 1 + description: Internal source name, used in URLs. + pattern: ^[-a-zA-Z0-9_]+$ + enabled: + type: boolean + promoted: + type: boolean + description: When enabled, this source will be displayed as a prominent + button on the login page, instead of a small icon. + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow to use when authenticating existing users. + enrollment_flow: + type: string + format: uuid + nullable: true + description: Flow to use when enrolling new users. + user_property_mappings: + type: array + items: + type: string + format: uuid + group_property_mappings: + type: array + items: + type: string + format: uuid + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + user_matching_mode: + allOf: + - $ref: '#/components/schemas/UserMatchingModeEnum' + description: How the source determines if an existing user should be authenticated + or a new user enrolled. + user_path_template: + type: string + minLength: 1 + icon: + type: string + group_matching_mode: + allOf: + - $ref: '#/components/schemas/GroupMatchingModeEnum' + description: How the source determines if an existing group should be used + or a new group created. + realm: + type: string + minLength: 1 + description: Kerberos realm + krb5_conf: + type: string + description: Custom krb5.conf to use. Uses the system one by default + kadmin_type: + allOf: + - $ref: '#/components/schemas/KadminTypeEnum' + description: KAdmin server type + sync_users: + type: boolean + description: Sync users from Kerberos into authentik + sync_users_password: + type: boolean + description: When a user changes their password, sync it back to Kerberos + sync_principal: + type: string + description: Principal to authenticate to kadmin for sync. + sync_password: + type: string + writeOnly: true + description: Password to authenticate to kadmin for sync + sync_keytab: + type: string + writeOnly: true + description: Keytab to authenticate to kadmin for sync. Must be base64-encoded + or in the form TYPE:residual + sync_ccache: + type: string + writeOnly: true + description: Credentials cache to authenticate to kadmin for sync. Must + be in the form TYPE:residual + spnego_server_name: + type: string + description: Force the use of a specific server name for SPNEGO. Must be + in the form HTTP@hostname + spnego_keytab: + type: string + writeOnly: true + description: SPNEGO keytab base64-encoded or path to keytab in the form + FILE:path + spnego_ccache: + type: string + writeOnly: true + description: Credential cache to use for SPNEGO in form type:residual + password_login_update_internal_password: + type: boolean + description: If enabled, the authentik-stored password will be updated upon + login with the Kerberos password backend + sync_outgoing_trigger_mode: + allOf: + - $ref: '#/components/schemas/SyncOutgoingTriggerModeEnum' + description: When to trigger sync for outgoing providers + PatchedKubernetesServiceConnectionRequest: + type: object + description: KubernetesServiceConnection Serializer + properties: + name: + type: string + minLength: 1 + local: + type: boolean + description: If enabled, use the local connection. Required Docker socket/Kubernetes + Integration + kubeconfig: + type: object + additionalProperties: {} + description: Paste your kubeconfig here. authentik will automatically use + the currently selected context. + verify_ssl: + type: boolean + description: Verify SSL Certificates of the Kubernetes API endpoint + PatchedLDAPProviderRequest: + type: object + description: LDAPProvider Serializer + properties: + name: + type: string + minLength: 1 + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow used for authentication when the associated application + is accessed by an un-authenticated user. + authorization_flow: + type: string + format: uuid + description: Flow used when authorizing this provider. + invalidation_flow: + type: string + format: uuid + description: Flow used ending the session from a provider. + property_mappings: + type: array + items: + type: string + format: uuid + base_dn: + type: string + minLength: 1 + description: DN under which objects are accessible. + certificate: + type: string + format: uuid + nullable: true + tls_server_name: + type: string + uid_start_number: + type: integer + maximum: 2147483647 + minimum: -2147483648 + description: The start for uidNumbers, this number is added to the user.pk + to make sure that the numbers aren't too low for POSIX users. Default + is 2000 to ensure that we don't collide with local users uidNumber + gid_start_number: + type: integer + maximum: 2147483647 + minimum: -2147483648 + description: The start for gidNumbers, this number is added to a number + generated from the group.pk to make sure that the numbers aren't too low + for POSIX groups. Default is 4000 to ensure that we don't collide with + local groups or users primary groups gidNumber + search_mode: + $ref: '#/components/schemas/LDAPAPIAccessMode' + bind_mode: + $ref: '#/components/schemas/LDAPAPIAccessMode' + mfa_support: + type: boolean + description: When enabled, code-based multi-factor authentication can be + used by appending a semicolon and the TOTP code to the password. This + should only be enabled if all users that will bind to this provider have + a TOTP device configured, as otherwise a password may incorrectly be rejected + if it contains a semicolon. + PatchedLDAPSourcePropertyMappingRequest: + type: object + description: LDAP PropertyMapping Serializer + properties: + managed: + type: string + nullable: true + minLength: 1 + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + minLength: 1 + expression: + type: string + minLength: 1 + PatchedLDAPSourceRequest: + type: object + description: LDAP Source Serializer + properties: + name: + type: string + minLength: 1 + description: Source's display Name. + slug: + type: string + minLength: 1 + description: Internal source name, used in URLs. + pattern: ^[-a-zA-Z0-9_]+$ + enabled: + type: boolean + promoted: + type: boolean + description: When enabled, this source will be displayed as a prominent + button on the login page, instead of a small icon. + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow to use when authenticating existing users. + enrollment_flow: + type: string + format: uuid + nullable: true + description: Flow to use when enrolling new users. + user_property_mappings: + type: array + items: + type: string + format: uuid + group_property_mappings: + type: array + items: + type: string + format: uuid + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + user_matching_mode: + allOf: + - $ref: '#/components/schemas/UserMatchingModeEnum' + description: How the source determines if an existing user should be authenticated + or a new user enrolled. + user_path_template: + type: string + minLength: 1 + icon: + type: string + server_uri: + type: string + minLength: 1 + format: uri + peer_certificate: + type: string + format: uuid + nullable: true + description: Optionally verify the LDAP Server's Certificate against the + CA Chain in this keypair. + client_certificate: + type: string + format: uuid + nullable: true + description: Client certificate to authenticate against the LDAP Server's + Certificate. + bind_cn: + type: string + bind_password: + type: string + writeOnly: true + start_tls: + type: boolean + title: Enable Start TLS + sni: + type: boolean + title: Use Server URI for SNI verification + base_dn: + type: string + minLength: 1 + additional_user_dn: + type: string + title: Addition User DN + description: Prepended to Base DN for User-queries. + additional_group_dn: + type: string + title: Addition Group DN + description: Prepended to Base DN for Group-queries. + user_object_filter: + type: string + minLength: 1 + description: Consider Objects matching this filter to be Users. + group_object_filter: + type: string + minLength: 1 + description: Consider Objects matching this filter to be Groups. + group_membership_field: + type: string + minLength: 1 + description: Field which contains members of a group. + user_membership_attribute: + type: string + minLength: 1 + description: Attribute which matches the value of `group_membership_field`. + object_uniqueness_field: + type: string + minLength: 1 + description: Field which contains a unique Identifier. + password_login_update_internal_password: + type: boolean + description: Update internal authentik password when login succeeds with + LDAP + sync_users: + type: boolean + sync_users_password: + type: boolean + description: When a user changes their password, sync it back to LDAP. This + can only be enabled on a single LDAP source. + sync_groups: + type: boolean + sync_parent_group: + type: string + format: uuid + nullable: true + lookup_groups_from_user: + type: boolean + description: Lookup group membership based on a user attribute instead of + a group attribute. This allows nested group resolution on systems like + FreeIPA and Active Directory + delete_not_found_objects: + type: boolean + description: Delete authentik users and groups which were previously supplied + by this source, but are now missing from it. + sync_outgoing_trigger_mode: + allOf: + - $ref: '#/components/schemas/SyncOutgoingTriggerModeEnum' + description: When to trigger sync for outgoing providers + sync_group_hierarchy: + type: boolean + description: Sync group parentage/hierarchy from LDAP directories. + PatchedLicenseRequest: + type: object + description: License Serializer + properties: + key: + type: string + minLength: 1 + PatchedLifecycleRuleRequest: + type: object + description: |- + Mixin to validate that a valid enterprise license + exists before allowing to save the object + properties: + name: + type: string + minLength: 1 + content_type: + $ref: '#/components/schemas/ContentTypeEnum' + object_id: + type: string + nullable: true + minLength: 1 + interval: + type: string + minLength: 1 + grace_period: + type: string + minLength: 1 + reviewer_groups: + type: array + items: + type: string + format: uuid + min_reviewers: + type: integer + maximum: 32767 + minimum: 0 + min_reviewers_is_per_group: + type: boolean + reviewers: + type: array + items: + type: string + format: uuid + notification_transports: + type: array + items: + type: string + format: uuid + description: Select which transports should be used to notify the reviewers. + If none are selected, the notification will only be shown in the authentik + UI. + PatchedMicrosoftEntraProviderMappingRequest: + type: object + description: MicrosoftEntraProviderMapping Serializer + properties: + managed: + type: string + nullable: true + minLength: 1 + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + minLength: 1 + expression: + type: string + minLength: 1 + PatchedMicrosoftEntraProviderRequest: + type: object + description: MicrosoftEntraProvider Serializer + properties: + name: + type: string + minLength: 1 + property_mappings: + type: array + items: + type: string + format: uuid + property_mappings_group: + type: array + items: + type: string + format: uuid + description: Property mappings used for group creation/updating. + client_id: + type: string + minLength: 1 + client_secret: + type: string + writeOnly: true + minLength: 1 + tenant_id: + type: string + minLength: 1 + exclude_users_service_account: + type: boolean + filter_group: + type: string + format: uuid + nullable: true + user_delete_action: + $ref: '#/components/schemas/OutgoingSyncDeleteAction' + group_delete_action: + $ref: '#/components/schemas/OutgoingSyncDeleteAction' + sync_page_size: + type: integer + maximum: 2147483647 + minimum: 1 + description: Controls the number of objects synced in a single task + discovery_enabled: + type: boolean + description: When enabled, authentik will attempt to discover existing resources + in the remote system. + sync_page_timeout: + type: string + minLength: 1 + description: Timeout for synchronization of a single page + dry_run: + type: boolean + description: When enabled, provider will not modify or create objects in + the remote system. + PatchedMutualTLSStageRequest: + type: object + description: MutualTLSStage Serializer + properties: + name: + type: string + minLength: 1 + mode: + $ref: '#/components/schemas/StageModeEnum' + certificate_authorities: + type: array + items: + type: string + format: uuid + description: Configure certificate authorities to validate the certificate + against. This option has a higher priority than the `client_certificate` + option on `Brand`. + cert_attribute: + $ref: '#/components/schemas/CertAttributeEnum' + user_attribute: + $ref: '#/components/schemas/UserAttributeEnum' + PatchedNotificationRequest: + type: object + description: Notification Serializer + properties: + hyperlink: + type: string + nullable: true + maxLength: 4096 + hyperlink_label: + type: string + nullable: true + event: + $ref: '#/components/schemas/EventRequest' + seen: + type: boolean + PatchedNotificationRuleRequest: + type: object + description: NotificationRule Serializer + properties: + name: + type: string + minLength: 1 + transports: + type: array + items: + type: string + format: uuid + description: Select which transports should be used to notify the user. + If none are selected, the notification will only be shown in the authentik + UI. + severity: + allOf: + - $ref: '#/components/schemas/SeverityEnum' + description: Controls which severity level the created notifications will + have. + destination_group: + type: string + format: uuid + nullable: true + description: Define which group of users this notification should be sent + and shown to. If left empty, Notification won't ben sent. + destination_event_user: + type: boolean + description: When enabled, notification will be sent to user the user that + triggered the event.When destination_group is configured, notification + is sent to both. + PatchedNotificationTransportRequest: + type: object + description: NotificationTransport Serializer + properties: + name: + type: string + minLength: 1 + mode: + $ref: '#/components/schemas/TransportModeEnum' + webhook_url: + type: string + format: uri + webhook_ca: + type: string + format: uuid + nullable: true + description: When set, the selected certificate is used to validate the + certificate of the webhook server. + webhook_mapping_body: + type: string + format: uuid + nullable: true + description: Customize the body of the request. Mapping should return data + that is JSON-serializable. + webhook_mapping_headers: + type: string + format: uuid + nullable: true + description: Configure additional headers to be sent. Mapping should return + a dictionary of key-value pairs + email_subject_prefix: + type: string + email_template: + type: string + minLength: 1 + send_once: + type: boolean + description: Only send notification once, for example when sending a webhook + into a chat channel. + PatchedNotificationWebhookMappingRequest: + type: object + description: NotificationWebhookMapping Serializer + properties: + name: + type: string + minLength: 1 + expression: + type: string + minLength: 1 + PatchedOAuth2DynamicClientRegistrationRequest: + type: object + description: Serializer for OAuth2DynamicClientRegistration + properties: + provider: + type: integer + default_application_group: + type: string + description: Group to assign to automatically created applications. + override_authorization_flow: + type: string + format: uuid + nullable: true + description: Authorization flow applied to dynamically registered clients. + override_invalidation_flow: + type: string + format: uuid + nullable: true + override_property_mappings: + type: array + items: + type: string + format: uuid + description: Scope mappings applied to dynamically registered clients. + access_token_validity: + type: string + minLength: 1 + description: 'Maximum access token validity for registered clients (Format: + hours=1;minutes=2;seconds=3).' + refresh_token_validity: + type: string + minLength: 1 + description: 'Maximum refresh token validity for registered clients (Format: + hours=1;minutes=2;seconds=3).' + allowed_grant_types: + type: array + items: + $ref: '#/components/schemas/GrantTypeEnum' + description: If empty, all grant types are allowed. + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + PatchedOAuth2ProviderRequest: + type: object + description: OAuth2Provider Serializer + properties: + name: + type: string + minLength: 1 + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow used for authentication when the associated application + is accessed by an un-authenticated user. + authorization_flow: + type: string + format: uuid + description: Flow used when authorizing this provider. + invalidation_flow: + type: string + format: uuid + description: Flow used ending the session from a provider. + property_mappings: + type: array + items: + type: string + format: uuid + client_type: + allOf: + - $ref: '#/components/schemas/ClientTypeEnum' + description: Confidential clients are capable of maintaining the confidentiality + of their credentials. Public clients are incapable + grant_types: + type: array + items: + $ref: '#/components/schemas/GrantTypeEnum' + client_id: + type: string + minLength: 1 + maxLength: 255 + client_secret: + type: string + maxLength: 255 + access_code_validity: + type: string + minLength: 1 + description: 'Access codes not valid on or after current time + this value + (Format: hours=1;minutes=2;seconds=3).' + access_token_validity: + type: string + minLength: 1 + description: 'Tokens not valid on or after current time + this value (Format: + hours=1;minutes=2;seconds=3).' + refresh_token_validity: + type: string + minLength: 1 + description: 'Tokens not valid on or after current time + this value (Format: + hours=1;minutes=2;seconds=3).' + refresh_token_threshold: + type: string + minLength: 1 + description: 'When refreshing a token, if the refresh token is valid for + less than this duration, it will be renewed. When set to seconds=0, token + will always be renewed. (Format: hours=1;minutes=2;seconds=3).' + include_claims_in_id_token: + type: boolean + description: Include User claims from scopes in the id_token, for applications + that don't access the userinfo endpoint. + signing_key: + type: string + format: uuid + nullable: true + description: Key used to sign the tokens. + encryption_key: + type: string + format: uuid + nullable: true + description: Key used to encrypt the tokens. When set, tokens will be encrypted + and returned as JWEs. + redirect_uris: + type: array + items: + $ref: '#/components/schemas/RedirectURIRequest' + logout_uri: + type: string + format: uri + logout_method: + allOf: + - $ref: '#/components/schemas/OAuth2ProviderLogoutMethodEnum' + description: Backchannel logs out with server to server calls. Frontchannel + uses iframes in your browser + sub_mode: + allOf: + - $ref: '#/components/schemas/SubModeEnum' + description: Configure what data should be used as unique User Identifier. + For most cases, the default should be fine. + issuer_mode: + allOf: + - $ref: '#/components/schemas/IssuerModeEnum' + description: Configure how the issuer field of the ID Token should be filled. + jwt_federation_sources: + type: array + items: + type: string + format: uuid + title: Any JWT signed by the JWK of the selected source can be used to + authenticate. + title: Any JWT signed by the JWK of the selected source can be used to authenticate. + jwt_federation_providers: + type: array + items: + type: integer + PatchedOAuthSourcePropertyMappingRequest: + type: object + description: OAuthSourcePropertyMapping Serializer + properties: + managed: + type: string + nullable: true + minLength: 1 + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + minLength: 1 + expression: + type: string + minLength: 1 + PatchedOAuthSourceRequest: + type: object + description: OAuth Source Serializer + properties: + name: + type: string + minLength: 1 + description: Source's display Name. + slug: + type: string + minLength: 1 + description: Internal source name, used in URLs. + pattern: ^[-a-zA-Z0-9_]+$ + enabled: + type: boolean + promoted: + type: boolean + description: When enabled, this source will be displayed as a prominent + button on the login page, instead of a small icon. + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow to use when authenticating existing users. + enrollment_flow: + type: string + format: uuid + nullable: true + description: Flow to use when enrolling new users. + user_property_mappings: + type: array + items: + type: string + format: uuid + group_property_mappings: + type: array + items: + type: string + format: uuid + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + user_matching_mode: + allOf: + - $ref: '#/components/schemas/UserMatchingModeEnum' + description: How the source determines if an existing user should be authenticated + or a new user enrolled. + user_path_template: + type: string + minLength: 1 + icon: + type: string + group_matching_mode: + allOf: + - $ref: '#/components/schemas/GroupMatchingModeEnum' + description: How the source determines if an existing group should be used + or a new group created. + provider_type: + $ref: '#/components/schemas/ProviderTypeEnum' + request_token_url: + type: string + nullable: true + description: URL used to request the initial token. This URL is only required + for OAuth 1. + authorization_url: + type: string + nullable: true + description: URL the user is redirect to to conest the flow. + access_token_url: + type: string + nullable: true + description: URL used by authentik to retrieve tokens. + profile_url: + type: string + nullable: true + description: URL used by authentik to get user information. + pkce: + $ref: '#/components/schemas/PKCEMethodEnum' + consumer_key: + type: string + minLength: 1 + consumer_secret: + type: string + writeOnly: true + minLength: 1 + additional_scopes: + type: string + oidc_well_known_url: + type: string + oidc_jwks_url: + type: string + oidc_jwks: + type: object + additionalProperties: {} + authorization_code_auth_method: + allOf: + - $ref: '#/components/schemas/AuthorizationCodeAuthMethodEnum' + description: How to perform authentication during an authorization_code + token request flow + PatchedObjectAttributeRequest: + type: object + properties: + object_type: + type: string + minLength: 1 + enabled: + type: boolean + default: true + key: + type: string + minLength: 1 + label: + type: string + minLength: 1 + regex: + type: string + type: + $ref: '#/components/schemas/ObjectAttributeTypeEnum' + group: + type: string + managed: + type: string + nullable: true + minLength: 1 + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + is_unique: + type: boolean + is_required: + type: boolean + PatchedOutpostRequest: + type: object + description: Outpost Serializer + properties: + name: + type: string + minLength: 1 + type: + $ref: '#/components/schemas/OutpostTypeEnum' + providers: + type: array + items: + type: integer + service_connection: + type: string + format: uuid + nullable: true + description: Select Service-Connection authentik should use to manage this + outpost. Leave empty if authentik should not handle the deployment. + config: + type: object + additionalProperties: {} + managed: + type: string + nullable: true + minLength: 1 + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + PatchedPasswordExpiryPolicyRequest: + type: object + description: Password Expiry Policy Serializer + properties: + name: + type: string + minLength: 1 + execution_logging: + type: boolean + description: When this option is enabled, all executions of this policy + will be logged. By default, only execution errors are logged. + days: + type: integer + maximum: 2147483647 + minimum: -2147483648 + deny_only: + type: boolean + PatchedPasswordPolicyRequest: + type: object + description: Password Policy Serializer + properties: + name: + type: string + minLength: 1 + execution_logging: + type: boolean + description: When this option is enabled, all executions of this policy + will be logged. By default, only execution errors are logged. + password_field: + type: string + minLength: 1 + description: Field key to check, field keys defined in Prompt stages are + available. + amount_digits: + type: integer + maximum: 2147483647 + minimum: 0 + amount_uppercase: + type: integer + maximum: 2147483647 + minimum: 0 + amount_lowercase: + type: integer + maximum: 2147483647 + minimum: 0 + amount_symbols: + type: integer + maximum: 2147483647 + minimum: 0 + length_min: + type: integer + maximum: 2147483647 + minimum: 0 + symbol_charset: + type: string + minLength: 1 + error_message: + type: string + check_static_rules: + type: boolean + check_have_i_been_pwned: + type: boolean + check_zxcvbn: + type: boolean + hibp_allowed_count: + type: integer + maximum: 2147483647 + minimum: 0 + description: How many times the password hash is allowed to be on haveibeenpwned + zxcvbn_score_threshold: + type: integer + maximum: 2147483647 + minimum: 0 + description: If the zxcvbn score is equal or less than this value, the policy + will fail. + PatchedPasswordStageRequest: + type: object + description: PasswordStage Serializer + properties: + name: + type: string + minLength: 1 + backends: + type: array + items: + $ref: '#/components/schemas/BackendsEnum' + description: Selection of backends to test the password against. + configure_flow: + type: string + format: uuid + nullable: true + description: Flow used by an authenticated user to configure this Stage. + If empty, user will not be able to configure this stage. + failed_attempts_before_cancel: + type: integer + maximum: 2147483647 + minimum: -2147483648 + description: How many attempts a user has before the flow is canceled. To + lock the user out, use a reputation policy and a user_write stage. + allow_show_password: + type: boolean + description: When enabled, provides a 'show password' button with the password + input field. + PatchedPermissionAssignRequest: + type: object + description: Request to assign a new permission + properties: + permissions: + type: array + items: + type: string + minLength: 1 + model: + $ref: '#/components/schemas/ModelEnum' + object_pk: + type: string + minLength: 1 + PatchedPlexSourcePropertyMappingRequest: + type: object + description: PlexSourcePropertyMapping Serializer + properties: + managed: + type: string + nullable: true + minLength: 1 + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + minLength: 1 + expression: + type: string + minLength: 1 + PatchedPlexSourceRequest: + type: object + description: Plex Source Serializer + properties: + name: + type: string + minLength: 1 + description: Source's display Name. + slug: + type: string + minLength: 1 + description: Internal source name, used in URLs. + pattern: ^[-a-zA-Z0-9_]+$ + enabled: + type: boolean + promoted: + type: boolean + description: When enabled, this source will be displayed as a prominent + button on the login page, instead of a small icon. + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow to use when authenticating existing users. + enrollment_flow: + type: string + format: uuid + nullable: true + description: Flow to use when enrolling new users. + user_property_mappings: + type: array + items: + type: string + format: uuid + group_property_mappings: + type: array + items: + type: string + format: uuid + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + user_matching_mode: + allOf: + - $ref: '#/components/schemas/UserMatchingModeEnum' + description: How the source determines if an existing user should be authenticated + or a new user enrolled. + user_path_template: + type: string + minLength: 1 + icon: + type: string + group_matching_mode: + allOf: + - $ref: '#/components/schemas/GroupMatchingModeEnum' + description: How the source determines if an existing group should be used + or a new group created. + client_id: + type: string + minLength: 1 + description: Client identifier used to talk to Plex. + allowed_servers: + type: array + items: + type: string + minLength: 1 + description: Which servers a user has to be a member of to be granted access. + Empty list allows every server. + allow_friends: + type: boolean + description: Allow friends to authenticate, even if you don't share a server. + plex_token: + type: string + minLength: 1 + description: Plex token used to check friends + PatchedPolicyBindingRequest: + type: object + description: PolicyBinding Serializer + properties: + policy: + type: string + format: uuid + nullable: true + group: + type: string + format: uuid + nullable: true + user: + type: integer + nullable: true + target: + type: string + format: uuid + negate: + type: boolean + description: Negates the outcome of the policy. Messages are unaffected. + enabled: + type: boolean + order: + type: integer + maximum: 2147483647 + minimum: -2147483648 + timeout: + type: integer + maximum: 2147483647 + minimum: 0 + description: Timeout after which Policy execution is terminated. + failure_result: + type: boolean + description: Result if the Policy execution fails. + PatchedPromptRequest: + type: object + description: Prompt Serializer + properties: + name: + type: string + minLength: 1 + field_key: + type: string + minLength: 1 + description: Name of the form field, also used to store the value + label: + type: string + minLength: 1 + type: + $ref: '#/components/schemas/PromptTypeEnum' + required: + type: boolean + placeholder: + type: string + description: Optionally provide a short hint that describes the expected + input value. When creating a fixed choice field, enable interpreting as + expression and return a list to return multiple choices. + initial_value: + type: string + description: Optionally pre-fill the input with an initial value. When creating + a fixed choice field, enable interpreting as expression and return a list + to return multiple default choices. + order: + type: integer + maximum: 2147483647 + minimum: -2147483648 + sub_text: + type: string + placeholder_expression: + type: boolean + initial_value_expression: + type: boolean + PatchedPromptStageRequest: + type: object + description: PromptStage Serializer + properties: + name: + type: string + minLength: 1 + fields: + type: array + items: + type: string + format: uuid + validation_policies: + type: array + items: + type: string + format: uuid + PatchedProxyProviderRequest: + type: object + description: ProxyProvider Serializer + properties: + name: + type: string + minLength: 1 + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow used for authentication when the associated application + is accessed by an un-authenticated user. + authorization_flow: + type: string + format: uuid + description: Flow used when authorizing this provider. + invalidation_flow: + type: string + format: uuid + description: Flow used ending the session from a provider. + property_mappings: + type: array + items: + type: string + format: uuid + internal_host: + type: string + format: uri + external_host: + type: string + minLength: 1 + format: uri + internal_host_ssl_validation: + type: boolean + description: Validate SSL Certificates of upstream servers + certificate: + type: string + format: uuid + nullable: true + skip_path_regex: + type: string + description: Regular expressions for which authentication is not required. + Each new line is interpreted as a new Regular Expression. + basic_auth_enabled: + type: boolean + title: Set HTTP-Basic Authentication + description: Set a custom HTTP-Basic Authentication header based on values + from authentik. + basic_auth_password_attribute: + type: string + title: HTTP-Basic Password Key + description: User/Group Attribute used for the password part of the HTTP-Basic + Header. + basic_auth_user_attribute: + type: string + title: HTTP-Basic Username Key + description: User/Group Attribute used for the user part of the HTTP-Basic + Header. If not set, the user's Email address is used. + mode: + allOf: + - $ref: '#/components/schemas/ProxyMode' + description: Enable support for forwardAuth in traefik and nginx auth_request. + Exclusive with internal_host. + intercept_header_auth: + type: boolean + description: When enabled, this provider will intercept the authorization + header and authenticate requests based on its value. + cookie_domain: + type: string + jwt_federation_sources: + type: array + items: + type: string + format: uuid + title: Any JWT signed by the JWK of the selected source can be used to + authenticate. + title: Any JWT signed by the JWK of the selected source can be used to authenticate. + jwt_federation_providers: + type: array + items: + type: integer + access_token_validity: + type: string + minLength: 1 + description: 'Tokens not valid on or after current time + this value (Format: + hours=1;minutes=2;seconds=3).' + refresh_token_validity: + type: string + minLength: 1 + description: 'Tokens not valid on or after current time + this value (Format: + hours=1;minutes=2;seconds=3).' + PatchedRACPropertyMappingRequest: + type: object + description: RACPropertyMapping Serializer + properties: + managed: + type: string + nullable: true + minLength: 1 + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + minLength: 1 + expression: + type: string + static_settings: + type: object + additionalProperties: {} + PatchedRACProviderRequest: + type: object + description: RACProvider Serializer + properties: + name: + type: string + minLength: 1 + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow used for authentication when the associated application + is accessed by an un-authenticated user. + authorization_flow: + type: string + format: uuid + description: Flow used when authorizing this provider. + property_mappings: + type: array + items: + type: string + format: uuid + settings: + type: object + additionalProperties: {} + connection_expiry: + type: string + minLength: 1 + description: 'Determines how long a session lasts. Default of 0 means that + the sessions lasts until the browser is closed. (Format: hours=-1;minutes=-2;seconds=-3)' + delete_token_on_disconnect: + type: boolean + description: When set to true, connection tokens will be deleted upon disconnect. + PatchedRadiusProviderPropertyMappingRequest: + type: object + description: RadiusProviderPropertyMapping Serializer + properties: + managed: + type: string + nullable: true + minLength: 1 + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + minLength: 1 + expression: + type: string + minLength: 1 + PatchedRadiusProviderRequest: + type: object + description: RadiusProvider Serializer + properties: + name: + type: string + minLength: 1 + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow used for authentication when the associated application + is accessed by an un-authenticated user. + authorization_flow: + type: string + format: uuid + description: Flow used when authorizing this provider. + invalidation_flow: + type: string + format: uuid + description: Flow used ending the session from a provider. + property_mappings: + type: array + items: + type: string + format: uuid + client_networks: + type: string + minLength: 1 + description: List of CIDRs (comma-separated) that clients can connect from. + A more specific CIDR will match before a looser one. Clients connecting + from a non-specified CIDR will be dropped. + shared_secret: + type: string + minLength: 1 + description: Shared secret between clients and server to hash packets. + mfa_support: + type: boolean + description: When enabled, code-based multi-factor authentication can be + used by appending a semicolon and the TOTP code to the password. This + should only be enabled if all users that will bind to this provider have + a TOTP device configured, as otherwise a password may incorrectly be rejected + if it contains a semicolon. + certificate: + type: string + format: uuid + nullable: true + PatchedRedirectStageRequest: + type: object + description: RedirectStage Serializer + properties: + name: + type: string + minLength: 1 + keep_context: + type: boolean + mode: + $ref: '#/components/schemas/RedirectStageModeEnum' + target_static: + type: string + target_flow: + type: string + format: uuid + nullable: true + PatchedReputationPolicyRequest: + type: object + description: Reputation Policy Serializer + properties: + name: + type: string + minLength: 1 + execution_logging: + type: boolean + description: When this option is enabled, all executions of this policy + will be logged. By default, only execution errors are logged. + check_ip: + type: boolean + check_username: + type: boolean + threshold: + type: integer + maximum: 2147483647 + minimum: -2147483648 + PatchedRequestRuleBindingRequest: + type: object + description: |- + Mixin to validate that a valid enterprise license + exists before allowing to save the object + properties: + uuid: + type: string + format: uuid + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + rule: + type: string + format: uuid + target: + type: string + format: uuid + expiry_pending: + type: string + minLength: 1 + description: How long a request against this binding stays pending before + it automatically lapses if not approved or denied. + expiry_granted_max: + type: string + minLength: 1 + description: The maximum duration a grant approved against this binding + can last. + PatchedRequestRuleChildBindingRequest: + type: object + properties: + uuid: + type: string + format: uuid + binding: + type: string + format: uuid + target: + type: string + format: uuid + PatchedRequestRuleRequest: + type: object + description: |- + Mixin to validate that a valid enterprise license + exists before allowing to save the object + properties: + uuid: + type: string + format: uuid + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + name: + type: string + minLength: 1 + notification_transports: + type: array + items: + type: string + format: uuid + notification_mode: + $ref: '#/components/schemas/NotificationModeEnum' + min_reviewers: + type: integer + maximum: 32767 + minimum: 0 + min_reviewers_is_per_group: + type: boolean + request_flow: + type: string + format: uuid + nullable: true + PatchedRoleRequest: + type: object + description: Role serializer + properties: + name: + type: string + minLength: 1 + PatchedSAMLPropertyMappingRequest: + type: object + description: SAMLPropertyMapping Serializer + properties: + managed: + type: string + nullable: true + minLength: 1 + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + minLength: 1 + expression: + type: string + minLength: 1 + saml_name: + type: string + minLength: 1 + friendly_name: + type: string + nullable: true + PatchedSAMLProviderRequest: + type: object + description: SAMLProvider Serializer + properties: + name: + type: string + minLength: 1 + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow used for authentication when the associated application + is accessed by an un-authenticated user. + authorization_flow: + type: string + format: uuid + description: Flow used when authorizing this provider. + invalidation_flow: + type: string + format: uuid + description: Flow used ending the session from a provider. + property_mappings: + type: array + items: + type: string + format: uuid + acs_url: + type: string + minLength: 1 + format: uri + sls_url: + type: string + description: Single Logout Service URL where the logout response should + be sent. + format: uri + audience: + type: string + description: Value of the audience restriction field of the assertion. When + left empty, no audience restriction will be added. + issuer_override: + type: string + description: Also known as EntityID. Providing a value overrides the default + issuer generated by authentik. + assertion_valid_not_before: + type: string + minLength: 1 + description: 'Assertion valid not before current time + this value (Format: + hours=-1;minutes=-2;seconds=-3).' + assertion_valid_not_on_or_after: + type: string + minLength: 1 + description: 'Assertion not valid on or after current time + this value + (Format: hours=1;minutes=2;seconds=3).' + session_valid_not_on_or_after: + type: string + minLength: 1 + description: 'Session not valid on or after current time + this value (Format: + hours=1;minutes=2;seconds=3).' + name_id_mapping: + type: string + format: uuid + nullable: true + title: NameID Property Mapping + description: Configure how the NameID value will be created. When left empty, + the NameIDPolicy of the incoming request will be considered + authn_context_class_ref_mapping: + type: string + format: uuid + nullable: true + title: AuthnContextClassRef Property Mapping + description: Configure how the AuthnContextClassRef value will be created. + When left empty, the AuthnContextClassRef will be set based on which authentication + methods the user used to authenticate. + digest_algorithm: + $ref: '#/components/schemas/DigestAlgorithmEnum' + signature_algorithm: + $ref: '#/components/schemas/SignatureAlgorithmEnum' + signing_kp: + type: string + format: uuid + nullable: true + title: Signing Keypair + description: Keypair used to sign outgoing Responses going to the Service + Provider. + verification_kp: + type: string + format: uuid + nullable: true + title: Verification Certificate + description: When selected, incoming assertion's Signatures will be validated + against this certificate. To allow unsigned Requests, leave on default. + encryption_kp: + type: string + format: uuid + nullable: true + title: Encryption Keypair + description: When selected, incoming assertions are encrypted by the IdP + using the public key of the encryption keypair. The assertion is decrypted + by the SP using the the private key. + sign_assertion: + type: boolean + sign_response: + type: boolean + sign_logout_request: + type: boolean + sign_logout_response: + type: boolean + sp_binding: + allOf: + - $ref: '#/components/schemas/SAMLBindingsEnum' + title: Service Provider Binding + description: This determines how authentik sends the response back to the + Service Provider. + sls_binding: + allOf: + - $ref: '#/components/schemas/SAMLBindingsEnum' + description: This determines how authentik sends the logout response back + to the Service Provider. + logout_method: + allOf: + - $ref: '#/components/schemas/SAMLLogoutMethods' + description: Method to use for logout. Front-channel iframe loads all logout + URLs simultaneously in hidden iframes. Front-channel native uses your + active browser tab to send post requests and redirect to providers. Back-channel + sends logout requests directly from the server without user interaction + (requires POST SLS binding). + default_relay_state: + type: string + description: Default relay_state value for IDP-initiated logins + default_name_id_policy: + $ref: '#/components/schemas/SAMLNameIDPolicyEnum' + PatchedSAMLSourcePropertyMappingRequest: + type: object + description: SAMLSourcePropertyMapping Serializer + properties: + managed: + type: string + nullable: true + minLength: 1 + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + minLength: 1 + expression: + type: string + minLength: 1 + PatchedSAMLSourceRequest: + type: object + description: SAMLSource Serializer + properties: + name: + type: string + minLength: 1 + description: Source's display Name. + slug: + type: string + minLength: 1 + description: Internal source name, used in URLs. + pattern: ^[-a-zA-Z0-9_]+$ + enabled: + type: boolean + promoted: + type: boolean + description: When enabled, this source will be displayed as a prominent + button on the login page, instead of a small icon. + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow to use when authenticating existing users. + enrollment_flow: + type: string + format: uuid + nullable: true + description: Flow to use when enrolling new users. + user_property_mappings: + type: array + items: + type: string + format: uuid + group_property_mappings: + type: array + items: + type: string + format: uuid + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + user_matching_mode: + allOf: + - $ref: '#/components/schemas/UserMatchingModeEnum' + description: How the source determines if an existing user should be authenticated + or a new user enrolled. + user_path_template: + type: string + minLength: 1 + icon: + type: string + group_matching_mode: + allOf: + - $ref: '#/components/schemas/GroupMatchingModeEnum' + description: How the source determines if an existing group should be used + or a new group created. + pre_authentication_flow: + type: string + format: uuid + description: Flow used before authentication. + issuer_override: + type: string + description: Also known as Entity ID. Defaults to the Metadata URL. + sso_url: + type: string + minLength: 1 + description: URL that the initial Login request is sent to. + format: uri + slo_url: + type: string + nullable: true + description: Optional URL if your IDP supports Single-Logout. + format: uri + allow_idp_initiated: + type: boolean + description: Allows authentication flows initiated by the IdP. This can + be a security risk, as no validation of the request ID is done. + force_authn: + type: boolean + description: When enabled, the IdP will re-authenticate the user even if + a session exists. + name_id_policy: + allOf: + - $ref: '#/components/schemas/SAMLNameIDPolicyEnum' + description: NameID Policy sent to the IdP. Can be unset, in which case + no Policy is sent. + binding_type: + $ref: '#/components/schemas/BindingTypeEnum' + verification_kp: + type: string + format: uuid + nullable: true + title: Verification Certificate + description: When selected, incoming assertion's Signatures will be validated + against this certificate. To allow unsigned Requests, leave on default. + signing_kp: + type: string + format: uuid + nullable: true + title: Signing Keypair + description: Keypair used to sign outgoing Responses going to the Identity + Provider. + digest_algorithm: + $ref: '#/components/schemas/DigestAlgorithmEnum' + signature_algorithm: + $ref: '#/components/schemas/SignatureAlgorithmEnum' + temporary_user_delete_after: + type: string + minLength: 1 + title: Delete temporary users after + description: 'Time offset when temporary users should be deleted. This only + applies if your IDP uses the NameID Format ''transient'', and the user + doesn''t log out manually. (Format: hours=1;minutes=2;seconds=3).' + encryption_kp: + type: string + format: uuid + nullable: true + title: Encryption Keypair + description: When selected, incoming assertions are encrypted by the IdP + using the public key of the encryption keypair. The assertion is decrypted + by the SP using the the private key. + signed_assertion: + type: boolean + signed_response: + type: boolean + PatchedSCIMMappingRequest: + type: object + description: SCIMMapping Serializer + properties: + managed: + type: string + nullable: true + minLength: 1 + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + minLength: 1 + expression: + type: string + minLength: 1 + PatchedSCIMProviderRequest: + type: object + description: SCIMProvider Serializer + properties: + name: + type: string + minLength: 1 + property_mappings: + type: array + items: + type: string + format: uuid + property_mappings_group: + type: array + items: + type: string + format: uuid + description: Property mappings used for group creation/updating. + url: + type: string + minLength: 1 + description: Base URL to SCIM requests, usually ends in /v2 + verify_certificates: + type: boolean + token: + type: string + writeOnly: true + description: Authentication token + auth_mode: + $ref: '#/components/schemas/SCIMAuthenticationModeEnum' + auth_oauth: + type: string + format: uuid + nullable: true + description: OAuth Source used for authentication + auth_oauth_params: + type: object + additionalProperties: {} + description: Additional OAuth parameters, such as grant_type + compatibility_mode: + allOf: + - $ref: '#/components/schemas/CompatibilityModeEnum' + title: SCIM Compatibility Mode + description: Alter authentik behavior for vendor-specific SCIM implementations. + service_provider_config_cache_timeout: + type: string + minLength: 1 + description: Cache duration for ServiceProviderConfig responses. Set minutes=0 + to disable. + exclude_users_service_account: + type: boolean + sync_page_size: + type: integer + maximum: 2147483647 + minimum: 1 + description: Controls the number of objects synced in a single task + sync_page_timeout: + type: string + minLength: 1 + description: Timeout for synchronization of a single page + discovery_enabled: + type: boolean + description: When enabled, authentik will attempt to discover existing resources + in the remote system. + group_filters: + type: array + items: + type: string + format: uuid + description: Group filters used to define sync-scope for groups. + dry_run: + type: boolean + description: When enabled, provider will not modify or create objects in + the remote system. + PatchedSCIMSourceGroupRequest: + type: object + description: SCIMSourceGroup Serializer + properties: + id: + type: string + minLength: 1 + external_id: + type: string + minLength: 1 + group: + type: string + format: uuid + source: + type: string + format: uuid + attributes: + type: object + additionalProperties: {} + PatchedSCIMSourcePropertyMappingRequest: + type: object + description: SCIMSourcePropertyMapping Serializer + properties: + managed: + type: string + nullable: true + minLength: 1 + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + minLength: 1 + expression: + type: string + minLength: 1 + PatchedSCIMSourceRequest: + type: object + description: SCIMSource Serializer + properties: + name: + type: string + minLength: 1 + description: Source's display Name. + slug: + type: string + minLength: 1 + description: Internal source name, used in URLs. + pattern: ^[-a-zA-Z0-9_]+$ + enabled: + type: boolean + user_property_mappings: + type: array + items: + type: string + format: uuid + group_property_mappings: + type: array + items: + type: string + format: uuid + user_path_template: + type: string + minLength: 1 + PatchedSCIMSourceUserRequest: + type: object + description: SCIMSourceUser Serializer + properties: + id: + type: string + minLength: 1 + external_id: + type: string + minLength: 1 + user: + type: integer + source: + type: string + format: uuid + attributes: + type: object + additionalProperties: {} + PatchedSMSDeviceRequest: + type: object + description: Serializer for sms authenticator devices + properties: + name: + type: string + minLength: 1 + description: The human-readable name of this device. + maxLength: 64 + PatchedSSFProviderRequest: + type: object + description: SSFProvider Serializer + properties: + name: + type: string + minLength: 1 + signing_key: + type: string + format: uuid + description: Key used to sign the SSF Events. + oidc_auth_providers: + type: array + items: + type: integer + event_retention: + type: string + minLength: 1 + push_verify_certificates: + type: boolean + PatchedScheduleRequest: + type: object + properties: + rel_obj_id: + type: string + nullable: true + minLength: 1 + crontab: + type: string + minLength: 1 + description: When to schedule tasks + paused: + type: boolean + description: Pause this schedule + PatchedScopeMappingRequest: + type: object + description: ScopeMapping Serializer + properties: + managed: + type: string + nullable: true + minLength: 1 + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + minLength: 1 + expression: + type: string + minLength: 1 + scope_name: + type: string + minLength: 1 + description: Scope name requested by the client + description: + type: string + description: Description shown to the user when consenting. If left empty, + the user won't be informed. + PatchedSettingsRequest: + type: object + description: Settings Serializer + properties: + avatars: + type: string + minLength: 1 + description: Configure how authentik should show avatars for users. + base_url: + type: string + description: Configure the base URL under which this authentik instance + is reachable, e.g. https://authentik.company + format: uri + maxLength: 200 + default_user_change_name: + type: boolean + description: Enable the ability for users to change their name. + default_user_change_email: + type: boolean + description: Enable the ability for users to change their email address. + default_user_change_username: + type: boolean + description: Enable the ability for users to change their username. + event_retention: + type: string + minLength: 1 + description: 'Events will be deleted after this duration.(Format: weeks=3;days=2;hours=3,seconds=2).' + reputation_lower_limit: + type: integer + maximum: 0 + minimum: -2147483648 + description: Reputation cannot decrease lower than this value. Zero or negative. + reputation_upper_limit: + type: integer + maximum: 2147483647 + minimum: 0 + description: Reputation cannot increase higher than this value. Zero or + positive. + footer_links: {} + gdpr_compliance: + type: boolean + description: When enabled, all the events caused by a user will be deleted + upon the user's deletion. + impersonation: + type: boolean + description: Globally enable/disable impersonation. + impersonation_require_reason: + type: boolean + description: Require administrators to provide a reason for impersonating + a user. + default_token_duration: + type: string + minLength: 1 + description: Default token duration + default_token_length: + type: integer + maximum: 2147483647 + minimum: 1 + description: Default token length + pagination_default_page_size: + type: integer + maximum: 2147483647 + minimum: 0 + description: Default page size for API responses, if no size was requested. + pagination_max_page_size: + type: integer + maximum: 2147483647 + minimum: 0 + description: Maximum page size + flags: + type: object + properties: + core_default_app_access: + type: boolean + description: Applications with no policies bound can be accessed by + any user. + enterprise_audit_include_expanded_diff: + type: boolean + description: Include additional information in audit logs, may incur + a performance penalty. + flows_continuous_login: + type: boolean + description: Upon successful authentication, re-start authentication + in other open tabs. + flows_refresh_others: + type: boolean + description: Refresh other tabs after successful authentication. + deprecated: true + required: + - core_default_app_access + - enterprise_audit_include_expanded_diff + - flows_continuous_login + - flows_refresh_others + PatchedSourceStageRequest: + type: object + description: SourceStage Serializer + properties: + name: + type: string + minLength: 1 + source: + type: string + format: uuid + resume_timeout: + type: string + minLength: 1 + description: 'Amount of time a user can take to return from the source to + continue the flow (Format: hours=-1;minutes=-2;seconds=-3)' + resume_on_match_failures: + type: array + items: + $ref: '#/components/schemas/ResumeOnMatchFailuresEnum' + description: Source matching failure reasons for which the flow should resume. + PatchedStaticDeviceRequest: + type: object + description: Serializer for static authenticator devices + properties: + name: + type: string + minLength: 1 + description: The human-readable name of this device. + maxLength: 64 + PatchedTOTPDeviceRequest: + type: object + description: Serializer for totp authenticator devices + properties: + name: + type: string + minLength: 1 + description: The human-readable name of this device. + maxLength: 64 + PatchedTelegramSourcePropertyMappingRequest: + type: object + description: TelegramSourcePropertyMapping Serializer + properties: + managed: + type: string + nullable: true + minLength: 1 + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + minLength: 1 + expression: + type: string + minLength: 1 + PatchedTelegramSourceRequest: + type: object + description: Source Serializer + properties: + name: + type: string + minLength: 1 + description: Source's display Name. + slug: + type: string + minLength: 1 + description: Internal source name, used in URLs. + pattern: ^[-a-zA-Z0-9_]+$ + enabled: + type: boolean + promoted: + type: boolean + description: When enabled, this source will be displayed as a prominent + button on the login page, instead of a small icon. + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow to use when authenticating existing users. + enrollment_flow: + type: string + format: uuid + nullable: true + description: Flow to use when enrolling new users. + user_property_mappings: + type: array + items: + type: string + format: uuid + group_property_mappings: + type: array + items: + type: string + format: uuid + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + user_matching_mode: + allOf: + - $ref: '#/components/schemas/UserMatchingModeEnum' + description: How the source determines if an existing user should be authenticated + or a new user enrolled. + user_path_template: + type: string + minLength: 1 + icon: + type: string + bot_username: + type: string + minLength: 1 + description: Telegram bot username + bot_token: + type: string + writeOnly: true + minLength: 1 + description: Telegram bot token + request_message_access: + type: boolean + description: Request access to send messages from your bot. + pre_authentication_flow: + type: string + format: uuid + description: Flow used before authentication. + PatchedTokenRequest: + type: object + description: Token Serializer + properties: + managed: + type: string + nullable: true + minLength: 1 + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + identifier: + type: string + minLength: 1 + maxLength: 255 + pattern: ^[-a-zA-Z0-9_]+$ + intent: + $ref: '#/components/schemas/IntentEnum' + user: + type: integer + description: + type: string + expires: + type: string + format: date-time + nullable: true + expiring: + type: boolean + PatchedUniquePasswordPolicyRequest: + type: object + description: Password Uniqueness Policy Serializer + properties: + name: + type: string + minLength: 1 + execution_logging: + type: boolean + description: When this option is enabled, all executions of this policy + will be logged. By default, only execution errors are logged. + password_field: + type: string + minLength: 1 + description: Field key to check, field keys defined in Prompt stages are + available. + num_historical_passwords: + type: integer + maximum: 2147483647 + minimum: 0 + description: Number of passwords to check against. + PatchedUserDeleteStageRequest: + type: object + description: UserDeleteStage Serializer + properties: + name: + type: string + minLength: 1 + PatchedUserKerberosSourceConnectionRequest: + type: object + description: User source connection + properties: + source: + type: string + format: uuid + identifier: + type: string + minLength: 1 + PatchedUserLDAPSourceConnectionRequest: + type: object + description: User source connection + properties: + source: + type: string + format: uuid + identifier: + type: string + minLength: 1 + PatchedUserLoginStageRequest: + type: object + description: UserLoginStage Serializer + properties: + name: + type: string + minLength: 1 + session_duration: + type: string + minLength: 1 + description: 'Determines how long a session lasts. Default of 0 means that + the sessions lasts until the browser is closed. (Format: hours=-1;minutes=-2;seconds=-3)' + terminate_other_sessions: + type: boolean + description: Terminate all other sessions of the user logging in. + remember_me_offset: + type: string + minLength: 1 + description: 'Offset the session will be extended by when the user picks + the remember me option. Default of 0 means that the remember me option + will not be shown. (Format: hours=-1;minutes=-2;seconds=-3)' + network_binding: + allOf: + - $ref: '#/components/schemas/NetworkBindingEnum' + description: Bind sessions created by this stage to the configured network + geoip_binding: + allOf: + - $ref: '#/components/schemas/GeoipBindingEnum' + description: Bind sessions created by this stage to the configured GeoIP + location + remember_device: + type: string + minLength: 1 + description: 'When set to a non-zero value, authentik will save a cookie + with a longer expiry,to remember the device the user is logging in from. + (Format: hours=-1;minutes=-2;seconds=-3)' + PatchedUserLogoutStageRequest: + type: object + description: UserLogoutStage Serializer + properties: + name: + type: string + minLength: 1 + PatchedUserOAuthSourceConnectionRequest: + type: object + description: User source connection + properties: + source: + type: string + format: uuid + identifier: + type: string + minLength: 1 + access_token: + type: string + writeOnly: true + nullable: true + expires: + type: string + format: date-time + PatchedUserPlexSourceConnectionRequest: + type: object + description: User source connection + properties: + source: + type: string + format: uuid + identifier: + type: string + minLength: 1 + plex_token: + type: string + writeOnly: true + minLength: 1 + PatchedUserRequest: + type: object + description: User Serializer + properties: + username: + type: string + minLength: 1 + maxLength: 150 + name: + type: string + description: User's display name. + is_active: + type: boolean + title: Active + description: Designates whether this user should be treated as active. Unselect + this instead of deleting accounts. + last_login: + type: string + format: date-time + nullable: true + groups: + type: array + items: + type: string + format: uuid + roles: + type: array + items: + type: string + format: uuid + email: + type: string + format: email + title: Email address + maxLength: 254 + attributes: + type: object + additionalProperties: {} + path: + type: string + minLength: 1 + type: + $ref: '#/components/schemas/UserTypeEnum' + PatchedUserSAMLSourceConnectionRequest: + type: object + description: User source connection + properties: + source: + type: string + format: uuid + identifier: + type: string + minLength: 1 + PatchedUserSourceConnectionRequest: + type: object + description: User source connection + properties: + source: + type: string + format: uuid + identifier: + type: string + minLength: 1 + PatchedUserTelegramSourceConnectionRequest: + type: object + description: User source connection + properties: + source: + type: string + format: uuid + identifier: + type: string + minLength: 1 + PatchedUserWriteStageRequest: + type: object + description: UserWriteStage Serializer + properties: + name: + type: string + minLength: 1 + user_creation_mode: + $ref: '#/components/schemas/UserCreationModeEnum' + create_users_as_inactive: + type: boolean + description: When set, newly created users are inactive and cannot login. + create_users_group: + type: string + format: uuid + nullable: true + description: Optionally add newly created users to this group. + user_type: + $ref: '#/components/schemas/UserTypeEnum' + user_path_template: + type: string + PatchedWSFederationProviderRequest: + type: object + description: WSFederationProvider Serializer + properties: + name: + type: string + minLength: 1 + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow used for authentication when the associated application + is accessed by an un-authenticated user. + authorization_flow: + type: string + format: uuid + description: Flow used when authorizing this provider. + invalidation_flow: + type: string + format: uuid + description: Flow used ending the session from a provider. + property_mappings: + type: array + items: + type: string + format: uuid + reply_url: + type: string + format: uri + minLength: 1 + wtrealm: + type: string + minLength: 1 + assertion_valid_not_before: + type: string + minLength: 1 + description: 'Assertion valid not before current time + this value (Format: + hours=-1;minutes=-2;seconds=-3).' + assertion_valid_not_on_or_after: + type: string + minLength: 1 + description: 'Assertion not valid on or after current time + this value + (Format: hours=1;minutes=2;seconds=3).' + session_valid_not_on_or_after: + type: string + minLength: 1 + description: 'Session not valid on or after current time + this value (Format: + hours=1;minutes=2;seconds=3).' + name_id_mapping: + type: string + format: uuid + nullable: true + title: NameID Property Mapping + description: Configure how the NameID value will be created. When left empty, + the NameIDPolicy of the incoming request will be considered + authn_context_class_ref_mapping: + type: string + format: uuid + nullable: true + title: AuthnContextClassRef Property Mapping + description: Configure how the AuthnContextClassRef value will be created. + When left empty, the AuthnContextClassRef will be set based on which authentication + methods the user used to authenticate. + saml_version: + allOf: + - $ref: '#/components/schemas/SamlVersionEnum' + description: SAML assertion version to issue in the security token. Microsoft + Entra ID and classic ADFS-style relying parties typically require SAML + 1.1. + digest_algorithm: + $ref: '#/components/schemas/DigestAlgorithmEnum' + signature_algorithm: + $ref: '#/components/schemas/SignatureAlgorithmEnum' + signing_kp: + type: string + format: uuid + nullable: true + title: Signing Keypair + description: Keypair used to sign outgoing Responses going to the Service + Provider. + encryption_kp: + type: string + format: uuid + nullable: true + title: Encryption Keypair + description: When selected, incoming assertions are encrypted by the IdP + using the public key of the encryption keypair. The assertion is decrypted + by the SP using the the private key. + sign_assertion: + type: boolean + sign_logout_request: + type: boolean + default_name_id_policy: + $ref: '#/components/schemas/SAMLNameIDPolicyEnum' + PatchedWebAuthnDeviceRequest: + type: object + description: Serializer for WebAuthn authenticator devices + properties: + name: + type: string + minLength: 1 + maxLength: 200 + Permission: + type: object + description: Global permission + properties: + id: + type: integer + readOnly: true + name: + type: string + maxLength: 255 + codename: + type: string + maxLength: 100 + model: + type: string + title: Python model class name + readOnly: true + app_label: + type: string + readOnly: true + app_label_verbose: + type: string + description: Human-readable app label + readOnly: true + model_verbose: + type: string + description: Human-readable model name + readOnly: true + required: + - app_label + - app_label_verbose + - codename + - id + - model + - model_verbose + - name + PermissionAssignRequest: + type: object + description: Request to assign a new permission + properties: + permissions: + type: array + items: + type: string + minLength: 1 + model: + $ref: '#/components/schemas/ModelEnum' + object_pk: + type: string + minLength: 1 + required: + - permissions + PermissionAssignResult: + type: object + description: Result from assigning permissions to a user/role + properties: + id: + type: string + required: + - id + PlexAuthenticationChallenge: + type: object + description: Challenge shown to the user in identification stage + properties: + flow_info: + $ref: '#/components/schemas/ContextualFlowInfo' + component: + type: string + default: ak-source-plex + response_errors: + type: object + additionalProperties: + type: array + items: + $ref: '#/components/schemas/ErrorDetail' + client_id: + type: string + slug: + type: string + required: + - client_id + - slug + PlexAuthenticationChallengeResponseRequest: + type: object + description: Pseudo class for plex response + properties: + component: + type: string + minLength: 1 + default: ak-source-plex + PlexSource: + type: object + description: Plex Source Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Pbm uuid + name: + type: string + description: Source's display Name. + slug: + type: string + description: Internal source name, used in URLs. + pattern: ^[-a-zA-Z0-9_]+$ + enabled: + type: boolean + promoted: + type: boolean + description: When enabled, this source will be displayed as a prominent + button on the login page, instead of a small icon. + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow to use when authenticating existing users. + enrollment_flow: + type: string + format: uuid + nullable: true + description: Flow to use when enrolling new users. + user_property_mappings: + type: array + items: + type: string + format: uuid + group_property_mappings: + type: array + items: + type: string + format: uuid + component: + type: string + description: Get object component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + user_matching_mode: + allOf: + - $ref: '#/components/schemas/UserMatchingModeEnum' + description: How the source determines if an existing user should be authenticated + or a new user enrolled. + managed: + type: string + nullable: true + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + readOnly: true + user_path_template: + type: string + icon: + type: string + icon_url: + type: string + readOnly: true + icon_themed_urls: + allOf: + - $ref: '#/components/schemas/ThemedUrls' + readOnly: true + nullable: true + group_matching_mode: + allOf: + - $ref: '#/components/schemas/GroupMatchingModeEnum' + description: How the source determines if an existing group should be used + or a new group created. + client_id: + type: string + description: Client identifier used to talk to Plex. + allowed_servers: + type: array + items: + type: string + description: Which servers a user has to be a member of to be granted access. + Empty list allows every server. + allow_friends: + type: boolean + description: Allow friends to authenticate, even if you don't share a server. + plex_token: + type: string + description: Plex token used to check friends + required: + - component + - icon_themed_urls + - icon_url + - managed + - meta_model_name + - name + - pk + - plex_token + - slug + - verbose_name + - verbose_name_plural + PlexSourcePropertyMapping: + type: object + description: PlexSourcePropertyMapping Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Pm uuid + managed: + type: string + nullable: true + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + expression: + type: string + component: + type: string + description: Get object's component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + required: + - component + - expression + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + PlexSourcePropertyMappingRequest: + type: object + description: PlexSourcePropertyMapping Serializer + properties: + managed: + type: string + nullable: true + minLength: 1 + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + minLength: 1 + expression: + type: string + minLength: 1 + required: + - expression + - name + PlexSourceRequest: + type: object + description: Plex Source Serializer + properties: + name: + type: string + minLength: 1 + description: Source's display Name. + slug: + type: string + minLength: 1 + description: Internal source name, used in URLs. + pattern: ^[-a-zA-Z0-9_]+$ + enabled: + type: boolean + promoted: + type: boolean + description: When enabled, this source will be displayed as a prominent + button on the login page, instead of a small icon. + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow to use when authenticating existing users. + enrollment_flow: + type: string + format: uuid + nullable: true + description: Flow to use when enrolling new users. + user_property_mappings: + type: array + items: + type: string + format: uuid + group_property_mappings: + type: array + items: + type: string + format: uuid + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + user_matching_mode: + allOf: + - $ref: '#/components/schemas/UserMatchingModeEnum' + description: How the source determines if an existing user should be authenticated + or a new user enrolled. + user_path_template: + type: string + minLength: 1 + icon: + type: string + group_matching_mode: + allOf: + - $ref: '#/components/schemas/GroupMatchingModeEnum' + description: How the source determines if an existing group should be used + or a new group created. + client_id: + type: string + minLength: 1 + description: Client identifier used to talk to Plex. + allowed_servers: + type: array + items: + type: string + minLength: 1 + description: Which servers a user has to be a member of to be granted access. + Empty list allows every server. + allow_friends: + type: boolean + description: Allow friends to authenticate, even if you don't share a server. + plex_token: + type: string + minLength: 1 + description: Plex token used to check friends + required: + - name + - plex_token + - slug + PlexTokenRedeemRequest: + type: object + description: Serializer to redeem a plex token + properties: + plex_token: + type: string + minLength: 1 + required: + - plex_token + Policy: + type: object + description: Policy Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Policy uuid + name: + type: string + execution_logging: + type: boolean + description: When this option is enabled, all executions of this policy + will be logged. By default, only execution errors are logged. + component: + type: string + description: Get object component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + bound_to: + type: integer + description: Return objects policy is bound to + readOnly: true + required: + - bound_to + - component + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + PolicyBehaviorEnum: + enum: + - mirror + - copy + - none + type: string + PolicyBinding: + type: object + description: PolicyBinding Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Policy binding uuid + policy: + type: string + format: uuid + nullable: true + group: + type: string + format: uuid + nullable: true + user: + type: integer + nullable: true + policy_obj: + allOf: + - $ref: '#/components/schemas/Policy' + readOnly: true + nullable: true + group_obj: + allOf: + - $ref: '#/components/schemas/PartialGroup' + readOnly: true + nullable: true + user_obj: + allOf: + - $ref: '#/components/schemas/PartialUser' + readOnly: true + nullable: true + target: + type: string + format: uuid + negate: + type: boolean + description: Negates the outcome of the policy. Messages are unaffected. + enabled: + type: boolean + order: + type: integer + maximum: 2147483647 + minimum: -2147483648 + timeout: + type: integer + maximum: 2147483647 + minimum: 0 + description: Timeout after which Policy execution is terminated. + failure_result: + type: boolean + description: Result if the Policy execution fails. + expires: + type: string + format: date-time + readOnly: true + nullable: true + expiring: + type: boolean + readOnly: true + required: + - expires + - expiring + - group_obj + - order + - pk + - policy_obj + - target + - user_obj + PolicyBindingRequest: + type: object + description: PolicyBinding Serializer + properties: + policy: + type: string + format: uuid + nullable: true + group: + type: string + format: uuid + nullable: true + user: + type: integer + nullable: true + target: + type: string + format: uuid + negate: + type: boolean + description: Negates the outcome of the policy. Messages are unaffected. + enabled: + type: boolean + order: + type: integer + maximum: 2147483647 + minimum: -2147483648 + timeout: + type: integer + maximum: 2147483647 + minimum: 0 + description: Timeout after which Policy execution is terminated. + failure_result: + type: boolean + description: Result if the Policy execution fails. + required: + - order + - target + PolicyEngineMode: + enum: + - all + - any + type: string + PolicyTestRequest: + type: object + description: Test policy execution for a user with context + properties: + user: + type: integer + context: + type: object + additionalProperties: {} + required: + - user + PolicyTestResult: + type: object + description: result of a policy test + properties: + passing: + type: boolean + messages: + type: array + items: + type: string + readOnly: true + log_messages: + type: array + items: + $ref: '#/components/schemas/LogEvent' + readOnly: true + required: + - log_messages + - messages + - passing + Process: + type: object + properties: + id: + type: integer + name: + type: string + user: + type: string + required: + - id + - name + ProcessRequest: + type: object + properties: + id: + type: integer + name: + type: string + minLength: 1 + user: + type: string + minLength: 1 + required: + - id + - name + Prompt: + type: object + description: Prompt Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Prompt uuid + name: + type: string + field_key: + type: string + description: Name of the form field, also used to store the value + label: + type: string + type: + $ref: '#/components/schemas/PromptTypeEnum' + required: + type: boolean + placeholder: + type: string + description: Optionally provide a short hint that describes the expected + input value. When creating a fixed choice field, enable interpreting as + expression and return a list to return multiple choices. + initial_value: + type: string + description: Optionally pre-fill the input with an initial value. When creating + a fixed choice field, enable interpreting as expression and return a list + to return multiple default choices. + order: + type: integer + maximum: 2147483647 + minimum: -2147483648 + prompt_stages_obj: + type: array + items: + $ref: '#/components/schemas/PromptStage' + readOnly: true + sub_text: + type: string + placeholder_expression: + type: boolean + initial_value_expression: + type: boolean + required: + - field_key + - label + - name + - pk + - prompt_stages_obj + - type + PromptChallenge: + type: object + description: Initial challenge being sent, define fields + properties: + flow_info: + $ref: '#/components/schemas/ContextualFlowInfo' + component: + type: string + default: ak-stage-prompt + response_errors: + type: object + additionalProperties: + type: array + items: + $ref: '#/components/schemas/ErrorDetail' + fields: + type: array + items: + $ref: '#/components/schemas/StagePrompt' + required: + - fields + PromptChallengeResponseRequest: + type: object + description: |- + Validate response, fields are dynamically created based + on the stage + properties: + component: + type: string + minLength: 1 + default: ak-stage-prompt + additionalProperties: {} + PromptChoice: + type: object + description: Serializer for a single Choice field + properties: + value: + type: string + label: + type: string + required: + - label + - value + PromptRequest: + type: object + description: Prompt Serializer + properties: + name: + type: string + minLength: 1 + field_key: + type: string + minLength: 1 + description: Name of the form field, also used to store the value + label: + type: string + minLength: 1 + type: + $ref: '#/components/schemas/PromptTypeEnum' + required: + type: boolean + placeholder: + type: string + description: Optionally provide a short hint that describes the expected + input value. When creating a fixed choice field, enable interpreting as + expression and return a list to return multiple choices. + initial_value: + type: string + description: Optionally pre-fill the input with an initial value. When creating + a fixed choice field, enable interpreting as expression and return a list + to return multiple default choices. + order: + type: integer + maximum: 2147483647 + minimum: -2147483648 + sub_text: + type: string + placeholder_expression: + type: boolean + initial_value_expression: + type: boolean + required: + - field_key + - label + - name + - type + PromptStage: + type: object + description: PromptStage Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Stage uuid + name: + type: string + component: + type: string + description: Get object type so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + flow_set: + type: array + items: + $ref: '#/components/schemas/FlowSet' + readOnly: true + fields: + type: array + items: + type: string + format: uuid + validation_policies: + type: array + items: + type: string + format: uuid + required: + - component + - fields + - flow_set + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + PromptStageRequest: + type: object + description: PromptStage Serializer + properties: + name: + type: string + minLength: 1 + fields: + type: array + items: + type: string + format: uuid + validation_policies: + type: array + items: + type: string + format: uuid + required: + - fields + - name + PromptTypeEnum: + enum: + - text + - text_area + - text_read_only + - text_area_read_only + - username + - email + - password + - number + - checkbox + - radio-button-group + - dropdown + - date + - date-time + - file + - separator + - hidden + - static + - alert_info + - alert_warning + - alert_danger + - ak-locale + type: string + PropertyMapping: + type: object + description: PropertyMapping Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Pm uuid + managed: + type: string + nullable: true + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + expression: + type: string + component: + type: string + description: Get object's component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + required: + - component + - expression + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + PropertyMappingPreview: + type: object + description: Preview how the current user is mapped via the property mappings + selected in a provider + properties: + preview: + type: object + additionalProperties: {} + readOnly: true + required: + - preview + PropertyMappingTestRequest: + type: object + description: Test property mapping execution for a user/group with context + properties: + user: + type: integer + nullable: true + context: + type: object + additionalProperties: {} + group: + type: string + format: uuid + nullable: true + PropertyMappingTestResult: + type: object + description: Result of a Property-mapping test + properties: + result: + type: string + readOnly: true + successful: + type: boolean + readOnly: true + required: + - result + - successful + ProtocolEnum: + enum: + - rdp + - vnc + - ssh + type: string + Provider: + type: object + description: Provider Serializer + properties: + pk: + type: integer + readOnly: true + title: ID + name: + type: string + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow used for authentication when the associated application + is accessed by an un-authenticated user. + authorization_flow: + type: string + format: uuid + nullable: true + description: Flow used when authorizing this provider. + invalidation_flow: + type: string + format: uuid + nullable: true + description: Flow used ending the session from a provider. + property_mappings: + type: array + items: + type: string + format: uuid + component: + type: string + description: Get object component so that we know how to edit the object + readOnly: true + assigned_application_slug: + type: string + description: Internal application name, used in URLs. + readOnly: true + nullable: true + assigned_application_name: + type: string + description: Application's display Name. + readOnly: true + nullable: true + assigned_backchannel_application_slug: + type: string + description: Internal application name, used in URLs. + readOnly: true + nullable: true + assigned_backchannel_application_name: + type: string + description: Application's display Name. + readOnly: true + nullable: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + required: + - assigned_application_name + - assigned_application_slug + - assigned_backchannel_application_name + - assigned_backchannel_application_slug + - component + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + ProviderEnum: + enum: + - twilio + - generic + type: string + ProviderModelEnum: + enum: + - authentik_providers_google_workspace.googleworkspaceprovider + - authentik_providers_ldap.ldapprovider + - authentik_providers_microsoft_entra.microsoftentraprovider + - authentik_providers_oauth2.oauth2provider + - authentik_providers_proxy.proxyprovider + - authentik_providers_rac.racprovider + - authentik_providers_radius.radiusprovider + - authentik_providers_saml.samlprovider + - authentik_providers_scim.scimprovider + - authentik_providers_ssf.ssfprovider + - authentik_providers_ws_federation.wsfederationprovider + type: string + ProviderTypeEnum: + enum: + - openidconnect + - apple + - discord + - entraid + - facebook + - github + - gitlab + - google + - mailcow + - okta + - patreon + - reddit + - slack + - twitch + - twitter + - wechat + type: string + ProxyMode: + enum: + - proxy + - forward_single + - forward_domain + type: string + ProxyOutpostConfig: + type: object + description: Proxy provider serializer for outposts + properties: + pk: + type: integer + readOnly: true + title: ID + name: + type: string + internal_host: + type: string + format: uri + external_host: + type: string + format: uri + internal_host_ssl_validation: + type: boolean + description: Validate SSL Certificates of upstream servers + client_id: + type: string + maxLength: 255 + client_secret: + type: string + maxLength: 255 + oidc_configuration: + allOf: + - $ref: '#/components/schemas/OpenIDConnectConfiguration' + readOnly: true + cookie_secret: + type: string + certificate: + type: string + format: uuid + nullable: true + skip_path_regex: + type: string + description: Regular expressions for which authentication is not required. + Each new line is interpreted as a new Regular Expression. + basic_auth_enabled: + type: boolean + title: Set HTTP-Basic Authentication + description: Set a custom HTTP-Basic Authentication header based on values + from authentik. + basic_auth_password_attribute: + type: string + title: HTTP-Basic Password Key + description: User/Group Attribute used for the password part of the HTTP-Basic + Header. + basic_auth_user_attribute: + type: string + title: HTTP-Basic Username Key + description: User/Group Attribute used for the user part of the HTTP-Basic + Header. If not set, the user's Email address is used. + mode: + allOf: + - $ref: '#/components/schemas/ProxyMode' + description: Enable support for forwardAuth in traefik and nginx auth_request. + Exclusive with internal_host. + cookie_domain: + type: string + access_token_validity: + type: number + format: double + nullable: true + description: Get token validity as second count + readOnly: true + intercept_header_auth: + type: boolean + description: When enabled, this provider will intercept the authorization + header and authenticate requests based on its value. + scopes_to_request: + type: array + items: + type: string + description: |- + Get all the scope names the outpost should request, + including custom-defined ones + readOnly: true + assigned_application_slug: + type: string + description: Internal application name, used in URLs. + readOnly: true + assigned_application_name: + type: string + description: Application's display Name. + readOnly: true + required: + - access_token_validity + - assigned_application_name + - assigned_application_slug + - external_host + - name + - oidc_configuration + - pk + - scopes_to_request + ProxyProvider: + type: object + description: ProxyProvider Serializer + properties: + pk: + type: integer + readOnly: true + title: ID + name: + type: string + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow used for authentication when the associated application + is accessed by an un-authenticated user. + authorization_flow: + type: string + format: uuid + description: Flow used when authorizing this provider. + invalidation_flow: + type: string + format: uuid + description: Flow used ending the session from a provider. + property_mappings: + type: array + items: + type: string + format: uuid + component: + type: string + description: Get object component so that we know how to edit the object + readOnly: true + assigned_application_slug: + type: string + description: Internal application name, used in URLs. + readOnly: true + nullable: true + assigned_application_name: + type: string + description: Application's display Name. + readOnly: true + nullable: true + assigned_backchannel_application_slug: + type: string + description: Internal application name, used in URLs. + readOnly: true + nullable: true + assigned_backchannel_application_name: + type: string + description: Application's display Name. + readOnly: true + nullable: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + client_id: + type: string + readOnly: true + internal_host: + type: string + format: uri + external_host: + type: string + format: uri + internal_host_ssl_validation: + type: boolean + description: Validate SSL Certificates of upstream servers + certificate: + type: string + format: uuid + nullable: true + skip_path_regex: + type: string + description: Regular expressions for which authentication is not required. + Each new line is interpreted as a new Regular Expression. + basic_auth_enabled: + type: boolean + title: Set HTTP-Basic Authentication + description: Set a custom HTTP-Basic Authentication header based on values + from authentik. + basic_auth_password_attribute: + type: string + title: HTTP-Basic Password Key + description: User/Group Attribute used for the password part of the HTTP-Basic + Header. + basic_auth_user_attribute: + type: string + title: HTTP-Basic Username Key + description: User/Group Attribute used for the user part of the HTTP-Basic + Header. If not set, the user's Email address is used. + mode: + allOf: + - $ref: '#/components/schemas/ProxyMode' + description: Enable support for forwardAuth in traefik and nginx auth_request. + Exclusive with internal_host. + intercept_header_auth: + type: boolean + description: When enabled, this provider will intercept the authorization + header and authenticate requests based on its value. + redirect_uris: + type: array + items: + $ref: '#/components/schemas/RedirectURI' + readOnly: true + cookie_domain: + type: string + jwt_federation_sources: + type: array + items: + type: string + format: uuid + title: Any JWT signed by the JWK of the selected source can be used to + authenticate. + title: Any JWT signed by the JWK of the selected source can be used to authenticate. + jwt_federation_providers: + type: array + items: + type: integer + access_token_validity: + type: string + description: 'Tokens not valid on or after current time + this value (Format: + hours=1;minutes=2;seconds=3).' + refresh_token_validity: + type: string + description: 'Tokens not valid on or after current time + this value (Format: + hours=1;minutes=2;seconds=3).' + outpost_set: + type: array + items: + type: string + readOnly: true + required: + - assigned_application_name + - assigned_application_slug + - assigned_backchannel_application_name + - assigned_backchannel_application_slug + - authorization_flow + - client_id + - component + - external_host + - invalidation_flow + - meta_model_name + - name + - outpost_set + - pk + - redirect_uris + - verbose_name + - verbose_name_plural + ProxyProviderRequest: + type: object + description: ProxyProvider Serializer + properties: + name: + type: string + minLength: 1 + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow used for authentication when the associated application + is accessed by an un-authenticated user. + authorization_flow: + type: string + format: uuid + description: Flow used when authorizing this provider. + invalidation_flow: + type: string + format: uuid + description: Flow used ending the session from a provider. + property_mappings: + type: array + items: + type: string + format: uuid + internal_host: + type: string + format: uri + external_host: + type: string + minLength: 1 + format: uri + internal_host_ssl_validation: + type: boolean + description: Validate SSL Certificates of upstream servers + certificate: + type: string + format: uuid + nullable: true + skip_path_regex: + type: string + description: Regular expressions for which authentication is not required. + Each new line is interpreted as a new Regular Expression. + basic_auth_enabled: + type: boolean + title: Set HTTP-Basic Authentication + description: Set a custom HTTP-Basic Authentication header based on values + from authentik. + basic_auth_password_attribute: + type: string + title: HTTP-Basic Password Key + description: User/Group Attribute used for the password part of the HTTP-Basic + Header. + basic_auth_user_attribute: + type: string + title: HTTP-Basic Username Key + description: User/Group Attribute used for the user part of the HTTP-Basic + Header. If not set, the user's Email address is used. + mode: + allOf: + - $ref: '#/components/schemas/ProxyMode' + description: Enable support for forwardAuth in traefik and nginx auth_request. + Exclusive with internal_host. + intercept_header_auth: + type: boolean + description: When enabled, this provider will intercept the authorization + header and authenticate requests based on its value. + cookie_domain: + type: string + jwt_federation_sources: + type: array + items: + type: string + format: uuid + title: Any JWT signed by the JWK of the selected source can be used to + authenticate. + title: Any JWT signed by the JWK of the selected source can be used to authenticate. + jwt_federation_providers: + type: array + items: + type: integer + access_token_validity: + type: string + minLength: 1 + description: 'Tokens not valid on or after current time + this value (Format: + hours=1;minutes=2;seconds=3).' + refresh_token_validity: + type: string + minLength: 1 + description: 'Tokens not valid on or after current time + this value (Format: + hours=1;minutes=2;seconds=3).' + required: + - authorization_flow + - external_host + - invalidation_flow + - name + RACPropertyMapping: + type: object + description: RACPropertyMapping Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Pm uuid + managed: + type: string + nullable: true + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + expression: + type: string + component: + type: string + description: Get object's component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + static_settings: + type: object + additionalProperties: {} + required: + - component + - meta_model_name + - name + - pk + - static_settings + - verbose_name + - verbose_name_plural + RACPropertyMappingRequest: + type: object + description: RACPropertyMapping Serializer + properties: + managed: + type: string + nullable: true + minLength: 1 + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + minLength: 1 + expression: + type: string + static_settings: + type: object + additionalProperties: {} + required: + - name + - static_settings + RACProvider: + type: object + description: RACProvider Serializer + properties: + pk: + type: integer + readOnly: true + title: ID + name: + type: string + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow used for authentication when the associated application + is accessed by an un-authenticated user. + authorization_flow: + type: string + format: uuid + description: Flow used when authorizing this provider. + property_mappings: + type: array + items: + type: string + format: uuid + component: + type: string + description: Get object component so that we know how to edit the object + readOnly: true + assigned_application_slug: + type: string + description: Internal application name, used in URLs. + readOnly: true + nullable: true + assigned_application_name: + type: string + description: Application's display Name. + readOnly: true + nullable: true + assigned_backchannel_application_slug: + type: string + description: Internal application name, used in URLs. + readOnly: true + nullable: true + assigned_backchannel_application_name: + type: string + description: Application's display Name. + readOnly: true + nullable: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + settings: + type: object + additionalProperties: {} + outpost_set: + type: array + items: + type: string + readOnly: true + connection_expiry: + type: string + description: 'Determines how long a session lasts. Default of 0 means that + the sessions lasts until the browser is closed. (Format: hours=-1;minutes=-2;seconds=-3)' + delete_token_on_disconnect: + type: boolean + description: When set to true, connection tokens will be deleted upon disconnect. + required: + - assigned_application_name + - assigned_application_slug + - assigned_backchannel_application_name + - assigned_backchannel_application_slug + - authorization_flow + - component + - meta_model_name + - name + - outpost_set + - pk + - verbose_name + - verbose_name_plural + RACProviderRequest: + type: object + description: RACProvider Serializer + properties: + name: + type: string + minLength: 1 + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow used for authentication when the associated application + is accessed by an un-authenticated user. + authorization_flow: + type: string + format: uuid + description: Flow used when authorizing this provider. + property_mappings: + type: array + items: + type: string + format: uuid + settings: + type: object + additionalProperties: {} + connection_expiry: + type: string + minLength: 1 + description: 'Determines how long a session lasts. Default of 0 means that + the sessions lasts until the browser is closed. (Format: hours=-1;minutes=-2;seconds=-3)' + delete_token_on_disconnect: + type: boolean + description: When set to true, connection tokens will be deleted upon disconnect. + required: + - authorization_flow + - name + RadiusCheckAccess: + type: object + description: Base serializer class which doesn't implement create/update methods + properties: + attributes: + type: string + access: + $ref: '#/components/schemas/PolicyTestResult' + required: + - access + RadiusOutpostConfig: + type: object + description: RadiusProvider Serializer + properties: + pk: + type: integer + readOnly: true + title: ID + name: + type: string + application_slug: + type: string + auth_flow_slug: + type: string + client_networks: + type: string + description: List of CIDRs (comma-separated) that clients can connect from. + A more specific CIDR will match before a looser one. Clients connecting + from a non-specified CIDR will be dropped. + shared_secret: + type: string + description: Shared secret between clients and server to hash packets. + mfa_support: + type: boolean + description: When enabled, code-based multi-factor authentication can be + used by appending a semicolon and the TOTP code to the password. This + should only be enabled if all users that will bind to this provider have + a TOTP device configured, as otherwise a password may incorrectly be rejected + if it contains a semicolon. + certificate: + type: string + format: uuid + nullable: true + required: + - application_slug + - auth_flow_slug + - name + - pk + RadiusProvider: + type: object + description: RadiusProvider Serializer + properties: + pk: + type: integer + readOnly: true + title: ID + name: + type: string + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow used for authentication when the associated application + is accessed by an un-authenticated user. + authorization_flow: + type: string + format: uuid + description: Flow used when authorizing this provider. + invalidation_flow: + type: string + format: uuid + description: Flow used ending the session from a provider. + property_mappings: + type: array + items: + type: string + format: uuid + component: + type: string + description: Get object component so that we know how to edit the object + readOnly: true + assigned_application_slug: + type: string + description: Internal application name, used in URLs. + readOnly: true + nullable: true + assigned_application_name: + type: string + description: Application's display Name. + readOnly: true + nullable: true + assigned_backchannel_application_slug: + type: string + description: Internal application name, used in URLs. + readOnly: true + nullable: true + assigned_backchannel_application_name: + type: string + description: Application's display Name. + readOnly: true + nullable: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + client_networks: + type: string + description: List of CIDRs (comma-separated) that clients can connect from. + A more specific CIDR will match before a looser one. Clients connecting + from a non-specified CIDR will be dropped. + shared_secret: + type: string + description: Shared secret between clients and server to hash packets. + outpost_set: + type: array + items: + type: string + readOnly: true + mfa_support: + type: boolean + description: When enabled, code-based multi-factor authentication can be + used by appending a semicolon and the TOTP code to the password. This + should only be enabled if all users that will bind to this provider have + a TOTP device configured, as otherwise a password may incorrectly be rejected + if it contains a semicolon. + certificate: + type: string + format: uuid + nullable: true + required: + - assigned_application_name + - assigned_application_slug + - assigned_backchannel_application_name + - assigned_backchannel_application_slug + - authorization_flow + - component + - invalidation_flow + - meta_model_name + - name + - outpost_set + - pk + - verbose_name + - verbose_name_plural + RadiusProviderPropertyMapping: + type: object + description: RadiusProviderPropertyMapping Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Pm uuid + managed: + type: string + nullable: true + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + expression: + type: string + component: + type: string + description: Get object's component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + required: + - component + - expression + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + RadiusProviderPropertyMappingRequest: + type: object + description: RadiusProviderPropertyMapping Serializer + properties: + managed: + type: string + nullable: true + minLength: 1 + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + minLength: 1 + expression: + type: string + minLength: 1 + required: + - expression + - name + RadiusProviderRequest: + type: object + description: RadiusProvider Serializer + properties: + name: + type: string + minLength: 1 + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow used for authentication when the associated application + is accessed by an un-authenticated user. + authorization_flow: + type: string + format: uuid + description: Flow used when authorizing this provider. + invalidation_flow: + type: string + format: uuid + description: Flow used ending the session from a provider. + property_mappings: + type: array + items: + type: string + format: uuid + client_networks: + type: string + minLength: 1 + description: List of CIDRs (comma-separated) that clients can connect from. + A more specific CIDR will match before a looser one. Clients connecting + from a non-specified CIDR will be dropped. + shared_secret: + type: string + minLength: 1 + description: Shared secret between clients and server to hash packets. + mfa_support: + type: boolean + description: When enabled, code-based multi-factor authentication can be + used by appending a semicolon and the TOTP code to the password. This + should only be enabled if all users that will bind to this provider have + a TOTP device configured, as otherwise a password may incorrectly be rejected + if it contains a semicolon. + certificate: + type: string + format: uuid + nullable: true + required: + - authorization_flow + - invalidation_flow + - name + RedirectChallenge: + type: object + description: Challenge type to redirect the client + properties: + flow_info: + $ref: '#/components/schemas/ContextualFlowInfo' + component: + type: string + default: xak-flow-redirect + response_errors: + type: object + additionalProperties: + type: array + items: + $ref: '#/components/schemas/ErrorDetail' + to: + type: string + final_redirect: + type: boolean + default: false + required: + - to + RedirectChallengeResponseRequest: + type: object + description: Redirect challenge response + properties: + component: + type: string + minLength: 1 + default: xak-flow-redirect + to: + type: string + minLength: 1 + required: + - to + RedirectStage: + type: object + description: RedirectStage Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Stage uuid + name: + type: string + component: + type: string + description: Get object type so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + flow_set: + type: array + items: + $ref: '#/components/schemas/FlowSet' + readOnly: true + keep_context: + type: boolean + mode: + $ref: '#/components/schemas/RedirectStageModeEnum' + target_static: + type: string + target_flow: + type: string + format: uuid + nullable: true + required: + - component + - flow_set + - meta_model_name + - mode + - name + - pk + - verbose_name + - verbose_name_plural + RedirectStageModeEnum: + enum: + - static + - flow + type: string + RedirectStageRequest: + type: object + description: RedirectStage Serializer + properties: + name: + type: string + minLength: 1 + keep_context: + type: boolean + mode: + $ref: '#/components/schemas/RedirectStageModeEnum' + target_static: + type: string + target_flow: + type: string + format: uuid + nullable: true + required: + - mode + - name + RedirectURI: + type: object + description: A single allowed redirect URI entry + properties: + matching_mode: + $ref: '#/components/schemas/MatchingModeEnum' + url: + type: string + redirect_uri_type: + allOf: + - $ref: '#/components/schemas/RedirectURITypeEnum' + default: authorization + required: + - matching_mode + - url + RedirectURIRequest: + type: object + description: A single allowed redirect URI entry + properties: + matching_mode: + $ref: '#/components/schemas/MatchingModeEnum' + url: + type: string + minLength: 1 + redirect_uri_type: + allOf: + - $ref: '#/components/schemas/RedirectURITypeEnum' + default: authorization + required: + - matching_mode + - url + RedirectURITypeEnum: + enum: + - authorization + - logout + type: string + RelatedGroup: + type: object + description: Stripped down group serializer to show relevant children/parents + for groups + properties: + pk: + type: string + format: uuid + readOnly: true + title: Group uuid + name: + type: string + is_superuser: + type: boolean + description: Users added to this group will be superusers. + attributes: + type: object + additionalProperties: {} + group_uuid: + type: string + format: uuid + readOnly: true + required: + - group_uuid + - name + - pk + RelatedRule: + type: object + description: |- + Mixin to validate that a valid enterprise license + exists before allowing to save the object + properties: + id: + type: string + format: uuid + name: + type: string + reviewer_groups: + type: array + items: + $ref: '#/components/schemas/PartialGroup' + readOnly: true + min_reviewers: + type: integer + readOnly: true + reviewers: + type: array + items: + $ref: '#/components/schemas/PartialUser' + readOnly: true + required: + - min_reviewers + - name + - reviewer_groups + - reviewers + RelatedTarget: + type: object + description: Simplified related target object + properties: + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + pbm_uuid: + type: string + readOnly: true + label: + type: string + readOnly: true + required: + - label + - meta_model_name + - pbm_uuid + - verbose_name + - verbose_name_plural + Reputation: + type: object + description: Reputation Serializer + properties: + pk: + type: string + format: uuid + title: Reputation uuid + identifier: + type: string + ip: + type: string + ip_geo_data: + type: object + additionalProperties: {} + ip_asn_data: + type: object + additionalProperties: {} + score: + type: integer + maximum: 9223372036854775807 + minimum: -9223372036854775808 + format: int64 + updated: + type: string + format: date-time + readOnly: true + required: + - identifier + - ip + - updated + ReputationPolicy: + type: object + description: Reputation Policy Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Policy uuid + name: + type: string + execution_logging: + type: boolean + description: When this option is enabled, all executions of this policy + will be logged. By default, only execution errors are logged. + component: + type: string + description: Get object component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + bound_to: + type: integer + description: Return objects policy is bound to + readOnly: true + check_ip: + type: boolean + check_username: + type: boolean + threshold: + type: integer + maximum: 2147483647 + minimum: -2147483648 + required: + - bound_to + - component + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + ReputationPolicyRequest: + type: object + description: Reputation Policy Serializer + properties: + name: + type: string + minLength: 1 + execution_logging: + type: boolean + description: When this option is enabled, all executions of this policy + will be logged. By default, only execution errors are logged. + check_ip: + type: boolean + check_username: + type: boolean + threshold: + type: integer + maximum: 2147483647 + minimum: -2147483648 + required: + - name + RequestContentTypeEnum: + enum: + - application/x-www-form-urlencoded + - application/json + type: string + RequestRule: + type: object + description: |- + Mixin to validate that a valid enterprise license + exists before allowing to save the object + properties: + uuid: + type: string + format: uuid + pbm_uuid: + type: string + format: uuid + readOnly: true + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + name: + type: string + targets: + type: array + items: + type: string + format: uuid + readOnly: true + notification_transports: + type: array + items: + type: string + format: uuid + notification_mode: + $ref: '#/components/schemas/NotificationModeEnum' + min_reviewers: + type: integer + maximum: 32767 + minimum: 0 + min_reviewers_is_per_group: + type: boolean + request_flow: + type: string + format: uuid + nullable: true + required: + - name + - pbm_uuid + - targets + RequestRuleBinding: + type: object + description: |- + Mixin to validate that a valid enterprise license + exists before allowing to save the object + properties: + uuid: + type: string + format: uuid + pbm_uuid: + type: string + format: uuid + readOnly: true + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + rule: + type: string + format: uuid + rule_obj: + allOf: + - $ref: '#/components/schemas/RequestRule' + readOnly: true + target: + type: string + format: uuid + related: + type: array + items: + type: string + format: uuid + readOnly: true + related_obj: + type: array + items: + $ref: '#/components/schemas/RelatedTarget' + readOnly: true + expiry_pending: + type: string + description: How long a request against this binding stays pending before + it automatically lapses if not approved or denied. + expiry_granted_max: + type: string + description: The maximum duration a grant approved against this binding + can last. + required: + - pbm_uuid + - related + - related_obj + - rule + - rule_obj + - target + RequestRuleBindingRequest: + type: object + description: |- + Mixin to validate that a valid enterprise license + exists before allowing to save the object + properties: + uuid: + type: string + format: uuid + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + rule: + type: string + format: uuid + target: + type: string + format: uuid + expiry_pending: + type: string + minLength: 1 + description: How long a request against this binding stays pending before + it automatically lapses if not approved or denied. + expiry_granted_max: + type: string + minLength: 1 + description: The maximum duration a grant approved against this binding + can last. + required: + - rule + - target + RequestRuleChildBinding: + type: object + properties: + uuid: + type: string + format: uuid + binding: + type: string + format: uuid + target: + type: string + format: uuid + required: + - binding + - target + RequestRuleChildBindingRequest: + type: object + properties: + uuid: + type: string + format: uuid + binding: + type: string + format: uuid + target: + type: string + format: uuid + required: + - binding + - target + RequestRuleRequest: + type: object + description: |- + Mixin to validate that a valid enterprise license + exists before allowing to save the object + properties: + uuid: + type: string + format: uuid + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + name: + type: string + minLength: 1 + notification_transports: + type: array + items: + type: string + format: uuid + notification_mode: + $ref: '#/components/schemas/NotificationModeEnum' + min_reviewers: + type: integer + maximum: 32767 + minimum: 0 + min_reviewers_is_per_group: + type: boolean + request_flow: + type: string + format: uuid + nullable: true + required: + - name + RequestStatus: + enum: + - created + - approved + - denied + - revoked + type: string + RequestableTarget: + type: object + description: |- + Generic representation of a single request target: whatever was actually + requested (an Application, an Application Entitlement, ...), always paired with the + parent it belongs to, so the UI/audit trail has that context even when the + request itself was scoped narrower than the whole app. + properties: + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + pbm_uuid: + type: string + readOnly: true + label: + type: string + readOnly: true + parent: + allOf: + - $ref: '#/components/schemas/Application' + readOnly: true + nullable: true + required: + - label + - meta_model_name + - parent + - pbm_uuid + - verbose_name + - verbose_name_plural + ResumeOnMatchFailuresEnum: + enum: + - missing_property + type: string + Review: + type: object + description: |- + Mixin to validate that a valid enterprise license + exists before allowing to save the object + properties: + id: + type: string + format: uuid + readOnly: true + iteration: + type: string + format: uuid + reviewer: + allOf: + - $ref: '#/components/schemas/PartialUser' + readOnly: true + timestamp: + type: string + format: date-time + readOnly: true + note: + type: string + nullable: true + required: + - id + - iteration + - reviewer + - timestamp + ReviewRequest: + type: object + description: |- + Mixin to validate that a valid enterprise license + exists before allowing to save the object + properties: + iteration: + type: string + format: uuid + note: + type: string + nullable: true + minLength: 1 + required: + - iteration + Role: + type: object + description: Role serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Uuid + name: + type: string + required: + - name + - pk + RoleAssignedObjectPermission: + type: object + description: Roles assigned object permission serializer + properties: + role_pk: + type: string + readOnly: true + name: + type: string + readOnly: true + object_permissions: + type: array + items: + $ref: '#/components/schemas/RoleObjectPermission' + model_permissions: + type: array + items: + $ref: '#/components/schemas/RoleModelPermission' + required: + - model_permissions + - name + - object_permissions + - role_pk + RoleModelPermission: + type: object + description: Role-bound object level permission + properties: + id: + type: integer + readOnly: true + codename: + type: string + readOnly: true + model: + type: string + title: Python model class name + readOnly: true + app_label: + type: string + readOnly: true + name: + type: string + readOnly: true + required: + - app_label + - codename + - id + - model + - name + RoleObjectPermission: + type: object + description: Role-bound object level permission + properties: + id: + type: integer + readOnly: true + codename: + type: string + readOnly: true + model: + type: string + title: Python model class name + readOnly: true + app_label: + type: string + readOnly: true + object_pk: + type: string + name: + type: string + readOnly: true + required: + - app_label + - codename + - id + - model + - name + - object_pk + RoleRequest: + type: object + description: Role serializer + properties: + name: + type: string + minLength: 1 + required: + - name + SAMLBindingsEnum: + enum: + - redirect + - post + type: string + SAMLLogoutMethods: + enum: + - frontchannel_iframe + - frontchannel_native + - backchannel + type: string + SAMLMetadata: + type: object + description: SAML Provider Metadata serializer + properties: + metadata: + type: string + download_url: + type: string + nullable: true + required: + - metadata + SAMLNameIDPolicyEnum: + enum: + - urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress + - urn:oasis:names:tc:SAML:2.0:nameid-format:persistent + - urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName + - urn:oasis:names:tc:SAML:2.0:nameid-format:WindowsDomainQualifiedName + - urn:oasis:names:tc:SAML:2.0:nameid-format:transient + - urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified + type: string + SAMLPropertyMapping: + type: object + description: SAMLPropertyMapping Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Pm uuid + managed: + type: string + nullable: true + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + expression: + type: string + component: + type: string + description: Get object's component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + saml_name: + type: string + friendly_name: + type: string + nullable: true + required: + - component + - expression + - meta_model_name + - name + - pk + - saml_name + - verbose_name + - verbose_name_plural + SAMLPropertyMappingRequest: + type: object + description: SAMLPropertyMapping Serializer + properties: + managed: + type: string + nullable: true + minLength: 1 + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + minLength: 1 + expression: + type: string + minLength: 1 + saml_name: + type: string + minLength: 1 + friendly_name: + type: string + nullable: true + required: + - expression + - name + - saml_name + SAMLProvider: + type: object + description: SAMLProvider Serializer + properties: + pk: + type: integer + readOnly: true + title: ID + name: + type: string + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow used for authentication when the associated application + is accessed by an un-authenticated user. + authorization_flow: + type: string + format: uuid + description: Flow used when authorizing this provider. + invalidation_flow: + type: string + format: uuid + description: Flow used ending the session from a provider. + property_mappings: + type: array + items: + type: string + format: uuid + component: + type: string + description: Get object component so that we know how to edit the object + readOnly: true + assigned_application_slug: + type: string + description: Internal application name, used in URLs. + readOnly: true + nullable: true + assigned_application_name: + type: string + description: Application's display Name. + readOnly: true + nullable: true + assigned_backchannel_application_slug: + type: string + description: Internal application name, used in URLs. + readOnly: true + nullable: true + assigned_backchannel_application_name: + type: string + description: Application's display Name. + readOnly: true + nullable: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + acs_url: + type: string + format: uri + sls_url: + type: string + description: Single Logout Service URL where the logout response should + be sent. + format: uri + audience: + type: string + description: Value of the audience restriction field of the assertion. When + left empty, no audience restriction will be added. + issuer_override: + type: string + description: Also known as EntityID. Providing a value overrides the default + issuer generated by authentik. + assertion_valid_not_before: + type: string + description: 'Assertion valid not before current time + this value (Format: + hours=-1;minutes=-2;seconds=-3).' + assertion_valid_not_on_or_after: + type: string + description: 'Assertion not valid on or after current time + this value + (Format: hours=1;minutes=2;seconds=3).' + session_valid_not_on_or_after: + type: string + description: 'Session not valid on or after current time + this value (Format: + hours=1;minutes=2;seconds=3).' + name_id_mapping: + type: string + format: uuid + nullable: true + title: NameID Property Mapping + description: Configure how the NameID value will be created. When left empty, + the NameIDPolicy of the incoming request will be considered + authn_context_class_ref_mapping: + type: string + format: uuid + nullable: true + title: AuthnContextClassRef Property Mapping + description: Configure how the AuthnContextClassRef value will be created. + When left empty, the AuthnContextClassRef will be set based on which authentication + methods the user used to authenticate. + digest_algorithm: + $ref: '#/components/schemas/DigestAlgorithmEnum' + signature_algorithm: + $ref: '#/components/schemas/SignatureAlgorithmEnum' + signing_kp: + type: string + format: uuid + nullable: true + title: Signing Keypair + description: Keypair used to sign outgoing Responses going to the Service + Provider. + verification_kp: + type: string + format: uuid + nullable: true + title: Verification Certificate + description: When selected, incoming assertion's Signatures will be validated + against this certificate. To allow unsigned Requests, leave on default. + encryption_kp: + type: string + format: uuid + nullable: true + title: Encryption Keypair + description: When selected, incoming assertions are encrypted by the IdP + using the public key of the encryption keypair. The assertion is decrypted + by the SP using the the private key. + sign_assertion: + type: boolean + sign_response: + type: boolean + sign_logout_request: + type: boolean + sign_logout_response: + type: boolean + sp_binding: + allOf: + - $ref: '#/components/schemas/SAMLBindingsEnum' + title: Service Provider Binding + description: This determines how authentik sends the response back to the + Service Provider. + sls_binding: + allOf: + - $ref: '#/components/schemas/SAMLBindingsEnum' + description: This determines how authentik sends the logout response back + to the Service Provider. + logout_method: + allOf: + - $ref: '#/components/schemas/SAMLLogoutMethods' + description: Method to use for logout. Front-channel iframe loads all logout + URLs simultaneously in hidden iframes. Front-channel native uses your + active browser tab to send post requests and redirect to providers. Back-channel + sends logout requests directly from the server without user interaction + (requires POST SLS binding). + default_relay_state: + type: string + description: Default relay_state value for IDP-initiated logins + default_name_id_policy: + $ref: '#/components/schemas/SAMLNameIDPolicyEnum' + url_download_metadata: + type: string + description: Get metadata download URL + readOnly: true + url_issuer: + type: string + description: Get Issuer/EntityID URL + readOnly: true + url_unified: + type: string + description: Get unified SAML endpoint URL (handles SSO and SLO) + readOnly: true + url_unified_init: + type: string + description: Get IdP-initiated SAML URL + readOnly: true + url_sso_post: + type: string + description: Get SSO Post URL + readOnly: true + url_sso_redirect: + type: string + description: Get SSO Redirect URL + readOnly: true + url_sso_init: + type: string + description: Get SSO IDP-Initiated URL + readOnly: true + url_slo_post: + type: string + description: Get SLO POST URL + readOnly: true + url_slo_redirect: + type: string + description: Get SLO redirect URL + readOnly: true + required: + - acs_url + - assigned_application_name + - assigned_application_slug + - assigned_backchannel_application_name + - assigned_backchannel_application_slug + - authorization_flow + - component + - invalidation_flow + - meta_model_name + - name + - pk + - url_download_metadata + - url_issuer + - url_slo_post + - url_slo_redirect + - url_sso_init + - url_sso_post + - url_sso_redirect + - url_unified + - url_unified_init + - verbose_name + - verbose_name_plural + SAMLProviderImportRequest: + type: object + description: Import saml provider from XML Metadata + properties: + name: + type: string + minLength: 1 + authorization_flow: + type: string + format: uuid + invalidation_flow: + type: string + format: uuid + file: + type: string + format: binary + required: + - authorization_flow + - file + - invalidation_flow + - name + SAMLProviderRequest: + type: object + description: SAMLProvider Serializer + properties: + name: + type: string + minLength: 1 + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow used for authentication when the associated application + is accessed by an un-authenticated user. + authorization_flow: + type: string + format: uuid + description: Flow used when authorizing this provider. + invalidation_flow: + type: string + format: uuid + description: Flow used ending the session from a provider. + property_mappings: + type: array + items: + type: string + format: uuid + acs_url: + type: string + minLength: 1 + format: uri + sls_url: + type: string + description: Single Logout Service URL where the logout response should + be sent. + format: uri + audience: + type: string + description: Value of the audience restriction field of the assertion. When + left empty, no audience restriction will be added. + issuer_override: + type: string + description: Also known as EntityID. Providing a value overrides the default + issuer generated by authentik. + assertion_valid_not_before: + type: string + minLength: 1 + description: 'Assertion valid not before current time + this value (Format: + hours=-1;minutes=-2;seconds=-3).' + assertion_valid_not_on_or_after: + type: string + minLength: 1 + description: 'Assertion not valid on or after current time + this value + (Format: hours=1;minutes=2;seconds=3).' + session_valid_not_on_or_after: + type: string + minLength: 1 + description: 'Session not valid on or after current time + this value (Format: + hours=1;minutes=2;seconds=3).' + name_id_mapping: + type: string + format: uuid + nullable: true + title: NameID Property Mapping + description: Configure how the NameID value will be created. When left empty, + the NameIDPolicy of the incoming request will be considered + authn_context_class_ref_mapping: + type: string + format: uuid + nullable: true + title: AuthnContextClassRef Property Mapping + description: Configure how the AuthnContextClassRef value will be created. + When left empty, the AuthnContextClassRef will be set based on which authentication + methods the user used to authenticate. + digest_algorithm: + $ref: '#/components/schemas/DigestAlgorithmEnum' + signature_algorithm: + $ref: '#/components/schemas/SignatureAlgorithmEnum' + signing_kp: + type: string + format: uuid + nullable: true + title: Signing Keypair + description: Keypair used to sign outgoing Responses going to the Service + Provider. + verification_kp: + type: string + format: uuid + nullable: true + title: Verification Certificate + description: When selected, incoming assertion's Signatures will be validated + against this certificate. To allow unsigned Requests, leave on default. + encryption_kp: + type: string + format: uuid + nullable: true + title: Encryption Keypair + description: When selected, incoming assertions are encrypted by the IdP + using the public key of the encryption keypair. The assertion is decrypted + by the SP using the the private key. + sign_assertion: + type: boolean + sign_response: + type: boolean + sign_logout_request: + type: boolean + sign_logout_response: + type: boolean + sp_binding: + allOf: + - $ref: '#/components/schemas/SAMLBindingsEnum' + title: Service Provider Binding + description: This determines how authentik sends the response back to the + Service Provider. + sls_binding: + allOf: + - $ref: '#/components/schemas/SAMLBindingsEnum' + description: This determines how authentik sends the logout response back + to the Service Provider. + logout_method: + allOf: + - $ref: '#/components/schemas/SAMLLogoutMethods' + description: Method to use for logout. Front-channel iframe loads all logout + URLs simultaneously in hidden iframes. Front-channel native uses your + active browser tab to send post requests and redirect to providers. Back-channel + sends logout requests directly from the server without user interaction + (requires POST SLS binding). + default_relay_state: + type: string + description: Default relay_state value for IDP-initiated logins + default_name_id_policy: + $ref: '#/components/schemas/SAMLNameIDPolicyEnum' + required: + - acs_url + - authorization_flow + - invalidation_flow + - name + SAMLSource: + type: object + description: SAMLSource Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Pbm uuid + name: + type: string + description: Source's display Name. + slug: + type: string + description: Internal source name, used in URLs. + pattern: ^[-a-zA-Z0-9_]+$ + enabled: + type: boolean + promoted: + type: boolean + description: When enabled, this source will be displayed as a prominent + button on the login page, instead of a small icon. + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow to use when authenticating existing users. + enrollment_flow: + type: string + format: uuid + nullable: true + description: Flow to use when enrolling new users. + user_property_mappings: + type: array + items: + type: string + format: uuid + group_property_mappings: + type: array + items: + type: string + format: uuid + component: + type: string + description: Get object component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + user_matching_mode: + allOf: + - $ref: '#/components/schemas/UserMatchingModeEnum' + description: How the source determines if an existing user should be authenticated + or a new user enrolled. + managed: + type: string + nullable: true + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + readOnly: true + user_path_template: + type: string + icon: + type: string + icon_url: + type: string + readOnly: true + icon_themed_urls: + allOf: + - $ref: '#/components/schemas/ThemedUrls' + readOnly: true + nullable: true + group_matching_mode: + allOf: + - $ref: '#/components/schemas/GroupMatchingModeEnum' + description: How the source determines if an existing group should be used + or a new group created. + pre_authentication_flow: + type: string + format: uuid + description: Flow used before authentication. + issuer_override: + type: string + description: Also known as Entity ID. Defaults to the Metadata URL. + url_issuer: + type: string + description: Get the resolved Issuer, falling back to the metadata URL when + unset + readOnly: true + sso_url: + type: string + description: URL that the initial Login request is sent to. + format: uri + slo_url: + type: string + nullable: true + description: Optional URL if your IDP supports Single-Logout. + format: uri + allow_idp_initiated: + type: boolean + description: Allows authentication flows initiated by the IdP. This can + be a security risk, as no validation of the request ID is done. + force_authn: + type: boolean + description: When enabled, the IdP will re-authenticate the user even if + a session exists. + name_id_policy: + allOf: + - $ref: '#/components/schemas/SAMLNameIDPolicyEnum' + description: NameID Policy sent to the IdP. Can be unset, in which case + no Policy is sent. + binding_type: + $ref: '#/components/schemas/BindingTypeEnum' + verification_kp: + type: string + format: uuid + nullable: true + title: Verification Certificate + description: When selected, incoming assertion's Signatures will be validated + against this certificate. To allow unsigned Requests, leave on default. + signing_kp: + type: string + format: uuid + nullable: true + title: Signing Keypair + description: Keypair used to sign outgoing Responses going to the Identity + Provider. + digest_algorithm: + $ref: '#/components/schemas/DigestAlgorithmEnum' + signature_algorithm: + $ref: '#/components/schemas/SignatureAlgorithmEnum' + temporary_user_delete_after: + type: string + title: Delete temporary users after + description: 'Time offset when temporary users should be deleted. This only + applies if your IDP uses the NameID Format ''transient'', and the user + doesn''t log out manually. (Format: hours=1;minutes=2;seconds=3).' + encryption_kp: + type: string + format: uuid + nullable: true + title: Encryption Keypair + description: When selected, incoming assertions are encrypted by the IdP + using the public key of the encryption keypair. The assertion is decrypted + by the SP using the the private key. + signed_assertion: + type: boolean + signed_response: + type: boolean + required: + - component + - icon_themed_urls + - icon_url + - managed + - meta_model_name + - name + - pk + - pre_authentication_flow + - slug + - sso_url + - url_issuer + - verbose_name + - verbose_name_plural + SAMLSourcePropertyMapping: + type: object + description: SAMLSourcePropertyMapping Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Pm uuid + managed: + type: string + nullable: true + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + expression: + type: string + component: + type: string + description: Get object's component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + required: + - component + - expression + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + SAMLSourcePropertyMappingRequest: + type: object + description: SAMLSourcePropertyMapping Serializer + properties: + managed: + type: string + nullable: true + minLength: 1 + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + minLength: 1 + expression: + type: string + minLength: 1 + required: + - expression + - name + SAMLSourceRequest: + type: object + description: SAMLSource Serializer + properties: + name: + type: string + minLength: 1 + description: Source's display Name. + slug: + type: string + minLength: 1 + description: Internal source name, used in URLs. + pattern: ^[-a-zA-Z0-9_]+$ + enabled: + type: boolean + promoted: + type: boolean + description: When enabled, this source will be displayed as a prominent + button on the login page, instead of a small icon. + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow to use when authenticating existing users. + enrollment_flow: + type: string + format: uuid + nullable: true + description: Flow to use when enrolling new users. + user_property_mappings: + type: array + items: + type: string + format: uuid + group_property_mappings: + type: array + items: + type: string + format: uuid + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + user_matching_mode: + allOf: + - $ref: '#/components/schemas/UserMatchingModeEnum' + description: How the source determines if an existing user should be authenticated + or a new user enrolled. + user_path_template: + type: string + minLength: 1 + icon: + type: string + group_matching_mode: + allOf: + - $ref: '#/components/schemas/GroupMatchingModeEnum' + description: How the source determines if an existing group should be used + or a new group created. + pre_authentication_flow: + type: string + format: uuid + description: Flow used before authentication. + issuer_override: + type: string + description: Also known as Entity ID. Defaults to the Metadata URL. + sso_url: + type: string + minLength: 1 + description: URL that the initial Login request is sent to. + format: uri + slo_url: + type: string + nullable: true + description: Optional URL if your IDP supports Single-Logout. + format: uri + allow_idp_initiated: + type: boolean + description: Allows authentication flows initiated by the IdP. This can + be a security risk, as no validation of the request ID is done. + force_authn: + type: boolean + description: When enabled, the IdP will re-authenticate the user even if + a session exists. + name_id_policy: + allOf: + - $ref: '#/components/schemas/SAMLNameIDPolicyEnum' + description: NameID Policy sent to the IdP. Can be unset, in which case + no Policy is sent. + binding_type: + $ref: '#/components/schemas/BindingTypeEnum' + verification_kp: + type: string + format: uuid + nullable: true + title: Verification Certificate + description: When selected, incoming assertion's Signatures will be validated + against this certificate. To allow unsigned Requests, leave on default. + signing_kp: + type: string + format: uuid + nullable: true + title: Signing Keypair + description: Keypair used to sign outgoing Responses going to the Identity + Provider. + digest_algorithm: + $ref: '#/components/schemas/DigestAlgorithmEnum' + signature_algorithm: + $ref: '#/components/schemas/SignatureAlgorithmEnum' + temporary_user_delete_after: + type: string + minLength: 1 + title: Delete temporary users after + description: 'Time offset when temporary users should be deleted. This only + applies if your IDP uses the NameID Format ''transient'', and the user + doesn''t log out manually. (Format: hours=1;minutes=2;seconds=3).' + encryption_kp: + type: string + format: uuid + nullable: true + title: Encryption Keypair + description: When selected, incoming assertions are encrypted by the IdP + using the public key of the encryption keypair. The assertion is decrypted + by the SP using the the private key. + signed_assertion: + type: boolean + signed_response: + type: boolean + required: + - name + - pre_authentication_flow + - slug + - sso_url + SCIMAuthenticationModeEnum: + enum: + - token + - oauth + - oauth_interactive + type: string + SCIMMapping: + type: object + description: SCIMMapping Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Pm uuid + managed: + type: string + nullable: true + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + expression: + type: string + component: + type: string + description: Get object's component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + required: + - component + - expression + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + SCIMMappingRequest: + type: object + description: SCIMMapping Serializer + properties: + managed: + type: string + nullable: true + minLength: 1 + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + minLength: 1 + expression: + type: string + minLength: 1 + required: + - expression + - name + SCIMProvider: + type: object + description: SCIMProvider Serializer + properties: + pk: + type: integer + readOnly: true + title: ID + name: + type: string + property_mappings: + type: array + items: + type: string + format: uuid + property_mappings_group: + type: array + items: + type: string + format: uuid + description: Property mappings used for group creation/updating. + component: + type: string + description: Get object component so that we know how to edit the object + readOnly: true + assigned_backchannel_application_slug: + type: string + description: Internal application name, used in URLs. + readOnly: true + nullable: true + assigned_backchannel_application_name: + type: string + description: Application's display Name. + readOnly: true + nullable: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + url: + type: string + description: Base URL to SCIM requests, usually ends in /v2 + verify_certificates: + type: boolean + auth_mode: + $ref: '#/components/schemas/SCIMAuthenticationModeEnum' + auth_oauth: + type: string + format: uuid + nullable: true + description: OAuth Source used for authentication + auth_oauth_params: + type: object + additionalProperties: {} + description: Additional OAuth parameters, such as grant_type + auth_oauth_token_last_updated: + type: string + format: date-time + nullable: true + readOnly: true + auth_oauth_token_expires: + type: string + format: date-time + nullable: true + readOnly: true + auth_oauth_url_callback: + type: string + nullable: true + readOnly: true + auth_oauth_url_start: + type: string + nullable: true + readOnly: true + compatibility_mode: + allOf: + - $ref: '#/components/schemas/CompatibilityModeEnum' + title: SCIM Compatibility Mode + description: Alter authentik behavior for vendor-specific SCIM implementations. + service_provider_config_cache_timeout: + type: string + description: Cache duration for ServiceProviderConfig responses. Set minutes=0 + to disable. + exclude_users_service_account: + type: boolean + sync_page_size: + type: integer + maximum: 2147483647 + minimum: 1 + description: Controls the number of objects synced in a single task + sync_page_timeout: + type: string + description: Timeout for synchronization of a single page + discovery_enabled: + type: boolean + description: When enabled, authentik will attempt to discover existing resources + in the remote system. + group_filters: + type: array + items: + type: string + format: uuid + description: Group filters used to define sync-scope for groups. + dry_run: + type: boolean + description: When enabled, provider will not modify or create objects in + the remote system. + required: + - assigned_backchannel_application_name + - assigned_backchannel_application_slug + - auth_oauth_token_expires + - auth_oauth_token_last_updated + - auth_oauth_url_callback + - auth_oauth_url_start + - component + - meta_model_name + - name + - pk + - url + - verbose_name + - verbose_name_plural + SCIMProviderGroup: + type: object + description: SCIMProviderGroup Serializer + properties: + id: + type: string + format: uuid + readOnly: true + scim_id: + type: string + group: + type: string + format: uuid + group_obj: + allOf: + - $ref: '#/components/schemas/PartialGroup' + readOnly: true + provider: + type: integer + attributes: + type: object + additionalProperties: {} + readOnly: true + required: + - attributes + - group + - group_obj + - id + - provider + - scim_id + SCIMProviderGroupRequest: + type: object + description: SCIMProviderGroup Serializer + properties: + scim_id: + type: string + minLength: 1 + group: + type: string + format: uuid + provider: + type: integer + required: + - group + - provider + - scim_id + SCIMProviderRequest: + type: object + description: SCIMProvider Serializer + properties: + name: + type: string + minLength: 1 + property_mappings: + type: array + items: + type: string + format: uuid + property_mappings_group: + type: array + items: + type: string + format: uuid + description: Property mappings used for group creation/updating. + url: + type: string + minLength: 1 + description: Base URL to SCIM requests, usually ends in /v2 + verify_certificates: + type: boolean + token: + type: string + writeOnly: true + description: Authentication token + auth_mode: + $ref: '#/components/schemas/SCIMAuthenticationModeEnum' + auth_oauth: + type: string + format: uuid + nullable: true + description: OAuth Source used for authentication + auth_oauth_params: + type: object + additionalProperties: {} + description: Additional OAuth parameters, such as grant_type + compatibility_mode: + allOf: + - $ref: '#/components/schemas/CompatibilityModeEnum' + title: SCIM Compatibility Mode + description: Alter authentik behavior for vendor-specific SCIM implementations. + service_provider_config_cache_timeout: + type: string + minLength: 1 + description: Cache duration for ServiceProviderConfig responses. Set minutes=0 + to disable. + exclude_users_service_account: + type: boolean + sync_page_size: + type: integer + maximum: 2147483647 + minimum: 1 + description: Controls the number of objects synced in a single task + sync_page_timeout: + type: string + minLength: 1 + description: Timeout for synchronization of a single page + discovery_enabled: + type: boolean + description: When enabled, authentik will attempt to discover existing resources + in the remote system. + group_filters: + type: array + items: + type: string + format: uuid + description: Group filters used to define sync-scope for groups. + dry_run: + type: boolean + description: When enabled, provider will not modify or create objects in + the remote system. + required: + - name + - url + SCIMProviderUser: + type: object + description: SCIMProviderUser Serializer + properties: + id: + type: string + format: uuid + readOnly: true + scim_id: + type: string + user: + type: integer + user_obj: + allOf: + - $ref: '#/components/schemas/PartialUser' + readOnly: true + provider: + type: integer + attributes: + type: object + additionalProperties: {} + readOnly: true + required: + - attributes + - id + - provider + - scim_id + - user + - user_obj + SCIMProviderUserRequest: + type: object + description: SCIMProviderUser Serializer + properties: + scim_id: + type: string + minLength: 1 + user: + type: integer + provider: + type: integer + required: + - provider + - scim_id + - user + SCIMSource: + type: object + description: SCIMSource Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Pbm uuid + name: + type: string + description: Source's display Name. + slug: + type: string + description: Internal source name, used in URLs. + pattern: ^[-a-zA-Z0-9_]+$ + enabled: + type: boolean + user_property_mappings: + type: array + items: + type: string + format: uuid + group_property_mappings: + type: array + items: + type: string + format: uuid + component: + type: string + description: Get object component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + managed: + type: string + nullable: true + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + readOnly: true + user_path_template: + type: string + root_url: + type: string + description: Get Root URL + readOnly: true + token_obj: + allOf: + - $ref: '#/components/schemas/Token' + readOnly: true + required: + - component + - managed + - meta_model_name + - name + - pk + - root_url + - slug + - token_obj + - verbose_name + - verbose_name_plural + SCIMSourceGroup: + type: object + description: SCIMSourceGroup Serializer + properties: + id: + type: string + external_id: + type: string + group: + type: string + format: uuid + group_obj: + allOf: + - $ref: '#/components/schemas/PartialGroup' + readOnly: true + source: + type: string + format: uuid + attributes: + type: object + additionalProperties: {} + required: + - external_id + - group + - group_obj + - source + SCIMSourceGroupRequest: + type: object + description: SCIMSourceGroup Serializer + properties: + id: + type: string + minLength: 1 + external_id: + type: string + minLength: 1 + group: + type: string + format: uuid + source: + type: string + format: uuid + attributes: + type: object + additionalProperties: {} + required: + - external_id + - group + - source + SCIMSourcePropertyMapping: + type: object + description: SCIMSourcePropertyMapping Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Pm uuid + managed: + type: string + nullable: true + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + expression: + type: string + component: + type: string + description: Get object's component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + required: + - component + - expression + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + SCIMSourcePropertyMappingRequest: + type: object + description: SCIMSourcePropertyMapping Serializer + properties: + managed: + type: string + nullable: true + minLength: 1 + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + minLength: 1 + expression: + type: string + minLength: 1 + required: + - expression + - name + SCIMSourceRequest: + type: object + description: SCIMSource Serializer + properties: + name: + type: string + minLength: 1 + description: Source's display Name. + slug: + type: string + minLength: 1 + description: Internal source name, used in URLs. + pattern: ^[-a-zA-Z0-9_]+$ + enabled: + type: boolean + user_property_mappings: + type: array + items: + type: string + format: uuid + group_property_mappings: + type: array + items: + type: string + format: uuid + user_path_template: + type: string + minLength: 1 + required: + - name + - slug + SCIMSourceUser: + type: object + description: SCIMSourceUser Serializer + properties: + id: + type: string + external_id: + type: string + user: + type: integer + user_obj: + allOf: + - $ref: '#/components/schemas/PartialUser' + readOnly: true + source: + type: string + format: uuid + attributes: + type: object + additionalProperties: {} + required: + - external_id + - source + - user + - user_obj + SCIMSourceUserRequest: + type: object + description: SCIMSourceUser Serializer + properties: + id: + type: string + minLength: 1 + external_id: + type: string + minLength: 1 + user: + type: integer + source: + type: string + format: uuid + attributes: + type: object + additionalProperties: {} + required: + - external_id + - source + - user + SMSDevice: + type: object + description: Serializer for sms authenticator devices + properties: + name: + type: string + description: The human-readable name of this device. + maxLength: 64 + pk: + type: integer + readOnly: true + title: ID + phone_number: + type: string + readOnly: true + user: + allOf: + - $ref: '#/components/schemas/PartialUser' + readOnly: true + required: + - name + - phone_number + - pk + - user + SMSDeviceRequest: + type: object + description: Serializer for sms authenticator devices + properties: + name: + type: string + minLength: 1 + description: The human-readable name of this device. + maxLength: 64 + required: + - name + SSFProvider: + type: object + description: SSFProvider Serializer + properties: + pk: + type: integer + readOnly: true + title: ID + name: + type: string + component: + type: string + description: Get object component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + signing_key: + type: string + format: uuid + description: Key used to sign the SSF Events. + token_obj: + allOf: + - $ref: '#/components/schemas/Token' + readOnly: true + oidc_auth_providers: + type: array + items: + type: integer + oidc_auth_providers_obj: + type: array + items: + $ref: '#/components/schemas/Provider' + readOnly: true + ssf_url: + type: string + nullable: true + readOnly: true + event_retention: + type: string + push_verify_certificates: + type: boolean + required: + - component + - meta_model_name + - name + - oidc_auth_providers_obj + - pk + - signing_key + - ssf_url + - token_obj + - verbose_name + - verbose_name_plural + SSFProviderRequest: + type: object + description: SSFProvider Serializer + properties: + name: + type: string + minLength: 1 + signing_key: + type: string + format: uuid + description: Key used to sign the SSF Events. + oidc_auth_providers: + type: array + items: + type: integer + event_retention: + type: string + minLength: 1 + push_verify_certificates: + type: boolean + required: + - name + - signing_key + SSFStream: + type: object + description: SSFStream Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Uuid + status: + $ref: '#/components/schemas/SSFStreamStatusEnum' + provider: + type: integer + provider_obj: + allOf: + - $ref: '#/components/schemas/SSFProvider' + readOnly: true + delivery_method: + $ref: '#/components/schemas/DeliveryMethodEnum' + endpoint_url: + type: string + nullable: true + events_requested: + type: array + items: + $ref: '#/components/schemas/EventsRequestedEnum' + format: + type: string + aud: + type: array + items: + type: string + iss: + type: string + required: + - delivery_method + - format + - iss + - pk + - provider + - provider_obj + SSFStreamStatusEnum: + enum: + - enabled + - paused + - disabled + - disabled_deleted + type: string + SamlVersionEnum: + enum: + - '1.1' + - '2.0' + type: string + Schedule: + type: object + properties: + id: + type: string + format: uuid + readOnly: true + identifier: + type: string + readOnly: true + nullable: true + description: Unique schedule identifier + uid: + type: string + readOnly: true + actor_name: + type: string + readOnly: true + description: Dramatiq actor to call + rel_obj_app_label: + type: string + readOnly: true + rel_obj_model: + type: string + title: Python model class name + readOnly: true + rel_obj_id: + type: string + nullable: true + crontab: + type: string + description: When to schedule tasks + paused: + type: boolean + description: Pause this schedule + next_run: + type: string + format: date-time + readOnly: true + description: + type: string + nullable: true + readOnly: true + last_task_status: + allOf: + - $ref: '#/components/schemas/LastTaskStatusEnum' + nullable: true + readOnly: true + required: + - actor_name + - crontab + - description + - id + - identifier + - last_task_status + - next_run + - rel_obj_app_label + - rel_obj_model + - uid + ScheduleRequest: + type: object + properties: + rel_obj_id: + type: string + nullable: true + minLength: 1 + crontab: + type: string + minLength: 1 + description: When to schedule tasks + paused: + type: boolean + description: Pause this schedule + required: + - crontab + ScopeMapping: + type: object + description: ScopeMapping Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Pm uuid + managed: + type: string + nullable: true + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + expression: + type: string + component: + type: string + description: Get object's component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + scope_name: + type: string + description: Scope name requested by the client + description: + type: string + description: Description shown to the user when consenting. If left empty, + the user won't be informed. + required: + - component + - expression + - meta_model_name + - name + - pk + - scope_name + - verbose_name + - verbose_name_plural + ScopeMappingRequest: + type: object + description: ScopeMapping Serializer + properties: + managed: + type: string + nullable: true + minLength: 1 + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + minLength: 1 + expression: + type: string + minLength: 1 + scope_name: + type: string + minLength: 1 + description: Scope name requested by the client + description: + type: string + description: Description shown to the user when consenting. If left empty, + the user won't be informed. + required: + - expression + - name + - scope_name + SelectableStage: + type: object + description: Serializer for stages which can be selected by users + properties: + pk: + type: string + format: uuid + name: + type: string + verbose_name: + type: string + meta_model_name: + type: string + required: + - meta_model_name + - name + - pk + - verbose_name + ServiceConnection: + type: object + description: ServiceConnection Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Uuid + name: + type: string + local: + type: boolean + description: If enabled, use the local connection. Required Docker socket/Kubernetes + Integration + component: + type: string + description: Return component used to edit this object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + required: + - component + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + ServiceConnectionState: + type: object + description: Serializer for Service connection state + properties: + healthy: + type: boolean + readOnly: true + version: + type: string + readOnly: true + required: + - healthy + - version + SessionEndChallenge: + type: object + description: Challenge for ending a session + properties: + flow_info: + $ref: '#/components/schemas/ContextualFlowInfo' + component: + type: string + default: ak-stage-session-end + response_errors: + type: object + additionalProperties: + type: array + items: + $ref: '#/components/schemas/ErrorDetail' + pending_user: + type: string + pending_user_avatar: + type: string + application_name: + type: string + application_launch_url: + type: string + invalidation_flow_url: + type: string + overview_url: + type: string + brand_name: + type: string + required: + - brand_name + - pending_user + - pending_user_avatar + SessionUser: + type: object + description: |- + Response for the /user/me endpoint, returns the currently active user (as `user` property) + and, if this user is being impersonated, the original user in the `original` property. + properties: + user: + $ref: '#/components/schemas/UserSelf' + original: + $ref: '#/components/schemas/UserSelf' + users: + type: array + items: + $ref: '#/components/schemas/UserSelf' + required: + - user + - users + Settings: + type: object + description: Settings Serializer + properties: + avatars: + type: string + description: Configure how authentik should show avatars for users. + base_url: + type: string + description: Configure the base URL under which this authentik instance + is reachable, e.g. https://authentik.company + format: uri + maxLength: 200 + default_user_change_name: + type: boolean + description: Enable the ability for users to change their name. + default_user_change_email: + type: boolean + description: Enable the ability for users to change their email address. + default_user_change_username: + type: boolean + description: Enable the ability for users to change their username. + event_retention: + type: string + description: 'Events will be deleted after this duration.(Format: weeks=3;days=2;hours=3,seconds=2).' + reputation_lower_limit: + type: integer + maximum: 0 + minimum: -2147483648 + description: Reputation cannot decrease lower than this value. Zero or negative. + reputation_upper_limit: + type: integer + maximum: 2147483647 + minimum: 0 + description: Reputation cannot increase higher than this value. Zero or + positive. + footer_links: {} + gdpr_compliance: + type: boolean + description: When enabled, all the events caused by a user will be deleted + upon the user's deletion. + impersonation: + type: boolean + description: Globally enable/disable impersonation. + impersonation_require_reason: + type: boolean + description: Require administrators to provide a reason for impersonating + a user. + default_token_duration: + type: string + description: Default token duration + default_token_length: + type: integer + maximum: 2147483647 + minimum: 1 + description: Default token length + pagination_default_page_size: + type: integer + maximum: 2147483647 + minimum: 0 + description: Default page size for API responses, if no size was requested. + pagination_max_page_size: + type: integer + maximum: 2147483647 + minimum: 0 + description: Maximum page size + flags: + type: object + properties: + core_default_app_access: + type: boolean + description: Applications with no policies bound can be accessed by + any user. + enterprise_audit_include_expanded_diff: + type: boolean + description: Include additional information in audit logs, may incur + a performance penalty. + flows_continuous_login: + type: boolean + description: Upon successful authentication, re-start authentication + in other open tabs. + flows_refresh_others: + type: boolean + description: Refresh other tabs after successful authentication. + deprecated: true + required: + - core_default_app_access + - enterprise_audit_include_expanded_diff + - flows_continuous_login + - flows_refresh_others + required: + - flags + SettingsRequest: + type: object + description: Settings Serializer + properties: + avatars: + type: string + minLength: 1 + description: Configure how authentik should show avatars for users. + base_url: + type: string + description: Configure the base URL under which this authentik instance + is reachable, e.g. https://authentik.company + format: uri + maxLength: 200 + default_user_change_name: + type: boolean + description: Enable the ability for users to change their name. + default_user_change_email: + type: boolean + description: Enable the ability for users to change their email address. + default_user_change_username: + type: boolean + description: Enable the ability for users to change their username. + event_retention: + type: string + minLength: 1 + description: 'Events will be deleted after this duration.(Format: weeks=3;days=2;hours=3,seconds=2).' + reputation_lower_limit: + type: integer + maximum: 0 + minimum: -2147483648 + description: Reputation cannot decrease lower than this value. Zero or negative. + reputation_upper_limit: + type: integer + maximum: 2147483647 + minimum: 0 + description: Reputation cannot increase higher than this value. Zero or + positive. + footer_links: {} + gdpr_compliance: + type: boolean + description: When enabled, all the events caused by a user will be deleted + upon the user's deletion. + impersonation: + type: boolean + description: Globally enable/disable impersonation. + impersonation_require_reason: + type: boolean + description: Require administrators to provide a reason for impersonating + a user. + default_token_duration: + type: string + minLength: 1 + description: Default token duration + default_token_length: + type: integer + maximum: 2147483647 + minimum: 1 + description: Default token length + pagination_default_page_size: + type: integer + maximum: 2147483647 + minimum: 0 + description: Default page size for API responses, if no size was requested. + pagination_max_page_size: + type: integer + maximum: 2147483647 + minimum: 0 + description: Maximum page size + flags: + type: object + properties: + core_default_app_access: + type: boolean + description: Applications with no policies bound can be accessed by + any user. + enterprise_audit_include_expanded_diff: + type: boolean + description: Include additional information in audit logs, may incur + a performance penalty. + flows_continuous_login: + type: boolean + description: Upon successful authentication, re-start authentication + in other open tabs. + flows_refresh_others: + type: boolean + description: Refresh other tabs after successful authentication. + deprecated: true + required: + - core_default_app_access + - enterprise_audit_include_expanded_diff + - flows_continuous_login + - flows_refresh_others + required: + - flags + SeverityEnum: + enum: + - notice + - warning + - alert + type: string + ShellChallenge: + type: object + description: challenge type to render HTML as-is + properties: + flow_info: + $ref: '#/components/schemas/ContextualFlowInfo' + component: + type: string + default: xak-flow-shell + response_errors: + type: object + additionalProperties: + type: array + items: + $ref: '#/components/schemas/ErrorDetail' + body: + type: string + required: + - body + SignatureAlgorithmEnum: + enum: + - http://www.w3.org/2000/09/xmldsig#rsa-sha1 + - http://www.w3.org/2001/04/xmldsig-more#rsa-sha256 + - http://www.w3.org/2001/04/xmldsig-more#rsa-sha384 + - http://www.w3.org/2001/04/xmldsig-more#rsa-sha512 + - http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1 + - http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256 + - http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384 + - http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512 + - http://www.w3.org/2000/09/xmldsig#dsa-sha1 + type: string + Software: + type: object + properties: + name: + type: string + version: + type: string + source: + type: string + path: + type: string + required: + - name + - source + SoftwareRequest: + type: object + properties: + name: + type: string + minLength: 1 + version: + type: string + source: + type: string + minLength: 1 + path: + type: string + minLength: 1 + required: + - name + - source + Source: + type: object + description: Source Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Pbm uuid + name: + type: string + description: Source's display Name. + slug: + type: string + description: Internal source name, used in URLs. + pattern: ^[-a-zA-Z0-9_]+$ + enabled: + type: boolean + promoted: + type: boolean + description: When enabled, this source will be displayed as a prominent + button on the login page, instead of a small icon. + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow to use when authenticating existing users. + enrollment_flow: + type: string + format: uuid + nullable: true + description: Flow to use when enrolling new users. + user_property_mappings: + type: array + items: + type: string + format: uuid + group_property_mappings: + type: array + items: + type: string + format: uuid + component: + type: string + description: Get object component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + user_matching_mode: + allOf: + - $ref: '#/components/schemas/UserMatchingModeEnum' + description: How the source determines if an existing user should be authenticated + or a new user enrolled. + managed: + type: string + nullable: true + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + readOnly: true + user_path_template: + type: string + icon: + type: string + icon_url: + type: string + nullable: true + description: Get the URL to the source icon + readOnly: true + icon_themed_urls: + allOf: + - $ref: '#/components/schemas/ThemedUrls' + readOnly: true + nullable: true + required: + - component + - icon_themed_urls + - icon_url + - managed + - meta_model_name + - name + - pk + - slug + - verbose_name + - verbose_name_plural + SourceStage: + type: object + description: SourceStage Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Stage uuid + name: + type: string + component: + type: string + description: Get object type so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + flow_set: + type: array + items: + $ref: '#/components/schemas/FlowSet' + readOnly: true + source: + type: string + format: uuid + resume_timeout: + type: string + description: 'Amount of time a user can take to return from the source to + continue the flow (Format: hours=-1;minutes=-2;seconds=-3)' + resume_on_match_failures: + type: array + items: + $ref: '#/components/schemas/ResumeOnMatchFailuresEnum' + description: Source matching failure reasons for which the flow should resume. + required: + - component + - flow_set + - meta_model_name + - name + - pk + - source + - verbose_name + - verbose_name_plural + SourceStageRequest: + type: object + description: SourceStage Serializer + properties: + name: + type: string + minLength: 1 + source: + type: string + format: uuid + resume_timeout: + type: string + minLength: 1 + description: 'Amount of time a user can take to return from the source to + continue the flow (Format: hours=-1;minutes=-2;seconds=-3)' + resume_on_match_failures: + type: array + items: + $ref: '#/components/schemas/ResumeOnMatchFailuresEnum' + description: Source matching failure reasons for which the flow should resume. + required: + - name + - source + SourceType: + type: object + description: Serializer for SourceType + properties: + name: + type: string + verbose_name: + type: string + urls_customizable: + type: boolean + request_token_url: + type: string + readOnly: true + nullable: true + authorization_url: + type: string + readOnly: true + nullable: true + access_token_url: + type: string + readOnly: true + nullable: true + profile_url: + type: string + readOnly: true + nullable: true + oidc_well_known_url: + type: string + readOnly: true + nullable: true + oidc_jwks_url: + type: string + readOnly: true + nullable: true + required: + - access_token_url + - authorization_url + - name + - oidc_jwks_url + - oidc_well_known_url + - profile_url + - request_token_url + - urls_customizable + - verbose_name + Stage: + type: object + description: Stage Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Stage uuid + name: + type: string + component: + type: string + description: Get object type so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + flow_set: + type: array + items: + $ref: '#/components/schemas/FlowSet' + readOnly: true + required: + - component + - flow_set + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + StageModeEnum: + enum: + - optional + - required + type: string + StagePrompt: + type: object + description: Serializer for a single Prompt field + properties: + field_key: + type: string + label: + type: string + type: + $ref: '#/components/schemas/PromptTypeEnum' + required: + type: boolean + placeholder: + type: string + initial_value: + type: string + order: + type: integer + sub_text: + type: string + choices: + type: array + items: + $ref: '#/components/schemas/PromptChoice' + nullable: true + required: + - choices + - field_key + - initial_value + - label + - order + - placeholder + - required + - sub_text + - type + StaticDevice: + type: object + description: Serializer for static authenticator devices + properties: + name: + type: string + description: The human-readable name of this device. + maxLength: 64 + token_set: + type: array + items: + $ref: '#/components/schemas/StaticDeviceToken' + readOnly: true + pk: + type: integer + readOnly: true + title: ID + user: + allOf: + - $ref: '#/components/schemas/PartialUser' + readOnly: true + required: + - name + - pk + - token_set + - user + StaticDeviceRequest: + type: object + description: Serializer for static authenticator devices + properties: + name: + type: string + minLength: 1 + description: The human-readable name of this device. + maxLength: 64 + required: + - name + StaticDeviceToken: + type: object + description: Serializer for static device's tokens + properties: + token: + type: string + maxLength: 100 + required: + - token + SubModeEnum: + enum: + - hashed_user_id + - user_id + - user_uuid + - user_username + - user_email + - user_upn + type: string + SyncObjectModelEnum: + enum: + - authentik.core.models.User + - authentik.core.models.Group + type: string + SyncObjectRequest: + type: object + description: Sync object serializer + properties: + sync_object_model: + $ref: '#/components/schemas/SyncObjectModelEnum' + sync_object_id: + type: string + minLength: 1 + override_dry_run: + type: boolean + default: false + required: + - sync_object_id + - sync_object_model + SyncObjectResult: + type: object + description: Result of a single object sync + properties: + messages: + type: array + items: + $ref: '#/components/schemas/LogEvent' + readOnly: true + required: + - messages + SyncOutgoingTriggerModeEnum: + enum: + - none + - immediate + - deferred_end + type: string + SyncStatus: + type: object + description: Provider/source sync status + properties: + is_running: + type: boolean + last_successful_sync: + type: string + format: date-time + last_sync_status: + $ref: '#/components/schemas/TaskAggregatedStatusEnum' + required: + - is_running + SystemInfo: + type: object + description: Get system information. + properties: + http_headers: + type: object + additionalProperties: + type: string + description: Get HTTP Request headers + readOnly: true + http_host: + type: string + description: Get HTTP host + readOnly: true + http_is_secure: + type: boolean + description: Get HTTP Secure flag + readOnly: true + runtime: + type: object + description: Get versions + properties: + python_version: + type: string + environment: + type: string + architecture: + type: string + platform: + type: string + uname: + type: string + openssl_version: + type: string + openssl_fips_enabled: + type: boolean + nullable: true + authentik_version: + type: string + required: + - architecture + - authentik_version + - environment + - openssl_fips_enabled + - openssl_version + - platform + - python_version + - uname + readOnly: true + brand: + type: string + description: Currently active brand + readOnly: true + server_time: + type: string + format: date-time + description: Current server time + readOnly: true + embedded_outpost_disabled: + type: boolean + description: Whether the embedded outpost is disabled + readOnly: true + embedded_outpost_host: + type: string + description: Get the FQDN configured on the embedded outpost + readOnly: true + base_url: + type: string + description: Configured external base URL. Can be empty + readOnly: true + required: + - base_url + - brand + - embedded_outpost_disabled + - embedded_outpost_host + - http_headers + - http_host + - http_is_secure + - runtime + - server_time + TOTPDevice: + type: object + description: Serializer for totp authenticator devices + properties: + name: + type: string + description: The human-readable name of this device. + maxLength: 64 + pk: + type: integer + readOnly: true + title: ID + user: + allOf: + - $ref: '#/components/schemas/PartialUser' + readOnly: true + required: + - name + - pk + - user + TOTPDeviceRequest: + type: object + description: Serializer for totp authenticator devices + properties: + name: + type: string + minLength: 1 + description: The human-readable name of this device. + maxLength: 64 + required: + - name + Task: + type: object + properties: + message_id: + type: string + format: uuid + queue_name: + type: string + description: Queue name + actor_name: + type: string + description: Dramatiq actor name + state: + allOf: + - $ref: '#/components/schemas/TaskStatusEnum' + description: Task status + mtime: + type: string + format: date-time + description: Task last modified time + retries: + type: integer + maximum: 9223372036854775807 + minimum: 0 + format: int64 + description: Number of retries + eta: + type: string + format: date-time + nullable: true + description: Planned execution time + rel_obj_app_label: + type: string + readOnly: true + rel_obj_model: + type: string + title: Python model class name + readOnly: true + rel_obj_id: + type: string + nullable: true + uid: + type: string + readOnly: true + logs: + type: array + items: + $ref: '#/components/schemas/LogEvent' + readOnly: true + previous_logs: + type: array + items: + $ref: '#/components/schemas/LogEvent' + readOnly: true + aggregated_status: + $ref: '#/components/schemas/TaskAggregatedStatusEnum' + description: + type: string + nullable: true + readOnly: true + required: + - actor_name + - aggregated_status + - description + - logs + - previous_logs + - rel_obj_app_label + - rel_obj_model + - uid + TaskAggregatedStatusEnum: + enum: + - waiting_for_dependencies + - queued + - consumed + - preprocess + - running + - postprocess + - rejected + - done + - info + - warning + - error + type: string + TaskStatusEnum: + enum: + - waiting_for_dependencies + - queued + - consumed + - preprocess + - running + - postprocess + - rejected + - done + type: string + TelegramAuthRequest: + type: object + properties: + id: + type: integer + first_name: + type: string + minLength: 1 + maxLength: 255 + last_name: + type: string + minLength: 1 + maxLength: 255 + username: + type: string + minLength: 1 + maxLength: 255 + photo_url: + type: string + format: uri + minLength: 1 + auth_date: + type: integer + hash: + type: string + minLength: 1 + maxLength: 64 + required: + - auth_date + - hash + - id + TelegramChallengeResponseRequest: + type: object + description: Base class for all challenge responses + properties: + id: + type: integer + first_name: + type: string + minLength: 1 + maxLength: 255 + last_name: + type: string + minLength: 1 + maxLength: 255 + username: + type: string + minLength: 1 + maxLength: 255 + photo_url: + type: string + format: uri + minLength: 1 + auth_date: + type: integer + hash: + type: string + minLength: 1 + maxLength: 64 + component: + type: string + minLength: 1 + default: ak-source-telegram + required: + - auth_date + - hash + - id + TelegramLoginChallenge: + type: object + description: Base login challenge for Identification stage + properties: + flow_info: + $ref: '#/components/schemas/ContextualFlowInfo' + component: + type: string + default: ak-source-telegram + response_errors: + type: object + additionalProperties: + type: array + items: + $ref: '#/components/schemas/ErrorDetail' + bot_username: + type: string + description: Telegram bot username + request_message_access: + type: boolean + required: + - bot_username + - request_message_access + TelegramSource: + type: object + description: Source Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Pbm uuid + name: + type: string + description: Source's display Name. + slug: + type: string + description: Internal source name, used in URLs. + pattern: ^[-a-zA-Z0-9_]+$ + enabled: + type: boolean + promoted: + type: boolean + description: When enabled, this source will be displayed as a prominent + button on the login page, instead of a small icon. + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow to use when authenticating existing users. + enrollment_flow: + type: string + format: uuid + nullable: true + description: Flow to use when enrolling new users. + user_property_mappings: + type: array + items: + type: string + format: uuid + group_property_mappings: + type: array + items: + type: string + format: uuid + component: + type: string + description: Get object component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + user_matching_mode: + allOf: + - $ref: '#/components/schemas/UserMatchingModeEnum' + description: How the source determines if an existing user should be authenticated + or a new user enrolled. + managed: + type: string + nullable: true + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + readOnly: true + user_path_template: + type: string + icon: + type: string + icon_url: + type: string + nullable: true + readOnly: true + icon_themed_urls: + allOf: + - $ref: '#/components/schemas/ThemedUrls' + readOnly: true + nullable: true + bot_username: + type: string + description: Telegram bot username + request_message_access: + type: boolean + description: Request access to send messages from your bot. + pre_authentication_flow: + type: string + format: uuid + description: Flow used before authentication. + required: + - bot_username + - component + - icon_themed_urls + - icon_url + - managed + - meta_model_name + - name + - pk + - pre_authentication_flow + - slug + - verbose_name + - verbose_name_plural + TelegramSourcePropertyMapping: + type: object + description: TelegramSourcePropertyMapping Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Pm uuid + managed: + type: string + nullable: true + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + expression: + type: string + component: + type: string + description: Get object's component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + required: + - component + - expression + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + TelegramSourcePropertyMappingRequest: + type: object + description: TelegramSourcePropertyMapping Serializer + properties: + managed: + type: string + nullable: true + minLength: 1 + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + name: + type: string + minLength: 1 + expression: + type: string + minLength: 1 + required: + - expression + - name + TelegramSourceRequest: + type: object + description: Source Serializer + properties: + name: + type: string + minLength: 1 + description: Source's display Name. + slug: + type: string + minLength: 1 + description: Internal source name, used in URLs. + pattern: ^[-a-zA-Z0-9_]+$ + enabled: + type: boolean + promoted: + type: boolean + description: When enabled, this source will be displayed as a prominent + button on the login page, instead of a small icon. + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow to use when authenticating existing users. + enrollment_flow: + type: string + format: uuid + nullable: true + description: Flow to use when enrolling new users. + user_property_mappings: + type: array + items: + type: string + format: uuid + group_property_mappings: + type: array + items: + type: string + format: uuid + policy_engine_mode: + $ref: '#/components/schemas/PolicyEngineMode' + user_matching_mode: + allOf: + - $ref: '#/components/schemas/UserMatchingModeEnum' + description: How the source determines if an existing user should be authenticated + or a new user enrolled. + user_path_template: + type: string + minLength: 1 + icon: + type: string + bot_username: + type: string + minLength: 1 + description: Telegram bot username + bot_token: + type: string + writeOnly: true + minLength: 1 + description: Telegram bot token + request_message_access: + type: boolean + description: Request access to send messages from your bot. + pre_authentication_flow: + type: string + format: uuid + description: Flow used before authentication. + required: + - bot_token + - bot_username + - name + - pre_authentication_flow + - slug + ThemedUrls: + type: object + description: Themed URLs - maps theme names to URLs for light and dark themes + properties: + light: + type: string + nullable: true + dark: + type: string + nullable: true + Token: + type: object + description: Token Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Token uuid + managed: + type: string + nullable: true + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + identifier: + type: string + maxLength: 255 + pattern: ^[-a-zA-Z0-9_]+$ + intent: + $ref: '#/components/schemas/IntentEnum' + user: + type: integer + user_obj: + allOf: + - $ref: '#/components/schemas/User' + readOnly: true + description: + type: string + expires: + type: string + format: date-time + nullable: true + expiring: + type: boolean + required: + - identifier + - pk + - user_obj + TokenModel: + type: object + description: Serializer for BaseGrantModel and RefreshToken + properties: + pk: + type: integer + readOnly: true + title: ID + provider: + $ref: '#/components/schemas/Provider' + user: + $ref: '#/components/schemas/User' + is_expired: + type: boolean + description: Check if token is expired yet. + readOnly: true + expires: + type: string + format: date-time + nullable: true + scope: + type: array + items: + type: string + id_token: + type: string + description: Get the token's id_token as JSON String + readOnly: true + revoked: + type: boolean + required: + - id_token + - is_expired + - pk + - provider + - scope + - user + TokenRequest: + type: object + description: Token Serializer + properties: + managed: + type: string + nullable: true + minLength: 1 + title: Managed by authentik + description: Objects that are managed by authentik. These objects are created + and updated automatically. This flag only indicates that an object can + be overwritten by migrations. You can still modify the objects via the + API, but expect changes to be overwritten in a later update. + identifier: + type: string + minLength: 1 + maxLength: 255 + pattern: ^[-a-zA-Z0-9_]+$ + intent: + $ref: '#/components/schemas/IntentEnum' + user: + type: integer + description: + type: string + expires: + type: string + format: date-time + nullable: true + expiring: + type: boolean + required: + - identifier + TokenSetKeyRequest: + type: object + description: Set token's key + properties: + key: + type: string + minLength: 1 + required: + - key + TokenView: + type: object + description: Show token's current key + properties: + key: + type: string + readOnly: true + required: + - key + TransactionApplicationRequest: + type: object + description: Serializer for creating a provider and an application in one transaction + properties: + app: + $ref: '#/components/schemas/ApplicationRequest' + provider_model: + $ref: '#/components/schemas/ProviderModelEnum' + provider: + $ref: '#/components/schemas/modelRequest' + policy_bindings: + type: array + items: + $ref: '#/components/schemas/TransactionPolicyBindingRequest' + required: + - app + - provider + - provider_model + TransactionApplicationResponse: + type: object + description: Transactional creation response + properties: + applied: + type: boolean + logs: + type: array + items: + type: string + required: + - applied + - logs + TransactionPolicyBindingRequest: + type: object + description: PolicyBindingSerializer which does not require target as target + is set implicitly + properties: + policy: + type: string + format: uuid + nullable: true + group: + type: string + format: uuid + nullable: true + user: + type: integer + nullable: true + negate: + type: boolean + description: Negates the outcome of the policy. Messages are unaffected. + enabled: + type: boolean + order: + type: integer + maximum: 2147483647 + minimum: -2147483648 + timeout: + type: integer + maximum: 2147483647 + minimum: 0 + description: Timeout after which Policy execution is terminated. + failure_result: + type: boolean + description: Result if the Policy execution fails. + required: + - order + TransportModeEnum: + enum: + - local + - webhook + - webhook_slack + - email + type: string + TypeCreate: + type: object + description: Types of an object that can be created + properties: + name: + type: string + description: + type: string + component: + type: string + model_name: + type: string + icon_url: + type: string + requires_enterprise: + type: boolean + default: false + deprecated: + type: boolean + default: false + required: + - component + - description + - model_name + - name + UiThemeEnum: + enum: + - automatic + - light + - dark + type: string + UniquePasswordPolicy: + type: object + description: Password Uniqueness Policy Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Policy uuid + name: + type: string + execution_logging: + type: boolean + description: When this option is enabled, all executions of this policy + will be logged. By default, only execution errors are logged. + component: + type: string + description: Get object component so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + bound_to: + type: integer + description: Return objects policy is bound to + readOnly: true + password_field: + type: string + description: Field key to check, field keys defined in Prompt stages are + available. + num_historical_passwords: + type: integer + maximum: 2147483647 + minimum: 0 + description: Number of passwords to check against. + required: + - bound_to + - component + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + UniquePasswordPolicyRequest: + type: object + description: Password Uniqueness Policy Serializer + properties: + name: + type: string + minLength: 1 + execution_logging: + type: boolean + description: When this option is enabled, all executions of this policy + will be logged. By default, only execution errors are logged. + password_field: + type: string + minLength: 1 + description: Field key to check, field keys defined in Prompt stages are + available. + num_historical_passwords: + type: integer + maximum: 2147483647 + minimum: 0 + description: Number of passwords to check against. + required: + - name + UsageEnum: + enum: + - media + type: string + UsedBy: + type: object + description: A list of all objects referencing the queried object + properties: + app: + type: string + model_name: + type: string + pk: + type: string + name: + type: string + action: + $ref: '#/components/schemas/UsedByActionEnum' + required: + - action + - app + - model_name + - name + - pk + UsedByActionEnum: + enum: + - cascade + - cascade_many + - set_null + - set_default + - left_dangling + type: string + User: + type: object + description: User Serializer + properties: + pk: + type: integer + readOnly: true + title: ID + username: + type: string + maxLength: 150 + name: + type: string + description: User's display name. + is_active: + type: boolean + title: Active + description: Designates whether this user should be treated as active. Unselect + this instead of deleting accounts. + last_login: + type: string + format: date-time + nullable: true + date_joined: + type: string + format: date-time + readOnly: true + is_superuser: + type: boolean + readOnly: true + groups: + type: array + items: + type: string + format: uuid + groups_obj: + type: array + items: + $ref: '#/components/schemas/PartialGroup' + readOnly: true + nullable: true + roles: + type: array + items: + type: string + format: uuid + roles_obj: + type: array + items: + $ref: '#/components/schemas/Role' + readOnly: true + nullable: true + email: + type: string + format: email + title: Email address + maxLength: 254 + avatar: + type: string + description: User's avatar, either a http/https URL or a data URI + readOnly: true + attributes: + type: object + additionalProperties: {} + uid: + type: string + readOnly: true + path: + type: string + type: + $ref: '#/components/schemas/UserTypeEnum' + uuid: + type: string + format: uuid + readOnly: true + password_change_date: + type: string + format: date-time + readOnly: true + last_updated: + type: string + format: date-time + readOnly: true + required: + - avatar + - date_joined + - groups_obj + - is_superuser + - last_updated + - name + - password_change_date + - pk + - roles_obj + - uid + - username + - uuid + UserAccountLockdownRequest: + type: object + description: Choose the target account before starting the lockdown flow. + properties: + user: + type: integer + nullable: true + description: User to lock. If omitted, locks the current user (self-service). + UserAccountRequest: + type: object + description: Account adding/removing operations + properties: + pk: + type: integer + required: + - pk + UserAccountSerializerForRoleRequest: + type: object + description: Account adding/removing operations + properties: + pk: + type: integer + required: + - pk + UserAttributeEnum: + enum: + - username + - email + type: string + UserConsent: + type: object + description: UserConsent Serializer + properties: + pk: + type: integer + readOnly: true + title: ID + expires: + type: string + format: date-time + nullable: true + expiring: + type: boolean + user: + $ref: '#/components/schemas/User' + application: + $ref: '#/components/schemas/Application' + permissions: + type: string + default: '' + required: + - application + - pk + - user + UserCreationModeEnum: + enum: + - never_create + - create_when_required + - always_create + type: string + UserDeleteStage: + type: object + description: UserDeleteStage Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Stage uuid + name: + type: string + component: + type: string + description: Get object type so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + flow_set: + type: array + items: + $ref: '#/components/schemas/FlowSet' + readOnly: true + required: + - component + - flow_set + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + UserDeleteStageRequest: + type: object + description: UserDeleteStage Serializer + properties: + name: + type: string + minLength: 1 + required: + - name + UserFieldsEnum: + enum: + - email + - username + - upn + type: string + UserKerberosSourceConnection: + type: object + description: User source connection + properties: + pk: + type: integer + readOnly: true + title: ID + user: + type: integer + readOnly: true + source: + type: string + format: uuid + source_obj: + allOf: + - $ref: '#/components/schemas/Source' + readOnly: true + identifier: + type: string + created: + type: string + format: date-time + readOnly: true + last_updated: + type: string + format: date-time + readOnly: true + required: + - created + - identifier + - last_updated + - pk + - source + - source_obj + - user + UserKerberosSourceConnectionRequest: + type: object + description: User source connection + properties: + source: + type: string + format: uuid + identifier: + type: string + minLength: 1 + required: + - identifier + - source + UserLDAPSourceConnection: + type: object + description: User source connection + properties: + pk: + type: integer + readOnly: true + title: ID + user: + type: integer + readOnly: true + source: + type: string + format: uuid + source_obj: + allOf: + - $ref: '#/components/schemas/Source' + readOnly: true + identifier: + type: string + created: + type: string + format: date-time + readOnly: true + last_updated: + type: string + format: date-time + readOnly: true + user_obj: + allOf: + - $ref: '#/components/schemas/PartialUser' + readOnly: true + required: + - created + - identifier + - last_updated + - pk + - source + - source_obj + - user + - user_obj + UserLDAPSourceConnectionRequest: + type: object + description: User source connection + properties: + source: + type: string + format: uuid + identifier: + type: string + minLength: 1 + required: + - identifier + - source + UserLoginChallenge: + type: object + description: Empty challenge + properties: + flow_info: + $ref: '#/components/schemas/ContextualFlowInfo' + component: + type: string + default: ak-stage-user-login + response_errors: + type: object + additionalProperties: + type: array + items: + $ref: '#/components/schemas/ErrorDetail' + pending_user: + type: string + pending_user_avatar: + type: string + required: + - pending_user + - pending_user_avatar + UserLoginChallengeResponseRequest: + type: object + description: User login challenge + properties: + component: + type: string + minLength: 1 + default: ak-stage-user-login + remember_me: + type: boolean + required: + - remember_me + UserLoginStage: + type: object + description: UserLoginStage Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Stage uuid + name: + type: string + component: + type: string + description: Get object type so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + flow_set: + type: array + items: + $ref: '#/components/schemas/FlowSet' + readOnly: true + session_duration: + type: string + description: 'Determines how long a session lasts. Default of 0 means that + the sessions lasts until the browser is closed. (Format: hours=-1;minutes=-2;seconds=-3)' + terminate_other_sessions: + type: boolean + description: Terminate all other sessions of the user logging in. + remember_me_offset: + type: string + description: 'Offset the session will be extended by when the user picks + the remember me option. Default of 0 means that the remember me option + will not be shown. (Format: hours=-1;minutes=-2;seconds=-3)' + network_binding: + allOf: + - $ref: '#/components/schemas/NetworkBindingEnum' + description: Bind sessions created by this stage to the configured network + geoip_binding: + allOf: + - $ref: '#/components/schemas/GeoipBindingEnum' + description: Bind sessions created by this stage to the configured GeoIP + location + remember_device: + type: string + description: 'When set to a non-zero value, authentik will save a cookie + with a longer expiry,to remember the device the user is logging in from. + (Format: hours=-1;minutes=-2;seconds=-3)' + required: + - component + - flow_set + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + UserLoginStageRequest: + type: object + description: UserLoginStage Serializer + properties: + name: + type: string + minLength: 1 + session_duration: + type: string + minLength: 1 + description: 'Determines how long a session lasts. Default of 0 means that + the sessions lasts until the browser is closed. (Format: hours=-1;minutes=-2;seconds=-3)' + terminate_other_sessions: + type: boolean + description: Terminate all other sessions of the user logging in. + remember_me_offset: + type: string + minLength: 1 + description: 'Offset the session will be extended by when the user picks + the remember me option. Default of 0 means that the remember me option + will not be shown. (Format: hours=-1;minutes=-2;seconds=-3)' + network_binding: + allOf: + - $ref: '#/components/schemas/NetworkBindingEnum' + description: Bind sessions created by this stage to the configured network + geoip_binding: + allOf: + - $ref: '#/components/schemas/GeoipBindingEnum' + description: Bind sessions created by this stage to the configured GeoIP + location + remember_device: + type: string + minLength: 1 + description: 'When set to a non-zero value, authentik will save a cookie + with a longer expiry,to remember the device the user is logging in from. + (Format: hours=-1;minutes=-2;seconds=-3)' + required: + - name + UserLogoutStage: + type: object + description: UserLogoutStage Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Stage uuid + name: + type: string + component: + type: string + description: Get object type so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + flow_set: + type: array + items: + $ref: '#/components/schemas/FlowSet' + readOnly: true + required: + - component + - flow_set + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + UserLogoutStageRequest: + type: object + description: UserLogoutStage Serializer + properties: + name: + type: string + minLength: 1 + required: + - name + UserMatchingModeEnum: + enum: + - identifier + - email_link + - email_deny + - username_link + - username_deny + type: string + UserOAuthSourceConnection: + type: object + description: User source connection + properties: + pk: + type: integer + readOnly: true + title: ID + user: + type: integer + readOnly: true + source: + type: string + format: uuid + source_obj: + allOf: + - $ref: '#/components/schemas/Source' + readOnly: true + identifier: + type: string + created: + type: string + format: date-time + readOnly: true + last_updated: + type: string + format: date-time + readOnly: true + expires: + type: string + format: date-time + required: + - created + - identifier + - last_updated + - pk + - source + - source_obj + - user + UserOAuthSourceConnectionRequest: + type: object + description: User source connection + properties: + source: + type: string + format: uuid + identifier: + type: string + minLength: 1 + access_token: + type: string + writeOnly: true + nullable: true + expires: + type: string + format: date-time + required: + - identifier + - source + UserOffboarding: + type: object + description: |- + Mixin to validate that a valid enterprise license + exists before allowing to save the object + properties: + id: + type: string + format: uuid + readOnly: true + user: + type: integer + user_obj: + allOf: + - $ref: '#/components/schemas/PartialUser' + readOnly: true + scheduled_at: + type: string + format: date-time + description: Absolute time at which the offboarding action is executed. + action: + $ref: '#/components/schemas/OffboardingActionEnum' + revoke_sessions: + type: boolean + description: Revoke all of the user's sessions when offboarding. + revoke_tokens: + type: boolean + description: Revoke all of the user's tokens when offboarding. + status: + allOf: + - $ref: '#/components/schemas/OffboardingStatusEnum' + readOnly: true + created_by_obj: + allOf: + - $ref: '#/components/schemas/PartialUser' + readOnly: true + created_at: + type: string + format: date-time + readOnly: true + executed_at: + type: string + format: date-time + readOnly: true + nullable: true + required: + - created_at + - created_by_obj + - executed_at + - id + - scheduled_at + - status + - user + - user_obj + UserOffboardingRequest: + type: object + description: |- + Mixin to validate that a valid enterprise license + exists before allowing to save the object + properties: + user: + type: integer + scheduled_at: + type: string + format: date-time + description: Absolute time at which the offboarding action is executed. + action: + $ref: '#/components/schemas/OffboardingActionEnum' + revoke_sessions: + type: boolean + description: Revoke all of the user's sessions when offboarding. + revoke_tokens: + type: boolean + description: Revoke all of the user's tokens when offboarding. + required: + - scheduled_at + - user + UserPasswordHashSetRequest: + type: object + description: Payload to set a users' password hash directly + properties: + password: + type: string + minLength: 1 + required: + - password + UserPasswordSetRequest: + type: object + description: Payload to set a users' password directly + properties: + password: + type: string + minLength: 1 + required: + - password + UserPath: + type: object + properties: + paths: + type: array + items: + type: string + readOnly: true + required: + - paths + UserPlexSourceConnection: + type: object + description: User source connection + properties: + pk: + type: integer + readOnly: true + title: ID + user: + type: integer + readOnly: true + source: + type: string + format: uuid + source_obj: + allOf: + - $ref: '#/components/schemas/Source' + readOnly: true + identifier: + type: string + created: + type: string + format: date-time + readOnly: true + last_updated: + type: string + format: date-time + readOnly: true + required: + - created + - identifier + - last_updated + - pk + - source + - source_obj + - user + UserPlexSourceConnectionRequest: + type: object + description: User source connection + properties: + source: + type: string + format: uuid + identifier: + type: string + minLength: 1 + plex_token: + type: string + writeOnly: true + minLength: 1 + required: + - identifier + - plex_token + - source + UserRecoveryEmailRequest: + type: object + description: Payload to create and email a recovery link + properties: + token_duration: + type: string + minLength: 1 + email_stage: + type: string + format: uuid + required: + - email_stage + UserRecoveryLinkRequest: + type: object + description: Payload to create a recovery link + properties: + token_duration: + type: string + minLength: 1 + UserRequest: + type: object + description: User Serializer + properties: + username: + type: string + minLength: 1 + maxLength: 150 + name: + type: string + description: User's display name. + is_active: + type: boolean + title: Active + description: Designates whether this user should be treated as active. Unselect + this instead of deleting accounts. + last_login: + type: string + format: date-time + nullable: true + groups: + type: array + items: + type: string + format: uuid + roles: + type: array + items: + type: string + format: uuid + email: + type: string + format: email + title: Email address + maxLength: 254 + attributes: + type: object + additionalProperties: {} + path: + type: string + minLength: 1 + type: + $ref: '#/components/schemas/UserTypeEnum' + required: + - name + - username + UserSAMLSourceConnection: + type: object + description: User source connection + properties: + pk: + type: integer + readOnly: true + title: ID + user: + type: integer + readOnly: true + source: + type: string + format: uuid + source_obj: + allOf: + - $ref: '#/components/schemas/Source' + readOnly: true + identifier: + type: string + created: + type: string + format: date-time + readOnly: true + last_updated: + type: string + format: date-time + readOnly: true + required: + - created + - identifier + - last_updated + - pk + - source + - source_obj + - user + UserSAMLSourceConnectionRequest: + type: object + description: User source connection + properties: + source: + type: string + format: uuid + identifier: + type: string + minLength: 1 + required: + - identifier + - source + UserSelf: + type: object + description: User Serializer for information a user can retrieve about themselves + properties: + pk: + type: integer + readOnly: true + title: ID + username: + type: string + description: Required. 150 characters or fewer. Letters, digits and @/./+/-/_ + only. + pattern: ^[\w.@+-]+$ + maxLength: 150 + name: + type: string + description: User's display name. + is_active: + type: boolean + readOnly: true + title: Active + description: Designates whether this user should be treated as active. Unselect + this instead of deleting accounts. + is_superuser: + type: boolean + readOnly: true + is_current: + type: boolean + description: Return whether this user owns the current browser session. + readOnly: true + groups: + type: array + items: + $ref: '#/components/schemas/UserSelfGroups' + readOnly: true + roles: + type: array + items: + $ref: '#/components/schemas/UserSelfRoles' + readOnly: true + email: + type: string + format: email + title: Email address + maxLength: 254 + avatar: + type: string + description: User's avatar, either a http/https URL or a data URI + readOnly: true + uid: + type: string + readOnly: true + settings: + type: object + additionalProperties: {} + description: Get user settings with brand and group settings applied + readOnly: true + type: + $ref: '#/components/schemas/UserTypeEnum' + system_permissions: + type: array + items: + type: string + description: Get all system permissions assigned to the user + readOnly: true + required: + - avatar + - groups + - is_active + - is_current + - is_superuser + - name + - pk + - roles + - settings + - system_permissions + - uid + - username + UserSelfGroups: + type: object + properties: + name: + type: string + readOnly: true + pk: + type: string + readOnly: true + required: + - name + - pk + UserSelfRoles: + type: object + properties: + name: + type: string + readOnly: true + pk: + type: string + readOnly: true + required: + - name + - pk + UserServiceAccountRequest: + type: object + description: Payload to create a service account + properties: + name: + type: string + minLength: 1 + create_group: + type: boolean + default: false + expiring: + type: boolean + default: true + expires: + type: string + format: date-time + description: If not provided, valid for 360 days + required: + - name + UserServiceAccountResponse: + type: object + properties: + username: + type: string + token: + type: string + user_uid: + type: string + user_pk: + type: integer + group_pk: + type: string + required: + - token + - user_pk + - user_uid + - username + UserSetting: + type: object + description: Serializer for User settings for stages and sources + properties: + object_uid: + type: string + component: + type: string + title: + type: string + configure_url: + type: string + icon_url: + type: string + required: + - component + - object_uid + - title + UserSourceConnection: + type: object + description: User source connection + properties: + pk: + type: integer + readOnly: true + title: ID + user: + type: integer + readOnly: true + source: + type: string + format: uuid + source_obj: + allOf: + - $ref: '#/components/schemas/Source' + readOnly: true + identifier: + type: string + created: + type: string + format: date-time + readOnly: true + last_updated: + type: string + format: date-time + readOnly: true + required: + - created + - identifier + - last_updated + - pk + - source + - source_obj + - user + UserSourceConnectionRequest: + type: object + description: User source connection + properties: + source: + type: string + format: uuid + identifier: + type: string + minLength: 1 + required: + - identifier + - source + UserSwitchActionEnum: + enum: + - add + - switch + type: string + UserSwitchRequest: + type: object + description: Request to add or switch users in the current browser. + properties: + action: + allOf: + - $ref: '#/components/schemas/UserSwitchActionEnum' + default: switch + user_pk: + type: integer + UserSwitchResponse: + type: object + description: Redirect returned after planning a user switch. + properties: + redirect: + type: string + readOnly: true + required: + - redirect + UserTelegramSourceConnection: + type: object + description: User source connection + properties: + pk: + type: integer + readOnly: true + title: ID + user: + type: integer + readOnly: true + source: + type: string + format: uuid + source_obj: + allOf: + - $ref: '#/components/schemas/Source' + readOnly: true + identifier: + type: string + created: + type: string + format: date-time + readOnly: true + last_updated: + type: string + format: date-time + readOnly: true + required: + - created + - identifier + - last_updated + - pk + - source + - source_obj + - user + UserTelegramSourceConnectionRequest: + type: object + description: User source connection + properties: + source: + type: string + format: uuid + identifier: + type: string + minLength: 1 + required: + - identifier + - source + UserTypeEnum: + enum: + - internal + - external + - service_account + - internal_service_account + type: string + UserVerificationEnum: + enum: + - required + - preferred + - discouraged + type: string + UserWriteStage: + type: object + description: UserWriteStage Serializer + properties: + pk: + type: string + format: uuid + readOnly: true + title: Stage uuid + name: + type: string + component: + type: string + description: Get object type so that we know how to edit the object + readOnly: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + flow_set: + type: array + items: + $ref: '#/components/schemas/FlowSet' + readOnly: true + user_creation_mode: + $ref: '#/components/schemas/UserCreationModeEnum' + create_users_as_inactive: + type: boolean + description: When set, newly created users are inactive and cannot login. + create_users_group: + type: string + format: uuid + nullable: true + description: Optionally add newly created users to this group. + user_type: + $ref: '#/components/schemas/UserTypeEnum' + user_path_template: + type: string + required: + - component + - flow_set + - meta_model_name + - name + - pk + - verbose_name + - verbose_name_plural + UserWriteStageRequest: + type: object + description: UserWriteStage Serializer + properties: + name: + type: string + minLength: 1 + user_creation_mode: + $ref: '#/components/schemas/UserCreationModeEnum' + create_users_as_inactive: + type: boolean + description: When set, newly created users are inactive and cannot login. + create_users_group: + type: string + format: uuid + nullable: true + description: Optionally add newly created users to this group. + user_type: + $ref: '#/components/schemas/UserTypeEnum' + user_path_template: + type: string + required: + - name + ValidationError: + type: object + description: Validation Error + properties: + non_field_errors: + type: array + items: + type: string + code: + type: string + additionalProperties: {} + VendorEnum: + enum: + - goauthentik.io/@merged + - goauthentik.io/platform + - fleetdm.com + - chrome.google.com + type: string + Version: + type: object + description: Get running and latest version. + properties: + version_current: + type: string + description: Get current version + readOnly: true + version_latest: + type: string + description: Get latest version from cache + readOnly: true + version_latest_valid: + type: boolean + description: Check if latest version is valid + readOnly: true + build_hash: + type: string + description: Get build hash, if version is not latest or released + readOnly: true + outdated: + type: boolean + description: Check if we're running the latest version + readOnly: true + outpost_outdated: + type: boolean + description: Check if any outpost is outdated/has a version mismatch + readOnly: true + required: + - build_hash + - outdated + - outpost_outdated + - version_current + - version_latest + - version_latest_valid + VersionHistory: + type: object + description: VersionHistory Serializer + properties: + id: + type: integer + readOnly: true + timestamp: + type: string + format: date-time + version: + type: string + build: + type: string + required: + - build + - id + - timestamp + - version + WSFederationProvider: + type: object + description: WSFederationProvider Serializer + properties: + pk: + type: integer + readOnly: true + title: ID + name: + type: string + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow used for authentication when the associated application + is accessed by an un-authenticated user. + authorization_flow: + type: string + format: uuid + description: Flow used when authorizing this provider. + invalidation_flow: + type: string + format: uuid + description: Flow used ending the session from a provider. + property_mappings: + type: array + items: + type: string + format: uuid + component: + type: string + description: Get object component so that we know how to edit the object + readOnly: true + assigned_application_slug: + type: string + description: Internal application name, used in URLs. + readOnly: true + nullable: true + assigned_application_name: + type: string + description: Application's display Name. + readOnly: true + nullable: true + assigned_backchannel_application_slug: + type: string + description: Internal application name, used in URLs. + readOnly: true + nullable: true + assigned_backchannel_application_name: + type: string + description: Application's display Name. + readOnly: true + nullable: true + verbose_name: + type: string + description: Return object's verbose_name + readOnly: true + verbose_name_plural: + type: string + description: Return object's plural verbose_name + readOnly: true + meta_model_name: + type: string + description: Return internal model name + readOnly: true + reply_url: + type: string + format: uri + wtrealm: + type: string + assertion_valid_not_before: + type: string + description: 'Assertion valid not before current time + this value (Format: + hours=-1;minutes=-2;seconds=-3).' + assertion_valid_not_on_or_after: + type: string + description: 'Assertion not valid on or after current time + this value + (Format: hours=1;minutes=2;seconds=3).' + session_valid_not_on_or_after: + type: string + description: 'Session not valid on or after current time + this value (Format: + hours=1;minutes=2;seconds=3).' + name_id_mapping: + type: string + format: uuid + nullable: true + title: NameID Property Mapping + description: Configure how the NameID value will be created. When left empty, + the NameIDPolicy of the incoming request will be considered + authn_context_class_ref_mapping: + type: string + format: uuid + nullable: true + title: AuthnContextClassRef Property Mapping + description: Configure how the AuthnContextClassRef value will be created. + When left empty, the AuthnContextClassRef will be set based on which authentication + methods the user used to authenticate. + saml_version: + allOf: + - $ref: '#/components/schemas/SamlVersionEnum' + description: SAML assertion version to issue in the security token. Microsoft + Entra ID and classic ADFS-style relying parties typically require SAML + 1.1. + digest_algorithm: + $ref: '#/components/schemas/DigestAlgorithmEnum' + signature_algorithm: + $ref: '#/components/schemas/SignatureAlgorithmEnum' + signing_kp: + type: string + format: uuid + nullable: true + title: Signing Keypair + description: Keypair used to sign outgoing Responses going to the Service + Provider. + encryption_kp: + type: string + format: uuid + nullable: true + title: Encryption Keypair + description: When selected, incoming assertions are encrypted by the IdP + using the public key of the encryption keypair. The assertion is decrypted + by the SP using the the private key. + sign_assertion: + type: boolean + sign_logout_request: + type: boolean + default_name_id_policy: + $ref: '#/components/schemas/SAMLNameIDPolicyEnum' + url_download_metadata: + type: string + description: Get metadata download URL + readOnly: true + url_wsfed: + type: string + description: Get WS-Fed url + readOnly: true + url_issuer: + type: string + description: Get Issuer/EntityID URL + readOnly: true + required: + - assigned_application_name + - assigned_application_slug + - assigned_backchannel_application_name + - assigned_backchannel_application_slug + - authorization_flow + - component + - invalidation_flow + - meta_model_name + - name + - pk + - reply_url + - url_download_metadata + - url_issuer + - url_wsfed + - verbose_name + - verbose_name_plural + - wtrealm + WSFederationProviderRequest: + type: object + description: WSFederationProvider Serializer + properties: + name: + type: string + minLength: 1 + authentication_flow: + type: string + format: uuid + nullable: true + description: Flow used for authentication when the associated application + is accessed by an un-authenticated user. + authorization_flow: + type: string + format: uuid + description: Flow used when authorizing this provider. + invalidation_flow: + type: string + format: uuid + description: Flow used ending the session from a provider. + property_mappings: + type: array + items: + type: string + format: uuid + reply_url: + type: string + format: uri + minLength: 1 + wtrealm: + type: string + minLength: 1 + assertion_valid_not_before: + type: string + minLength: 1 + description: 'Assertion valid not before current time + this value (Format: + hours=-1;minutes=-2;seconds=-3).' + assertion_valid_not_on_or_after: + type: string + minLength: 1 + description: 'Assertion not valid on or after current time + this value + (Format: hours=1;minutes=2;seconds=3).' + session_valid_not_on_or_after: + type: string + minLength: 1 + description: 'Session not valid on or after current time + this value (Format: + hours=1;minutes=2;seconds=3).' + name_id_mapping: + type: string + format: uuid + nullable: true + title: NameID Property Mapping + description: Configure how the NameID value will be created. When left empty, + the NameIDPolicy of the incoming request will be considered + authn_context_class_ref_mapping: + type: string + format: uuid + nullable: true + title: AuthnContextClassRef Property Mapping + description: Configure how the AuthnContextClassRef value will be created. + When left empty, the AuthnContextClassRef will be set based on which authentication + methods the user used to authenticate. + saml_version: + allOf: + - $ref: '#/components/schemas/SamlVersionEnum' + description: SAML assertion version to issue in the security token. Microsoft + Entra ID and classic ADFS-style relying parties typically require SAML + 1.1. + digest_algorithm: + $ref: '#/components/schemas/DigestAlgorithmEnum' + signature_algorithm: + $ref: '#/components/schemas/SignatureAlgorithmEnum' + signing_kp: + type: string + format: uuid + nullable: true + title: Signing Keypair + description: Keypair used to sign outgoing Responses going to the Service + Provider. + encryption_kp: + type: string + format: uuid + nullable: true + title: Encryption Keypair + description: When selected, incoming assertions are encrypted by the IdP + using the public key of the encryption keypair. The assertion is decrypted + by the SP using the the private key. + sign_assertion: + type: boolean + sign_logout_request: + type: boolean + default_name_id_policy: + $ref: '#/components/schemas/SAMLNameIDPolicyEnum' + required: + - authorization_flow + - invalidation_flow + - name + - reply_url + - wtrealm + WebAuthnDevice: + type: object + description: Serializer for WebAuthn authenticator devices + properties: + pk: + type: integer + readOnly: true + title: ID + name: + type: string + maxLength: 200 + created_on: + type: string + format: date-time + readOnly: true + device_type: + allOf: + - $ref: '#/components/schemas/WebAuthnDeviceType' + readOnly: true + nullable: true + aaguid: + type: string + readOnly: true + user: + allOf: + - $ref: '#/components/schemas/PartialUser' + readOnly: true + required: + - aaguid + - created_on + - device_type + - name + - pk + - user + WebAuthnDeviceRequest: + type: object + description: Serializer for WebAuthn authenticator devices + properties: + name: + type: string + minLength: 1 + maxLength: 200 + required: + - name + WebAuthnDeviceType: + type: object + description: WebAuthnDeviceType Serializer + properties: + aaguid: + type: string + format: uuid + description: + type: string + required: + - aaguid + - description + WebAuthnHintEnum: + enum: + - security-key + - client-device + - hybrid + type: string + Worker: + type: object + properties: + worker_id: + type: string + version: + type: string + version_matching: + type: boolean + required: + - version + - version_matching + - worker_id + modelRequest: + oneOf: + - $ref: '#/components/schemas/GoogleWorkspaceProviderRequest' + - $ref: '#/components/schemas/LDAPProviderRequest' + - $ref: '#/components/schemas/MicrosoftEntraProviderRequest' + - $ref: '#/components/schemas/OAuth2ProviderRequest' + - $ref: '#/components/schemas/ProxyProviderRequest' + - $ref: '#/components/schemas/RACProviderRequest' + - $ref: '#/components/schemas/RadiusProviderRequest' + - $ref: '#/components/schemas/SAMLProviderRequest' + - $ref: '#/components/schemas/SCIMProviderRequest' + - $ref: '#/components/schemas/SSFProviderRequest' + - $ref: '#/components/schemas/WSFederationProviderRequest' + discriminator: + propertyName: provider_model + mapping: + authentik_providers_google_workspace.googleworkspaceprovider: '#/components/schemas/GoogleWorkspaceProviderRequest' + authentik_providers_ldap.ldapprovider: '#/components/schemas/LDAPProviderRequest' + authentik_providers_microsoft_entra.microsoftentraprovider: '#/components/schemas/MicrosoftEntraProviderRequest' + authentik_providers_oauth2.oauth2provider: '#/components/schemas/OAuth2ProviderRequest' + authentik_providers_proxy.proxyprovider: '#/components/schemas/ProxyProviderRequest' + authentik_providers_rac.racprovider: '#/components/schemas/RACProviderRequest' + authentik_providers_radius.radiusprovider: '#/components/schemas/RadiusProviderRequest' + authentik_providers_saml.samlprovider: '#/components/schemas/SAMLProviderRequest' + authentik_providers_scim.scimprovider: '#/components/schemas/SCIMProviderRequest' + authentik_providers_ssf.ssfprovider: '#/components/schemas/SSFProviderRequest' + authentik_providers_ws_federation.wsfederationprovider: '#/components/schemas/WSFederationProviderRequest' + securitySchemes: + authentik: + type: http + scheme: bearer + authentik_device_auth: + type: http + scheme: bearer+agent + authentik_device_enroll: + type: http + scheme: bearer + authentik_device_federation: + type: http + scheme: bearer +servers: +- url: /api/v3 diff --git a/src/test/resources/blueprints/kof22-identity-bootstrap.yaml b/src/test/resources/blueprints/kof22-identity-bootstrap.yaml new file mode 100644 index 0000000..253e6b5 --- /dev/null +++ b/src/test/resources/blueprints/kof22-identity-bootstrap.yaml @@ -0,0 +1,107 @@ +# Test fixture: the kof22 identity bootstrap blueprint (DESIGN.md section 4.3), +# in the shape proposed for cluster-gitops. Identity objects are +# `state: created`: created when missing, never updated, never given members. +version: 1 +metadata: + name: kof22-identity-bootstrap + labels: + blueprints.goauthentik.io/instantiate: "true" +entries: + # Apply the infrastructure blueprint first (it owns the recovery email stage + # referenced below). On an empty instance this is what makes the bootstrap + # apply cleanly (contract test h). + - model: authentik_blueprints.metaapplyblueprint + attrs: + identifiers: + name: kof22-oauth2-apps + required: true + + # The role the qbit service account runs as. It is the qbit's own + # infrastructure, not identity data, so it is `present`: attrs carry ONLY + # `permissions` (global permissions; a blueprint-only RoleSerializer field), + # which are assigned additively on every apply, so a permission removed in + # the UI comes back within the hour and nothing granted elsewhere is taken + # away. No users, no groups. Phase 0/1 = read-only; later phases append here. + # Note: matching is by codename, so view_group also grants Django's unused + # auth.view_group (harmless). + - model: authentik_rbac.role + state: present + id: qqq-role + identifiers: + name: qqq-kof22-admin-idadmin + attrs: + permissions: + - authentik_core.view_user + - authentik_core.view_group + - authentik_core.view_application + - authentik_core.view_authenticatedsession + - authentik_rbac.view_role + - authentik_policies.view_policybinding + - authentik_events.view_event + - authentik_events.add_event + - authentik_blueprints.view_blueprintinstance + + # The qbit service account. Its API token is minted once by hand (never here). + - model: authentik_core.user + state: created + id: qqq-sa + identifiers: + username: qqq-kof22-admin-idadmin + attrs: + name: QQQ kof22 Admin identity service + type: service_account + path: service-accounts/qqq + roles: + - !KeyOf qqq-role + attributes: + qqq.io/protected: true + + # Object permission on a stage the infrastructure blueprint owns: the bare + # `created` entry is skipped (the stage exists), but its permissions are + # still applied, additively, on every run. + - model: authentik_stages_email.emailstage + state: created + identifiers: + name: kof22-recovery-email + permissions: + - role: !KeyOf qqq-role + permission: authentik_stages_email.view_emailstage + + # Seed groups: created once, then plain data. No users, no member lists. + - model: authentik_core.group + state: created + identifiers: + name: identity-admins + attrs: + attributes: + qqq.io/permissions: ["identity.*"] + qqq.io/app-access: ["kof22-website-prod"] + - model: authentik_core.group + state: created + identifiers: + name: kof22-admins + - model: authentik_core.group + state: created + identifiers: + name: kof-website-publishers + # No qqq.io/app-access yet: drafters sign in to the admin only once the owner + # decides to set that one attribute (DESIGN.md section 11.2 item 6). + - model: authentik_core.group + state: created + identifiers: + name: kof-website-drafters + + # Break-glass admin: a superuser the qbit cannot touch. Password set once by + # hand (1Password); recovery through `ak create_recovery_key`. + - model: authentik_core.user + state: created + identifiers: + username: kof22-breakglass + attrs: + name: Break-glass admin + type: internal + path: users/breakglass + groups: + - !Find [authentik_core.group, [name, "authentik Admins"]] + attributes: + qqq.io/protected: true diff --git a/src/test/resources/blueprints/kof22-oauth2-apps.yaml b/src/test/resources/blueprints/kof22-oauth2-apps.yaml new file mode 100644 index 0000000..9464a3b --- /dev/null +++ b/src/test/resources/blueprints/kof22-oauth2-apps.yaml @@ -0,0 +1,372 @@ +# Test fixture: an infrastructure blueprint shaped like kof22's production +# kof22-oauth2-apps.yaml (cluster-gitops tenants/kof22/website-authentik), +# trimmed to what the contract tests need. Branding and the authorization +# flow's consent stage are left out. The provider secret comes from !Env, as in +# production; the test container sets KOF22_OAUTH2_CLIENT_SECRET to a dummy. +# +# This is the AFTER-migration shape (DESIGN.md section 4.4): the present +# james.maes user and kof22-admins group entries have been removed, and the +# sign-in policy is attribute-driven with the group-name fallback. +version: 1 +metadata: + name: kof22-oauth2-apps + labels: + blueprints.goauthentik.io/instantiate: "true" +entries: + - model: authentik_flows.flow + id: kof22-recovery-flow + state: present + identifiers: + slug: kof22-recovery + attrs: + name: "Kof22 Recovery" + title: "Reset your password" + designation: recovery + authentication: require_unauthenticated + + - model: authentik_stages_identification.identificationstage + id: kof22-recovery-identification-stage + state: present + identifiers: + name: kof22-recovery-identification + attrs: + user_fields: [username, email] + pretend_user_exists: true + show_matched_user: false + + - model: authentik_stages_email.emailstage + id: kof22-recovery-email-stage + state: present + identifiers: + name: kof22-recovery-email + attrs: + use_global_settings: true + template: email/password_reset.html + subject: "Kof Twenty Two: reset your password" + token_expiry: minutes=30 + activate_user_on_success: true + + - model: authentik_flows.flowstagebinding + state: present + identifiers: + target: !KeyOf kof22-recovery-flow + stage: !KeyOf kof22-recovery-identification-stage + order: 10 + attrs: + target: !KeyOf kof22-recovery-flow + stage: !KeyOf kof22-recovery-identification-stage + order: 10 + + - model: authentik_flows.flowstagebinding + state: present + identifiers: + target: !KeyOf kof22-recovery-flow + stage: !KeyOf kof22-recovery-email-stage + order: 20 + attrs: + target: !KeyOf kof22-recovery-flow + stage: !KeyOf kof22-recovery-email-stage + order: 20 + + - model: authentik_flows.flow + id: kof22-authorization-flow + state: present + identifiers: + slug: kof22-authorization + attrs: + name: "Kof22 Authorization" + title: "Authorize Kof Twenty Two" + designation: authorization + authentication: require_authenticated + + - model: authentik_flows.flow + id: kof22-invalidation-prod-flow + state: present + identifiers: + slug: kof22-invalidation-prod + attrs: + name: "Kof22 Invalidation (Production)" + title: "Signing out..." + designation: invalidation + authentication: none + + - model: authentik_providers_oauth2.oauth2provider + state: present + identifiers: + name: kof22-website-prod + attrs: + name: kof22-website-prod + authorization_flow: !KeyOf kof22-authorization-flow + invalidation_flow: !KeyOf kof22-invalidation-prod-flow + client_type: confidential + client_id: kof22-website-prod + client_secret: !Env KOF22_OAUTH2_CLIENT_SECRET + redirect_uris: + - matching_mode: strict + url: "https://admin.kof22.test/token" + sub_mode: user_email + issuer_mode: per_provider + + - model: authentik_core.application + state: present + identifiers: + slug: kof22-website-prod + attrs: + name: "Kof22 Website (Production)" + slug: kof22-website-prod + provider: !Find [authentik_providers_oauth2.oauth2provider, [name, kof22-website-prod]] + policy_engine_mode: any + + - model: authentik_policies_expression.expressionpolicy + id: kof22-require-admins-policy + state: present + identifiers: + name: kof22-require-admins-group + attrs: + name: kof22-require-admins-group + # Attribute-driven app access (DESIGN.md section 4.4): any group of the + # user, including inherited parents, whose qqq.io/app-access lists this + # app. A plain string is treated as a list of one (never a substring). + expression: | + appkey = "kof22-website-prod" + for group in request.user.all_groups(): + access = (group.attributes or {}).get("qqq.io/app-access", []) + if isinstance(access, str): + access = [access] + if isinstance(access, list) and appkey in access: + return True + # Transition fallback (DESIGN.md section 4.4 step 2); remove after the backend cut-over. + return ak_is_group_member(request.user, name__in=["kof22-admins", "kof-website-publishers"]) + + - model: authentik_policies.policybinding + state: present + identifiers: + target: !Find [authentik_core.application, [slug, kof22-website-prod]] + policy: !KeyOf kof22-require-admins-policy + order: 0 + attrs: + target: !Find [authentik_core.application, [slug, kof22-website-prod]] + policy: !KeyOf kof22-require-admins-policy + order: 0 + enabled: true + negate: false + timeout: 30 + failure_result: false + + # ===== qbit-authentik webhook plumbing (DESIGN.md section 7.1) ===== + # Infrastructure, `present`. INERT until phase 2: the rule has no destination + # (destination_event_user false, no destination_group), so Authentik creates + # no notifications and sends nothing. Phase 2 flips destination_event_user to + # true once the QQQ receiver (/qqq/v1/authentik/webhook) exists. + + - model: authentik_events.notificationwebhookmapping + id: qqq-kof22-admin-webhook-body + state: present + identifiers: + name: qqq-kof22-admin-webhook-body + attrs: + name: qqq-kof22-admin-webhook-body + expression: | + event = notification.event + if event is None: + return {"eventPk": None, "action": None} + return { + "eventPk": str(event.pk), + "action": event.action, + "created": event.created.isoformat(), + "username": (event.user or {}).get("username"), + "model": (event.context or {}).get("model"), + "app": event.app, + } + + - model: authentik_events.notificationwebhookmapping + id: qqq-kof22-admin-webhook-headers + state: present + identifiers: + name: qqq-kof22-admin-webhook-headers + attrs: + name: qqq-kof22-admin-webhook-headers + # Shared secret from the worker environment (Infisical, never in git). + expression: | + import os + return {"X-QQQ-Webhook-Secret": os.environ.get("QQQ_KOF22_ADMIN_WEBHOOK_SECRET", "")} + + - model: authentik_events.notificationtransport + id: qqq-kof22-admin-transport + state: present + identifiers: + name: qqq-kof22-admin + attrs: + name: qqq-kof22-admin + mode: webhook + webhook_url: "https://admin.kof22.com/qqq/v1/authentik/webhook" + webhook_mapping_body: !KeyOf qqq-kof22-admin-webhook-body + webhook_mapping_headers: !KeyOf qqq-kof22-admin-webhook-headers + send_once: true + + - model: authentik_events.notificationrule + id: qqq-kof22-admin-rule + state: present + identifiers: + name: qqq-kof22-admin-sync + attrs: + name: qqq-kof22-admin-sync + severity: notice + transports: + - !KeyOf qqq-kof22-admin-transport + destination_event_user: false + + - model: authentik_policies_event_matcher.eventmatcherpolicy + id: qqq-sync-user-created + state: present + identifiers: { name: qqq-kof22-admin-sync-user-created } + attrs: { action: model_created, model: authentik_core.user } + - model: authentik_policies_event_matcher.eventmatcherpolicy + id: qqq-sync-user-updated + state: present + identifiers: { name: qqq-kof22-admin-sync-user-updated } + attrs: { action: model_updated, model: authentik_core.user } + - model: authentik_policies_event_matcher.eventmatcherpolicy + id: qqq-sync-user-deleted + state: present + identifiers: { name: qqq-kof22-admin-sync-user-deleted } + attrs: { action: model_deleted, model: authentik_core.user } + - model: authentik_policies_event_matcher.eventmatcherpolicy + id: qqq-sync-group-created + state: present + identifiers: { name: qqq-kof22-admin-sync-group-created } + attrs: { action: model_created, model: authentik_core.group } + - model: authentik_policies_event_matcher.eventmatcherpolicy + id: qqq-sync-group-updated + state: present + identifiers: { name: qqq-kof22-admin-sync-group-updated } + attrs: { action: model_updated, model: authentik_core.group } + - model: authentik_policies_event_matcher.eventmatcherpolicy + id: qqq-sync-group-deleted + state: present + identifiers: { name: qqq-kof22-admin-sync-group-deleted } + attrs: { action: model_deleted, model: authentik_core.group } + - model: authentik_policies_event_matcher.eventmatcherpolicy + id: qqq-sync-login + state: present + identifiers: { name: qqq-kof22-admin-sync-login } + attrs: { action: login } + - model: authentik_policies_event_matcher.eventmatcherpolicy + id: qqq-sync-login-failed + state: present + identifiers: { name: qqq-kof22-admin-sync-login-failed } + attrs: { action: login_failed } + - model: authentik_policies_event_matcher.eventmatcherpolicy + id: qqq-sync-password-set + state: present + identifiers: { name: qqq-kof22-admin-sync-password-set } + attrs: { action: password_set } + - model: authentik_policies_event_matcher.eventmatcherpolicy + id: qqq-sync-invitation-used + state: present + identifiers: { name: qqq-kof22-admin-sync-invitation-used } + attrs: { action: invitation_used } + - model: authentik_policies_event_matcher.eventmatcherpolicy + id: qqq-sync-user-write + state: present + identifiers: { name: qqq-kof22-admin-sync-user-write } + attrs: { action: user_write } + - model: authentik_policies.policybinding + state: present + identifiers: + target: !KeyOf qqq-kof22-admin-rule + policy: !KeyOf qqq-sync-user-created + attrs: + target: !KeyOf qqq-kof22-admin-rule + policy: !KeyOf qqq-sync-user-created + order: 0 + - model: authentik_policies.policybinding + state: present + identifiers: + target: !KeyOf qqq-kof22-admin-rule + policy: !KeyOf qqq-sync-user-updated + attrs: + target: !KeyOf qqq-kof22-admin-rule + policy: !KeyOf qqq-sync-user-updated + order: 1 + - model: authentik_policies.policybinding + state: present + identifiers: + target: !KeyOf qqq-kof22-admin-rule + policy: !KeyOf qqq-sync-user-deleted + attrs: + target: !KeyOf qqq-kof22-admin-rule + policy: !KeyOf qqq-sync-user-deleted + order: 2 + - model: authentik_policies.policybinding + state: present + identifiers: + target: !KeyOf qqq-kof22-admin-rule + policy: !KeyOf qqq-sync-group-created + attrs: + target: !KeyOf qqq-kof22-admin-rule + policy: !KeyOf qqq-sync-group-created + order: 3 + - model: authentik_policies.policybinding + state: present + identifiers: + target: !KeyOf qqq-kof22-admin-rule + policy: !KeyOf qqq-sync-group-updated + attrs: + target: !KeyOf qqq-kof22-admin-rule + policy: !KeyOf qqq-sync-group-updated + order: 4 + - model: authentik_policies.policybinding + state: present + identifiers: + target: !KeyOf qqq-kof22-admin-rule + policy: !KeyOf qqq-sync-group-deleted + attrs: + target: !KeyOf qqq-kof22-admin-rule + policy: !KeyOf qqq-sync-group-deleted + order: 5 + - model: authentik_policies.policybinding + state: present + identifiers: + target: !KeyOf qqq-kof22-admin-rule + policy: !KeyOf qqq-sync-login + attrs: + target: !KeyOf qqq-kof22-admin-rule + policy: !KeyOf qqq-sync-login + order: 6 + - model: authentik_policies.policybinding + state: present + identifiers: + target: !KeyOf qqq-kof22-admin-rule + policy: !KeyOf qqq-sync-login-failed + attrs: + target: !KeyOf qqq-kof22-admin-rule + policy: !KeyOf qqq-sync-login-failed + order: 7 + - model: authentik_policies.policybinding + state: present + identifiers: + target: !KeyOf qqq-kof22-admin-rule + policy: !KeyOf qqq-sync-password-set + attrs: + target: !KeyOf qqq-kof22-admin-rule + policy: !KeyOf qqq-sync-password-set + order: 8 + - model: authentik_policies.policybinding + state: present + identifiers: + target: !KeyOf qqq-kof22-admin-rule + policy: !KeyOf qqq-sync-invitation-used + attrs: + target: !KeyOf qqq-kof22-admin-rule + policy: !KeyOf qqq-sync-invitation-used + order: 9 + - model: authentik_policies.policybinding + state: present + identifiers: + target: !KeyOf qqq-kof22-admin-rule + policy: !KeyOf qqq-sync-user-write + attrs: + target: !KeyOf qqq-kof22-admin-rule + policy: !KeyOf qqq-sync-user-write + order: 10 diff --git a/src/test/resources/fixtures/2026.8.3/admin-version.json b/src/test/resources/fixtures/2026.8.3/admin-version.json new file mode 100644 index 0000000..022b6a6 --- /dev/null +++ b/src/test/resources/fixtures/2026.8.3/admin-version.json @@ -0,0 +1,8 @@ +{ + "version_current": "2026.8.3", + "outdated": false, + "version_latest_valid": false, + "version_latest": "0.0.0", + "outpost_outdated": false, + "build_hash": "" +} diff --git a/src/test/resources/fixtures/2026.8.3/error-400-bad-filter.json b/src/test/resources/fixtures/2026.8.3/error-400-bad-filter.json new file mode 100644 index 0000000..58d301d --- /dev/null +++ b/src/test/resources/fixtures/2026.8.3/error-400-bad-filter.json @@ -0,0 +1 @@ +{"last_login__lt": ["Enter a valid date/time."]} diff --git a/src/test/resources/fixtures/2026.8.3/error-403.json b/src/test/resources/fixtures/2026.8.3/error-403.json new file mode 100644 index 0000000..493d137 --- /dev/null +++ b/src/test/resources/fixtures/2026.8.3/error-403.json @@ -0,0 +1 @@ +{"detail": "You do not have permission to perform this action."} diff --git a/src/test/resources/fixtures/2026.8.3/groups-list.json b/src/test/resources/fixtures/2026.8.3/groups-list.json new file mode 100644 index 0000000..066c672 --- /dev/null +++ b/src/test/resources/fixtures/2026.8.3/groups-list.json @@ -0,0 +1,54 @@ +{ + "pagination": { + "next": 0, + "current": 1, + "previous": 0, + "start_index": 1, + "count": 1, + "end_index": 1, + "total_pages": 1 + }, + "autocomplete": { + "models": { + "authentik_core.group": { + "is_superuser": { + "nullable": true, + "options": null, + "type": "bool" + }, + "name": { + "nullable": false, + "options": null, + "type": "str" + }, + "attributes": { + "nullable": false, + "options": null, + "type": "relation", + "relation": "authentik_core.group_attributes" + } + }, + "authentik_core.group_attributes": {} + }, + "current_model": "authentik_core.group" + }, + "results": [{ + "inherited_roles_obj": null, + "roles_obj": [], + "is_superuser": false, + "roles": [], + "num_pk": 97374, + "users_obj": null, + "users": [], + "parents_obj": [], + "children": [], + "name": "identity-admins", + "attributes": { + "qqq.io/app-access": ["kof22-website-prod"], + "qqq.io/permissions": ["identity.*"] + }, + "pk": "4941bc80-3f27-446f-b4d3-ba023f044b65", + "children_obj": [], + "parents": [] + }] +} diff --git a/src/test/resources/fixtures/2026.8.3/user-get.json b/src/test/resources/fixtures/2026.8.3/user-get.json new file mode 100644 index 0000000..181be83 --- /dev/null +++ b/src/test/resources/fixtures/2026.8.3/user-get.json @@ -0,0 +1,22 @@ +{ + "roles_obj": [], + "last_updated": "2026-10-12T00:42:44.589851Z", + "is_active": true, + "is_superuser": false, + "last_login": null, + "password_change_date": "2026-10-12T00:42:44.548432Z", + "roles": [], + "groups": [], + "avatar": "", + "type": "internal", + "groups_obj": [], + "uuid": "b99e966f-61bb-4f9f-b136-b747d5fb68f7", + "uid": "77947ea5357373462f042427a96e83bb14ea799dfae76daf6a014d01fc4580ce", + "path": "users", + "name": "Read Probe 2", + "attributes": {}, + "pk": 17, + "date_joined": "2026-10-12T00:42:44.548001Z", + "email": "read.probe2@example.test", + "username": "read.probe2" +} diff --git a/src/test/resources/fixtures/2026.8.3/users-list.json b/src/test/resources/fixtures/2026.8.3/users-list.json new file mode 100644 index 0000000..6be3b65 --- /dev/null +++ b/src/test/resources/fixtures/2026.8.3/users-list.json @@ -0,0 +1,380 @@ +{ + "pagination": { + "next": 0, + "current": 1, + "previous": 0, + "start_index": 1, + "count": 12, + "end_index": 12, + "total_pages": 1 + }, + "autocomplete": { + "models": { + "authentik_core.user_attributes": {}, + "authentik_core.user": { + "path": { + "nullable": false, + "options": null, + "type": "str" + }, + "is_active": { + "nullable": true, + "options": null, + "type": "bool" + }, + "name": { + "nullable": false, + "options": null, + "type": "str" + }, + "attributes": { + "nullable": false, + "options": null, + "type": "relation", + "relation": "authentik_core.user_attributes" + }, + "type": { + "nullable": false, + "options": [ + "internal", + "external", + "service_account", + "internal_service_account" + ], + "type": "str" + }, + "email": { + "nullable": false, + "options": null, + "type": "str" + }, + "username": { + "nullable": false, + "options": null, + "type": "str" + } + } + }, + "current_model": "authentik_core.user" + }, + "results": [ + { + "roles_obj": [], + "last_updated": "2026-10-12T00:42:38.179289Z", + "is_active": true, + "is_superuser": false, + "last_login": null, + "password_change_date": "2026-10-12T00:42:38.131278Z", + "roles": [], + "groups": ["c7bb0c43-3b6d-47e1-8812-c3fbf41fe6bd"], + "avatar": "", + "type": "internal", + "groups_obj": [{ + "is_superuser": false, + "name": "kof-website-publishers", + "attributes": {}, + "pk": "c7bb0c43-3b6d-47e1-8812-c3fbf41fe6bd", + "num_pk": 26548 + }], + "uuid": "6656101d-7d44-4b7f-aeb5-257b13a4447f", + "uid": "41758f45cd5b97f58994f51764097ce15a3b6daaad23a2aaadc3a47325370edb", + "path": "users", + "name": "Access Publisher", + "attributes": {}, + "pk": 14, + "date_joined": "2026-10-12T00:42:38.130713Z", + "email": "", + "username": "access.publisher" + }, + { + "roles_obj": [], + "last_updated": "2026-10-12T00:41:39.098819Z", + "is_active": true, + "is_superuser": true, + "last_login": null, + "password_change_date": "2026-10-12T00:41:38.964003Z", + "roles": [], + "groups": [ + "99da4fa1-41b7-41ed-9a09-536682c4589b", + "6b62508d-14e8-4cf6-9783-682d7c94af12" + ], + "avatar": "", + "type": "internal", + "groups_obj": [ + { + "is_superuser": true, + "name": "authentik Admins", + "attributes": {}, + "pk": "99da4fa1-41b7-41ed-9a09-536682c4589b", + "num_pk": 20450 + }, + { + "is_superuser": false, + "name": "lint-demo-group", + "attributes": {"note": "declared in git"}, + "pk": "6b62508d-14e8-4cf6-9783-682d7c94af12", + "num_pk": 14273 + } + ], + "uuid": "96235ac9-286c-4a6a-ae21-4df0dab33315", + "uid": "dee4b27045f6d9ad52b880c654fbdafc4c3ce86c45d3f045e5a638ea3c4b0065", + "path": "users", + "name": "authentik Default Admin", + "attributes": {}, + "pk": 4, + "date_joined": "2026-10-12T00:41:38.934836Z", + "email": "akadmin@example.test", + "username": "akadmin" + }, + { + "roles_obj": [], + "last_updated": "2026-10-12T00:42:40.507175Z", + "is_active": true, + "is_superuser": false, + "last_login": null, + "password_change_date": "2026-10-12T00:42:40.455393Z", + "roles": [], + "groups": [], + "avatar": "", + "type": "internal", + "groups_obj": [], + "uuid": "e933b7a1-db0d-4d7f-af92-ebca960e04ce", + "uid": "5f82699a0cd33c6c02a73fcd8cc3a995302a22e28881733fa3dca7ef2dfff0ac", + "path": "users", + "name": "Floor Probe", + "attributes": {}, + "pk": 15, + "date_joined": "2026-10-12T00:42:40.454755Z", + "email": "", + "username": "floor.probe" + }, + { + "roles_obj": [], + "last_updated": "2026-10-12T00:42:41.985973Z", + "is_active": true, + "is_superuser": true, + "last_login": null, + "password_change_date": "2026-10-12T00:41:47.932445Z", + "roles": [], + "groups": ["99da4fa1-41b7-41ed-9a09-536682c4589b"], + "avatar": "", + "type": "internal", + "groups_obj": [{ + "is_superuser": true, + "name": "authentik Admins", + "attributes": {}, + "pk": "99da4fa1-41b7-41ed-9a09-536682c4589b", + "num_pk": 20450 + }], + "uuid": "f72814ed-7574-4d20-bbcb-56545e39adab", + "uid": "67d171fe0aa7735f081344377ef53325b135026db1544efcb8e1a3c7d236cdf2", + "path": "users/breakglass", + "name": "Break-glass admin", + "attributes": {"qqq.io/protected": true}, + "pk": 8, + "date_joined": "2026-10-12T00:41:47.930197Z", + "email": "", + "username": "kof22-breakglass" + }, + { + "roles_obj": [], + "last_updated": "2026-10-12T00:42:19.183065Z", + "is_active": true, + "is_superuser": false, + "last_login": null, + "password_change_date": "2026-10-12T00:42:19.139382Z", + "roles": [], + "groups": [], + "avatar": "", + "type": "internal", + "groups_obj": [], + "uuid": "1cca8899-bf67-4acb-8231-b82f48b61549", + "uid": "84030aa88ef5db17880ead3e60f4830246bdf0a7e40c71599a047ddf3cbac5ea", + "path": "users", + "name": "Added Via API", + "attributes": {}, + "pk": 12, + "date_joined": "2026-10-12T00:42:19.138961Z", + "email": "", + "username": "lint.added" + }, + { + "roles_obj": [], + "last_updated": "2026-10-12T00:42:20.680396Z", + "is_active": true, + "is_superuser": false, + "last_login": null, + "password_change_date": "2026-10-12T00:42:18.514303Z", + "roles": [], + "groups": ["6b62508d-14e8-4cf6-9783-682d7c94af12"], + "avatar": "", + "type": "internal", + "groups_obj": [{ + "is_superuser": false, + "name": "lint-demo-group", + "attributes": {"note": "declared in git"}, + "pk": "6b62508d-14e8-4cf6-9783-682d7c94af12", + "num_pk": 14273 + }], + "uuid": "db22814d-9610-429b-ab01-9ca7fdd6a3dd", + "uid": "bb030a055fdd722735c72012ae24e9142e3626875be2ed6e82994079674b009f", + "path": "users", + "name": "Lint Demo User", + "attributes": {}, + "pk": 11, + "date_joined": "2026-10-12T00:42:18.512951Z", + "email": "", + "username": "lint.demo.user" + }, + { + "roles_obj": [ + { + "name": "qqq-kof22-admin-idadmin", + "pk": "2de63138-3566-48e7-9cf2-913a70b2c06f" + }, + { + "name": "ak-managed-role--user-7", + "pk": "ea22584a-d801-4ebc-aa2f-6cbb1f0ba9f7" + } + ], + "last_updated": "2026-10-12T00:41:47.841974Z", + "is_active": true, + "is_superuser": false, + "last_login": null, + "password_change_date": "2026-10-12T00:41:47.831570Z", + "roles": [ + "2de63138-3566-48e7-9cf2-913a70b2c06f", + "ea22584a-d801-4ebc-aa2f-6cbb1f0ba9f7" + ], + "groups": [], + "avatar": "", + "type": "service_account", + "groups_obj": [], + "uuid": "63ac79e2-ce5c-46d1-9209-8210ad2b4b9e", + "uid": "f15497ad81cf34b68a067048a07bf0ca199d9d1b8a4afa24c26b8d7211bac66d", + "path": "service-accounts/qqq", + "name": "QQQ kof22 Admin identity service", + "attributes": {"qqq.io/protected": true}, + "pk": 7, + "date_joined": "2026-10-12T00:41:47.829884Z", + "email": "", + "username": "qqq-kof22-admin-idadmin" + }, + { + "roles_obj": [], + "last_updated": "2026-10-12T00:42:44.388384Z", + "is_active": true, + "is_superuser": false, + "last_login": null, + "password_change_date": "2026-10-12T00:42:44.335235Z", + "roles": [], + "groups": ["c7bb0c43-3b6d-47e1-8812-c3fbf41fe6bd"], + "avatar": "", + "type": "internal", + "groups_obj": [{ + "is_superuser": false, + "name": "kof-website-publishers", + "attributes": {}, + "pk": "c7bb0c43-3b6d-47e1-8812-c3fbf41fe6bd", + "num_pk": 26548 + }], + "uuid": "7f8691f0-1ec0-42da-a24f-cb71bcb64c17", + "uid": "07df95d4db5f9cd781eac774b3b8129b7bf9ee3106a4c9a2f830d5fbdb85c583", + "path": "users", + "name": "Read Probe 1", + "attributes": {}, + "pk": 16, + "date_joined": "2026-10-12T00:42:44.334765Z", + "email": "read.probe1@example.test", + "username": "read.probe1" + }, + { + "roles_obj": [], + "last_updated": "2026-10-12T00:42:44.589851Z", + "is_active": true, + "is_superuser": false, + "last_login": null, + "password_change_date": "2026-10-12T00:42:44.548432Z", + "roles": [], + "groups": [], + "avatar": "", + "type": "internal", + "groups_obj": [], + "uuid": "b99e966f-61bb-4f9f-b136-b747d5fb68f7", + "uid": "77947ea5357373462f042427a96e83bb14ea799dfae76daf6a014d01fc4580ce", + "path": "users", + "name": "Read Probe 2", + "attributes": {}, + "pk": 17, + "date_joined": "2026-10-12T00:42:44.548001Z", + "email": "read.probe2@example.test", + "username": "read.probe2" + }, + { + "roles_obj": [], + "last_updated": "2026-10-12T00:42:44.790626Z", + "is_active": true, + "is_superuser": false, + "last_login": null, + "password_change_date": "2026-10-12T00:42:44.740536Z", + "roles": [], + "groups": [], + "avatar": "", + "type": "internal", + "groups_obj": [], + "uuid": "9cb596e1-ac25-4c9c-aa49-e9a66e07a5fd", + "uid": "961c6ec5f4e73114ab10c834f18cf279fb6a61b53144302674144c73f7194932", + "path": "users", + "name": "Read Probe 3", + "attributes": {}, + "pk": 18, + "date_joined": "2026-10-12T00:42:44.740046Z", + "email": "read.probe3@example.test", + "username": "read.probe3" + }, + { + "roles_obj": [], + "last_updated": "2026-10-12T00:42:45.576270Z", + "is_active": false, + "is_superuser": false, + "last_login": null, + "password_change_date": "2026-10-12T00:42:44.997114Z", + "roles": [], + "groups": [], + "avatar": "", + "type": "internal", + "groups_obj": [], + "uuid": "9c523de5-9a37-4510-85d3-4cb23a8ba6df", + "uid": "41ae72db125e854553e33f6ca481dc2dc2194fe5b0154a44a2f3cd0482e281b9", + "path": "users", + "name": "Read Probe 4", + "attributes": {}, + "pk": 19, + "date_joined": "2026-10-12T00:42:44.996692Z", + "email": "read.probe4@example.test", + "username": "read.probe4" + }, + { + "roles_obj": [], + "last_updated": "2026-10-12T00:42:22.763043Z", + "is_active": true, + "is_superuser": false, + "last_login": null, + "password_change_date": "2026-10-12T00:42:22.714165Z", + "roles": [], + "groups": [], + "avatar": "", + "type": "internal", + "groups_obj": [], + "uuid": "b6ec0c40-5bff-4cb3-8434-7fe74c55c879", + "uid": "e3bf082dd81daa0f56be03530c403e048dce22e7a522e02594897674fdf3b51f", + "path": "users", + "name": "Reapply Member", + "attributes": {}, + "pk": 13, + "date_joined": "2026-10-12T00:42:22.713832Z", + "email": "", + "username": "reapply.member" + } + ] +} diff --git a/src/test/resources/junit-platform.properties b/src/test/resources/junit-platform.properties new file mode 100644 index 0000000..44d8900 --- /dev/null +++ b/src/test/resources/junit-platform.properties @@ -0,0 +1 @@ +junit.jupiter.testclass.order.default=org.junit.jupiter.api.ClassOrderer$OrderAnnotation diff --git a/src/test/resources/log4j2-test.xml b/src/test/resources/log4j2-test.xml new file mode 100644 index 0000000..f25638e --- /dev/null +++ b/src/test/resources/log4j2-test.xml @@ -0,0 +1,20 @@ + + + + + + + + + + + + + + + + + + + + -- 2.54.0 From 447d4b1e529a31bad7585680cb87da9df6c79cce Mon Sep 17 00:00:00 2001 From: James Maes Date: Mon, 12 Oct 2026 05:55:04 -0500 Subject: [PATCH 2/2] chore: drop committed Python bytecode and ignore it The lint script's __pycache__/*.pyc was committed by accident: it is generated output and an unreviewable binary (K22-REPO-05). Co-Authored-By: Claude Opus 5.5 --- .gitignore | 2 ++ .../lint-authentik-blueprints.cpython-314.pyc | Bin 16474 -> 0 bytes 2 files changed, 2 insertions(+) delete mode 100644 docs/cluster-gitops-phase0/scripts/__pycache__/lint-authentik-blueprints.cpython-314.pyc diff --git a/.gitignore b/.gitignore index a971850..fa20108 100644 --- a/.gitignore +++ b/.gitignore @@ -19,3 +19,5 @@ dependency-reduced-pom.xml /.env.local /.cache/ .claude/settings.local.json +__pycache__/ +*.py[cod] diff --git a/docs/cluster-gitops-phase0/scripts/__pycache__/lint-authentik-blueprints.cpython-314.pyc b/docs/cluster-gitops-phase0/scripts/__pycache__/lint-authentik-blueprints.cpython-314.pyc deleted file mode 100644 index f0114b733cd732af319c1feb9de026394438e5fd..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 16474 zcmch8dr(_fn&-XJ73c*LPus+X3;2O-5H==u4Do{)><}>E3zpjnL>7_&#X^$rmHbeW zYPK`AgS&escxQS;rcxWG*E=D*y*2LLsV#R+*N%6RsmWB$R>?*&^leY2tGcVU`me?9 zxYNn(AN%{x)x8oJ$JyE0Jrw7jd+vFB=R4o|o=1C1OY9ud=goir+B-Wq?w9nUr&6uJ zKm0E|$IWmOm*igMB)*q_(UdgRQQ6dMPMX(C5v+3ij&2XAX)aBlGeSP zv}>AA+VE_`(=HWDR@6JHxOz^qZQ>+*yGffZ>11^d)H%nBhiY_S^3Qg2u4SoIf>x!Q zxTrhn8Y>;D&$rP_l55PRk6g!%6|u41=vAiIw&$8A%cOGDSFq8_rAm~mSh+%~MtKt} zS4x{v-onaNQcbd2dPed{TczF7HffJkD>X|+Qj1h4c_mS5Z7oi2lIqdEfwkW(HKM$o zmA8!5NIRbU7RQB}Ic_UACJY_WAB^k*G*rjh-7 z_6DXb9M>O-CB?2(aw;54MlOis(Ns7gqfQZ(xEK)Sa7!SOh+Y+gftVNzUkb~pLY@>O zA?lI5Dux2dfY)v}#@MCgM-d~_iMX6(y;_vOrLZENSCWBbxI;|HVFe?c7m>*ke2B+H z8u_ZoCbTzA#Zz+hYO@%Kh4SAfBGIrIoC?Gy!yfI^bRc%MB^hs_rx-{kWkqaCDPdV@ z7ANI+Dxoyn69E~MphAvE!-_}5t0?sh^>-cb>24Nd@uWB%mM6m@uh^x7CDIULT-L^5 zFai|32kg_~>2Z9EMwDc;2)xPRi8uyS09h;vOr>I>IF=I*MS#TVKqxFmV$`kx%V&CN zC{&+5ecIl1aXgZ22^d?@-80;Ka=<$s5|wZ;8HvXfvCZ4oEVg^w7%tkq&vuHzIItE7 zCdFh}Ns3J&j|W>IrLa7)DI5q+iI*brXn=Z)5e19Fj)p^GKoJRn9fb0$9ay!Z1c1m6 zyC_QgMA3l3AH<5h3n#BuYkZCf0A&i-W(Fiu$uXW0; zCAVL|<+-j?{bDjO33~BPdd2#l*d-4maJD_2>$jbaX>5BQIkW?TXf%GA$cq(0h`q5y zD%m0SrEpMUVUVbJJRX~fOr8oPfcjWu0z^xM%8onn5Ajj}j0Y&h5Yc%2f`a39A&kRj z@FODQ;8ZwxAsoU12Hq3V01i<8I}x_x70(bwci6GqC}=)^tXhngiZ^jpJki_V;~$j# z-My06>jmjHis38RyM4rJjI*OWZJ3r8B^;e-VTX{NfJRYHX{UWW6^SNW0AetpgcZAo zR~>;Eu*D9gGJtm*tvndTR;DZRv}zo^uPWD7GU`_?Y$sGl0THPJ(O^*H^je-1nfyaY z5eVopF3Cekn_k_WG)sI^kW3IbW+reflCX(O7D*O}>at0+Z?Pp=cl&o{C39 z;B{bdbfUWS1C=KpB?Vpswo>00zB)M3EY_ch5WAKcJ$Zv9eR2|rBaqB^eYll@GDB#~5Fzm7&!r{AC3 zv9RB-x`7pMVNDAFQ7YJ4zTixjXC6>Cf1EuYqM8e0Wk$-a-uAE-RWsaKcg*;7R*dO5 zf+p3-eaH`dXp)`yu3Ff+@R(JB=#16LoA5!Qp?B`wDZ8na)$fnQB1r)0)PU697=Sd) z47XBI{eA07Rm~sTWrCRP3!W^|Q24h!>_B0L^KnC3{hHhf$nYgcR)wEBOir%Nj9ueZ zUX-ix=|f)Lj0fAPJcKgziadnc+dgXc3^G7iUj0tf^`^O+`F-;v@4x)+%kK_kTzfLs zJq%zr?tsTiOC?&zKz6@>Iv#?=qe1=ti>W{~_r>M+Pef!TiOmhi;`m(b_k$Mvet8R~ zl4%3fD!-p(PbBCkZXX#>;RvGv>9yK~gjm_8XS-2QT*&?<_cLMOk$|24t(CVlYi+4n z5dTKXZ72VbG_iuy_pE;Uk`{?jCaA6#bcL%w4pl);?;Q?IgtfB94g@)k$s*>G>nUrXtdX+qltFpt)~{?A)lv2={uStfSlK@a9ol-Re$CM> zLIp^Ke@NpIiEMOqB{Qk?Qc)|dtXOuSsah1(R^_@Hn2vh$OH=KD-LIr3CL&kl5^5>L z;-PTb#@Y>_$N={6G9g_%^NiNzGQ6|w5PhKK&TwCF#eCBP%I1%*(&LtyJ#HUjm26RK z4kN9Xt)~V%HN%bO_KV|urcr~$hXk}*mvqyBFhnVY)3lWiMzQu@nEOn+(w#7$I{Ab- ztc5+a@?&#U<>nxau1h|X1hea44ra_#0ays1>(csmql8wLB$JOP8KEbiS)ZR6@d!?} z5DJGADqoM&XOAe67|u;B7*++^D%Cy={u_{K$5c0zQgG{35IP5|Rh`4(i>WYLv+v~v z-*fe9S-x%>dVeG~$qt=IkUfA%rgJCnp^R}o+7WO)QDb|hP*e2@K~6FmN{lLG6lS>l z#btBb-xJ<wTDLuv*!=&e>^;Z$H#iGm`xZdOr%fHA$1D@(WfCEB zCuQ4^6-of`V9*Abahb6ONK;nTPfdwQX;NU%^*wXj=EoN*KdAZBng!?L3yaA=f8)b9 z7GoLL;f(dLhGt^a1K=_up6i&N3jSZ9X@RRBrbaZudM-%jvrO3u{3|58exLh=)Ad&0 zilg+cmsU#LZ}tCH;4MeAIjP}44_mZANeW+4&CpO8%5cUa!K7LQP%_t1NUP}mCU-iSkz7V0w%k@#Gfbk~cU(@Q!pJ!Ky?_+TN2 zmCQa4v?@GdEf&2$+7$WB$cx*wGv&}6850q>4ALf8O@*kSW$mZKOJFo$;WOL_cLKzB z8R(SDeLOoJOar>Y%~xI>dkz*h>a(vO=6R3fxZ-u%A|g)yvI|dnkU0axfQSSajFwu zi$`Lr1-9n2!e|g&xQo8BQ%y$%AIa;(h6fwYf$u1QSsp<%Mw%B9nW>o{Hdk# z-OJ^BGv#|1$7lNP_Y7u+UdfIHmV3tU_KeSVzukMS_fA#U;w#H7NA9#7$+jF@s_M!* zyRuUkGSSORQ&(nsR!S=7dgcz!H_V@T|J=Lh7A`MsYt3xkdy~Jp}d^ z&M0Amk-Es>d9v!#Y63H}FttVFWh6%BZe(A%$k+3V!MDbqdNzINrD(d}7uB<{8dQN6er_AD>rD9y?-?6_T!pQ5#G+`+i(K5{F6TUrVM=@K;{XVU4NBvTVl zV2~swdrW=XwG#0hPnB9sq6EPJc>pU&?_mN<^Yp@78-PnM=Le0$QOiOSs3spyIHX#b zFIg?lxpdQe*!wr_%zVCSGrZtw(de_@oh>#^!rOU1ec-&OQ+HPzF40_A^BVQ;`Jx(}*^Z>#&)8 zsql7^=Xv@`K?VR*=v_2C;pqd?eq#;f8fQLn<^~Ui;grN2=L=knaCT3`5!n#sLE4%1 zu1V&TOnaqv&G(GB2gL=ncoDWJH)4o@%==-}PPEsz^nAMhd?!U+nCFl@h)Nhirlc58 zB^78LA{=-gS6*9@Ny$(JlFX_t97`dBgOCF=9)aRSA{+}b&7LVFs;jrVXJDjvL9?Am$P zwex4r$`yCjJGSe#`CUuy1~PK1=ECm{FFWe*I_g)P)yvLpcbwbai!2uXh2vJw(%#-o z-<74>t668duTJgd&;XYpWc0fe)DQcy8SEkmKrtrq4O9BxJ%MnabT+$L__{Eo-** z*zL2Kp)=W@GiwH;ZlkQ*80+?`*3FZ3coxIi&cUpA@P6f{dCMQYl&$alw6b%y=Q9`3 zRIoYfhjN>e{cz0_4qVoqT1{6i6inJ4@BOiWQ0 z)+x%WkR(EeWdx7Flbv>N;=7?3+xf-^9I^!{#&|3S+1ulaG5N?EInMI%cYswh!bVZ0 zrHx$D^{{A1X+13E{bLZ2pF%*IMvL`t@b?)WI9<8ZMSf0zLYza`88)Zh6CNAGzbBcQ z5PyfM7X@Q)*h|orf+x=$k~L*R5()+PMk;Q54jfJNGo!S1I^ z<(wgH%Nf%4^o!>r;b=%~(wtrt`jiz!9Szp#(c)BEh#R8wxDj)t@KwH@_d`UJG#9%n zT!1S^wHZy}iGgJO%9_(dI?`6eC@I|Aq4JILx3JCuk4@f-r)nkNwjZ%i=0{&AnPh07 zT+Xvi?O<8bO63@3layVcjC4`veP?W6WBAp^f)s>x{Cd1pzKXW&{QMLJvj2Zox%r(_ z|LWAj_8)zFx$@|&m3Vp6jqYWa=dQ~`4B1if_Vd@CpD$W+)Gc&o9p1m_xHa`x(Vs*= zIk0p@%8q<%dH=b)`_HY^?p(O^X{~p;w*5|R`@Px&*X?uW`xV>f!#9SPD?Hf>&*E#h zdhU6-WoGEX}IvXCAaaG6oFPQ`5J1;aG@8JL1BT(MP^3GP2KWcR#|Gzfj zRSN>}Q_5F1X1c@8IL1tQnIz{^xzu-QS9J5eg3NbhbCFegEDW-@JpV*nmWV?z{<#3T z9B?uNp7(J$ng5e`4$S$&lT+x8%MGxRL7ew+>0BuUXC{o8Tp##a3}fD?;&28H-h}z< zVWb1HxKr-&nK$yb`JDS<W8;s&c?JS-uL;nppVSctcZq$fAAd--iEr1~c z926B8NIcTBD~0rR_iki8HT4`!*NAiXb<&GI7ax5 zu$?zBM-a7_ibfpZ${V;cwjsiwa2$2?-3F&+r3fG4G#EU^YuudVF4|AB|Bq34o;Mtw zptXx-8~TO~`ZCrF3WHe*X_7?h6boRm1KVbyS>n!mDmDd05VG0EQs zkZHktbvlXwDmZmWxg1GOsiwH13Uun_(`bN*L@ypHA5#T69#7^xt}|K`kwOmYHl|rK zKCywTbq-AwV)VabzSgb5pY+_k__r_rx0f?R|#zP2k4ag~)pKnP!*)5!~EXQR8QA*{1 zfqMBn^wAPgLJ?UNE(f9))FS9sWYCNUu9_8A+~s5%l)QcL+QGLEUpqWsx$LOD>!`iou>FHw zKisvr{m)vim(B@u0kTA#*PU5H{LK=DTGrf+HI$$OPAJ~VT?`}v0@TvfvZ7gtuj+Mwyp zUsPZ;%<_+)mvRulN3I|FoZ~TGp#t80v+>r}+hJH22Tv_E3@p0`@45&7an(%izEZXW zHGeIZ9q+V#WcGHK3LkYkx*a7Smsa(Z6o1@U*JCaI8>gs$<2%HQ7caJ4d6Ru+4iJ1Ou=zX0SMuYt zYe|)9V``JU&)X>04G#b;?K1Uv~&EUFvqQDs{6@*$g zl3?{*K7f+9;quyyF3A$S&xo6bwvcp0@QH6W^do3QTt1d5nZ0N~$Uj>|w`f{<0UE<7 zg@jlda_Ob~Q`d!{(fkKZqe+;^0!*0Ww!CZiX*XJM$zG3#n!k26!l+xHyOTdHyu^i| zM^P-;XM^@=W!j^V*B(y*_I0`eG)DwRZKo<(fYg4<4Lx2`02n+(~dCWS$lHZxLSMqI72+*|744C_%%`>eM)(1UP zLc)@;CW^liUSG)J^$7O#|2tgk_iPec^iwFlOz#6q2W@CcD#spk%%8$EN~z+Mz`PHY z&~b@{Ac5u#+R|v_RcPO@!by~ZzD+wB(Mmb&t$*`W{hEeRg~@n4BqvZzZ#~h~+b`04 z-cKM-L<5ufSwIK*g%fEr*ll|AlLWHL+t;Yn*icQSCZ9opN{vGUl^S*H(-4-sJ`Edc zc1|tM86R{@lx`QuKr#o7xDyZ64xuk6nJ%1De&s%@7i9Wb0FAy=EL4BD(v?y_U0vQl z`~3vX+3gZd`z=5G z_TM4C!DL>+CXlbZKr^D(C+Q`5;ZChK(uW|;*K8sojoC%VP%x~bN^ld{%dj3%yFQWP zoZBo|dF(`jHnpoDXKtA z5L()9TxRc3O@n=Dhd2?4L{oCON%0`c5halJQg#KIS~}d*f5MNj$%y~t;9xiNg2C-V zKQ&QH^50(Q>SoR`)r=qLXjhxaljX6i*4*fd{4NbzOd0HU*gh=Oq*1Re$h>&C9H{b& z%8$$c1}&J0MVrV{&i=3&^ejUja<{47FLUOH%RTereaDvhoj10B;Q68FM*|-p%{B}# zIYwr>KPz^uSlx47e^3GsnzbZT+MKZ-TTI@y9=lbI?0#MIa$Vbb`|jHLHW-6`aS45L>1YiXEHv2Ch%JJ=!Hj& z9PS*w@Z;poi=T7cC7uNxaAU*tTY7uRlu2CtPi5#x|L#Bk zuwQVTv)}X^maoP6p{%vzzF?beUa&59-6(lixH)z6UI zFMm_QJvYdIiAyp7_e%|Gr5v06(ca3FyDC54S9`MA{x^qfPwp>Wqka-Y#(92fd_yR> z2&4)DdGeC{2D)nQ!*8UGE)nJF?n67@Kw*uB*{c-fXqX>nZ;!hV$pyo}yN?2C#}en| znHYpmh3cz`XpbrFDEQe-x+MQ|8)7pSc6jA~i!rp@ z>pwtAHRHE+5NgoKG)IPN%ZFHL)o@2>P6%NdzY3Cnj4HMZuc83&L$PD7WcJ(H;@bPJ z&EI=HW3Bnj;lf$}{^a*df97)EFMDRbd#S8`=B1xk)y>-QVK#Ely7_^bs}_GH*uFnJ zSMxo8#<^{NEMwo36`DVD*AP9{FYw6NPSVd3Xkx#=U7HMK>YT__GeaiUb<~8*;JFX551!s_a`nP6SQ;h`Y&>Zmm1q2h zM<(Tm`9Gm;UsY5G>3;0Takve{4inQn0@P}pvI)vUlo2z+4-t&t&1mts15{fT2!;I9 zsc15i|E)mIFUl^4XgUq)Bg|zf|By;IC?geu@ex@>NfqeVfg1lI_W?Wg8pp9d59~q1 zJ|cgF4|MvKYUFVD@%#f}GcP=9=lI57a<-py_J82&f5|z1QPGsyeJoSnHRDn@J)hw! z)zbbM$4c#DeCH!8e%-QK$?@)GZpR&N z$3k%NNS5n>Q`F@6!c@c`S>=$yd1-R2((9vg-2Z;$#I@5$13Y5vk7^LYT5YZ<7iLOV zn>kBmrpmV>ltZno8ZfO0Whhj>fI<}tn~$U5$dpX22$guFacY&vV+vLY1!{)^vv@!H5-BmJIhzU>FiOC@#p1QG01s9|{f->|=d A_y7O^ -- 2.54.0