Kernel Managed Auth API

openapi: 3.2.0
info:
  title: Kernel API Keys Managed Auth API
  description: Developer tools and cloud infrastructure for AI agents to use web browsers
  version: 0.1.0
servers:
- url: https://api.onkernel.com
  description: API Server
security:
- bearerAuth: []
tags:
- name: Managed Auth
  description: Create and manage auth connections for automated credential capture and login.
paths:
  /auth/connections:
    post:
      operationId: postAuthConnections
      tags:
      - Managed Auth
      summary: Create auth connection
      description: Creates an auth connection for a profile and domain combination. If the provided profile_name does not exist, it is created automatically. Returns 409 Conflict if an auth connection already exists for the given profile and domain.
      security:
      - bearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ManagedAuthCreateRequest'
      responses:
        '201':
          description: Auth connection created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ManagedAuth'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '409':
          description: Auth connection already exists for this profile and domain
          content:
            application/json:
              schema:
                type: object
                required:
                - code
                - message
                - existing_id
                properties:
                  code:
                    type: string
                    example: already_exists
                  message:
                    type: string
                    example: Auth connection already exists for this profile and domain
                  existing_id:
                    type: string
                    description: ID of the existing auth connection
        '500':
          $ref: '#/components/responses/InternalError'
      x-codeSamples:
      - lang: JavaScript
        source: "import Kernel from '@onkernel/sdk';\n\nconst client = new Kernel({\n  apiKey: process.env['KERNEL_API_KEY'], // This is the default and can be omitted\n});\n\nconst managedAuth = await client.auth.connections.create({\n  domain: 'netflix.com',\n  profile_name: 'user-123',\n});\n\nconsole.log(managedAuth.id);"
      - lang: Python
        source: "import os\nfrom kernel import Kernel\n\nclient = Kernel(\n    api_key=os.environ.get(\"KERNEL_API_KEY\"),  # This is the default and can be omitted\n)\nmanaged_auth = client.auth.connections.create(\n    domain=\"netflix.com\",\n    profile_name=\"user-123\",\n)\nprint(managed_auth.id)"
      - lang: Go
        source: "package main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\n\t\"github.com/kernel/kernel-go-sdk\"\n\t\"github.com/kernel/kernel-go-sdk/option\"\n)\n\nfunc main() {\n\tclient := kernel.NewClient(\n\t\toption.WithAPIKey(\"My API Key\"),\n\t)\n\tmanagedAuth, err := client.Auth.Connections.New(context.TODO(), kernel.AuthConnectionNewParams{\n\t\tManagedAuthCreateRequest: kernel.ManagedAuthCreateRequestParam{\n\t\t\tDomain:      \"netflix.com\",\n\t\t\tProfileName: \"user-123\",\n\t\t},\n\t})\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n\tfmt.Printf(\"%+v\\n\", managedAuth.ID)\n}\n"
    get:
      operationId: getAuthConnections
      tags:
      - Managed Auth
      summary: List auth connections
      description: List auth connections with optional filters for profile_name and domain.
      security:
      - bearerAuth: []
      parameters:
      - name: profile_name
        in: query
        required: false
        schema:
          type: string
        description: Filter by profile name
      - name: domain
        in: query
        required: false
        schema:
          type: string
        description: Filter by domain
      - name: limit
        in: query
        required: false
        schema:
          type: integer
          default: 20
          maximum: 100
        description: Maximum number of results to return
      - name: offset
        in: query
        required: false
        schema:
          type: integer
          default: 0
        description: Number of results to skip
      - name: query
        in: query
        required: false
        description: Search auth connections by ID, domain, or profile name.
        schema:
          type: string
      responses:
        '200':
          description: List of auth connections
          headers:
            X-Has-More:
              schema:
                type: boolean
              description: Whether there are more results
            X-Next-Offset:
              schema:
                type: integer
              description: The offset where the next page starts. 0 when there are no more results.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/ManagedAuth'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '500':
          $ref: '#/components/responses/InternalError'
      x-codeSamples:
      - lang: JavaScript
        source: "import Kernel from '@onkernel/sdk';\n\nconst client = new Kernel({\n  apiKey: process.env['KERNEL_API_KEY'], // This is the default and can be omitted\n});\n\n// Automatically fetches more pages as needed.\nfor await (const managedAuth of client.auth.connections.list()) {\n  console.log(managedAuth.id);\n}"
      - lang: Python
        source: "import os\nfrom kernel import Kernel\n\nclient = Kernel(\n    api_key=os.environ.get(\"KERNEL_API_KEY\"),  # This is the default and can be omitted\n)\npage = client.auth.connections.list()\npage = page.items[0]\nprint(page.id)"
      - lang: Go
        source: "package main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\n\t\"github.com/kernel/kernel-go-sdk\"\n\t\"github.com/kernel/kernel-go-sdk/option\"\n)\n\nfunc main() {\n\tclient := kernel.NewClient(\n\t\toption.WithAPIKey(\"My API Key\"),\n\t)\n\tpage, err := client.Auth.Connections.List(context.TODO(), kernel.AuthConnectionListParams{})\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n\tfmt.Printf(\"%+v\\n\", page)\n}\n"
  /auth/connections/{id}:
    get:
      operationId: getAuthConnectionsById
      tags:
      - Managed Auth
      summary: Get auth connection
      description: Retrieve an auth connection by its ID. Includes current flow state if a login is in progress.
      security:
      - bearerAuth: []
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
        description: Auth connection ID
      responses:
        '200':
          description: Auth connection details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ManagedAuth'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalError'
      x-codeSamples:
      - lang: JavaScript
        source: "import Kernel from '@onkernel/sdk';\n\nconst client = new Kernel({\n  apiKey: process.env['KERNEL_API_KEY'], // This is the default and can be omitted\n});\n\nconst managedAuth = await client.auth.connections.retrieve('id');\n\nconsole.log(managedAuth.id);"
      - lang: Python
        source: "import os\nfrom kernel import Kernel\n\nclient = Kernel(\n    api_key=os.environ.get(\"KERNEL_API_KEY\"),  # This is the default and can be omitted\n)\nmanaged_auth = client.auth.connections.retrieve(\n    \"id\",\n)\nprint(managed_auth.id)"
      - lang: Go
        source: "package main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\n\t\"github.com/kernel/kernel-go-sdk\"\n\t\"github.com/kernel/kernel-go-sdk/option\"\n)\n\nfunc main() {\n\tclient := kernel.NewClient(\n\t\toption.WithAPIKey(\"My API Key\"),\n\t)\n\tmanagedAuth, err := client.Auth.Connections.Get(context.TODO(), \"id\")\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n\tfmt.Printf(\"%+v\\n\", managedAuth.ID)\n}\n"
    patch:
      operationId: patchAuthConnectionsById
      tags:
      - Managed Auth
      summary: Update auth connection
      description: Update an auth connection's configuration. Only the fields provided will be updated.
      security:
      - bearerAuth: []
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
        description: Auth connection ID
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ManagedAuthUpdateRequest'
      responses:
        '200':
          description: Auth connection updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ManagedAuth'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalError'
      x-codeSamples:
      - lang: JavaScript
        source: "import Kernel from '@onkernel/sdk';\n\nconst client = new Kernel({\n  apiKey: process.env['KERNEL_API_KEY'], // This is the default and can be omitted\n});\n\nconst managedAuth = await client.auth.connections.update('id');\n\nconsole.log(managedAuth.id);"
      - lang: Python
        source: "import os\nfrom kernel import Kernel\n\nclient = Kernel(\n    api_key=os.environ.get(\"KERNEL_API_KEY\"),  # This is the default and can be omitted\n)\nmanaged_auth = client.auth.connections.update(\n    id=\"id\",\n)\nprint(managed_auth.id)"
      - lang: Go
        source: "package main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\n\t\"github.com/kernel/kernel-go-sdk\"\n\t\"github.com/kernel/kernel-go-sdk/option\"\n)\n\nfunc main() {\n\tclient := kernel.NewClient(\n\t\toption.WithAPIKey(\"My API Key\"),\n\t)\n\tmanagedAuth, err := client.Auth.Connections.Update(\n\t\tcontext.TODO(),\n\t\t\"id\",\n\t\tkernel.AuthConnectionUpdateParams{\n\t\t\tManagedAuthUpdateRequest: kernel.ManagedAuthUpdateRequestParam{},\n\t\t},\n\t)\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n\tfmt.Printf(\"%+v\\n\", managedAuth.ID)\n}\n"
    delete:
      operationId: deleteAuthConnectionsById
      tags:
      - Managed Auth
      summary: Delete auth connection
      description: 'Deletes an auth connection and terminates its workflow. This will:

        - Delete the auth connection record

        - Terminate the Temporal workflow

        - Cancel any in-progress login flows

        '
      security:
      - bearerAuth: []
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
        description: Auth connection ID
      responses:
        '204':
          description: Auth connection deleted successfully
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalError'
      x-codeSamples:
      - lang: JavaScript
        source: "import Kernel from '@onkernel/sdk';\n\nconst client = new Kernel({\n  apiKey: process.env['KERNEL_API_KEY'], // This is the default and can be omitted\n});\n\nawait client.auth.connections.delete('id');"
      - lang: Python
        source: "import os\nfrom kernel import Kernel\n\nclient = Kernel(\n    api_key=os.environ.get(\"KERNEL_API_KEY\"),  # This is the default and can be omitted\n)\nclient.auth.connections.delete(\n    \"id\",\n)"
      - lang: Go
        source: "package main\n\nimport (\n\t\"context\"\n\n\t\"github.com/kernel/kernel-go-sdk\"\n\t\"github.com/kernel/kernel-go-sdk/option\"\n)\n\nfunc main() {\n\tclient := kernel.NewClient(\n\t\toption.WithAPIKey(\"My API Key\"),\n\t)\n\terr := client.Auth.Connections.Delete(context.TODO(), \"id\")\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n}\n"
  /auth/connections/{id}/login:
    post:
      operationId: postAuthConnectionsLogin
      tags:
      - Managed Auth
      summary: Start login flow
      description: Starts a login flow for the auth connection. Returns immediately with a hosted URL for the user to complete authentication, or triggers automatic re-auth if credentials are stored.
      security:
      - bearerAuth: []
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
        description: Auth connection ID
      requestBody:
        required: false
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LoginRequest'
      responses:
        '200':
          description: Login flow started
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LoginResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          description: Login flow already in progress
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          $ref: '#/components/responses/InternalError'
      x-codeSamples:
      - lang: JavaScript
        source: "import Kernel from '@onkernel/sdk';\n\nconst client = new Kernel({\n  apiKey: process.env['KERNEL_API_KEY'], // This is the default and can be omitted\n});\n\nconst loginResponse = await client.auth.connections.login('id');\n\nconsole.log(loginResponse.id);"
      - lang: Python
        source: "import os\nfrom kernel import Kernel\n\nclient = Kernel(\n    api_key=os.environ.get(\"KERNEL_API_KEY\"),  # This is the default and can be omitted\n)\nlogin_response = client.auth.connections.login(\n    id=\"id\",\n)\nprint(login_response.id)"
      - lang: Go
        source: "package main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\n\t\"github.com/kernel/kernel-go-sdk\"\n\t\"github.com/kernel/kernel-go-sdk/option\"\n)\n\nfunc main() {\n\tclient := kernel.NewClient(\n\t\toption.WithAPIKey(\"My API Key\"),\n\t)\n\tloginResponse, err := client.Auth.Connections.Login(\n\t\tcontext.TODO(),\n\t\t\"id\",\n\t\tkernel.AuthConnectionLoginParams{},\n\t)\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n\tfmt.Printf(\"%+v\\n\", loginResponse.ID)\n}\n"
  /auth/connections/{id}/submit:
    post:
      operationId: postAuthConnectionsSubmit
      tags:
      - Managed Auth
      summary: Submit field values
      description: Submits field values for the login form. Poll the auth connection to track progress and get results.
      security:
      - bearerAuth: []
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
        description: Auth connection ID
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SubmitFieldsRequest'
      responses:
        '202':
          description: Submission accepted for processing
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SubmitFieldsResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '422':
          $ref: '#/components/responses/BadRequest'
        '500':
          $ref: '#/components/responses/InternalError'
      x-codeSamples:
      - lang: JavaScript
        source: "import Kernel from '@onkernel/sdk';\n\nconst client = new Kernel({\n  apiKey: process.env['KERNEL_API_KEY'], // This is the default and can be omitted\n});\n\nconst submitFieldsResponse = await client.auth.connections.submit('id');\n\nconsole.log(submitFieldsResponse.accepted);"
      - lang: Python
        source: "import os\nfrom kernel import Kernel\n\nclient = Kernel(\n    api_key=os.environ.get(\"KERNEL_API_KEY\"),  # This is the default and can be omitted\n)\nsubmit_fields_response = client.auth.connections.submit(\n    id=\"id\",\n)\nprint(submit_fields_response.accepted)"
      - lang: Go
        source: "package main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\n\t\"github.com/kernel/kernel-go-sdk\"\n\t\"github.com/kernel/kernel-go-sdk/option\"\n)\n\nfunc main() {\n\tclient := kernel.NewClient(\n\t\toption.WithAPIKey(\"My API Key\"),\n\t)\n\tsubmitFieldsResponse, err := client.Auth.Connections.Submit(\n\t\tcontext.TODO(),\n\t\t\"id\",\n\t\tkernel.AuthConnectionSubmitParams{\n\t\t\tSubmitFieldsRequest: kernel.SubmitFieldsRequestParam{},\n\t\t},\n\t)\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n\tfmt.Printf(\"%+v\\n\", submitFieldsResponse.Accepted)\n}\n"
  /auth/connections/{id}/events:
    get:
      operationId: getAuthConnectionsEventsById
      tags:
      - Managed Auth
      summary: Stream login flow events via SSE
      description: 'Establishes a Server-Sent Events (SSE) stream that delivers real-time

        login flow state updates. The stream terminates automatically once

        the flow reaches a terminal state (SUCCESS, FAILED, EXPIRED, CANCELED).

        '
      security:
      - bearerAuth: []
      parameters:
      - name: id
        in: path
        required: true
        description: The auth connection ID to follow.
        schema:
          type: string
      responses:
        '200':
          description: SSE stream of auth connection state updates.
          headers:
            X-SSE-Content-Type:
              description: Media type of SSE data events (always application/json).
              schema:
                type: string
                const: application/json
          content:
            text/event-stream:
              schema:
                $ref: '#/components/schemas/ManagedAuthEvent'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalError'
      x-codeSamples:
      - lang: JavaScript
        source: "import Kernel from '@onkernel/sdk';\n\nconst client = new Kernel({\n  apiKey: process.env['KERNEL_API_KEY'], // This is the default and can be omitted\n});\n\nconst response = await client.auth.connections.follow('id');\n\nconsole.log(response);"
      - lang: Python
        source: "import os\nfrom kernel import Kernel\n\nclient = Kernel(\n    api_key=os.environ.get(\"KERNEL_API_KEY\"),  # This is the default and can be omitted\n)\nfor connection in client.auth.connections.follow(\n    \"id\",\n):\n  print(connection)"
      - lang: Go
        source: "package main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\n\t\"github.com/kernel/kernel-go-sdk\"\n\t\"github.com/kernel/kernel-go-sdk/option\"\n)\n\nfunc main() {\n\tclient := kernel.NewClient(\n\t\toption.WithAPIKey(\"My API Key\"),\n\t)\n\tstream := client.Auth.Connections.FollowStreaming(context.TODO(), \"id\")\n\tfor stream.Next() {\n\t\tfmt.Printf(\"%+v\\n\", stream.Current())\n\t}\n\terr := stream.Err()\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n}\n"
  /auth/connections/{id}/timeline:
    get:
      operationId: getAuthConnectionsTimelineById
      tags:
      - Managed Auth
      summary: Get auth connection event timeline
      description: 'Returns a chronological timeline of events for an auth connection —

        login attempts, automatic re-auth attempts, and health checks. Events

        are returned newest-first.

        '
      security:
      - bearerAuth: []
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
        description: Auth connection ID
      - name: type
        in: query
        required: false
        schema:
          type: string
          enum:
          - login
          - reauth
          - health_check
        description: Filter the timeline to a single event type.
      - name: limit
        in: query
        required: false
        schema:
          type: integer
          default: 20
          maximum: 100
        description: Maximum number of events to return
      - name: offset
        in: query
        required: false
        schema:
          type: integer
          default: 0
        description: Number of events to skip
      responses:
        '200':
          description: Event timeline for the auth connection
          headers:
            X-Has-More:
              schema:
                type: boolean
              description: Whether there are more results
            X-Next-Offset:
              schema:
                type: integer
              description: The offset where the next page starts. 0 when there are no more results.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/ManagedAuthTimelineEvent'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalError'
      x-codeSamples:
      - lang: JavaScript
        source: "import Kernel from '@onkernel/sdk';\n\nconst client = new Kernel({\n  apiKey: process.env['KERNEL_API_KEY'], // This is the default and can be omitted\n});\n\n// Automatically fetches more pages as needed.\nfor await (const managedAuthTimelineEvent of client.auth.connections.timeline('id')) {\n  console.log(managedAuthTimelineEvent.id);\n}"
      - lang: Python
        source: "import os\nfrom kernel import Kernel\n\nclient = Kernel(\n    api_key=os.environ.get(\"KERNEL_API_KEY\"),  # This is the default and can be omitted\n)\npage = client.auth.connections.timeline(\n    id=\"id\",\n)\npage = page.items[0]\nprint(page.id)"
      - lang: Go
        source: "package main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\n\t\"github.com/kernel/kernel-go-sdk\"\n\t\"github.com/kernel/kernel-go-sdk/option\"\n)\n\nfunc main() {\n\tclient := kernel.NewClient(\n\t\toption.WithAPIKey(\"My API Key\"),\n\t)\n\tpage, err := client.Auth.Connections.Timeline(\n\t\tcontext.TODO(),\n\t\t\"id\",\n\t\tkernel.AuthConnectionTimelineParams{},\n\t)\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n\tfmt.Printf(\"%+v\\n\", page)\n}\n"
  /auth/connections/{id}/exchange:
    post:
      x-cli-skip: true
      x-stainless-skip: true
      x-hidden: true
      operationId: postAuthConnectionsExchange
      tags:
      - Managed Auth
      summary: Exchange handoff code for JWT
      description: Validates the handoff code and returns a JWT token for subsequent requests. Used by the hosted login UI.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ManagedAuthExchangeRequest'
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
        description: Auth connection ID
      responses:
        '200':
          description: Exchange successful, JWT returned
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ManagedAuthExchangeResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
        '410':
          $ref: '#/components/responses/Gone'
        '500':
          $ref: '#/components/responses/InternalError'
components:
  schemas:
    CredentialReference:
      type: object
      description: 'Reference to credentials for the auth connection. Use one of:

        - { name } for Kernel credentials

        - { provider, path } for external provider item

        - { provider, auto: true } for external provider domain lookup

        '
      properties:
        name:
          type: string
          description: Kernel credential name
          example: my-netflix-creds
        provider:
          type: string
          description: External provider name (e.g., "my-1p")
          example: my-1p
        path:
          type: string
          description: Provider-specific path (e.g., "VaultName/ItemName" for 1Password)
          example: Personal/Netflix
        auto:
          type: boolean
          description: If true, lookup by domain from the specified provider
          example: true
      additionalProperties: false
    ManagedAuthExchangeResponse:
      type: object
      description: Response from exchange endpoint
      required:
      - invocation_id
      - jwt
      properties:
        invocation_id:
          type: string
          description: Invocation ID
          example: abc123xyz
        jwt:
          type: string
          description: JWT token with invocation_id claim (30 minute TTL)
          example: eyJ0eXAi...
      additionalProperties: false
    DiscoveredField:
      type: object
      description: A discovered form field
      properties:
        name:
          type: string
          description: Field name
          example: email
        type:
          type: string
          enum:
          - text
          - email
          - password
          - tel
          - number
          - url
          - code
          - totp
          description: Field type
          example: email
        label:
          type: string
          description: Field label
          example: Email address
        placeholder:
          type: string
          description: Field placeholder
          example: you@example.com
        required:
          type: boolean
          description: Whether field is required
          default: true
          example: true
        selector:
          type: string
          description: CSS selector for the field
          example: input#email
        linked_mfa_type:
          $ref: '#/components/schemas/MFAType'
          nullable: true
          description: If this field is associated with an MFA option, the type of that option (e.g., password field linked to "Enter password" option)
        hint:
          type: string
          description: Contextual help text near the field that tells the user what to enter (e.g., "Enter the phone ending in (***) ***-**92")
          example: Enter the phone ending in (***) ***-**92
      required:
      - name
      - type
      - label
      - selector
      additionalProperties: false
    ManagedAuthTimelineEvent:
      type: object
      description: A single event in an auth connection's history — a login attempt, an automatic re-auth attempt, or a health check.
      required:
      - type
      - id
      - timestamp
      - status
      properties:
        type:
          type: string
          enum:
          - login
          - reauth
          - health_check
          description: The kind of event. "login" and "reauth" are authentication attempts; "health_check" is a periodic session-validity check.
        id:
          type: string
          description: Identifier of the underlying login/reauth session or health check.
        timestamp:
          type: string
          format: date-time
          description: When the event occurred.
        status:
          type: string
          enum:
          - IN_PROGRESS
          - SUCCESS
          - EXPIRED
          - CANCELED
          - FAILED
          - AUTHENTICATED
          - NEEDS_AUTH
          description: 'Outcome of the event. For login/reauth events this is the flow status

            (IN_PROGRESS, SUCCESS, EXPIRED, CANCELED, FAILED). For health_check events

            it is the observed session state (AUTHENTICATED, NEEDS_AUTH).

            '
        previous_status:
          type: string
          enum:
          - AUTHENTICATED
          - NEEDS_AUTH
          description: The session state observed before this event. Present for health_check events that recorded a prior state.
        step:
          type: string
          enum:
          - INITIALIZED
          - DISCOVERING
          - AWAITING_INPUT
          - AWAITING_EXTERNAL_ACTION
          - AWAITING_HUMAN_INTERVENTION
          - SUBMITTING
          - COMPLETED
          - EXPIRED
          description: The step the flow reached. Present for login/reauth events.
        error_code:
          type: string
          description: Machine-readable error code. Present when a login/reauth event failed.
        error_message:
          type: string
          description: Human-readable error message. Present when a login/reauth event failed.
        website_error:
          type: string
          description: Visible error message from the website (e.g., 'Incorrect password'). Present when the website displayed an error during the attempt.
        browser_session_id:
          type: string
          description: Browser session that produced the event, if one was created.
        replay_id:
          type: string
          description: Replay recording ID for the event's browser session, if session recording was enabled.
        updated_at:
          type: string
          format: date-time
          description: When the event was last updated. Present for login/reauth events.
    ErrorDetail:
      type: object
      properties:
        code:
          type: string
          description: Lower-level error code providing more specific detail
          example: invalid_input
        message:
          type: string
          description: Further detail about the error
          example: Provided version string is not semver compliant
    ManagedAuthStateEvent:
      type: object
      description: An event representing the current state of a managed auth flow.
      required:
      - event
      - timestamp
      - flow_status
      - flow_step
      properties:
        event:
          type: string
          const: managed_auth_state
          description: Event type identifier (always "managed_auth_state").
        timestamp:
          type: string
          format: date-time
          description: Time the state was reported.
        flow_status:
          type: string
          enum:
          - IN_PROGRESS
          - SUCCESS
          - FAILED
          - EXPIRED
          - CANCELED
          description: Current flow status.
        flow_step:
          type: string
          enum:
          - DISCOVERING
          - AWAITING_INPUT
          - AWAITING_EXTERNAL_ACTION
          - SUBMITTING
          - COMPLETED
          description: Current step in the flow.
        flow_type:
          type: string
          enum:
          - LOGIN
          - REAUTH
          description: Type of the current flow.
        fields:
          type: array
          description: Canonical fields awaiting input. Prefer this over discovered_fields when present.
          items:
            $ref: '#/components/schemas/ManagedAuthField'
        choices:
          type: array
          description: Canonical choices awaiting selection. Prefer this over pending_sso_buttons, mfa_options, and sign_in_options when present.
          items:
            $ref: '#/components/schemas/ManagedAuthChoice'
        discovered_fields:
          type: array
          description: Fields awaiting input (present when flow_step=AWAITING_INPUT; may also be present with AWAITING_EXTERNAL_ACTION as fallback actions).
          items:
            $ref: '#/components/schemas/DiscoveredField'
        mfa_options:
          type: array
          description: MFA method options (present when flow_step=AWAITING_INPUT; may also be present with AWAITING_EXTERNAL_ACTION as fallback actions).
          items:
            $ref: '#/components/schemas/MFAOption'
        sign_in_options:
          type: array
          description: Non-MFA choices presented during the auth flow, such as account selection or org pickers (present when flow_step=AWAITING_INPUT; may also be present with AWAITING_EXTERNAL_ACTION as fallback actions).
          items:
            $ref: '#/components/schemas/SignInOption'
        pending_sso_buttons:
          type: array
          description: SSO buttons available (present when flow_st

# --- truncated at 32 KB (64 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/kernel/refs/heads/main/openapi/kernel-managed-auth-api-openapi.yml