Authentik

Authentik is an open source identity provider from Authentik Security Inc., a public benefit company, exposing a 1,193-operation REST API at /api/v3 on every self-hosted instance. The published OpenAPI covers users, groups, applications, tokens, RBAC, flows, stages, policies, property mappings, outposts, events, blueprints, endpoint devices, privileged access management and agent accounts. authentik speaks OAuth2/OIDC (OpenID Certified), SAML 2.0, SCIM 2.0, LDAP, RADIUS, Kerberos, Proxy and the OpenID Shared Signals Framework, and ships first-party API clients for TypeScript, Python, Go and Rust plus a Terraform provider and the `ak` CLI.

Authentik publishes 27 API contracts indexed on the APIs.io network, including Core API, Crypto API, Events API, and 24 more. Tagged areas include Authentication, Authorization, Identity Provider, LDAP, and Open Source.

The Authentik catalog on APIs.io includes 1 event-driven AsyncAPI specification.

Authentik’s developer surface includes authentication, documentation, changelog, support, pricing, engineering blog, CLI, and 41 more developer resources.

🌐 Visit website 📡 Profile data on GitHub

70.1/100 exemplar ▬ flat Agent 28/100 agent aware Front door AI 2/6 trace Full breakdown ↓
scored 2026-10-17 · rubric v0.24.0

AccessFreemiumSelf serve

2 published contracts 7 Features 4 Use Cases

Authentication Authorization Identity Provider LDAP Open Source OpenID Connect SAML SCIM Self-Hosted Identity Federation

What this lets a business do 2

Business capabilities this provider's published APIs can perform, derived from its own contracts. Browse all capabilities →

Cybersecurity Management

BC-620

AuthenticatorsCoreFlowsLifecycleOAuth2Policies

GET /rbac/permissions/ GET /rbac/permissions/assigned_by_roles/ POST /rbac/permissions/assigned_by_roles/{uuid}/assign/ GET /sources/all/

SaaS Tenant Management

BC-4230

Tenants

POST /tenants/tenants/ DELETE /tenants/tenants/{tenant_uuid}/

What people ask Authentik 27

The questions people put to an LLM, and the jobs they hand an agent, that Authentik's APIs answer — each one linked to the operation that does it. Generated by API Evangelist

Authentik Stages API List account lockdown stages “Which account lockdown stages are configured in my authentik instance?” Create an account lockdown stage “How do I add a stage that locks down a compromised account?” Get an account lockdown stage “What does a specific account lockdown stage do to the user when it runs?” Replace an account lockdown stage's settings “Can I overwrite every setting on an existing account lockdown stage in one request?”

Authentik Sources API List all federation and sync sources “Which login and directory sources are set up in authentik across every type?” Get any source by its slug “What type of source is behind a given slug, whatever protocol it uses?” Delete a source of any type “Can built-in sources be deleted, or only ones I created?” See what depends on a source “Which objects still reference a source before I delete it?”

Authentik Providers API List all providers of every type “Which providers of any type are configured in my authentik instance?” Get any provider by ID “What type of provider is a given provider ID, whatever its protocol?” Delete a provider of any type “Can I delete a provider without knowing which protocol type it is?” See what depends on a provider “What objects reference a provider before I delete it, whatever its type?”

Authentik Property Mappings API List property mappings of every type “What property mappings exist across all types in my authentik instance?” Get any property mapping by ID “How do I look up a property mapping when I only have its UUID and not its type?” Delete any property mapping by ID “Can I delete a property mapping through the generic endpoint without knowing its type?” Test a property mapping against a user “How do I preview what a property mapping expression returns for a given user?”

Authentik Authenticators API List every MFA device a user has (admin) “As an admin, how can I see all of a given user's MFA devices across every type?” List all users' Duo devices (admin) “Which Duo devices are enrolled across all users in authentik?” Create a Duo device record (admin) “Can an admin register a Duo device record directly through the API?” Get any user's Duo device (admin) “As an admin, how do I inspect a specific user's Duo device?”

Authentik Core API List application entitlements “Which entitlements are defined for my applications in authentik?” Create an application entitlement “How do I define a new entitlement that users of an application can be granted?” Get an application entitlement “What attributes does a specific entitlement carry?” Replace an application entitlement “Can I fully overwrite an existing entitlement's name and application?”

Authentik Policies API List policies of every type “Which policies of any type exist in my authentik instance?” Get any policy by UUID “What is a policy when I only know its UUID and not its type?” Delete a policy of any type “Can I delete a policy by UUID without knowing which type it is?” Test a policy against a user “How do I check whether a policy would pass or fail for a particular user?”

Authentik Endpoints API List authentik Agent connectors “Which authentik Agent connectors are set up for my devices?” Create an authentik Agent connector “How do I set up a new connector for the authentik Agent on endpoints?” Get an authentik Agent connector “What settings does a particular Agent connector have?” Replace an Agent connector's settings “Can I overwrite the full configuration of an Agent connector in one call?”

Authentik Outposts API List outposts “Which outposts are deployed in my authentik instance?” Create an outpost “How do I deploy a new proxy or LDAP outpost in authentik?” Get an outpost's details “What providers and config does one specific outpost have?” Replace an outpost's settings “Can I overwrite an outpost's whole definition, including name, type, providers and config, in one call?”

Authentik Events API Browse the audit event log “Which login and admin events did a specific user trigger?” Record a custom audit event “Can I write my own entry into the authentik event log?” Get one audit event “What exactly is recorded in a single event, including its context?” Replace an audit event “Can I overwrite an existing event record with a new action and app?”

Authentik Requests API List access grant requests “Which access grant requests have been filed, and what status are they in?” Request access to resources “How do I ask for temporary access to something I don't have yet?” Get one grant request “What is the current status of a particular access request?” Delete a grant request “Can I withdraw and delete an access request I filed by mistake?”

Authentik RBAC API List initial permission sets “Which initial permission sets are configured for newly created objects?” Create an initial permission set “How do I grant a role permissions automatically on objects a user creates?” Get one initial permission set “What role and permissions does a specific initial permissions entry grant?” Replace an initial permission set “How do I fully overwrite an existing initial permissions entry?”

Showing 12 of 27 APIs with phrasing — see every API.

Kin Score

Kin Score How this is scored →
scored 2026-10-17 · rubric v0.24.0

Composite quality — 70.1/100 · exemplar

Contract Quality 10.7 / 19

Developer Ergonomics 12.4 / 15

Access Clarity 12.6 / 15

Operational Transparency 5.9 / 10

Contract Governance 1.6 / 9

Discoverability 5.5 / 8

Regulatory Posture 5.3 / 15

Create-or-Update Ergonomics 2.8 / 10

Agent readiness — 28/100 · agent aware

Machine-Readable Contract 18 / 18

Agentic Access Contract 10 / 10

Documented Reversibility 0 / 6

MCP Server 0 / 12

Machine-Readable Auth 10 / 10

Idempotency 0 / 9

Stable Error Semantics 8 / 8

Request/Response Examples 7 / 7

Rate-Limit Signaling 7 / 7

Typed Event Surface 6 / 6

Agent Skills 5 / 5

Well-Known Catalog 0 / 4

Consent & Bot Identity 0 / 3

A2A Agent Card 0 / 8

Dry-Run / Simulate Mode 0 / 4

Delegated User Identity 0 / 6

Protected Resource Metadata 0 / 5

Registration Without a Human 0 / 6

Agentic Commerce Well-Known Document 0 / 5

Regulatory Posture applies to this provider. Its tags matched the Horizontal (data, software, accessibility, platform) regime, so Regulatory Posture carries 15 points of the composite. If this regime is wrong for your business, say so on your provider repo — the applicability map is public and we will correct it.

Create-or-Update Ergonomics applies to this provider. This API accepts writes, so it carries 10 points of the composite. It is scored from the published contracts themselves: whether a caller can create-or-update in one call, whether the write accepts a key the caller already holds, and whether the response says which branch ran. Without that, every write needs a search-and-branch in front of it, and the first time that check is skipped a duplicate record is created. Scored against the observed mean rather than raw — a provider at the catalog average is unchanged by this facet, not penalised by it.

The six quality facets above are damped to 75 points between them, because the conditional facet above carries the other 25. That is why each facet's contribution is shown against a damped maximum: raising a quality facet moves the composite by 75% of its nominal weight, not 100%. The full arithmetic is at apis.io/rating/.

Improve this rating by publishing the missing artifacts — every area above can be raised, and the full rubric is at apis.io/rating/. Every facet and dimension name above is a link: it opens that measurement's own page — what it means, the exact checks that feed it, how the whole catalog distributes on it, and the providers at the top of it. This rating is computed from github.com/api-evangelist/authentik: open an issue to ask a question, or submit a pull request to add artifacts. Submit an artifact on GitHub — free → Manage your own listing — the Influence plan, $499/mo →

Markets this provider is in provisional

The Kin Score Market layer reads a provider inside its market: its position, and how deep its integrations go. Depth is only comparable within a position. Provisional and unweighted: not part of the Kin Score or agent readiness.

Market	Position	Depth	Registered MCP server	Declares compatibility
Identity and Auth	standard	58.1	-	-

Registered MCP server and declares compatibility are report only — not weighted. Undeclared means we found nothing we can read, so there is no number: we never infer integrations.

Standards implemented 4

Standards this provider implements or carries. De facto ones are profiled and measured by the API Commons; formal ones come from the standards directory and are linked by the provider's own tags. The evidence column says how each claim was established — not that it was made.

LDAP

tagged — the provider's own APIs.json carries the standard as a tag; implementation not verified

OpenID Connect

tagged — the provider's own APIs.json carries the standard as a tag; implementation not verified

SAML

tagged — the provider's own APIs.json carries the standard as a tag; implementation not verified

SCIM 2.0

prose — states compatibility; nothing published to check it against

5 core of 24 operations graded · api-commons/identity

APIs 27

Individual APIs this provider publishes, each with its own machine-readable definition.

Authentik Core API

Users, groups, applications, tokens, brands, application entitlements and authenticated sessions — the identity records and the objects users see.

Authentik Crypto API

Certificate-key pairs used to sign SAML assertions and OIDC ID tokens, and to validate webhook receivers.

Authentik Events API

Audit events, notification rules and notification transports — including the webhook and Slack transports that push authentik events to external receivers.

Authentik Flows API

Flow instances, flow bindings and the flow executor that drives authentication, enrollment, recovery and unenrollment.

Authentik Policies API

Policies and policy bindings — expression, event matcher, GeoIP, password, password expiry, reputation and unique-password types.

Authentik Providers API

Protocol providers: OAuth2/OIDC, SAML, SCIM, LDAP, RADIUS, Proxy, RAC, WS-Fed, Google Workspace, Microsoft Entra and the Shared Signals Framework backchannel.

Authentik RBAC API

Role-based access control — roles, global and object-level permissions, and initial permission sets.

Authentik Schema API

The self-describing OpenAPI schema endpoint every authentik instance serves.

Authentik Sources API

External identity sources — LDAP, OAuth, SAML, SCIM, Kerberos, Plex and Telegram — plus their user and group connections.

Authentik Stages API

Flow stages: identification, password, consent, prompt, email, captcha, mTLS, redirect, user write/login/logout/delete, account lockdown and every authenticator setup and valida...

Authentik Admin API

Instance administration — installed apps, models, version, system information, workers and the file storage backend.

Authentik Agents API

Agent accounts — service accounts that act on behalf of a parent user when calling the authentik API, with expiring tokens and audited delegation.

Authentik Authenticators API

Authenticator device management for TOTP, static, WebAuthn, SMS, email, Duo and endpoint devices, from both the admin and end-user perspectives.

Authentik Endpoints API

Endpoint device management — the authentik Agent connectors, device enrollment tokens, device bindings, device access groups, Fleet and Google Chrome device-trust connectors, an...

Authentik Enterprise API

Enterprise licensing — license installation, summary and forecast for a licensed authentik deployment.

Authentik Lifecycle API

Identity lifecycle operations, including scheduled user offboarding with session and token revocation and a cancellable pending state.

Authentik Managed API

Blueprints — the YAML templates that declare authentik configuration as code, and the blueprint instances that apply them.

Authentik Outposts API

Outpost instances and service connections (Docker, Kubernetes) — the deployable components that run the proxy, LDAP and RADIUS providers.

Authentik Property Mappings API

Property mappings — the expressions that shape claims, attributes and payloads for every provider and source type, plus notification webhook bodies.

Authentik RAC API

Remote Access Control — browser-based RDP, SSH and VNC endpoints and their single-use connection tokens.

Authentik Reports API

Reporting surface for exportable user and event data.

Authentik Requests API

Privileged access management — access request rules, rule bindings, grant requests, reviewer workflows and grant revocation.

Authentik Root API

Root configuration endpoint describing the running instance to its own frontend.

Authentik SSF API

OpenID Shared Signals Framework streams — the SSF stream surface a receiving application manages on authentik as transmitter of Security Event Tokens.

Authentik Tasks API

Background task schedules and runs executed by the authentik worker.

Authentik Tenants API

Multi-tenant administration for deployments running more than one authentik tenant.

Authentik Oauth2 API

The oauth2 API from Authentik — 9 operation(s) for oauth2.

Scroll for all 27

Open Collections 1

Open, tool-agnostic API collections (OpenAPI-derived and Bruno).

API Collection

OPEN COLLECTION

Pricing Plans 1

Published pricing tiers and plan structures.

Authentik Plans Pricing

3 plans

PLANS

Rate Limits 1

Documented rate limits and quota policies.

Authentik Rate Limits

0 limits

RATE LIMITS

FinOps 1

Cost, billing, and metering signals for API financial operations.

Authentik Finops

FINOPS

Features 7

Notable capabilities this provider offers.

Comprehensive REST API

Full REST API covering all authentik features with built-in Swagger UI at /api/v3/ on every instance.

Multi-Protocol Support

Native support for OAuth2, OIDC, SAML, LDAP, SCIM, RADIUS, and SSTP protocols for broad integration coverage.

Flow Engine

Customizable authentication and enrollment flows with visual flow designer for configuring multi-step authentication processes.

Multi-Language SDKs

Official API client SDKs in TypeScript, Python, Go, Rust, Kotlin, and Swift auto-generated from the OpenAPI schema.

Terraform Provider

Official Terraform provider for infrastructure-as-code management of authentik resources.

Helm Deployment

Official Helm chart for Kubernetes deployment with configurable replicas, persistence, and external database support.

RBAC

Role-based access control for granular permission management across authentik resources and administrative functions.

Scroll for all 7

Event Specifications 1

AsyncAPI definitions for this provider's event-driven and streaming APIs.

Authentik Events Webhooks

ASYNCAPI

OpenAPI Overlays 54

Overlays applied on top of this provider's contracts. Each card says who wrote it: a document the provider publishes, or one API Evangelist derived or generated.

Authentik Admin Api Overlay

5 actions · update · authentik-admin-api-openapi.yml

GENERATED

Authentik Admin Api Phrasing Overlay

15 actions · phrasing · authentik-admin-api-openapi.yml

GENERATED

Authentik Agents Api Overlay

5 actions · update · authentik-agents-api-openapi.yml

GENERATED

Authentik Agents Api Phrasing Overlay

7 actions · phrasing · authentik-agents-api-openapi.yml

GENERATED

Authentik Authenticators Api Overlay

5 actions · update · authentik-authenticators-api-openapi.yml

GENERATED

Authentik Authenticators Api Phrasing Overlay

84 actions · phrasing · authentik-authenticators-api-openapi.yml

GENERATED

Authentik Core Api Overlay

5 actions · update · authentik-core-api-openapi.yml

GENERATED

Authentik Core Api Phrasing Overlay

79 actions · phrasing · authentik-core-api-openapi.yml

GENERATED

Authentik Crypto Api Overlay

5 actions · update · authentik-crypto-api-openapi.yml

GENERATED

Authentik Crypto Api Phrasing Overlay

11 actions · phrasing · authentik-crypto-api-openapi.yml

GENERATED

Authentik Endpoints Api Overlay

5 actions · update · authentik-endpoints-api-openapi.yml

GENERATED

Authentik Endpoints Api Phrasing Overlay

71 actions · phrasing · authentik-endpoints-api-openapi.yml

GENERATED

Authentik Enterprise Api Overlay

5 actions · update · authentik-enterprise-api-openapi.yml

GENERATED

Authentik Enterprise Api Phrasing Overlay

11 actions · phrasing · authentik-enterprise-api-openapi.yml

GENERATED

Authentik Events Api Overlay

5 actions · update · authentik-events-api-openapi.yml

GENERATED

Authentik Events Api Phrasing Overlay

34 actions · phrasing · authentik-events-api-openapi.yml

GENERATED

Authentik Flows Api Overlay

5 actions · update · authentik-flows-api-openapi.yml

GENERATED

Authentik Flows Api Phrasing Overlay

23 actions · phrasing · authentik-flows-api-openapi.yml

GENERATED

Authentik Lifecycle Api Overlay

5 actions · update · authentik-lifecycle-api-openapi.yml

GENERATED

Authentik Lifecycle Api Phrasing Overlay

15 actions · phrasing · authentik-lifecycle-api-openapi.yml

GENERATED

Authentik Managed Api Overlay

5 actions · update · authentik-managed-api-openapi.yml

GENERATED

Authentik Managed Api Phrasing Overlay

11 actions · phrasing · authentik-managed-api-openapi.yml

GENERATED

Authentik Oauth2 Api Overlay

5 actions · update · authentik-oauth2-api-openapi.yml

GENERATED

Authentik Oauth2 Api Phrasing Overlay

13 actions · phrasing · authentik-oauth2-api-openapi.yml

GENERATED

Authentik Outposts Api Overlay

5 actions · update · authentik-outposts-api-openapi.yml

GENERATED

Authentik Outposts Api Phrasing Overlay

35 actions · phrasing · authentik-outposts-api-openapi.yml

GENERATED

Authentik Policies Api Overlay

5 actions · update · authentik-policies-api-openapi.yml

GENERATED

Authentik Policies Api Phrasing Overlay

77 actions · phrasing · authentik-policies-api-openapi.yml

GENERATED

Authentik Propertymappings Api Overlay

5 actions · update · authentik-propertymappings-api-openapi.yml

GENERATED

Authentik Propertymappings Api Phrasing Overlay

112 actions · phrasing · authentik-propertymappings-api-openapi.yml

GENERATED

Authentik Providers Api Overlay

5 actions · update · authentik-providers-api-openapi.yml

GENERATED

Authentik Providers Api Phrasing Overlay

132 actions · phrasing · authentik-providers-api-openapi.yml

GENERATED

Authentik Rac Api Overlay

5 actions · update · authentik-rac-api-openapi.yml

GENERATED

Authentik Rac Api Phrasing Overlay

14 actions · phrasing · authentik-rac-api-openapi.yml

GENERATED

Authentik Rbac Api Overlay

5 actions · update · authentik-rbac-api-openapi.yml

GENERATED

Authentik Rbac Api Phrasing Overlay

23 actions · phrasing · authentik-rbac-api-openapi.yml

GENERATED

Authentik Reports Api Overlay

5 actions · update · authentik-reports-api-openapi.yml

GENERATED

Authentik Reports Api Phrasing Overlay

4 actions · phrasing · authentik-reports-api-openapi.yml

GENERATED

Authentik Requests Api Overlay

5 actions · update · authentik-requests-api-openapi.yml

GENERATED

Authentik Requests Api Phrasing Overlay

30 actions · phrasing · authentik-requests-api-openapi.yml

GENERATED

Authentik Root Api Overlay

5 actions · update · authentik-root-api-openapi.yml

GENERATED

Authentik Root Api Phrasing Overlay

2 actions · phrasing · authentik-root-api-openapi.yml

GENERATED

Authentik Schema Api Overlay

5 actions · update · authentik-schema-api-openapi.yml

GENERATED

Authentik Schema Api Phrasing Overlay

2 actions · phrasing · authentik-schema-api-openapi.yml

GENERATED

Authentik Sources Api Overlay

5 actions · update · authentik-sources-api-openapi.yml

GENERATED

Authentik Sources Api Phrasing Overlay

174 actions · phrasing · authentik-sources-api-openapi.yml

GENERATED

Authentik Ssf Api Overlay

5 actions · update · authentik-ssf-api-openapi.yml

GENERATED

Authentik Ssf Api Phrasing Overlay

4 actions · phrasing · authentik-ssf-api-openapi.yml

GENERATED

Authentik Stages Api Overlay

5 actions · update · authentik-stages-api-openapi.yml

GENERATED

Authentik Stages Api Phrasing Overlay

211 actions · phrasing · authentik-stages-api-openapi.yml

GENERATED

Authentik Tasks Api Overlay

5 actions · update · authentik-tasks-api-openapi.yml

GENERATED

Authentik Tasks Api Phrasing Overlay

11 actions · phrasing · authentik-tasks-api-openapi.yml

GENERATED

Authentik Tenants Api Overlay

5 actions · update · authentik-tenants-api-openapi.yml

GENERATED

Authentik Tenants Api Phrasing Overlay

15 actions · phrasing · authentik-tenants-api-openapi.yml

GENERATED

Scroll for all 54

Security Posture 3

Authentication, domain security, vulnerability disclosure, and trust-center signals.

Authentik Authentication

http · 4 schemes

SECURITY

Authentik Domain Security

TLSv1.3 · HSTS · DNSSEC · DMARC

SECURITY

Authentik Vulnerability Disclosure

security.txt · contact published

SECURITY

Agentic Access 1

Recommended x-agentic-access execution contracts for AI agents.

Authentik Agentic Access

1193 operations · 636 acting · 1 human-in-the-loop

1193 operations · 636 acting

AGENTIC

Use Cases 4

What developers build with this provider.

Self-Hosted Identity Provider

Deploy a complete identity provider on-premises or in private cloud with full data sovereignty.

SSO Gateway

Provide single sign-on for all internal applications using OIDC, SAML, or LDAP protocol support.

B2C Identity

Build customer-facing registration and authentication flows with customizable enrollment and recovery processes.

Zero Trust Access

Implement zero trust application access with forward auth proxy integration and per-application policies.

Solutions 2

Packaged solutions this provider offers.

Self-Hosted IAM

Complete identity and access management platform deployable on any infrastructure with no vendor lock-in.

Application Gateway

Secure and authenticate any application using forward auth with optional MFA and per-user access policies.

Resources

Get Started 3

Portal, sign-up, and the first successful call

DeveloperPortal

DeveloperPortal

GettingStarted

GettingStarted

SignUp

SignUp

Documentation 3

Reference material describing how the API behaves

ContributionGuide

ContributionGuide

Documentation

Documentation

APIReference

APIReference

Agent Surfaces 4

MCP servers, agent skills, and machine-readable catalogs

AgenticAccess

WellKnown

LLMsTxt

AgentSkill

Design & Contract 7

Pagination, idempotency, versioning, errors, and events

Conformance

ErrorCatalog

Lifecycle

Conventions

Components

DataModel

Webhooks

Scroll for all 7

Build 6

SDKs, sample code, and the tooling you integrate with

CodeOfConduct

CodeOfConduct

GitHubOrganization

GitHubRepository

Packages

SDKs

CLI

Access & Security 7

Authentication, authorization, and security posture

SecurityPolicy

SecurityPolicy

VulnerabilityDisclosure

VulnerabilityDisclosure

DomainSecurity

Authentication

SecurityTxt

Compliance

Security

Scroll for all 7

Operate 8

Status, limits, changes, and where to get help

IssueTracker

ChangeLog

Support

Community

StatusPage

Deprecation

ChangeLog

RateLimits

Scroll for all 8

Commercial 5

Pricing, plans, and the legal terms of use

Pricing

Plans

FinOps

TermsOfService

PrivacyPolicy

Company 3

The organization behind the API

LinkedIn

Website

Website

Blog

Blog

Other 2

Properties that don't map to a standard resource type

CapabilityMap

CapabilityMap

Overlay

Overlay

Source (apis.yml)

aid: authentik
name: Authentik
description: 'Authentik is an open source identity provider from Authentik Security Inc., a public benefit company, exposing
  a 1,193-operation REST API at /api/v3 on every self-hosted instance. The published OpenAPI covers users, groups, applications,
  tokens, RBAC, flows, stages, policies, property mappings, outposts, events, blueprints, endpoint devices, privileged access
  management and agent accounts. authentik speaks OAuth2/OIDC (OpenID Certified), SAML 2.0, SCIM 2.0, LDAP, RADIUS, Kerberos,
  Proxy and the OpenID Shared Signals Framework, and ships first-party API clients for TypeScript, Python, Go and Rust plus
  a Terraform provider and the `ak` CLI.

  '
type: Index
deliveryModel:
  model: unknown
  license_evidence:
    repo: goauthentik/authentik
    spdx: NOASSERTION
    stars: 25714
  open_source: unknown
  commercial: true
  callable_host: false
  label: Delivery model not determined — needs a product licence on record
  confidence: low
  source:
  - openapi
  - pricing
  - repository-unlicensed
  generated: '2026-09-25'
  method: derived
accessModel:
  pricing: freemium
  onboarding: self-serve
  trial: false
  try_now: false
  public: false
  label: Freemium · Self-serve signup
  confidence: medium
  try_now_blocked_by: self-hosted
  source:
  - plans
  - authentication
  - security
  generated: '2026-09-03'
  method: derived
image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/icons/authentik.png
x-docs-platform: docusaurus
x-docs-platform-confidence: medium
x-docs-platform-checked: 2026-09-19
tags:
- Authentication
- Authorization
- Identity Provider
- LDAP
- Open Source
- OpenID Connect
- SAML
- SCIM
- Self-Hosted
- Identity Federation
tags_raw:
- Authentication
- Authorization
- Identity Provider
- LDAP
- OAuth
- Open Source
- OpenID Connect
- SAML
- SCIM
- Self-Hosted
- Identity Federation
- Open-Source
url: https://raw.githubusercontent.com/api-evangelist/authentik/refs/heads/main/apis.yml
created: '2026-03-25'
modified: '2026-09-16'
specificationVersion: '0.23'
apis:
- aid: authentik:authentik-core-api
  name: Authentik Core API
  description: Users, groups, applications, tokens, brands, application entitlements and authenticated sessions — the identity
    records and the objects users see.
  humanURL: https://api.goauthentik.io/
  baseURL: https://{authentik_host}/api/v3
  tags:
  - Core
  properties:
  - type: OpenAPI
    url: openapi/authentik-core-api-openapi.yml
  - type: Documentation
    url: https://docs.goauthentik.io/developer-docs/api/
  - type: APIReference
    url: https://api.goauthentik.io/
  - type: SDKs
    url: https://pypi.org/project/authentik-client/
  - type: SDKs
    url: https://www.npmjs.com/package/@goauthentik/api
  - type: GitHubRepository
    url: https://github.com/goauthentik/authentik
  - type: Overlay
    url: overlays/authentik-core-api-overlay.yaml
  - type: Documentation
    url: https://docs.goauthentik.io
- aid: authentik:authentik-crypto-api
  name: Authentik Crypto API
  description: Certificate-key pairs used to sign SAML assertions and OIDC ID tokens, and to validate webhook receivers.
  humanURL: https://api.goauthentik.io/
  baseURL: https://{authentik_host}/api/v3
  tags:
  - Cryptocurrency
  tags_raw:
  - Crypto
  properties:
  - type: OpenAPI
    url: openapi/authentik-crypto-api-openapi.yml
  - type: Documentation
    url: https://docs.goauthentik.io/developer-docs/api/
  - type: APIReference
    url: https://api.goauthentik.io/
  - type: SDKs
    url: https://pypi.org/project/authentik-client/
  - type: SDKs
    url: https://www.npmjs.com/package/@goauthentik/api
  - type: GitHubRepository
    url: https://github.com/goauthentik/authentik
  - type: Overlay
    url: overlays/authentik-crypto-api-overlay.yaml
  - type: Documentation
    url: https://docs.goauthentik.io
- aid: authentik:authentik-events-api
  name: Authentik Events API
  description: Audit events, notification rules and notification transports — including the webhook and Slack transports that
    push authentik events to external receivers.
  humanURL: https://api.goauthentik.io/
  baseURL: https://{authentik_host}/api/v3
  tags:
  - Event
  tags_raw:
  - Events
  properties:
  - type: OpenAPI
    url: openapi/authentik-events-api-openapi.yml
  - type: Documentation
    url: https://docs.goauthentik.io/developer-docs/api/
  - type: APIReference
    url: https://api.goauthentik.io/
  - type: SDKs
    url: https://pypi.org/project/authentik-client/
  - type: SDKs
    url: https://www.npmjs.com/package/@goauthentik/api
  - type: GitHubRepository
    url: https://github.com/goauthentik/authentik
  - type: Overlay
    url: overlays/authentik-events-api-overlay.yaml
  - type: Documentation
    url: https://docs.goauthentik.io
- aid: authentik:authentik-flows-api
  name: Authentik Flows API
  description: Flow instances, flow bindings and the flow executor that drives authentication, enrollment, recovery and unenrollment.
  humanURL: https://api.goauthentik.io/
  baseURL: https://{authentik_host}/api/v3
  tags:
  - Flow
  tags_raw:
  - Flows
  properties:
  - type: OpenAPI
    url: openapi/authentik-flows-api-openapi.yml
  - type: Documentation
    url: https://docs.goauthentik.io/developer-docs/api/
  - type: APIReference
    url: https://api.goauthentik.io/
  - type: SDKs
    url: https://pypi.org/project/authentik-client/
  - type: SDKs
    url: https://www.npmjs.com/package/@goauthentik/api
  - type: GitHubRepository
    url: https://github.com/goauthentik/authentik
  - type: Overlay
    url: overlays/authentik-flows-api-overlay.yaml
  - type: Documentation
    url: https://docs.goauthentik.io
- aid: authentik:authentik-policies-api
  name: Authentik Policies API
  description: Policies and policy bindings — expression, event matcher, GeoIP, password, password expiry, reputation and
    unique-password types.
  humanURL: https://api.goauthentik.io/
  baseURL: https://{authentik_host}/api/v3
  tags:
  - Policies
  properties:
  - type: OpenAPI
    url: openapi/authentik-policies-api-openapi.yml
  - type: Documentation
    url: https://docs.goauthentik.io/developer-docs/api/
  - type: APIReference
    url: https://api.goauthentik.io/
  - type: SDKs
    url: https://pypi.org/project/authentik-client/
  - type: SDKs
    url: https://www.npmjs.com/package/@goauthentik/api
  - type: GitHubRepository
    url: https://github.com/goauthentik/authentik
  - type: Overlay
    url: overlays/authentik-policies-api-overlay.yaml
  - type: Documentation
    url: https://docs.goauthentik.io
- aid: authentik:authentik-providers-api
  name: Authentik Providers API
  description: 'Protocol providers: OAuth2/OIDC, SAML, SCIM, LDAP, RADIUS, Proxy, RAC, WS-Fed, Google Workspace, Microsoft
    Entra and the Shared Signals Framework backchannel.'
  humanURL: https://api.goauthentik.io/
  baseURL: https://{authentik_host}/api/v3
  tags:
  - Providers
  properties:
  - type: OpenAPI
    url: openapi/authentik-providers-api-openapi.yml
  - type: Documentation
    url: https://docs.goauthentik.io/developer-docs/api/
  - type: APIReference
    url: https://api.goauthentik.io/
  - type: SDKs
    url: https://pypi.org/project/authentik-client/
  - type: SDKs
    url: https://www.npmjs.com/package/@goauthentik/api
  - type: GitHubRepository
    url: https://github.com/goauthentik/authentik
  - type: Overlay
    url: overlays/authentik-providers-api-overlay.yaml
  - type: Documentation
    url: https://docs.goauthentik.io
- aid: authentik:authentik-rbac-api
  name: Authentik RBAC API
  description: Role-based access control — roles, global and object-level permissions, and initial permission sets.
  humanURL: https://api.goauthentik.io/
  baseURL: https://{authentik_host}/api/v3
  tags:
  - RBAC
  properties:
  - type: OpenAPI
    url: openapi/authentik-rbac-api-openapi.yml
  - type: Documentation
    url: https://docs.goauthentik.io/developer-docs/api/
  - type: APIReference
    url: https://api.goauthentik.io/
  - type: SDKs
    url: https://pypi.org/project/authentik-client/
  - type: SDKs
    url: https://www.npmjs.com/package/@goauthentik/api
  - type: GitHubRepository
    url: https://github.com/goauthentik/authentik
  - type: Overlay
    url: overlays/authentik-rbac-api-overlay.yaml
  - type: Documentation
    url: https://docs.goauthentik.io
- aid: authentik:authentik-schema-api
  name: Authentik Schema API
  description: The self-describing OpenAPI schema endpoint every authentik instance serves.
  humanURL: https://api.goauthentik.io/
  baseURL: https://{authentik_host}/api/v3
  tags:
  - Schema
  properties:
  - type: OpenAPI
    url: openapi/authentik-schema-api-openapi.yml
  - type: Documentation
    url: https://docs.goauthentik.io/developer-docs/api/
  - type: APIReference
    url: https://api.goauthentik.io/
  - type: SDKs
    url: https://pypi.org/project/authentik-client/
  - type: SDKs
    url: https://www.npmjs.com/package/@goauthentik/api
  - type: GitHubRepository
    url: https://github.com/goauthentik/authentik
  - type: Overlay
    url: overlays/authentik-schema-api-overlay.yaml
  - type: Documentation
    url: https://docs.goauthentik.io
- aid: authentik:authentik-sources-api
  name: Authentik Sources API
  description: External identity sources — LDAP, OAuth, SAML, SCIM, Kerberos, Plex and Telegram — plus their user and group
    connections.
  humanURL: https://api.goauthentik.io/
  baseURL: https://{authentik_host}/api/v3
  tags:
  - Sources
  properties:
  - type: OpenAPI
    url: openapi/authentik-sources-api-openapi.yml
  - type: Documentation
    url: https://docs.goauthentik.io/developer-docs/api/
  - type: APIReference
    url: https://api.goauthentik.io/
  - type: SDKs
    url: https://pypi.org/project/authentik-client/
  - type: SDKs
    url: https://www.npmjs.com/package/@goauthentik/api
  - type: GitHubRepository
    url: https://github.com/goauthentik/authentik
  - type: Overlay
    url: overlays/authentik-sources-api-overlay.yaml
  - type: Documentation
    url: https://docs.goauthentik.io
- aid: authentik:authentik-stages-api
  name: Authentik Stages API
  description: 'Flow stages: identification, password, consent, prompt, email, captcha, mTLS, redirect, user write/login/logout/delete,
    account lockdown and every authenticator setup and validation stage.'
  humanURL: https://api.goauthentik.io/
  baseURL: https://{authentik_host}/api/v3
  tags:
  - Stages
  properties:
  - type: OpenAPI
    url: openapi/authentik-stages-api-openapi.yml
  - type: Documentation
    url: https://docs.goauthentik.io/developer-docs/api/
  - type: APIReference
    url: https://api.goauthentik.io/
  - type: SDKs
    url: https://pypi.org/project/authentik-client/
  - type: SDKs
    url: https://www.npmjs.com/package/@goauthentik/api
  - type: GitHubRepository
    url: https://github.com/goauthentik/authentik
  - type: Overlay
    url: overlays/authentik-stages-api-overlay.yaml
  - type: Documentation
    url: https://docs.goauthentik.io
- aid: authentik:authentik-admin-api
  name: Authentik Admin API
  description: Instance administration — installed apps, models, version, system information, workers and the file storage
    backend.
  humanURL: https://api.goauthentik.io/
  baseURL: https://{authentik_host}/api/v3
  tags:
  - Admin
  tags_raw:
  - admin
  properties:
  - type: OpenAPI
    url: openapi/authentik-admin-api-openapi.yml
  - type: Overlay
    url: overlays/authentik-admin-api-overlay.yaml
  - type: Documentation
    url: https://docs.goauthentik.io
  - type: APIReference
    url: https://api.goauthentik.io/
  - type: SDKs
    url: https://www.npmjs.com/package/@goauthentik/api
  - type: SDKs
    url: https://pypi.org/project/authentik-client/
  - type: GitHubRepository
    url: https://github.com/goauthentik/authentik
- aid: authentik:authentik-agents-api
  name: Authentik Agents API
  description: Agent accounts — service accounts that act on behalf of a parent user when calling the authentik API, with
    expiring tokens and audited delegation.
  humanURL: https://api.goauthentik.io/
  baseURL: https://{authentik_host}/api/v3
  tags:
  - Agents
  tags_raw:
  - agents
  properties:
  - type: OpenAPI
    url: openapi/authentik-agents-api-openapi.yml
  - type: Overlay
    url: overlays/authentik-agents-api-overlay.yaml
  - type: Documentation
    url: https://docs.goauthentik.io
  - type: APIReference
    url: https://api.goauthentik.io/
  - type: SDKs
    url: https://www.npmjs.com/package/@goauthentik/api
  - type: SDKs
    url: https://pypi.org/project/authentik-client/
  - type: GitHubRepository
    url: https://github.com/goauthentik/authentik
- aid: authentik:authentik-authenticators-api
  name: Authentik Authenticators API
  description: Authenticator device management for TOTP, static, WebAuthn, SMS, email, Duo and endpoint devices, from both
    the admin and end-user perspectives.
  humanURL: https://api.goauthentik.io/
  baseURL: https://{authentik_host}/api/v3
  tags:
  - Authenticators
  tags_raw:
  - authenticators
  properties:
  - type: OpenAPI
    url: openapi/authentik-authenticators-api-openapi.yml
  - type: Overlay
    url: overlays/authentik-authenticators-api-overlay.yaml
  - type: Documentation
    url: https://docs.goauthentik.io
  - type: APIReference
    url: https://api.goauthentik.io/
  - type: SDKs
    url: https://www.npmjs.com/package/@goauthentik/api
  - type: SDKs
    url: https://pypi.org/project/authentik-client/
  - type: GitHubRepository
    url: https://github.com/goauthentik/authentik
- aid: authentik:authentik-endpoints-api
  name: Authentik Endpoints API
  description: Endpoint device management — the authentik Agent connectors, device enrollment tokens, device bindings, device
    access groups, Fleet and Google Chrome device-trust connectors, and platform SSO registration.
  humanURL: https://api.goauthentik.io/
  baseURL: https://{authentik_host}/api/v3
  tags: []
  tags_raw:
  - endpoints
  properties:
  - type: OpenAPI
    url: openapi/authentik-endpoints-api-openapi.yml
  - type: Overlay
    url: overlays/authentik-endpoints-api-overlay.yaml
  - type: Documentation
    url: https://docs.goauthentik.io
  - type: APIReference
    url: https://api.goauthentik.io/
  - type: SDKs
    url: https://www.npmjs.com/package/@goauthentik/api
  - type: SDKs
    url: https://pypi.org/project/authentik-client/
  - type: GitHubRepository
    url: https://github.com/goauthentik/authentik
- aid: authentik:authentik-enterprise-api
  name: Authentik Enterprise API
  description: Enterprise licensing — license installation, summary and forecast for a licensed authentik deployment.
  humanURL: https://api.goauthentik.io/
  baseURL: https://{authentik_host}/api/v3
  tags:
  - Enterprise
  tags_raw:
  - enterprise
  properties:
  - type: OpenAPI
    url: openapi/authentik-enterprise-api-openapi.yml
  - type: Overlay
    url: overlays/authentik-enterprise-api-overlay.yaml
  - type: Documentation
    url: https://docs.goauthentik.io
  - type: APIReference
    url: https://api.goauthentik.io/
  - type: SDKs
    url: https://www.npmjs.com/package/@goauthentik/api
  - type: SDKs
    url: https://pypi.org/project/authentik-client/
  - type: GitHubRepository
    url: https://github.com/goauthentik/authentik
- aid: authentik:authentik-lifecycle-api
  name: Authentik Lifecycle API
  description: Identity lifecycle operations, including scheduled user offboarding with session and token revocation and a
    cancellable pending state.
  humanURL: https://api.goauthentik.io/
  baseURL: https://{authentik_host}/api/v3
  tags:
  - Lifecycle
  tags_raw:
  - lifecycle
  properties:
  - type: OpenAPI
    url: openapi/authentik-lifecycle-api-openapi.yml
  - type: Overlay
    url: overlays/authentik-lifecycle-api-overlay.yaml
  - type: Documentation
    url: https://docs.goauthentik.io
  - type: APIReference
    url: https://api.goauthentik.io/
  - type: SDKs
    url: https://www.npmjs.com/package/@goauthentik/api
  - type: SDKs
    url: https://pypi.org/project/authentik-client/
  - type: GitHubRepository
    url: https://github.com/goauthentik/authentik
- aid: authentik:authentik-managed-api
  name: Authentik Managed API
  description: Blueprints — the YAML templates that declare authentik configuration as code, and the blueprint instances that
    apply them.
  humanURL: https://api.goauthentik.io/
  baseURL: https://{authentik_host}/api/v3
  tags:
  - Managed
  tags_raw:
  - managed
  properties:
  - type: OpenAPI
    url: openapi/authentik-managed-api-openapi.yml
  - type: Overlay
    url: overlays/authentik-managed-api-overlay.yaml
  - type: Documentation
    url: https://docs.goauthentik.io
  - type: APIReference
    url: https://api.goauthentik.io/
  - type: SDKs
    url: https://www.npmjs.com/package/@goauthentik/api
  - type: SDKs
    url: https://pypi.org/project/authentik-client/
  - type: GitHubRepository
    url: https://github.com/goauthentik/authentik
- aid: authentik:authentik-outposts-api
  name: Authentik Outposts API
  description: Outpost instances and service connections (Docker, Kubernetes) — the deployable components that run the proxy,
    LDAP and RADIUS providers.
  humanURL: https://api.goauthentik.io/
  baseURL: https://{authentik_host}/api/v3
  tags:
  - Outposts
  tags_raw:
  - outposts
  properties:
  - type: OpenAPI
    url: openapi/authentik-outposts-api-openapi.yml
  - type: Overlay
    url: overlays/authentik-outposts-api-overlay.yaml
  - type: Documentation
    url: https://docs.goauthentik.io
  - type: APIReference
    url: https://api.goauthentik.io/
  - type: SDKs
    url: https://www.npmjs.com/package/@goauthentik/api
  - type: SDKs
    url: https://pypi.org/project/authentik-client/
  - type: GitHubRepository
    url: https://github.com/goauthentik/authentik
- aid: authentik:authentik-propertymappings-api
  name: Authentik Property Mappings API
  description: Property mappings — the expressions that shape claims, attributes and payloads for every provider and source
    type, plus notification webhook bodies.
  humanURL: https://api.goauthentik.io/
  baseURL: https://{authentik_host}/api/v3
  tags:
  - propertymappings
  properties:
  - type: OpenAPI
    url: openapi/authentik-propertymappings-api-openapi.yml
  - type: Overlay
    url: overlays/authentik-propertymappings-api-overlay.yaml
  - type: Documentation
    url: https://docs.goauthentik.io
  - type: APIReference
    url: https://api.goauthentik.io/
  - type: SDKs
    url: https://www.npmjs.com/package/@goauthentik/api
  - type: SDKs
    url: https://pypi.org/project/authentik-client/
  - type: GitHubRepository
    url: https://github.com/goauthentik/authentik
- aid: authentik:authentik-rac-api
  name: Authentik RAC API
  description: Remote Access Control — browser-based RDP, SSH and VNC endpoints and their single-use connection tokens.
  humanURL: https://api.goauthentik.io/
  baseURL: https://{authentik_host}/api/v3
  tags:
  - rac
  properties:
  - type: OpenAPI
    url: openapi/authentik-rac-api-openapi.yml
  - type: Overlay
    url: overlays/authentik-rac-api-overlay.yaml
  - type: Documentation
    url: https://docs.goauthentik.io
  - type: APIReference
    url: https://api.goauthentik.io/
  - type: SDKs
    url: https://www.npmjs.com/package/@goauthentik/api
  - type: SDKs
    url: https://pypi.org/project/authentik-client/
  - type: GitHubRepository
    url: https://github.com/goauthentik/authentik
- aid: authentik:authentik-reports-api
  name: Authentik Reports API
  description: Reporting surface for exportable user and event data.
  humanURL: https://api.goauthentik.io/
  baseURL: https://{authentik_host}/api/v3
  tags:
  - Reports
  tags_raw:
  - reports
  properties:
  - type: OpenAPI
    url: openapi/authentik-reports-api-openapi.yml
  - type: Overlay
    url: overlays/authentik-reports-api-overlay.yaml
  - type: Documentation
    url: https://docs.goauthentik.io
  - type: APIReference
    url: https://api.goauthentik.io/
  - type: SDKs
    url: https://www.npmjs.com/package/@goauthentik/api
  - type: SDKs
    url: https://pypi.org/project/authentik-client/
  - type: GitHubRepository
    url: https://github.com/goauthentik/authentik
- aid: authentik:authentik-requests-api
  name: Authentik Requests API
  description: Privileged access management — access request rules, rule bindings, grant requests, reviewer workflows and
    grant revocation.
  humanURL: https://api.goauthentik.io/
  baseURL: https://{authentik_host}/api/v3
  tags:
  - Requests
  tags_raw:
  - requests
  properties:
  - type: OpenAPI
    url: openapi/authentik-requests-api-openapi.yml
  - type: Overlay
    url: overlays/authentik-requests-api-overlay.yaml
  - type: Documentation
    url: https://docs.goauthentik.io
  - type: APIReference
    url: https://api.goauthentik.io/
  - type: SDKs
    url: https://www.npmjs.com/package/@goauthentik/api
  - type: SDKs
    url: https://pypi.org/project/authentik-client/
  - type: GitHubRepository
    url: https://github.com/goauthentik/authentik
- aid: authentik:authentik-root-api
  name: Authentik Root API
  description: Root configuration endpoint describing the running instance to its own frontend.
  humanURL: https://api.goauthentik.io/
  baseURL: https://{authentik_host}/api/v3
  tags:
  - Root
  tags_raw:
  - root
  properties:
  - type: OpenAPI
    url: openapi/authentik-root-api-openapi.yml
  - type: Overlay
    url: overlays/authentik-root-api-overlay.yaml
  - type: Documentation
    url: https://docs.goauthentik.io
  - type: APIReference
    url: https://api.goauthentik.io/
  - type: SDKs
    url: https://www.npmjs.com/package/@goauthentik/api
  - type: SDKs
    url: https://pypi.org/project/authentik-client/
  - type: GitHubRepository
    url: https://github.com/goauthentik/authentik
- aid: authentik:authentik-ssf-api
  name: Authentik SSF API
  description: OpenID Shared Signals Framework streams — the SSF stream surface a receiving application manages on authentik
    as transmitter of Security Event Tokens.
  humanURL: https://api.goauthentik.io/
  baseURL: https://{authentik_host}/api/v3
  tags:
  - ssf
  properties:
  - type: OpenAPI
    url: openapi/authentik-ssf-api-openapi.yml
  - type: Overlay
    url: overlays/authentik-ssf-api-overlay.yaml
  - type: Documentation
    url: https://docs.goauthentik.io
  - type: APIReference
    url: https://api.goauthentik.io/
  - type: SDKs
    url: https://www.npmjs.com/package/@goauthentik/api
  - type: SDKs
    url: https://pypi.org/project/authentik-client/
  - type: GitHubRepository
    url: https://github.com/goauthentik/authentik
- aid: authentik:authentik-tasks-api
  name: Authentik Tasks API
  description: Background task schedules and runs executed by the authentik worker.
  humanURL: https://api.goauthentik.io/
  baseURL: https://{authentik_host}/api/v3
  tags:
  - Task
  tags_raw:
  - tasks
  properties:
  - type: OpenAPI
    url: openapi/authentik-tasks-api-openapi.yml
  - type: Overlay
    url: overlays/authentik-tasks-api-overlay.yaml
  - type: Documentation
    url: https://docs.goauthentik.io
  - type: APIReference
    url: https://api.goauthentik.io/
  - type: SDKs
    url: https://www.npmjs.com/package/@goauthentik/api
  - type: SDKs
    url: https://pypi.org/project/authentik-client/
  - type: GitHubRepository
    url: https://github.com/goauthentik/authentik
- aid: authentik:authentik-tenants-api
  name: Authentik Tenants API
  description: Multi-tenant administration for deployments running more than one authentik tenant.
  humanURL: https://api.goauthentik.io/
  baseURL: https://{authentik_host}/api/v3
  tags:
  - Tenants
  tags_raw:
  - tenants
  properties:
  - type: OpenAPI
    url: openapi/authentik-tenants-api-openapi.yml
  - type: Overlay
    url: overlays/authentik-tenants-api-overlay.yaml
  - type: Documentation
    url: https://docs.goauthentik.io
  - type: APIReference
    url: https://api.goauthentik.io/
  - type: SDKs
    url: https://www.npmjs.com/package/@goauthentik/api
  - type: SDKs
    url: https://pypi.org/project/authentik-client/
  - type: GitHubRepository
    url: https://github.com/goauthentik/authentik
- aid: authentik:authentik-oauth2-api
  name: Authentik Oauth2 API
  description: The oauth2 API from Authentik — 9 operation(s) for oauth2.
  humanURL: https://api.goauthentik.io/
  baseURL: https://{authentik_host}/api/v3
  tags:
  - Authentication
  tags_raw:
  - oauth2
  properties:
  - type: OpenAPI
    url: openapi/authentik-oauth2-api-openapi.yml
  - type: Documentation
    url: https://docs.goauthentik.io
  - type: APIReference
    url: https://api.goauthentik.io/
  - type: SDKs
    url: https://www.npmjs.com/package/@goauthentik/api
  - type: SDKs
    url: https://pypi.org/project/authentik-client/
  - type: GitHubRepository
    url: https://github.com/goauthentik/authentik
common:
- type: CapabilityMap
  url: capabilities/authentik-capability-edges.yml
  name: Authentik Business Capability Map
- type: Overlay
  url: overlays/authentik-oauth2-api-overlay.yaml
- type: IssueTracker
  url: https://github.com/goauthentik/authentik/issues
- type: SecurityPolicy
  url: https://github.com/goauthentik/authentik/blob/main/SECURITY.md
- type: CodeOfConduct
  url: https://github.com/goauthentik/authentik/blob/main/CODE_OF_CONDUCT.md
- type: ContributionGuide
  url: https://github.com/goauthentik/authentik/blob/main/CONTRIBUTING.md
- type: AgenticAccess
  url: agentic-access/authentik-agentic-access.yml
- type: VulnerabilityDisclosure
  url: security/authentik-vulnerability-disclosure.yml
- type: DomainSecurity
  url: security/authentik-domain-security.yml
- type: Authentication
  url: authentication/authentik-authentication.yml
- type: LinkedIn
  url: https://www.linkedin.com/company/authentik-security
- type: Website
  url: https://goauthentik.io
- type: Documentation
  url: https://docs.goauthentik.io
- type: GitHubOrganization
  url: https://github.com/goauthentik
- type: GitHubRepository
  url: https://github.com/goauthentik/authentik
- type: ChangeLog
  url: https://github.com/goauthentik/authentik/releases
- type: Support
  url: https://github.com/goauthentik/authentik/discussions
- type: Community
  url: https://discord.gg/jg33eMhnj6
- type: Pricing
  url: https://goauthentik.io/pricing
- type: Blog
  url: https://goauthentik.io/blog/rss.xml
- type: Features
  data:
  - name: Comprehensive REST API
    description: Full REST API covering all authentik features with built-in Swagger UI at /api/v3/ on every instance.
  - name: Multi-Protocol Support
    description: Native support for OAuth2, OIDC, SAML, LDAP, SCIM, RADIUS, and SSTP protocols for broad integration coverage.
  - name: Flow Engine
    description: Customizable authentication and enrollment flows with visual flow designer for configuring multi-step authentication
      processes.
  - name: Multi-Language SDKs
    description: Official API client SDKs in TypeScript, Python, Go, Rust, Kotlin, and Swift auto-generated from the OpenAPI
      schema.
  - name: Terraform Provider
    description: Official Terraform provider for infrastructure-as-code management of authentik resources.
  - name: Helm Deployment
    description: Official Helm chart for Kubernetes deployment with configurable replicas, persistence, and external database
      support.
  - name: RBAC
    description: Role-based access control for granular permission management across authentik resources and administrative
      functions.
- type: UseCases
  data:
  - name: Self-Hosted Identity Provider
    description: Deploy a complete identity provider on-premises or in private cloud with full data sovereignty.
  - name: SSO Gateway
    description: Provide single sign-on for all internal applications using OIDC, SAML, or LDAP protocol support.
  - name: B2C Identity
    description: Build customer-facing registration and authentication flows with customizable enrollment and recovery processes.
  - name: Zero Trust Access
    description: Implement zero trust application access with forward auth proxy integration and per-application policies.
- type: Integrations
  data:
  - name: Nginx/Traefik/Caddy
    description: Forward auth integration with major reverse proxies for transparent application authentication.
  - name: Kubernetes
    description: Native Kubernetes deployment via Helm chart with optional operator and RBAC integration.
  - name: LDAP Directory
    description: LDAP outpost that exposes authentik users to LDAP-compatible applications without a directory server.
  - name: Grafana
    description: Native OAuth2 integration with Grafana for unified authentication in monitoring stacks.
  - name: Nextcloud
    description: OIDC or SAML integration with Nextcloud for unified login in self-hosted file storage.
- type: Solutions
  data:
  - name: Self-Hosted IAM
    description: Complete identity and access management platform deployable on any infrastructure with no vendor lock-in.
  - name: Application Gateway
    description: Secure and authenticate any application using forward auth with optional MFA and per-user access policies.
- type: Packages
  url: packages/authentik-packages.yml
- type: SDKs
  url: packages/authentik-packages.yml
- type: WellKnown
  url: well-known/authentik-well-known.yml
- type: SecurityTxt
  url: well-known/authentik-security.txt
- type: LLMsTxt
  url: llms/authentik-llms.txt
- type: Conformance
  url: conformance/authentik-conformance.yml
- type: Compliance
  url: conformance/authentik-conformance.yml
- type: ErrorCatalog
  url: errors/authentik-problem-types.yml
- type: Lifecycle
  url: lifecycle/authentik-lifecycle.yml
- type: StatusPage
  url: https://status.goauthentik.io
- type: Deprecation
  url: lifecycle/authentik-lifecycle.yml
- type: Security
  url: security/authentik-vulnerability-disclosure.yml
- type: Conventions
  url: conventions/authentik-conventions.yml
- type: ChangeLog
  url: changelog/authentik-changelog.yml
- type: CLI
  url: cli/authentik-cli.yml
- type: Components
  url: components/authentik-components.yml
- type: DataModel
  url: data-model/authentik-data-model.yml
- type: Webhooks
  url: asyncapi/authentik-events-webhooks.yml
- type: AgentSkill
  url: skills/_index.yml
- type: Plans
  url: plans/authentik-plans-pricing.yml
- type: RateLimits
  url: rate-limits/authentik-rate-limits.yml
- type: FinOps
  url: finops/authentik-finops.yml
- type: DeveloperPortal
  url: https://docs.goauthentik.io/developer-docs/
- type: APIReference
  url: https://api.goauthentik.io/
- type: GettingStarted
  url: https://docs.goauthentik.io/install-config/
- type: SignUp
  url: https://customers.goauthentik.io
- type: TermsOfService
  url: https://goauthentik.io/legal/terms/
- type: PrivacyPolicy
  url: https://goauthentik.io/legal/privacy-policy/
- type: Integrations
  url: https://integrations.goauthentik.io
x-enrichment:
  date: '2026-09-04'
  status: enriched
  artifacts_added: 75
  pass: local-v3
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com

Work with this as data

Every provider here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for providers

9 MCP tools reach this

find_providersBrowse and filter every provider in the catalog.
get_provider_artifactsEvery artifact this provider publishes, grouped by type.
get_provider_operationsEvery operation across all of their OpenAPIs — one call instead of parsing every spec.
get_provider_toolsEvery MCP tool they ship, with the operation each wraps.
get_provider_evidenceHow each part of their score was established. Free — the basis for a claim should not sit behind it.
get_provider_ratingPRO — composite, band, trend and facet scores.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This provider

curl "https://apis.io/api/v1/providers/authentik"

All providers

curl "https://apis.io/api/v1/providers?limit=25"

Every operation they expose

curl "https://apis.io/api/v1/providers/authentik/operations?limit=25"

How their score was established

curl "https://apis.io/api/v1/providers/authentik/evidence"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.