Authentik Requests API
Privileged access management — access request rules, rule bindings, grant requests, reviewer workflows and grant revocation.
Privileged access management — access request rules, rule bindings, grant requests, reviewer workflows and grant revocation.
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/authentik-requests-api"
curl "https://apis.io/api/v1/apis?limit=25"
Discovery needs no key. Ratings and market analysis are Pro.
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.2.0
info:
title: authentik Requests API
version: 2026.11.0-rc1
description: Making authentication simple.
contact:
email: hello@goauthentik.io
license:
name: MIT
url: https://github.com/goauthentik/authentik/blob/main/LICENSE
x-source-url: https://api.goauthentik.io/schema.yml
x-last-validated: '2026-09-04'
servers:
- url: /api/v3
tags:
- name: requests
paths:
/requests/grant-requests/:
get:
operationId: requests_grant_requests_list
parameters:
- in: query
name: agent_owner
schema:
type: integer
- in: query
name: created_by
schema:
type: integer
- $ref: '#/components/parameters/QueryPaginationOrdering'
- $ref: '#/components/parameters/QueryPaginationPage'
- $ref: '#/components/parameters/QueryPaginationPageSize'
- $ref: '#/components/parameters/QuerySearch'
- in: query
name: status
schema:
$ref: '#/components/schemas/RequestStatus'
tags:
- requests
security:
- authentik: []
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/PaginatedGrantRequestList'
description: ''
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
post:
operationId: requests_grant_requests_create
tags:
- requests
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/GrantRequestCreateRequest'
required: true
security:
- authentik: []
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/Link'
description: ''
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
/requests/grant-requests/{uuid}/:
get:
operationId: requests_grant_requests_retrieve
parameters:
- in: path
name: uuid
schema:
type: string
format: uuid
description: A UUID string identifying this Grant Request.
required: true
tags:
- requests
security:
- authentik: []
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/GrantRequest'
description: ''
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
delete:
operationId: requests_grant_requests_destroy
parameters:
- in: path
name: uuid
schema:
type: string
format: uuid
description: A UUID string identifying this Grant Request.
required: true
tags:
- requests
security:
- authentik: []
responses:
'204':
description: No response body
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
/requests/grant-requests/{uuid}/fulfill/:
patch:
operationId: requests_grant_requests_fulfill_partial_update
parameters:
- in: path
name: uuid
schema:
type: string
format: uuid
description: A UUID string identifying this Grant Request.
required: true
tags:
- requests
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/PatchedGrantRequestFulfillRequest'
security:
- authentik: []
responses:
'204':
description: Request fulfilled
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
/requests/grant-requests/{uuid}/revoke/:
delete:
operationId: requests_grant_requests_revoke_destroy
description: 'Immediately end an active grant. Available to the same reviewers who could
approve it in the first place.'
parameters:
- in: path
name: uuid
schema:
type: string
format: uuid
description: A UUID string identifying this Grant Request.
required: true
tags:
- requests
security:
- authentik: []
responses:
'204':
description: Grant revoked
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
/requests/grant-requests/agent/:
post:
operationId: requests_grant_requests_agent_create
description: 'Delegate access an agent''s owner already holds to the agent, time-boxed. Unlike
`create` this persists the request directly instead of returning a flow link -- an agent
authenticates with an API token and has no browser to run a flow in, so no justification
is ever collected. That is why the agent may only ask for what its owner already has:
the owner''s approval is then the whole decision, and no reviewer is asked to judge a
request with nothing in it. The returned `fulfill_url` is what the agent hands to its
owner so they can act on it.'
tags:
- requests
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/AgentGrantRequestCreateRequest'
required: true
security:
- authentik: []
responses:
'201':
content:
application/json:
schema:
$ref: '#/components/schemas/AgentGrantRequestCreated'
description: ''
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
/requests/grant-requests/pending_review/:
get:
operationId: requests_grant_requests_pending_review_list
description: List pending grant requests the current user is eligible to review.
parameters:
- in: query
name: agent_owner
schema:
type: integer
- in: query
name: created_by
schema:
type: integer
- $ref: '#/components/parameters/QueryPaginationOrdering'
- $ref: '#/components/parameters/QueryPaginationPage'
- $ref: '#/components/parameters/QueryPaginationPageSize'
- $ref: '#/components/parameters/QuerySearch'
- in: query
name: status
schema:
$ref: '#/components/schemas/RequestStatus'
tags:
- requests
security:
- authentik: []
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/PaginatedGrantRequestList'
description: ''
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
/requests/rule-bindings/:
get:
operationId: requests_rule_bindings_list
description: Mixin to add a used_by endpoint to return a list of all objects using this object
parameters:
- $ref: '#/components/parameters/QueryPaginationOrdering'
- $ref: '#/components/parameters/QueryPaginationPage'
- $ref: '#/components/parameters/QueryPaginationPageSize'
- in: query
name: rule
schema:
type: string
format: uuid
- $ref: '#/components/parameters/QuerySearch'
- in: query
name: target
schema:
type: string
format: uuid
tags:
- requests
security:
- authentik: []
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/PaginatedRequestRuleBindingList'
description: ''
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
post:
operationId: requests_rule_bindings_create
description: Mixin to add a used_by endpoint to return a list of all objects using this object
tags:
- requests
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/RequestRuleBindingRequest'
required: true
security:
- authentik: []
responses:
'201':
content:
application/json:
schema:
$ref: '#/components/schemas/RequestRuleBinding'
description: ''
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
/requests/rule-bindings/{uuid}/:
get:
operationId: requests_rule_bindings_retrieve
description: Mixin to add a used_by endpoint to return a list of all objects using this object
parameters:
- in: path
name: uuid
schema:
type: string
format: uuid
description: A UUID string identifying this Request Rule Binding.
required: true
tags:
- requests
security:
- authentik: []
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/RequestRuleBinding'
description: ''
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
put:
operationId: requests_rule_bindings_update
description: Mixin to add a used_by endpoint to return a list of all objects using this object
parameters:
- in: path
name: uuid
schema:
type: string
format: uuid
description: A UUID string identifying this Request Rule Binding.
required: true
tags:
- requests
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/RequestRuleBindingRequest'
required: true
security:
- authentik: []
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/RequestRuleBinding'
description: ''
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
patch:
operationId: requests_rule_bindings_partial_update
description: Mixin to add a used_by endpoint to return a list of all objects using this object
parameters:
- in: path
name: uuid
schema:
type: string
format: uuid
description: A UUID string identifying this Request Rule Binding.
required: true
tags:
- requests
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/PatchedRequestRuleBindingRequest'
security:
- authentik: []
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/RequestRuleBinding'
description: ''
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
delete:
operationId: requests_rule_bindings_destroy
description: Mixin to add a used_by endpoint to return a list of all objects using this object
parameters:
- in: path
name: uuid
schema:
type: string
format: uuid
description: A UUID string identifying this Request Rule Binding.
required: true
tags:
- requests
security:
- authentik: []
responses:
'204':
description: No response body
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
/requests/rule-bindings/{uuid}/used_by/:
get:
operationId: requests_rule_bindings_used_by_list
description: Get a list of all objects that use this object
parameters:
- in: path
name: uuid
schema:
type: string
format: uuid
description: A UUID string identifying this Request Rule Binding.
required: true
tags:
- requests
security:
- authentik: []
responses:
'200':
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/UsedBy'
description: ''
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
/requests/rule-child-bindings/:
get:
operationId: requests_rule_child_bindings_list
description: Mixin to add a used_by endpoint to return a list of all objects using this object
parameters:
- in: query
name: binding
schema:
type: string
format: uuid
- $ref: '#/components/parameters/QueryPaginationOrdering'
- $ref: '#/components/parameters/QueryPaginationPage'
- $ref: '#/components/parameters/QueryPaginationPageSize'
- $ref: '#/components/parameters/QuerySearch'
- in: query
name: target
schema:
type: string
format: uuid
tags:
- requests
security:
- authentik: []
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/PaginatedRequestRuleChildBindingList'
description: ''
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
post:
operationId: requests_rule_child_bindings_create
description: Mixin to add a used_by endpoint to return a list of all objects using this object
tags:
- requests
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/RequestRuleChildBindingRequest'
required: true
security:
- authentik: []
responses:
'201':
content:
application/json:
schema:
$ref: '#/components/schemas/RequestRuleChildBinding'
description: ''
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
/requests/rule-child-bindings/{uuid}/:
get:
operationId: requests_rule_child_bindings_retrieve
description: Mixin to add a used_by endpoint to return a list of all objects using this object
parameters:
- in: path
name: uuid
schema:
type: string
format: uuid
description: A UUID string identifying this Request Rule Child Binding.
required: true
tags:
- requests
security:
- authentik: []
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/RequestRuleChildBinding'
description: ''
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
put:
operationId: requests_rule_child_bindings_update
description: Mixin to add a used_by endpoint to return a list of all objects using this object
parameters:
- in: path
name: uuid
schema:
type: string
format: uuid
description: A UUID string identifying this Request Rule Child Binding.
required: true
tags:
- requests
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/RequestRuleChildBindingRequest'
required: true
security:
- authentik: []
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/RequestRuleChildBinding'
description: ''
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
patch:
operationId: requests_rule_child_bindings_partial_update
description: Mixin to add a used_by endpoint to return a list of all objects using this object
parameters:
- in: path
name: uuid
schema:
type: string
format: uuid
description: A UUID string identifying this Request Rule Child Binding.
required: true
tags:
- requests
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/PatchedRequestRuleChildBindingRequest'
security:
- authentik: []
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/RequestRuleChildBinding'
description: ''
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
delete:
operationId: requests_rule_child_bindings_destroy
description: Mixin to add a used_by endpoint to return a list of all objects using this object
parameters:
- in: path
name: uuid
schema:
type: string
format: uuid
description: A UUID string identifying this Request Rule Child Binding.
required: true
tags:
- requests
security:
- authentik: []
responses:
'204':
description: No response body
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
/requests/rule-child-bindings/{uuid}/used_by/:
get:
operationId: requests_rule_child_bindings_used_by_list
description: Get a list of all objects that use this object
parameters:
- in: path
name: uuid
schema:
type: string
format: uuid
description: A UUID string identifying this Request Rule Child Binding.
required: true
tags:
- requests
security:
- authentik: []
responses:
'200':
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/UsedBy'
description: ''
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
/requests/rules/:
get:
operationId: requests_rules_list
description: Mixin to add a used_by endpoint to return a list of all objects using this object
parameters:
- $ref: '#/components/parameters/QueryName'
- $ref: '#/components/parameters/QueryPaginationOrdering'
- $ref: '#/components/parameters/QueryPaginationPage'
- $ref: '#/components/parameters/QueryPaginationPageSize'
- in: query
name: pbm_uuid
schema:
type: string
format: uuid
- in: query
name: request_flow__slug
schema:
type: string
- $ref: '#/components/parameters/QuerySearch'
tags:
- requests
security:
- authentik: []
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/PaginatedRequestRuleList'
description: ''
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
post:
operationId: requests_rules_create
description: Mixin to add a used_by endpoint to return a list of all objects using this object
tags:
- requests
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/RequestRuleRequest'
required: true
security:
- authentik: []
responses:
'201':
content:
application/json:
schema:
$ref: '#/components/schemas/RequestRule'
description: ''
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
/requests/rules/{uuid}/:
get:
operationId: requests_rules_retrieve
description: Mixin to add a used_by endpoint to return a list of all objects using this object
parameters:
- in: path
name: uuid
schema:
type: string
format: uuid
description: A UUID string identifying this Request Rule.
required: true
tags:
- requests
security:
- authentik: []
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/RequestRule'
description: ''
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
put:
operationId: requests_rules_update
description: Mixin to add a used_by endpoint to return a list of all objects using this object
parameters:
- in: path
name: uuid
schema:
type: string
format: uuid
description: A UUID string identifying this Request Rule.
required: true
tags:
- requests
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/RequestRuleRequest'
required: true
security:
- authentik: []
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/RequestRule'
description: ''
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
patch:
operationId: requests_rules_partial_update
description: Mixin to add a used_by endpoint to return a list of all objects using this object
parameters:
- in: path
name: uuid
schema:
type: string
format: uuid
description: A UUID string identifying this Request Rule.
required: true
tags:
- requests
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/PatchedRequestRuleRequest'
security:
- authentik: []
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/RequestRule'
description: ''
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
delete:
operationId: requests_rules_destroy
description: Mixin to add a used_by endpoint to return a list of all objects using this object
parameters:
- in: path
name: uuid
schema:
type: string
format: uuid
description: A UUID string identifying this Request Rule.
required: true
tags:
- requests
security:
- authentik: []
responses:
'204':
description: No response body
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
/requests/rules/{uuid}/used_by/:
get:
operationId: requests_rules_used_by_list
description: Get a list of all objects that use this object
parameters:
- in: path
name: uuid
schema:
type: string
format: uuid
description: A UUID string identifying this Request Rule.
required: true
tags:
- requests
security:
- authentik: []
responses:
'200':
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/UsedBy'
description: ''
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
components:
schemas:
RequestRuleBindingRequest:
type: object
description: 'Mixin to validate that a valid enterprise license
exists before allowing to save the object'
properties:
uuid:
type: string
format: uuid
policy_engine_mode:
$ref: '#/components/schemas/PolicyEngineMode'
rule:
type: string
format: uuid
target:
type: string
format: uuid
expiry_pending:
type: string
minLength: 1
description: How long a request against this binding stays pending before it automatically lapses if not approved or denied.
expiry_granted_max:
type: string
minLength: 1
description: The maximum duration a grant approved against this binding can last.
required:
- rule
- target
Link:
type: object
description: Returns a single link
properties:
link:
type: string
required:
- link
RequestableTarget:
type: object
description: 'Generic representation of a single request target: whatever was actually
requested (an Application, an Application Entitlement, ...), always paired with the
parent it belongs to, so the UI/audit trail has that context even when the
request itself was scoped narrower than the whole app.'
properties:
verbose_name:
type: string
description: Return object's verbose_name
readOnly: true
verbose_name_plural:
type: string
description: Return object's plural verbose_name
readOnly: true
meta_model_name:
type: string
description: Return internal model name
readOnly: true
pbm_uuid:
type: string
readOnly: true
label:
type: string
readOnly: true
parent:
allOf:
- $ref: '#/components/schemas/Application'
readOnly: true
required:
- label
- meta_model_name
- parent
- pbm_uuid
- verbose_name
- verbose_name_plural
RelatedTarget:
type: object
description: Simplified related target object
properties:
verbose_name:
type: string
description: Return object's verbose_name
readOnly: true
verbose_name_plural:
type: string
description: Return object's plural verbose_name
readOnly: true
meta_model_name:
type: string
description: Return internal model name
readOnly: true
pbm_uuid:
type: string
readOnly: true
label:
type: string
readOnly: true
required:
- label
- meta_model_name
- pbm_uuid
- verbose_name
- verbose_name_plural
RequestRuleChildBinding:
type: object
properties:
uuid:
type: string
format: uuid
binding:
type: string
format: uuid
target:
type: string
format: uuid
required:
- binding
- target
Provider:
type: object
description: Provider Serializer
properties:
pk:
type: integer
readOnly: true
title: ID
name:
type: string
authentication_flow:
type:
- string
- 'null'
format: uuid
description: Flow used for authentication when the associated application is accessed by an un-authenticated user.
authorization_flow:
type:
- string
- 'null'
format: uuid
description: Flow used when authorizing this provider.
invalidation_flow:
type:
- string
- 'null'
format: uuid
description: Flow used ending the session from a provider.
property_mappings:
type: array
items:
type: string
format: uuid
component:
type: string
description: Get object component so that we know how to edit the object
readOnly: true
assigned_application_slug:
type:
- string
- 'null'
description: Internal application name, used in URLs.
readOnly: true
assigned_application_name:
type:
- string
- 'null'
description: Application's display Name.
readOnly: true
assigned_backchannel_application_slug:
type:
- string
- 'null'
description: Internal application name, used in URLs.
readOnly: true
assigned_backchannel_application_name:
type:
- string
- 'null'
description: Application's display Name.
readOnly: true
verbose_name:
type: string
description: Return object's verbose_name
readOnly: true
verbose_name_plural:
type: string
description: Return object's plural verbose_name
readOnly: true
meta_model_name:
type: string
description: Return internal model name
readOnly: true
required:
- assigned_application_name
- assigned_application_slug
- assigned_backchannel_application_name
- assigned_backchannel_application_slug
- component
- meta_model_name
- name
- pk
- verbose_name
- verbose_name_plural
PatchedRequestRuleChildBindingRequest:
type: object
properties:
uuid:
type: string
format: uuid
binding:
type: string
format: uuid
target:
type: string
format: uuid
Pagination:
type: object
properties:
next:
type: number
previous:
type: number
count:
type: number
current:
type: number
total_pages:
type: number
start_index:
type: number
end_index:
type: number
required:
- count
- current
- end_index
- next
- previous
- start_index
- total_pages
GrantRequest:
type: object
description: 'Mixin to validate that a valid enterprise license
exists before allowing to save the object'
properties:
created:
type: string
format: date-time
readOnly: true
created_by:
allOf:
- $ref: '#/components/schemas/PartialUser'
readOnly: true
requester_data:
type: object
additionalProperties: {}
fulfiller_data:
type: object
additionalProperties: {}
revoked_by:
allOf:
- $ref: '#/components/schemas/PartialUser'
readOnly: true
agent_owner:
allOf:
# --- truncated at 32 KB (47 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/authentik/refs/heads/main/openapi/authentik-requests-api-openapi.yml