Authentik RBAC API

Role-based access control — roles, global and object-level permissions, and initial permission sets.

Documentation GitHub OpenAPI

Business capability

Operations 22

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /rbac/initial_permissions/ List initial permission sets · Rbac initial permissions list #

Ask an LLM

“Which initial permission sets are configured for newly created objects?”

“Can I search initial permissions by name?”

Tell an agent

List all initial permission sets.

Find initial permission sets named {name}.

POST /rbac/initial_permissions/ Create an initial permission set · Rbac initial permissions create #

Ask an LLM

“How do I grant a role permissions automatically on objects a user creates?”

“What does a new initial permissions entry need besides a role?”

Tell an agent

Create initial permissions {name} for role {role}.

Set up initial permissions {name} giving role {role} the permissions {permissions}.

GET /rbac/initial_permissions/{id}/ Get one initial permission set · Rbac initial permissions retrieve #

Ask an LLM

“What role and permissions does a specific initial permissions entry grant?”

“How do I look up one initial permission set by ID?”

Tell an agent

Show initial permission set {id}.

Get the role and permissions of initial permissions entry {id}.

PUT /rbac/initial_permissions/{id}/ Replace an initial permission set · Rbac initial permissions update #

Ask an LLM

“How do I fully overwrite an existing initial permissions entry?”

“Can I reassign an initial permission set to a different role in one full update?”

Tell an agent

Replace initial permission set {id} with name {name} and role {role}.

Overwrite initial permissions {id}: name {name}, role {role}, permissions {permissions}.

PATCH /rbac/initial_permissions/{id}/ Patch fields of an initial permission set · Rbac initial permissions partial update #

Ask an LLM

“Can I change only the permissions list on an initial permission set?”

“Is there a way to rename an initial permissions entry without resending everything?”

Tell an agent

Patch initial permission set {id} to grant only {permissions}.

Rename initial permissions entry {id} to {name}.

DELETE /rbac/initial_permissions/{id}/ Delete an initial permission set · Rbac initial permissions destroy #

Ask an LLM

“How do I stop auto-granting permissions on new objects by removing an initial permission set?”

“Can I delete an initial permissions entry?”

Tell an agent destructive · confirm first

Delete initial permission set {id}.

Remove the initial permissions entry {id}.

GET /rbac/initial_permissions/{id}/used_by/ See what uses an initial permission set · Rbac initial permissions used by list #

Ask an LLM

“Which objects reference a given initial permissions entry?”

“What depends on this initial permission set before I remove it?”

Tell an agent

List objects that use initial permission set {id}.

Show dependents of initial permissions entry {id}.

GET /rbac/permissions/ List available permissions · Rbac permissions list #

Ask an LLM

“Which permissions exist in authentik that I can grant to roles?”

“Can I filter the permission catalog by app label or model?”

Tell an agent

List all available permissions.

Show permissions for app {app_label} and model {model}.

GET /rbac/permissions/{id}/ Get one permission definition · Rbac permissions retrieve #

Ask an LLM

“What does a single permission with a given ID cover?”

“How do I look up one permission's codename and model?”

Tell an agent

Show permission {id}.

Get the codename and model of permission {id}.

GET /rbac/permissions/assigned_by_roles/ List roles holding permissions on an object · Rbac permissions assigned by roles list #

Ask an LLM

“Which roles have permissions on a specific object?”

“Who has been granted access to one model instance through roles?”

Tell an agent

Show which roles hold permissions on model {model}.

List role permissions on {model} object {object_pk}.

POST /rbac/permissions/assigned_by_roles/{uuid}/assign/ Grant permissions to a role · Rbac permissions assigned by roles assign #

Ask an LLM

“How do I give a role permissions globally across authentik?”

“Can I grant a role permissions on just one specific object?”

Tell an agent

Grant role {uuid} the permissions {permissions} globally.

Assign {permissions} to role {uuid} only on {model} object {object_pk}.

PATCH /rbac/permissions/assigned_by_roles/{uuid}/unassign/ Revoke permissions from a role · Rbac permissions assigned by roles unassign partial update #

Ask an LLM

“How do I take permissions away from a role?”

“Can I revoke a role's permissions on one object while keeping its global ones?”

Tell an agent destructive · confirm first

Revoke {permissions} from role {uuid}.

Unassign {permissions} from role {uuid} for {model} object {object_pk}.

GET /rbac/permissions/roles/ List a role's object permissions · Rbac permissions roles list #

Ask an LLM

“What object-level permissions has a given role been assigned?”

“Can I see every per-object grant a role holds?”

Tell an agent

Show the object permissions assigned to role {uuid}.

List per-object grants for role {uuid} matching {search}.

GET /rbac/roles/ List roles · Rbac roles list #

Ask an LLM

“What roles are defined in authentik?”

“Which roles does a given user have, including inherited ones?”

Tell an agent

List all roles.

Show roles for user {users}, including inherited: {inherited}.

POST /rbac/roles/ Create a role · Rbac roles create #

Ask an LLM

“How do I create a new role for grouping permissions?”

“What is needed to add a role in authentik?”

Tell an agent

Create a role named {name}.

Add a new RBAC role called {name}.

GET /rbac/roles/{uuid}/ Get one role · Rbac roles retrieve #

Ask an LLM

“What are the details of a specific role?”

“How do I look up a role by its UUID?”

Tell an agent

Show role {uuid}.

Get the details of RBAC role {uuid}.

PUT /rbac/roles/{uuid}/ Replace a role · Rbac roles update #

Ask an LLM

“How do I do a full update of a role's definition?”

“Can I overwrite a role record with a PUT?”

Tell an agent

Replace role {uuid} with name {name}.

Fully update RBAC role {uuid}, setting its name to {name}.

PATCH /rbac/roles/{uuid}/ Rename a role · Rbac roles partial update #

Ask an LLM

“Can I just rename a role without a full update?”

“Is there a patch call to change a role's name?”

Tell an agent

Rename role {uuid} to {name}.

Patch RBAC role {uuid} so it is called {name}.

DELETE /rbac/roles/{uuid}/ Delete a role · Rbac roles destroy #

Ask an LLM

“How do I delete a role I no longer need?”

“Can I remove an RBAC role permanently?”

Tell an agent destructive · confirm first

Delete role {uuid}.

Permanently remove RBAC role {uuid}.

POST /rbac/roles/{uuid}/add_user/ Add a user to a role · Rbac roles add user create #

Ask an LLM

“How do I put a user into a role?”

“Can I assign a role directly to one user?”

Tell an agent

Add user {pk} to role {uuid}.

Give user {pk} the role {uuid}.

POST /rbac/roles/{uuid}/remove_user/ Remove a user from a role · Rbac roles remove user create #

Ask an LLM

“How do I take a user out of a role?”

“Can I revoke a role from one specific user?”

Tell an agent destructive · confirm first

Remove user {pk} from role {uuid}.

Revoke role {uuid} from user {pk}.

GET /rbac/roles/{uuid}/used_by/ See what uses a role · Rbac roles used by list #

Ask an LLM

“Which objects reference a given role?”

“What depends on this role before I delete it?”

Tell an agent

List everything that uses role {uuid}.

Show dependents of RBAC role {uuid}.

Authentik RBAC API

Operations 22

Documentation

Specifications

SDKs

Other Resources

Work with this as data

MCP server

Tools for apis

Call it yourself

Get an API key

OpenAPI Specification