Authentik

Authentik Events API

Audit events, notification rules and notification transports — including the webhook and Slack transports that push authentik events to external receivers.

GitHub OpenAPI

Operations 33

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /events/events/ Browse the audit event log · Events events list #
Ask an LLM
“Which login and admin events did a specific user trigger?”
“Can I filter the audit log by client IP address?”
Tell an agent
List recent audit events.
Show events performed by user {username}.
POST /events/events/ Record a custom audit event · Events events create #
Ask an LLM
“Can I write my own entry into the authentik event log?”
“What does it take to log a custom event with an action and app name?”
Tell an agent
Log a {action} event for app {app}.
Record event {action} from app {app} with context {context}.
GET /events/events/{event_uuid}/ Get one audit event · Events events retrieve #
Ask an LLM
“What exactly is recorded in a single event, including its context?”
“Where can I view one audit log entry by its UUID?”
Tell an agent
Show event {event_uuid}.
Get the full context of audit event {event_uuid}.
PUT /events/events/{event_uuid}/ Replace an audit event · Events events update #
Ask an LLM
“Can I overwrite an existing event record with a new action and app?”
“What must I send to fully replace a logged event?”
Tell an agent
Replace event {event_uuid} with action {action} and app {app}.
Overwrite event {event_uuid} as {action} from {app} with context {context}.
PATCH /events/events/{event_uuid}/ Edit fields on an audit event · Events events partial update #
Ask an LLM
“Can I change just the expiry date of a logged event?”
“Is it possible to patch only the context of an existing event?”
Tell an agent
Set event {event_uuid} to expire at {expires}.
Update only the context of event {event_uuid} to {context}.
DELETE /events/events/{event_uuid}/ Delete an audit event · Events events destroy #
Ask an LLM
“Can I remove a single entry from the event log?”
“What happens if I delete an audit event?”
Tell an agent destructive · confirm first
Delete event {event_uuid}.
Remove audit log entry {event_uuid} permanently.
GET /events/events/actions/ List all event action types · Events events actions list #
Ask an LLM
“What kinds of actions can appear in the authentik event log?”
“Which event action names can I filter or alert on?”
Tell an agent
List every event action type.
Show the possible audit event actions.
POST /events/events/export/ Export audit events to a file · Events events export create #
Ask an LLM
“How do I download the event log as a file?”
“Can I export only the events for one user, and how do I know when the export is ready?”
Tell an agent
Export all audit events.
Start an export of events for user {username}.
GET /events/events/stats/ Get event counts over time steps · Events events stats retrieve #
Ask an LLM
“Can I get event statistics bucketed into a set number of count steps?”
“What do aggregate counts look like for failed logins across time buckets?”
Tell an agent
Get event stats in {count_steps} steps.
Show {action} event stats split into {count_steps} steps.
GET /events/events/top_per_user/ Rank users by event count · Events events top per user list #
Ask an LLM
“Which users generate the most events of a given action?”
“Who are the top users by login count?”
Tell an agent
Show the top {top_n} users for {action} events.
Group events by user and show the most active ones.
GET /events/events/volume/ Get event volume over recent days · Events events volume list #
Ask an LLM
“How many events happened per day over the last few weeks?”
“Can I chart event volume for one action across a chosen number of days?”
Tell an agent
Show event volume for the last {history_days} days.
Chart the volume of {action} events.
GET /events/notifications/ List notifications · Events notifications list #
Ask an LLM
“Which notifications have I not seen yet?”
“Can I filter notifications by severity?”
Tell an agent
List my notifications.
Show notifications with seen set to {seen}.
GET /events/notifications/{uuid}/ Get one notification · Events notifications retrieve #
Ask an LLM
“What does a specific notification say and which event triggered it?”
“Where can I open a single notification by its ID?”
Tell an agent
Show notification {uuid}.
Open notification {uuid} and tell me its event.
PUT /events/notifications/{uuid}/ Replace a notification's fields · Events notifications update #
Ask an LLM
“Can I overwrite a notification's hyperlink, label and seen flag together?”
“What does a full replace of a notification look like?”
Tell an agent
Replace notification {uuid} with hyperlink {hyperlink} labeled {hyperlink_label}.
Overwrite notification {uuid}, setting seen to {seen}.
PATCH /events/notifications/{uuid}/ Mark one notification as seen · Events notifications partial update #
Ask an LLM
“How do I mark a single notification as read?”
“Can I change just the link on one notification?”
Tell an agent
Mark notification {uuid} seen: {seen}.
Change the link on notification {uuid} to {hyperlink}.
DELETE /events/notifications/{uuid}/ Delete a notification · Events notifications destroy #
Ask an LLM
“Can I dismiss and delete a single notification?”
“Is there a way to remove one notification from my list for good?”
Tell an agent destructive · confirm first
Delete notification {uuid}.
Remove notification {uuid} permanently.
GET /events/notifications/{uuid}/used_by/ See what uses a notification · Events notifications used by list #
Ask an LLM
“Which objects reference a given notification?”
“Does anything depend on this notification before I delete it?”
Tell an agent
List objects that use notification {uuid}.
Show what references notification {uuid}.
POST /events/notifications/mark_all_seen/ Mark all my notifications as seen · Events notifications mark all seen create #
Ask an LLM
“Is there a way to clear every unread notification at once?”
“Can I mark all of my notifications read in one call?”
Tell an agent
Mark all my notifications as seen.
Clear my entire unread notification list.
GET /events/rules/ List notification rules · Events rules list #
Ask an LLM
“Which notification rules decide who gets alerted about events?”
“Can I find the rules that notify a particular group?”
Tell an agent
List all notification rules.
Show notification rules sending to group {destination_group__name}.
POST /events/rules/ Create a notification rule · Events rules create #
Ask an LLM
“How do I set up an alert that notifies a group when certain events happen?”
“Can a new notification rule send to the user who caused the event?”
Tell an agent
Create notification rule {name} notifying group {destination_group}.
Add a {severity} rule called {name} that sends through transports {transports}.
GET /events/rules/{pbm_uuid}/ Get a notification rule · Events rules retrieve #
Ask an LLM
“Which group and transports does one notification rule use?”
“Where can I view a single notification rule?”
Tell an agent
Show notification rule {pbm_uuid}.
Get the settings of alert rule {pbm_uuid}.
PUT /events/rules/{pbm_uuid}/ Replace a notification rule · Events rules update #
Ask an LLM
“Can I overwrite a notification rule's name, severity and transports in one go?”
“What does a full replacement of an alert rule need?”
Tell an agent
Replace notification rule {pbm_uuid} with name {name}.
Redefine rule {pbm_uuid} as {name} at severity {severity} via transports {transports}.
PATCH /events/rules/{pbm_uuid}/ Change some notification rule settings · Events rules partial update #
Ask an LLM
“Can I change only the destination group of an existing rule?”
“Is it possible to bump just a rule's severity?”
Tell an agent
Send notification rule {pbm_uuid} to group {destination_group} instead.
Change the severity of rule {pbm_uuid} to {severity}.
DELETE /events/rules/{pbm_uuid}/ Delete a notification rule · Events rules destroy #
Ask an LLM
“How can I stop an alert rule from sending notifications?”
“Can I delete a notification rule I no longer need?”
Tell an agent destructive · confirm first
Delete notification rule {pbm_uuid}.
Remove alert rule {pbm_uuid}.
GET /events/rules/{pbm_uuid}/used_by/ See what uses a notification rule · Events rules used by list #
Ask an LLM
“What is still linked to an alert rule I want to retire?”
“Is anything bound to this alert rule?”
Tell an agent
List objects that use notification rule {pbm_uuid}.
Show what depends on alert rule {pbm_uuid}.
GET /events/transports/ List notification transports · Events transports list #
Ask an LLM
“Which delivery channels, like email or webhook, are set up for notifications?”
“Can I find transports that post to a specific webhook URL?”
Tell an agent
List all notification transports.
Show transports in mode {mode}.
POST /events/transports/ Create a notification transport · Events transports create #
Ask an LLM
“How do I send authentik notifications to a webhook?”
“Can a new transport email alerts with a custom subject prefix?”
Tell an agent
Create a webhook transport {name} posting to {webhook_url}.
Add transport {name} in mode {mode} with email subject prefix {email_subject_prefix}.
GET /events/transports/{uuid}/ Get a notification transport · Events transports retrieve #
Ask an LLM
“What mode and webhook URL does a specific transport use?”
“Where can I view one notification transport's settings?”
Tell an agent
Show notification transport {uuid}.
Get the delivery settings of transport {uuid}.
PUT /events/transports/{uuid}/ Replace a notification transport · Events transports update #
Ask an LLM
“Can I overwrite a transport's whole configuration at once?”
“What is required to fully replace a notification transport?”
Tell an agent
Replace transport {uuid} with name {name} in mode {mode}.
Redefine transport {uuid} as {name} sending to webhook {webhook_url}.
PATCH /events/transports/{uuid}/ Change some transport settings · Events transports partial update #
Ask an LLM
“Can I change only the webhook URL on an existing transport?”
“Is it possible to make a transport send each notification just once?”
Tell an agent
Point transport {uuid} at webhook {webhook_url}.
Set send-once on transport {uuid} to {send_once}.
DELETE /events/transports/{uuid}/ Delete a notification transport · Events transports destroy #
Ask an LLM
“How do I remove a webhook or email transport I no longer use?”
“Can I delete a single notification transport?”
Tell an agent destructive · confirm first
Delete notification transport {uuid}.
Remove delivery transport {uuid}.
POST /events/transports/{uuid}/test/ Send a test notification · Events transports test create #
Ask an LLM
“How can I check a webhook or email transport actually delivers?”
“Can I fire an example notification through one transport?”
Tell an agent
Send a test notification through transport {uuid}.
Test delivery on transport {uuid}.
GET /events/transports/{uuid}/used_by/ See what uses a transport · Events transports used by list #
Ask an LLM
“Which notification rules send through a given transport?”
“Does anything still depend on this delivery transport?”
Tell an agent
List objects that use transport {uuid}.
Show what references notification transport {uuid}.

Documentation

📖
Documentation
https://docs.goauthentik.io/developer-docs/api/
📖
APIReference
https://api.goauthentik.io/
📖
Documentation
https://docs.goauthentik.io

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/authentik/refs/heads/main/openapi/authentik-events-api-openapi.yml

SDKs

📦
GitHubRepository
https://github.com/goauthentik/authentik

Other Resources

🔗
SDKs
https://pypi.org/project/authentik-client/
🔗
SDKs
https://www.npmjs.com/package/@goauthentik/api
🔗
Overlay
https://raw.githubusercontent.com/api-evangelist/authentik/refs/heads/main/overlays/authentik-events-api-overlay.yaml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/authentik:authentik-events-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

authentik-events-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: authentik Events API
  version: 2026.11.0-rc1
  description: Making authentication simple.
  contact:
    email: hello@goauthentik.io
  license:
    name: MIT
    url: https://github.com/goauthentik/authentik/blob/main/LICENSE
  x-source-url: https://api.goauthentik.io/schema.yml
  x-last-validated: '2026-09-04'
servers:
- url: /api/v3
tags:


# --- truncated at 32 KB (58 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/authentik/refs/heads/main/openapi/authentik-events-api-openapi.yml