Authentik

Authentik Crypto API

Certificate-key pairs used to sign SAML assertions and OIDC ID tokens, and to validate webhook receivers.

GitHub OpenAPI

Operations 10

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /crypto/certificatekeypairs/ List certificate-key pairs · Crypto certificatekeypairs list #
Ask an LLM
“Which certificates and key pairs are stored in my authentik instance?”
“Can I list only the certificate-key pairs that include a private key?”
Tell an agent
List all certificate-key pairs.
Show only certificate-key pairs that have a private key: {has_key}.
POST /crypto/certificatekeypairs/ Import a certificate-key pair · Crypto certificatekeypairs create #
Ask an LLM
“How do I upload an existing PEM certificate so authentik can use it?”
“Can I import a certificate without its private key?”
Tell an agent
Import certificate {certificate_data} as a new keypair called {name}.
Upload PEM certificate {certificate_data} with private key {key_data} under the name {name}.
GET /crypto/certificatekeypairs/{kp_uuid}/ Get a certificate-key pair · Crypto certificatekeypairs retrieve #
Ask an LLM
“What are the details of one certificate-key pair, like its fingerprint and expiry?”
“Can I look up a single stored certificate by its UUID?”
Tell an agent
Show the details of certificate-key pair {kp_uuid}.
Get the metadata for keypair {kp_uuid}.
PUT /crypto/certificatekeypairs/{kp_uuid}/ Replace a certificate-key pair · Crypto certificatekeypairs update #
Ask an LLM
“How do I swap in a renewed certificate on an existing keypair?”
“Can I fully replace the name and PEM data of a stored certificate in one call?”
Tell an agent
Replace keypair {kp_uuid} with name {name} and certificate {certificate_data}.
Overwrite keypair {kp_uuid} entirely with certificate {certificate_data}, key {key_data} and name {name}.
PATCH /crypto/certificatekeypairs/{kp_uuid}/ Edit fields on a certificate-key pair · Crypto certificatekeypairs partial update #
Ask an LLM
“Can I just rename a certificate-key pair without re-uploading it?”
“How do I add a private key to a certificate that was imported without one?”
Tell an agent
Rename keypair {kp_uuid} to {name}.
Attach private key {key_data} to the existing keypair {kp_uuid}.
DELETE /crypto/certificatekeypairs/{kp_uuid}/ Delete a certificate-key pair · Crypto certificatekeypairs destroy #
Ask an LLM
“How do I remove a certificate I no longer need from authentik?”
“What happens when I delete a keypair that something still uses?”
Tell an agent destructive · confirm first
Delete certificate-key pair {kp_uuid}.
Remove the stored certificate {kp_uuid} permanently.
GET /crypto/certificatekeypairs/{kp_uuid}/used_by/ See what uses a certificate-key pair · Crypto certificatekeypairs used by list #
Ask an LLM
“Which providers or sources depend on this certificate before I rotate it?”
“Is a certificate still referenced by anything in authentik?”
Tell an agent
List every object that uses certificate {kp_uuid}.
Check what depends on keypair {kp_uuid} before I delete it.
GET /crypto/certificatekeypairs/{kp_uuid}/view_certificate/ View or download a certificate · Crypto certificatekeypairs view certificate retrieve #
Ask an LLM
“How do I get the PEM text of a certificate stored in authentik?”
“Can I download a certificate as a file, and is that access logged?”
Tell an agent
Show the certificate PEM for keypair {kp_uuid}.
Download the public certificate of {kp_uuid} as a file: {download}.
GET /crypto/certificatekeypairs/{kp_uuid}/view_private_key/ View or download a private key · Crypto certificatekeypairs view private key retrieve #
Ask an LLM
“How can I export the private key that belongs to a stored keypair?”
“Does authentik record an audit event when someone views a private key?”
Tell an agent
Reveal the private key for keypair {kp_uuid}.
Download the private key of {kp_uuid} as a file: {download}.
POST /crypto/certificatekeypairs/generate/ Generate a self-signed certificate · Crypto certificatekeypairs generate create #
Ask an LLM
“Can authentik create a self-signed certificate for me?”
“How long can a generated certificate be valid, and can I add subject alternative names?”
Tell an agent
Generate a self-signed certificate for {common_name} valid for {validity_days} days.
Create a new self-signed keypair for {common_name} with SANs {subject_alt_name}, {validity_days} days, algorithm {alg}.

Documentation

📖
Documentation
https://docs.goauthentik.io/developer-docs/api/
📖
APIReference
https://api.goauthentik.io/
📖
Documentation
https://docs.goauthentik.io

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/authentik/refs/heads/main/openapi/authentik-crypto-api-openapi.yml

SDKs

📦
GitHubRepository
https://github.com/goauthentik/authentik

Other Resources

🔗
SDKs
https://pypi.org/project/authentik-client/
🔗
SDKs
https://www.npmjs.com/package/@goauthentik/api
🔗
Overlay
https://raw.githubusercontent.com/api-evangelist/authentik/refs/heads/main/overlays/authentik-crypto-api-overlay.yaml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/authentik:authentik-crypto-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

authentik-crypto-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: authentik Crypto API
  version: 2026.11.0-rc1
  description: Making authentication simple.
  contact:
    email: hello@goauthentik.io
  license:
    name: MIT
    url: https://github.com/goauthentik/authentik/blob/main/LICENSE
  x-source-url: https://api.goauthentik.io/schema.yml
  x-last-validated: '2026-09-04'
servers:
- url: /api/v3
tags:
- name: Crypto
paths:
  /crypto/certificatekeypairs/:
    get:
      operationId: crypto_certificatekeypairs_list
      description: CertificateKeyPair Viewset
      parameters:
      - in: query
        name: has_key
        schema:
          type: boolean
        description: Only return certificate-key pairs with keys
      - in: query
        name: key_type
        schema:
          type: array
          items:
            $ref: '#/components/schemas/KeyTypeEnum'
          description: Filter by key algorithm type (RSA, EC, DSA, etc). Can be specified multiple times (e.g. '?key_type=rsa&key_type=ec')
      - in: query
        name: managed
        schema:
          type: string
      - $ref: '#/components/parameters/QueryName'
      - $ref: '#/components/parameters/QueryPaginationOrdering'
      - $ref: '#/components/parameters/QueryPaginationPage'
      - $ref: '#/components/parameters/QueryPaginationPageSize'
      - $ref: '#/components/parameters/QuerySearch'
      tags:
      - Crypto
      security:
      - authentik: []
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedCertificateKeyPairList'
          description: ''
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
      summary: Crypto certificatekeypairs list
      x-summary-source: derived
    post:
      operationId: crypto_certificatekeypairs_create
      description: CertificateKeyPair Viewset
      tags:
      - Crypto
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CertificateKeyPairRequest'
        required: true
      security:
      - authentik: []
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CertificateKeyPair'
          description: ''
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
      summary: Crypto certificatekeypairs create
      x-summary-source: derived
  /crypto/certificatekeypairs/{kp_uuid}/:
    get:
      operationId: crypto_certificatekeypairs_retrieve
      description: CertificateKeyPair Viewset
      parameters:
      - in: path
        name: kp_uuid
        schema:
          type: string
          format: uuid
        description: A UUID string identifying this Certificate-Key Pair.
        required: true
      tags:
      - Crypto
      security:
      - authentik: []
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CertificateKeyPair'
          description: ''
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
      summary: Crypto certificatekeypairs retrieve
      x-summary-source: derived
    put:
      operationId: crypto_certificatekeypairs_update
      description: CertificateKeyPair Viewset
      parameters:
      - in: path
        name: kp_uuid
        schema:
          type: string
          format: uuid
        description: A UUID string identifying this Certificate-Key Pair.
        required: true
      tags:
      - Crypto
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CertificateKeyPairRequest'
        required: true
      security:
      - authentik: []
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CertificateKeyPair'
          description: ''
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
      summary: Crypto certificatekeypairs update
      x-summary-source: derived
    patch:
      operationId: crypto_certificatekeypairs_partial_update
      description: CertificateKeyPair Viewset
      parameters:
      - in: path
        name: kp_uuid
        schema:
          type: string
          format: uuid
        description: A UUID string identifying this Certificate-Key Pair.
        required: true
      tags:
      - Crypto
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchedCertificateKeyPairRequest'
      security:
      - authentik: []
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CertificateKeyPair'
          description: ''
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
      summary: Crypto certificatekeypairs partial update
      x-summary-source: derived
    delete:
      operationId: crypto_certificatekeypairs_destroy
      description: CertificateKeyPair Viewset
      parameters:
      - in: path
        name: kp_uuid
        schema:
          type: string
          format: uuid
        description: A UUID string identifying this Certificate-Key Pair.
        required: true
      tags:
      - Crypto
      security:
      - authentik: []
      responses:
        '204':
          description: No response body
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
      summary: Crypto certificatekeypairs destroy
      x-summary-source: derived
  /crypto/certificatekeypairs/{kp_uuid}/used_by/:
    get:
      operationId: crypto_certificatekeypairs_used_by_list
      description: Get a list of all objects that use this object
      parameters:
      - in: path
        name: kp_uuid
        schema:
          type: string
          format: uuid
        description: A UUID string identifying this Certificate-Key Pair.
        required: true
      tags:
      - Crypto
      security:
      - authentik: []
      responses:
        '200':
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/UsedBy'
          description: ''
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
      summary: Crypto certificatekeypairs used by list
      x-summary-source: derived
  /crypto/certificatekeypairs/{kp_uuid}/view_certificate/:
    get:
      operationId: crypto_certificatekeypairs_view_certificate_retrieve
      description: Return certificate-key pairs certificate and log access
      parameters:
      - in: query
        name: download
        schema:
          type: boolean
      - in: path
        name: kp_uuid
        schema:
          type: string
          format: uuid
        description: A UUID string identifying this Certificate-Key Pair.
        required: true
      tags:
      - Crypto
      security:
      - authentik: []
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CertificateData'
          description: ''
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
      summary: Crypto certificatekeypairs view certificate retrieve
      x-summary-source: derived
  /crypto/certificatekeypairs/{kp_uuid}/view_private_key/:
    get:
      operationId: crypto_certificatekeypairs_view_private_key_retrieve
      description: Return certificate-key pairs private key and log access
      parameters:
      - in: query
        name: download
        schema:
          type: boolean
      - in: path
        name: kp_uuid
        schema:
          type: string
          format: uuid
        description: A UUID string identifying this Certificate-Key Pair.
        required: true
      tags:
      - Crypto
      security:
      - authentik: []
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CertificateData'
          description: ''
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
      summary: Crypto certificatekeypairs view private key retrieve
      x-summary-source: derived
  /crypto/certificatekeypairs/generate/:
    post:
      operationId: crypto_certificatekeypairs_generate_create
      description: Generate a new, self-signed certificate-key pair
      tags:
      - Crypto
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CertificateGenerationRequest'
        required: true
      security:
      - authentik: []
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CertificateKeyPair'
          description: ''
        '400':
          description: Bad request
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
      summary: Crypto certificatekeypairs generate create
      x-summary-source: derived
components:
  schemas:
    CertificateData:
      type: object
      description: Get CertificateKeyPair's data
      properties:
        data:
          type: string
          readOnly: true
      required:
      - data
    AlgEnum:
      enum:
      - rsa
      - ecdsa
      - ed25519
      - ed448
      type: string
    CertificateKeyPair:
      type: object
      description: CertificateKeyPair Serializer
      properties:
        pk:
          type: string
          format: uuid
          readOnly: true
          title: Kp uuid
        name:
          type: string
        fingerprint_sha256:
          type:
          - string
          - 'null'
          readOnly: true
          description: SHA256 fingerprint of the certificate
        fingerprint_sha1:
          type:
          - string
          - 'null'
          readOnly: true
          description: SHA1 fingerprint of the certificate
        cert_expiry:
          type:
          - string
          - 'null'
          format: date-time
          readOnly: true
          description: Certificate expiry date
        cert_subject:
          type:
          - string
          - 'null'
          readOnly: true
          description: Certificate subject as RFC4514 string
        private_key_available:
          type: boolean
          description: Show if this keypair has a private key configured or not
          readOnly: true
        key_type:
          allOf:
          - $ref: '#/components/schemas/CertificateKeyPairKeyTypeEnum'
          readOnly: true
          description: Key algorithm type detected from the certificate's public key
        certificate_download_url:
          type: string
          description: Get URL to download certificate
          readOnly: true
        private_key_download_url:
          type: string
          description: Get URL to download private key
          readOnly: true
        managed:
          type:
          - string
          - 'null'
          readOnly: true
          title: Managed by authentik
          description: Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
      required:
      - cert_expiry
      - cert_subject
      - certificate_download_url
      - fingerprint_sha1
      - fingerprint_sha256
      - key_type
      - managed
      - name
      - pk
      - private_key_available
      - private_key_download_url
    UsedBy:
      type: object
      description: A list of all objects referencing the queried object
      properties:
        app:
          type: string
        model_name:
          type: string
        pk:
          type: string
        name:
          type: string
        action:
          $ref: '#/components/schemas/UsedByActionEnum'
      required:
      - action
      - app
      - model_name
      - name
      - pk
    PaginatedCertificateKeyPairList:
      type: object
      properties:
        pagination:
          $ref: '#/components/schemas/Pagination'
        results:
          type: array
          items:
            $ref: '#/components/schemas/CertificateKeyPair'
        autocomplete:
          $ref: '#/components/schemas/Autocomplete'
      required:
      - autocomplete
      - pagination
      - results
    KeyTypeEnum:
      type: string
      enum:
      - dsa
      - ec
      - ed25519
      - ed448
      - rsa
    CertificateKeyPairRequest:
      type: object
      description: CertificateKeyPair Serializer
      properties:
        name:
          type: string
          minLength: 1
        certificate_data:
          type: string
          writeOnly: true
          minLength: 1
          description: PEM-encoded Certificate data
        key_data:
          type: string
          writeOnly: true
          description: Optional Private Key. If this is set, you can use this keypair for encryption.
      required:
      - certificate_data
      - name
    UsedByActionEnum:
      enum:
      - cascade
      - cascade_many
      - set_null
      - set_default
      - left_dangling
      type: string
    ValidationError:
      type: object
      description: Validation Error
      properties:
        non_field_errors:
          type: array
          items:
            type: string
        code:
          type: string
      additionalProperties: {}
    Autocomplete:
      type: object
      additionalProperties: {}
    GenericError:
      type: object
      description: Generic API Error
      properties:
        detail:
          type: string
        code:
          type: string
      required:
      - detail
    CertificateGenerationRequest:
      type: object
      description: Certificate generation parameters
      properties:
        common_name:
          type: string
          minLength: 1
        subject_alt_name:
          type: string
        validity_days:
          type: integer
        alg:
          allOf:
          - $ref: '#/components/schemas/AlgEnum'
          default: rsa
      required:
      - common_name
      - validity_days
    PatchedCertificateKeyPairRequest:
      type: object
      description: CertificateKeyPair Serializer
      properties:
        name:
          type: string
          minLength: 1
        certificate_data:
          type: string
          writeOnly: true
          minLength: 1
          description: PEM-encoded Certificate data
        key_data:
          type: string
          writeOnly: true
          description: Optional Private Key. If this is set, you can use this keypair for encryption.
    Pagination:
      type: object
      properties:
        next:
          type: number
        previous:
          type: number
        count:
          type: number
        current:
          type: number
        total_pages:
          type: number
        start_index:
          type: number
        end_index:
          type: number
      required:
      - count
      - current
      - end_index
      - next
      - previous
      - start_index
      - total_pages
    CertificateKeyPairKeyTypeEnum:
      enum:
      - rsa
      - ec
      - dsa
      - ed25519
      - ed448
      type: string
  responses:
    GenericErrorResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/GenericError'
      description: ''
    ValidationErrorResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ValidationError'
      description: ''
  parameters:
    QueryPaginationOrdering:
      in: query
      name: ordering
      schema:
        type: string
      description: Which field to use when ordering the results.
    QueryName:
      in: query
      name: name
      schema:
        type: string
    QueryPaginationPageSize:
      in: query
      name: page_size
      schema:
        type: integer
      description: Number of results to return per page.
    QueryPaginationPage:
      in: query
      name: page
      schema:
        type: integer
      description: A page number within the paginated result set.
    QuerySearch:
      in: query
      name: search
      schema:
        type: string
      description: A search term.
  securitySchemes:
    authentik:
      type: http
      scheme: bearer
    authentik_device_auth:
      type: http
      scheme: bearer+agent
    authentik_device_enroll:
      type: http
      scheme: bearer
    authentik_device_federation:
      type: http
      scheme: bearer