Authentik

Authentik Requests API

Privileged access management — access request rules, rule bindings, grant requests, reviewer workflows and grant revocation.

GitHub OpenAPI
Business capability
Identity & Access Management BC-620.20

Operations 29

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /requests/grant-requests/ List access grant requests · Requests grant requests list #
Ask an LLM
“Which access grant requests have been filed, and what status are they in?”
“Can I see only the grant requests created by one user?”
Tell an agent
List all grant requests.
Show grant requests with status {status}.
POST /requests/grant-requests/ Request access to resources · Requests grant requests create #
Ask an LLM
“How do I ask for temporary access to something I don't have yet?”
“Can I request access that expires on a set date?”
Tell an agent
Request access to {pbms}.
Open a grant request for {pbms} expiring at {expiry}.
GET /requests/grant-requests/{uuid}/ Get one grant request · Requests grant requests retrieve #
Ask an LLM
“What is the current status of a particular access request?”
“Where can I view a single grant request by its ID?”
Tell an agent
Show grant request {uuid}.
Check the status of access request {uuid}.
DELETE /requests/grant-requests/{uuid}/ Delete a grant request · Requests grant requests destroy #
Ask an LLM
“Can I withdraw and delete an access request I filed by mistake?”
“Is there a way to remove a grant request record entirely?”
Tell an agent destructive · confirm first
Delete grant request {uuid}.
Withdraw access request {uuid} and remove it.
PATCH /requests/grant-requests/{uuid}/fulfill/ Approve or deny a grant request · Requests grant requests fulfill partial update #
Ask an LLM
“How do I approve a pending access request as a reviewer?”
“Can I reject a grant request by setting its status?”
Tell an agent
Set grant request {uuid} to status {status}.
Fulfill access request {uuid} with decision data {data}.
DELETE /requests/grant-requests/{uuid}/revoke/ Revoke an active access grant · Requests grant requests revoke destroy #
Ask an LLM
“How can I end someone's temporary access before it expires?”
“Who is allowed to cut off an approved grant immediately?”
Tell an agent destructive · confirm first
Revoke the active grant {uuid} now.
End approved access from grant request {uuid} immediately.
POST /requests/grant-requests/agent/ Delegate owner access to an agent · Requests grant requests agent create #
Ask an LLM
“Can an AI agent ask its owner for time-boxed access without running a browser flow?”
“What access is an agent allowed to request from the person who owns it?”
Tell an agent
Have my agent request delegated access to {pbms} from its owner.
File an agent grant request for {pbms} and give me the fulfill link.
GET /requests/grant-requests/pending_review/ List grant requests awaiting my review · Requests grant requests pending review list #
Ask an LLM
“Which access requests am I eligible to approve right now?”
“Is anything waiting on my review in the approval queue?”
Tell an agent
Show grant requests pending my review.
List requests I can review that were filed by {created_by}.
GET /requests/rule-bindings/ List request rule bindings · Requests rule bindings list #
Ask an LLM
“Which targets have an access-request rule bound to them?”
“Can I filter rule bindings by the rule they use?”
Tell an agent
List all request rule bindings.
Show bindings for request rule {rule}.
POST /requests/rule-bindings/ Bind a request rule to a target · Requests rule bindings create #
Ask an LLM
“How do I make an application requestable under a given approval rule?”
“Can I cap how long granted access lasts when binding a rule?”
Tell an agent
Bind request rule {rule} to target {target}.
Attach rule {rule} to {target} with a maximum grant duration of {expiry_granted_max}.
GET /requests/rule-bindings/{uuid}/ Get a request rule binding · Requests rule bindings retrieve #
Ask an LLM
“What rule, target and expiry limits does one binding define?”
“Where can I view a single request rule binding?”
Tell an agent
Show request rule binding {uuid}.
Get the expiry settings of rule binding {uuid}.
PUT /requests/rule-bindings/{uuid}/ Replace a request rule binding · Requests rule bindings update #
Ask an LLM
“Can I overwrite both the rule and the target on an existing binding?”
“What does fully replacing a request rule binding require?”
Tell an agent
Replace rule binding {uuid} to bind rule {rule} to {target}.
Redefine binding {uuid} as rule {rule} on {target} with pending expiry {expiry_pending}.
PATCH /requests/rule-bindings/{uuid}/ Change some rule binding settings · Requests rule bindings partial update #
Ask an LLM
“Can I shorten only how long pending requests stay open on a binding?”
“Is it possible to switch just the policy engine mode of a rule binding?”
Tell an agent
Set pending-request expiry on rule binding {uuid} to {expiry_pending}.
Change the policy engine mode of binding {uuid} to {policy_engine_mode}.
DELETE /requests/rule-bindings/{uuid}/ Delete a request rule binding · Requests rule bindings destroy #
Ask an LLM
“How do I stop a target from being requestable under a rule?”
“Can I remove one request rule binding?”
Tell an agent destructive · confirm first
Delete request rule binding {uuid}.
Unbind the request rule in binding {uuid}.
GET /requests/rule-bindings/{uuid}/used_by/ See what uses a request rule binding · Requests rule bindings used by list #
Ask an LLM
“Which objects depend on a given request rule binding?”
“Is anything still attached to this rule binding?”
Tell an agent
List objects that use rule binding {uuid}.
Show what references request rule binding {uuid}.
GET /requests/rule-child-bindings/ List child bindings of request rules · Requests rule child bindings list #
Ask an LLM
“Which child bindings hang off a given request rule binding?”
“Can I filter child bindings by their target?”
Tell an agent
List all request rule child bindings.
Show child bindings under binding {binding}.
POST /requests/rule-child-bindings/ Add a child binding to a rule binding · Requests rule child bindings create #
Ask an LLM
“How do I extend an existing request rule binding to an additional target?”
“Can I nest a target under a rule binding as a child?”
Tell an agent
Create a child binding of {binding} for target {target}.
Nest target {target} under rule binding {binding}.
GET /requests/rule-child-bindings/{uuid}/ Get a rule child binding · Requests rule child bindings retrieve #
Ask an LLM
“Which parent binding and target does a child binding link?”
“Where can I view one request rule child binding?”
Tell an agent
Show rule child binding {uuid}.
Get the parent and target of child binding {uuid}.
PUT /requests/rule-child-bindings/{uuid}/ Replace a rule child binding · Requests rule child bindings update #
Ask an LLM
“Can I overwrite both the parent binding and target of a child binding?”
“What must I send to fully replace a child binding?”
Tell an agent
Replace child binding {uuid} with parent {binding} and target {target}.
Redefine child binding {uuid} to link {binding} to {target}.
PATCH /requests/rule-child-bindings/{uuid}/ Change a child binding's target or parent · Requests rule child bindings partial update #
Ask an LLM
“Can I move a child binding to a different target without resending its parent?”
“Is it possible to reparent only a child binding?”
Tell an agent
Point child binding {uuid} at target {target}.
Move child binding {uuid} under parent binding {binding}.
DELETE /requests/rule-child-bindings/{uuid}/ Delete a rule child binding · Requests rule child bindings destroy #
Ask an LLM
“How can I detach a nested target from a request rule binding?”
“Can I delete a single child binding?”
Tell an agent destructive · confirm first
Delete rule child binding {uuid}.
Remove nested target binding {uuid}.
GET /requests/rule-child-bindings/{uuid}/used_by/ See what uses a rule child binding · Requests rule child bindings used by list #
Ask an LLM
“Which objects reference a given child binding?”
“Does anything still depend on this nested rule binding?”
Tell an agent
List objects that use child binding {uuid}.
Show what references rule child binding {uuid}.
GET /requests/rules/ List access request rules · Requests rules list #
Ask an LLM
“Which approval rules govern access requests in authentik?”
“Can I find the request rules that use a particular request flow?”
Tell an agent
List all access request rules.
Find request rules named {name}.
POST /requests/rules/ Create an access request rule · Requests rules create #
Ask an LLM
“How do I require a minimum number of reviewers before access is granted?”
“Can a new request rule notify reviewers through my existing transports?”
Tell an agent
Create request rule {name} needing {min_reviewers} reviewers.
Add rule {name} using request flow {request_flow} and notifying via {notification_transports}.
GET /requests/rules/{uuid}/ Get an access request rule · Requests rules retrieve #
Ask an LLM
“How many reviewers and which flow does a specific request rule use?”
“Where can I view one access request rule?”
Tell an agent
Show request rule {uuid}.
Get the reviewer settings of approval rule {uuid}.
PUT /requests/rules/{uuid}/ Replace an access request rule · Requests rules update #
Ask an LLM
“Can I overwrite an approval rule's full configuration in one call?”
“What is needed to completely replace a request rule?”
Tell an agent
Replace request rule {uuid} with name {name}.
Redefine rule {uuid} as {name} requiring {min_reviewers} reviewers.
PATCH /requests/rules/{uuid}/ Change some request rule settings · Requests rules partial update #
Ask an LLM
“Can I raise only the minimum reviewer count on an existing rule?”
“Is it possible to count required reviewers per group instead of overall?”
Tell an agent
Set the minimum reviewers on rule {uuid} to {min_reviewers}.
Make reviewer counts per group on rule {uuid}: {min_reviewers_is_per_group}.
DELETE /requests/rules/{uuid}/ Delete an access request rule · Requests rules destroy #
Ask an LLM
“How do I remove an approval rule nobody uses anymore?”
“Can I delete a single access request rule?”
Tell an agent destructive · confirm first
Delete request rule {uuid}.
Remove approval rule {uuid}.
GET /requests/rules/{uuid}/used_by/ See what uses an access request rule · Requests rules used by list #
Ask an LLM
“Which bindings rely on a given approval rule?”
“Is anything still attached to this request rule?”
Tell an agent
List objects that use request rule {uuid}.
Show what references approval rule {uuid}.

Documentation

📖
Documentation
https://docs.goauthentik.io
📖
APIReference
https://api.goauthentik.io/

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/authentik/refs/heads/main/openapi/authentik-requests-api-openapi.yml

SDKs

📦
GitHubRepository
https://github.com/goauthentik/authentik

Other Resources

🔗
Overlay
https://raw.githubusercontent.com/api-evangelist/authentik/refs/heads/main/overlays/authentik-requests-api-overlay.yaml
🔗
SDKs
https://www.npmjs.com/package/@goauthentik/api
🔗
SDKs
https://pypi.org/project/authentik-client/

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/authentik:authentik-requests-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

authentik-requests-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: authentik Requests API
  version: 2026.11.0-rc1
  description: Making authentication simple.
  contact:
    email: hello@goauthentik.io
  license:
    name: MIT
    url: https://github.com/goauthentik/authentik/blob/main/LICENSE
  x-source-url: https://api.goauthentik.io/schema.yml
  x-last-validated: '2026-09-04'
servers:
- url: /api/v3
tags:


# --- truncated at 32 KB (49 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/authentik/refs/heads/main/openapi/authentik-requests-api-openapi.yml