Authentik SSF API
OpenID Shared Signals Framework streams — the SSF stream surface a receiving application manages on authentik as transmitter of Security Event Tokens.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/authentik-ssf-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: authentik Ssf API
version: 2026.11.0-rc1
description: Making authentication simple.
contact:
email: hello@goauthentik.io
license:
name: MIT
url: https://github.com/goauthentik/authentik/blob/main/LICENSE
x-source-url: https://api.goauthentik.io/schema.yml
x-last-validated: '2026-09-04'
servers:
- url: /api/v3
tags:
- name: ssf
paths:
/ssf/streams/:
get:
operationId: ssf_streams_list
description: SSFStream Viewset
parameters:
- in: query
name: delivery_method
schema:
$ref: '#/components/schemas/DeliveryMethodEnum'
- in: query
name: endpoint_url
schema:
type: string
- $ref: '#/components/parameters/QueryPaginationOrdering'
- $ref: '#/components/parameters/QueryPaginationPage'
- $ref: '#/components/parameters/QueryPaginationPageSize'
- in: query
name: provider
schema:
type: integer
- $ref: '#/components/parameters/QuerySearch'
tags:
- ssf
security:
- authentik: []
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/PaginatedSSFStreamList'
description: ''
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
/ssf/streams/{uuid}/:
get:
operationId: ssf_streams_retrieve
description: SSFStream Viewset
parameters:
- in: path
name: uuid
schema:
type: string
format: uuid
description: A UUID string identifying this SSF Stream.
required: true
tags:
- ssf
security:
- authentik: []
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/SSFStream'
description: ''
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
delete:
operationId: ssf_streams_destroy
description: SSFStream Viewset
parameters:
- in: path
name: uuid
schema:
type: string
format: uuid
description: A UUID string identifying this SSF Stream.
required: true
tags:
- ssf
security:
- authentik: []
responses:
'204':
description: No response body
'400':
$ref: '#/components/responses/ValidationErrorResponse'
'403':
$ref: '#/components/responses/GenericErrorResponse'
components:
parameters:
QueryPaginationOrdering:
in: query
name: ordering
schema:
type: string
description: Which field to use when ordering the results.
QuerySearch:
in: query
name: search
schema:
type: string
description: A search term.
QueryPaginationPage:
in: query
name: page
schema:
type: integer
description: A page number within the paginated result set.
QueryPaginationPageSize:
in: query
name: page_size
schema:
type: integer
description: Number of results to return per page.
schemas:
SSFStream:
type: object
description: SSFStream Serializer
properties:
pk:
type: string
format: uuid
readOnly: true
title: Uuid
status:
$ref: '#/components/schemas/SSFStreamStatusEnum'
provider:
type: integer
provider_obj:
allOf:
- $ref: '#/components/schemas/SSFProvider'
readOnly: true
delivery_method:
$ref: '#/components/schemas/DeliveryMethodEnum'
endpoint_url:
type:
- string
- 'null'
events_requested:
type: array
items:
$ref: '#/components/schemas/EventsRequestedEnum'
format:
type: string
aud:
type: array
items:
type: string
iss:
type: string
required:
- delivery_method
- format
- iss
- pk
- provider
- provider_obj
Token:
type: object
description: Token Serializer
properties:
pk:
type: string
format: uuid
readOnly: true
title: Token uuid
managed:
type:
- string
- 'null'
title: Managed by authentik
description: Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.
identifier:
type: string
maxLength: 255
pattern: ^[-a-zA-Z0-9_]+$
intent:
$ref: '#/components/schemas/IntentEnum'
user:
type: integer
user_obj:
allOf:
- $ref: '#/components/schemas/User'
readOnly: true
description:
type: string
expires:
type:
- string
- 'null'
format: date-time
expiring:
type: boolean
required:
- identifier
- pk
- user_obj
Role:
type: object
description: Role serializer
properties:
pk:
type: string
format: uuid
readOnly: true
title: Uuid
name:
type: string
required:
- name
- pk
SSFProvider:
type: object
description: SSFProvider Serializer
properties:
pk:
type: integer
readOnly: true
title: ID
name:
type: string
component:
type: string
description: Get object component so that we know how to edit the object
readOnly: true
verbose_name:
type: string
description: Return object's verbose_name
readOnly: true
verbose_name_plural:
type: string
description: Return object's plural verbose_name
readOnly: true
meta_model_name:
type: string
description: Return internal model name
readOnly: true
signing_key:
type: string
format: uuid
description: Key used to sign the SSF Events.
token_obj:
allOf:
- $ref: '#/components/schemas/Token'
readOnly: true
oidc_auth_providers:
type: array
items:
type: integer
oidc_auth_providers_obj:
type: array
items:
$ref: '#/components/schemas/Provider'
readOnly: true
ssf_url:
type:
- string
- 'null'
readOnly: true
event_retention:
type: string
push_verify_certificates:
type: boolean
required:
- component
- meta_model_name
- name
- oidc_auth_providers_obj
- pk
- signing_key
- ssf_url
- token_obj
- verbose_name
- verbose_name_plural
Provider:
type: object
description: Provider Serializer
properties:
pk:
type: integer
readOnly: true
title: ID
name:
type: string
authentication_flow:
type:
- string
- 'null'
format: uuid
description: Flow used for authentication when the associated application is accessed by an un-authenticated user.
authorization_flow:
type:
- string
- 'null'
format: uuid
description: Flow used when authorizing this provider.
invalidation_flow:
type:
- string
- 'null'
format: uuid
description: Flow used ending the session from a provider.
property_mappings:
type: array
items:
type: string
format: uuid
component:
type: string
description: Get object component so that we know how to edit the object
readOnly: true
assigned_application_slug:
type:
- string
- 'null'
description: Internal application name, used in URLs.
readOnly: true
assigned_application_name:
type:
- string
- 'null'
description: Application's display Name.
readOnly: true
assigned_backchannel_application_slug:
type:
- string
- 'null'
description: Internal application name, used in URLs.
readOnly: true
assigned_backchannel_application_name:
type:
- string
- 'null'
description: Application's display Name.
readOnly: true
verbose_name:
type: string
description: Return object's verbose_name
readOnly: true
verbose_name_plural:
type: string
description: Return object's plural verbose_name
readOnly: true
meta_model_name:
type: string
description: Return internal model name
readOnly: true
required:
- assigned_application_name
- assigned_application_slug
- assigned_backchannel_application_name
- assigned_backchannel_application_slug
- component
- meta_model_name
- name
- pk
- verbose_name
- verbose_name_plural
EventsRequestedEnum:
enum:
- https://schemas.openid.net/secevent/caep/event-type/session-revoked
- https://schemas.openid.net/secevent/caep/event-type/token-claims-change
- https://schemas.openid.net/secevent/caep/event-type/credential-change
- https://schemas.openid.net/secevent/caep/event-type/assurance-level-change
- https://schemas.openid.net/secevent/caep/event-type/device-compliance-change
- https://schemas.openid.net/secevent/caep/event-type/session-established
- https://schemas.openid.net/secevent/caep/event-type/session-presented
- https://schemas.openid.net/secevent/caep/event-type/risk-level-change
- https://schemas.openid.net/secevent/ssf/event-type/verification
type: string
Pagination:
type: object
properties:
next:
type: number
previous:
type: number
count:
type: number
current:
type: number
total_pages:
type: number
start_index:
type: number
end_index:
type: number
required:
- count
- current
- end_index
- next
- previous
- start_index
- total_pages
IntentEnum:
enum:
- verification
- api
- recovery
- app_password
type: string
UserTypeEnum:
enum:
- internal
- external
- service_account
- internal_service_account
type: string
User:
type: object
description: User Serializer
properties:
pk:
type: integer
readOnly: true
title: ID
username:
type: string
maxLength: 150
name:
type: string
description: User's display name.
is_active:
type: boolean
title: Active
description: Designates whether this user should be treated as active. Unselect this instead of deleting accounts.
last_login:
type:
- string
- 'null'
format: date-time
date_joined:
type: string
format: date-time
readOnly: true
is_superuser:
type: boolean
readOnly: true
groups:
type: array
items:
type: string
format: uuid
groups_obj:
type:
- array
- 'null'
items:
$ref: '#/components/schemas/PartialGroup'
readOnly: true
roles:
type: array
items:
type: string
format: uuid
roles_obj:
type:
- array
- 'null'
items:
$ref: '#/components/schemas/Role'
readOnly: true
email:
type: string
format: email
title: Email address
maxLength: 254
avatar:
type: string
description: User's avatar, either a http/https URL or a data URI
readOnly: true
attributes:
type: object
additionalProperties: {}
uid:
type: string
readOnly: true
path:
type: string
type:
$ref: '#/components/schemas/UserTypeEnum'
uuid:
type: string
format: uuid
readOnly: true
password_change_date:
type: string
format: date-time
readOnly: true
last_updated:
type: string
format: date-time
readOnly: true
required:
- avatar
- date_joined
- groups_obj
- is_superuser
- last_updated
- name
- password_change_date
- pk
- roles_obj
- uid
- username
- uuid
ValidationError:
type: object
description: Validation Error
properties:
non_field_errors:
type: array
items:
type: string
code:
type: string
additionalProperties: {}
PaginatedSSFStreamList:
type: object
properties:
pagination:
$ref: '#/components/schemas/Pagination'
results:
type: array
items:
$ref: '#/components/schemas/SSFStream'
autocomplete:
$ref: '#/components/schemas/Autocomplete'
required:
- autocomplete
- pagination
- results
SSFStreamStatusEnum:
enum:
- enabled
- paused
- disabled
- disabled_deleted
type: string
Autocomplete:
type: object
additionalProperties: {}
DeliveryMethodEnum:
enum:
- https://schemas.openid.net/secevent/risc/delivery-method/push
- https://schemas.openid.net/secevent/risc/delivery-method/poll
- urn:ietf:rfc:8935
- urn:ietf:rfc:8936
type: string
PartialGroup:
type: object
description: Partial Group Serializer, does not include child relations.
properties:
pk:
type: string
format: uuid
readOnly: true
title: Group uuid
num_pk:
type: integer
description: Get a numerical, int32 ID for the group
readOnly: true
name:
type: string
is_superuser:
type: boolean
description: Users added to this group will be superusers.
attributes:
type: object
additionalProperties: {}
required:
- name
- num_pk
- pk
GenericError:
type: object
description: Generic API Error
properties:
detail:
type: string
code:
type: string
required:
- detail
responses:
GenericErrorResponse:
content:
application/json:
schema:
$ref: '#/components/schemas/GenericError'
description: ''
ValidationErrorResponse:
content:
application/json:
schema:
$ref: '#/components/schemas/ValidationError'
description: ''
securitySchemes:
authentik:
type: http
scheme: bearer
authentik_device_auth:
type: http
scheme: bearer+agent
authentik_device_enroll:
type: http
scheme: bearer
authentik_device_federation:
type: http
scheme: bearer