core_transactional_applications_update

PUT 
/api/v3//core/transactional/applications/

Convert data into a blueprint, validate it and apply it

Request

application/json

Bodyrequired

app objectrequired
Application Serializer
namestringrequired
Application's display Name.
Possible values: non-empty
slugstringrequired
Internal application name, used in URLs.
Possible values: non-empty and <= 50 characters, Value must match regular expression ^[-a-zA-Z0-9_]+$
providerintegernullable
backchannel_providersinteger[]
open_in_new_tabboolean
Open launch URL in a new browser tab or window.
meta_launch_urluri
meta_descriptionstring
meta_publisherstring
policy_engine_modePolicyEngineMode (string)
Possible values: [all, any]
groupstring
provider_modelProviderModelEnum (string)required
Possible values: [authentik_providers_google_workspace.googleworkspaceprovider, authentik_providers_ldap.ldapprovider, authentik_providers_microsoft_entra.microsoftentraprovider, authentik_providers_oauth2.oauth2provider, authentik_providers_proxy.proxyprovider, authentik_providers_rac.racprovider, authentik_providers_radius.radiusprovider, authentik_providers_saml.samlprovider, authentik_providers_scim.scimprovider, authentik_providers_ssf.ssfprovider]
provider objectrequired
provider_model
Possible values: [authentik_providers_google_workspace.googleworkspaceprovider, authentik_providers_ldap.ldapprovider, authentik_providers_microsoft_entra.microsoftentraprovider, authentik_providers_oauth2.oauth2provider, authentik_providers_proxy.proxyprovider, authentik_providers_rac.racprovider, authentik_providers_radius.radiusprovider, authentik_providers_saml.samlprovider, authentik_providers_scim.scimprovider, authentik_providers_ssf.ssfprovider]
authentik_providers_google_workspace.googleworkspaceprovider
namestringrequired
Possible values: non-empty
property_mappingsuuid[]
property_mappings_groupuuid[]
Property mappings used for group creation/updating.
delegated_subjectemailrequired
Possible values: non-empty and <= 254 characters
credentialsrequired
scopesstring
Possible values: non-empty
exclude_users_service_accountboolean
filter_groupuuidnullable
user_delete_actionOutgoingSyncDeleteAction (string)
Possible values: [do_nothing, delete, suspend]
group_delete_actionOutgoingSyncDeleteAction (string)
Possible values: [do_nothing, delete, suspend]
default_group_email_domainstringrequired
Possible values: non-empty
dry_runboolean
When enabled, provider will not modify or create objects in the remote system.
authentik_providers_ldap.ldapprovider
namestringrequired
Possible values: non-empty
authentication_flowuuidnullable
Flow used for authentication when the associated application is accessed by an un-authenticated user.
authorization_flowuuidrequired
Flow used when authorizing this provider.
invalidation_flowuuidrequired
Flow used ending the session from a provider.
property_mappingsuuid[]
base_dnstring
DN under which objects are accessible.
Possible values: non-empty
certificateuuidnullable
tls_server_namestring
uid_start_numberinteger
The start for uidNumbers, this number is added to the user.pk to make sure that the numbers aren't too low for POSIX users. Default is 2000 to ensure that we don't collide with local users uidNumber
Possible values: >= -2147483648 and <= 2147483647
gid_start_numberinteger
The start for gidNumbers, this number is added to a number generated from the group.pk to make sure that the numbers aren't too low for POSIX groups. Default is 4000 to ensure that we don't collide with local groups or users primary groups gidNumber
Possible values: >= -2147483648 and <= 2147483647
search_modeLDAPAPIAccessMode (string)
Possible values: [direct, cached]
bind_modeLDAPAPIAccessMode (string)
Possible values: [direct, cached]
mfa_supportboolean
When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.
authentik_providers_microsoft_entra.microsoftentraprovider
namestringrequired
Possible values: non-empty
property_mappingsuuid[]
property_mappings_groupuuid[]
Property mappings used for group creation/updating.
client_idstringrequired
Possible values: non-empty
client_secretstringrequired
Possible values: non-empty
tenant_idstringrequired
Possible values: non-empty
exclude_users_service_accountboolean
filter_groupuuidnullable
user_delete_actionOutgoingSyncDeleteAction (string)
Possible values: [do_nothing, delete, suspend]
group_delete_actionOutgoingSyncDeleteAction (string)
Possible values: [do_nothing, delete, suspend]
dry_runboolean
When enabled, provider will not modify or create objects in the remote system.
authentik_providers_oauth2.oauth2provider
namestringrequired
Possible values: non-empty
authentication_flowuuidnullable
Flow used for authentication when the associated application is accessed by an un-authenticated user.
authorization_flowuuidrequired
Flow used when authorizing this provider.
invalidation_flowuuidrequired
Flow used ending the session from a provider.
property_mappingsuuid[]
client_typeClientTypeEnum (string)
Confidential clients are capable of maintaining the confidentiality of their credentials. Public clients are incapable
Possible values: [confidential, public]
client_idstring
Possible values: non-empty and <= 255 characters
client_secretstring
Possible values: <= 255 characters
access_code_validitystring
Access codes not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).
Possible values: non-empty
access_token_validitystring
Tokens not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).
Possible values: non-empty
refresh_token_validitystring
Tokens not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).
Possible values: non-empty
include_claims_in_id_tokenboolean
Include User claims from scopes in the id_token, for applications that don't access the userinfo endpoint.
signing_keyuuidnullable
Key used to sign the tokens.
encryption_keyuuidnullable
Key used to encrypt the tokens. When set, tokens will be encrypted and returned as JWEs.
redirect_uris object[]required
Array [
matching_modeMatchingModeEnum (string)required
Possible values: [strict, regex]
urlstringrequired
Possible values: non-empty
]
sub_modeSubModeEnum (string)
Configure what data should be used as unique User Identifier. For most cases, the default should be fine.
Possible values: [hashed_user_id, user_id, user_uuid, user_username, user_email, user_upn]
issuer_modeIssuerModeEnum (string)
Configure how the issuer field of the ID Token should be filled.
Possible values: [global, per_provider]
jwt_federation_sourcesuuid[]
jwt_federation_providersinteger[]
authentik_providers_proxy.proxyprovider
namestringrequired
Possible values: non-empty
authentication_flowuuidnullable
Flow used for authentication when the associated application is accessed by an un-authenticated user.
authorization_flowuuidrequired
Flow used when authorizing this provider.
invalidation_flowuuidrequired
Flow used ending the session from a provider.
property_mappingsuuid[]
internal_hosturi
external_hosturirequired
Possible values: non-empty
internal_host_ssl_validationboolean
Validate SSL Certificates of upstream servers
certificateuuidnullable
skip_path_regexstring
Regular expressions for which authentication is not required. Each new line is interpreted as a new Regular Expression.
basic_auth_enabledSet HTTP-Basic Authentication (boolean)
Set a custom HTTP-Basic Authentication header based on values from authentik.
basic_auth_password_attributeHTTP-Basic Password Key (string)
User/Group Attribute used for the password part of the HTTP-Basic Header.
basic_auth_user_attributeHTTP-Basic Username Key (string)
User/Group Attribute used for the user part of the HTTP-Basic Header. If not set, the user's Email address is used.
modeProxyMode (string)
Enable support for forwardAuth in traefik and nginx auth_request. Exclusive with internal_host.
Possible values: [proxy, forward_single, forward_domain]
intercept_header_authboolean
When enabled, this provider will intercept the authorization header and authenticate requests based on its value.
cookie_domainstring
jwt_federation_sourcesuuid[]
jwt_federation_providersinteger[]
access_token_validitystring
Tokens not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).
Possible values: non-empty
refresh_token_validitystring
Tokens not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).
Possible values: non-empty
authentik_providers_rac.racprovider
namestringrequired
Possible values: non-empty
authentication_flowuuidnullable
Flow used for authentication when the associated application is accessed by an un-authenticated user.
authorization_flowuuidrequired
Flow used when authorizing this provider.
property_mappingsuuid[]
settings
connection_expirystring
Determines how long a session lasts. Default of 0 means that the sessions lasts until the browser is closed. (Format: hours=-1;minutes=-2;seconds=-3)
Possible values: non-empty
delete_token_on_disconnectboolean
When set to true, connection tokens will be deleted upon disconnect.
authentik_providers_radius.radiusprovider
namestringrequired
Possible values: non-empty
authentication_flowuuidnullable
Flow used for authentication when the associated application is accessed by an un-authenticated user.
authorization_flowuuidrequired
Flow used when authorizing this provider.
invalidation_flowuuidrequired
Flow used ending the session from a provider.
property_mappingsuuid[]
client_networksstring
List of CIDRs (comma-separated) that clients can connect from. A more specific CIDR will match before a looser one. Clients connecting from a non-specified CIDR will be dropped.
Possible values: non-empty
shared_secretstring
Shared secret between clients and server to hash packets.
Possible values: non-empty
mfa_supportboolean
When enabled, code-based multi-factor authentication can be used by appending a semicolon and the TOTP code to the password. This should only be enabled if all users that will bind to this provider have a TOTP device configured, as otherwise a password may incorrectly be rejected if it contains a semicolon.
authentik_providers_saml.samlprovider
namestringrequired
Possible values: non-empty
authentication_flowuuidnullable
Flow used for authentication when the associated application is accessed by an un-authenticated user.
authorization_flowuuidrequired
Flow used when authorizing this provider.
invalidation_flowuuidrequired
Flow used ending the session from a provider.
property_mappingsuuid[]
acs_urlurirequired
Possible values: non-empty
audiencestring
Value of the audience restriction field of the assertion. When left empty, no audience restriction will be added.
issuerstring
Also known as EntityID
Possible values: non-empty
assertion_valid_not_beforestring
Assertion valid not before current time + this value (Format: hours=-1;minutes=-2;seconds=-3).
Possible values: non-empty
assertion_valid_not_on_or_afterstring
Assertion not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).
Possible values: non-empty
session_valid_not_on_or_afterstring
Session not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).
Possible values: non-empty
name_id_mappinguuidnullable
Configure how the NameID value will be created. When left empty, the NameIDPolicy of the incoming request will be considered
authn_context_class_ref_mappinguuidnullable
Configure how the AuthnContextClassRef value will be created. When left empty, the AuthnContextClassRef will be set based on which authentication methods the user used to authenticate.
digest_algorithmDigestAlgorithmEnum (string)
Possible values: [http://www.w3.org/2000/09/xmldsig#sha1, http://www.w3.org/2001/04/xmlenc#sha256, http://www.w3.org/2001/04/xmldsig-more#sha384, http://www.w3.org/2001/04/xmlenc#sha512]
signature_algorithmSignatureAlgorithmEnum (string)
Possible values: [http://www.w3.org/2000/09/xmldsig#rsa-sha1, http://www.w3.org/2001/04/xmldsig-more#rsa-sha256, http://www.w3.org/2001/04/xmldsig-more#rsa-sha384, http://www.w3.org/2001/04/xmldsig-more#rsa-sha512, http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1, http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256, http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384, http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512, http://www.w3.org/2000/09/xmldsig#dsa-sha1]
signing_kpuuidnullable
Keypair used to sign outgoing Responses going to the Service Provider.
verification_kpuuidnullable
When selected, incoming assertion's Signatures will be validated against this certificate. To allow unsigned Requests, leave on default.
encryption_kpuuidnullable
When selected, incoming assertions are encrypted by the IdP using the public key of the encryption keypair. The assertion is decrypted by the SP using the the private key.
sign_assertionboolean
sign_responseboolean
sp_bindingService Provider Binding (string)
This determines how authentik sends the response back to the Service Provider.
Possible values: [redirect, post]
default_relay_statestring
Default relay_state value for IDP-initiated logins
authentik_providers_scim.scimprovider
namestringrequired
Possible values: non-empty
property_mappingsuuid[]
property_mappings_groupuuid[]
Property mappings used for group creation/updating.
urlstringrequired
Base URL to SCIM requests, usually ends in /v2
Possible values: non-empty
verify_certificatesboolean
tokenstringrequired
Authentication token
Possible values: non-empty
compatibility_modeSCIM Compatibility Mode (string)
Alter authentik behavior for vendor-specific SCIM implementations.
Possible values: [default, aws, slack]
exclude_users_service_accountboolean
filter_groupuuidnullable
dry_runboolean
When enabled, provider will not modify or create objects in the remote system.
authentik_providers_ssf.ssfprovider
namestringrequired
Possible values: non-empty
signing_keyuuidrequired
Key used to sign the SSF Events.
oidc_auth_providersinteger[]
event_retentionstring
Possible values: non-empty
policy_bindings object[]
Array [
policyuuidnullable
groupuuidnullable
userintegernullable
negateboolean
Negates the outcome of the policy. Messages are unaffected.
enabledboolean
orderintegerrequired
Possible values: >= -2147483648 and <= 2147483647
timeoutinteger
Timeout after which Policy execution is terminated.
Possible values: <= 2147483647
failure_resultboolean
Result if the Policy execution fails.
]

Responses

200

application/json

Schema

Schema

appliedbooleanrequired
logsstring[]required

Example (auto)

{
  "applied": true,
  "logs": [
    "string"
  ]
}

400

application/json

Schema

Schema

non_field_errorsstring[]

codestring

property name*any

Validation Error

Example (auto)

{
  "non_field_errors": [
    "string"
  ],
  "code": "string"
}

403

application/json

Schema

Schema

detailstringrequired
codestring

Example (auto)

{
  "detail": "string",
  "code": "string"
}

Authorization: http

name: authentiktype: httpscheme: bearer

• csharp
• curl
• dart
• go
• http
• java
• javascript
• kotlin
• c
• nodejs
• objective-c
• ocaml
• php
• powershell
• python
• r
• ruby
• rust
• shell
• swift

• HTTPCLIENT
• RESTSHARP

var client = new HttpClient();
var request = new HttpRequestMessage(HttpMethod.Put, "/api/v3/core/transactional/applications/");
request.Headers.Add("Accept", "application/json");
request.Headers.Add("Authorization", "Bearer <token>");
var content = new StringContent("{\n  \"app\": {\n    \"name\": \"string\",\n    \"slug\": \"string\",\n    \"provider\": 0,\n    \"backchannel_providers\": [\n      0\n    ],\n    \"open_in_new_tab\": true,\n    \"meta_launch_url\": \"string\",\n    \"meta_description\": \"string\",\n    \"meta_publisher\": \"string\",\n    \"policy_engine_mode\": \"all\",\n    \"group\": \"string\"\n  },\n  \"provider_model\": \"authentik_providers_google_workspace.googleworkspaceprovider\",\n  \"provider\": {\n    \"name\": \"string\",\n    \"property_mappings\": [\n      \"3fa85f64-5717-4562-b3fc-2c963f66afa6\"\n    ],\n    \"property_mappings_group\": [\n      \"3fa85f64-5717-4562-b3fc-2c963f66afa6\"\n    ],\n    \"delegated_subject\": \"user@example.com\",\n    \"credentials\": {},\n    \"scopes\": \"string\",\n    \"exclude_users_service_account\": true,\n    \"filter_group\": \"3fa85f64-5717-4562-b3fc-2c963f66afa6\",\n    \"user_delete_action\": \"do_nothing\",\n    \"group_delete_action\": \"do_nothing\",\n    \"default_group_email_domain\": \"string\",\n    \"dry_run\": true\n  },\n  \"policy_bindings\": [\n    {\n      \"policy\": \"3fa85f64-5717-4562-b3fc-2c963f66afa6\",\n      \"group\": \"3fa85f64-5717-4562-b3fc-2c963f66afa6\",\n      \"user\": 0,\n      \"negate\": true,\n      \"enabled\": true,\n      \"order\": 0,\n      \"timeout\": 0,\n      \"failure_result\": true\n    }\n  ]\n}", null, "application/json");
request.Content = content;
var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());

Request Collapse all

Base URL

/api/v3

Auth

Bearer Token

Body required

{
  "app": {
    "name": "string",
    "slug": "string",
    "provider": 0,
    "backchannel_providers": [
      0
    ],
    "open_in_new_tab": true,
    "meta_launch_url": "string",
    "meta_description": "string",
    "meta_publisher": "string",
    "policy_engine_mode": "all",
    "group": "string"
  },
  "provider_model": "authentik_providers_google_workspace.googleworkspaceprovider",
  "provider": {
    "name": "string",
    "property_mappings": [
      "3fa85f64-5717-4562-b3fc-2c963f66afa6"
    ],
    "property_mappings_group": [
      "3fa85f64-5717-4562-b3fc-2c963f66afa6"
    ],
    "delegated_subject": "user@example.com",
    "credentials": {},
    "scopes": "string",
    "exclude_users_service_account": true,
    "filter_group": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "user_delete_action": "do_nothing",
    "group_delete_action": "do_nothing",
    "default_group_email_domain": "string",
    "dry_run": true
  },
  "policy_bindings": [
    {
      "policy": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "group": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "user": 0,
      "negate": true,
      "enabled": true,
      "order": 0,
      "timeout": 0,
      "failure_result": true
    }
  ]
}