Agent accounts — service accounts that act on behalf of a parent user when calling the authentik API, with expiring tokens and audited delegation.
Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/authentik:authentik-agents-api"curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.2.0
info:
title: authentik Agents API
version: 2026.11.0-rc1
description: Making authentication simple.
contact:
email: hello@goauthentik.io
license:
name: MIT
url: https://github.com/goauthentik/authentik/blob/main/LICENSE
x-source-url: https://api.goauthentik.io/schema.yml
x-last-validated: '2026-09-04'
servers:
- url: /api/v3
tags:
- name: Agents
paths:
/agents/agents/:
get:
operationId: agents_agents_list
description: 'Admin-provisioned delegate identities. An admin creates a Agent for a given
parent user, then grants it access the same way as any other User -- ordinary
PolicyBindings pointed at whatever it needs.'
parameters:
- $ref: '#/components/parameters/QueryPaginationOrdering'
- $ref: '#/components/parameters/QueryPaginationPage'
- $ref: '#/components/parameters/QueryPaginationPageSize'
- in: query
name: parent
schema:
type: integer
- $ref: '#/components/parameters/QuerySearch'
tags:
- Agents
security:
- authentik: []
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/PaginatedAgentList'
description: ''
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
summary: Agents agents list
x-summary-source: derived
post:
operationId: agents_agents_create
description: 'Admin-provisioned delegate identities. An admin creates a Agent for a given
parent user, then grants it access the same way as any other User -- ordinary
PolicyBindings pointed at whatever it needs.'
tags:
- Agents
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/AgentCreateRequest'
security:
- authentik: []
responses:
'201':
content:
application/json:
schema:
$ref: '#/components/schemas/AgentCreated'
description: ''
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
summary: Agents agents create
x-summary-source: derived
/agents/agents/{id}/:
get:
operationId: agents_agents_retrieve
description: 'Admin-provisioned delegate identities. An admin creates a Agent for a given
parent user, then grants it access the same way as any other User -- ordinary
PolicyBindings pointed at whatever it needs.'
parameters:
- in: path
name: id
schema:
type: integer
description: A unique integer value identifying this Agent.
required: true
tags:
- Agents
security:
- authentik: []
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/Agent'
description: ''
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
summary: Agents agents retrieve
x-summary-source: derived
put:
operationId: agents_agents_update
description: 'Admin-provisioned delegate identities. An admin creates a Agent for a given
parent user, then grants it access the same way as any other User -- ordinary
PolicyBindings pointed at whatever it needs.'
parameters:
- in: path
name: id
schema:
type: integer
description: A unique integer value identifying this Agent.
required: true
tags:
- Agents
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/AgentRequest'
required: true
security:
- authentik: []
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/Agent'
description: ''
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
summary: Agents agents update
x-summary-source: derived
patch:
operationId: agents_agents_partial_update
description: 'Admin-provisioned delegate identities. An admin creates a Agent for a given
parent user, then grants it access the same way as any other User -- ordinary
PolicyBindings pointed at whatever it needs.'
parameters:
- in: path
name: id
schema:
type: integer
description: A unique integer value identifying this Agent.
required: true
tags:
- Agents
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/PatchedAgentRequest'
security:
- authentik: []
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/Agent'
description: ''
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
summary: Agents agents partial update
x-summary-source: derived
delete:
operationId: agents_agents_destroy
description: 'Admin-provisioned delegate identities. An admin creates a Agent for a given
parent user, then grants it access the same way as any other User -- ordinary
PolicyBindings pointed at whatever it needs.'
parameters:
- in: path
name: id
schema:
type: integer
description: A unique integer value identifying this Agent.
required: true
tags:
- Agents
security:
- authentik: []
responses:
'204':
description: No response body
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
summary: Agents agents destroy
x-summary-source: derived
components:
schemas:
PolicyBehaviorEnum:
enum:
- mirror
- copy
- none
type: string
AgentCreated:
type: object
description: Response returned once when an agent is created, carrying the one-time API token.
properties:
agent:
allOf:
- $ref: '#/components/schemas/Agent'
readOnly: true
token:
type: string
readOnly: true
required:
- agent
- token
ValidationError:
type: object
description: Validation Error
properties:
non_field_errors:
type: array
items:
type: string
code:
type: string
additionalProperties: {}
Pagination:
type: object
properties:
next:
type: number
previous:
type: number
count:
type: number
current:
type: number
total_pages:
type: number
start_index:
type: number
end_index:
type: number
required:
- count
- current
- end_index
- next
- previous
- start_index
- total_pages
PartialUser:
type: object
description: Partial User Serializer, does not include child relations.
properties:
pk:
type: integer
readOnly: true
title: ID
username:
type: string
description: Required. 150 characters or fewer. Letters, digits and @/./+/-/_ only.
pattern: ^[\w.@+-]+$
maxLength: 150
name:
type: string
description: User's display name.
is_active:
type: boolean
title: Active
description: Designates whether this user should be treated as active. Unselect this instead of deleting accounts.
last_login:
type:
- string
- 'null'
format: date-time
email:
type: string
format: email
title: Email address
maxLength: 254
attributes:
type: object
additionalProperties: {}
uid:
type: string
readOnly: true
required:
- name
- pk
- uid
- username
PatchedAgentRequest:
type: object
description: 'Mixin to validate that a valid enterprise license
exists before allowing to save the object'
properties:
username:
type: string
minLength: 1
description: Required. 150 characters or fewer. Letters, digits and @/./+/-/_ only.
pattern: ^[\w.@+-]+$
maxLength: 150
name:
type: string
minLength: 1
description: User's display name.
is_active:
type: boolean
title: Active
description: Designates whether this user should be treated as active. Unselect this instead of deleting accounts.
last_login:
type:
- string
- 'null'
format: date-time
email:
type: string
format: email
title: Email address
maxLength: 254
attributes:
type: object
additionalProperties: {}
expiring:
type: boolean
expires:
type:
- string
- 'null'
format: date-time
Agent:
type: object
description: 'Mixin to validate that a valid enterprise license
exists before allowing to save the object'
properties:
pk:
type: integer
readOnly: true
title: ID
username:
type: string
description: Required. 150 characters or fewer. Letters, digits and @/./+/-/_ only.
pattern: ^[\w.@+-]+$
maxLength: 150
name:
type: string
description: User's display name.
is_active:
type: boolean
title: Active
description: Designates whether this user should be treated as active. Unselect this instead of deleting accounts.
last_login:
type:
- string
- 'null'
format: date-time
email:
type: string
format: email
title: Email address
maxLength: 254
attributes:
type: object
additionalProperties: {}
uid:
type: string
readOnly: true
uuid:
type: string
format: uuid
readOnly: true
expiring:
type: boolean
expires:
type:
- string
- 'null'
format: date-time
parent:
allOf:
- $ref: '#/components/schemas/PartialUser'
readOnly: true
policy_behavior:
allOf:
- $ref: '#/components/schemas/PolicyBehaviorEnum'
readOnly: true
token_identifier:
type:
- string
- 'null'
description: Identifier of the agent's API token, so its key can be retrieved/copied later.
readOnly: true
required:
- name
- parent
- pk
- policy_behavior
- token_identifier
- uid
- username
- uuid
PaginatedAgentList:
type: object
properties:
pagination:
$ref: '#/components/schemas/Pagination'
results:
type: array
items:
$ref: '#/components/schemas/Agent'
autocomplete:
$ref: '#/components/schemas/Autocomplete'
required:
- autocomplete
- pagination
- results
Autocomplete:
type: object
additionalProperties: {}
AgentRequest:
type: object
description: 'Mixin to validate that a valid enterprise license
exists before allowing to save the object'
properties:
username:
type: string
minLength: 1
description: Required. 150 characters or fewer. Letters, digits and @/./+/-/_ only.
pattern: ^[\w.@+-]+$
maxLength: 150
name:
type: string
minLength: 1
description: User's display name.
is_active:
type: boolean
title: Active
description: Designates whether this user should be treated as active. Unselect this instead of deleting accounts.
last_login:
type:
- string
- 'null'
format: date-time
email:
type: string
format: email
title: Email address
maxLength: 254
attributes:
type: object
additionalProperties: {}
expiring:
type: boolean
expires:
type:
- string
- 'null'
format: date-time
required:
- name
- username
GenericError:
type: object
description: Generic API Error
properties:
detail:
type: string
code:
type: string
required:
- detail
AgentCreateRequest:
type: object
description: Base serializer class which doesn't implement create/update methods
properties:
parent:
type: integer
label:
type: string
expiring:
type: boolean
default: false
expires:
type:
- string
- 'null'
format: date-time
policy_behavior:
allOf:
- $ref: '#/components/schemas/PolicyBehaviorEnum'
default: mirror
parameters:
QueryPaginationPageSize:
in: query
name: page_size
schema:
type: integer
description: Number of results to return per page.
QueryPaginationOrdering:
in: query
name: ordering
schema:
type: string
description: Which field to use when ordering the results.
QueryPaginationPage:
in: query
name: page
schema:
type: integer
description: A page number within the paginated result set.
QuerySearch:
in: query
name: search
schema:
type: string
description: A search term.
responses:
ValidationErrorResponse:
content:
application/json:
schema:
$ref: '#/components/schemas/ValidationError'
description: ''
GenericErrorResponse:
content:
application/json:
schema:
$ref: '#/components/schemas/GenericError'
description: ''
securitySchemes:
authentik:
type: http
scheme: bearer
authentik_device_auth:
type: http
scheme: bearer+agent
authentik_device_enroll:
type: http
scheme: bearer
authentik_device_federation:
type: http
scheme: bearer