Authentik

Authentik Oauth2 API

The oauth2 API from Authentik — 9 operation(s) for oauth2.

GitHub OpenAPI
Business capability
Identity & Access Management BC-620.20

Operations 12

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /oauth2/access_tokens/ List issued OAuth2 access tokens · Oauth2 access tokens list #
Ask an LLM
“Which OAuth2 access tokens has authentik issued to a given user?”
“Can I see the access tokens handed out by one specific OAuth2 provider?”
Tell an agent
List all OAuth2 access tokens.
Show OAuth2 access tokens issued to user {user}.
GET /oauth2/access_tokens/{id}/ Get one OAuth2 access token · Oauth2 access tokens retrieve #
Ask an LLM
“Which user and provider does a particular access token belong to?”
“Where can I inspect a single issued OAuth2 access token by its ID?”
Tell an agent
Show the details of access token {id}.
Look up OAuth2 access token {id} and tell me who it belongs to.
DELETE /oauth2/access_tokens/{id}/ Revoke an OAuth2 access token · Oauth2 access tokens destroy #
Ask an LLM
“How do I kill an access token that was leaked?”
“Can I delete a single OAuth2 access token without touching the user's refresh token?”
Tell an agent destructive · confirm first
Delete access token {id}.
Revoke OAuth2 access token {id} right away.
GET /oauth2/access_tokens/{id}/used_by/ See what references an access token · Oauth2 access tokens used by list #
Ask an LLM
“Is anything in authentik still referencing this access token?”
“Which objects would be affected if I removed a given OAuth2 access token?”
Tell an agent
List objects that use access token {id}.
Check what depends on OAuth2 access token {id} before I delete it.
GET /oauth2/authorization_codes/ List OAuth2 authorization codes · Oauth2 authorization codes list #
Ask an LLM
“Which authorization codes are outstanding for a user?”
“Can I filter pending OAuth2 authorization codes by provider?”
Tell an agent
List all OAuth2 authorization codes.
Show authorization codes issued to user {user}.
GET /oauth2/authorization_codes/{id}/ Get one OAuth2 authorization code · Oauth2 authorization codes retrieve #
Ask an LLM
“Which user and client is a specific authorization code tied to?”
“Where can I view one OAuth2 authorization code by its ID?”
Tell an agent
Show authorization code {id}.
Get the details of OAuth2 authorization code {id}.
DELETE /oauth2/authorization_codes/{id}/ Delete an OAuth2 authorization code · Oauth2 authorization codes destroy #
Ask an LLM
“Can I invalidate an authorization code before a client exchanges it?”
“What is the way to delete an unused OAuth2 authorization code?”
Tell an agent destructive · confirm first
Delete authorization code {id}.
Invalidate OAuth2 authorization code {id} so it can't be redeemed.
GET /oauth2/authorization_codes/{id}/used_by/ See what references an authorization code · Oauth2 authorization codes used by list #
Ask an LLM
“Which objects still point at a given authorization code?”
“Is an OAuth2 authorization code referenced by anything else in authentik?”
Tell an agent
List objects that use authorization code {id}.
Show what depends on OAuth2 authorization code {id}.
GET /oauth2/refresh_tokens/ List OAuth2 refresh tokens · Oauth2 refresh tokens list #
Ask an LLM
“Which long-lived refresh tokens does a user currently hold?”
“Can I list the refresh tokens issued by one OAuth2 provider?”
Tell an agent
List all OAuth2 refresh tokens.
Show refresh tokens belonging to user {user}.
GET /oauth2/refresh_tokens/{id}/ Get one OAuth2 refresh token · Oauth2 refresh tokens retrieve #
Ask an LLM
“Which provider issued a particular refresh token, and to whom?”
“Where do I view a single OAuth2 refresh token by its ID?”
Tell an agent
Show refresh token {id}.
Get the details of OAuth2 refresh token {id}.
DELETE /oauth2/refresh_tokens/{id}/ Revoke an OAuth2 refresh token · Oauth2 refresh tokens destroy #
Ask an LLM
“How do I stop a client from minting new access tokens with a refresh token?”
“Can I delete one user's OAuth2 refresh token to force them to sign in again?”
Tell an agent destructive · confirm first
Delete refresh token {id}.
Revoke OAuth2 refresh token {id} now.
GET /oauth2/refresh_tokens/{id}/used_by/ See what references a refresh token · Oauth2 refresh tokens used by list #
Ask an LLM
“Which objects are linked to a specific refresh token?”
“Does anything else in authentik depend on this OAuth2 refresh token?”
Tell an agent
List objects that use refresh token {id}.
Check what depends on OAuth2 refresh token {id} before revoking it.

Documentation

📖
Documentation
https://docs.goauthentik.io
📖
APIReference
https://api.goauthentik.io/

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/authentik/refs/heads/main/openapi/authentik-oauth2-api-openapi.yml

SDKs

📦
GitHubRepository
https://github.com/goauthentik/authentik

Other Resources

🔗
SDKs
https://www.npmjs.com/package/@goauthentik/api
🔗
SDKs
https://pypi.org/project/authentik-client/

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/authentik:authentik-oauth2-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

authentik-oauth2-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: authentik Oauth2 API
  version: 2026.11.0-rc1
  description: Making authentication simple.
  contact:
    email: hello@goauthentik.io
  license:
    name: MIT
    url: https://github.com/goauthentik/authentik/blob/main/LICENSE
  x-source-url: https://api.goauthentik.io/schema.yml
  x-last-validated: '2026-09-04'
servers:
- url: /api/v3
tags:
- name: OAuth2
paths:
  /oauth2/access_tokens/:
    get:
      operationId: oauth2_access_tokens_list
      description: AccessToken Viewset
      parameters:
      - $ref: '#/components/parameters/QueryPaginationOrdering'
      - $ref: '#/components/parameters/QueryPaginationPage'
      - $ref: '#/components/parameters/QueryPaginationPageSize'
      - in: query
        name: provider
        schema:
          type: integer
      - $ref: '#/components/parameters/QuerySearch'
      - in: query
        name: user
        schema:
          type: integer
      tags:
      - OAuth2
      security:
      - authentik: []
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedTokenModelList'
          description: ''
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
      summary: Oauth2 access tokens list
      x-summary-source: derived
  /oauth2/access_tokens/{id}/:
    get:
      operationId: oauth2_access_tokens_retrieve
      description: AccessToken Viewset
      parameters:
      - in: path
        name: id
        schema:
          type: integer
        description: A unique integer value identifying this OAuth2 Access Token.
        required: true
      tags:
      - OAuth2
      security:
      - authentik: []
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenModel'
          description: ''
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
      summary: Oauth2 access tokens retrieve
      x-summary-source: derived
    delete:
      operationId: oauth2_access_tokens_destroy
      description: AccessToken Viewset
      parameters:
      - in: path
        name: id
        schema:
          type: integer
        description: A unique integer value identifying this OAuth2 Access Token.
        required: true
      tags:
      - OAuth2
      security:
      - authentik: []
      responses:
        '204':
          description: No response body
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
      summary: Oauth2 access tokens destroy
      x-summary-source: derived
  /oauth2/access_tokens/{id}/used_by/:
    get:
      operationId: oauth2_access_tokens_used_by_list
      description: Get a list of all objects that use this object
      parameters:
      - in: path
        name: id
        schema:
          type: integer
        description: A unique integer value identifying this OAuth2 Access Token.
        required: true
      tags:
      - OAuth2
      security:
      - authentik: []
      responses:
        '200':
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/UsedBy'
          description: ''
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
      summary: Oauth2 access tokens used by list
      x-summary-source: derived
  /oauth2/authorization_codes/:
    get:
      operationId: oauth2_authorization_codes_list
      description: AuthorizationCode Viewset
      parameters:
      - $ref: '#/components/parameters/QueryPaginationOrdering'
      - $ref: '#/components/parameters/QueryPaginationPage'
      - $ref: '#/components/parameters/QueryPaginationPageSize'
      - in: query
        name: provider
        schema:
          type: integer
      - $ref: '#/components/parameters/QuerySearch'
      - in: query
        name: user
        schema:
          type: integer
      tags:
      - OAuth2
      security:
      - authentik: []
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedExpiringBaseGrantModelList'
          description: ''
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
      summary: Oauth2 authorization codes list
      x-summary-source: derived
  /oauth2/authorization_codes/{id}/:
    get:
      operationId: oauth2_authorization_codes_retrieve
      description: AuthorizationCode Viewset
      parameters:
      - in: path
        name: id
        schema:
          type: integer
        description: A unique integer value identifying this Authorization Code.
        required: true
      tags:
      - OAuth2
      security:
      - authentik: []
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExpiringBaseGrantModel'
          description: ''
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
      summary: Oauth2 authorization codes retrieve
      x-summary-source: derived
    delete:
      operationId: oauth2_authorization_codes_destroy
      description: AuthorizationCode Viewset
      parameters:
      - in: path
        name: id
        schema:
          type: integer
        description: A unique integer value identifying this Authorization Code.
        required: true
      tags:
      - OAuth2
      security:
      - authentik: []
      responses:
        '204':
          description: No response body
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
      summary: Oauth2 authorization codes destroy
      x-summary-source: derived
  /oauth2/authorization_codes/{id}/used_by/:
    get:
      operationId: oauth2_authorization_codes_used_by_list
      description: Get a list of all objects that use this object
      parameters:
      - in: path
        name: id
        schema:
          type: integer
        description: A unique integer value identifying this Authorization Code.
        required: true
      tags:
      - OAuth2
      security:
      - authentik: []
      responses:
        '200':
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/UsedBy'
          description: ''
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
      summary: Oauth2 authorization codes used by list
      x-summary-source: derived
  /oauth2/refresh_tokens/:
    get:
      operationId: oauth2_refresh_tokens_list
      description: RefreshToken Viewset
      parameters:
      - $ref: '#/components/parameters/QueryPaginationOrdering'
      - $ref: '#/components/parameters/QueryPaginationPage'
      - $ref: '#/components/parameters/QueryPaginationPageSize'
      - in: query
        name: provider
        schema:
          type: integer
      - $ref: '#/components/parameters/QuerySearch'
      - in: query
        name: user
        schema:
          type: integer
      tags:
      - OAuth2
      security:
      - authentik: []
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedTokenModelList'
          description: ''
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
      summary: Oauth2 refresh tokens list
      x-summary-source: derived
  /oauth2/refresh_tokens/{id}/:
    get:
      operationId: oauth2_refresh_tokens_retrieve
      description: RefreshToken Viewset
      parameters:
      - in: path
        name: id
        schema:
          type: integer
        description: A unique integer value identifying this OAuth2 Refresh Token.
        required: true
      tags:
      - OAuth2
      security:
      - authentik: []
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenModel'
          description: ''
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
      summary: Oauth2 refresh tokens retrieve
      x-summary-source: derived
    delete:
      operationId: oauth2_refresh_tokens_destroy
      description: RefreshToken Viewset
      parameters:
      - in: path
        name: id
        schema:
          type: integer
        description: A unique integer value identifying this OAuth2 Refresh Token.
        required: true
      tags:
      - OAuth2
      security:
      - authentik: []
      responses:
        '204':
          description: No response body
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
      summary: Oauth2 refresh tokens destroy
      x-summary-source: derived
  /oauth2/refresh_tokens/{id}/used_by/:
    get:
      operationId: oauth2_refresh_tokens_used_by_list
      description: Get a list of all objects that use this object
      parameters:
      - in: path
        name: id
        schema:
          type: integer
        description: A unique integer value identifying this OAuth2 Refresh Token.
        required: true
      tags:
      - OAuth2
      security:
      - authentik: []
      responses:
        '200':
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/UsedBy'
          description: ''
        '400':
          $ref: '#/components/responses/ValidationErrorResponse'
        '403':
          $ref: '#/components/responses/GenericErrorResponse'
      summary: Oauth2 refresh tokens used by list
      x-summary-source: derived
components:
  responses:
    GenericErrorResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/GenericError'
      description: ''
    ValidationErrorResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ValidationError'
      description: ''
  schemas:
    UsedBy:
      type: object
      description: A list of all objects referencing the queried object
      properties:
        app:
          type: string
        model_name:
          type: string
        pk:
          type: string
        name:
          type: string
        action:
          $ref: '#/components/schemas/UsedByActionEnum'
      required:
      - action
      - app
      - model_name
      - name
      - pk
    TokenModel:
      type: object
      description: Serializer for BaseGrantModel and RefreshToken
      properties:
        pk:
          type: integer
          readOnly: true
          title: ID
        provider:
          $ref: '#/components/schemas/Provider'
        user:
          $ref: '#/components/schemas/User'
        is_expired:
          type: boolean
          description: Check if token is expired yet.
          readOnly: true
        expires:
          type:
          - string
          - 'null'
          format: date-time
        scope:
          type: array
          items:
            type: string
        id_token:
          type: string
          description: Get the token's id_token as JSON String
          readOnly: true
        revoked:
          type: boolean
      required:
      - id_token
      - is_expired
      - pk
      - provider
      - scope
      - user
    User:
      type: object
      description: User Serializer
      properties:
        pk:
          type: integer
          readOnly: true
          title: ID
        username:
          type: string
          maxLength: 150
        name:
          type: string
          description: User's display name.
        is_active:
          type: boolean
          title: Active
          description: Designates whether this user should be treated as active. Unselect this instead of deleting accounts.
        last_login:
          type:
          - string
          - 'null'
          format: date-time
        date_joined:
          type: string
          format: date-time
          readOnly: true
        is_superuser:
          type: boolean
          readOnly: true
        groups:
          type: array
          items:
            type: string
            format: uuid
        groups_obj:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/PartialGroup'
          readOnly: true
        roles:
          type: array
          items:
            type: string
            format: uuid
        roles_obj:
          type:
          - array
          - 'null'
          items:
            $ref: '#/components/schemas/Role'
          readOnly: true
        email:
          type: string
          format: email
          title: Email address
          maxLength: 254
        avatar:
          type: string
          description: User's avatar, either a http/https URL or a data URI
          readOnly: true
        attributes:
          type: object
          additionalProperties: {}
        uid:
          type: string
          readOnly: true
        path:
          type: string
        type:
          $ref: '#/components/schemas/UserTypeEnum'
        uuid:
          type: string
          format: uuid
          readOnly: true
        password_change_date:
          type: string
          format: date-time
          readOnly: true
        last_updated:
          type: string
          format: date-time
          readOnly: true
      required:
      - avatar
      - date_joined
      - groups_obj
      - is_superuser
      - last_updated
      - name
      - password_change_date
      - pk
      - roles_obj
      - uid
      - username
      - uuid
    UsedByActionEnum:
      enum:
      - cascade
      - cascade_many
      - set_null
      - set_default
      - left_dangling
      type: string
    ExpiringBaseGrantModel:
      type: object
      description: Serializer for BaseGrantModel and ExpiringBaseGrant
      properties:
        pk:
          type: integer
          readOnly: true
          title: ID
        provider:
          $ref: '#/components/schemas/Provider'
        user:
          $ref: '#/components/schemas/User'
        is_expired:
          type: boolean
          description: Check if token is expired yet.
          readOnly: true
        expires:
          type:
          - string
          - 'null'
          format: date-time
        scope:
          type: array
          items:
            type: string
      required:
      - is_expired
      - pk
      - provider
      - scope
      - user
    UserTypeEnum:
      enum:
      - internal
      - external
      - service_account
      - internal_service_account
      type: string
    ValidationError:
      type: object
      description: Validation Error
      properties:
        non_field_errors:
          type: array
          items:
            type: string
        code:
          type: string
      additionalProperties: {}
    PaginatedTokenModelList:
      type: object
      properties:
        pagination:
          $ref: '#/components/schemas/Pagination'
        results:
          type: array
          items:
            $ref: '#/components/schemas/TokenModel'
        autocomplete:
          $ref: '#/components/schemas/Autocomplete'
      required:
      - autocomplete
      - pagination
      - results
    Provider:
      type: object
      description: Provider Serializer
      properties:
        pk:
          type: integer
          readOnly: true
          title: ID
        name:
          type: string
        authentication_flow:
          type:
          - string
          - 'null'
          format: uuid
          description: Flow used for authentication when the associated application is accessed by an un-authenticated user.
        authorization_flow:
          type:
          - string
          - 'null'
          format: uuid
          description: Flow used when authorizing this provider.
        invalidation_flow:
          type:
          - string
          - 'null'
          format: uuid
          description: Flow used ending the session from a provider.
        property_mappings:
          type: array
          items:
            type: string
            format: uuid
        component:
          type: string
          description: Get object component so that we know how to edit the object
          readOnly: true
        assigned_application_slug:
          type:
          - string
          - 'null'
          description: Internal application name, used in URLs.
          readOnly: true
        assigned_application_name:
          type:
          - string
          - 'null'
          description: Application's display Name.
          readOnly: true
        assigned_backchannel_application_slug:
          type:
          - string
          - 'null'
          description: Internal application name, used in URLs.
          readOnly: true
        assigned_backchannel_application_name:
          type:
          - string
          - 'null'
          description: Application's display Name.
          readOnly: true
        verbose_name:
          type: string
          description: Return object's verbose_name
          readOnly: true
        verbose_name_plural:
          type: string
          description: Return object's plural verbose_name
          readOnly: true
        meta_model_name:
          type: string
          description: Return internal model name
          readOnly: true
      required:
      - assigned_application_name
      - assigned_application_slug
      - assigned_backchannel_application_name
      - assigned_backchannel_application_slug
      - component
      - meta_model_name
      - name
      - pk
      - verbose_name
      - verbose_name_plural
    PartialGroup:
      type: object
      description: Partial Group Serializer, does not include child relations.
      properties:
        pk:
          type: string
          format: uuid
          readOnly: true
          title: Group uuid
        num_pk:
          type: integer
          description: Get a numerical, int32 ID for the group
          readOnly: true
        name:
          type: string
        is_superuser:
          type: boolean
          description: Users added to this group will be superusers.
        attributes:
          type: object
          additionalProperties: {}
      required:
      - name
      - num_pk
      - pk
    Role:
      type: object
      description: Role serializer
      properties:
        pk:
          type: string
          format: uuid
          readOnly: true
          title: Uuid
        name:
          type: string
      required:
      - name
      - pk
    Autocomplete:
      type: object
      additionalProperties: {}
    GenericError:
      type: object
      description: Generic API Error
      properties:
        detail:
          type: string
        code:
          type: string
      required:
      - detail
    PaginatedExpiringBaseGrantModelList:
      type: object
      properties:
        pagination:
          $ref: '#/components/schemas/Pagination'
        results:
          type: array
          items:
            $ref: '#/components/schemas/ExpiringBaseGrantModel'
        autocomplete:
          $ref: '#/components/schemas/Autocomplete'
      required:
      - autocomplete
      - pagination
      - results
    Pagination:
      type: object
      properties:
        next:
          type: number
        previous:
          type: number
        count:
          type: number
        current:
          type: number
        total_pages:
          type: number
        start_index:
          type: number
        end_index:
          type: number
      required:
      - count
      - current
      - end_index
      - next
      - previous
      - start_index
      - total_pages
  parameters:
    QueryPaginationOrdering:
      in: query
      name: ordering
      schema:
        type: string
      description: Which field to use when ordering the results.
    QueryPaginationPageSize:
      in: query
      name: page_size
      schema:
        type: integer
      description: Number of results to return per page.
    QueryPaginationPage:
      in: query
      name: page
      schema:
        type: integer
      description: A page number within the paginated result set.
    QuerySearch:
      in: query
      name: search
      schema:
        type: string
      description: A search term.
  securitySchemes:
    authentik:
      type: http
      scheme: bearer
    authentik_device_auth:
      type: http
      scheme: bearer+agent
    authentik_device_enroll:
      type: http
      scheme: bearer
    authentik_device_federation:
      type: http
      scheme: bearer