Kernel Managed Auth API

openapi: 3.2.0
info:
  title: Kernel API Keys Managed Auth API
  description: Developer tools and cloud infrastructure for AI agents to use web browsers
  version: 0.1.0
servers:
- url: https://api.onkernel.com
  description: API Server
security:
- bearerAuth: []
tags:
- name: Managed Auth
  description: Create and manage auth connections for automated credential capture and login.
paths:
  /auth/connections:
    post:
      operationId: postAuthConnections
      tags:
      - Managed Auth
      summary: Create auth connection
      description: Creates an auth connection for a profile and domain combination. If the provided profile_name does not exist, it is created automatically. Returns 409 Conflict if an auth connection already exists for the given profile and domain.
      security:
      - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ManagedAuthCreateRequest'
      responses:
        '201':
          description: Auth connection created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ManagedAuth'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '409':
          description: Auth connection already exists for this profile and domain
          content:
            application/json:
              schema:
                type: object
                required:
                - code
                - message
                - existing_id
                properties:
                  code:
                    type: string
                    example: already_exists
                  message:
                    type: string
                    example: Auth connection already exists for this profile and domain
                  existing_id:
                    type: string
                    description: ID of the existing auth connection
        '500':
          $ref: '#/components/responses/InternalError'
      x-codeSamples:
      - lang: JavaScript
        source: "import Kernel from '@onkernel/sdk';\n\nconst client = new Kernel({\n  apiKey: process.env['KERNEL_API_KEY'], // This is the default and can be omitted\n});\n\nconst managedAuth = await client.auth.connections.create({\n  domain: 'netflix.com',\n  profile_name: 'user-123',\n});\n\nconsole.log(managedAuth.id);"
      - lang: Python
        source: "import os\nfrom kernel import Kernel\n\nclient = Kernel(\n    api_key=os.environ.get(\"KERNEL_API_KEY\"),  # This is the default and can be omitted\n)\nmanaged_auth = client.auth.connections.create(\n    domain=\"netflix.com\",\n    profile_name=\"user-123\",\n)\nprint(managed_auth.id)"
      - lang: Go
        source: "package main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\n\t\"github.com/kernel/kernel-go-sdk\"\n\t\"github.com/kernel/kernel-go-sdk/option\"\n)\n\nfunc main() {\n\tclient := kernel.NewClient(\n\t\toption.WithAPIKey(\"My API Key\"),\n\t)\n\tmanagedAuth, err := client.Auth.Connections.New(context.TODO(), kernel.AuthConnectionNewParams{\n\t\tManagedAuthCreateRequest: kernel.ManagedAuthCreateRequestParam{\n\t\t\tDomain:      \"netflix.com\",\n\t\t\tProfileName: \"user-123\",\n\t\t},\n\t})\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n\tfmt.Printf(\"%+v\\n\", managedAuth.ID)\n}\n"
    get:
      operationId: getAuthConnections
      tags:
      - Managed Auth
      summary: List auth connections
      description: List auth connections with optional filters for profile_name and domain.
      security:
      - bearerAuth: []
      parameters:
      - name: profile_name
        in: query
        required: false
        schema:
          type: string
        description: Filter by profile name
      - name: domain
        in: query
        required: false
        schema:
          type: string
        description: Filter by domain
      - name: limit
        in: query
        required: false
        schema:
          type: integer
          default: 20
          maximum: 100
        description: Maximum number of results to return
      - name: offset
        in: query
        required: false
        schema:
          type: integer
          default: 0
        description: Number of results to skip
      responses:
        '200':
          description: List of auth connections
          headers:
            X-Has-More:
              schema:
                type: boolean
              description: Whether there are more results
            X-Next-Offset:
              schema:
                type: integer
              description: Offset for next page
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/ManagedAuth'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '500':
          $ref: '#/components/responses/InternalError'
      x-codeSamples:
      - lang: JavaScript
        source: "import Kernel from '@onkernel/sdk';\n\nconst client = new Kernel({\n  apiKey: process.env['KERNEL_API_KEY'], // This is the default and can be omitted\n});\n\n// Automatically fetches more pages as needed.\nfor await (const managedAuth of client.auth.connections.list()) {\n  console.log(managedAuth.id);\n}"
      - lang: Python
        source: "import os\nfrom kernel import Kernel\n\nclient = Kernel(\n    api_key=os.environ.get(\"KERNEL_API_KEY\"),  # This is the default and can be omitted\n)\npage = client.auth.connections.list()\npage = page.items[0]\nprint(page.id)"
      - lang: Go
        source: "package main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\n\t\"github.com/kernel/kernel-go-sdk\"\n\t\"github.com/kernel/kernel-go-sdk/option\"\n)\n\nfunc main() {\n\tclient := kernel.NewClient(\n\t\toption.WithAPIKey(\"My API Key\"),\n\t)\n\tpage, err := client.Auth.Connections.List(context.TODO(), kernel.AuthConnectionListParams{})\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n\tfmt.Printf(\"%+v\\n\", page)\n}\n"
  /auth/connections/{id}:
    get:
      operationId: getAuthConnectionsById
      tags:
      - Managed Auth
      summary: Get auth connection
      description: Retrieve an auth connection by its ID. Includes current flow state if a login is in progress.
      security:
      - bearerAuth: []
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
        description: Auth connection ID
      responses:
        '200':
          description: Auth connection details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ManagedAuth'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalError'
      x-codeSamples:
      - lang: JavaScript
        source: "import Kernel from '@onkernel/sdk';\n\nconst client = new Kernel({\n  apiKey: process.env['KERNEL_API_KEY'], // This is the default and can be omitted\n});\n\nconst managedAuth = await client.auth.connections.retrieve('id');\n\nconsole.log(managedAuth.id);"
      - lang: Python
        source: "import os\nfrom kernel import Kernel\n\nclient = Kernel(\n    api_key=os.environ.get(\"KERNEL_API_KEY\"),  # This is the default and can be omitted\n)\nmanaged_auth = client.auth.connections.retrieve(\n    \"id\",\n)\nprint(managed_auth.id)"
      - lang: Go
        source: "package main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\n\t\"github.com/kernel/kernel-go-sdk\"\n\t\"github.com/kernel/kernel-go-sdk/option\"\n)\n\nfunc main() {\n\tclient := kernel.NewClient(\n\t\toption.WithAPIKey(\"My API Key\"),\n\t)\n\tmanagedAuth, err := client.Auth.Connections.Get(context.TODO(), \"id\")\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n\tfmt.Printf(\"%+v\\n\", managedAuth.ID)\n}\n"
    delete:
      operationId: deleteAuthConnectionsById
      tags:
      - Managed Auth
      summary: Delete auth connection
      description: 'Deletes an auth connection and terminates its workflow. This will:

        - Delete the auth connection record

        - Terminate the Temporal workflow

        - Cancel any in-progress login flows

        '
      security:
      - bearerAuth: []
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
        description: Auth connection ID
      responses:
        '204':
          description: Auth connection deleted successfully
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalError'
      x-codeSamples:
      - lang: JavaScript
        source: "import Kernel from '@onkernel/sdk';\n\nconst client = new Kernel({\n  apiKey: process.env['KERNEL_API_KEY'], // This is the default and can be omitted\n});\n\nawait client.auth.connections.delete('id');"
      - lang: Python
        source: "import os\nfrom kernel import Kernel\n\nclient = Kernel(\n    api_key=os.environ.get(\"KERNEL_API_KEY\"),  # This is the default and can be omitted\n)\nclient.auth.connections.delete(\n    \"id\",\n)"
      - lang: Go
        source: "package main\n\nimport (\n\t\"context\"\n\n\t\"github.com/kernel/kernel-go-sdk\"\n\t\"github.com/kernel/kernel-go-sdk/option\"\n)\n\nfunc main() {\n\tclient := kernel.NewClient(\n\t\toption.WithAPIKey(\"My API Key\"),\n\t)\n\terr := client.Auth.Connections.Delete(context.TODO(), \"id\")\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n}\n"
    patch:
      operationId: patchAuthConnectionsById
      tags:
      - Managed Auth
      summary: Update auth connection
      description: Update an auth connection's configuration. Only the fields provided will be updated.
      security:
      - bearerAuth: []
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
        description: Auth connection ID
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ManagedAuthUpdateRequest'
      responses:
        '200':
          description: Auth connection updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ManagedAuth'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalError'
      x-codeSamples:
      - lang: JavaScript
        source: "import Kernel from '@onkernel/sdk';\n\nconst client = new Kernel({\n  apiKey: process.env['KERNEL_API_KEY'], // This is the default and can be omitted\n});\n\nconst managedAuth = await client.auth.connections.update('id');\n\nconsole.log(managedAuth.id);"
      - lang: Python
        source: "import os\nfrom kernel import Kernel\n\nclient = Kernel(\n    api_key=os.environ.get(\"KERNEL_API_KEY\"),  # This is the default and can be omitted\n)\nmanaged_auth = client.auth.connections.update(\n    id=\"id\",\n)\nprint(managed_auth.id)"
      - lang: Go
        source: "package main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\n\t\"github.com/kernel/kernel-go-sdk\"\n\t\"github.com/kernel/kernel-go-sdk/option\"\n)\n\nfunc main() {\n\tclient := kernel.NewClient(\n\t\toption.WithAPIKey(\"My API Key\"),\n\t)\n\tmanagedAuth, err := client.Auth.Connections.Update(\n\t\tcontext.TODO(),\n\t\t\"id\",\n\t\tkernel.AuthConnectionUpdateParams{\n\t\t\tManagedAuthUpdateRequest: kernel.ManagedAuthUpdateRequestParam{},\n\t\t},\n\t)\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n\tfmt.Printf(\"%+v\\n\", managedAuth.ID)\n}\n"
  /auth/connections/{id}/login:
    post:
      operationId: postAuthConnectionsLogin
      tags:
      - Managed Auth
      summary: Start login flow
      description: Starts a login flow for the auth connection. Returns immediately with a hosted URL for the user to complete authentication, or triggers automatic re-auth if credentials are stored.
      security:
      - bearerAuth: []
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
        description: Auth connection ID
      requestBody:
        required: false
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LoginRequest'
      responses:
        '200':
          description: Login flow started
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LoginResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          description: Login flow already in progress
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          $ref: '#/components/responses/InternalError'
      x-codeSamples:
      - lang: JavaScript
        source: "import Kernel from '@onkernel/sdk';\n\nconst client = new Kernel({\n  apiKey: process.env['KERNEL_API_KEY'], // This is the default and can be omitted\n});\n\nconst loginResponse = await client.auth.connections.login('id');\n\nconsole.log(loginResponse.id);"
      - lang: Python
        source: "import os\nfrom kernel import Kernel\n\nclient = Kernel(\n    api_key=os.environ.get(\"KERNEL_API_KEY\"),  # This is the default and can be omitted\n)\nlogin_response = client.auth.connections.login(\n    id=\"id\",\n)\nprint(login_response.id)"
      - lang: Go
        source: "package main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\n\t\"github.com/kernel/kernel-go-sdk\"\n\t\"github.com/kernel/kernel-go-sdk/option\"\n)\n\nfunc main() {\n\tclient := kernel.NewClient(\n\t\toption.WithAPIKey(\"My API Key\"),\n\t)\n\tloginResponse, err := client.Auth.Connections.Login(\n\t\tcontext.TODO(),\n\t\t\"id\",\n\t\tkernel.AuthConnectionLoginParams{},\n\t)\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n\tfmt.Printf(\"%+v\\n\", loginResponse.ID)\n}\n"
  /auth/connections/{id}/submit:
    post:
      operationId: postAuthConnectionsSubmit
      tags:
      - Managed Auth
      summary: Submit field values
      description: Submits field values for the login form. Poll the auth connection to track progress and get results.
      security:
      - bearerAuth: []
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
        description: Auth connection ID
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SubmitFieldsRequest'
      responses:
        '202':
          description: Submission accepted for processing
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SubmitFieldsResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '422':
          $ref: '#/components/responses/BadRequest'
        '500':
          $ref: '#/components/responses/InternalError'
      x-codeSamples:
      - lang: JavaScript
        source: "import Kernel from '@onkernel/sdk';\n\nconst client = new Kernel({\n  apiKey: process.env['KERNEL_API_KEY'], // This is the default and can be omitted\n});\n\nconst submitFieldsResponse = await client.auth.connections.submit('id');\n\nconsole.log(submitFieldsResponse.accepted);"
      - lang: Python
        source: "import os\nfrom kernel import Kernel\n\nclient = Kernel(\n    api_key=os.environ.get(\"KERNEL_API_KEY\"),  # This is the default and can be omitted\n)\nsubmit_fields_response = client.auth.connections.submit(\n    id=\"id\",\n)\nprint(submit_fields_response.accepted)"
      - lang: Go
        source: "package main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\n\t\"github.com/kernel/kernel-go-sdk\"\n\t\"github.com/kernel/kernel-go-sdk/option\"\n)\n\nfunc main() {\n\tclient := kernel.NewClient(\n\t\toption.WithAPIKey(\"My API Key\"),\n\t)\n\tsubmitFieldsResponse, err := client.Auth.Connections.Submit(\n\t\tcontext.TODO(),\n\t\t\"id\",\n\t\tkernel.AuthConnectionSubmitParams{\n\t\t\tSubmitFieldsRequest: kernel.SubmitFieldsRequestParam{},\n\t\t},\n\t)\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n\tfmt.Printf(\"%+v\\n\", submitFieldsResponse.Accepted)\n}\n"
  /auth/connections/{id}/events:
    get:
      operationId: getAuthConnectionsEventsById
      tags:
      - Managed Auth
      summary: Stream login flow events via SSE
      description: 'Establishes a Server-Sent Events (SSE) stream that delivers real-time

        login flow state updates. The stream terminates automatically once

        the flow reaches a terminal state (SUCCESS, FAILED, EXPIRED, CANCELED).

        '
      security:
      - bearerAuth: []
      parameters:
      - name: id
        in: path
        required: true
        description: The auth connection ID to follow.
        schema:
          type: string
      responses:
        '200':
          description: SSE stream of auth connection state updates.
          headers:
            X-SSE-Content-Type:
              description: Media type of SSE data events (always application/json).
              schema:
                type: string
                const: application/json
          content:
            text/event-stream:
              schema:
                $ref: '#/components/schemas/ManagedAuthEvent'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalError'
      x-codeSamples:
      - lang: JavaScript
        source: "import Kernel from '@onkernel/sdk';\n\nconst client = new Kernel({\n  apiKey: process.env['KERNEL_API_KEY'], // This is the default and can be omitted\n});\n\nconst response = await client.auth.connections.follow('id');\n\nconsole.log(response);"
      - lang: Python
        source: "import os\nfrom kernel import Kernel\n\nclient = Kernel(\n    api_key=os.environ.get(\"KERNEL_API_KEY\"),  # This is the default and can be omitted\n)\nfor connection in client.auth.connections.follow(\n    \"id\",\n):\n  print(connection)"
      - lang: Go
        source: "package main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\n\t\"github.com/kernel/kernel-go-sdk\"\n\t\"github.com/kernel/kernel-go-sdk/option\"\n)\n\nfunc main() {\n\tclient := kernel.NewClient(\n\t\toption.WithAPIKey(\"My API Key\"),\n\t)\n\tstream := client.Auth.Connections.FollowStreaming(context.TODO(), \"id\")\n\tfor stream.Next() {\n\t\tfmt.Printf(\"%+v\\n\", stream.Current())\n\t}\n\terr := stream.Err()\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n}\n"
  /auth/connections/{id}/exchange:
    post:
      x-cli-skip: true
      x-stainless-skip: true
      x-hidden: true
      operationId: postAuthConnectionsExchange
      tags:
      - Managed Auth
      summary: Exchange handoff code for JWT
      description: Validates the handoff code and returns a JWT token for subsequent requests. Used by the hosted login UI.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ManagedAuthExchangeRequest'
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
        description: Auth connection ID
      responses:
        '200':
          description: Exchange successful, JWT returned
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ManagedAuthExchangeResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
        '410':
          $ref: '#/components/responses/Gone'
        '500':
          $ref: '#/components/responses/InternalError'
components:
  schemas:
    MFAType:
      type: string
      enum:
      - sms
      - call
      - email
      - totp
      - push
      - password
      - switch
      description: The MFA delivery method type. Includes 'password' for auth method selection pages and 'switch' for generic method-switcher links like "Use another method" that do not name a specific method.
      example: sms
    ManagedAuthUpdateRequest:
      type: object
      description: Request to update an auth connection's configuration
      properties:
        login_url:
          type: string
          format: uri
          description: Login page URL. Set to empty string to clear.
          example: https://netflix.com/login
        credential:
          $ref: '#/components/schemas/CredentialReference'
        allowed_domains:
          type: array
          items:
            type: string
          description: Additional domains valid for this auth flow (replaces existing list)
          example:
          - login.netflix.com
          - auth.netflix.com
        health_check_interval:
          type: integer
          minimum: 300
          maximum: 86400
          description: Interval in seconds between automatic health checks
          example: 3600
        health_checks:
          type: boolean
          description: 'Whether periodic health checks are enabled. When set to false, the system will not

            automatically verify authentication status, and `auto_reauth` has no effect on the

            automatic flow (since re-auth is only triggered by a failed scheduled health check).

            '
          example: true
        auto_reauth:
          type: boolean
          description: 'Whether automatic re-authentication is permitted for this connection. This is an opt-in

            flag only — it does not check whether re-auth is actually feasible. Even when true,

            re-auth only runs when the system has what it needs to perform it (for example, saved

            credentials for the required login fields), and only after a scheduled health check

            detects an expired session — so this flag has no effect when `health_checks` is false.

            When false, expired sessions detected by a health check are marked as `NEEDS_AUTH`

            instead of attempting re-auth.

            '
          example: true
        save_credentials:
          type: boolean
          description: Whether to save credentials after every successful login
          example: true
        record_session:
          type: boolean
          description: Whether to record browser sessions for this connection by default
          example: false
        proxy:
          $ref: '#/components/schemas/ProxyRef'
      additionalProperties: false
    LoginResponse:
      type: object
      description: Response from starting a login flow
      required:
      - id
      - flow_type
      - hosted_url
      - flow_expires_at
      properties:
        id:
          type: string
          description: Auth connection ID
          example: ma_abc123xyz
        flow_type:
          type: string
          enum:
          - LOGIN
          - REAUTH
          description: Type of login flow started
          example: LOGIN
        hosted_url:
          type: string
          format: uri
          description: URL to redirect user to for login
          example: https://auth.kernel.com/login/abc123xyz
        flow_expires_at:
          type: string
          format: date-time
          description: When the login flow expires
          example: '2025-11-05T20:00:00Z'
        handoff_code:
          type: string
          description: One-time code for handoff (internal use)
          example: aBcD123EfGh456IjKl789MnOp012QrStUvWxYzAbCdEf
        live_view_url:
          type: string
          format: uri
          description: Browser live view URL for watching the login flow
          example: https://live.onkernel.com/abc123xyz
      additionalProperties: false
    ManagedAuthExchangeRequest:
      type: object
      description: Request to exchange handoff code for JWT
      required:
      - code
      properties:
        code:
          type: string
          description: Handoff code from start endpoint
          example: abc123xyz
      additionalProperties: false
    LoginRequest:
      type: object
      description: Request to start a login flow
      properties:
        proxy:
          $ref: '#/components/schemas/ProxyRef'
        record_session:
          type: boolean
          description: Override the connection's default for recording this login's browser session. When omitted, the connection's record_session default is used.
          example: true
      additionalProperties: false
    ManagedAuthExchangeResponse:
      type: object
      description: Response from exchange endpoint
      required:
      - invocation_id
      - jwt
      properties:
        invocation_id:
          type: string
          description: Invocation ID
          example: abc123xyz
        jwt:
          type: string
          description: JWT token with invocation_id claim (30 minute TTL)
          example: eyJ0eXAi...
      additionalProperties: false
    ErrorDetail:
      type: object
      properties:
        code:
          type: string
          description: Lower-level error code providing more specific detail
          example: invalid_input
        message:
          type: string
          description: Further detail about the error
          example: Provided version string is not semver compliant
    ManagedAuth:
      type: object
      description: Managed authentication that keeps a profile logged into a specific domain. Flow fields (flow_status, flow_step, discovered_fields, mfa_options) reflect the most recent login flow and are null when no flow has been initiated.
      required:
      - id
      - profile_name
      - domain
      - status
      - save_credentials
      - record_session
      properties:
        id:
          type: string
          description: Unique identifier for the auth connection
          example: ma_abc123xyz
        profile_name:
          type: string
          description: Name of the profile associated with this auth connection
          example: my-netflix-profile
        domain:
          type: string
          description: Target domain for authentication
          example: netflix.com
        status:
          type: string
          enum:
          - AUTHENTICATED
          - NEEDS_AUTH
          description: Current authentication status of the managed profile
          example: AUTHENTICATED
        last_auth_check_at:
          type: string
          format: date-time
          description: When the most recent auth health check ran for this connection, regardless of outcome. Updated on every health check and does not by itself indicate that the profile is currently authenticated - use `status` for that. May be newer than `flow_expires_at` when a flow is still in progress because health checks continue to run in parallel.
          example: '2025-01-15T10:30:00Z'
        last_auth_at:
          type: string
          format: date-time
          deprecated: true
          description: Deprecated alias for `last_auth_check_at`. Despite the name, this is the last health-check timestamp, not the last successful authentication. Use `last_auth_check_at` instead.
          example: '2025-01-15T10:30:00Z'
        credential:
          $ref: '#/components/schemas/CredentialReference'
        can_reauth:
          type: boolean
          description: Whether Kernel can automatically re-authenticate this connection when the session expires. Requires a prior successful login plus either a Kernel credential or an external credential reference. See `can_reauth_reason` for the specific outcome.
          example: true
        can_reauth_reason:
          type: string
          description: "Machine-readable reason for the current value of `can_reauth`.\nAffirmative values (re-auth is possible):\n  - `external_credential` — an external credential provider is attached\n  - `cua_has_credential` — CUA flow with a stored credential\n  - `has_credential` — Kernel credential is attached (optimistic; plan viability not checked)\n  - `viable_plans_found` — at least one stored login plan can be replayed\n  - `no_requirements_recorded` — no recorded credential requirements to fail against\n  - `requirements_satisfiable` — recorded requirements can be met by the attached credential\n\nNegative values (a human must complete the login flow):\n  - `no_prior_successful_login` — connection has never completed a successful login\n  - `no_credential` — no Kernel or external credential attached\n  - `no_viable_plans` — credential attached but no replayable login plan exists yet\n  - `viable_plans_require_external_action` — stored plans need an external step (email link, push, etc.)\n  - `requires_external_action` — recorded requirements include an external step\n  - `requires_totp_without_secret` — flow needs a TOTP code but no TOTP secret is stored\n  - `requires_sms_code` — flow needs an SMS code that cannot be received automatically\n  - `requires_email_code` — flow needs an email code that cannot be received automatically"
          enum:
          - external_credential
          - cua_has_credential
          - has_credential
          - viable_plans_found
          - no_requirements_recorded
          - requirements_satisfiable
          - no_prior_successful_login
          - no_credential
          - no_viable_plans
          - viable_plans_require_external_action
          - requires_external_action
          - requires_totp_without_secret
          - requires_sms_code
          - requires_email_code
          example: has_credential
        proxy_id:
          type: string
          description: ID of the proxy associated with this connection, if any.
        allowed_domains:
          type: array
          items:
            type: string
          description: 'Additional domains that are valid for this auth flow (besides the primary domain). Useful when login pages redirect to different domains.


            The following SSO/OAuth provider domains are automatically allowed by default and do not need to be specified:

            - Google: accounts.google.com

            - Microsoft/Azure AD: login.microsoftonline.com, login.live.com

            - Okta: *.okta.com, *.oktapreview.com

            - Auth0: *.auth0.com, *.us.auth0.com, *.eu.auth0.com, *.au.auth0.com

            - Apple: appleid.apple.com

            - GitHub: github.com

            - Facebook/Meta: www.facebook.com

            - LinkedIn: www.linkedin.com

            - Amazon Cognito: *.amazoncognito.com

            - OneLogin: *.onelogin.com

            - Ping Identity: *.pingone.com, *.pingidentity.com

            '
          example:
          - login.netflix.com
          - auth.netflix.com
        login_url:
          type: string
          format: uri
          description: Optional login page URL to skip discovery
          example: https://example.com/login
        post_login_url:
          type: string
          format: uri
          description: URL where the browser landed after successful login
          example: https://www.netflix.com/browse
        flow_status:
          type: string
          enum:
          - IN_PROGRESS
          - SUCCESS
          - FAILED
          - EXPIRED
          - CANCELED
          nullable: true
          description: Current flow status (null when no flow in progress)
          example: IN_PROGRESS
        flow_step:
          type: string
          enum:
          - DISCOVERING
          - AWAITING_INPUT
          - AWAITING_EXTERNAL_ACTION
          - SUBMITTING
          - COMPLETED
          nullable: true
          description: Current step in the flow (null when no flow in progress)
          example: AWAITING_INPUT
        flow_type:
          type: string
          enum:
          - LOGIN
     

# --- truncated at 32 KB (54 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/kernel-so/refs/heads/main/openapi/kernel-so-managed-auth-api-openapi.yml